cc-codeconductor 0.5.0 → 1.1.0

package/presets/opencode/skills/security-threat-hunting/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-threat-hunting
+description: >
+  Hunt for adversary techniques in telemetry you are authorized to query. Hypothesis-driven, evidence-first, no live offensive operations.
+---
+
+# Threat Hunting
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- State a hypothesis (technique + data source + expected artifact)
+- Query only approved telemetry (SIEM, EDR, cloud logs)
+- Promote confirmed hits to IR with timestamps and host identity
+
+## Do not
+
+- Run offensive tooling on production to 'verify' a hunt
+- Query personal mailboxes or systems outside the authorization scope
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-threat-hunting`.
+Example prompts:
+
+- `Hypothesis: stolen refresh tokens in our IdP logs this week. Query patterns and list follow-ups.`
+- `Hunt for unusual service-account key creation in GCP for project X (authorized).`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-vuln-assessment/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-vuln-assessment
+description: >
+  Plan and report authorized vulnerability assessments on owned systems. Prioritize evidence, severity, and remediations. Do not deliver exploit payloads.
+---
+
+# Vulnerability Assessment
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use scanner findings plus code review as evidence, not as a scoreboard
+- Map issues to OWASP / CWE and to a concrete fix in the repo
+- Require a reproduction that is safe (config, unit test, or staging)
+- Track false positives explicitly
+
+## Do not
+
+- Ship exploit PoCs, weaponized payloads, or live attack scripts
+- Scan production without a documented freeze and rollback
+- Mark a finding closed without a failing-then-passing test when code changes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-vuln-assessment`.
+Example prompts:
+
+- `Assess the checkout API in staging (ticket SEC-214). Report exploitable authz gaps as remediations, not exploits.`
+- `Triage SAST results on src/auth and turn confirmed issues into failing tests plus patches.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-web/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-web
+description: >
+  Review and harden web apps (authz, XSS, CSRF, SSRF, injection) on code you maintain. Complements the OWASP `security` skill. No exploit kits.
+---
+
+# Web Application Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Enforce authorization on every handler; never rely on the UI
+- Parameterize queries; reject unknown fields
+- Treat cookies, tokens, and redirects as untrusted until validated
+- Add tests for authz, CSRF, and open redirects when you change those paths
+
+## Do not
+
+- Provide XSS or SQLi payloads for use against systems you do not own
+- Disable CSRF or SameSite 'to make local dev easier' in production configs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-web`.
+Example prompts:
+
+- `Review our Next.js Server Actions for IDOR and CSRF. Propose tests, not exploits.`
+- `Harden the file-upload endpoint: type, size, path containment, and tests.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/seo-hotel/settings.json

@@ -74,20 +74,6 @@
       "Bash(docker compose ps*)",
       "Bash(docker compose logs*)",
       "Read(**)",
-      "Write(./src/**)",
-      "Write(./app/**)",
-      "Write(./pages/**)",
-      "Write(./components/**)",
-      "Write(./lib/**)",
-      "Write(./tests/**)",
-      "Write(./test/**)",
-      "Write(./__tests__/**)",
-      "Write(./prisma/**)",
-      "Write(./drizzle/**)",
-      "Write(./public/**)",
-      "Write(./styles/**)",
-      "Write(./scripts/**)",
-      "Write(./docs/**)",
       "Edit(**)",
       "WebFetch(*)"
     ],
@@ -132,9 +118,6 @@
       "Read(~/.ssh/**)",
       "Read(~/.aws/**)",
       "Read(~/.gnupg/**)",
-      "Write(./.env)",
-      "Write(./.env.*)",
-      "Write(./**/.env)",
       "Edit(./.env)",
       "Edit(./.env.*)",
       "Edit(./**/.env)"

package/src/presets/council/council.yml

@@ -49,6 +49,18 @@ agents:
       - pipelines
       - analytics
 
+  - id: security-reviewer
+    role: Security Reviewer
+    context: repo-readonly
+    modelHint: security-reasoning
+    focus:
+      - security
+      - vulnerabilities
+      - credentials
+      - injection
+      - auth
+      - supply-chain
+
   - id: devil
     role: Devil
     context: repo-readonly

package/src/presets/manifests/agy.yml

@@ -37,8 +37,8 @@ entries:
     dest: .agents/agents
     strategy: overwrite
     template: true
-  - src: opencode/prompts/v0.5.0
-    dest: .agents/prompts/v0.5.0
+  - src: opencode/prompts/v1.0.0
+    dest: .agents/prompts/v1.0.0
     strategy: overwrite
     template: true
 

package/src/presets/manifests/claude.yml

@@ -23,7 +23,7 @@ entries:
     dest: .claude/agents
     strategy: overwrite
     template: true
-  - src: opencode/prompts/v0.5.0
-    dest: .claude/prompts/v0.5.0
+  - src: opencode/prompts/v1.0.0
+    dest: .claude/prompts/v1.0.0
     strategy: overwrite
     template: true

package/src/presets/manifests/codex.yml

@@ -7,7 +7,7 @@ entries:
   - src: codex/skills
     dest: .codex/skills
     strategy: overwrite
-  - src: opencode/prompts/v0.5.0
-    dest: .codex/prompts/v0.5.0
+  - src: opencode/prompts/v1.0.0
+    dest: .codex/prompts/v1.0.0
     strategy: overwrite
     template: true

package/src/presets/manifests/cursor.yml

@@ -20,7 +20,7 @@ entries:
     dest: .cursor/agents
     strategy: overwrite
     template: true
-  - src: opencode/prompts/v0.5.0
-    dest: .cursor/prompts/v0.5.0
+  - src: opencode/prompts/v1.0.0
+    dest: .cursor/prompts/v1.0.0
     strategy: overwrite
     template: true

package/src/presets/manifests/gemini.yml

@@ -4,7 +4,7 @@ entries:
     dest: .gemini/agents
     strategy: overwrite
     template: true
-  - src: opencode/prompts/v0.5.0
-    dest: .gemini/prompts/v0.5.0
+  - src: opencode/prompts/v1.0.0
+    dest: .gemini/prompts/v1.0.0
     strategy: overwrite
     template: true

package/src/presets/manifests/opencode.yml

@@ -15,8 +15,8 @@ entries:
   - src: opencode/commands
     dest: .opencode/commands
     strategy: overwrite
-  - src: opencode/prompts/v0.5.0
-    dest: .opencode/prompts/v0.5.0
+  - src: opencode/prompts/v1.0.0
+    dest: .opencode/prompts/v1.0.0
     strategy: overwrite
     template: true
   - src: opencode/skills

package/src/presets/models/agy.yml

@@ -2,89 +2,117 @@
 target: agy
 agents:
   architect:
-    claude: claude-opus-4-7
+    claude: claude-opus-5
     opencode: opencode-go/deepseek-v4-pro
-    codex: gpt-5.5
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.5
-    agy: gemini-2.5-pro
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-opus-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.1-pro-preview
   implementer:
-    claude: claude-sonnet-4-6
+    claude: claude-sonnet-5
     opencode: opencode-go/mimo-v2.5-pro
-    codex: gpt-5.3-codex
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.3
-    agy: gemini-2.5-flash
+    codex: gpt-5.6-terra
+    gemini: gemini-3.7-flash
+    cursor: composer-2.5-fast
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.7-flash
   tester:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/minimax-m2.7
-    codex: gpt-5.3-codex
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.3
-    agy: gemini-2.5-flash
+    claude: claude-sonnet-5
+    opencode: opencode-go/minimax-m3
+    codex: gpt-5.6-terra
+    gemini: gemini-3.7-flash
+    cursor: composer-2.5-fast
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.7-flash
   orchestrator:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/deepseek-v4-pro
-    codex: gpt-5.2
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.2
-    agy: gemini-2.5-pro
+    claude: claude-sonnet-5
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-terra
+    gemini: gemini-3.7-flash
+    cursor: composer-2.5
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.7-flash
   reviewer:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.4
-    agy: gemini-2.5-pro
+    claude: claude-opus-5
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-sonnet-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.1-pro-preview
   docs:
     claude: claude-haiku-4-5-20251001
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4-mini
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.4-mini
-    agy: gemini-2.5-flash
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: claude-4.5-haiku-thinking
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.7-flash
   task-coach:
     claude: claude-haiku-4-5-20251001
-    opencode: opencode-go/kimi-k2.6
-    codex: gpt-5.4-mini
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.4-mini
-    agy: gemini-2.5-flash
+    opencode: opencode-go/kimi-k2.7-code
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: claude-4.5-haiku-thinking
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.7-flash
   repo-explorer:
     claude: claude-haiku-4-5-20251001
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4-mini
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.4-mini
-    agy: gemini-2.5-flash
+    opencode: opencode-go/deepseek-v4-flash
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: composer-2.5-fast
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.7-flash
   goal-planner:
     claude: claude-haiku-4-5-20251001
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4-mini
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.4-mini
-    agy: gemini-2.5-flash
+    opencode: opencode-go/deepseek-v4-flash
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: claude-4.5-haiku-thinking
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.7-flash
   complexity-auditor:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.4
-    agy: gemini-2.5-pro
+    claude: claude-sonnet-5
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-terra
+    gemini: gemini-3.7-flash
+    cursor: claude-sonnet-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.7-flash
   security-reviewer:
-    claude: claude-opus-4-7
+    claude: claude-opus-5
     opencode: opencode-go/deepseek-v4-pro
-    codex: gpt-5.5
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.5
-    agy: gemini-2.5-pro
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-opus-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.1-pro-preview
   contract-builder:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.4
-    agy: gemini-2.5-pro
+    claude: claude-opus-5
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-sonnet-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.1-pro-preview
+  planner:
+    claude: claude-haiku-4-5-20251001
+    opencode: opencode-go/kimi-k2.7-code
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: claude-4.5-haiku-thinking
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.7-flash
+  devil:
+    claude: claude-opus-5
+    opencode: opencode-go/deepseek-v4-pro
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-opus-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
+    agy: gemini-3.1-pro-preview
 tools:
   Read:
     agy: view_file
@@ -100,4 +128,3 @@ tools:
     agy: grep_search
   WebFetch:
     agy: read_url_content / read_browser_page
-

package/src/presets/models/claude.yml

@@ -4,77 +4,103 @@
 target: claude
 agents:
   architect:
-    claude: claude-opus-4-7
+    claude: claude-opus-5
     opencode: opencode-go/deepseek-v4-pro
-    codex: gpt-5.5
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.5
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-opus-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
   implementer:
-    claude: claude-sonnet-4-6
+    claude: claude-sonnet-5
     opencode: opencode-go/mimo-v2.5-pro
-    codex: gpt-5.3-codex
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.3
+    codex: gpt-5.6-terra
+    gemini: gemini-3.7-flash
+    cursor: composer-2.5-fast
+    grok: cursor-grok-4.6-high-fast
   tester:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/minimax-m2.7
-    codex: gpt-5.3-codex
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.3
+    claude: claude-sonnet-5
+    opencode: opencode-go/minimax-m3
+    codex: gpt-5.6-terra
+    gemini: gemini-3.7-flash
+    cursor: composer-2.5-fast
+    grok: cursor-grok-4.6-high-fast
   orchestrator:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/deepseek-v4-pro
-    codex: gpt-5.2
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.2
+    claude: claude-sonnet-5
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-terra
+    gemini: gemini-3.7-flash
+    cursor: composer-2.5
+    grok: cursor-grok-4.6-high-fast
   reviewer:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.4
+    claude: claude-opus-5
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-sonnet-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
   docs:
     claude: claude-haiku-4-5-20251001
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4-mini
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.4-mini
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: claude-4.5-haiku-thinking
+    grok: cursor-grok-4.6-high-fast
   task-coach:
     claude: claude-haiku-4-5-20251001
-    opencode: opencode-go/kimi-k2.6
-    codex: gpt-5.4-mini
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.4-mini
+    opencode: opencode-go/kimi-k2.7-code
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: claude-4.5-haiku-thinking
+    grok: cursor-grok-4.6-high-fast
   repo-explorer:
     claude: claude-haiku-4-5-20251001
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4-mini
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.4-mini
+    opencode: opencode-go/deepseek-v4-flash
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: composer-2.5-fast
+    grok: cursor-grok-4.6-high-fast
   goal-planner:
     claude: claude-haiku-4-5-20251001
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4-mini
-    gemini: gemini-2.5-flash
-    cursor: gpt-5.4-mini
+    opencode: opencode-go/deepseek-v4-flash
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: claude-4.5-haiku-thinking
+    grok: cursor-grok-4.6-high-fast
   complexity-auditor:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.4
+    claude: claude-sonnet-5
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-terra
+    gemini: gemini-3.7-flash
+    cursor: claude-sonnet-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
   security-reviewer:
-    claude: claude-opus-4-7
+    claude: claude-opus-5
     opencode: opencode-go/deepseek-v4-pro
-    codex: gpt-5.5
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.5
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-opus-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
   contract-builder:
-    claude: claude-sonnet-4-6
-    opencode: opencode-go/qwen3.6-plus
-    codex: gpt-5.4
-    gemini: gemini-2.5-pro
-    cursor: gpt-5.4
+    claude: claude-opus-5
+    opencode: opencode-go/qwen3.7-plus
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-sonnet-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
+  planner:
+    claude: claude-haiku-4-5-20251001
+    opencode: opencode-go/kimi-k2.7-code
+    codex: gpt-5.6-luna
+    gemini: gemini-3.7-flash
+    cursor: claude-4.5-haiku-thinking
+    grok: cursor-grok-4.6-high-fast
+  devil:
+    claude: claude-opus-5
+    opencode: opencode-go/deepseek-v4-pro
+    codex: gpt-5.6-sol
+    gemini: gemini-3.1-pro-preview
+    cursor: claude-opus-5-thinking-high
+    grok: cursor-grok-4.6-high-fast
 tools:
   Read:
     claude: ViewCodeItem / ReadFile