cc-codeconductor 1.0.0 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-codeconductor",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "A multi-agent orchestration framework for AI-assisted software engineering workflows.",
   "keywords": [
     "ai",
@@ -49,7 +49,10 @@
     "build:lib": "bun build src/index.ts --target=node --outfile=dist/library.js --packages=external",
     "build:types": "tsc -p tsconfig.lib.json --emitDeclarationOnly",
     "test": "bun test",
+    "test:fast": "bun run scripts/test-fast.ts",
     "typecheck": "tsc --noEmit",
+    "lint": "bun run scripts/lint.ts",
+    "check:coverage": "bun run scripts/check-coverage.ts",
     "check:prompt-changelog": "bun run scripts/check-prompt-changelog.ts",
     "release:patch": "bash release.sh patch",
     "release:minor": "bash release.sh minor",

package/presets/agy/AGENTS.md

@@ -80,7 +80,10 @@ Antigravity CLI loads custom slash commands from `.agents/workflows/*.md`. The f
 | `/cc-prototype`  | Disposable spike in an isolated worktree                         |
 | `/cc-handoff`    | Compact the session to `.codeconductor/` Markdown                |
 | `/cc-clarify`    | Re-explain the last deliverable in Task Card vocabulary          |
+| `/cc-backlog`    | Author or append BACKLOG.md and plan OpenSpec change folders   |
+| `/cc-openspec`   | OpenSpec delivery loop from BACKLOG.md                         |
 | `/cc-pagespeed`  | Performs a web performance and Core Web Vitals audit               |
+| `/cc-security`   | Authorized defensive security workflow (authorization gate)   |
 
 ---
 

package/presets/agy/gates/pre-commit/GATE.md

@@ -1,6 +1,6 @@
-# Pre-commit Gate: Typecheck and Test
+# Pre-commit Gate: Typecheck, Lint, and Test
 
-Este gate instala un hook `pre-commit` que ejecuta `bun run typecheck` y `bun run test` antes de permitir commits en el repositorio. Si cualquiera de estos comandos falla, el commit es bloqueado.
+Este gate instala un hook `pre-commit` que ejecuta `bun run typecheck`, `bun run lint` y `bun run test` antes de permitir commits en el repositorio. Si cualquiera de estos comandos falla, el commit es bloqueado.
 
 ## Cuándo usar
 
@@ -63,6 +63,7 @@ mkdir -p "$GIT_DIR/hooks"
 cat > "$HOOK_PATH" << 'HOOK_EOF'
 #!/bin/bash
 bun run typecheck || exit 1
+bun run lint || exit 1
 bun run test || exit 1
 HOOK_EOF
 
@@ -78,7 +79,7 @@ echo "Pre-commit hook installed successfully."
 - **Resolución dinámica de git dir**: Usa `git rev-parse --git-dir` para localizar el directorio correcto, incluso en worktrees.
 - **Detección de conflictos**: Si Husky o lint-staged ya está en `package.json`, el script avisa y no instala para evitar conflictos.
 - **Protección de hooks existentes**: Si ya existe un `.git/hooks/pre-commit`, el script no lo sobrescribe.
-- **Solo Bun**: El hook ejecuta `bun run typecheck` y `bun run test`. Asegúrate de que estos scripts están definidos en `package.json`.
+- **Solo Bun**: El hook ejecuta `bun run typecheck`, `bun run lint` y `bun run test`. Asegúrate de que estos scripts están definidos en `package.json`.
 
 ## Verificación
 
@@ -121,7 +122,7 @@ Verifica que el hook es ejecutable:
 
     chmod +x .git/hooks/pre-commit
 
-Verifica que `bun run typecheck` y `bun run test` existen en `package.json`:
+Verifica que `bun run typecheck`, `bun run lint` y `bun run test` existen en `package.json`:
 
     cat package.json | grep -A 5 '"scripts"'
 

package/presets/agy/skills/backlog/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: backlog
+description: >
+  Author BACKLOG.md and OpenSpec change folders for CodeConductor.
+  Trigger: /cc-backlog, /cc:backlog, creating or appending backlog items,
+  writing BACKLOG.md, or preparing work for /cc-openspec.
+---
+
+# Backlog authoring
+
+Use this skill to **create or append** `BACKLOG.md` and generate OpenSpec
+change docs. Delivery of an existing item is `/cc-openspec` (skill `openspec`).
+
+## BACKLOG.md contract
+
+Canonical template: `presets/templates/BACKLOG.md` (or the installed copy).
+Required sections:
+
+- `## Global` — Product, Strategy, Policy, Review required, TDD required
+- `## Items` — active entries
+- `## Archive` — completed entries (never re-execute; never rewrite)
+
+Each item: `### BC-001 | Short title` with Priority (P0–P3), Status, Type,
+Depends on, Description, Scope, Out of scope, Acceptance (measurable checklist).
+
+Status after grilling: `READY`. `openspec plan` then moves the item to `PLANNED`.
+
+## Create vs append
+
+- **No `BACKLOG.md`:** create it from the template. Set Global `Product` from
+  `package.json` `name` when present.
+- **File exists:** append new `### BC-xxx` blocks under `## Items`. Do not
+  rewrite `## Global` or `## Archive`.
+
+Next ID = max numeric suffix across Items and Archive, plus one, zero-padded
+to three digits (`BC-013` after `BC-012`).
+
+## Wayfinding (before Scope)
+
+If `graphify-out/graph.json` exists, run `graphify query "<objectives>"` (and
+`graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`.
+Scope must name real files or modules. Do not write `BACKLOG.md` in this step.
+
+## Grilling (before write)
+
+Invoke `task-coach`. One grilling question per assumption. Reject vague
+acceptance ("improve UX", "fix bugs"). Criteria must be measurable (same rules
+as `openspec validate` / `VAGUE_ACCEPTANCE`).
+
+Unresolved questions go in `questionsForUser`. Run `ccep evaluate --command
+backlog`. If `stop` is true, **STOP** and wait for the human.
+
+Do not write items until the gate passes.
+
+## Validate loop
+
+After writing:
+
+```bash
+npx cc-codeconductor openspec validate
+```
+
+Local CodeConductor dogfood: `bun run dev openspec validate`.
+
+If invalid: list errors and recommendations, show the canonical structure,
+fix the file, re-validate. Do not plan until valid.
+
+## Plan new items only
+
+For each **new** `BC-xxx` this run:
+
+```bash
+npx cc-codeconductor openspec plan BC-xxx
+```
+
+That writes `openspec/changes/<slug>/` (`proposal.md`, `design.md`, `tasks.md`,
+`specs/`). Then tell the user to run `/cc-openspec` (optionally with the ID).
+
+## Local artifacts — do not version
+
+In consumer projects these paths are gitignored (see `init`):
+
+- `BACKLOG.md`
+- `openspec/`
+- `.codeconductor/openspec-state.json`
+
+Do **not** `git add` them. Do not edit `openspec-state.json` by hand.
+
+## Delivery
+
+Format and state machine: skill `openspec`. Authoring is this skill.

package/presets/agy/skills/openspec/SKILL.md

@@ -2,11 +2,15 @@
 name: openspec
 description:
   OpenSpec backlog format, state machine, and delivery workflow for CodeConductor.
-  Use when running /cc-openspec or editing BACKLOG.md.
+  Use when running /cc-openspec or delivering a BACKLOG.md item.
+  To create or append BACKLOG.md, use /cc-backlog (skill backlog).
 ---
 
 # OpenSpec / BACKLOG Skill
 
+Authoring (create or append `BACKLOG.md`, then `openspec validate` / `plan`) is
+`/cc-backlog` and skill `backlog`. This skill is **delivery**.
+
 ## BACKLOG.md contract
 
 `BACKLOG.md` at repo root is the operational queue. Required sections:

package/presets/agy/skills/security-ai-llm/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-ai-llm
+description: >
+  Harden LLM and agent integrations you operate: prompt injection, tool allowlists, secret leakage, and supply-chain of models. Defensive only.
+---
+
+# AI / LLM Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Treat model output as untrusted; never exec it without a schema
+- Allowlist tools and paths; contain file writes
+- Keep secrets out of prompts and logs
+
+## Do not
+
+- Help jailbreak third-party products or steal model weights
+- Log raw user PII to prompt-debug stores
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-ai-llm`.
+Example prompts:
+
+- `Review our agent tool runner for path traversal and unbounded shell.`
+- `Add tests that a prompt cannot make the bot dump .env.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-blue-team/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-blue-team
+description: >
+  Improve detections, hardening, and response for the estate you defend. Detection-as-code and control design, not offense.
+---
+
+# Blue Team Defense
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Tune detections for true positives; document exceptions
+- Pair every new control with a test or canary
+- Share hunt hypotheses with IR, not with the public internet
+
+## Do not
+
+- Disable EDR or logging to 'reduce noise' without a ticket
+- Copy attacker malware into production 'for training'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-blue-team`.
+Example prompts:
+
+- `We missed a token-replay. Propose a detection plus a unit test for the API gateway.`
+- `Harden CI: pin actions, require reviews on workflows that deploy.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-cloud/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-cloud
+description: >
+  Harden IAM, storage, keys, and org policies in cloud accounts you administer. Focus on identity, logging, and public-exposure controls.
+---
+
+# Cloud Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer roles over long-lived keys; require MFA on human admins
+- Block public buckets and overly broad IAM `*` unless justified
+- Turn on cloud audit logs and retain them per policy
+
+## Do not
+
+- Disable logging or GuardDuty/Security Command Center 'to save cost' without a recorded exception
+- Share account credentials in chat or tickets
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-cloud`.
+Example prompts:
+
+- `Audit this AWS account's IAM: unused keys, admin wildcards, and public S3.`
+- `Write a policy-as-code check that fails CI if a bucket ACL is public.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-crypto/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-crypto
+description: >
+  Choose and review cryptographic usage in your codebase: TLS, hashing, KMS, secret storage. Prefer standard libraries and vetted constructions.
+---
+
+# Applied Cryptography
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use platform TLS and KMS; do not invent protocols
+- Hash passwords with a memory-hard KDF; never roll your own
+- Keep keys out of git; rotate on leak
+
+## Do not
+
+- Recommend ECB, MD5 for security, or home-grown ciphers
+- Ask models to 'break' or weaken crypto for a CTF against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-crypto`.
+Example prompts:
+
+- `Review how we store refresh tokens. Propose KMS envelope encryption and tests.`
+- `Replace SHA-1 password hashes in this legacy module with a modern KDF and a migration plan.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-exploit-dev/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-exploit-dev
+description: >
+  Understand how a confirmed vulnerability in an owned system is triggered so you can patch and test it. This is not exploit development for offense. No payloads, malware, or attack procedures.
+---
+
+# Defensive Exploit Analysis (Authorized)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Describe the bug class (e.g. missing authz) at a design level
+- Write a regression test that fails before the fix and passes after
+- Prefer sanitizers, type systems, and least-privilege patches
+- Stop and refuse if the user asks for a working exploit, PoC payload, or bypass kit
+
+## Do not
+
+- Write exploits, exploit PoCs, shellcode, or weaponized requests
+- Document step-by-step attack procedures against any system
+- Help with CTF flags, cracking, or unauthorized access
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-exploit-dev`.
+Example prompts:
+
+- `We confirmed IDOR on /invoices/:id in our app. Help design the authz check and a RED test — no exploit.`
+- `Turn this crash report from our fuzzer into a defensive patch and a regression test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-grc/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-grc
+description: >
+  Map controls to SOC2, ISO 27001, PCI, or internal policy for the org you work for. Evidence and control design — not audit theater.
+---
+
+# GRC / Compliance Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Map each control to an owner, evidence path, and test
+- Prefer automated evidence (CI, IaC, tickets) over screenshots
+- Record exceptions with expiry dates
+
+## Do not
+
+- Fabricate evidence or backdate approvals
+- Copy another company's policies without legal review
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-grc`.
+Example prompts:
+
+- `Map our GitHub branch protection to SOC2 CC6.6 and list evidence.`
+- `List gaps: secrets in git, missing MFA on GitHub org owners.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-incident-response/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-incident-response
+description: >
+  Coordinate containment, eradication, and recovery for an authorized incident. Preserve evidence, communicate facts, and avoid destructive actions without approval.
+---
+
+# Incident Response
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Follow the org IR plan: detect, contain, eradicate, recover, lessons
+- Preserve logs and disk images before reboot or wipe
+- Redact secrets from tickets and chat
+- Track timeline, systems, and decision-makers
+
+## Do not
+
+- Wipe systems before evidence capture unless imminent ransomware spread is approved
+- Blame individuals in the working notes; stick to systems and facts
+- Reuse attacker tooling from the incident as a 'test'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-incident-response`.
+Example prompts:
+
+- `P1: suspected token theft on api-prod. Draft containment and evidence steps for the IR commander.`
+- `After containment, write the lessons-learned outline and the regression tests we should add.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-log-analysis/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-log-analysis
+description: >
+  Query and interpret security logs you are authorized to read. Build detections and investigations without leaking PII.
+---
+
+# Security Log Analysis
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Minimize PII in saved queries and screenshots
+- Time-box queries; record the query and the index in the ticket
+- Correlate identity, source IP, and resource — not just a single field
+
+## Do not
+
+- Export full production logs to a laptop or public gist
+- Query other customers' tenants in a multi-tenant SaaS
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-log-analysis`.
+Example prompts:
+
+- `Find failed logins then a success from a new country for our IdP (last 24h).`
+- `Explain this CloudTrail burst: is it deploy automation or a key leak?`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-malware-analysis/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-malware-analysis
+description: >
+  Analyze suspicious artifacts in an isolated lab to contain and recover. For incident responders on owned estates. Never write, improve, or distribute malware.
+---
+
+# Defensive Malware Analysis
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Work only in an isolated lab with no production credentials
+- Capture IOCs, family labels, and containment steps for the IR ticket
+- Prefer vendor/sandbox reports plus hash look-ups over sample execution when possible
+
+## Do not
+
+- Write, compile, or 'improve' malware, ransomware, or wipers
+- Share live samples outside the IR chain of custody
+- Give attackers persistence or packing recipes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-malware-analysis`.
+Example prompts:
+
+- `A phishing attachment landed in our sandbox hash X. Summarize likely objectives and containment for IR — do not recreate the sample.`
+- `Translate this EDR alert into a containment checklist for our Windows fleet.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-mobile/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-mobile
+description: >
+  Harden iOS/Android apps you ship: storage, TLS pinning policy, IPC, and backend trust. You still enforce authz on the server.
+---
+
+# Mobile App Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Assume the client is hostile; enforce authz on APIs
+- Review local storage, backup flags, and WebView URLs
+- Pin or constrain TLS per org policy; never ship debug trust-all
+
+## Do not
+
+- Provide IPA/APK cracking or cert-unpinning recipes for others' apps
+- Store long-lived tokens in world-readable prefs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-mobile`.
+Example prompts:
+
+- `Review Android SharedPreferences usage for tokens in this module.`
+- `Check that certificate pinning failures fail closed in release builds.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-network/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-network
+description: >
+  Harden network architecture, segmentation, TLS, and allowlists for systems you operate. Defensive design and review only.
+---
+
+# Network Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer deny-by-default, least privilege, and explicit allowlists
+- Review security groups, NACLs, and mesh policies against the threat model
+- Require TLS with modern ciphers; flag plaintext admin paths
+
+## Do not
+
+- Provide packet-crafting or MITM instructions against third-party networks
+- Open 0.0.0.0/0 'just for debugging' in production
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-network`.
+Example prompts:
+
+- `Review terraform for the prod VPC: public subnets, SG ingress, and admin jump box.`
+- `Propose segmentation between PCI and non-PCI subnets with testable terraform assertions.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`