codymaster 4.5.4 → 4.8.0

package/skills/cm-continuity/SKILL.md

@@ -48,6 +48,25 @@ cm continuity mcp
 
 # Migrate learnings.json + decisions.json → SQLite (one-time)
 cm continuity migrate
+
+# Export SQLite back to JSON (backup)
+cm continuity export
+
+# ── OpenViking backend (optional) ────────────────────────
+# 1. Install OpenViking server (Python 3.10+)
+pip install openviking --upgrade
+
+# 2. Configure ~/.openviking/ov.conf with embedding provider, then start:
+openviking start          # Runs on localhost:1933 by default
+
+# 3. Switch CodyMaster to use OpenViking in .cm/config.yaml:
+#    storage:
+#      backend: viking
+#      viking:
+#        host: localhost
+#        port: 1933
+#        workspace: codymaster
+#        timeout: 60000
 ```
 
 ## The Protocol
@@ -163,15 +182,22 @@ Tier 2: WORKING MEMORY (current session → 7 days)
     · Read via: cm continuity bus | cm_bus_read MCP tool
 
 Tier 3: LONG-TERM MEMORY (30+ days, only if reinforced)
-  → Primary:  .cm/context.db (SQLite + FTS5) ← v5 default
+  → Default:  .cm/context.db (SQLite + FTS5)
       · learnings table + learnings_fts (BM25 keyword search)
       · decisions table + decisions_fts
       · skill_outputs per session/chain
       · indexes table (cached L0/L1 content + staleness hash)
+  → Optional: OpenViking backend (storage.backend: viking in .cm/config.yaml)
+      · True vector semantic search — finds "async timeout" even when you query "network delay"
+      · L0/L1/L2 auto-generated by engine — no manual cm continuity index needed
+      · Session compression + long-term memory extraction built-in
+      · Graph relations between memories (link/unlink)
+      · Setup: pip install openviking && openviking start
   → Fallback: .cm/memory/learnings.json + decisions.json (kept for compat)
   → L0 indexes: .cm/learnings-index.md (~100 tok), .cm/skeleton-index.md (~500 tok)
       · Auto-regenerated on addLearning() + on demand via cm continuity index
       · File watcher auto-refreshes learnings L0 on JSON change (300ms debounce)
+      · With Viking: engine generates L0/L1 automatically — no file watcher needed
   → Token budget: .cm/token-budget.json — 200k window, per-category soft limits
       · Enforced at load time: checkBudget() → allowed/remaining/suggestion
       · View: cm continuity budget
@@ -185,11 +211,12 @@ Tier 5: STRUCTURAL CODE MEMORY (optional — code-heavy projects)
   → See cm-codeintell skill — ONLY when >50 source files
 ```
 
-**CONTINUITY.md  = "what am I doing NOW?"**
-**context bus    = "what did upstream skills produce in this chain?"**
-**L0 indexes     = "cheapest possible memory load (~600 tokens)"**
-**context.db     = "keyword search across all learnings + decisions"**
-**qmd (optional) = "find what was written across hundreds of docs"**
+**CONTINUITY.md      = "what am I doing NOW?"**
+**context bus        = "what did upstream skills produce in this chain?"**
+**L0 indexes         = "cheapest possible memory load (~600 tokens)"**
+**context.db         = "keyword search across all learnings + decisions"**
+**OpenViking (opt.)  = "semantic vector search + auto L0/L1 + session compression"**
+**qmd (optional)     = "find what was written across hundreds of docs"**
 
 ### MCP Context Server (Claude Desktop integration)
 

package/skills/cm-design-studio/SKILL.md

@@ -0,0 +1,30 @@
+# cm-design-studio
+
+> Local design-variant workspace: checklist, named variants, and a handoff stub—no external MCP required.
+
+## When to use
+
+- You want **2–3 UI/UX variants** documented before coding.
+- You need a **repeatable handoff** from design choice to implementation agents.
+- You prefer **files under `.cm/`** over ad-hoc chat-only decisions.
+
+## Steps
+
+1. From the repo root: `cm design-studio init`
+2. Edit `.cm/design-studio/CHECKLIST.md` and `VARIANTS.md` (name options A/B/C).
+3. Pick a variant; complete `.cm/design-studio/HANDOFF.md` (screens, tokens, prompt stub).
+4. Run implementation skills (e.g. `cm-execution`, `cm-tdd`) **using the HANDOFF prompt stub** as the single source of truth.
+
+Optional: `cm design-studio status` — list artifact files.
+
+## Output
+
+- `.cm/design-studio/README.md` — happy path
+- `.cm/design-studio/CHECKLIST.md`
+- `.cm/design-studio/VARIANTS.md`
+- `.cm/design-studio/HANDOFF.md`
+
+## Related
+
+- ADR 003 (`docs/adr/003-skill-distro-and-meta.md`) for pack layout when publishing skills.
+- `cm suggest` may recommend other skills based on git + sprint state.

package/skills/cm-ecosystem-roadmap/SKILL.md

@@ -0,0 +1,11 @@
+# cm-ecosystem-roadmap — marketplace & distros
+
+**In CLI today:** `cm distro validate <dir>` checks skill folder layout; see **ADR 003** (`docs/adr/003-skill-distro-and-meta.md`) for `meta.json` + tmpl rules.
+
+**Backlog** (community scale-out):
+
+- **`cm marketplace`** — starred skills, semver, dependency graph.
+- **`cm install`** / **`cm distro create`** — preset skill packs + branding (SaaS, e-commerce, mobile, agency).
+- **Publish** — npm and/or git tags as distribution channels.
+
+Reuse **meta.json** + `SKILL.md.tmpl` from `scripts/build-skills.mjs` for reproducible skill packages.

package/skills/cm-engineering-meta/SKILL.md

@@ -0,0 +1,69 @@
+# cm-engineering-meta — quick wins + access + voice map
+
+## Search before building
+
+Before adding infrastructure, search in three layers:
+
+1. **Tried-and-true** — patterns already in this repo / sibling services.
+2. **New-and-popular** — current docs for your stack version.
+3. **First-principles** — only when 1–2 don’t apply.
+
+## AskUserQuestion format
+
+When asking the human to choose:
+
+- Short **context** (what you already know).
+- Clear **question**.
+- **RECOMMENDATION** (one option you’d pick and why).
+- Lettered options **A / B / C** (not vague yes/no).
+
+## Review readiness dashboard (ASCII)
+
+Before ship, print a table:
+
+```
+| Gate        | Status | Notes |
+|-------------|--------|-------|
+| Tests       | ?      |       |
+| Lint/Type   | ?      |       |
+| Secrets     | ?      |       |
+| Manual QA   | ?      |       |
+```
+
+## Completeness gap (code review)
+
+Flag when an **80% solution** is chosen but the **100%** path costs **< 30 minutes** (tests, edge case, docs).
+
+## Investigate Iron Law
+
+- Do **not** patch without a **root cause** hypothesis.
+- After **three** failed fix attempts, stop and question architecture or gather more data.
+
+## Access controls (Goose-style)
+
+- Maintain lists: **autonomous_ok** vs **confirm_required** skill groups (see `.cm/config.example.yaml`).
+- Respect “stop suggesting skill X” in session notes.
+
+## Provider abstraction
+
+Prefer interfaces for LLM calls so **cm-second-opinion** can swap `OPENAI_API_KEY` / future providers without rewriting skills.
+
+## Proactive skill suggestion
+
+Infer stage from files touched and git state:
+
+- Many `test/` edits → suggest **cm-test-gate**.
+- `Dockerfile` / deploy scripts → **cm-safe-deploy** + **cm canary**.
+- `rm` / migration scripts → **cm-guardian** + **cm-secret-shield**.
+
+## Voice-friendly triggers (examples)
+
+| Phrase (approx.) | Skill / command |
+|------------------|-----------------|
+| “Run a security check” | cm-secret-shield / cm-security-gate |
+| “Test the website” | cm browse + cm qa-visual |
+| “Code review this” | cm-code-review |
+| “Deploy safely” | cm-safe-deploy |
+| “Log what went wrong” | `cm retro --note "…"` |
+
+Use Whisper / AquaVoice → paste transcript; map keywords to the table above.

package/skills/cm-growth-hacking/SKILL.md

@@ -1,17 +1,6 @@
 ---
 name: cm-growth-hacking
-description: |
-  Growth Hacking Engine — Bottom Sheet + Calendar + Trigger + CRO Tracking.
-  Modular system for booking popups, lead capture, flash sales, surveys, re-engagement.
-  Auto-detect industry → select pattern → generate bottom sheet + calendar CTA + tracking.
-  Zero dependencies, works on any static or dynamic site.
-  
-  Kế thừa và liên kết với: cm-booking-calendar, cm-ads-tracker, cm-google-form, cm-readit, cm-ux-master.
-  
-  ALWAYS trigger for: bottom sheet, popup, đặt lịch, booking popup, lead capture, exit intent,
-  engagement, "tạo popup", "thêm bottom sheet", "popup đặt lịch", "nhắc lịch hẹn",
-  "add to calendar", "google calendar", "apple calendar", flash sale popup, survey popup,
-  "tăng conversion", "giảm bounce", re-engagement, "popup CTA"
+description: "Bottom-sheet and popup growth system: booking CTAs, calendars, lead capture, surveys, re-engagement, with CRO tracking hooks. Zero-deps; works static or dynamic sites. Works with cm-booking-calendar, cm-ads-tracker, cm-google-form, cm-readit, cm-ux-master."
 allowed-tools: Read, Write, Edit, Glob, Grep, Browser
 version: 1.0
 priority: HIGH

package/skills/cm-guardian-runtime/SKILL.md

@@ -0,0 +1,22 @@
+# cm-guardian-runtime — destructive command & freeze checks
+
+## Commands
+
+```bash
+cm guardian check -- git push --force origin main    # exits 1 if blocked
+cm guardian path-check --file ./src/app.ts --roots src,lib
+```
+
+## Behaviour
+
+- Regex set for `rm -rf`, `DROP TABLE`, `git push --force`, `git reset --hard`, pipes to shell, etc.
+- Prefix whitelist includes `npm run build`, `npm test`, `npx vitest`.
+- Violations append to `.cm/guardian.log`.
+
+## Investigate / debug mode
+
+When using **cm-debugging** or root-cause work, treat **freeze roots** as mandatory: only edit inside allowed directories until the hypothesis is proven.
+
+## Config
+
+See `.cm/config.example.yaml` → `guardian:`.

package/skills/cm-mcp-engineering/SKILL.md

@@ -0,0 +1,18 @@
+# cm-mcp-engineering — MCP tools on context server
+
+The same binary as memory MCP (`dist/mcp-context-server.js`) now exposes **engineering bridge** tools:
+
+| Tool | Purpose |
+|------|---------|
+| `cm_plan` | Sprint state + artifact paths + next skill hint |
+| `cm_review` | Preview `.cm/sprint/artifacts/review.md` |
+| `cm_qa` | Pointers to browse daemon + `cm qa-visual` |
+| `cm_deploy` | Hints for safe deploy + canary |
+| `cm_search` | Learnings + decisions search |
+| `cm_memory_query` | Same backing store, alias-style |
+
+Existing tools unchanged: `cm_query`, `cm_resolve`, `cm_bus_read`, `cm_bus_write`, `cm_budget_check`, `cm_memory_decay`, `cm_index_refresh`.
+
+## Config
+
+Point `--project` at the repo root (or `CM_PROJECT_PATH`).

package/skills/cm-notebooklm/SKILL.md

@@ -1,22 +1,6 @@
 ---
 name: cm-notebooklm
-description: |
-  CodyMaster NotebookLM — Cloud-based AI brain/soul engine. Stores the most
-  valuable knowledge (skills, lessons learned, coding experiences, key decisions)
-  into Google NotebookLM for cross-machine sync and AI-powered recall.
-  Combines cm-dockit (codebase → docs) + cm-deep-search (local BM25) +
-  NotebookLM (cloud AI memory + podcast + flashcards).
-
-  Offers LOCAL vs CLOUD choice for large codebases. Auto-sync mechanism.
-  Selective indexing — only high-value content, not everything.
-
-  Use when user says: "notebooklm", "notebook lm", "nlm", "nạp kiến thức",
-  "knowledge base", "create notebook", "sync skills to notebook", "tạo notebook",
-  "knowledge memory", "podcast từ skills", "flashcards từ docs",
-  "add to notebooklm", "query notebooklm", "hỏi notebooklm",
-  "lưu kinh nghiệm", "bộ nhớ AI", "AI memory", "tạo podcast",
-  "codymaster notebook", "skill notebook", "sync knowledge",
-  "cloud brain", "soul sync", "cross-machine sync".
+description: "Sync high-value dev knowledge (skills, decisions, lessons) into Google NotebookLM for cloud recall, podcasts, and flashcards. Pairs with Dockit/deep-search. Use for NotebookLM, nlm, knowledge base, skill sync, or cross-machine AI memory."
 ---
 
 # Goal

package/skills/cm-post-deploy-canary/SKILL.md

@@ -0,0 +1,18 @@
+# cm-post-deploy-canary — smoke + browse tail
+
+## CLI
+
+```bash
+cm canary --url https://app.example.com
+cm canary --url https://app.example.com --browse-port 17395 --token "$CM_BROWSE_TOKEN"
+```
+
+## Flow
+
+1. **HTTP GET** the URL (status < 400).
+2. Optionally pull **browse daemon** `/console` for recent browser errors after deploy.
+
+## Next
+
+- Wire into **cm-safe-deploy** as a final step.
+- Add programmatic CWV (Lighthouse) when you need baselines per PR.

package/skills/cm-qa-visual-cli/SKILL.md

@@ -0,0 +1,18 @@
+# cm-qa-visual-cli — screenshot via browse daemon
+
+## Prerequisites
+
+`cm browse start` running with the same `CM_BROWSE_TOKEN`.
+
+## CLI
+
+```bash
+cm qa-visual --url http://localhost:5173 --port 17395
+```
+
+Writes `cm-qa-visual.png` in the current working directory.
+
+## Next
+
+- Diff against golden images for visual regression.
+- Map `git diff` → affected routes (project-specific heuristics).

package/skills/cm-retro-cli/SKILL.md

@@ -0,0 +1,19 @@
+# cm-retro-cli — operational learnings JSONL
+
+## Append
+
+```bash
+cm retro --project . --tool claude --note "Forgot to run gate before push; CI failed on lint."
+```
+
+Stored in `.cm/operational-learnings.jsonl`.
+
+## Summary
+
+```bash
+cm retro --project . --summary
+```
+
+## Use with skill evolution
+
+Feed highlights into **cm-skill-evolution** / project learnings DB so future sessions avoid repeating mistakes.

package/skills/cm-second-opinion-cli/SKILL.md

@@ -0,0 +1,19 @@
+# cm-second-opinion-cli — cross-model review stub
+
+## CLI
+
+```bash
+cm second-opinion --file /tmp/my.diff
+```
+
+- With `OPENAI_API_KEY`, calls **OpenAI chat completions** (`CM_SECOND_OPINION_MODEL` optional, default `gpt-4o-mini`).
+- Without key, prints a **stub** reminder (no network).
+
+## Safety
+
+- **Never** paste secrets or production credentials into the diff file.
+- Prefer unified diffs of **application code** only.
+
+## Roadmap
+
+Add Anthropic / Google / Ollama providers via shared provider interface (see **cm-engineering-meta**).

package/skills/cm-secret-shield/SKILL.md

@@ -79,8 +79,8 @@ ROTATION is not optional after a leak.
 // ❌ NEVER write code like this:
 const API_KEY = "sk-proj-abc123def456ghi789";
 const SUPABASE_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
-const DB_PASSWORD = "MyP@ssw0rd123!";
-fetch('https://api.example.com', { headers: { Authorization: 'Bearer sk-...' } });
+const DB_PASSWORD = "<YOUR_SECURE_PASSWORD>";
+fetch('https://api.example.com', { headers: { Authorization: 'Bearer <YOUR_TOKEN>' } });
 
 // ✅ ALWAYS write code like this:
 const API_KEY = process.env.API_KEY;

package/skills/cm-sprint-bus/SKILL.md

@@ -0,0 +1,29 @@
+# cm-sprint-bus — opinionated pipeline + artifacts
+
+## Pipeline
+
+`brainstorm → plan → design → tdd → build → review → qa → security → ship → monitor → retro`
+
+## CLI
+
+```bash
+cm sprint init --project .
+cm sprint init --from plan --project .    # jump in mid-pipeline
+cm sprint status --project .
+cm sprint complete plan -m "$(cat plan-notes.md)" --project .
+cm sprint dry-run --project .
+```
+
+## Artifacts
+
+- `.cm/sprint/state.json`
+- `.cm/sprint/artifacts/<step>.md`
+- `.cm/sprint/events.jsonl`
+
+## Skill mapping (hints)
+
+Each step maps to existing CodyMaster skills (see `skillMappingForStep` in `src/sprint-pipeline.ts`). Use `cm sprint status` for the **next** recommended skill.
+
+## Context bus
+
+This complements `.cm/context-bus.json` (skill-chain). Prefer **sprint files** for linear release trains; use **context bus** for ad-hoc chains.

package/skills/cm-start/SKILL.md

@@ -13,12 +13,15 @@ When this workflow is called, the AI Assistant should execute the following acti
     Per `_shared/helpers.md#Load-Working-Memory` — **use Smart Spine order:**
     1. Check `.cm/context-bus.json` → any active pipeline? any prior skill output to reuse?
     2. Load L0 indexes: `learnings-index.md` (~100 tok) + `skeleton-index.md` (~500 tok)
+       > **If OpenViking backend active:** Skip step 2 — engine auto-serves L0/L1 via `cm_resolve`.
     3. Scope-filter learnings via `cm_query` — only load what matches current objective
+       > **If OpenViking:** `cm_query` uses vector semantic search — broader recall, fewer missed learnings.
     4. Read `CONTINUITY.md` → set Active Goal to the new objective
     5. Run token budget check: `cm continuity budget` → confirm no category is over soft limit
 
     > ⚡ Total context load: ~700 tokens. Full load used to be ~3,200.
     > Only escalate to L2 (full files) if L0 index explicitly flags a match.
+    > With OpenViking: L0 is auto-maintained — no stale index risk.
 
 0.5. **Skill Coverage Check (Adaptive Discovery):**
     - Scan the objective for technologies, frameworks, or patterns mentioned
@@ -82,5 +85,11 @@ When this workflow is called, the AI Assistant should execute the following acti
     - Record any new learnings or decisions made during this workflow
     - If inside a skill chain: `cm continuity bus` → verify context bus reflects completed step
     - Refresh L0 indexes: `cm continuity index` (auto-runs on `addLearning`, manual refresh here)
-
-> **Note for AI:** If this is a brand new project, suggest running `cm-project-bootstrap` first. If the working environment has a risk of accidentally switching accounts/projects, remind about `cm-identity-guard` (Per `_shared/helpers.md#Identity-Check`).
+      > **If OpenViking:** Skip manual index refresh — engine maintains L0/L1 automatically.
+
+> **Note for AI:** If this is a brand new project, suggest running `cm-project-bootstrap` first.
+> If the working environment has a risk of accidentally switching accounts/projects, remind about `cm-identity-guard` (Per `_shared/helpers.md#Identity-Check`).
+>
+> **OpenViking tip:** If the project uses many learnings/decisions (>100 entries) or needs semantic
+> search beyond keyword matching, suggest switching to the Viking backend:
+> `storage.backend: viking` in `.cm/config.yaml` + `pip install openviking && openviking start`