euthyna 0.4.1 → 0.5.0

package/.cursor/commands/euthyna.md

@@ -0,0 +1,14 @@
+# /euthyna — 代码安全审计（判定纪律）
+
+你在 Cursor 中调用本命令。**把审计目标（文件、目录、PR 描述或 diff 范围）用 @ 引用或直接写在命令后面。**
+
+按 euthyna 技能执行一次完整审计：
+
+1. **先加载纪律**：找到 euthyna 技能目录（`~/.cursor/skills/euthyna/`、项目 `.cursor/skills/euthyna/`，或 npm 全局包内的 `.agents/skills/euthyna/`），读 `SKILL.md`，需要时再读 `references/`。找不到就明说「技能缺失」，不要凭印象执行。
+2. **按入口决策树走**：单条漏洞结论 → 阶段 C；一次变更 → 阶段 B；依赖面 → 阶段 A；整体审计 → 阶段 B 为主。
+3. **先测量再读码**：第一条命令跑 `euthyna audit --base <分叉点> --repo <被审计仓库>`（history + deps 一次跑完）；谈测试覆盖再跑 `coverage`（操作手册在 `references/fact-producers.md`）。
+4. **每条结论过六道门禁**：证据到 `文件:行号`、可复现命令、影响说明；拿不出证据的降级为「观察」。
+5. **三态裁定**：`BUG #N TRUE POSITIVE / FALSE POSITIVE / INCONCLUSIVE`。
+6. **报告落盘**：`<项目>_EUTHYNA_AUDIT_<日期>.md`，并跑 `euthyna gate <报告>` 校验（退出码 0 才算过）。
+
+CLI 未安装时先 `npm install -g euthyna`，或每次用 `npx euthyna <子命令> …`。

package/.github/prompts/euthyna.prompt.md

@@ -0,0 +1,16 @@
+---
+description: 代码安全审计：按 euthyna 纪律审一段代码、一次变更或一条漏洞结论，产出带证据的报告
+---
+
+你在 GitHub Copilot（VS Code / CLI）中调用本命令。**把审计目标（文件、目录、PR 描述或 diff 范围）用 #file / #codebase 引用或直接写在命令后面。**
+
+按 euthyna 技能执行一次完整审计：
+
+1. **先加载纪律**：找到 euthyna 技能目录（项目 `.github/skills/euthyna/` 或 `.agents/skills/euthyna/`，个人 `~/.copilot/skills/euthyna/`），读 `SKILL.md`，需要时再读 `references/`。找不到就明说「技能缺失」，不要凭印象执行。
+2. **按入口决策树走**：单条漏洞结论 → 阶段 C；一次变更 → 阶段 B；依赖面 → 阶段 A；整体审计 → 阶段 B 为主。
+3. **先测量再读码**：第一条命令跑 `euthyna audit --base <分叉点> --repo <被审计仓库>`（history + deps 一次跑完）；谈测试覆盖再跑 `coverage`（操作手册在 `references/fact-producers.md`）。
+4. **每条结论过六道门禁**：证据到 `文件:行号`、可复现命令、影响说明；拿不出证据的降级为「观察」。复现命令执行前须向用户报备（见技能「执行纪律」节）。
+5. **三态裁定**：`BUG #N TRUE POSITIVE / FALSE POSITIVE / INCONCLUSIVE`。
+6. **报告落盘**：`<项目>_EUTHYNA_AUDIT_<日期>.md`，并跑 `euthyna gate <报告>` 校验（退出码 0 才算过）。
+
+CLI 未安装时先 `npm install -g euthyna`，或每次用 `npx euthyna <子命令> …`。

package/README.md

@@ -105,7 +105,9 @@ the project is deliberately zero-dependency.
 | **Codex** | The same Markdown layer works; packaging goes through Codex's plugin/marketplace format | Same |
 | **Hermes** | Copy the same folder into `~/.hermes/skills/` under a category folder, or install from a repo with `hermes skills install` — and for the slash command, install the repo as a plugin (see below) | Same |
 | **OpenCode** | Copy the same folder into `~/.agents/skills/` or `~/.config/opencode/skills/` (OpenCode loads both; unknown frontmatter fields are ignored). For a `/euthyna` slash command, copy `.opencode/commands/euthyna.md` into `~/.config/opencode/commands/` — it is a prompt template that tells the model to run the CLI | Same |
-| **OpenClaw** | Copy the same folder into `~/.agents/skills/` (or `<workspace>/.agents/skills/`) — OpenClaw exposes every `user-invocable` skill as a slash command natively, so `/euthyna` works with no extra file | Same |
+| **OpenClaw** | Copy the same folder into `~/.agents/skills/` (or `<workspace>/.agents/skills/`) — OpenClaw exposes every `user-invocable` skill as a slash command natively, so `/euthyna` works with no extra file. Published on ClawHub as [`@modusensus/euthyna`](https://clawhub.ai/modusensus/skills/euthyna) (zh) and [`@modusensus/euthyna-en`](https://clawhub.ai/modusensus/skills/euthyna-en) (en): `clawhub install modusensus/euthyna` | Same |
+| **GitHub Copilot** | Copy the same folder into `.github/skills/` (project), `~/.copilot/skills/` or `~/.agents/skills/` (personal) — Copilot reads all three. For a `/euthyna` prompt, copy `.github/prompts/euthyna.prompt.md` into the same-named folder of your repo or profile. `gh skill` can also install skills from this repository | Same |
+| **Cursor** | Copy the same folder into `.cursor/skills/` (project), `~/.cursor/skills/` (global) — Cursor also reads `.claude/skills/` for compatibility. For a `/euthyna` command, copy `.cursor/commands/euthyna.md` into the matching `commands/` folder (plain Markdown, no frontmatter) | Same |
 | **Any terminal** | — | `npm install -g euthyna`, then `euthyna …` |
 
 The skill ships in two languages. The directory above is the Chinese original (`euthyna`);
@@ -154,6 +156,9 @@ replying in chat.
 | Codex | — | Codex's custom-prompt slash commands (`~/.codex/prompts/`) are deprecated upstream; the same Markdown can still be placed there manually |
 | DSH | `/euthyna` | installed with the plugin; after a restart the command prints the usage manual (DSH slash commands run without reaching the model) |
 | Hermes | `/euthyna <subcommand> <args…>` | install this repository as a Hermes plugin: `hermes plugins install slow-stack/euthyna` then `hermes plugins enable euthyna` (needs Node >= 20 on PATH; the repo root carries `plugin.yaml` + `__init__.py`). The command forwards to the CLI and prints its output without reaching the model. The skill itself can still be installed separately with `hermes skills install slow-stack/euthyna/.agents/skills/euthyna` |
+| OpenCode | `/euthyna <args…>` | copy `.opencode/commands/euthyna.md` into `~/.config/opencode/commands/` or `.opencode/commands/` |
+| GitHub Copilot | `/euthyna <target>` | copy `.github/prompts/euthyna.prompt.md` into `.github/prompts/` (project) or the prompt folder of your profile; available in VS Code and Copilot CLI |
+| Cursor | `/euthyna <target>` | copy `.cursor/commands/euthyna.md` into `.cursor/commands/` (project) or `~/.cursor/commands/` (global); plain Markdown, no frontmatter |
 
 ### How to tell it was euthyna that audited
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "euthyna",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Deterministic fact producers for security auditing: which deleted code came from a security fix, and which changed symbols no test ever executed.",
   "type": "module",
   "main": "./plugin/index.js",
@@ -18,6 +18,8 @@
     ".agents/skills/euthyna-en/",
     ".claude/commands/",
     ".opencode/commands/",
+    ".cursor/commands/",
+    ".github/prompts/",
     "assets/euthyna.png",
     "NOTICE.md"
   ],

package/plugin.yaml

@@ -1,5 +1,5 @@
 name: euthyna
-version: 0.4.1
+version: 0.5.0
 description: euthyna audit discipline — slash commands that drive the euthyna fact-producing CLI (history / coverage / deps / gate)
 license: Apache-2.0
 homepage: https://github.com/slow-stack/euthyna