ironcode-ai 1.20.1 → 1.20.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +99 -65
  2. package/package.json +6 -6
package/README.md CHANGED
@@ -36,12 +36,26 @@ IronCode is a **high-performance CLI AI coding agent** — a fork of [OpenCode](
36
36
  - 💬 **Chat Integrations** — Control IronCode from Telegram, Discord, or Slack
37
37
  - 💻 **Built-in Terminal** — Fish-style autosuggest, tab completion, syntax highlighting
38
38
  - 📝 **External Editor** — Opens `$EDITOR`/nvim with auto-install if missing
39
- - 🧩 **Built-in Skills** — 9 opinionated slash commands: plan review, code review, QA, ship, retro, and more
39
+ - 🧩 **Built-in Skills** — 13 opinionated slash commands: plan review, code review, QA (web + API), ship, retro, and more
40
+ - 🛡️ **Security** — Prompt injection detection blocks malicious websites from manipulating the AI
40
41
  - 🏠 **100% Local** — No cloud services, works completely offline
41
42
  - ⚡ **Blazing Fast** — Native Rust for all performance-critical operations
42
43
 
43
44
  ---
44
45
 
46
+ ## Security
47
+
48
+ IronCode includes built-in protection against prompt injection attacks when fetching external web content:
49
+
50
+ - **Prompt Injection Detection** — Automatically scans fetched website content for malicious prompts attempting to manipulate the AI
51
+ - **Pattern Recognition** — Detects common attack vectors including instruction manipulation, role changes, context escapes, and delimiter-based attacks
52
+ - **Safe Blocking** — Blocks suspicious content with clear error messages while allowing legitimate websites through
53
+ - **Zero False Positives** — Carefully tuned to avoid blocking normal web content about security topics
54
+
55
+ When the WebFetch tool encounters a website with potential prompt injection content, it will block the request and show an error like: `Content blocked: prompt injection detected - instruction manipulation`
56
+
57
+ ---
58
+
45
59
  ## Installation
46
60
 
47
61
  ### NPM (Recommended)
@@ -100,77 +114,97 @@ ironcode auth login
100
114
 
101
115
  Press **`Ctrl+T`** to cycle between variants:
102
116
 
103
- | Variant | Description |
104
- |---------|-------------|
105
- | `low` | Faster responses, lower cost |
106
- | `medium` | Balanced performance and quality |
107
- | `high 🧠` | Best quality with thinking enabled (default) |
108
- | `thinking 🧠` | Extended reasoning for complex problems |
117
+ | Variant | Description |
118
+ | ------------- | -------------------------------------------- |
119
+ | `low` | Faster responses, lower cost |
120
+ | `medium` | Balanced performance and quality |
121
+ | `high 🧠` | Best quality with thinking enabled (default) |
122
+ | `thinking 🧠` | Extended reasoning for complex problems |
109
123
 
110
124
  ---
111
125
 
112
126
  ## Skills
113
127
 
114
- IronCode ships with **9 built-in skill workflows** — opinionated slash commands that switch the agent into a specialist mode. Instead of one generic assistant, you get: founder, tech lead, paranoid reviewer, release engineer, QA tester, technical writer, and engineering manager.
115
-
116
- | Skill | Mode | What it does |
117
- |-------|------|-------------|
118
- | `/ceo-review` | Founder / CEO | Rethink the problem. Find the 10-star product hiding inside the request. Three modes: Scope Expansion, Hold Scope, Scope Reduction. |
119
- | `/eng-review` | Tech lead | Lock in architecture, data flow, failure modes, edge cases, and test matrix. |
120
- | `/code-review` | Staff engineer | Find bugs that pass CI but blow up in production. Two-pass: critical + informational. |
121
- | `/code-ship` | Release engineer | Merge, test, typecheck, review, changelog, bisectable commits, push, and PR — one command. |
122
- | `/browse` | QA engineer | Headless Chromium via Playwright. Navigate, click, fill forms, screenshot, assert states, test responsive layouts. |
123
- | `/qa` | QA + fix engineer | Test app, find bugs, fix them with atomic commits, re-verify. Four modes: diff-aware, full, quick, regression. |
124
- | `/qa-only` | QA reporter | Report-only QA. Same methodology as `/qa` but never fixes anything. Pure bug report with health score. |
125
- | `/document-release` | Technical writer | Post-ship doc update. Cross-references diff against README, ARCHITECTURE, CONTRIBUTING, CHANGELOG. |
126
- | `/retro` | Engineering manager | Team-aware weekly retro: commit analysis, session detection, per-person praise and growth areas. |
128
+ IronCode ships with **13 built-in skill workflows** — opinionated slash commands that switch the agent into a specialist mode. Instead of one generic assistant, you get: founder, tech lead, TDD coach, debugger, paranoid reviewer, release engineer, QA tester, technical writer, and engineering manager.
129
+
130
+ | Skill | Mode | What it does |
131
+ | ------------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
132
+ | `/ceo-review` | Founder / CEO | Rethink the problem. Find the 10-star product hiding inside the request. Three modes: Scope Expansion, Hold Scope, Scope Reduction. |
133
+ | `/eng-review` | Tech lead | Lock in architecture, data flow, failure modes, edge cases, and test matrix. |
134
+ | `/tdd` | Developer | RED-GREEN-REFACTOR: write a failing test, minimal code to pass, refactor. No production code without a failing test first. |
135
+ | `/debug` | Debugger | Systematic 4-phase debugging: root cause investigation, pattern analysis, hypothesis testing, implementation. 3-fix rule escalates architectural problems. |
136
+ | `/code-review` | Staff engineer | Find bugs that pass CI but blow up in production. Two-pass: critical + informational. |
137
+ | `/verify` | Gatekeeper | Run the command, read the output, then claim the result. Evidence before assertions — no "should work now." |
138
+ | `/code-ship` | Release engineer | Merge, test, typecheck, review, changelog, bisectable commits, push, and PR — one command. |
139
+ | `/browse` | QA engineer | Headless Chromium via Playwright. Navigate, click, fill forms, screenshot, assert states, test responsive layouts. |
140
+ | `/qa` | QA + fix engineer | Test web app, find bugs, fix with atomic commits, re-verify. Four modes: diff-aware, full, quick, regression. |
141
+ | `/qa-only` | QA reporter | Report-only QA. Same methodology as `/qa` but never fixes anything. Pure bug report with health score. |
142
+ | `/qa-api` | API tester | REST & GraphQL API testing. Auto-discovers routes, tests every endpoint with valid/invalid/edge-case payloads, auth, schema validation. |
143
+ | `/document-release` | Technical writer | Post-ship doc update. Cross-references diff against README, ARCHITECTURE, CONTRIBUTING, CHANGELOG. |
144
+ | `/retro` | Engineering manager | Team-aware weekly retro: commit analysis, session detection, per-person praise and growth areas. |
127
145
 
128
146
  ### Workflow
129
147
 
130
- ```
131
- /ceo-review → /eng-review → (code) → /code-review → /code-ship → /qa → /document-release → /retro
132
- product architecture build find bugs land it verify update docs reflect
133
- ```
148
+ ````
149
+ /ceo-review → /eng-review → /tdd → /debug (when stuck) → /code-review → /verify → /code-ship → /qa → /document-release → /retro
150
+ product architecture build fix it right find bugs prove it land it verify update docs reflect
151
+ ```### Example
134
152
 
135
- ### Example
153
+ ````
136
154
 
137
- ```
138
- You: I want to add voice message transcription.
139
- /ceo-review
155
+ You: I want to add voice message transcription.
156
+ /ceo-review
140
157
 
141
158
  IronCode: "Voice transcription" is not the feature. The real job is
142
- letting users code from anywhere — even when they can't type.
159
+ letting users code from anywhere — even when they can't type.
143
160
 
144
161
  A) SCOPE EXPANSION — voice commands, image upload, voice-to-diff
145
162
  B) HOLD SCOPE — transcription only, production-ready
146
163
  C) SCOPE REDUCTION — bare minimum Whisper API call
147
164
 
148
- You: B
165
+ You: B
149
166
 
150
- You: /eng-review
167
+ You: /eng-review
151
168
  IronCode: [Architecture diagram, data flow, failure modes, test matrix]
152
169
 
153
- You: (implement the plan)
154
- You: /code-review
170
+ You: /tdd
171
+ IronCode: RED: Writing test for Whisper API transcription...
172
+ test("transcribes voice message to text") → FAIL ✓
173
+ GREEN: Implementing minimal WhisperService.transcribe()...
174
+ 34/34 tests pass. Committed.
175
+
176
+ You: /debug
177
+ IronCode: Phase 1: Reading error — "ECONNRESET on Whisper API"
178
+ Phase 2: Working example found — image upload uses retry
179
+ Phase 3: Hypothesis — no retry on transient network errors
180
+ Phase 4: Test written, fix applied, verified. ✅
181
+
182
+ You: /code-review
155
183
  IronCode: Missing .catch() on Whisper API — unhandled rejection will crash the bot.
156
184
 
157
- You: (fix it)
158
- You: /code-ship
185
+ You: (fix it)
186
+ You: /verify
187
+ IronCode: $ bun test → 34/34 pass, exit 0
188
+ $ bun check → 0 errors
189
+ All verified. Ready to ship.
190
+
191
+ You: /code-ship
159
192
  IronCode: ✅ Format → typecheck → test → push → PR created
160
193
 
161
- You: /qa http://localhost:3000
194
+ You: /qa http://localhost:3000
162
195
  IronCode: [Screenshots, console check, form test] All pages load. Voice flow works.
163
- Health score: 92/100. 1 medium issue found and fixed.
196
+ Health score: 92/100. 1 medium issue found and fixed.
164
197
 
165
- You: /document-release
198
+ You: /document-release
166
199
  IronCode: README.md: added voice transcription to features table.
167
- CHANGELOG.md: polished voice. All docs up to date.
200
+ CHANGELOG.md: polished voice. All docs up to date.
168
201
 
169
- You: /retro
202
+ You: /retro
170
203
  IronCode: Week of Mar 10: 23 commits, 1.8k LOC, 42% tests, peak: 10pm
171
- Your biggest ship: voice transcription pipeline.
172
- Streak: 12 consecutive days.
173
- ```
204
+ Your biggest ship: voice transcription pipeline.
205
+ Streak: 12 consecutive days.
206
+
207
+ ````
174
208
 
175
209
  ### Custom Skills
176
210
 
@@ -185,7 +219,7 @@ description: What this skill does and when to use it.
185
219
  # Instructions for the agent
186
220
 
187
221
  Your prompt content here...
188
- ```
222
+ ````
189
223
 
190
224
  Skills are automatically discovered — no restart needed.
191
225
 
@@ -199,10 +233,10 @@ Built-in skills are embedded in the IronCode binary. On first run, they are extr
199
233
 
200
234
  Switch between agents with `Tab`:
201
235
 
202
- | Agent | Access | Use for |
203
- |-------|--------|---------|
236
+ | Agent | Access | Use for |
237
+ | --------- | --------------- | ------------------------------------- |
204
238
  | **build** | Full read/write | Development, implementation (default) |
205
- | **plan** | Read-only | Analysis, code exploration, planning |
239
+ | **plan** | Read-only | Analysis, code exploration, planning |
206
240
 
207
241
  ---
208
242
 
@@ -250,17 +284,17 @@ cd packages/slack && bun dev
250
284
 
251
285
  Native Rust components via FFI:
252
286
 
253
- | Operation | Speedup | Notes |
254
- | --------------------- | ---------------------------------- | ---------------------------------------------- |
255
- | PTY/Terminal | **15x faster** | Zero-copy ring buffer |
256
- | Edit Tool | **2–6x faster** | 9 smart replacement strategies |
257
- | Bash Parser | **50–100x faster** | Native tree-sitter vs WASM |
258
- | Archive extraction | **3–5x faster** | s-zip streaming reader |
259
- | Grep search | **90–99% less memory** | Streams GB-sized files |
260
- | File read | **1.5x faster, 99.7% less memory** | 64KB buffer + pre-allocation |
261
- | Git operations | **1.8x faster** | libgit2, no process spawning |
262
- | Permission evaluation | **N× fewer FFI calls** | Entire ruleset in 1 native call |
263
- | File ignore matching | **Faster glob matching** | Compiled `globset` regex |
287
+ | Operation | Speedup | Notes |
288
+ | --------------------- | ---------------------------------- | ------------------------------- |
289
+ | PTY/Terminal | **15x faster** | Zero-copy ring buffer |
290
+ | Edit Tool | **2–6x faster** | 9 smart replacement strategies |
291
+ | Bash Parser | **50–100x faster** | Native tree-sitter vs WASM |
292
+ | Archive extraction | **3–5x faster** | s-zip streaming reader |
293
+ | Grep search | **90–99% less memory** | Streams GB-sized files |
294
+ | File read | **1.5x faster, 99.7% less memory** | 64KB buffer + pre-allocation |
295
+ | Git operations | **1.8x faster** | libgit2, no process spawning |
296
+ | Permission evaluation | **N× fewer FFI calls** | Entire ruleset in 1 native call |
297
+ | File ignore matching | **Faster glob matching** | Compiled `globset` regex |
264
298
 
265
299
  ---
266
300
 
@@ -283,13 +317,13 @@ Native Rust components via FFI:
283
317
  └──────────────────────────────────────────────┘
284
318
  ```
285
319
 
286
- | Layer | Tech | Packages |
287
- |-------|------|----------|
288
- | CLI/TUI | TypeScript + Bun | `packages/ironcode` |
289
- | Native | Rust FFI | `packages/ironcode/native/tool` |
290
- | Telegram | grammy + SDK + Groq Whisper | `@ironcode-ai/telegram` |
291
- | Discord | discord.js + SDK | `@ironcode-ai/discord` |
292
- | Slack | Bolt + SDK | `@ironcode-ai/slack` |
320
+ | Layer | Tech | Packages |
321
+ | -------- | --------------------------- | ------------------------------- |
322
+ | CLI/TUI | TypeScript + Bun | `packages/ironcode` |
323
+ | Native | Rust FFI | `packages/ironcode/native/tool` |
324
+ | Telegram | grammy + SDK + Groq Whisper | `@ironcode-ai/telegram` |
325
+ | Discord | discord.js + SDK | `@ironcode-ai/discord` |
326
+ | Slack | Bolt + SDK | `@ironcode-ai/slack` |
293
327
 
294
328
  ---
295
329
 
package/package.json CHANGED
@@ -6,13 +6,13 @@
6
6
  "scripts": {
7
7
  "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
8
8
  },
9
- "version": "1.20.1",
9
+ "version": "1.20.3",
10
10
  "license": "MIT",
11
11
  "optionalDependencies": {
12
- "ironcode-linux-x64-baseline": "1.20.1",
13
- "ironcode-linux-x64-modern": "1.20.1",
14
- "ironcode-linux-x64-baseline-musl": "1.20.1",
15
- "ironcode-windows-x64-modern": "1.20.1",
16
- "ironcode-darwin-arm64": "1.20.1"
12
+ "ironcode-linux-x64-baseline": "1.20.3",
13
+ "ironcode-linux-x64-modern": "1.20.3",
14
+ "ironcode-linux-x64-baseline-musl": "1.20.3",
15
+ "ironcode-windows-x64-modern": "1.20.3",
16
+ "ironcode-darwin-arm64": "1.20.3"
17
17
  }
18
18
  }