ironcode-ai 1.20.2 → 1.20.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +99 -66
  2. package/package.json +6 -6
package/README.md CHANGED
@@ -36,12 +36,26 @@ IronCode is a **high-performance CLI AI coding agent** — a fork of [OpenCode](
36
36
  - 💬 **Chat Integrations** — Control IronCode from Telegram, Discord, or Slack
37
37
  - 💻 **Built-in Terminal** — Fish-style autosuggest, tab completion, syntax highlighting
38
38
  - 📝 **External Editor** — Opens `$EDITOR`/nvim with auto-install if missing
39
- - 🧩 **Built-in Skills** — 10 opinionated slash commands: plan review, code review, QA (web + API), ship, retro, and more
39
+ - 🧩 **Built-in Skills** — 13 opinionated slash commands: plan review, code review, QA (web + API), ship, retro, and more
40
+ - 🛡️ **Security** — Prompt injection detection blocks malicious websites from manipulating the AI
40
41
  - 🏠 **100% Local** — No cloud services, works completely offline
41
42
  - ⚡ **Blazing Fast** — Native Rust for all performance-critical operations
42
43
 
43
44
  ---
44
45
 
46
+ ## Security
47
+
48
+ IronCode includes built-in protection against prompt injection attacks when fetching external web content:
49
+
50
+ - **Prompt Injection Detection** — Automatically scans fetched website content for malicious prompts attempting to manipulate the AI
51
+ - **Pattern Recognition** — Detects common attack vectors including instruction manipulation, role changes, context escapes, and delimiter-based attacks
52
+ - **Safe Blocking** — Blocks suspicious content with clear error messages while allowing legitimate websites through
53
+ - **Zero False Positives** — Carefully tuned to avoid blocking normal web content about security topics
54
+
55
+ When the WebFetch tool encounters a website with potential prompt injection content, it will block the request and show an error like: `Content blocked: prompt injection detected - instruction manipulation`
56
+
57
+ ---
58
+
45
59
  ## Installation
46
60
 
47
61
  ### NPM (Recommended)
@@ -100,78 +114,97 @@ ironcode auth login
100
114
 
101
115
  Press **`Ctrl+T`** to cycle between variants:
102
116
 
103
- | Variant | Description |
104
- |---------|-------------|
105
- | `low` | Faster responses, lower cost |
106
- | `medium` | Balanced performance and quality |
107
- | `high 🧠` | Best quality with thinking enabled (default) |
108
- | `thinking 🧠` | Extended reasoning for complex problems |
117
+ | Variant | Description |
118
+ | ------------- | -------------------------------------------- |
119
+ | `low` | Faster responses, lower cost |
120
+ | `medium` | Balanced performance and quality |
121
+ | `high 🧠` | Best quality with thinking enabled (default) |
122
+ | `thinking 🧠` | Extended reasoning for complex problems |
109
123
 
110
124
  ---
111
125
 
112
126
  ## Skills
113
127
 
114
- IronCode ships with **10 built-in skill workflows** — opinionated slash commands that switch the agent into a specialist mode. Instead of one generic assistant, you get: founder, tech lead, paranoid reviewer, release engineer, QA tester, technical writer, and engineering manager.
115
-
116
- | Skill | Mode | What it does |
117
- |-------|------|-------------|
118
- | `/ceo-review` | Founder / CEO | Rethink the problem. Find the 10-star product hiding inside the request. Three modes: Scope Expansion, Hold Scope, Scope Reduction. |
119
- | `/eng-review` | Tech lead | Lock in architecture, data flow, failure modes, edge cases, and test matrix. |
120
- | `/code-review` | Staff engineer | Find bugs that pass CI but blow up in production. Two-pass: critical + informational. |
121
- | `/code-ship` | Release engineer | Merge, test, typecheck, review, changelog, bisectable commits, push, and PR — one command. |
122
- | `/browse` | QA engineer | Headless Chromium via Playwright. Navigate, click, fill forms, screenshot, assert states, test responsive layouts. |
123
- | `/qa` | QA + fix engineer | Test web app, find bugs, fix with atomic commits, re-verify. Four modes: diff-aware, full, quick, regression. |
124
- | `/qa-only` | QA reporter | Report-only QA. Same methodology as `/qa` but never fixes anything. Pure bug report with health score. |
125
- | `/qa-api` | API tester | REST & GraphQL API testing. Auto-discovers routes, tests every endpoint with valid/invalid/edge-case payloads, auth, schema validation. |
126
- | `/document-release` | Technical writer | Post-ship doc update. Cross-references diff against README, ARCHITECTURE, CONTRIBUTING, CHANGELOG. |
127
- | `/retro` | Engineering manager | Team-aware weekly retro: commit analysis, session detection, per-person praise and growth areas. |
128
+ IronCode ships with **13 built-in skill workflows** — opinionated slash commands that switch the agent into a specialist mode. Instead of one generic assistant, you get: founder, tech lead, TDD coach, debugger, paranoid reviewer, release engineer, QA tester, technical writer, and engineering manager.
129
+
130
+ | Skill | Mode | What it does |
131
+ | ------------------- | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
132
+ | `/ceo-review` | Founder / CEO | Rethink the problem. Find the 10-star product hiding inside the request. Three modes: Scope Expansion, Hold Scope, Scope Reduction. |
133
+ | `/eng-review` | Tech lead | Lock in architecture, data flow, failure modes, edge cases, and test matrix. |
134
+ | `/tdd` | Developer | RED-GREEN-REFACTOR: write a failing test, minimal code to pass, refactor. No production code without a failing test first. |
135
+ | `/debug` | Debugger | Systematic 4-phase debugging: root cause investigation, pattern analysis, hypothesis testing, implementation. 3-fix rule escalates architectural problems. |
136
+ | `/code-review` | Staff engineer | Find bugs that pass CI but blow up in production. Two-pass: critical + informational. |
137
+ | `/verify` | Gatekeeper | Run the command, read the output, then claim the result. Evidence before assertions — no "should work now." |
138
+ | `/code-ship` | Release engineer | Merge, test, typecheck, review, changelog, bisectable commits, push, and PR — one command. |
139
+ | `/browse` | QA engineer | Headless Chromium via Playwright. Navigate, click, fill forms, screenshot, assert states, test responsive layouts. |
140
+ | `/qa` | QA + fix engineer | Test web app, find bugs, fix with atomic commits, re-verify. Four modes: diff-aware, full, quick, regression. |
141
+ | `/qa-only` | QA reporter | Report-only QA. Same methodology as `/qa` but never fixes anything. Pure bug report with health score. |
142
+ | `/qa-api` | API tester | REST & GraphQL API testing. Auto-discovers routes, tests every endpoint with valid/invalid/edge-case payloads, auth, schema validation. |
143
+ | `/document-release` | Technical writer | Post-ship doc update. Cross-references diff against README, ARCHITECTURE, CONTRIBUTING, CHANGELOG. |
144
+ | `/retro` | Engineering manager | Team-aware weekly retro: commit analysis, session detection, per-person praise and growth areas. |
128
145
 
129
146
  ### Workflow
130
147
 
131
- ```
132
- /ceo-review → /eng-review → (code) → /code-review → /code-ship → /qa → /document-release → /retro
133
- product architecture build find bugs land it verify update docs reflect
134
- ```
148
+ ````
149
+ /ceo-review → /eng-review → /tdd → /debug (when stuck) → /code-review → /verify → /code-ship → /qa → /document-release → /retro
150
+ product architecture build fix it right find bugs prove it land it verify update docs reflect
151
+ ```### Example
135
152
 
136
- ### Example
153
+ ````
137
154
 
138
- ```
139
- You: I want to add voice message transcription.
140
- /ceo-review
155
+ You: I want to add voice message transcription.
156
+ /ceo-review
141
157
 
142
158
  IronCode: "Voice transcription" is not the feature. The real job is
143
- letting users code from anywhere — even when they can't type.
159
+ letting users code from anywhere — even when they can't type.
144
160
 
145
161
  A) SCOPE EXPANSION — voice commands, image upload, voice-to-diff
146
162
  B) HOLD SCOPE — transcription only, production-ready
147
163
  C) SCOPE REDUCTION — bare minimum Whisper API call
148
164
 
149
- You: B
165
+ You: B
150
166
 
151
- You: /eng-review
167
+ You: /eng-review
152
168
  IronCode: [Architecture diagram, data flow, failure modes, test matrix]
153
169
 
154
- You: (implement the plan)
155
- You: /code-review
170
+ You: /tdd
171
+ IronCode: RED: Writing test for Whisper API transcription...
172
+ test("transcribes voice message to text") → FAIL ✓
173
+ GREEN: Implementing minimal WhisperService.transcribe()...
174
+ 34/34 tests pass. Committed.
175
+
176
+ You: /debug
177
+ IronCode: Phase 1: Reading error — "ECONNRESET on Whisper API"
178
+ Phase 2: Working example found — image upload uses retry
179
+ Phase 3: Hypothesis — no retry on transient network errors
180
+ Phase 4: Test written, fix applied, verified. ✅
181
+
182
+ You: /code-review
156
183
  IronCode: Missing .catch() on Whisper API — unhandled rejection will crash the bot.
157
184
 
158
- You: (fix it)
159
- You: /code-ship
185
+ You: (fix it)
186
+ You: /verify
187
+ IronCode: $ bun test → 34/34 pass, exit 0
188
+ $ bun check → 0 errors
189
+ All verified. Ready to ship.
190
+
191
+ You: /code-ship
160
192
  IronCode: ✅ Format → typecheck → test → push → PR created
161
193
 
162
- You: /qa http://localhost:3000
194
+ You: /qa http://localhost:3000
163
195
  IronCode: [Screenshots, console check, form test] All pages load. Voice flow works.
164
- Health score: 92/100. 1 medium issue found and fixed.
196
+ Health score: 92/100. 1 medium issue found and fixed.
165
197
 
166
- You: /document-release
198
+ You: /document-release
167
199
  IronCode: README.md: added voice transcription to features table.
168
- CHANGELOG.md: polished voice. All docs up to date.
200
+ CHANGELOG.md: polished voice. All docs up to date.
169
201
 
170
- You: /retro
202
+ You: /retro
171
203
  IronCode: Week of Mar 10: 23 commits, 1.8k LOC, 42% tests, peak: 10pm
172
- Your biggest ship: voice transcription pipeline.
173
- Streak: 12 consecutive days.
174
- ```
204
+ Your biggest ship: voice transcription pipeline.
205
+ Streak: 12 consecutive days.
206
+
207
+ ````
175
208
 
176
209
  ### Custom Skills
177
210
 
@@ -186,7 +219,7 @@ description: What this skill does and when to use it.
186
219
  # Instructions for the agent
187
220
 
188
221
  Your prompt content here...
189
- ```
222
+ ````
190
223
 
191
224
  Skills are automatically discovered — no restart needed.
192
225
 
@@ -200,10 +233,10 @@ Built-in skills are embedded in the IronCode binary. On first run, they are extr
200
233
 
201
234
  Switch between agents with `Tab`:
202
235
 
203
- | Agent | Access | Use for |
204
- |-------|--------|---------|
236
+ | Agent | Access | Use for |
237
+ | --------- | --------------- | ------------------------------------- |
205
238
  | **build** | Full read/write | Development, implementation (default) |
206
- | **plan** | Read-only | Analysis, code exploration, planning |
239
+ | **plan** | Read-only | Analysis, code exploration, planning |
207
240
 
208
241
  ---
209
242
 
@@ -251,17 +284,17 @@ cd packages/slack && bun dev
251
284
 
252
285
  Native Rust components via FFI:
253
286
 
254
- | Operation | Speedup | Notes |
255
- | --------------------- | ---------------------------------- | ---------------------------------------------- |
256
- | PTY/Terminal | **15x faster** | Zero-copy ring buffer |
257
- | Edit Tool | **2–6x faster** | 9 smart replacement strategies |
258
- | Bash Parser | **50–100x faster** | Native tree-sitter vs WASM |
259
- | Archive extraction | **3–5x faster** | s-zip streaming reader |
260
- | Grep search | **90–99% less memory** | Streams GB-sized files |
261
- | File read | **1.5x faster, 99.7% less memory** | 64KB buffer + pre-allocation |
262
- | Git operations | **1.8x faster** | libgit2, no process spawning |
263
- | Permission evaluation | **N× fewer FFI calls** | Entire ruleset in 1 native call |
264
- | File ignore matching | **Faster glob matching** | Compiled `globset` regex |
287
+ | Operation | Speedup | Notes |
288
+ | --------------------- | ---------------------------------- | ------------------------------- |
289
+ | PTY/Terminal | **15x faster** | Zero-copy ring buffer |
290
+ | Edit Tool | **2–6x faster** | 9 smart replacement strategies |
291
+ | Bash Parser | **50–100x faster** | Native tree-sitter vs WASM |
292
+ | Archive extraction | **3–5x faster** | s-zip streaming reader |
293
+ | Grep search | **90–99% less memory** | Streams GB-sized files |
294
+ | File read | **1.5x faster, 99.7% less memory** | 64KB buffer + pre-allocation |
295
+ | Git operations | **1.8x faster** | libgit2, no process spawning |
296
+ | Permission evaluation | **N× fewer FFI calls** | Entire ruleset in 1 native call |
297
+ | File ignore matching | **Faster glob matching** | Compiled `globset` regex |
265
298
 
266
299
  ---
267
300
 
@@ -284,13 +317,13 @@ Native Rust components via FFI:
284
317
  └──────────────────────────────────────────────┘
285
318
  ```
286
319
 
287
- | Layer | Tech | Packages |
288
- |-------|------|----------|
289
- | CLI/TUI | TypeScript + Bun | `packages/ironcode` |
290
- | Native | Rust FFI | `packages/ironcode/native/tool` |
291
- | Telegram | grammy + SDK + Groq Whisper | `@ironcode-ai/telegram` |
292
- | Discord | discord.js + SDK | `@ironcode-ai/discord` |
293
- | Slack | Bolt + SDK | `@ironcode-ai/slack` |
320
+ | Layer | Tech | Packages |
321
+ | -------- | --------------------------- | ------------------------------- |
322
+ | CLI/TUI | TypeScript + Bun | `packages/ironcode` |
323
+ | Native | Rust FFI | `packages/ironcode/native/tool` |
324
+ | Telegram | grammy + SDK + Groq Whisper | `@ironcode-ai/telegram` |
325
+ | Discord | discord.js + SDK | `@ironcode-ai/discord` |
326
+ | Slack | Bolt + SDK | `@ironcode-ai/slack` |
294
327
 
295
328
  ---
296
329
 
package/package.json CHANGED
@@ -6,13 +6,13 @@
6
6
  "scripts": {
7
7
  "postinstall": "bun ./postinstall.mjs || node ./postinstall.mjs"
8
8
  },
9
- "version": "1.20.2",
9
+ "version": "1.20.4",
10
10
  "license": "MIT",
11
11
  "optionalDependencies": {
12
- "ironcode-linux-x64-baseline": "1.20.2",
13
- "ironcode-linux-x64-modern": "1.20.2",
14
- "ironcode-linux-x64-baseline-musl": "1.20.2",
15
- "ironcode-windows-x64-modern": "1.20.2",
16
- "ironcode-darwin-arm64": "1.20.2"
12
+ "ironcode-linux-x64-baseline": "1.20.4",
13
+ "ironcode-linux-x64-modern": "1.20.4",
14
+ "ironcode-linux-x64-baseline-musl": "1.20.4",
15
+ "ironcode-windows-x64-modern": "1.20.4",
16
+ "ironcode-darwin-arm64": "1.20.4"
17
17
  }
18
18
  }