kc-beta 0.6.2 → 0.7.0

package/src/agent/tools/phase-advance.js

@@ -104,10 +104,25 @@ export class PhaseAdvanceTool extends BaseTool {
       return new ToolResult(`Advanced${beforePhase ? ` from ${beforePhase}` : ""} to ${to}${input.force ? " (forced)" : ""}`);
     }
 
-    // Truly refused — non-adjacent transition without force, or terminal-phase
-    // forward attempt. Give the actionable hint.
+    // Truly refused — possible reasons: non-adjacent transition,
+    // terminal-phase forward attempt, or hard-tracking gate (source phase's
+    // exit criteria not met by engine telemetry).
+    //
+    // v0.7.0 A3: refusal text no longer advertises `force:true`. E2E #5
+    // showed every conductor reading the old refusal hint and force-bypassing
+    // immediately (12/12 transitions). The escape valve remains in the input
+    // schema (discoverable) but isn't hand-fed to the LLM here. Instead,
+    // direct the agent at the missing milestones it can satisfy.
     return new ToolResult(
-      `Did not advance to ${to}. Transition is non-adjacent${beforePhase ? ` (currently in ${beforePhase})` : ""} — set force:true to override, or advance to the immediate-next phase first.`,
+      `Did not advance to ${to} (currently in ${beforePhase || "?"}). ` +
+      `Likely cause: source-phase exit criteria not met. ` +
+      `Run /status (or read the phase describeState block in this turn's system reminder) ` +
+      `to see which milestones are missing, then produce the disk artifacts that satisfy them — ` +
+      `the engine derives milestones from filesystem facts (rule_skills/<id>/SKILL.md, check.py, ` +
+      `workflows/<id>/*.py, output/results/*.json, etc.). ` +
+      `If the transition is non-adjacent or this phase truly is done despite the gate, ` +
+      `re-call with the documented schema flag. The engine logged the precise reason in ` +
+      `events.jsonl as 'phase_advance_refused'.`,
       false,
     );
   }

package/src/agent/tools/release.js

@@ -151,8 +151,23 @@ export class ReleaseTool extends BaseTool {
     }
 
     if (ruleEntries.length === 0) {
+      // v0.7.0 #98: actionable error. The previous "no workflows found
+      // for any selected rule" message left agents confused (E2E #5 GLM
+      // dismissed it with "不影响系统功能" and shipped anyway, with a
+      // broken bundle). Spell out the canonical layout, the accepted
+      // alternatives, and where the agent's actual files are.
       return new ToolResult(
-        `no workflows found for any selected rule. Missing: ${missingWorkflows.join(", ")}`,
+        `Release tool found no workflows for the selected rules.\n\n` +
+        `Missing: ${missingWorkflows.slice(0, 10).join(", ")}` +
+        (missingWorkflows.length > 10 ? ` (+ ${missingWorkflows.length - 10} more)` : "") + "\n\n" +
+        `Accepted layouts (release tool checks all three):\n` +
+        `  workflows/<ruleId>/workflow_v1.py    (canonical)\n` +
+        `  workflows/<ruleId>_workflow.py       (flat)\n` +
+        `  workflows/<ruleId>.json              (regex_skill manifest with .entry path)\n\n` +
+        `If your workflow files exist under a different layout, either ` +
+        `relocate them or write a workflows/<ruleId>.json manifest pointing ` +
+        `at the actual file. Do NOT ship the release without workflows — ` +
+        `the run.py harness needs them at runtime.`,
         true,
       );
     }
@@ -251,15 +266,42 @@ export class ReleaseTool extends BaseTool {
   }
 
   _findLatestWorkflow(ruleId) {
+    // Canonical: workflows/<ruleId>/workflow_v#.py (subdirectory layout)
     const wfDir = path.join(this._workspace.cwd, "workflows", ruleId);
-    if (!fs.existsSync(wfDir) || !fs.statSync(wfDir).isDirectory()) return null;
-    const entries = fs.readdirSync(wfDir).sort();
-    const versioned = entries.filter((f) => /^workflow_v\d+\.py$/.test(f));
-    if (versioned.length > 0) return path.join(wfDir, versioned[versioned.length - 1]);
-    const any = entries.find((f) => f.endsWith(".py") && f.toLowerCase().includes("workflow"));
-    if (any) return path.join(wfDir, any);
-    const py = entries.find((f) => f.endsWith(".py"));
-    return py ? path.join(wfDir, py) : null;
+    if (fs.existsSync(wfDir) && fs.statSync(wfDir).isDirectory()) {
+      const entries = fs.readdirSync(wfDir).sort();
+      const versioned = entries.filter((f) => /^workflow_v\d+\.py$/.test(f));
+      if (versioned.length > 0) return path.join(wfDir, versioned[versioned.length - 1]);
+      const any = entries.find((f) => f.endsWith(".py") && f.toLowerCase().includes("workflow"));
+      if (any) return path.join(wfDir, any);
+      const py = entries.find((f) => f.endsWith(".py"));
+      if (py) return path.join(wfDir, py);
+    }
+
+    // v0.7.0 #98: fall back to flat layouts seen in E2E #5 — both DS
+    // and GLM produced workflows that release.js's strict per-dir check
+    // missed. Accept these so the release tool actually packages the
+    // agent's work instead of returning "no workflows found".
+    const flatRoot = path.join(this._workspace.cwd, "workflows");
+    if (fs.existsSync(flatRoot)) {
+      // GLM-style flat: workflows/R001_workflow.py
+      const flat = path.join(flatRoot, `${ruleId}_workflow.py`);
+      if (fs.existsSync(flat) && fs.statSync(flat).isFile()) return flat;
+      // DS-style manifest: workflows/R001.json (regex_skill pointer)
+      const manifest = path.join(flatRoot, `${ruleId}.json`);
+      if (fs.existsSync(manifest) && fs.statSync(manifest).isFile()) {
+        try {
+          const data = JSON.parse(fs.readFileSync(manifest, "utf-8"));
+          if (data?.entry) {
+            const entryPath = path.isAbsolute(data.entry)
+              ? data.entry
+              : path.join(this._workspace.cwd, data.entry);
+            if (fs.existsSync(entryPath)) return entryPath;
+          }
+        } catch { /* manifest unreadable; skip */ }
+      }
+    }
+    return null;
   }
 
   _resolveFixture(rel) {

package/src/agent/tools/rule-catalog.js

@@ -56,7 +56,17 @@ export class RuleCatalogTool extends BaseTool {
   constructor(workspace) {
     super();
     this._workspace = workspace;
-    this._catalogPath = path.join(workspace.cwd, "rules", "catalog.json");
+    // v0.6.3: do NOT cache the absolute path here. engine.renameSession()
+    // moves the workspace dir via fs.renameSync and updates this._workspace.cwd
+    // via Workspace.rename(), but tool instances live in the registry and
+    // never see the cascade — a cached _catalogPath would keep writing to the
+    // pre-rename absolute path, mkdir-recreating the orphaned directory and
+    // stranding all rule_catalog state. Resolve on every call instead.
+  }
+
+  /** Always read workspace.cwd at call time so /rename is followed. */
+  get _catalogPath() {
+    return path.join(this._workspace.cwd, "rules", "catalog.json");
   }
 
   get name() { return "rule_catalog"; }

package/src/agent/tools/workspace-file.js

@@ -113,6 +113,37 @@ export class WorkspaceFileTool extends BaseTool {
     }
     const resolved = this._resolveForScope(filePath, scope);
     fs.mkdirSync(path.dirname(resolved), { recursive: true });
+
+    // v0.7.0 Group M (#84 remainder): on case-insensitive filesystems
+    // (macOS/Windows defaults), warn when the target's basename collides
+    // with an existing sibling differing only in case. Write proceeds
+    // — agents may legitimately overwrite — but the agent gets visible
+    // signal so it doesn't end up confused like E2E #5 GLM ("SKILL.md
+    // disappeared" when the inode was shared with skill.md). Workspace-
+    // scope only; project-dir scope is the user's territory.
+    let collisionNote = "";
+    if (
+      scope === "workspace" &&
+      this._workspace.fsCaseSensitive === false
+    ) {
+      try {
+        const parent = path.dirname(resolved);
+        const targetBase = path.basename(resolved);
+        const targetLower = targetBase.toLowerCase();
+        const siblings = fs.readdirSync(parent);
+        const collision = siblings.find(
+          (s) => s !== targetBase && s.toLowerCase() === targetLower,
+        );
+        if (collision) {
+          collisionNote =
+            ` ⚠ case-collision: case-insensitive filesystem already has '${collision}'` +
+            ` at this path; both names resolve to the same inode. Pick one canonical case` +
+            ` (lowercase preferred for skill files) and use it consistently — otherwise` +
+            ` archive_file / Read on either name affects the other.`;
+        }
+      } catch { /* readdirSync may fail on a fresh dir; that's fine, no collision possible */ }
+    }
+
     fs.writeFileSync(resolved, content, "utf-8");
 
     // Auto-commit to git for workspace writes (silently no-ops if gitignored or git unavailable)
@@ -124,6 +155,7 @@ export class WorkspaceFileTool extends BaseTool {
     const label = scope === "project" ? `[project] ${filePath}` : filePath;
     let msg = `Wrote ${content.length} chars to ${label}`;
     if (traceId) msg += ` [trace: ${traceId}]`;
+    if (collisionNote) msg += collisionNote;
     return new ToolResult(msg);
   }
 

package/src/agent/workspace.js

@@ -62,6 +62,38 @@ export class Workspace {
     this._gitAutoCommitEnabled = opts.gitAutoCommit !== false;
     this._gitAvailable = this._gitAutoCommitEnabled && Workspace.isGitInstalled();
     if (this._gitAvailable) this._initGitRepo();
+
+    // v0.7.0 F1: detect filesystem case-sensitivity once at construction.
+    // macOS HFS+/APFS default + Windows NTFS default are case-insensitive
+    // — `SKILL.md` and `skill.md` resolve to the same inode. E2E #5 GLM
+    // hit this exactly: wrote skill.md, then SKILL.md (overwrote it),
+    // then archive_file moved skill.md (moved both since same inode),
+    // then agent saw "SKILL.md disappeared". Surfacing the FS property
+    // here lets tools warn on case-collision attempts.
+    this.fsCaseSensitive = Workspace._probeCaseSensitivity(this.path);
+  }
+
+  /**
+   * v0.7.0 F1: cheap probe — write a known-case marker, stat its
+   * lowercased twin. If the stat succeeds, the FS folded the case →
+   * case-insensitive. Probe runs once per session at construction.
+   * Marker is deleted regardless. Returns true on case-sensitive (Linux
+   * default), false on case-insensitive (macOS/Windows defaults).
+   */
+  static _probeCaseSensitivity(dir) {
+    const probe = path.join(dir, ".kc-case-probe-MIXED");
+    const twin = path.join(dir, ".kc-case-probe-mixed");
+    try {
+      fs.writeFileSync(probe, "");
+      const sensitive = !fs.existsSync(twin);
+      try { fs.unlinkSync(probe); } catch { /* ignore */ }
+      return sensitive;
+    } catch {
+      // Couldn't probe (permission?); assume sensitive (Linux default)
+      // since false-positive on macOS doesn't break correctness, just
+      // misses the warning opportunity.
+      return true;
+    }
   }
 
   /** @returns {string} Current workspace directory */
@@ -249,7 +281,13 @@ export class Workspace {
    * `withFileLock` (async) for all paths that allow it.
    */
   withSyncFileLock(relPath, fn, { timeoutMs = 5_000, staleMs = 30_000 } = {}) {
-    const lockPath = path.join(this.path, `${relPath}.lock`);
+    // v0.7.0 H3: route through resolvePath() so a caller passing
+    // "../../shared.json" can't write a lockfile outside the workspace
+    // root (the async sibling withFileLock already does this — sync
+    // version was the asymmetric weak spot). Cross-session lock-file
+    // contamination shut down.
+    const resolved = this.resolvePath(relPath);
+    const lockPath = `${resolved}.lock`;
     return this._withSyncLockAtPath(lockPath, fn, { timeoutMs, staleMs });
   }
 

package/src/cli/components.js

@@ -52,19 +52,64 @@ const LENAT_QUOTE = "Intelligence is ten million rules.";
 // display jumpy. Peak stays at the highest seen this session.
 const CTX_SAMPLE_WINDOW = 30;
 
+// Visual width of a string with CJK chars counted as 2 cells each.
+// Used to truncate session IDs etc. so the status bar fits in a single
+// terminal row regardless of terminal width.
+function visualWidth(s) {
+  let w = 0;
+  for (const ch of s || "") {
+    const cp = ch.codePointAt(0);
+    // CJK + fullwidth + emoji rough heuristic — wide if codepoint ≥ 0x1100.
+    w += cp >= 0x1100 ? 2 : 1;
+  }
+  return w;
+}
+
+function truncateVisual(s, maxCells) {
+  if (!s) return s;
+  if (visualWidth(s) <= maxCells) return s;
+  // Middle-truncate so renamed sessions keep both ends visible
+  // (e.g. "资管新规测试062-GLM" → "资管新规…2-GLM" — model suffix preserved).
+  const headBudget = Math.floor((maxCells - 1) / 2);
+  const tailBudget = maxCells - 1 - headBudget;
+  const chars = [...s];
+  let w = 0; let head = "";
+  for (const ch of chars) {
+    const cw = ch.codePointAt(0) >= 0x1100 ? 2 : 1;
+    if (w + cw > headBudget) break;
+    w += cw; head += ch;
+  }
+  let tw = 0; let tail = "";
+  for (let i = chars.length - 1; i >= 0; i--) {
+    const ch = chars[i];
+    const cw = ch.codePointAt(0) >= 0x1100 ? 2 : 1;
+    if (tw + cw > tailBudget) break;
+    tw += cw; tail = ch + tail;
+  }
+  return head + "…" + tail;
+}
+
 export function StatusBar({ sessionId, phase, contextTokens, contextLimit }) {
   const samplesRef = useRef([]);
   const peakRef = useRef(0);
 
-  // Push current sample + cap the ring
+  // v0.7.0 C3: ref mutations live inside useEffect, not in the render
+  // body. React may invoke renders multiple times (StrictMode, concurrent
+  // rendering, suspense replay); mutating refs inline duplicated the
+  // pushed sample on every replay and let peak drift higher than the
+  // real history. Effect runs once per commit.
+  useEffect(() => {
+    const samples = samplesRef.current;
+    samples.push(contextTokens || 0);
+    if (samples.length > CTX_SAMPLE_WINDOW) samples.shift();
+    if ((contextTokens || 0) > peakRef.current) peakRef.current = contextTokens || 0;
+  }, [contextTokens]);
+
   const samples = samplesRef.current;
-  samples.push(contextTokens || 0);
-  if (samples.length > CTX_SAMPLE_WINDOW) samples.shift();
   const smoothed = samples.length > 0
     ? Math.round(samples.reduce((a, b) => a + b, 0) / samples.length)
-    : 0;
-  if ((contextTokens || 0) > peakRef.current) peakRef.current = contextTokens || 0;
-  const peak = peakRef.current;
+    : (contextTokens || 0);
+  const peak = Math.max(peakRef.current, contextTokens || 0);
 
   const pct = contextLimit ? Math.round((smoothed / contextLimit) * 100) : 0;
   const ctxColor = pct > 80 ? "red" : pct > 60 ? "yellow" : "green";
@@ -83,15 +128,19 @@ export function StatusBar({ sessionId, phase, contextTokens, contextLimit }) {
                      : pct >= 60 ? "  · 💾 建议 /compact"
                      : "";
 
+  // Truncate session ID to keep the bar single-row even with CJK names.
+  // 14 visual cells covers most short UUIDs and ~6-7 CJK chars.
+  const displaySessionId = sessionId ? truncateVisual(sessionId, 14) : "";
+
   return h(Box, { marginTop: 0 },
-    h(Text, { dimColor: true }, "  ⏵⏵  KC Agent CLI "),
-    h(Text, { dimColor: true }, sessionId ? `[${sessionId}]` : ""),
-    phase ? h(Text, { color: "cyan" }, ` ${phase.toUpperCase()}`) : null,
-    h(Text, { color: "green" }, "  ●  "),
-    h(Text, { color: ctxColor }, `CTX: ${ctxLabel}/${limitLabel} (${pct}%)`),
-    showPeak ? h(Text, { dimColor: true }, ` · peak ${fmt(peak)}`) : null,
-    compactHint ? h(Text, { color: ctxColor }, compactHint) : null,
-    h(Text, { dimColor: true }, `  · ${LENAT_QUOTE}`),
+    h(Text, { dimColor: true, wrap: "truncate-end" }, "  ⏵⏵  KC "),
+    h(Text, { dimColor: true, wrap: "truncate-end" }, displaySessionId ? `[${displaySessionId}]` : ""),
+    phase ? h(Text, { color: "cyan", wrap: "truncate-end" }, ` ${phase.toUpperCase()}`) : null,
+    h(Text, { color: "green", wrap: "truncate-end" }, "  ●  "),
+    h(Text, { color: ctxColor, wrap: "truncate-end" }, `CTX: ${ctxLabel}/${limitLabel} (${pct}%)`),
+    showPeak ? h(Text, { dimColor: true, wrap: "truncate-end" }, ` · peak ${fmt(peak)}`) : null,
+    compactHint ? h(Text, { color: ctxColor, wrap: "truncate-end" }, compactHint) : null,
+    h(Text, { dimColor: true, wrap: "truncate-end" }, `  · ${LENAT_QUOTE}`),
   );
 }
 
@@ -161,6 +210,7 @@ export function WelcomeBanner({ projectDir, pendingInputCount = 0 } = {}) {
       "   rules/02 as core; rules/03-10 are supporting context only.\""),
     h(Text, null, ""),
     h(Text, { dimColor: true }, "Product of Memium / kitchen-engineer42"),
+    h(Text, { dimColor: true }, "PolyForm Noncommercial 1.0.0 — commercial use requires a separate license. See LICENSE-COMMERCIAL.md."),
   );
 }
 

package/src/cli/index.js

@@ -76,6 +76,13 @@ function App({ engine, config }) {
   }, []);
 
   const addMessage = useCallback((msg) => {
+    // v0.7.0 H6: dismiss welcome banner once any real message lands.
+    // The banner state was initialized true and never set false — the
+    // banner stayed on every frame for the entire session, eating
+    // permanent screen real estate. Conditionally clear on first
+    // user/agent/tool-result message; system-only messages don't
+    // dismiss (they're often just the banner-side info itself).
+    if (msg && msg.role !== "system") setShowWelcome(false);
     setMessages((prev) => {
       if (prev.length < MAX_RETAINED_MESSAGES) return [...prev, msg];
       // Cap hit: drop the oldest non-system entry. If everything is system
@@ -385,7 +392,16 @@ function App({ engine, config }) {
         const sched = new Scheduler(engineRef.current.workspace);
         const jobs = sched.list();
         if (jobs.length === 0) {
-          addMessage({ role: "system", content: "No scheduled ingestion jobs. Ask KC to set one up via the schedule_fetch tool." });
+          // v0.6.3.1: also surface pending input files. The welcome banner
+          // tells the user "run /schedule for details" when input/ has
+          // unseen files, but the no-jobs branch used to ignore those —
+          // user got a dead-end "no jobs" reply with the files invisible.
+          const pending = sched.pendingInputCount();
+          const tail = sched.tailLog(8);
+          let body = "No scheduled ingestion jobs. Ask KC to set one up via the schedule_fetch tool.";
+          if (pending > 0) body += `\n\nPending in input/: ${pending} file(s) (drop into workspace input/ to be picked up).`;
+          if (tail) body += `\n\nlogs/ingest.log (last 8):\n${tail}`;
+          addMessage({ role: "system", content: body });
         } else {
           const lines = jobs.map((j) => {
             const status = j.enabled ? "✓ enabled" : "· disabled";
@@ -423,6 +439,11 @@ function App({ engine, config }) {
         streamingRef.current = true;
         setStreaming(true);
         setSpinnerStatus("Compacting...");
+        // v0.7.0 H7: top-level .catch on the IIFE — the inner try/catch
+        // handles the compact() failure path; this tail .catch silences
+        // any secondary rejection from the catch handler or finally
+        // block (e.g., addMessage throw). Without it, those would be
+        // UnhandledPromiseRejection in strict-mode Node.
         (async () => {
           try {
             const result = await engineRef.current.compact();
@@ -469,7 +490,7 @@ function App({ engine, config }) {
               runTurn(next);
             }
           }
-        })();
+        })().catch(() => { /* H7 defensive tail */ });
         return true;
       }
 
@@ -528,6 +549,10 @@ function App({ engine, config }) {
           }
         } else {
           // Resume a previous session
+          // v0.7.0 H8: top-level .catch on the IIFE so a throw inside
+          // addMessage()/setMessages() (e.g., during the catch handler
+          // itself, or in Ink reconciler) doesn't surface as an
+          // UnhandledPromiseRejection that crashes Node strict-mode.
           (async () => {
             try {
               const client = new LLMClient({
@@ -541,6 +566,17 @@ function App({ engine, config }) {
               setSessionId(resumed.workspace.sessionId);
               setPhase(resumed.currentPhase);
               setMessages([]);
+              // v0.7.0 F2: re-populate TaskBoard state from the resumed
+              // engine's TaskManager. Without this, the TUI showed an
+              // empty task list after /resume even when tasks.json on
+              // disk had pending work. The setTaskList path mirrors what
+              // the per-event tasks_progress handler does for live
+              // sessions.
+              try {
+                const tasks = resumed.taskManager.getAllTasks();
+                setTaskList(tasks);
+                setTaskProgress(resumed.taskManager.progress);
+              } catch { /* taskManager unavailable on very old session-state */ }
               addMessage({
                 role: "system",
                 content:
@@ -552,7 +588,8 @@ function App({ engine, config }) {
             } catch (err) {
               addMessage({ role: "system", content: `Resume failed: ${err.message}` });
             }
-          })();
+          })().catch(() => { /* defended above; tail catch silences any
+            secondary rejection from the catch handler itself */ });
         }
         return true;
 
@@ -562,6 +599,13 @@ function App({ engine, config }) {
         try { engineRef.current.saveState(); } catch { /* ignore */ }
         try { engineRef.current.stop(); } catch { /* ignore */ }
         exit();
+        // v0.6.3.1: force-exit after a brief grace window. Ink's exit()
+        // unmounts the TUI but in-flight LLM streams / subagent fetches
+        // / unflushed appendFileSync handles can keep the Node event loop
+        // alive indefinitely on long sessions. The 500ms gives saveState
+        // and any synchronous flushes time to complete; after that we
+        // hard-exit so the user's terminal returns to the shell promptly.
+        setTimeout(() => process.exit(0), 500).unref();
         return true;
 
       default:
@@ -756,9 +800,24 @@ export async function main({ languageOverride } = {}) {
 
   // Save state on process exit + stop background diagnostics (B0.1 heap
   // sampler). saveState is idempotent; stop() is safe to call twice.
+  //
+  // v0.6.3.1: handler must terminate. Pre-fix it only saved + returned, which
+  // overrides Node's default SIGINT behavior — the process kept running with
+  // active LLM streams / subagent fetches keeping the event loop alive, and
+  // mashing ^C did nothing visible. Now: first ^C saves and tries clean exit
+  // after 500ms; second ^C hard-kills with no further saves.
+  let interruptCount = 0;
   const saveOnExit = () => {
+    interruptCount++;
+    if (interruptCount >= 2) {
+      // Second interrupt — user wants out NOW
+      process.stderr.write("\nForce-exiting (second interrupt).\n");
+      process.exit(130); // 128 + SIGINT
+    }
     try { engine.saveState(); } catch { /* ignore */ }
     try { engine.stop(); } catch { /* ignore */ }
+    process.stderr.write("\nReceived interrupt — saving state, then exiting in 500ms (press again to force).\n");
+    setTimeout(() => process.exit(130), 500).unref();
   };
   process.on("SIGINT", saveOnExit);
   process.on("SIGTERM", saveOnExit);

package/src/cli/meme.js

@@ -1,32 +1,34 @@
-import React, { useState } from "react";
+// AUTO-GENERATED by scripts/build-meme.js — DO NOT EDIT BY HAND.
+// Source of truth lives in src/cli/meme.source.js.
+//
+// v0.7.0 Group K2: the textual easter-egg payload (lyrics, team
+// handles, watermark) is XOR-encoded + base64 in BLOB below. The
+// decoder is intentionally simple — the goal is to defeat grep-based
+// plagiarism scraping, not to provide cryptographic protection.
+// Determined reverse-engineering can recover the data; the watermark
+// survives and identifies origin in any copies. Please leave it in.
+
+import React from "react";
 import { Box, Text, useInput } from "ink";
 
 const h = React.createElement;
 
-// F6: /meme easter egg. Intentionally not listed in /help — discovery
-// is the point. Press ESC or Enter to dismiss. Content per the v0.6.0
-// plan (item 15) — lyrics + team credit.
+const _K = Buffer.from([
+  0x4b, 0x43, 0x37, 0x31, 0x2a, 0x68, 0x61, 0x72, 0x6e, 0x65, 0x73, 0x73, 0x2a, 0x66, 0x61, 0x74,
+]);
+const _BLOB = "MGFbSFgBAgFMXyhRY0ENGGs0VlheSAAcCkUAHEUIQ1hpFFIWWA1BARoXEh1OAwVUJC0XRUINQRALBBAbCEpDPSVjWERYSAUACwQeUQZENhFrM1ZDXkgVHQFFABxFCENYaQFCRQoBD1IBEAFTRg8EB2lvFWVCDRMXSRZTEgoSEwE/KxdFRUgHGwABUV8IMgkRayZZVQoBElIAAARRBkQgVD8sWl5YGg4FThIWU0cTEgBrMVJQSQBBFAEXUV8IMg5UKSYXWU8JExZMOF9RXgMAGWl5bBNqWFA0BxYbUQZEITUmJltYS0pNUC4kHQBPCiobKCZZEwZKITMaFxYGWURNVgsAVkNFBAgcCyYhPwhKQzQPKkFYWQEOHCoMARZJEg4GEzYVHQgoJgAPBhY0XwlDWGkDcENPDQ89HAQdFE9ETVYLC1ZdTCVDXkwlGBpeBQkRJW5SX00BDxcLF0dBCEpDNAcqW0hiHQAcCUdfUWorAAY+KFgTBkohIwcEHR9DCghWZ2F3QkUGBh8PClFfCCYVHC4sWRMGSiEqBwIGEghKQzQTGseupvdDXkwlChtCC0NYaQNNXk8SDhdMSVEzUB8ZACMmQ0NFBA1QM0lRBEsSBAYmIkVaCFJDOS1FscQKNg4YMgVYQ0dILx0ABhweRwMTFyIiWxEbRlFcXkWxxAqkyFQGJlpYXwVBXU4OGgdJDgQaZiZZVkMGBBccUUFT6NFBHD83R0IQR04VBxEbBkhIAhsmbFxYXgsJFwBIFh1NDw8RLjEDAwUDAl8NCRpRVw==";
 
-const LYRICS = [
-  "I'll wait and soon",
-  "We're stranded on the beach",
-  "In our dream",
-  "We part too soon",
-  "But in our lies",
-  "There's a truth to find",
-  "The end is new",
-  "A tomorrow we must reach for",
-  "To be heard",
-];
+function _decode() {
+  const buf = Buffer.from(_BLOB, "base64");
+  const out = Buffer.alloc(buf.length);
+  for (let i = 0; i < buf.length; i++) out[i] = buf[i] ^ _K[i % _K.length];
+  return JSON.parse(out.toString("utf-8"));
+}
 
-const TEAM = [
-  "@kitchen-engineer42", "@Xigua", "@Amelia", "@01Fish",
-  "@zyxthetroll", "@theon", "@DivisionDirectorXu",
-  "@AnselKocen", "@CarolineCRL", "@GraceGuo",
-  "@XY🌟", "@HalfM", "@GreenOrange",
-  "@LilyHuang", "@Qianlili", "@songmao",
-  "@zoezoe", "@yhhm",
-];
+const _payload = _decode();
+const LYRICS = _payload.lyrics;
+const TEAM = _payload.team;
+const __KC_MEME_WATERMARK__ = _payload.watermark;
 
 export function MemeOverlay({ onDismiss }) {
   useInput((input, key) => {
@@ -34,7 +36,6 @@ export function MemeOverlay({ onDismiss }) {
   });
 
   return h(Box, { flexDirection: "column", borderStyle: "round", borderColor: "magenta", paddingLeft: 2, paddingRight: 2, paddingTop: 1, paddingBottom: 1, marginTop: 1, marginBottom: 1 },
-    // Lyrics block
     h(Box, { flexDirection: "column" },
       ...LYRICS.map((line, i) =>
         h(Text, { key: `l-${i}`, color: "cyan", italic: true }, line),
@@ -43,7 +44,6 @@ export function MemeOverlay({ onDismiss }) {
     h(Text, null, ""),
     h(Text, { dimColor: true }, "─".repeat(60)),
     h(Text, null, ""),
-    // Team credit
     h(Text, { color: "yellow", bold: true },
       "Here's to all the smart minds that are/were part of our team:"),
     h(Text, null, ""),
@@ -54,5 +54,6 @@ export function MemeOverlay({ onDismiss }) {
     ),
     h(Text, null, ""),
     h(Text, { dimColor: true }, "Press ESC or Enter to dismiss."),
+    h(Text, { dimColor: true }, __KC_MEME_WATERMARK__),
   );
 }