kodelyth-ecc 1.5.9 → 1.7.0

package/install.sh

@@ -47,7 +47,7 @@ echo -e "${RED}${BOLD}  ║   DANGER LEVEL: GOD TIER    ·    NOT FOR JUNIOR DEV
 echo -e "${RED}${BOLD}  ╚══════════════════════════════════════════════════════════════╝${RESET}"
 echo ""
 echo -e "${BOLD}  Kodelyth ECC — The most dangerous AI coding toolkit on the planet${RESET}"
-echo -e "${CYAN}  62 specialist agents  ·  188 skills  ·  90 commands  ·  20+ hooks  ·  intent routing  ·  compound memory${RESET}"
+echo -e "${CYAN}  70 specialist agents (8 devil-mode)  ·  194 skills  ·  97 commands  ·  22+ hooks  ·  intent routing  ·  compound memory${RESET}"
 echo -e "${CYAN}  Any language  ·  Any framework  ·  Any scale  ·  300B-level quality${RESET}"
 echo ""
 echo -e "  github.com/sifxprime/kodelyth-ecc"
@@ -75,6 +75,7 @@ else
 fi
 TARGET="claude-home"
 LANGUAGE_MODULES=()
+BUNDLE=""
 
 # ── Parse Arguments ───────────────────────────────────────────────────────────
 while [[ $# -gt 0 ]]; do
@@ -93,6 +94,57 @@ while [[ $# -gt 0 ]]; do
       LANGUAGE_MODULES+=("$lang")
       shift
       ;;
+    --bundle)
+      case "$2" in
+        indie-hacker|indie)
+          BUNDLE="indie-hacker"
+          LANGUAGE_MODULES+=("typescript" "python")
+          echo -e "${CYAN}Bundle: Indie Hacker → ship-fast workflow + TS/Python${RESET}"
+          ;;
+        red-team|redteam|security)
+          BUNDLE="red-team"
+          LANGUAGE_MODULES+=("typescript" "python")
+          echo -e "${CYAN}Bundle: Red Team → adversarial mindset + devil-mode crew${RESET}"
+          ;;
+        enterprise|compliance)
+          BUNDLE="enterprise"
+          LANGUAGE_MODULES+=("typescript" "java" "python")
+          echo -e "${CYAN}Bundle: Enterprise → compliance + audit + supply chain${RESET}"
+          ;;
+        *)
+          echo -e "${RED}Unknown bundle: $2${RESET}"
+          echo "Available bundles: indie-hacker, red-team, enterprise"
+          exit 1
+          ;;
+      esac
+      shift 2
+      ;;
+    --bundle=*)
+      bundle_val="${1#--bundle=}"
+      case "$bundle_val" in
+        indie-hacker|indie)
+          BUNDLE="indie-hacker"
+          LANGUAGE_MODULES+=("typescript" "python")
+          echo -e "${CYAN}Bundle: Indie Hacker → ship-fast workflow + TS/Python${RESET}"
+          ;;
+        red-team|redteam|security)
+          BUNDLE="red-team"
+          LANGUAGE_MODULES+=("typescript" "python")
+          echo -e "${CYAN}Bundle: Red Team → adversarial mindset + devil-mode crew${RESET}"
+          ;;
+        enterprise|compliance)
+          BUNDLE="enterprise"
+          LANGUAGE_MODULES+=("typescript" "java" "python")
+          echo -e "${CYAN}Bundle: Enterprise → compliance + audit + supply chain${RESET}"
+          ;;
+        *)
+          echo -e "${RED}Unknown bundle: $bundle_val${RESET}"
+          echo "Available bundles: indie-hacker, red-team, enterprise"
+          exit 1
+          ;;
+      esac
+      shift
+      ;;
     --profile)
       case "$2" in
         nextjs|next)
@@ -127,13 +179,24 @@ while [[ $# -gt 0 ]]; do
       echo "Usage: $0 [--target TARGET] [--profile PROFILE] [language...]"
       echo ""
       echo "Targets:"
-      echo "  claude-home      Claude Code global install (default)"
+      echo "  claude-home         Claude Code global install (default)"
       echo "  antigravity         Google Antigravity (.agent/ in project)"
       echo "  cursor-project      Cursor IDE (.cursor/ in project)"
       echo "  windsurf-project    Windsurf IDE (.windsurf/ + .windsurfrules in project)"
       echo "  windsurf-home       Windsurf IDE global (~/.codeium/windsurf/)"
       echo "  codex-home          OpenAI Codex CLI (~/.codex/)"
       echo "  opencode            OpenCode (.opencode/ in project)"
+      echo "  cline               Cline VS Code agent (.clinerules/ in project)"
+      echo "  roocode             Roo Code agent (.roo/ in project)"
+      echo "  aider               Aider terminal agent (.aider-ecc/ + CONVENTIONS.md)"
+      echo "  kimi                Kimi Code (.kimi/ in project)"
+      echo "  gemini-project      Gemini CLI — project (.gemini/ in project)"
+      echo "  gemini-home         Gemini CLI — global (~/.gemini/)"
+      echo ""
+      echo "Bundles (audience-tailored — installs everything + curated cheat sheet):"
+      echo "  --bundle indie-hacker  Solo founders / SaaS — ship fast, validate, harden"
+      echo "  --bundle red-team      Security engineers — devil-mode crew + adversarial workflows"
+      echo "  --bundle enterprise    Compliance / audit teams — SBOM, license, supply chain"
       echo ""
       echo "Profiles (pre-built language bundles):"
       echo "  --profile nextjs      TypeScript + React + Next.js"
@@ -235,9 +298,69 @@ case "$TARGET" in
     RULES_DEST="$DEST/rules"
     INSTALL_MODE="project"
     ;;
+  cline)
+    # Cline (VS Code AI agent) reads markdown rules from .clinerules/
+    DEST="$(pwd)/.clinerules"
+    AGENTS_DEST=""
+    SKILLS_DEST=""
+    COMMANDS_DEST=""
+    HOOKS_DEST=""
+    RULES_DEST="$DEST"
+    INSTALL_MODE="project"
+    ;;
+  roocode)
+    # Roo Code (VS Code AI agent, Cline fork) reads from .roo/
+    DEST="$(pwd)/.roo"
+    AGENTS_DEST="$DEST/agents"
+    SKILLS_DEST="$DEST/skills"
+    COMMANDS_DEST="$DEST/commands"
+    HOOKS_DEST=""
+    RULES_DEST="$DEST/rules"
+    INSTALL_MODE="project"
+    ;;
+  aider)
+    # Aider (terminal pair-programmer) reads from CONVENTIONS.md and .aider-ecc/
+    DEST="$(pwd)/.aider-ecc"
+    AGENTS_DEST="$DEST/agents"
+    SKILLS_DEST="$DEST/skills"
+    COMMANDS_DEST="$DEST/commands"
+    HOOKS_DEST=""
+    RULES_DEST="$DEST/rules"
+    INSTALL_MODE="project"
+    ;;
+  kimi)
+    # Kimi Code (Moonshot CLI agent) reads from .kimi/
+    DEST="$(pwd)/.kimi"
+    AGENTS_DEST="$DEST/agents"
+    SKILLS_DEST="$DEST/skills"
+    COMMANDS_DEST="$DEST/commands"
+    HOOKS_DEST=""
+    RULES_DEST="$DEST/rules"
+    INSTALL_MODE="project"
+    ;;
+  gemini-project)
+    # Gemini CLI reads GEMINI.md + .gemini/
+    DEST="$(pwd)/.gemini"
+    AGENTS_DEST="$DEST/agents"
+    SKILLS_DEST="$DEST/skills"
+    COMMANDS_DEST=""
+    HOOKS_DEST=""
+    RULES_DEST="$DEST/rules"
+    INSTALL_MODE="project"
+    ;;
+  gemini-home)
+    # Gemini CLI global install
+    DEST="$HOME_DIR/.gemini"
+    AGENTS_DEST="$DEST/agents"
+    SKILLS_DEST="$DEST/skills"
+    COMMANDS_DEST=""
+    HOOKS_DEST=""
+    RULES_DEST="$DEST/rules"
+    INSTALL_MODE="user"
+    ;;
   *)
     echo -e "${RED}Unknown target: $TARGET${RESET}"
-    echo "Valid targets: claude-home, antigravity, cursor-project, windsurf-project, windsurf-home, codex-home, opencode"
+    echo "Valid targets: claude-home, antigravity, cursor-project, windsurf-project, windsurf-home, codex-home, opencode, cline, roocode, aider, kimi, gemini-project, gemini-home"
     exit 1
     ;;
 esac
@@ -363,7 +486,7 @@ case "$TARGET" in
       cp -r "$SCRIPT_DIR/rules/common"/. "$RULES_DEST/"
       echo -e "  ${GREEN}✓${RESET} Rules (common) ${BLUE}(→ $RULES_DEST)${RESET}"
     fi
-    for lang in "${LANGUAGE_MODULES[@]}"; do
+    for lang in "${LANGUAGE_MODULES[@]+"${LANGUAGE_MODULES[@]}"}"; do
       if [[ -d "$SCRIPT_DIR/rules/$lang" ]]; then
         mkdir -p "$RULES_DEST/$lang"
         cp -r "$SCRIPT_DIR/rules/$lang"/. "$RULES_DEST/$lang/"
@@ -416,8 +539,100 @@ case "$TARGET" in
   opencode)
     install_flat "$SCRIPT_DIR/rules"    "$RULES_DEST"    "Rules (flattened)"
     ;;
+
+  cline)
+    # Cline reads everything in .clinerules/ as markdown — flatten the lot
+    install_flat "$SCRIPT_DIR/rules"    "$RULES_DEST"    "Rules (flattened)"
+    install_flat "$SCRIPT_DIR/agents"   "$RULES_DEST"    "Agents (flattened → rules)"
+    install_flat "$SCRIPT_DIR/commands" "$RULES_DEST"    "Commands (flattened → rules)"
+    ;;
+
+  roocode)
+    install_dir  "$SCRIPT_DIR/agents"   "$AGENTS_DEST"   "Agents   ($AGENT_COUNT)"
+    install_dir  "$SCRIPT_DIR/skills"   "$SKILLS_DEST"   "Skills   ($SKILL_COUNT)"
+    install_dir  "$SCRIPT_DIR/commands" "$COMMANDS_DEST" "Commands ($CMD_COUNT)"
+    install_flat "$SCRIPT_DIR/rules"    "$RULES_DEST"    "Rules (flattened)"
+    ;;
+
+  aider)
+    install_dir  "$SCRIPT_DIR/agents"   "$AGENTS_DEST"   "Agents   ($AGENT_COUNT)"
+    install_dir  "$SCRIPT_DIR/skills"   "$SKILLS_DEST"   "Skills   ($SKILL_COUNT)"
+    install_dir  "$SCRIPT_DIR/commands" "$COMMANDS_DEST" "Commands ($CMD_COUNT)"
+    install_flat "$SCRIPT_DIR/rules"    "$RULES_DEST"    "Rules (flattened)"
+    # Aider integration: write a CONVENTIONS.md at project root that points to .aider-ecc/
+    CONVENTIONS_FILE="$(pwd)/CONVENTIONS.md"
+    if [[ ! -f "$CONVENTIONS_FILE" ]]; then
+      cat > "$CONVENTIONS_FILE" <<'AIDER_EOF'
+# Project Conventions (Aider)
+
+This project uses **Kodelyth ECC** for AI agent guidance.
+
+Aider auto-loads this file. To bring full ECC context into your session:
+
+```bash
+aider --read .aider-ecc/rules/agent-intent-routing.md \
+      --read .aider-ecc/rules/coding-standards.md \
+      --read .aider-ecc/rules/self-improvement-workflow.md
+```
+
+For a specialist agent, also read its file:
+
+```bash
+aider --read .aider-ecc/agents/debug-detective.md
+aider --read .aider-ecc/agents/security-reviewer.md
+aider --read .aider-ecc/agents/prompt-injection-hunter.md
+```
+
+Full catalog: `.aider-ecc/agents/`, `.aider-ecc/skills/`, `.aider-ecc/commands/`, `.aider-ecc/rules/`.
+
+Powered by Kodelyth ECC — github.com/sifxprime/kodelyth-ecc
+AIDER_EOF
+      echo -e "  ${GREEN}✓${RESET} CONVENTIONS.md ${BLUE}(→ $CONVENTIONS_FILE)${RESET}"
+    else
+      echo -e "  ${YELLOW}·${RESET} CONVENTIONS.md exists — not overwriting (manually add: --read .aider-ecc/rules/agent-intent-routing.md)"
+    fi
+    ;;
+
+  kimi)
+    install_dir  "$SCRIPT_DIR/agents"   "$AGENTS_DEST"   "Agents   ($AGENT_COUNT)"
+    install_dir  "$SCRIPT_DIR/skills"   "$SKILLS_DEST"   "Skills   ($SKILL_COUNT)"
+    install_dir  "$SCRIPT_DIR/commands" "$COMMANDS_DEST" "Commands ($CMD_COUNT)"
+    install_flat "$SCRIPT_DIR/rules"    "$RULES_DEST"    "Rules (flattened)"
+    ;;
+
+  gemini-project|gemini-home)
+    install_dir  "$SCRIPT_DIR/agents"   "$AGENTS_DEST"   "Agents   ($AGENT_COUNT)"
+    install_dir  "$SCRIPT_DIR/skills"   "$SKILLS_DEST"   "Skills   ($SKILL_COUNT)"
+    install_flat "$SCRIPT_DIR/rules"    "$RULES_DEST"    "Rules (flattened)"
+    # Gemini CLI integration: write a GEMINI.md at the install location
+    GEMINI_FILE="$DEST/GEMINI.md"
+    if [[ ! -f "$GEMINI_FILE" ]]; then
+      cat > "$GEMINI_FILE" <<'GEMINI_EOF'
+# Kodelyth ECC — Gemini CLI context
+
+This project uses Kodelyth ECC — 70 specialist agents, 194 skills, 97 commands, intent routing, and self-learning memory.
+
+The full toolkit is installed under this directory:
+
+- `agents/` — specialist subagents (debug-detective, security-reviewer, devil-mode crew)
+- `skills/` — domain knowledge files
+- `rules/` — always-on coding standards + intent routing rule
+
+The `agent-intent-routing.md` rule maps plain-language requests to the right specialist. Read `agents/<name>.md` to invoke a specialist explicitly.
+
+For more: github.com/sifxprime/kodelyth-ecc
+GEMINI_EOF
+      echo -e "  ${GREEN}✓${RESET} GEMINI.md ${BLUE}(→ $GEMINI_FILE)${RESET}"
+    fi
+    ;;
 esac
 
+# ── Install bundle cheat sheet (if --bundle was set) ──────────────────────────
+if [[ -n "$BUNDLE" ]] && [[ -f "$SCRIPT_DIR/bundles/$BUNDLE.md" ]]; then
+  cp "$SCRIPT_DIR/bundles/$BUNDLE.md" "$DEST/BUNDLE.md"
+  echo -e "  ${GREEN}✓${RESET} Bundle cheat sheet (${BOLD}$BUNDLE${RESET}) ${BLUE}(→ $DEST/BUNDLE.md)${RESET}"
+fi
+
 # ── Write install state ───────────────────────────────────────────────────────
 VERSION="$(cat "$SCRIPT_DIR/VERSION" 2>/dev/null || echo "1.0.0")"
 STATE_FILE="$DEST/kodelyth-ecc-install-state.json"
@@ -426,12 +641,35 @@ cat > "$STATE_FILE" <<EOF
   "installed_by": "kodelyth-ecc",
   "version": "$VERSION",
   "target": "$TARGET",
+  "bundle": "$BUNDLE",
   "installed_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
   "languages": $(printf '%s\n' "${LANGUAGE_MODULES[@]+"${LANGUAGE_MODULES[@]}"}" | jq -R . | jq -s . 2>/dev/null || echo "[]")
 }
 EOF
 echo -e "  ${GREEN}✓${RESET} Install state ${BLUE}(→ $STATE_FILE)${RESET}"
 
+# ── Bundle-specific reminder ──────────────────────────────────────────────────
+if [[ -n "$BUNDLE" ]]; then
+  echo ""
+  case "$BUNDLE" in
+    indie-hacker)
+      echo -e "${BOLD}${CYAN}  Bundle: Indie Hacker is active.${RESET}"
+      echo "  Lead with: /project-launch (new) • /tdd • /devil-mode --pre-public (before going public)"
+      echo "  Read: $DEST/BUNDLE.md for the full ship-fast playbook."
+      ;;
+    red-team)
+      echo -e "${BOLD}${RED}  Bundle: Red Team is active.${RESET}"
+      echo "  Lead with: /devil-mode (4-agent sweep) • /devil-mode --all (full 8-agent crew)"
+      echo "  Read: $DEST/BUNDLE.md for the adversarial workflow playbook."
+      ;;
+    enterprise)
+      echo -e "${BOLD}${CYAN}  Bundle: Enterprise is active.${RESET}"
+      echo "  Lead with: /team-review (per-PR) • /pre-release (per-tag) • /devil-mode --pre-launch"
+      echo "  Read: $DEST/BUNDLE.md for the compliance + audit playbook."
+      ;;
+  esac
+fi
+
 # ── Done ──────────────────────────────────────────────────────────────────────
 echo ""
 echo -e "  ─────────────────────────────────────────────────────────────"
@@ -493,6 +731,50 @@ case "$TARGET" in
     echo "    use ux-reviewer            ← after touching any UI"
     echo "    use api-guardian           ← API contract protection"
     ;;
+  cline)
+    echo -e "${BOLD}  Cline (VS Code) — what to do now:${RESET}"
+    echo ""
+    echo "  Open the project in VS Code with Cline installed."
+    echo "  Cline auto-loads .clinerules/ — all 70 agents, rules, and commands as markdown context."
+    echo "    Ask: 'use debug-detective'  /  'review my code'  /  'devil mode the codebase'"
+    ;;
+  roocode)
+    echo -e "${BOLD}  Roo Code — what to do now:${RESET}"
+    echo ""
+    echo "  Open the project in VS Code with Roo Code."
+    echo "  Rules, agents, skills, commands installed under .roo/"
+    echo "    Ask: 'use kodelyth-advisor' or 'use debug-detective'"
+    ;;
+  aider)
+    echo -e "${BOLD}  Aider — what to do now:${RESET}"
+    echo ""
+    echo "  CONVENTIONS.md created at project root — Aider auto-reads it."
+    echo "  Full ECC toolkit under .aider-ecc/"
+    echo ""
+    echo "  Recommended startup:"
+    echo "    aider --read .aider-ecc/rules/agent-intent-routing.md \\"
+    echo "          --read .aider-ecc/rules/coding-standards.md"
+    echo ""
+    echo "  Then describe your problem in plain words; intent routing fires."
+    ;;
+  kimi)
+    echo -e "${BOLD}  Kimi Code — what to do now:${RESET}"
+    echo ""
+    echo "  Open the project with Kimi CLI."
+    echo "  Rules, agents, skills, commands installed under .kimi/"
+    echo "    Ask: 'use kodelyth-advisor'"
+    ;;
+  gemini-project|gemini-home)
+    echo -e "${BOLD}  Gemini CLI — what to do now:${RESET}"
+    echo ""
+    if [[ "$TARGET" == "gemini-project" ]]; then
+      echo "  Project install at .gemini/ + GEMINI.md auto-loaded by Gemini CLI."
+    else
+      echo "  Global install at ~/.gemini/ + GEMINI.md auto-loaded by Gemini CLI."
+    fi
+    echo "  Agents in agents/, skills in skills/, rules in rules/"
+    echo "    Ask: 'use debug-detective' or 'use kodelyth-advisor'"
+    ;;
   *)
     echo -e "${BOLD}  What to do now:${RESET}"
     echo "  Restart your AI agent. Rules, agents, and skills are live."

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kodelyth-ecc",
-  "version": "1.5.9",
-  "description": "Production-grade AI coding toolkit — 62 agents, 188 skills, 90 commands, parallel multi-agent commands, semantic intent routing, self-learning memory. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, and OpenCode.",
+  "version": "1.7.0",
+  "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",
   "repository": {
@@ -16,25 +16,51 @@
     "codex",
     "antigravity",
     "opencode",
+    "cline",
+    "roocode",
+    "aider",
+    "gemini-cli",
     "ai-agents",
+    "ai-coding",
     "coding-toolkit",
+    "developer-tools",
     "llm",
+    "llm-tools",
     "memory",
     "self-learning",
     "auto-recall",
+    "intent-routing",
+    "semantic-routing",
+    "agent-orchestration",
     "incident-response",
     "load-testing",
     "kodelyth",
     "image-generation",
     "parallel-agents",
     "multi-agent",
-    "project-launch"
+    "project-launch",
+    "mcp",
+    "model-context-protocol",
+    "devil-mode",
+    "red-team",
+    "adversarial",
+    "dashboard",
+    "observability",
+    "bm25",
+    "local-memory",
+    "hooks",
+    "slash-commands",
+    "productivity"
   ],
   "bin": {
     "kodelyth-ecc": "bin/kodelyth-ecc.js"
   },
   "scripts": {
-    "test": "node tests/run-all.js"
+    "test": "node tests/run-all.js",
+    "mcp": "node scripts/mcp/server.js"
+  },
+  "optionalDependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4"
   },
   "engines": {
     "node": ">=18.0.0"

package/rules/common/agent-intent-routing.md

@@ -12,6 +12,8 @@ If multiple agents match, pick the **highest priority** below (priority decrease
 
 **Never silently route.** Always be transparent about which agent is taking over.
 
+> **Companion rule:** [`cost-aware-model-routing`](./cost-aware-model-routing.md) handles the orthogonal question of _which model tier_ to use for the routed task. They run together — agent routing picks the specialist; model routing picks the right tier so the team isn't burning frontier-model tokens on doc typos.
+
 ---
 
 ## How to Apply This Rule — Semantic Intent, Not Keyword Matching
@@ -143,6 +145,81 @@ Trigger if the user describes **what they're about to build** before they start.
 | Input handling | "user input", "sanitize", "escape", "validation", "user-submitted data" |
 | Worry signal | "I'm worried this might be insecure", "is there a risk here", "could someone exploit this" |
 
+### Devil-Mode Adversarial Crew (8 specialists — attacker mindset)
+
+These 8 agents look at the same code an attacker would. Route to them when the user shows signs of adversarial thinking, supply-chain worry, AI safety concern, or pre-public-launch paranoia.
+
+#### `prompt-injection-hunter` — AI-feature attack-surface review
+
+| Signal | Real human phrasing |
+|---|---|
+| AI feature audit | "is my AI feature safe?", "can my agent be jailbroken?", "review my prompts", "audit my LLM integration" |
+| Prompt safety | "prompt injection", "indirect injection", "system prompt leak", "tool hijacking", "RAG security" |
+| MCP server review | "is this MCP server safe?", "audit my MCP integration", "agent tool security" |
+
+#### `supply-chain-auditor` — Dependency & install-script attacker review
+
+| Signal | Real human phrasing |
+|---|---|
+| Dep paranoia | "is this package safe?", "could this dep be malicious?", "typosquat", "dependency confusion", "is npm install safe?" |
+| Lockfile concern | "lockfile drift", "should I trust this dep?", "audit my deps for malware", "what's in my node_modules" |
+| Recent CVE worry | "is this CVE in my supply chain", "compromised package alert", "is `<pkg>` malicious now?" |
+
+#### `secret-hunter` — Leaked credential hunt
+
+| Signal | Real human phrasing |
+|---|---|
+| Leak worry | "did I leak any secrets?", "scan for API keys", "any tokens in my code?", "secret scanner", "credentials in git" |
+| Pre-public | "I'm about to make this public, any secrets in history?", "before I go open-source check secrets" |
+| Bundled to client | "are my env vars exposed to the browser?", "is `process.env.X` leaking to the client?" |
+| Rotate event | "rotated my keys, did I miss any?", "post-incident sweep" |
+
+#### `license-violation-finder` — IP / copyleft contamination audit
+
+| Signal | Real human phrasing |
+|---|---|
+| License audit | "license audit", "are my deps GPL?", "license compatibility", "copyleft check", "AGPL contamination" |
+| Going public | "before I open-source, license audit", "any license issues with my deps?" |
+| Due diligence | "M&A license review", "investor due diligence", "what licenses are in my distribution" |
+| Attribution | "do I need to add attribution?", "missing THIRD-PARTY.md", "MIT license requirements" |
+
+#### `jailbreak-tester` — Live AI feature red-team
+
+| Signal | Real human phrasing |
+|---|---|
+| AI red-team | "red-team my AI", "test my chatbot for jailbreaks", "can my LLM be tricked?", "AI safety testing" |
+| Pre-launch AI | "launching an AI feature, is it safe?", "production AI safety check", "test my agent for refusal bypasses" |
+| Overrefusal | "my AI refuses too much", "false refusals", "my chatbot won't answer normal questions" |
+
+#### `code-stealer-detector` — Code provenance audit
+
+| Signal | Real human phrasing |
+|---|---|
+| Provenance | "where did this code come from?", "provenance check", "audit copy-paste origin", "is this Stack Overflow code?" |
+| AI-generated | "audit AI-generated code", "Copilot-written code provenance", "is my LLM-generated code safe to ship?" |
+| Pre-public | "before going open-source, check code origins", "M&A IP audit", "due diligence code review" |
+| Style break | "this code looks pasted", "doesn't match our style", "audit unusual code blocks" |
+
+#### `backdoor-hunter` — Malicious-code pattern detection
+
+| Signal | Real human phrasing |
+|---|---|
+| Malware suspicion | "is this code malicious?", "look for backdoors", "obfuscated code", "what does this eval do?", "scan for hidden payloads" |
+| Post-compromise | "after a security incident, sweep the code", "vendor said they were compromised, audit my install" |
+| Vendored review | "audit this vendored library", "review this third-party code dump", "contractor code review for malice" |
+| Suspicious CI | "weird stuff happening in my CI", "build is doing things it shouldn't", "unexplained network calls" |
+
+#### `chaos-engineer` — Adversarial reliability / fault injection
+
+| Signal | Real human phrasing |
+|---|---|
+| Resilience | "test my system's resilience", "chaos engineering", "fault injection", "what happens if X dies?" |
+| Pre-launch readiness | "is my system production-ready under failure?", "test failure modes before launch" |
+| Hidden assumption | "what hidden assumptions am I making?", "what could break?", "stress my dependencies" |
+| Game day | "schedule a game day", "team chaos exercise", "training for incidents" |
+
+**Counter-signal (for all devil-mode agents):** General quality concern not framed adversarially → use the standard `code-reviewer` / `security-reviewer` / `performance-optimizer`. Route to devil-mode only when the user is explicitly thinking like an attacker or asking pre-public/pre-launch questions.
+
 ### `api-guardian` — API contract changes
 
 | Signal | Real human phrasing |
@@ -343,6 +420,71 @@ Trigger for non-code workflow tasks: drafting emails, scheduling, status updates
 
 Use the chain: `forker` → `sanitizer` → `packager`.
 
+### `/dashboard` — Local observability dashboard
+
+Trigger when the user wants to inspect ECC's live data — memory store, session history, agent catalog, token budget, or evolve proposals — through a browser UI.
+
+| Signal | Real human phrasing |
+|---|---|
+| Open dashboard | "open the dashboard", "launch the dashboard", "show me the dashboard", "start the dashboard" |
+| Inspect memory | "show me what's in my memory", "browse my sessions", "see my memory store", "view past solutions" |
+| View catalog | "show me the agent catalog", "list my agents in the UI", "see all skills in a browser" |
+| Token budget | "what's my token budget", "see budget snapshot", "token usage overview" |
+| Evolve tab | "show evolve proposals", "see what skills ECC proposed", "evolve tab", "review memory proposals" |
+
+**How:** run `npx kodelyth-ecc dashboard` — opens `http://localhost:3141` in the default browser. GET-only, localhost-only, zero telemetry.
+
+### `/swarm` — Parallel agent swarm in git worktrees
+
+Trigger when the user wants to run a task across multiple parallel agents simultaneously, each in an isolated git worktree — the maximum-throughput execution mode.
+
+| Signal | Real human phrasing |
+|---|---|
+| Swarm request | "use the swarm", "run a swarm", "swarm this", "parallel swarm on this task", "launch swarm" |
+| Parallel worktrees | "run agents in parallel", "use git worktrees", "spawn multiple agents at once", "parallel execution" |
+| Scale a task | "give me maximum throughput on this", "throw all agents at this", "run this with maximum agents" |
+| Speed concern | "how do I run this as fast as possible", "I want to parallelize this analysis", "fastest path" |
+
+**How:** `npx kodelyth-ecc swarm --task "<description>"` — spawns parallel agents in isolated git worktrees, aggregates results.
+
+### `/route-model` — Cost-aware model selection
+
+Trigger when the user is unsure which model tier to use for a task, wants to minimize cost, or is asking about the right model for a specific job.
+
+| Signal | Real human phrasing |
+|---|---|
+| Model choice | "which model should I use", "what model for this task", "haiku or sonnet?", "should I use opus here" |
+| Cost concern | "cheapest model for this", "save tokens on this", "what's the cost-efficient choice", "not worth opus" |
+| Tier question | "is this a trivial or complex task tier", "which tier for X", "model selection", "right model tier" |
+| Route a task | "route this task", "what does the router say", "model router", "cost-aware routing" |
+
+**How:** `npx kodelyth-ecc route "<task description>"` — returns the recommended model tier with reasoning.
+
+### `/memory-evolve` — Self-evolving memory proposals
+
+Trigger when the user wants to see what patterns ECC has learned from their usage and review proposals for new skills or routing rules derived from that data.
+
+| Signal | Real human phrasing |
+|---|---|
+| Evolve proposals | "show evolve proposals", "what has ECC learned", "memory evolution", "evolve my toolkit" |
+| Skill upgrades | "suggest new skills from usage", "what skills should I add", "my memory patterns", "recurring solutions" |
+| Routing additions | "suggest routing improvements", "what routing misses happened", "improve my intent routing from usage" |
+| Review proposals | "review pending proposals", "accept or reject proposals", "what did the analyzer find" |
+
+**How:** `npx kodelyth-ecc evolve analyze` — analyzes BM25 memory surface data + routing misses, outputs proposals. Nothing auto-applies — the user reviews, accepts, and commits.
+
+### `/replay` — Session replay
+
+Trigger when the user wants to re-run or review a past session bundle — reproducing a past agent workflow exactly.
+
+| Signal | Real human phrasing |
+|---|---|
+| Replay request | "replay a session", "re-run that session", "session replay", "run the session bundle again" |
+| Review past work | "what happened in that session", "reproduce that workflow", "play back the session" |
+| Bundle | "session bundle", "kodelyth.session-bundle", "export and replay", "portable session" |
+
+**How:** `npx kodelyth-ecc replay <bundle-name>` — re-runs the session bundle, restoring agent context and workflow.
+
 ---
 
 ## Priority 10 — Multi-Agent Patterns
@@ -448,6 +590,27 @@ Route to `/security-audit` — fires `security-reviewer` + `dependency-doctor` +
 
 ---
 
+### `/devil-mode` — Full adversarial parallel sweep
+
+Trigger when the user wants the **attacker mindset** applied to their entire codebase, not just one concern. Stronger than `/security-audit` — it hunts secrets, supply-chain attacks, prompt injection, and backdoors all at once. Always trigger before going open-source, before any public launch, after any security alert, or when the user mentions multiple adversarial concerns together.
+
+| Signal | Real human phrasing |
+|---|---|
+| Attacker mindset | "think like an attacker", "what would a hacker find?", "red-team my code", "adversarial review", "find what's exploitable" |
+| Pre-public sweep | "I'm going open-source — full audit", "making this public, scan for everything", "before I publish, full red-team" |
+| Multi-vector worry | User mentions secrets AND deps AND AI-feature security AND backdoors together |
+| Post-compromise | "we were hacked, audit everything", "compromise alert, sweep the codebase", "after the incident, full review" |
+| Pre-launch paranoia | "launching tomorrow, find everything", "find what we missed", "what's the worst case in my code?" |
+| Devil mode keyword | "devil mode", "go feral on this", "throw everything at it", "no-mercy audit", "paranoid review" |
+
+**Key rule:** Standard security concern with one or two angles → `/security-audit`. Multi-vector adversarial sweep, going public, or attacker-mindset framing → `/devil-mode`.
+
+**Counter-signals (do NOT route here):** Single-angle question (just secrets, just AI safety, just deps) → individual devil-mode agent. Code quality (not adversarial) → `/team-review`.
+
+Route to `/devil-mode` — fires `prompt-injection-hunter` + `supply-chain-auditor` + `secret-hunter` + `backdoor-hunter` simultaneously. Use `/devil-mode --all` to fire all 8 (also adds `license-violation-finder` + `code-stealer-detector` + `jailbreak-tester` + `chaos-engineer`). Use `/devil-mode --pre-public` for the open-source sweep, or `/devil-mode --pre-launch` for the launch readiness sweep.
+
+---
+
 ### `/pre-release` — Ship-readiness parallel check
 
 Trigger when the user is about to cut a release, tag a version, or deploy to production and wants confidence everything is correct. Also trigger when they mention "release" + "check" or "ready to ship" + version number.
@@ -602,12 +765,31 @@ When the user's request spans multiple concerns, name the parallel agents and ex
 | "clean up this whole module, add types and tests" | `/refactor-sprint` | Multi-concern quality |
 | "this code is a mess, full cleanup needed" | `/refactor-sprint` | Technical debt + scope |
 | "I just joined this team, where do I start?" | `/onboard` | New-joiner onboarding |
+| "think like an attacker, sweep my code" | `/devil-mode` | Attacker mindset trigger |
+| "going open-source, full audit before publish" | `/devil-mode --pre-public` | Pre-public adversarial sweep |
+| "we were hacked, audit everything" | `/devil-mode --all` | Post-compromise full sweep |
+| "is my AI feature jailbreak-safe?" | `prompt-injection-hunter` | AI-feature attack surface |
+| "did I leak secrets in git history?" | `secret-hunter` | Credential leak hunt |
+| "could this npm package be malicious?" | `supply-chain-auditor` | Dep paranoia |
+| "audit my deps for GPL contamination" | `license-violation-finder` | Copyleft check |
+| "is this code copy-pasted from somewhere?" | `code-stealer-detector` | Provenance audit |
+| "scan this vendored lib for backdoors" | `backdoor-hunter` | Malicious-code scan |
+| "red-team my chatbot for jailbreaks" | `jailbreak-tester` | Live AI red-team |
+| "what hidden assumptions could break us?" | `chaos-engineer` | Fault-injection planning |
 | "inherited this codebase, help me understand it" | `/onboard` | Unfamiliar codebase |
 | "remember we always use pnpm here" | `/lessons` | Preference to encode |
 | "what rules do we follow in this project?" | `/lessons` | Load lessons |
 | "from now on never use var" | `/lessons` | Rule to save |
 | [user pastes code with no text] | `code-reviewer` | Implicit review |
 | [user pastes stack trace with no text] | `debug-detective` | Implicit debug |
+| "open the dashboard" | `/dashboard` | Local observability UI |
+| "show me what's in my memory store" | `/dashboard` | Memory inspection |
+| "run a swarm on this task" | `/swarm` | Parallel agent execution |
+| "which model should I use for this?" | `/route-model` | Cost-aware model routing |
+| "what has ECC learned from my usage?" | `/memory-evolve` | Evolve proposals review |
+| "replay that session bundle" | `/replay` | Session reproduction |
+| "show evolve proposals" | `/memory-evolve` | Pending skill/routing proposals |
+| "fastest way to run this across agents" | `/swarm` | Maximum-throughput execution |
 
 ---