kodelyth-ecc 1.5.9 → 1.7.0

package/actions/ecc-review/README.md

@@ -0,0 +1,243 @@
+# Kodelyth ECC — PR Review GitHub Action
+
+A one-line GitHub Action that runs the Kodelyth ECC adversarial agent crew against your pull-request diff, posts findings as a PR comment, and optionally fails CI on critical issues.
+
+> **Phase 1.6 of the Devil Roadmap.** Bigger reach lever than the VS Code extension — every GitHub repo is a potential install target.
+
+---
+
+## Quick Start
+
+Drop this into `.github/workflows/ecc-review.yml` in any repo:
+
+```yaml
+name: Kodelyth ECC Review
+
+on:
+  pull_request:
+    branches: [main, master]
+
+permissions:
+  contents: read
+  pull-requests: write   # required to post the review comment
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: sifxprime/kodelyth-ecc/actions/ecc-review@v1.6.0
+        with:
+          bundle: red-team
+          fail-on: critical
+          api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+That's it. Every PR now gets reviewed by ECC's adversarial crew and the findings appear as a sticky PR comment.
+
+---
+
+## Inputs
+
+| Input | Default | Description |
+|---|---|---|
+| `bundle` | `red-team` | Which ECC bundle: `indie-hacker` / `red-team` / `enterprise` |
+| `agents` | (none) | Comma-separated agent names. Overrides `bundle` if set. Example: `prompt-injection-hunter,secret-hunter,backdoor-hunter` |
+| `fail-on` | `critical` | Severity threshold that fails the build: `critical` / `high` / `medium` / `none` |
+| `api-key` | (none) | Anthropic API key. Pass via `${{ secrets.ANTHROPIC_API_KEY }}`. **Required** for live model review. |
+| `model` | `claude-sonnet-4-5-20250929` | Claude model to use |
+| `comment` | `true` | Post findings as a PR comment |
+| `max-files` | `20` | Max files reviewed per run (cost guard) |
+| `ecc-version` | `latest` | Pin a specific Kodelyth ECC version (e.g., `1.6.0`) |
+
+## Outputs
+
+| Output | Description |
+|---|---|
+| `critical-count` | Number of CRITICAL findings |
+| `high-count` | Number of HIGH findings |
+| `medium-count` | Number of MEDIUM findings |
+| `report-path` | Path to the JSON report on the runner |
+
+---
+
+## Bundle → Agents Mapping
+
+| Bundle | Agents Run on Each PR |
+|---|---|
+| `indie-hacker` | `security-reviewer` · `code-reviewer` · `ux-reviewer` · `dependency-doctor` |
+| `red-team` (default) | `prompt-injection-hunter` · `supply-chain-auditor` · `secret-hunter` · `backdoor-hunter` |
+| `enterprise` | `code-reviewer` · `security-reviewer` · `license-violation-finder` · `supply-chain-auditor` · `api-guardian` |
+
+To run a custom set, use `agents:` instead:
+
+```yaml
+- uses: sifxprime/kodelyth-ecc/actions/ecc-review@v1.6.0
+  with:
+    agents: secret-hunter,license-violation-finder,jailbreak-tester
+```
+
+---
+
+## Real-World Example Workflows
+
+### 1. Indie Hacker — fast feedback, never block
+
+```yaml
+- uses: sifxprime/kodelyth-ecc/actions/ecc-review@v1.6.0
+  with:
+    bundle: indie-hacker
+    fail-on: none
+    api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+PR gets a comment, but CI never fails. You decide what to address.
+
+### 2. Red Team — full adversarial sweep, block on critical
+
+```yaml
+- uses: sifxprime/kodelyth-ecc/actions/ecc-review@v1.6.0
+  with:
+    bundle: red-team
+    fail-on: critical
+    api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+Default. Recommended for any user-facing product.
+
+### 3. Enterprise — strict, block on high
+
+```yaml
+- uses: sifxprime/kodelyth-ecc/actions/ecc-review@v1.6.0
+  with:
+    bundle: enterprise
+    fail-on: high
+    api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+### 4. Pre-public-release — secret + license + AI safety only
+
+```yaml
+- uses: sifxprime/kodelyth-ecc/actions/ecc-review@v1.6.0
+  with:
+    agents: secret-hunter,license-violation-finder,prompt-injection-hunter
+    fail-on: critical
+    api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+### 5. Cost-controlled — only review on changes to security-sensitive paths
+
+```yaml
+on:
+  pull_request:
+    paths:
+      - 'src/auth/**'
+      - 'src/api/**'
+      - 'src/payments/**'
+      - 'package*.json'
+```
+
+---
+
+## Cost & Rate-Limit Guards
+
+The action ships with sensible defaults to keep your Anthropic spend under control:
+
+- `max-files: 20` — caps how many changed files get sent per run
+- Each file capped at 20KB per send (truncated with marker)
+- Default `red-team` bundle = 4 agents = 4 API calls per PR
+- Each call uses `max_tokens: 4096`
+- A typical PR review: 4 calls × ~6k input + 4k output tokens ≈ ~$0.06-0.15 with Sonnet
+
+For larger codebases or stricter cost control:
+
+```yaml
+with:
+  max-files: 10
+  agents: secret-hunter   # single agent only
+  ecc-version: 1.6.0      # pin version for reproducibility
+```
+
+---
+
+## How It Works
+
+1. **Setup** — installs the latest (or pinned) Kodelyth ECC into the runner via `npx kodelyth-ecc --target claude-home --bundle <bundle>`
+2. **Diff** — resolves the changed files between PR base and head SHAs
+3. **Filter** — drops binary, vendored, and oversized files; caps at `max-files`
+4. **Review loop** — for each agent in the bundle:
+   - Loads the agent's playbook from `~/.claude/agents/<name>.md`
+   - Sends `[playbook + changed files + JSON output schema]` to Claude
+   - Parses the structured findings response
+5. **Aggregate** — combines all findings, tallies severities
+6. **Comment** — posts a single PR comment (upserts on subsequent pushes — never spammy)
+7. **Gate** — exits non-zero if findings exceed `fail-on` threshold
+
+---
+
+## What This Action Does NOT Do
+
+- ❌ Auto-fix issues (advisory only)
+- ❌ Send any data anywhere except Anthropic API + GitHub PR comments
+- ❌ Cache anything between runs (each PR = clean slate)
+- ❌ Run on commits that don't touch reviewable file types
+
+---
+
+## Privacy & Security
+
+- **Code never leaves your control:** PR diff is sent to Anthropic API (using your key) and GitHub PR comments (using `github.token`). Nothing else.
+- **No telemetry:** This action sends no analytics anywhere.
+- **No persistence:** No data stored beyond the runtime of the workflow.
+- **API key:** Pass via `secrets.*` only. Never hardcode.
+
+If your repo has compliance requirements that prohibit sending code to Anthropic, **don't use this action**. Run ECC locally instead.
+
+---
+
+## Troubleshooting
+
+### "No ANTHROPIC_API_KEY set — review skipped"
+
+You forgot to pass the secret. Add it under repo Settings → Secrets and variables → Actions, then reference it in the workflow:
+
+```yaml
+api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+### "::warning::Agent file not found"
+
+The bundle resolved an agent name that doesn't exist in the installed ECC. Pin a known-good version:
+
+```yaml
+ecc-version: 1.6.0
+```
+
+### "Failed to post PR comment: 403"
+
+Your workflow needs `pull-requests: write` permission. Add to top of workflow:
+
+```yaml
+permissions:
+  contents: read
+  pull-requests: write
+```
+
+### Comment is too long (GitHub 65k limit)
+
+Reduce findings by tightening `agents:` or `max-files:`. The action caps to first 30 findings in the comment but writes the full report to the runner artifacts (downloadable from Actions tab).
+
+---
+
+## Related
+
+- [Kodelyth ECC repo](https://github.com/sifxprime/kodelyth-ecc) — the toolkit this action runs
+- [`/devil-mode` command](../../commands/devil-mode.md) — same agents, run locally
+- [Devil Roadmap](../../) — the broader v1.6.0 → v2.0.0 plan
+
+---
+
+**Powered by Kodelyth ECC** · MIT license · No telemetry · No cloud

package/actions/ecc-review/action.yml

@@ -0,0 +1,158 @@
+name: 'Kodelyth ECC PR Review'
+description: 'Run Kodelyth ECC adversarial agents against a PR diff. Posts findings as a PR comment, optionally fails CI on critical issues.'
+author: 'Kodelyth <github.com/sifxprime>'
+branding:
+  icon: 'shield'
+  color: 'red'
+
+inputs:
+  bundle:
+    description: 'Which ECC bundle to use: indie-hacker, red-team, enterprise'
+    required: false
+    default: 'red-team'
+  agents:
+    description: 'Comma-separated agent names to run. Overrides bundle if set. Examples: prompt-injection-hunter,supply-chain-auditor,secret-hunter'
+    required: false
+    default: ''
+  fail-on:
+    description: 'Severity threshold that fails CI: critical | high | medium | none'
+    required: false
+    default: 'critical'
+  api-key:
+    description: 'Anthropic API key (recommended). Falls back to OPENAI_API_KEY if not set.'
+    required: false
+    default: ''
+  model:
+    description: 'Claude model to use'
+    required: false
+    default: 'claude-sonnet-4-5-20250929'
+  comment:
+    description: 'Post findings as a PR comment'
+    required: false
+    default: 'true'
+  max-files:
+    description: 'Max number of changed files to review per run (cost guard)'
+    required: false
+    default: '20'
+  ecc-version:
+    description: 'Pin to a specific ECC version (default: latest from npm)'
+    required: false
+    default: 'latest'
+
+outputs:
+  critical-count:
+    description: 'Number of CRITICAL findings'
+    value: ${{ steps.review.outputs.critical-count }}
+  high-count:
+    description: 'Number of HIGH findings'
+    value: ${{ steps.review.outputs.high-count }}
+  medium-count:
+    description: 'Number of MEDIUM findings'
+    value: ${{ steps.review.outputs.medium-count }}
+  report-path:
+    description: 'Filesystem path of the JSON findings report'
+    value: ${{ steps.review.outputs.report-path }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Node 20
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+
+    - name: Install Kodelyth ECC
+      shell: bash
+      run: |
+        echo "::group::Install Kodelyth ECC"
+        npx --yes kodelyth-ecc@${{ inputs.ecc-version }} \
+          --target claude-home \
+          --bundle ${{ inputs.bundle }}
+        echo "::endgroup::"
+
+    - name: Resolve PR diff
+      id: diff
+      shell: bash
+      run: |
+        echo "::group::Resolve PR diff"
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          HEAD_SHA="${{ github.event.pull_request.head.sha }}"
+        else
+          # push event — diff against previous commit
+          BASE_SHA="${{ github.event.before }}"
+          HEAD_SHA="${{ github.sha }}"
+        fi
+        echo "base-sha=$BASE_SHA" >> "$GITHUB_OUTPUT"
+        echo "head-sha=$HEAD_SHA" >> "$GITHUB_OUTPUT"
+        git fetch origin "$BASE_SHA" --depth=1 2>/dev/null || true
+        git diff --name-only "$BASE_SHA" "$HEAD_SHA" > /tmp/ecc-changed-files.txt || \
+          git diff --name-only "$HEAD_SHA~1" "$HEAD_SHA" > /tmp/ecc-changed-files.txt
+        echo "Changed files:"
+        cat /tmp/ecc-changed-files.txt
+        echo "::endgroup::"
+
+    - name: Run ECC review
+      id: review
+      shell: bash
+      env:
+        ANTHROPIC_API_KEY: ${{ inputs.api-key }}
+        ECC_BUNDLE: ${{ inputs.bundle }}
+        ECC_AGENTS: ${{ inputs.agents }}
+        ECC_MODEL: ${{ inputs.model }}
+        ECC_FAIL_ON: ${{ inputs.fail-on }}
+        ECC_MAX_FILES: ${{ inputs.max-files }}
+        ECC_BASE_SHA: ${{ steps.diff.outputs.base-sha }}
+        ECC_HEAD_SHA: ${{ steps.diff.outputs.head-sha }}
+        GITHUB_REPOSITORY: ${{ github.repository }}
+        GITHUB_TOKEN: ${{ github.token }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+      run: |
+        node ${{ github.action_path }}/run-review.js
+
+    - name: Post PR comment
+      if: ${{ inputs.comment == 'true' && github.event_name == 'pull_request' && steps.review.outputs.report-path != '' }}
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+        REPORT_PATH: ${{ steps.review.outputs.report-path }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+        REPO: ${{ github.repository }}
+      run: |
+        node ${{ github.action_path }}/post-comment.js
+
+    - name: Enforce fail-on threshold
+      shell: bash
+      env:
+        FAIL_ON: ${{ inputs.fail-on }}
+        CRITICAL: ${{ steps.review.outputs.critical-count }}
+        HIGH: ${{ steps.review.outputs.high-count }}
+        MEDIUM: ${{ steps.review.outputs.medium-count }}
+      run: |
+        critical=${CRITICAL:-0}
+        high=${HIGH:-0}
+        medium=${MEDIUM:-0}
+        case "$FAIL_ON" in
+          critical)
+            if [[ "$critical" -gt 0 ]]; then
+              echo "::error::Found $critical CRITICAL issues. Failing build (fail-on=critical)."
+              exit 1
+            fi ;;
+          high)
+            if [[ "$critical" -gt 0 ]] || [[ "$high" -gt 0 ]]; then
+              echo "::error::Found $critical CRITICAL + $high HIGH issues. Failing build (fail-on=high)."
+              exit 1
+            fi ;;
+          medium)
+            if [[ "$critical" -gt 0 ]] || [[ "$high" -gt 0 ]] || [[ "$medium" -gt 0 ]]; then
+              echo "::error::Found $critical CRITICAL + $high HIGH + $medium MEDIUM issues. Failing build (fail-on=medium)."
+              exit 1
+            fi ;;
+          none)
+            echo "::notice::Review complete. fail-on=none — never blocking."
+            ;;
+          *)
+            echo "::warning::Unknown fail-on value: $FAIL_ON. Treating as 'none'."
+            ;;
+        esac
+        echo "::notice::ECC review complete: $critical CRITICAL, $high HIGH, $medium MEDIUM."

package/actions/ecc-review/post-comment.js

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+// Kodelyth ECC — GitHub Action PR comment poster
+// Reads the JSON report and posts a formatted PR comment via GitHub API.
+//
+// Env contract:
+//   GITHUB_TOKEN   Provided by github.token
+//   REPORT_PATH    JSON report file
+//   PR_NUMBER      PR number
+//   REPO           owner/repo
+
+'use strict';
+
+const fs = require('fs');
+const https = require('https');
+
+const reportPath = process.env.REPORT_PATH;
+const prNumber = process.env.PR_NUMBER;
+const repo = process.env.REPO;
+const token = process.env.GITHUB_TOKEN;
+
+if (!reportPath || !fs.existsSync(reportPath)) {
+  console.log('::warning::No report found, skipping PR comment.');
+  process.exit(0);
+}
+if (!prNumber || !repo || !token) {
+  console.log('::warning::Missing PR_NUMBER, REPO, or GITHUB_TOKEN. Skipping comment.');
+  process.exit(0);
+}
+
+const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));
+
+// ── Format PR comment ───────────────────────────────────────────────────────
+function severityEmoji(sev) {
+  const s = (sev || '').toLowerCase();
+  if (s === 'critical') return '🔴';
+  if (s === 'high') return '🟠';
+  if (s === 'medium') return '🟡';
+  if (s === 'low') return '🔵';
+  return '⚪';
+}
+
+function buildComment() {
+  const c = report.counts || { critical: 0, high: 0, medium: 0, low: 0 };
+  const total = (c.critical || 0) + (c.high || 0) + (c.medium || 0) + (c.low || 0);
+  const verdict = total === 0
+    ? '✅ **Clean.** No issues found by the selected agents.'
+    : `**${total}** finding${total === 1 ? '' : 's'} across ${(report.agents || []).length} agents.`;
+
+  const summaryTable = `
+| Severity | Count |
+|---|---|
+| 🔴 Critical | ${c.critical || 0} |
+| 🟠 High | ${c.high || 0} |
+| 🟡 Medium | ${c.medium || 0} |
+| 🔵 Low | ${c.low || 0} |
+`.trim();
+
+  const findings = (report.findings || []).slice(0, 30); // cap to first 30 to fit comment limits
+  const findingsBlock = findings.length === 0 ? '' : `
+
+## Findings
+
+${findings.map((f, i) => {
+  const emoji = severityEmoji(f.severity);
+  const loc = f.line ? `\`${f.file}:${f.line}\`` : `\`${f.file || 'unknown'}\``;
+  return `### ${i + 1}. ${emoji} ${(f.severity || 'unknown').toUpperCase()} — ${f.title || '(no title)'}
+**Agent:** \`${f.agent || 'unknown'}\`  ·  **Location:** ${loc}  ·  **Category:** ${f.category || 'general'}
+
+${f.description || ''}
+
+${f.evidence ? `<details><summary>Evidence</summary>\n\n\`\`\`\n${(f.evidence || '').slice(0, 1000)}\n\`\`\`\n\n</details>` : ''}
+
+**Recommended fix:** ${f.fix || '(none provided)'}
+`;
+}).join('\n---\n')}
+${(report.findings || []).length > 30 ? `\n_…and ${(report.findings || []).length - 30} more findings (see full report artifact)._\n` : ''}`;
+
+  return `## 🦞 Kodelyth ECC — Devil Mode Review
+
+${verdict}
+
+**Bundle:** \`${report.bundle || 'red-team'}\` &nbsp;·&nbsp; **Agents:** ${(report.agents || []).map(a => `\`${a}\``).join(', ')} &nbsp;·&nbsp; **Files reviewed:** ${(report.files_reviewed || []).length}
+
+${summaryTable}
+${findingsBlock}
+
+---
+
+<sub>Powered by [Kodelyth ECC](https://github.com/sifxprime/kodelyth-ecc) · [Configure this action](https://github.com/sifxprime/kodelyth-ecc/tree/main/actions/ecc-review)</sub>`;
+}
+
+// ── Find existing comment from this action (for upsert) ─────────────────────
+function listComments() {
+  return new Promise((resolve, reject) => {
+    const req = https.request({
+      hostname: 'api.github.com',
+      path: `/repos/${repo}/issues/${prNumber}/comments?per_page=100`,
+      method: 'GET',
+      headers: {
+        'Authorization': `token ${token}`,
+        'User-Agent': 'kodelyth-ecc-action',
+        'Accept': 'application/vnd.github+json',
+      },
+    }, (res) => {
+      let data = '';
+      res.on('data', c => data += c);
+      res.on('end', () => {
+        try { resolve(JSON.parse(data)); }
+        catch (e) { reject(e); }
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+function upsertComment(body, existingId) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify({ body });
+    const opts = existingId ? {
+      hostname: 'api.github.com',
+      path: `/repos/${repo}/issues/comments/${existingId}`,
+      method: 'PATCH',
+    } : {
+      hostname: 'api.github.com',
+      path: `/repos/${repo}/issues/${prNumber}/comments`,
+      method: 'POST',
+    };
+    opts.headers = {
+      'Authorization': `token ${token}`,
+      'User-Agent': 'kodelyth-ecc-action',
+      'Accept': 'application/vnd.github+json',
+      'Content-Type': 'application/json',
+      'Content-Length': Buffer.byteLength(payload),
+    };
+    const req = https.request(opts, (res) => {
+      let data = '';
+      res.on('data', c => data += c);
+      res.on('end', () => {
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          resolve(JSON.parse(data));
+        } else {
+          reject(new Error(`GitHub API ${res.statusCode}: ${data}`));
+        }
+      });
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+(async () => {
+  try {
+    const body = buildComment();
+    let comments = [];
+    try {
+      comments = await listComments();
+    } catch (err) {
+      console.log(`::warning::Could not list existing comments (${err.message}); will create new.`);
+    }
+    const existing = Array.isArray(comments)
+      ? comments.find(c => c.body && c.body.includes('Kodelyth ECC — Devil Mode Review'))
+      : null;
+    const result = await upsertComment(body, existing ? existing.id : null);
+    console.log(`::notice::PR comment ${existing ? 'updated' : 'created'}: ${result.html_url || ''}`);
+  } catch (err) {
+    console.log(`::error::Failed to post PR comment: ${err.message}`);
+    process.exit(1);
+  }
+})();