kodelyth-ecc 2.17.0 → 2.18.0

package/CHANGELOG.md

@@ -2,6 +2,49 @@
 
 All notable changes to Kodelyth ECC are documented here.
 
+## v2.18.0 — Support channels, shell portability, honest counts (September 2026)
+
+### Added — Support
+
+The README had **no support section at all**. There is now one, and the same
+details reach the site, the npm page, and the repository metadata from a single
+place each.
+
+| Channel | Reach us |
+|---|---|
+| Email | [ecc@kodelyth.com](mailto:ecc@kodelyth.com) |
+| WhatsApp | [+880 1312 365939](https://wa.me/8801312365939) |
+
+`package.json` now carries `bugs.email` so `npm bugs` resolves, and `homepage`
+points at the docs site rather than the repo.
+
+### Added — `rules/common/shell-portability.md`
+
+An always-on rule, so all 70 agents inherit it rather than 70 separate edits.
+
+Every row in its table was **verified on a stock macOS shell**, not assumed:
+
+```
+timeout       ABSENT (GNU coreutils only)   <- this one bit me mid-session
+stat -c       FAILS (BSD needs -f)
+sed -i        FAILS (BSD needs -i '')
+grep -P       FAILS (no PCRE in BSD grep)
+```
+
+Suggesting `timeout 30 npm test` to a macOS user wastes their turn. The rule
+gives the portable form for each, covers Windows/PowerShell, and tells agents to
+prefer the language runtime over the shell when a task can be done either way.
+Verified installing correctly via a real install into a sandboxed `HOME`.
+
+### Fixed — counts that had drifted for releases
+
+`97 slash commands` was a different string from `97 commands`, so an earlier
+sweep missed it — the site advertised 97 while the real number was 103. Every
+count is now correct in both repos, and on the site they are **derived** from the
+synced catalogs rather than hardcoded in six files.
+
+**604 tests passing.**
+
 ## v2.17.0 — ECC Immunity: the arena's findings, made executable (September 2026)
 
 Four arena runs confirmed real bugs and stored them as prose. Prose does not

package/CLAUDE.md

@@ -10,7 +10,7 @@ Guidance for Claude Code when working with this repository.
 - **196 skills** — domain knowledge, patterns, testing, security, intent routing, local memory, swarm orchestration, MCP integration
 - **103 commands** — slash workflows (`/tdd`, `/plan`, `/code-review`, `/team-review`, `/devil-mode`, `/debug-blitz`, `/security-audit`, ...)
 - **22+ hooks** — quality gates, memory inject + capture, correction encoding, prompt-injection guard, token-budget enforcer
-- **14 rules** — always-on coding standards + semantic intent routing + memory protocol + self-improvement
+- **15 rules** — always-on coding standards + semantic intent routing + memory protocol + self-improvement
 
 Works with Claude Code, Windsurf, Cursor, Codex CLI, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, and Gemini CLI — **11 platforms** (13 install targets).
 
@@ -21,7 +21,7 @@ agents/      → 70 specialist subagents (planner, code-reviewer, debug-detectiv
 commands/    → 103 slash commands (8 parallel multi-agent, 1 adversarial loop, rest single-agent)
 skills/      → 196 workflow + domain knowledge files (loadable via slash commands)
 hooks/       → 22+ automations (pre-commit, session memory, prompt-injection guard, token-budget)
-rules/       → 14 always-on guidelines (agent-intent-routing, self-improvement, memory-protocol, ...)
+rules/       → 15 always-on guidelines (agent-intent-routing, self-improvement, memory-protocol, ...)
 scripts/     → Node.js utilities: MCP server, dashboard, swarm, replay, router, memory, supply-chain
 bundles/     → 3 power bundles (indie-hacker, red-team, enterprise)
 actions/     → GitHub Action (CI/CD integration for PR review)

package/README.md

@@ -33,7 +33,7 @@
 
 </div>
 
-**Kodelyth ECC** is a production-grade AI coding toolkit — **70 specialist agents (incl. an 8-agent devil-mode adversarial crew), 196 skills, 102 commands**, a god-tier **semantic intent-routing system**, local self-learning memory, MCP server, swarm orchestrator, and an observability dashboard — all local, zero telemetry.
+**Kodelyth ECC** is a production-grade AI coding toolkit — **70 specialist agents (incl. an 8-agent devil-mode adversarial crew), 196 skills, 103 commands**, a god-tier **semantic intent-routing system**, local self-learning memory, MCP server, swarm orchestrator, and an observability dashboard — all local, zero telemetry.
 
 Now bundled with:
 
@@ -73,7 +73,7 @@ You never typed `use debug-detective`. You didn't have to. The toolkit read the
 | **Intent routing** | Plain-language → right specialist via 10-tier priority rules | Mostly missing — you memorize names |
 | **70 agents** | Specialists with playbooks, severity calibration, real commands | Often persona-only ("you are a senior engineer...") |
 | **196 skills** | Domain knowledge files agents read on demand | Rarely separated from agents |
-| **102 commands** | Slash workflows (`/tdd`, `/arena`, `/devil-mode`, `/team-review`) | Limited or none |
+| **103 commands** | Slash workflows (`/tdd`, `/arena`, `/devil-mode`, `/team-review`) | Limited or none |
 | **8 parallel commands** | Fire 3-8 agents simultaneously, aggregate results | Rare |
 | **Compound memory** | BM25 local recall + auto-inject + project lessons | Cloud-only or absent |
 | **22+ hooks** | Quality gates, secret scan, project-DNA detection | Often missing |
@@ -118,7 +118,7 @@ kodelythecc --target claude-code --codebase-graph
 That's it. This single flow:
 
 1. Installs both binaries (`kodelyth-ecc` and short-form `kodelythecc`) to your PATH
-2. Copies 70 agents + 196 skills + 102 commands + 22 hooks + 14 rules into your AI tool's config dir
+2. Copies 70 agents + 196 skills + 103 commands + 22 hooks + 15 rules into your AI tool's config dir
 3. Auto-installs **RTK** binary and wires its PreToolUse hook (input compression starts on next AI restart)
 4. Installs **Terse mode** skill + `/terse` and `/terse-compress` slash commands (dormant — user types `/terse` to activate)
 5. Auto-installs **codebase-memory-mcp** and registers its MCP entries in your AI tool (with `--codebase-graph`)
@@ -220,7 +220,7 @@ npx kodelyth-ecc --bundle red-team        # Security engineer — devil-mode + a
 npx kodelyth-ecc --bundle enterprise      # Compliance / audit team — SBOM, license, supply chain
 ```
 
-Each bundle installs the full ECC toolkit (all 70 agents, 196 skills, 102 commands, 22+ hooks), adds a `BUNDLE.md` cheat sheet, and biases the AI toward audience-fit workflows on every session.
+Each bundle installs the full ECC toolkit (all 70 agents, 196 skills, 103 commands, 22+ hooks), adds a `BUNDLE.md` cheat sheet, and biases the AI toward audience-fit workflows on every session.
 
 Combine with any target:
 
@@ -417,7 +417,7 @@ What's inside:
 | **Overview** | Agent count, memory stats, session count, recent activity |
 | **Memory** | Browse, search, and manage your local BM25 memory store |
 | **Evolve** | Self-improving memory — review AI-proposed refinements |
-| **Catalog** | Full searchable index of all 70 agents, 196 skills, 102 commands |
+| **Catalog** | Full searchable index of all 70 agents, 196 skills, 103 commands |
 | **Sessions** | **Live IDE activity** (Claude Code, Windsurf, Windsurf-Next, Cursor, Antigravity) + orchestration/swarm sessions |
 
 Real-time:
@@ -1069,6 +1069,26 @@ v1.4.0 highlights:
 
 ---
 
+## Support
+
+Real people, and we answer.
+
+| Channel | Reach us |
+|---|---|
+| Email | **[ecc@kodelyth.com](mailto:ecc@kodelyth.com)** |
+| WhatsApp | **[+880 1312 365939](https://wa.me/8801312365939)** |
+| Bug reports | [GitHub Issues](https://github.com/sifxprime/kodelyth-ecc/issues) |
+| Docs | [ecc.kodelyth.com/docs](https://ecc.kodelyth.com/docs) |
+
+**Found a security issue?** Email [ecc@kodelyth.com](mailto:ecc@kodelyth.com)
+directly rather than opening a public issue, and give us a reasonable window to
+ship a fix before disclosing it.
+
+When reporting a bug, the three things that get it fixed fastest are the exact
+command you ran, the full error, and your `kodelythecc doctor` output.
+
+---
+
 <div align="center">
 
 [![npm](https://img.shields.io/badge/npm-kodelyth--ecc-red.svg)](https://www.npmjs.com/package/kodelyth-ecc)

package/VERSION

@@ -1 +1 @@
-2.17.0
+2.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.17.0",
+  "version": "2.18.0",
   "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 194 skills, 97 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",
@@ -8,9 +8,10 @@
     "type": "git",
     "url": "https://github.com/sifxprime/kodelyth-ecc.git"
   },
-  "homepage": "https://github.com/sifxprime/kodelyth-ecc",
+  "homepage": "https://ecc.kodelyth.com",
   "bugs": {
-    "url": "https://github.com/sifxprime/kodelyth-ecc/issues"
+    "url": "https://github.com/sifxprime/kodelyth-ecc/issues",
+    "email": "ecc@kodelyth.com"
   },
   "keywords": [
     "claude-code",

package/rules/common/shell-portability.md

@@ -0,0 +1,70 @@
+# Shell Portability — commands that work on the user's machine, not just yours
+
+> Always-on. Every agent that runs a shell command loads this.
+
+An agent that suggests `timeout 30 npm test` on macOS has wasted the user's turn:
+`timeout` is GNU coreutils and **is not installed on macOS by default**. The same
+goes for half the flags people reach for by habit.
+
+The rule is simple: **assume nothing about the user's OS or installed tools.**
+Detect, or use the portable form.
+
+## Verified differences
+
+Every row below was checked on a stock macOS shell. These are not theoretical.
+
+| You reach for | Breaks on | Portable form |
+|---|---|---|
+| `timeout 30 cmd` | **macOS** — not installed | run without it, or `command -v timeout \|\| gtimeout` |
+| `stat -c %s f` | **macOS/BSD** | `stat -f %z f` on BSD; `wc -c < f` works everywhere |
+| `sed -i 's/a/b/' f` | **macOS/BSD** — needs an arg | `sed -i '' 's/a/b/' f` on BSD; or write to a temp and `mv` |
+| `grep -P '\d'` | **macOS/BSD** — no PCRE | `grep -E '[0-9]'` |
+| `readlink -f` | older BSD | `cd "$(dirname "$f")" && pwd -P` |
+| `rg` | **any OS** — ripgrep is not preinstalled | `grep -rn` |
+| `date -d` | **macOS/BSD** | `date -j` on BSD, or do date math in the language |
+| `find -printf` | **macOS/BSD** | `find ... -exec stat ...` or `-print0 \| xargs` |
+
+## Before running a tool that may be absent
+
+```bash
+command -v rg >/dev/null 2>&1 || echo "ripgrep not installed — using grep"
+```
+
+Prefer a single command that works everywhere over a clever one that works on
+yours. `grep -rn "pattern" .` is slower than `rg pattern` and it runs on every
+machine on earth.
+
+## Windows
+
+Windows users on PowerShell have neither `grep`, `sed`, nor `find` in the Unix
+sense. When a task can be done by the language runtime instead of the shell,
+**do it in the runtime** — `node -e`, `python -c` — which behaves identically on
+all three platforms.
+
+```bash
+# Fragile: three different behaviours on three platforms
+find . -name "*.js" -newermt "1 day ago"
+
+# Portable: one behaviour everywhere Node runs
+node -e "…"
+```
+
+## Paths
+
+- Never hardcode `/` as a separator in code — use the language's path join.
+- Never assume `$HOME` exists in a spawned process; on Windows it is `%USERPROFILE%`.
+- Quote every path variable: `"$file"`, not `$file`. Spaces in paths are normal
+  on macOS and Windows.
+
+## When the user reports "works on my machine"
+
+This table is the first thing to check, before deeper debugging. A surprising
+share of "the command did nothing" reports are a BSD/GNU flag difference, and
+`env-debugger` should reach for this rule immediately.
+
+## Checklist before suggesting a shell command
+
+- [ ] Does the binary exist on macOS, Linux, and Windows by default?
+- [ ] Are the flags the same across BSD and GNU?
+- [ ] Are all paths quoted?
+- [ ] Could the language runtime do this identically on all three instead?

package/rules/shell-portability.md

@@ -0,0 +1,70 @@
+# Shell Portability — commands that work on the user's machine, not just yours
+
+> Always-on. Every agent that runs a shell command loads this.
+
+An agent that suggests `timeout 30 npm test` on macOS has wasted the user's turn:
+`timeout` is GNU coreutils and **is not installed on macOS by default**. The same
+goes for half the flags people reach for by habit.
+
+The rule is simple: **assume nothing about the user's OS or installed tools.**
+Detect, or use the portable form.
+
+## Verified differences
+
+Every row below was checked on a stock macOS shell. These are not theoretical.
+
+| You reach for | Breaks on | Portable form |
+|---|---|---|
+| `timeout 30 cmd` | **macOS** — not installed | run without it, or `command -v timeout \|\| gtimeout` |
+| `stat -c %s f` | **macOS/BSD** | `stat -f %z f` on BSD; `wc -c < f` works everywhere |
+| `sed -i 's/a/b/' f` | **macOS/BSD** — needs an arg | `sed -i '' 's/a/b/' f` on BSD; or write to a temp and `mv` |
+| `grep -P '\d'` | **macOS/BSD** — no PCRE | `grep -E '[0-9]'` |
+| `readlink -f` | older BSD | `cd "$(dirname "$f")" && pwd -P` |
+| `rg` | **any OS** — ripgrep is not preinstalled | `grep -rn` |
+| `date -d` | **macOS/BSD** | `date -j` on BSD, or do date math in the language |
+| `find -printf` | **macOS/BSD** | `find ... -exec stat ...` or `-print0 \| xargs` |
+
+## Before running a tool that may be absent
+
+```bash
+command -v rg >/dev/null 2>&1 || echo "ripgrep not installed — using grep"
+```
+
+Prefer a single command that works everywhere over a clever one that works on
+yours. `grep -rn "pattern" .` is slower than `rg pattern` and it runs on every
+machine on earth.
+
+## Windows
+
+Windows users on PowerShell have neither `grep`, `sed`, nor `find` in the Unix
+sense. When a task can be done by the language runtime instead of the shell,
+**do it in the runtime** — `node -e`, `python -c` — which behaves identically on
+all three platforms.
+
+```bash
+# Fragile: three different behaviours on three platforms
+find . -name "*.js" -newermt "1 day ago"
+
+# Portable: one behaviour everywhere Node runs
+node -e "…"
+```
+
+## Paths
+
+- Never hardcode `/` as a separator in code — use the language's path join.
+- Never assume `$HOME` exists in a spawned process; on Windows it is `%USERPROFILE%`.
+- Quote every path variable: `"$file"`, not `$file`. Spaces in paths are normal
+  on macOS and Windows.
+
+## When the user reports "works on my machine"
+
+This table is the first thing to check, before deeper debugging. A surprising
+share of "the command did nothing" reports are a BSD/GNU flag difference, and
+`env-debugger` should reach for this rule immediately.
+
+## Checklist before suggesting a shell command
+
+- [ ] Does the binary exist on macOS, Linux, and Windows by default?
+- [ ] Are the flags the same across BSD and GNU?
+- [ ] Are all paths quoted?
+- [ ] Could the language runtime do this identically on all three instead?