kodelyth-ecc 2.18.0 → 2.19.0

package/.kimi/commands/devil-mode.md

@@ -0,0 +1,121 @@
+---
+description: Parallel adversarial sweep — fires prompt-injection-hunter + supply-chain-auditor + secret-hunter + backdoor-hunter simultaneously. The full attacker-mindset audit in one command.
+---
+
+# /devil-mode — Adversarial Parallel Sweep
+
+Four red-team specialists attack your codebase from every angle attackers actually use. What would take a security firm a week of billable hours, your repo gets in 20 minutes.
+
+> **Read the brief first.** Each agent thinks like a hostile actor. Findings will be uncomfortable. That's the point.
+
+## What Gets Launched in Parallel
+
+| Agent | Hunts |
+|---|---|
+| `prompt-injection-hunter` | Jailbreak vectors, indirect injection, system-prompt leaks, tool-call hijacking |
+| `supply-chain-auditor` | Typosquats, malicious post-install, lockfile drift, slopsquats, compromised deps |
+| `secret-hunter` | Live secrets, git history leaks, encoded creds, bundled-to-client env vars |
+| `backdoor-hunter` | Obfuscated payloads, network beacons, time bombs, eval/exec abuse, cryptominers |
+
+## Optional Extension Agents
+
+Use these flags to add more agents to the sweep:
+
+| Flag | Adds |
+|---|---|
+| `--license` | `license-violation-finder` (GPL contamination, attribution gaps) |
+| `--theft` | `code-stealer-detector` (copy-paste provenance, copyleft hits) |
+| `--jailbreak` | `jailbreak-tester` (live AI feature red-team) |
+| `--chaos` | `chaos-engineer` (fault-injection plan generation) |
+| `--all` | All 8 agents — the **full devil sweep** |
+
+## Usage
+
+```
+/devil-mode                  # 4-agent default sweep
+/devil-mode --all            # all 8 adversarial agents
+/devil-mode src/auth/        # focus on auth module
+/devil-mode --pre-public     # before going open-source: --license + --theft + default
+/devil-mode --pre-launch     # before public launch: --jailbreak + default + --chaos
+```
+
+## Report Format
+
+```
+## DEVIL MODE REPORT
+
+### Prompt Injection Surface (prompt-injection-hunter)
+CRITICAL: [list]
+HIGH:     [list]
+DEFENSE GAPS: [where existing protections can be bypassed]
+
+### Supply Chain (supply-chain-auditor)
+THREATS:    [confirmed malicious / typosquat / drift]
+WATCHLIST:  [suspicious patterns]
+LOCKFILE:   [OK / drift / missing]
+
+### Leaked Secrets (secret-hunter)
+ACTIVE:     [rotate now — still valid]
+HISTORICAL: [git history leaks — assume compromised]
+BUNDLED:    [exposed to every client visit]
+
+### Backdoors / Malicious Code (backdoor-hunter)
+CRITICAL:   [confirmed reverse-shell / RCE / exfiltration]
+SUSPICIOUS: [needs manual decode/review]
+
+---
+TOTAL EXPOSURE:    X critical, Y high, Z medium across N agents
+PRIORITIZED ACTIONS:
+  1. [first action — usually rotate or revert]
+  2. [second]
+  3. [third]
+```
+
+## When to Use
+
+- **Before going open-source** — any repo about to be public, run with `--pre-public`
+- **Before any public launch** — run with `--pre-launch`
+- **After accepting code from new contractor / contributor** — full audit with `--all`
+- **Quarterly red-team review** — schedule it
+- **After any compromise alert / vendor security advisory** — verify your exposure
+- **Before M&A due diligence** — what their lawyers will find, you find first
+- **After major dep update** — supply-chain + backdoor + secret sweep
+
+## When NOT to Use
+
+- ❌ On code you don't have permission to audit (run only on your own repos / authorized targets)
+- ❌ On production systems for `chaos-engineer` flag — chaos requires `--staging` or signed-off blast radius
+- ❌ As a substitute for actual security review — this finds patterns; humans verify exploitability
+
+## Execute Now
+
+Invoking this command is confirmation to proceed. Execute immediately:
+
+1. Parse `$ARGUMENTS` for scope path and flags (`--all`, `--license`, `--theft`, `--jailbreak`, `--chaos`, `--pre-public`, `--pre-launch`).
+2. Determine the agent set:
+   - Default: `prompt-injection-hunter`, `supply-chain-auditor`, `secret-hunter`, `backdoor-hunter`
+   - `--pre-public`: default + `license-violation-finder` + `code-stealer-detector`
+   - `--pre-launch`: default + `jailbreak-tester` + `chaos-engineer`
+   - `--all`: all 8
+3. Spawn all selected agents simultaneously with `run_in_background: true`.
+4. Wait for all to complete.
+5. Aggregate findings into the Devil Mode Report format above.
+6. Prioritize actions by severity (critical first), with concrete recommended fix for each.
+7. End with: "Which threat do you want to neutralize first?"
+
+## Severity Priority Order
+
+When aggregating across agents, sort findings by:
+
+1. **Active credential leak** (still valid keys) — rotate immediately
+2. **Confirmed backdoor / malicious code** in current dep — quarantine + revert
+3. **Confirmed prompt injection** with tool-call abuse possible — disable affected agent
+4. **Critical supply-chain threat** (typosquat, malicious postinstall) — remove dep
+5. **Historical credential leak** in git history — rotate, plan history rewrite
+6. **High-severity prompt injection** without tool abuse — patch + monitor
+7. **License/IP exposure** — remediate before any public action
+8. **Suspicious patterns needing manual review** — schedule deep dive
+
+---
+
+**Remember:** The devil-mode report is uncomfortable on purpose. Every finding here is one an attacker can find too — the only question is whether you fix it first.

package/.kimi/commands/docs.md

@@ -0,0 +1,23 @@
+---
+description: Legacy slash-entry shim for the documentation-lookup skill. Prefer the skill directly.
+---
+
+# Docs Command (Legacy Shim)
+
+Use this only if you still reach for `/docs`. The maintained workflow lives in `skills/documentation-lookup/SKILL.md`.
+
+## Canonical Surface
+
+- Prefer the `documentation-lookup` skill directly.
+- Keep this file only as a compatibility entry point.
+
+## Arguments
+
+`$ARGUMENTS`
+
+## Delegation
+
+Apply the `documentation-lookup` skill.
+- If the library or the question is missing, ask for the missing part.
+- Use live documentation through Context7 instead of training data.
+- Return only the current answer and the minimum code/example surface needed.

package/.kimi/commands/doctor.md

@@ -0,0 +1,75 @@
+---
+description: Diagnose your Kodelyth ECC install — check for drift, missing files, version mismatches, and confirm everything is healthy
+---
+
+# /doctor
+
+Runs a health check on your ECC install. Detects drift between what was installed and what is currently on disk.
+
+## What It Checks
+
+- Install state file exists and is readable
+- Installed version vs latest available
+- Agent files present and uncorrupted
+- Skills directory intact
+- Rules loaded correctly
+- Memory store accessible (if applicable)
+- Hooks registered (Claude Code only)
+
+## Usage
+
+```
+/doctor
+```
+
+Run with no arguments for a full health report on all detected installs.
+
+## Implementation
+
+Runs the built-in doctor script:
+
+```bash
+node scripts/doctor.js
+```
+
+Or with a specific target:
+
+```bash
+node scripts/doctor.js --target claude-home
+node scripts/doctor.js --target windsurf-home
+node scripts/doctor.js --target windsurf-project
+node scripts/doctor.js --target codex-home
+node scripts/doctor.js --target cursor-project
+```
+
+For JSON output (useful in CI or scripts):
+
+```bash
+node scripts/doctor.js --json
+```
+
+## Output
+
+The doctor report shows:
+
+| Field | Meaning |
+|-------|---------|
+| `OK` | Component healthy, no issues |
+| `WARNING` | Potential issue, non-blocking |
+| `ERROR` | Missing or corrupted file, needs attention |
+
+A summary line shows total checked, ok, warnings, and errors.
+
+## When to Run
+
+- After first install to confirm everything landed
+- After upgrading to a new ECC version
+- When an agent or skill isn't behaving as expected
+- Before filing a bug report
+
+## Related
+
+- `/update` — upgrade to the latest ECC version
+- `use kodelyth-advisor` — if you're not sure where to start
+
+> Powered by Kodelyth — trust your install, verify your tools.

package/.kimi/commands/e2e.md

@@ -0,0 +1,268 @@
+---
+description: Legacy slash-entry shim for the e2e-testing skill. Prefer the skill directly.
+---
+
+# E2E Command (Legacy Shim)
+
+Use this only if you still invoke `/e2e`. The maintained workflow lives in `skills/e2e-testing/SKILL.md`.
+
+## Canonical Surface
+
+- Prefer the `e2e-testing` skill directly.
+- Keep this file only as a compatibility entry point.
+
+## Arguments
+
+`$ARGUMENTS`
+
+## Delegation
+
+Apply the `e2e-testing` skill.
+- Generate or update Playwright coverage for the requested user flow.
+- Run only the relevant tests unless the user explicitly asked for the entire suite.
+- Capture the usual artifacts and report failures, flake risk, and next fixes without duplicating the full skill body here.
+    await marketsPage.searchMarkets('xyznonexistentmarket123456')
+
+    // Verify empty state
+    await expect(page.locator('[data-testid="no-results"]')).toBeVisible()
+    await expect(page.locator('[data-testid="no-results"]')).toContainText(
+      /no.*results|no.*markets/i
+    )
+
+    const marketCount = await marketsPage.marketCards.count()
+    expect(marketCount).toBe(0)
+  })
+
+  test('can clear search and see all markets again', async ({ page }) => {
+    const marketsPage = new MarketsPage(page)
+    await marketsPage.goto()
+
+    // Initial market count
+    const initialCount = await marketsPage.marketCards.count()
+
+    // Perform search
+    await marketsPage.searchMarkets('trump')
+    await page.waitForLoadState('networkidle')
+
+    // Verify filtered results
+    const filteredCount = await marketsPage.marketCards.count()
+    expect(filteredCount).toBeLessThan(initialCount)
+
+    // Clear search
+    await marketsPage.searchInput.clear()
+    await page.waitForLoadState('networkidle')
+
+    // Verify all markets shown again
+    const finalCount = await marketsPage.marketCards.count()
+    expect(finalCount).toBe(initialCount)
+  })
+})
+```
+
+## Running Tests
+
+```bash
+# Run the generated test
+npx playwright test tests/e2e/markets/search-and-view.spec.ts
+
+Running 3 tests using 3 workers
+
+  ✓  [chromium] › search-and-view.spec.ts:5:3 › user can search markets and view details (4.2s)
+  ✓  [chromium] › search-and-view.spec.ts:52:3 › search with no results shows empty state (1.8s)
+  ✓  [chromium] › search-and-view.spec.ts:67:3 › can clear search and see all markets again (2.9s)
+
+  3 passed (9.1s)
+
+Artifacts generated:
+- artifacts/search-results.png
+- artifacts/market-details.png
+- playwright-report/index.html
+```
+
+## Test Report
+
+```
+╔══════════════════════════════════════════════════════════════╗
+║                    E2E Test Results                          ║
+╠══════════════════════════════════════════════════════════════╣
+║ Status:     PASS: ALL TESTS PASSED                              ║
+║ Total:      3 tests                                          ║
+║ Passed:     3 (100%)                                         ║
+║ Failed:     0                                                ║
+║ Flaky:      0                                                ║
+║ Duration:   9.1s                                             ║
+╚══════════════════════════════════════════════════════════════╝
+
+Artifacts:
+ Screenshots: 2 files
+ Videos: 0 files (only on failure)
+ Traces: 0 files (only on failure)
+ HTML Report: playwright-report/index.html
+
+View report: npx playwright show-report
+```
+
+PASS: E2E test suite ready for CI/CD integration!
+```
+
+## Test Artifacts
+
+When tests run, the following artifacts are captured:
+
+**On All Tests:**
+- HTML Report with timeline and results
+- JUnit XML for CI integration
+
+**On Failure Only:**
+- Screenshot of the failing state
+- Video recording of the test
+- Trace file for debugging (step-by-step replay)
+- Network logs
+- Console logs
+
+## Viewing Artifacts
+
+```bash
+# View HTML report in browser
+npx playwright show-report
+
+# View specific trace file
+npx playwright show-trace artifacts/trace-abc123.zip
+
+# Screenshots are saved in artifacts/ directory
+open artifacts/search-results.png
+```
+
+## Flaky Test Detection
+
+If a test fails intermittently:
+
+```
+WARNING:  FLAKY TEST DETECTED: tests/e2e/markets/trade.spec.ts
+
+Test passed 7/10 runs (70% pass rate)
+
+Common failure:
+"Timeout waiting for element '[data-testid="confirm-btn"]'"
+
+Recommended fixes:
+1. Add explicit wait: await page.waitForSelector('[data-testid="confirm-btn"]')
+2. Increase timeout: { timeout: 10000 }
+3. Check for race conditions in component
+4. Verify element is not hidden by animation
+
+Quarantine recommendation: Mark as test.fixme() until fixed
+```
+
+## Browser Configuration
+
+Tests run on multiple browsers by default:
+- PASS: Chromium (Desktop Chrome)
+- PASS: Firefox (Desktop)
+- PASS: WebKit (Desktop Safari)
+- PASS: Mobile Chrome (optional)
+
+Configure in `playwright.config.ts` to adjust browsers.
+
+## CI/CD Integration
+
+Add to your CI pipeline:
+
+```yaml
+# .github/workflows/e2e.yml
+- name: Install Playwright
+  run: npx playwright install --with-deps
+
+- name: Run E2E tests
+  run: npx playwright test
+
+- name: Upload artifacts
+  if: always()
+  uses: actions/upload-artifact@v3
+  with:
+    name: playwright-report
+    path: playwright-report/
+```
+
+## PMX-Specific Critical Flows
+
+For PMX, prioritize these E2E tests:
+
+**CRITICAL (Must Always Pass):**
+1. User can connect wallet
+2. User can browse markets
+3. User can search markets (semantic search)
+4. User can view market details
+5. User can place trade (with test funds)
+6. Market resolves correctly
+7. User can withdraw funds
+
+**IMPORTANT:**
+1. Market creation flow
+2. User profile updates
+3. Real-time price updates
+4. Chart rendering
+5. Filter and sort markets
+6. Mobile responsive layout
+
+## Best Practices
+
+**DO:**
+- PASS: Use Page Object Model for maintainability
+- PASS: Use data-testid attributes for selectors
+- PASS: Wait for API responses, not arbitrary timeouts
+- PASS: Test critical user journeys end-to-end
+- PASS: Run tests before merging to main
+- PASS: Review artifacts when tests fail
+
+**DON'T:**
+- FAIL: Use brittle selectors (CSS classes can change)
+- FAIL: Test implementation details
+- FAIL: Run tests against production
+- FAIL: Ignore flaky tests
+- FAIL: Skip artifact review on failures
+- FAIL: Test every edge case with E2E (use unit tests)
+
+## Important Notes
+
+**CRITICAL for PMX:**
+- E2E tests involving real money MUST run on testnet/staging only
+- Never run trading tests against production
+- Set `test.skip(process.env.NODE_ENV === 'production')` for financial tests
+- Use test wallets with small test funds only
+
+## Integration with Other Commands
+
+- Use `/plan` to identify critical journeys to test
+- Use `/tdd` for unit tests (faster, more granular)
+- Use `/e2e` for integration and user journey tests
+- Use `/code-review` to verify test quality
+
+## Related Agents
+
+This command invokes the `e2e-runner` agent provided by ECC.
+
+For manual installs, the source file lives at:
+`agents/e2e-runner.md`
+
+## Quick Commands
+
+```bash
+# Run all E2E tests
+npx playwright test
+
+# Run specific test file
+npx playwright test tests/e2e/markets/search.spec.ts
+
+# Run in headed mode (see browser)
+npx playwright test --headed
+
+# Debug test
+npx playwright test --debug
+
+# Generate test code
+npx playwright codegen http://localhost:3000
+
+# View report
+npx playwright show-report
+```

package/.kimi/commands/eval.md

@@ -0,0 +1,23 @@
+---
+description: Legacy slash-entry shim for the eval-harness skill. Prefer the skill directly.
+---
+
+# Eval Command (Legacy Shim)
+
+Use this only if you still invoke `/eval`. The maintained workflow lives in `skills/eval-harness/SKILL.md`.
+
+## Canonical Surface
+
+- Prefer the `eval-harness` skill directly.
+- Keep this file only as a compatibility entry point.
+
+## Arguments
+
+`$ARGUMENTS`
+
+## Delegation
+
+Apply the `eval-harness` skill.
+- Support the same user intents as before: define, check, report, list, and cleanup.
+- Keep evals capability-first, regression-backed, and evidence-based.
+- Use the skill as the canonical evaluator instead of maintaining a separate command-specific playbook.

package/.kimi/commands/evil-mode.md

@@ -0,0 +1,106 @@
+---
+description: EVIL mode — adversarial sweep with scored findings, adversarial verification, and loop-until-dry. The upgrade of /devil-mode — unreproducible findings get refuted instead of padding the report.
+argument-hint: "[scope] [--all|--license|--theft|--jailbreak|--chaos|--pre-public|--pre-launch]"
+---
+
+# /evil-mode — Attack Your Own Code
+
+Eight red-team specialists hunt your repository the way an attacker would. Unlike a plain sweep, EVIL mode **grades its own findings** and then **tries to disprove them** — so what reaches you is what survived scrutiny, not everything anyone thought of.
+
+> Findings will be uncomfortable. That is the point. This attacks **your own** codebase so real attackers find nothing left.
+
+## What makes this different from a one-shot scan
+
+| | Plain sweep | EVIL mode |
+|---|---|---|
+| Output | Flat list | Scored: severity × confidence × exploitability |
+| False positives | You triage them | **Adversarially refuted** before you see them |
+| Coverage | One pass | **Loops until two rounds find nothing new** |
+| Handoff | Prose | Structured findings `/god-mode` can consume |
+
+## The crew
+
+**Core (always):** `prompt-injection-hunter` · `supply-chain-auditor` · `secret-hunter` · `backdoor-hunter`
+
+**Opt-in:** `--license` · `--theft` · `--jailbreak` · `--chaos` · `--all`
+
+**Presets:** `--pre-public` (license + theft) · `--pre-launch` (jailbreak + chaos)
+
+## Usage
+
+```
+/evil-mode                      # core 4 on the whole repo
+/evil-mode src/auth             # focus a module
+/evil-mode --all                # all 8 hunters
+/evil-mode --pre-public         # before open-sourcing
+```
+
+Preview crew and cost first:
+```bash
+kodelythecc evil src/auth --all
+```
+
+## Instructions to the assistant
+
+### Stage 1 — Hunt (parallel)
+Launch the selected crew **simultaneously** via the Task tool. Give each agent its scope and tell it:
+
+- `evidence` must **quote the actual offending code**, not describe it.
+- `repro` must be concrete steps or a command.
+- Only claim `confirmed` when you have actually reproduced it.
+- **Do not pad.** Five confirmed findings beat forty guesses.
+
+Each finding comes back as:
+```json
+{ "title", "severity": "critical|high|medium|low|info",
+  "confidence": "confirmed|likely|suspected|speculative",
+  "exploitability": "trivial|moderate|hard|theoretical",
+  "file", "line", "evidence", "repro", "fix" }
+```
+
+### Stage 2 — Verify (the part that matters)
+Take the top findings by risk and, for each, launch a **fresh** agent whose job is to **REFUTE it**:
+
+1. Read the actual code — does the evidence match reality?
+2. Do guards, framework behaviour, or callers already neutralise it?
+3. Try to reproduce it.
+
+Return `confirmed` / `refuted` / `needs_context`. **Default to `refuted` when uncertain.** A finding that cannot be demonstrated is not a finding.
+
+Refuted findings stay in the record (so the same false positive isn't re-litigated) but count as **zero risk**.
+
+### Stage 3 — Loop until dry
+If this is an arena run, sweep again — telling each agent which findings are already known and to hunt what the last pass **missed**. Stop when two consecutive rounds surface nothing new.
+
+### Stage 4 — Report
+
+```
+EVIL MODE — <scope> — round <n>
+  swept:     <agents>
+  found:     <n> · confirmed <n> · refuted <n>
+  open risk: <sum of surviving risk>
+
+CONFIRMED (fix these)
+  [risk] title — file:line
+         repro: <command or steps>
+         fix:   <what to change>
+
+REFUTED (checked, not real)
+  title — why it is not exploitable
+```
+
+Order strictly by risk. Never lead with a `speculative` finding.
+
+## Rules
+
+- **Never invent findings to look thorough.** An empty confirmed list is a valid, good result.
+- **Never report a finding you could not reproduce** without marking it `speculative`.
+- This is for auditing **code you own or are authorised to test**. It is a defensive tool.
+
+## Handoff
+
+```
+/god-mode fix the confirmed findings from the EVIL sweep
+```
+
+GOD mode treats confirmed findings as mandatory work items — each must be fixed or explicitly accepted as risk.