kodelyth-ecc 2.19.0 → 2.20.0

package/.kimi/commands/devil-mode.md

@@ -1,121 +0,0 @@
----
-description: Parallel adversarial sweep — fires prompt-injection-hunter + supply-chain-auditor + secret-hunter + backdoor-hunter simultaneously. The full attacker-mindset audit in one command.
----
-
-# /devil-mode — Adversarial Parallel Sweep
-
-Four red-team specialists attack your codebase from every angle attackers actually use. What would take a security firm a week of billable hours, your repo gets in 20 minutes.
-
-> **Read the brief first.** Each agent thinks like a hostile actor. Findings will be uncomfortable. That's the point.
-
-## What Gets Launched in Parallel
-
-| Agent | Hunts |
-|---|---|
-| `prompt-injection-hunter` | Jailbreak vectors, indirect injection, system-prompt leaks, tool-call hijacking |
-| `supply-chain-auditor` | Typosquats, malicious post-install, lockfile drift, slopsquats, compromised deps |
-| `secret-hunter` | Live secrets, git history leaks, encoded creds, bundled-to-client env vars |
-| `backdoor-hunter` | Obfuscated payloads, network beacons, time bombs, eval/exec abuse, cryptominers |
-
-## Optional Extension Agents
-
-Use these flags to add more agents to the sweep:
-
-| Flag | Adds |
-|---|---|
-| `--license` | `license-violation-finder` (GPL contamination, attribution gaps) |
-| `--theft` | `code-stealer-detector` (copy-paste provenance, copyleft hits) |
-| `--jailbreak` | `jailbreak-tester` (live AI feature red-team) |
-| `--chaos` | `chaos-engineer` (fault-injection plan generation) |
-| `--all` | All 8 agents — the **full devil sweep** |
-
-## Usage
-
-```
-/devil-mode                  # 4-agent default sweep
-/devil-mode --all            # all 8 adversarial agents
-/devil-mode src/auth/        # focus on auth module
-/devil-mode --pre-public     # before going open-source: --license + --theft + default
-/devil-mode --pre-launch     # before public launch: --jailbreak + default + --chaos
-```
-
-## Report Format
-
-```
-## DEVIL MODE REPORT
-
-### Prompt Injection Surface (prompt-injection-hunter)
-CRITICAL: [list]
-HIGH:     [list]
-DEFENSE GAPS: [where existing protections can be bypassed]
-
-### Supply Chain (supply-chain-auditor)
-THREATS:    [confirmed malicious / typosquat / drift]
-WATCHLIST:  [suspicious patterns]
-LOCKFILE:   [OK / drift / missing]
-
-### Leaked Secrets (secret-hunter)
-ACTIVE:     [rotate now — still valid]
-HISTORICAL: [git history leaks — assume compromised]
-BUNDLED:    [exposed to every client visit]
-
-### Backdoors / Malicious Code (backdoor-hunter)
-CRITICAL:   [confirmed reverse-shell / RCE / exfiltration]
-SUSPICIOUS: [needs manual decode/review]
-
----
-TOTAL EXPOSURE:    X critical, Y high, Z medium across N agents
-PRIORITIZED ACTIONS:
-  1. [first action — usually rotate or revert]
-  2. [second]
-  3. [third]
-```
-
-## When to Use
-
-- **Before going open-source** — any repo about to be public, run with `--pre-public`
-- **Before any public launch** — run with `--pre-launch`
-- **After accepting code from new contractor / contributor** — full audit with `--all`
-- **Quarterly red-team review** — schedule it
-- **After any compromise alert / vendor security advisory** — verify your exposure
-- **Before M&A due diligence** — what their lawyers will find, you find first
-- **After major dep update** — supply-chain + backdoor + secret sweep
-
-## When NOT to Use
-
-- ❌ On code you don't have permission to audit (run only on your own repos / authorized targets)
-- ❌ On production systems for `chaos-engineer` flag — chaos requires `--staging` or signed-off blast radius
-- ❌ As a substitute for actual security review — this finds patterns; humans verify exploitability
-
-## Execute Now
-
-Invoking this command is confirmation to proceed. Execute immediately:
-
-1. Parse `$ARGUMENTS` for scope path and flags (`--all`, `--license`, `--theft`, `--jailbreak`, `--chaos`, `--pre-public`, `--pre-launch`).
-2. Determine the agent set:
-   - Default: `prompt-injection-hunter`, `supply-chain-auditor`, `secret-hunter`, `backdoor-hunter`
-   - `--pre-public`: default + `license-violation-finder` + `code-stealer-detector`
-   - `--pre-launch`: default + `jailbreak-tester` + `chaos-engineer`
-   - `--all`: all 8
-3. Spawn all selected agents simultaneously with `run_in_background: true`.
-4. Wait for all to complete.
-5. Aggregate findings into the Devil Mode Report format above.
-6. Prioritize actions by severity (critical first), with concrete recommended fix for each.
-7. End with: "Which threat do you want to neutralize first?"
-
-## Severity Priority Order
-
-When aggregating across agents, sort findings by:
-
-1. **Active credential leak** (still valid keys) — rotate immediately
-2. **Confirmed backdoor / malicious code** in current dep — quarantine + revert
-3. **Confirmed prompt injection** with tool-call abuse possible — disable affected agent
-4. **Critical supply-chain threat** (typosquat, malicious postinstall) — remove dep
-5. **Historical credential leak** in git history — rotate, plan history rewrite
-6. **High-severity prompt injection** without tool abuse — patch + monitor
-7. **License/IP exposure** — remediate before any public action
-8. **Suspicious patterns needing manual review** — schedule deep dive
-
----
-
-**Remember:** The devil-mode report is uncomfortable on purpose. Every finding here is one an attacker can find too — the only question is whether you fix it first.

package/.kimi/commands/docs.md

@@ -1,23 +0,0 @@
----
-description: Legacy slash-entry shim for the documentation-lookup skill. Prefer the skill directly.
----
-
-# Docs Command (Legacy Shim)
-
-Use this only if you still reach for `/docs`. The maintained workflow lives in `skills/documentation-lookup/SKILL.md`.
-
-## Canonical Surface
-
-- Prefer the `documentation-lookup` skill directly.
-- Keep this file only as a compatibility entry point.
-
-## Arguments
-
-`$ARGUMENTS`
-
-## Delegation
-
-Apply the `documentation-lookup` skill.
-- If the library or the question is missing, ask for the missing part.
-- Use live documentation through Context7 instead of training data.
-- Return only the current answer and the minimum code/example surface needed.

package/.kimi/commands/doctor.md

@@ -1,75 +0,0 @@
----
-description: Diagnose your Kodelyth ECC install — check for drift, missing files, version mismatches, and confirm everything is healthy
----
-
-# /doctor
-
-Runs a health check on your ECC install. Detects drift between what was installed and what is currently on disk.
-
-## What It Checks
-
-- Install state file exists and is readable
-- Installed version vs latest available
-- Agent files present and uncorrupted
-- Skills directory intact
-- Rules loaded correctly
-- Memory store accessible (if applicable)
-- Hooks registered (Claude Code only)
-
-## Usage
-
-```
-/doctor
-```
-
-Run with no arguments for a full health report on all detected installs.
-
-## Implementation
-
-Runs the built-in doctor script:
-
-```bash
-node scripts/doctor.js
-```
-
-Or with a specific target:
-
-```bash
-node scripts/doctor.js --target claude-home
-node scripts/doctor.js --target windsurf-home
-node scripts/doctor.js --target windsurf-project
-node scripts/doctor.js --target codex-home
-node scripts/doctor.js --target cursor-project
-```
-
-For JSON output (useful in CI or scripts):
-
-```bash
-node scripts/doctor.js --json
-```
-
-## Output
-
-The doctor report shows:
-
-| Field | Meaning |
-|-------|---------|
-| `OK` | Component healthy, no issues |
-| `WARNING` | Potential issue, non-blocking |
-| `ERROR` | Missing or corrupted file, needs attention |
-
-A summary line shows total checked, ok, warnings, and errors.
-
-## When to Run
-
-- After first install to confirm everything landed
-- After upgrading to a new ECC version
-- When an agent or skill isn't behaving as expected
-- Before filing a bug report
-
-## Related
-
-- `/update` — upgrade to the latest ECC version
-- `use kodelyth-advisor` — if you're not sure where to start
-
-> Powered by Kodelyth — trust your install, verify your tools.

package/.kimi/commands/e2e.md

@@ -1,268 +0,0 @@
----
-description: Legacy slash-entry shim for the e2e-testing skill. Prefer the skill directly.
----
-
-# E2E Command (Legacy Shim)
-
-Use this only if you still invoke `/e2e`. The maintained workflow lives in `skills/e2e-testing/SKILL.md`.
-
-## Canonical Surface
-
-- Prefer the `e2e-testing` skill directly.
-- Keep this file only as a compatibility entry point.
-
-## Arguments
-
-`$ARGUMENTS`
-
-## Delegation
-
-Apply the `e2e-testing` skill.
-- Generate or update Playwright coverage for the requested user flow.
-- Run only the relevant tests unless the user explicitly asked for the entire suite.
-- Capture the usual artifacts and report failures, flake risk, and next fixes without duplicating the full skill body here.
-    await marketsPage.searchMarkets('xyznonexistentmarket123456')
-
-    // Verify empty state
-    await expect(page.locator('[data-testid="no-results"]')).toBeVisible()
-    await expect(page.locator('[data-testid="no-results"]')).toContainText(
-      /no.*results|no.*markets/i
-    )
-
-    const marketCount = await marketsPage.marketCards.count()
-    expect(marketCount).toBe(0)
-  })
-
-  test('can clear search and see all markets again', async ({ page }) => {
-    const marketsPage = new MarketsPage(page)
-    await marketsPage.goto()
-
-    // Initial market count
-    const initialCount = await marketsPage.marketCards.count()
-
-    // Perform search
-    await marketsPage.searchMarkets('trump')
-    await page.waitForLoadState('networkidle')
-
-    // Verify filtered results
-    const filteredCount = await marketsPage.marketCards.count()
-    expect(filteredCount).toBeLessThan(initialCount)
-
-    // Clear search
-    await marketsPage.searchInput.clear()
-    await page.waitForLoadState('networkidle')
-
-    // Verify all markets shown again
-    const finalCount = await marketsPage.marketCards.count()
-    expect(finalCount).toBe(initialCount)
-  })
-})
-```
-
-## Running Tests
-
-```bash
-# Run the generated test
-npx playwright test tests/e2e/markets/search-and-view.spec.ts
-
-Running 3 tests using 3 workers
-
-  ✓  [chromium] › search-and-view.spec.ts:5:3 › user can search markets and view details (4.2s)
-  ✓  [chromium] › search-and-view.spec.ts:52:3 › search with no results shows empty state (1.8s)
-  ✓  [chromium] › search-and-view.spec.ts:67:3 › can clear search and see all markets again (2.9s)
-
-  3 passed (9.1s)
-
-Artifacts generated:
-- artifacts/search-results.png
-- artifacts/market-details.png
-- playwright-report/index.html
-```
-
-## Test Report
-
-```
-╔══════════════════════════════════════════════════════════════╗
-║                    E2E Test Results                          ║
-╠══════════════════════════════════════════════════════════════╣
-║ Status:     PASS: ALL TESTS PASSED                              ║
-║ Total:      3 tests                                          ║
-║ Passed:     3 (100%)                                         ║
-║ Failed:     0                                                ║
-║ Flaky:      0                                                ║
-║ Duration:   9.1s                                             ║
-╚══════════════════════════════════════════════════════════════╝
-
-Artifacts:
- Screenshots: 2 files
- Videos: 0 files (only on failure)
- Traces: 0 files (only on failure)
- HTML Report: playwright-report/index.html
-
-View report: npx playwright show-report
-```
-
-PASS: E2E test suite ready for CI/CD integration!
-```
-
-## Test Artifacts
-
-When tests run, the following artifacts are captured:
-
-**On All Tests:**
-- HTML Report with timeline and results
-- JUnit XML for CI integration
-
-**On Failure Only:**
-- Screenshot of the failing state
-- Video recording of the test
-- Trace file for debugging (step-by-step replay)
-- Network logs
-- Console logs
-
-## Viewing Artifacts
-
-```bash
-# View HTML report in browser
-npx playwright show-report
-
-# View specific trace file
-npx playwright show-trace artifacts/trace-abc123.zip
-
-# Screenshots are saved in artifacts/ directory
-open artifacts/search-results.png
-```
-
-## Flaky Test Detection
-
-If a test fails intermittently:
-
-```
-WARNING:  FLAKY TEST DETECTED: tests/e2e/markets/trade.spec.ts
-
-Test passed 7/10 runs (70% pass rate)
-
-Common failure:
-"Timeout waiting for element '[data-testid="confirm-btn"]'"
-
-Recommended fixes:
-1. Add explicit wait: await page.waitForSelector('[data-testid="confirm-btn"]')
-2. Increase timeout: { timeout: 10000 }
-3. Check for race conditions in component
-4. Verify element is not hidden by animation
-
-Quarantine recommendation: Mark as test.fixme() until fixed
-```
-
-## Browser Configuration
-
-Tests run on multiple browsers by default:
-- PASS: Chromium (Desktop Chrome)
-- PASS: Firefox (Desktop)
-- PASS: WebKit (Desktop Safari)
-- PASS: Mobile Chrome (optional)
-
-Configure in `playwright.config.ts` to adjust browsers.
-
-## CI/CD Integration
-
-Add to your CI pipeline:
-
-```yaml
-# .github/workflows/e2e.yml
-- name: Install Playwright
-  run: npx playwright install --with-deps
-
-- name: Run E2E tests
-  run: npx playwright test
-
-- name: Upload artifacts
-  if: always()
-  uses: actions/upload-artifact@v3
-  with:
-    name: playwright-report
-    path: playwright-report/
-```
-
-## PMX-Specific Critical Flows
-
-For PMX, prioritize these E2E tests:
-
-**CRITICAL (Must Always Pass):**
-1. User can connect wallet
-2. User can browse markets
-3. User can search markets (semantic search)
-4. User can view market details
-5. User can place trade (with test funds)
-6. Market resolves correctly
-7. User can withdraw funds
-
-**IMPORTANT:**
-1. Market creation flow
-2. User profile updates
-3. Real-time price updates
-4. Chart rendering
-5. Filter and sort markets
-6. Mobile responsive layout
-
-## Best Practices
-
-**DO:**
-- PASS: Use Page Object Model for maintainability
-- PASS: Use data-testid attributes for selectors
-- PASS: Wait for API responses, not arbitrary timeouts
-- PASS: Test critical user journeys end-to-end
-- PASS: Run tests before merging to main
-- PASS: Review artifacts when tests fail
-
-**DON'T:**
-- FAIL: Use brittle selectors (CSS classes can change)
-- FAIL: Test implementation details
-- FAIL: Run tests against production
-- FAIL: Ignore flaky tests
-- FAIL: Skip artifact review on failures
-- FAIL: Test every edge case with E2E (use unit tests)
-
-## Important Notes
-
-**CRITICAL for PMX:**
-- E2E tests involving real money MUST run on testnet/staging only
-- Never run trading tests against production
-- Set `test.skip(process.env.NODE_ENV === 'production')` for financial tests
-- Use test wallets with small test funds only
-
-## Integration with Other Commands
-
-- Use `/plan` to identify critical journeys to test
-- Use `/tdd` for unit tests (faster, more granular)
-- Use `/e2e` for integration and user journey tests
-- Use `/code-review` to verify test quality
-
-## Related Agents
-
-This command invokes the `e2e-runner` agent provided by ECC.
-
-For manual installs, the source file lives at:
-`agents/e2e-runner.md`
-
-## Quick Commands
-
-```bash
-# Run all E2E tests
-npx playwright test
-
-# Run specific test file
-npx playwright test tests/e2e/markets/search.spec.ts
-
-# Run in headed mode (see browser)
-npx playwright test --headed
-
-# Debug test
-npx playwright test --debug
-
-# Generate test code
-npx playwright codegen http://localhost:3000
-
-# View report
-npx playwright show-report
-```

package/.kimi/commands/eval.md

@@ -1,23 +0,0 @@
----
-description: Legacy slash-entry shim for the eval-harness skill. Prefer the skill directly.
----
-
-# Eval Command (Legacy Shim)
-
-Use this only if you still invoke `/eval`. The maintained workflow lives in `skills/eval-harness/SKILL.md`.
-
-## Canonical Surface
-
-- Prefer the `eval-harness` skill directly.
-- Keep this file only as a compatibility entry point.
-
-## Arguments
-
-`$ARGUMENTS`
-
-## Delegation
-
-Apply the `eval-harness` skill.
-- Support the same user intents as before: define, check, report, list, and cleanup.
-- Keep evals capability-first, regression-backed, and evidence-based.
-- Use the skill as the canonical evaluator instead of maintaining a separate command-specific playbook.

package/.kimi/commands/evil-mode.md

@@ -1,106 +0,0 @@
----
-description: EVIL mode — adversarial sweep with scored findings, adversarial verification, and loop-until-dry. The upgrade of /devil-mode — unreproducible findings get refuted instead of padding the report.
-argument-hint: "[scope] [--all|--license|--theft|--jailbreak|--chaos|--pre-public|--pre-launch]"
----
-
-# /evil-mode — Attack Your Own Code
-
-Eight red-team specialists hunt your repository the way an attacker would. Unlike a plain sweep, EVIL mode **grades its own findings** and then **tries to disprove them** — so what reaches you is what survived scrutiny, not everything anyone thought of.
-
-> Findings will be uncomfortable. That is the point. This attacks **your own** codebase so real attackers find nothing left.
-
-## What makes this different from a one-shot scan
-
-| | Plain sweep | EVIL mode |
-|---|---|---|
-| Output | Flat list | Scored: severity × confidence × exploitability |
-| False positives | You triage them | **Adversarially refuted** before you see them |
-| Coverage | One pass | **Loops until two rounds find nothing new** |
-| Handoff | Prose | Structured findings `/god-mode` can consume |
-
-## The crew
-
-**Core (always):** `prompt-injection-hunter` · `supply-chain-auditor` · `secret-hunter` · `backdoor-hunter`
-
-**Opt-in:** `--license` · `--theft` · `--jailbreak` · `--chaos` · `--all`
-
-**Presets:** `--pre-public` (license + theft) · `--pre-launch` (jailbreak + chaos)
-
-## Usage
-
-```
-/evil-mode                      # core 4 on the whole repo
-/evil-mode src/auth             # focus a module
-/evil-mode --all                # all 8 hunters
-/evil-mode --pre-public         # before open-sourcing
-```
-
-Preview crew and cost first:
-```bash
-kodelythecc evil src/auth --all
-```
-
-## Instructions to the assistant
-
-### Stage 1 — Hunt (parallel)
-Launch the selected crew **simultaneously** via the Task tool. Give each agent its scope and tell it:
-
-- `evidence` must **quote the actual offending code**, not describe it.
-- `repro` must be concrete steps or a command.
-- Only claim `confirmed` when you have actually reproduced it.
-- **Do not pad.** Five confirmed findings beat forty guesses.
-
-Each finding comes back as:
-```json
-{ "title", "severity": "critical|high|medium|low|info",
-  "confidence": "confirmed|likely|suspected|speculative",
-  "exploitability": "trivial|moderate|hard|theoretical",
-  "file", "line", "evidence", "repro", "fix" }
-```
-
-### Stage 2 — Verify (the part that matters)
-Take the top findings by risk and, for each, launch a **fresh** agent whose job is to **REFUTE it**:
-
-1. Read the actual code — does the evidence match reality?
-2. Do guards, framework behaviour, or callers already neutralise it?
-3. Try to reproduce it.
-
-Return `confirmed` / `refuted` / `needs_context`. **Default to `refuted` when uncertain.** A finding that cannot be demonstrated is not a finding.
-
-Refuted findings stay in the record (so the same false positive isn't re-litigated) but count as **zero risk**.
-
-### Stage 3 — Loop until dry
-If this is an arena run, sweep again — telling each agent which findings are already known and to hunt what the last pass **missed**. Stop when two consecutive rounds surface nothing new.
-
-### Stage 4 — Report
-
-```
-EVIL MODE — <scope> — round <n>
-  swept:     <agents>
-  found:     <n> · confirmed <n> · refuted <n>
-  open risk: <sum of surviving risk>
-
-CONFIRMED (fix these)
-  [risk] title — file:line
-         repro: <command or steps>
-         fix:   <what to change>
-
-REFUTED (checked, not real)
-  title — why it is not exploitable
-```
-
-Order strictly by risk. Never lead with a `speculative` finding.
-
-## Rules
-
-- **Never invent findings to look thorough.** An empty confirmed list is a valid, good result.
-- **Never report a finding you could not reproduce** without marking it `speculative`.
-- This is for auditing **code you own or are authorised to test**. It is a defensive tool.
-
-## Handoff
-
-```
-/god-mode fix the confirmed findings from the EVIL sweep
-```
-
-GOD mode treats confirmed findings as mandatory work items — each must be fixed or explicitly accepted as risk.