kodelyth-ecc 2.24.2 → 2.24.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +50 -0
- package/README.md +11 -11
- package/agents/chaos-engineer.md +7 -7
- package/commands/devil-mode.md +3 -3
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,56 @@
|
|
|
2
2
|
|
|
3
3
|
All notable changes to Kodelyth ECC are documented here.
|
|
4
4
|
|
|
5
|
+
## v2.24.3 — remove decorative emoji from docs and catalog (October 2026)
|
|
6
|
+
|
|
7
|
+
Documentation only. No code, no behaviour change.
|
|
8
|
+
|
|
9
|
+
`rules/common/coding-style.md` bans decorative emoji and names the permitted
|
|
10
|
+
status indicators: `PASS`/`FAIL` or the text characters `✓` (U+2713) and `✗`
|
|
11
|
+
(U+2717). Three shipped files were not following it.
|
|
12
|
+
|
|
13
|
+
### README comparison table
|
|
14
|
+
|
|
15
|
+
39 emoji across 11 rows replaced with `✓` / `✗`.
|
|
16
|
+
|
|
17
|
+
This also fixed a polarity bug the emoji were hiding. In every row `❌` meant
|
|
18
|
+
"lacks this", where lacking it is the bad outcome. In the telemetry row it meant
|
|
19
|
+
"none", where none is the *good* outcome — so one glyph carried opposite meanings
|
|
20
|
+
in the same column, and ECC's `❌` sat beside a competitor's `❌` looking like
|
|
21
|
+
agreement while reading as praise and criticism. A mechanical swap would have
|
|
22
|
+
preserved that, so the row now states the value instead of a verdict:
|
|
23
|
+
|
|
24
|
+
| Telemetry | **None** | Varies | None | Varies |
|
|
25
|
+
|
|
26
|
+
### Agent and command bodies
|
|
27
|
+
|
|
28
|
+
10 decorative `❌` prefixes removed from bullet lists in
|
|
29
|
+
`agents/chaos-engineer.md` and `commands/devil-mode.md`. Dropped rather than
|
|
30
|
+
swapped for `✗`: both lists sit under headings that already state the negation —
|
|
31
|
+
"What You DON'T Do" and "When NOT to Use" — so every bullet was marked negative
|
|
32
|
+
twice.
|
|
33
|
+
|
|
34
|
+
These two files were also the upstream source of the emoji appearing on the
|
|
35
|
+
website. `ecc-web` syncs agent bodies into `src/lib/agents.json`, so the site
|
|
36
|
+
inherited them and could not be fixed there; a site-side edit would be
|
|
37
|
+
overwritten by the next sync.
|
|
38
|
+
|
|
39
|
+
### Deliberately left alone
|
|
40
|
+
|
|
41
|
+
`rules/common/coding-style.md` still contains `✅ 🔍 🎯 🚀 ❌`. Every one sits in
|
|
42
|
+
the **Wrong** column of the table teaching which emoji not to use. They are
|
|
43
|
+
quoted specimens, not decoration — stripping them would empty the column and
|
|
44
|
+
leave the rule unable to demonstrate its own point. Future emoji sweeps should
|
|
45
|
+
skip that file.
|
|
46
|
+
|
|
47
|
+
The `← ↑ ↓ ⚙` in README.md are also kept. They sit inside terminal-output code
|
|
48
|
+
blocks and reproduce what the CLI actually prints — the gear comes from
|
|
49
|
+
`scripts/cli/menu.js:243`. Changing them would make the README stop matching the
|
|
50
|
+
tool.
|
|
51
|
+
|
|
52
|
+
Catalog parsing verified unchanged: 70 agents, 103 commands, frontmatter intact.
|
|
53
|
+
**665 tests across 43 files.**
|
|
54
|
+
|
|
5
55
|
## v2.24.2 — adversarial pass: path traversal in get_rule, unrecallable memories (October 2026)
|
|
6
56
|
|
|
7
57
|
**Security fix.** Three defects found by attacking the memory store, MCP server
|
package/README.md
CHANGED
|
@@ -107,18 +107,18 @@ Most "AI agent kits" are folders of markdown files you have to remember the name
|
|
|
107
107
|
| Feature | **Kodelyth ECC** | `agency-agents` | `awesome-claude-agents` | Generic prompt libs |
|
|
108
108
|
|---|---|---|---|---|
|
|
109
109
|
| Specialist agents | **70** | ~30 | ~20 | Varies |
|
|
110
|
-
| Skills as separate layer |
|
|
111
|
-
| Slash commands |
|
|
112
|
-
| **Parallel multi-agent commands** |
|
|
113
|
-
| **Intent routing (plain language → agent)** |
|
|
114
|
-
| **Local BM25 self-learning memory** |
|
|
115
|
-
| **Compound learning from corrections** |
|
|
116
|
-
| **Adversarial / red-team agents** |
|
|
117
|
-
| **Adversarial build/attack loop** |
|
|
118
|
-
| Quality hooks |
|
|
110
|
+
| Skills as separate layer | ✓ 196 | ✗ | ✗ | ✗ |
|
|
111
|
+
| Slash commands | ✓ 103 | Some | Some | ✗ |
|
|
112
|
+
| **Parallel multi-agent commands** | ✓ 8 (incl. `/devil-mode`) | ✗ | ✗ | ✗ |
|
|
113
|
+
| **Intent routing (plain language → agent)** | ✓ 10-tier rule | ✗ | ✗ | ✗ |
|
|
114
|
+
| **Local BM25 self-learning memory** | ✓ | ✗ | ✗ | ✗ |
|
|
115
|
+
| **Compound learning from corrections** | ✓ `tasks/lessons.md` | ✗ | ✗ | ✗ |
|
|
116
|
+
| **Adversarial / red-team agents** | ✓ 8 (devil-mode) | ✗ | ✗ | ✗ |
|
|
117
|
+
| **Adversarial build/attack loop** | ✓ `/arena` — scored, verified, converges | ✗ | ✗ | ✗ |
|
|
118
|
+
| Quality hooks | ✓ 44 | Some | ✗ | ✗ |
|
|
119
119
|
| IDE platforms | **11** (Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, Roo Code, Aider, Kimi, Gemini CLI) | 1-2 | 1 | Varies |
|
|
120
|
-
| Telemetry |
|
|
121
|
-
| Test coverage |
|
|
120
|
+
| Telemetry | **None** | Varies | None | Varies |
|
|
121
|
+
| Test coverage | ✓ 665 tests | ✗ | ✗ | ✗ |
|
|
122
122
|
| Distributed via | `npx`, curl, clone | Manual | Manual | Manual |
|
|
123
123
|
|
|
124
124
|
---
|
package/agents/chaos-engineer.md
CHANGED
|
@@ -173,13 +173,13 @@ curl -X POST localhost:3000/admin/flags/new-feature --data '{"enabled":true}'
|
|
|
173
173
|
|
|
174
174
|
## What You DON'T Do
|
|
175
175
|
|
|
176
|
-
-
|
|
177
|
-
-
|
|
178
|
-
-
|
|
179
|
-
-
|
|
180
|
-
-
|
|
181
|
-
-
|
|
182
|
-
-
|
|
176
|
+
- Run experiments in production without an SRE on call and explicit sign-off
|
|
177
|
+
- Touch production data without an explicit backup and tested restore
|
|
178
|
+
- Cause unbounded blast radius (kill all services, all regions, all replicas)
|
|
179
|
+
- Run during high-traffic events (peak hours, launches, marketing campaigns)
|
|
180
|
+
- Run without monitoring (chaos without observability is just sabotage)
|
|
181
|
+
- Continue past abort criteria — if abort fires, abort, no exceptions
|
|
182
|
+
- Inject faults into systems you don't own without coordination
|
|
183
183
|
|
|
184
184
|
## Output Format
|
|
185
185
|
|
package/commands/devil-mode.md
CHANGED
|
@@ -83,9 +83,9 @@ PRIORITIZED ACTIONS:
|
|
|
83
83
|
|
|
84
84
|
## When NOT to Use
|
|
85
85
|
|
|
86
|
-
-
|
|
87
|
-
-
|
|
88
|
-
-
|
|
86
|
+
- On code you don't have permission to audit (run only on your own repos / authorized targets)
|
|
87
|
+
- On production systems for `chaos-engineer` flag — chaos requires `--staging` or signed-off blast radius
|
|
88
|
+
- As a substitute for actual security review — this finds patterns; humans verify exploitability
|
|
89
89
|
|
|
90
90
|
## Execute Now
|
|
91
91
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kodelyth-ecc",
|
|
3
|
-
"version": "2.24.
|
|
3
|
+
"version": "2.24.3",
|
|
4
4
|
"description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 196 skills, 103 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
|
|
5
5
|
"author": "Kodelyth <github.com/sifxprime>",
|
|
6
6
|
"license": "MIT",
|