kodelyth-ecc 2.25.0 → 2.30.0

package/bin/kodelyth-ecc.js

@@ -21,6 +21,9 @@ const os            = require('os');
 
 const ROOT    = path.join(__dirname, '..');
 
+// Where each IDE target reads skills/commands from (used by `terse` install).
+const { getTargetSkillsDir, getTargetCommandsDir } = require(path.join(ROOT, 'scripts', 'lib', 'target-paths.js'));
+
 // Auto-migrate legacy ~/.kodelyth/ → ~/.kodelythecc/ on first run for existing users.
 // Idempotent; instant no-op if legacy dir is absent or migration marker exists.
 try { require(path.join(ROOT, 'scripts', 'migrate-legacy.js')).main(); } catch { /* best-effort */ }
@@ -141,7 +144,7 @@ if (args[1] === '--help' || args[1] === '-h') {
 
 // ── Subcommand: mcp (start MCP server over stdio) ────────────────────────────
 // Usage: npx kodelyth-ecc mcp
-// Exposes 70 agents, 196 skills, 103 commands, the routing rule, and the local
+// Exposes 71 agents, 196 skills, 104 commands, the routing rule, and the local
 // memory store to any MCP-compatible client (Claude Desktop, LangGraph, etc.).
 if (args[0] === 'mcp') {
   // Hand off entirely to the MCP server — it owns stdio from here on.
@@ -419,11 +422,49 @@ if (args[0] === 'memory') {
       w(`Top tags: ${s.topTags.slice(0, 8).map(t => t[0] + '(' + t[1] + ')').join(', ')}`);
       process.exit(0);
     }
-    process.stderr.write('unknown memory subcommand. try: capture | recall | list | stats\n');
+    // Auto-capture review queue: the Stop hook auto-queues candidates; these are
+    // the consent gate that turns them into stored memories.
+    if (sub === 'list-pending' || sub === 'review-pending') {
+      const pending = require(path.join(ROOT, 'scripts', 'memory', 'pending.js'));
+      const items = pending.listPending();
+      if (!items.length) { w('No memory candidates pending review.'); process.exit(0); }
+      w(`${items.length} candidate(s) pending review:`);
+      for (const c of items) w(`  [${c.id}] (score ${c.score ?? '-'})  ${(c.problem || '').slice(0, 70)}`);
+      w('Confirm: kodelythecc memory promote-pending <id|all>   ·   drop: kodelythecc memory discard-pending <id|all>');
+      process.exit(0);
+    }
+    if (sub === 'promote-pending') {
+      const pending = require(path.join(ROOT, 'scripts', 'memory', 'pending.js'));
+      const sel = rest.find(a => !a.startsWith('--')) || 'all';
+      const stored = pending.promotePending(sel);
+      if (!stored.length) { w('Nothing promoted (no matching pending candidate).'); process.exit(0); }
+      w(`✓ stored ${stored.length} memor${stored.length === 1 ? 'y' : 'ies'}:`);
+      for (const m of stored) w(`  ${m.id}  ${(m.problem || '').slice(0, 60)}`);
+      process.exit(0);
+    }
+    if (sub === 'discard-pending') {
+      const pending = require(path.join(ROOT, 'scripts', 'memory', 'pending.js'));
+      const sel = rest.find(a => !a.startsWith('--')) || 'all';
+      w(`Discarded ${pending.discardPending(sel)} pending candidate(s).`);
+      process.exit(0);
+    }
+    process.stderr.write('unknown memory subcommand. try: capture | recall | list | stats | list-pending | promote-pending | discard-pending\n');
     process.exit(2);
   } catch (e) { process.stderr.write(`[memory] ${e.message}\n`); process.exit(1); }
 }
 
+// ── Subcommand: super-agent (autonomous orchestrator driver) ─────────────────
+// Arena-style state machine: it does not run agents, it tells the driving LLM
+// what to do next. start → plan → step… → integrate → verify → done, resumable.
+//   kodelythecc super-agent start --goal "<objective>" [--token-cap N] [--step-cap N]
+//   kodelythecc super-agent next|status|list <id> ; plan/step/integrate/verify to advance
+if (args[0] === 'super-agent' || args[0] === 'superagent') {
+  try {
+    require(path.join(ROOT, 'scripts', 'super-agent', 'cli.js')).main(args.slice(1));
+    process.exit(0);
+  } catch (e) { process.stderr.write(`[super-agent] ${e.message}\n`); process.exit(1); }
+}
+
 // ── Subcommand: god / evil / arena (the adversarial arena) ──────────────────
 // Usage:
 //   kodelythecc god  --task "<task>" [--json]        plan a GOD-mode build
@@ -716,10 +757,11 @@ if (args[0] === 'doctor') {
   let update;
   try {
     const { cachedCheck } = require(path.join(ROOT, 'scripts', 'cli', 'update-check.js'));
-    const vf = path.join(ROOT, 'VERSION');
-    const current = fs.existsSync(vf)
-      ? fs.readFileSync(vf, 'utf8').trim()
-      : require(path.join(ROOT, 'package.json')).version;
+    // package.json is the source of truth for an npm package; VERSION is only a
+    // fallback. (They drifted once and the CLI reported a stale version.)
+    let current;
+    try { current = require(path.join(ROOT, 'package.json')).version; }
+    catch { try { current = fs.readFileSync(path.join(ROOT, 'VERSION'), 'utf8').trim(); } catch { /* leave undefined */ } }
     update = cachedCheck(current) || undefined;
   } catch { /* never let a version hint break the health check */ }
 
@@ -929,43 +971,8 @@ if (args[0] === 'terse') {
   }
 }
 
-// Normalise alias → canonical target (matches scripts/rtk/index.js).
-function _canon(target) {
-  if (target === 'claude-code') return 'claude-home';
-  if (target === 'gemini-cli')  return 'gemini-home';
-  if (target === 'cursor')      return 'cursor-project';
-  return target;
-}
-function getTargetSkillsDir(target) {
-  const home = os.homedir();
-  switch (_canon(target)) {
-    case 'claude-home':      return path.join(home, '.claude', 'skills');
-    case 'cursor-project':   return path.join(home, '.cursor', 'skills');
-    case 'windsurf-home':
-    case 'windsurf-project': return path.join(home, '.codeium', 'windsurf', 'skills');
-    case 'antigravity':      return path.join(home, '.antigravity', 'skills');
-    case 'codex-home':       return path.join(home, '.codex', 'skills');
-    case 'gemini-home':      return path.join(home, '.gemini', 'skills');
-    case 'gemini-project':   return path.join(process.cwd(), '.gemini', 'skills');
-    case 'opencode':         return path.join(home, '.config', 'opencode', 'skills');
-    default: return null;
-  }
-}
-function getTargetCommandsDir(target) {
-  const home = os.homedir();
-  switch (_canon(target)) {
-    case 'claude-home':      return path.join(home, '.claude', 'commands');
-    case 'cursor-project':   return path.join(home, '.cursor', 'commands');
-    case 'windsurf-home':
-    case 'windsurf-project': return path.join(home, '.codeium', 'windsurf', 'commands');
-    case 'antigravity':      return path.join(home, '.antigravity', 'commands');
-    case 'codex-home':       return path.join(home, '.codex', 'commands');
-    case 'gemini-home':      return path.join(home, '.gemini', 'commands');
-    case 'gemini-project':   return path.join(process.cwd(), '.gemini', 'commands');
-    case 'opencode':         return path.join(home, '.config', 'opencode', 'commands');
-    default: return null;
-  }
-}
+// getTargetSkillsDir / getTargetCommandsDir are imported at the top of this file
+// from scripts/lib/target-paths.js (shared, unit-tested, mirrors install.sh).
 
 // ── Subcommand: route (cost-aware model tier recommendation) ──────────────────
 // Usage: npx kodelyth-ecc route "<task description>" [--files N] [--agent <name>] [--current <model-id>]
@@ -1825,10 +1832,10 @@ if (args.includes('--help') || args.includes('-h')) {
 
 // ── Version shortcut ──────────────────────────────────────────────────────────
 if (args.includes('--version') || args.includes('-v')) {
-  const versionFile = path.join(ROOT, 'VERSION');
-  const version     = fs.existsSync(versionFile)
-    ? fs.readFileSync(versionFile, 'utf8').trim()
-    : require(path.join(ROOT, 'package.json')).version;
+  // package.json is canonical for an npm package; VERSION is only a fallback.
+  let version;
+  try { version = require(path.join(ROOT, 'package.json')).version; }
+  catch { try { version = fs.readFileSync(path.join(ROOT, 'VERSION'), 'utf8').trim(); } catch { version = 'unknown'; } }
   console.log(`kodelyth-ecc v${version}`);
   process.exit(0);
 }

package/bundles/enterprise.md

@@ -137,7 +137,7 @@ Recommended hooks to enable for SOC 2 / ISO 27001 readiness:
 
 ## What This Bundle Surfaces First
 
-You still have all 70 agents — but routing is biased toward:
+You still have all 71 agents — but routing is biased toward:
 
 1. **Auditability** — every recommendation comes with rationale
 2. **Documentation** — every change has a doc impact note

package/bundles/indie-hacker.md

@@ -84,7 +84,7 @@ If you have `/model-route` available, lean on it.
 
 ## What This Bundle Skips by Default
 
-You still have access to all 70 agents — these just aren't surfaced first:
+You still have access to all 71 agents — these just aren't surfaced first:
 
 - Heavy enterprise agents (`compliance-checker` patterns, `architect-of-architects`)
 - Most language-specific reviewers if you're TypeScript/Python only — they're there if you need them

package/commands/super-agent.md

@@ -0,0 +1,47 @@
+---
+name: super-agent
+description: Drive a large objective to completion through the autonomous orchestrator — decompose, dispatch (parallel), integrate branches, verify. Resumable, budget-governed.
+---
+
+# /super-agent
+
+Turn one big objective into a finished, verified result by running it through the
+**super-agent** orchestrator — a deterministic, resumable, budget-governed state
+machine (`scripts/super-agent/`).
+
+## Usage
+
+```
+/super-agent <objective>            e.g. /super-agent build a rate-limited login API with tests
+/super-agent resume <runId>         continue a crashed or earlier run
+```
+
+## What it does
+
+Behaves as the `super-agent` agent and runs the loop:
+
+1. `kodelythecc super-agent start --goal "<objective>" --step-cap <N>` — always with a budget.
+2. `kodelythecc super-agent next <id>` → perform the action it names:
+   - **decompose** → build a dependency DAG with the `blueprint` skill, `… plan <id> --file`.
+   - **dispatch** → run each ready step (parallel where independent, each on its own branch), `… step <id> <step> --status done --branch`.
+   - **integrate** → conflict-check with `scripts/super-agent/integrate.js`, merge in `mergeOrder`, `… integrate <id>` (or `--conflicts …` to stop).
+   - **verify** → run `/verify`, then `… verify <id> --passed|--failed`.
+3. Repeat until **report**.
+
+## When to use it
+
+- A feature or change too large for one pass, that splits into dependent steps.
+- You want parallel execution of independent steps with correct, conflict-checked integration.
+- You want the run to survive a crash and resume.
+
+## When NOT to use it
+
+- A single edit, one-file change, or a quick fix — just do it, or use the specific specialist.
+- Something with no real internal dependencies — the swarm (`/swarm`) or a single agent is lighter.
+
+## Guarantees
+
+- Nothing is faked: a step that did not succeed is recorded `failed`, and a failed
+  dependency stalls the run instead of building on it.
+- The budget cap and integration-conflict stop are honored, never bypassed.
+- `verify --passed` requires the tests/build to actually pass, with evidence.

package/hooks/memory/capture-stop.js

@@ -70,7 +70,7 @@ function main() {
     // ── Improvement A: build contextual advisory from session activity ────────
     const parts = [];
     if (candidates.length > 0) {
-      parts.push(`${candidates.length} memory candidate(s) queued — run "/memory review-pending" to confirm`);
+      parts.push(`${candidates.length} memory candidate(s) queued — review with "kodelythecc memory list-pending", then "promote-pending <id|all>" to confirm`);
     }
     if (hadFileWrites) {
       parts.push('files written this session — run "/memory save" or "/learn-eval" to save what we learned');

package/install.ps1

@@ -88,7 +88,7 @@ if ($Bundle) {
 # -- Banner --------------------------------------------------------------------
 Write-Host ""
 Write-Host "  Kodelyth ECC -- Production-grade AI coding agent toolkit" -ForegroundColor Cyan
-Write-Host "  70 agents (8 devil-mode) | 196 skills | 103 commands | 44 hooks | intent routing | local memory" -ForegroundColor Gray
+Write-Host "  71 agents (8 devil-mode) | 196 skills | 104 commands | 44 hooks | intent routing | local memory" -ForegroundColor Gray
 Write-Host ""
 
 # $PSScriptRoot is always the directory containing this .ps1 file,
@@ -155,6 +155,17 @@ switch ($Target) {
         $HooksDest    = ""
         $RulesDest    = "$Dest\rules"
     }
+    "kiro" {
+        # Kiro (AWS AI IDE): rules become always-on steering; the full catalog
+        # arrives via the MCP server the Node post-install wires into
+        # .kiro\settings\mcp.json. MCP-native, so no file dump into steering.
+        $Dest         = "$(Get-Location)\.kiro"
+        $AgentsDest   = ""
+        $SkillsDest   = ""
+        $CommandsDest = ""
+        $HooksDest    = ""
+        $RulesDest    = "$Dest\steering"
+    }
     "cline" {
         $Dest         = "$(Get-Location)\.clinerules"
         $AgentsDest   = ""
@@ -205,7 +216,7 @@ switch ($Target) {
     }
     default {
         Write-Host "Unknown target: $Target" -ForegroundColor Red
-        Write-Host "Valid targets: claude-home, windsurf-project, windsurf-home, antigravity, cursor-project, codex-home, opencode, cline, roocode, aider, kimi, gemini-project, gemini-home"
+        Write-Host "Valid targets: claude-home, windsurf-project, windsurf-home, antigravity, cursor-project, codex-home, opencode, cline, roocode, aider, kimi, gemini-project, gemini-home, kiro"
         exit 1
     }
 }
@@ -399,7 +410,7 @@ Powered by Kodelyth ECC -- github.com/sifxprime/kodelyth-ecc
             $geminiText = @'
 # Kodelyth ECC -- Gemini CLI context
 
-This project uses Kodelyth ECC -- 70 specialist agents, 196 skills, 103 commands, intent routing, and self-learning memory.
+This project uses Kodelyth ECC -- 71 specialist agents, 196 skills, 104 commands, intent routing, and self-learning memory.
 
 The full toolkit is installed under this directory:
 

package/install.sh

@@ -47,7 +47,7 @@ echo -e "${RED}${BOLD}  ║   DANGER LEVEL: GOD TIER    ·    NOT FOR JUNIOR DEV
 echo -e "${RED}${BOLD}  ╚══════════════════════════════════════════════════════════════╝${RESET}"
 echo ""
 echo -e "${BOLD}  Kodelyth ECC — The most dangerous AI coding toolkit on the planet${RESET}"
-echo -e "${CYAN}  70 specialist agents (8 devil-mode)  ·  196 skills  ·  103 commands  ·  44 hooks  ·  intent routing  ·  compound memory${RESET}"
+echo -e "${CYAN}  71 specialist agents (8 devil-mode)  ·  196 skills  ·  104 commands  ·  44 hooks  ·  intent routing  ·  compound memory${RESET}"
 echo -e "${CYAN}  Any language  ·  Any framework  ·  Any scale  ·  300B-level quality${RESET}"
 echo ""
 echo -e "  github.com/sifxprime/kodelyth-ecc"
@@ -359,9 +359,22 @@ case "$TARGET" in
     RULES_DEST="$DEST/rules"
     INSTALL_MODE="user"
     ;;
+  kiro|kiro-project)
+    # Kiro (AWS AI IDE). Rules become always-on steering docs; the full catalog
+    # (agents, skills, commands, memory) arrives via the MCP server the Node
+    # post-install wires into .kiro/settings/mcp.json. Kiro is MCP-native, so we
+    # do not dump 266 agent/skill files into steering — that is what MCP is for.
+    DEST="$(pwd)/.kiro"
+    AGENTS_DEST=""
+    SKILLS_DEST=""
+    COMMANDS_DEST=""
+    HOOKS_DEST=""
+    RULES_DEST="$DEST/steering"
+    INSTALL_MODE="project"
+    ;;
   *)
     echo -e "${RED}Unknown target: $TARGET${RESET}"
-    echo "Valid targets: claude-home (aka claude-code), antigravity, cursor-project, windsurf-project, windsurf-home, codex-home, opencode, cline, roocode, aider, kimi, gemini-project, gemini-home"
+    echo "Valid targets: claude-home (aka claude-code), antigravity, cursor-project, windsurf-project, windsurf-home, codex-home, opencode, cline, roocode, aider, kimi, gemini-project, gemini-home, kiro"
     exit 1
     ;;
 esac
@@ -653,7 +666,7 @@ AIDER_EOF
       cat > "$GEMINI_FILE" <<'GEMINI_EOF'
 # Kodelyth ECC — Gemini CLI context
 
-This project uses Kodelyth ECC — 70 specialist agents, 196 skills, 103 commands, intent routing, and self-learning memory.
+This project uses Kodelyth ECC — 71 specialist agents, 196 skills, 104 commands, intent routing, and self-learning memory.
 
 The full toolkit is installed under this directory:
 
@@ -778,7 +791,7 @@ case "$TARGET" in
     echo -e "${BOLD}  Cline (VS Code) — what to do now:${RESET}"
     echo ""
     echo "  Open the project in VS Code with Cline installed."
-    echo "  Cline auto-loads .clinerules/ — all 70 agents, rules, and commands as markdown context."
+    echo "  Cline auto-loads .clinerules/ — all 71 agents, rules, and commands as markdown context."
     echo "    Ask: 'use debug-detective'  /  'review my code'  /  'devil mode the codebase'"
     ;;
   roocode)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kodelyth-ecc",
-  "version": "2.25.0",
-  "description": "Production-grade AI coding toolkit — 70 agents (incl. devil-mode adversarial crew), 196 skills, 103 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 377 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, and Gemini CLI.",
+  "version": "2.30.0",
+  "description": "Production-grade AI coding toolkit — 71 agents (incl. devil-mode adversarial crew), 196 skills, 104 commands, parallel multi-agent commands, semantic intent routing, self-learning memory, and a built-in MCP server (16 tools / 6 prompts / 389 resources) that bridges to Claude Desktop, LangGraph, AutoGen, CrewAI, and OpenAI Agents SDK. Works on macOS, Linux and Windows with Claude Code, Windsurf, Cursor, Codex, Antigravity, OpenCode, Cline, RooCode, Aider, Kimi, Gemini CLI, and Kiro.",
   "author": "Kodelyth <github.com/sifxprime>",
   "license": "MIT",
   "repository": {
@@ -75,7 +75,10 @@
     "portability": "node scripts/portability/scan.js agents commands skills hooks rules scripts"
   },
   "optionalDependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.4"
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "sql.js": "^1.8.0",
+    "@xenova/transformers": "^2.17.2",
+    "ajv": "^8.12.0"
   },
   "engines": {
     "node": ">=18.0.0"

package/rules/common/agent-intent-routing.md

@@ -66,7 +66,8 @@ Beyond the 10 priority tiers below, watch for these newer signals — they map t
 | "record this decision" / "write an ADR" / "architecture decision record" | `codebase-memory-mcp` via `manage_adr` |
 | "remove ECC" / "uninstall kodelythecc" / "clean this up" | Suggest `kodelythecc uninstall --dry-run` |
 | "how much did I save" / "show my token savings" / "RTK stats" | `kodelythecc dashboard` OR `kodelythecc rtk gain` |
-| "install for another IDE" / "add to Cursor / Windsurf / Antigravity" | `kodelythecc --target <ide>` |
+| "install for another IDE" / "add to Cursor / Windsurf / Antigravity / Kiro" | `kodelythecc --target <ide>` |
+| "orchestrate this" / "build the whole X end-to-end" / "autonomously build" / "break this big goal into steps and build it" / "run it until it's done" | `super-agent` (the autonomous orchestrator) — decompose → dispatch (parallel) → integrate → verify, resumable + budget-governed. Not for a single edit. |
 
 ### 5. Compound intent → parallel agents
 

package/rules/common/agents.md

@@ -1,6 +1,6 @@
 # Agent Orchestration
 
-70 specialist agents are available. Intent routing is always-on — describe your problem in plain words and the right agent is invoked automatically. You can also invoke explicitly: `use <agent-name>`.
+71 specialist agents are available. Intent routing is always-on — describe your problem in plain words and the right agent is invoked automatically. You can also invoke explicitly: `use <agent-name>`.
 
 ## Kodelyth Exclusives
 

package/rules/common/self-improvement-workflow.md

@@ -124,7 +124,7 @@ ECC uses three compounding memory layers — together they make Claude increasin
 - Example: "Last time you had a CORS issue in Express, you added this middleware..."
 
 ### Layer 3 — Intent Routing (`rules/common/agent-intent-routing.md`)
-- Always-on. 70 specialists. Zero setup.
+- Always-on. 71 specialists. Zero setup.
 - Routes your message to the right expert from the first word
 - No agent names needed — just describe the problem
 

package/scripts/cli/menu.js

@@ -144,7 +144,7 @@ async function pickIdeAndInstall(ROOT) {
   const targets = [
     'claude-code', 'cursor-project', 'windsurf-home', 'windsurf-project',
     'antigravity', 'codex-home', 'opencode', 'cline', 'roocode',
-    'gemini-home', 'gemini-project', 'kimi', 'aider',
+    'gemini-home', 'gemini-project', 'kimi', 'aider', 'kiro',
   ];
   const chosen = await pick('Pick an IDE to install for', targets);
   if (chosen == null) return main();

package/scripts/hooks/post-bash-command-log.js

@@ -4,6 +4,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const { redact } = require('../lib/redact');
 
 const MAX_STDIN = 1024 * 1024;
 let raw = '';
@@ -20,17 +21,9 @@ const MODE_CONFIG = {
 };
 
 function sanitizeCommand(command) {
-  return String(command || '')
-    .replace(/\n/g, ' ')
-    .replace(/--token[= ][^ ]*/g, '--token=<REDACTED>')
-    .replace(/Authorization:[: ]*[^ ]*[: ]*[^ ]*/gi, 'Authorization:<REDACTED>')
-    .replace(/\bAKIA[A-Z0-9]{16}\b/g, '<REDACTED>')
-    .replace(/\bASIA[A-Z0-9]{16}\b/g, '<REDACTED>')
-    .replace(/password[= ][^ ]*/gi, 'password=<REDACTED>')
-    .replace(/\bghp_[A-Za-z0-9_]+\b/g, '<REDACTED>')
-    .replace(/\bgho_[A-Za-z0-9_]+\b/g, '<REDACTED>')
-    .replace(/\bghs_[A-Za-z0-9_]+\b/g, '<REDACTED>')
-    .replace(/\bgithub_pat_[A-Za-z0-9_]+\b/g, '<REDACTED>');
+  // Flatten to one log line, then run the shared credential redactor (which now
+  // covers more token formats than this hook's old inline list did).
+  return redact(String(command || '').replace(/\n/g, ' '));
 }
 
 function appendLine(filePath, line) {

package/scripts/hooks/session-start.js

@@ -392,6 +392,19 @@ async function main() {
     additionalContextParts.push(structuredInstinctSummary);
   }
 
+  // Surface the auto-capture review queue so candidates the last session proposed
+  // are discoverable now, not just at the end of that session. Consent-first:
+  // this only points at the review command; nothing is stored without the user
+  // running promote-pending.
+  try {
+    const n = require('../memory/pending').countPending();
+    if (n > 0) {
+      additionalContextParts.push(
+        `${n} memory candidate(s) await review — list with "kodelythecc memory list-pending", confirm with "promote-pending <id|all>".`
+      );
+    }
+  } catch { /* never block session start */ }
+
   // Check for recent session files (last 7 days)
   const recentSessions = dedupeRecentSessions(sessionSearchDirs);
 

package/scripts/lib/redact.js

@@ -0,0 +1,58 @@
+// scripts/lib/redact.js
+//
+// One place to scrub credentials out of text before it is stored or logged.
+// Used by the memory capture path (so a leaked key is never written into
+// memories.jsonl, where it would then be surfaced by recall and injected into a
+// future session) and by the bash-command logger.
+//
+// Two rule families:
+//   - High-confidence provider token FORMATS, matched anywhere (prose or a
+//     command line) — AWS, GitHub, OpenAI/Anthropic, Stripe, Slack, Google, npm,
+//     JWTs, PEM private-key blocks.
+//   - Assignment / header forms — `--token=`, `Authorization:`, `password=`,
+//     `api_key=`, etc.
+//
+// Every pattern is linear (no nested quantifiers, no adjacent `\s*\s*`) so none
+// can backtrack catastrophically on hostile input — the ReDoS lesson from the
+// prompt-injection guard applies here too.
+'use strict';
+
+const RULES = [
+  // ── Provider token formats (match anywhere) ──
+  [/-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/g, '<REDACTED:private-key>'],
+  [/\bAKIA[0-9A-Z]{16}\b/g, '<REDACTED:aws-key>'],
+  [/\bASIA[0-9A-Z]{16}\b/g, '<REDACTED:aws-temp-key>'],
+  [/\bghp_[A-Za-z0-9]{20,}\b/g, '<REDACTED:github-token>'],
+  [/\bgho_[A-Za-z0-9]{20,}\b/g, '<REDACTED:github-token>'],
+  [/\bghs_[A-Za-z0-9]{20,}\b/g, '<REDACTED:github-token>'],
+  [/\bghr_[A-Za-z0-9]{20,}\b/g, '<REDACTED:github-token>'],
+  [/\bgithub_pat_[A-Za-z0-9_]{22,}\b/g, '<REDACTED:github-pat>'],
+  [/\bsk-ant-[A-Za-z0-9_-]{20,}/g, '<REDACTED:anthropic-key>'],
+  [/\bsk-[A-Za-z0-9_-]{20,}/g, '<REDACTED:openai-key>'],
+  [/\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}\b/g, '<REDACTED:stripe-key>'],
+  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, '<REDACTED:slack-token>'],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g, '<REDACTED:google-key>'],
+  [/\bnpm_[A-Za-z0-9]{36}\b/g, '<REDACTED:npm-token>'],
+  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '<REDACTED:jwt>'],
+  // ── Assignment / header forms ──
+  [/(--token[= ])\S+/g, '$1<REDACTED>'],
+  [/(Authorization:\s*)(?:Bearer\s+)?\S+/gi, '$1<REDACTED>'],
+  [/(\bpassword\s*[=:]\s*)\S+/gi, '$1<REDACTED>'],
+  [/(\b(?:api[_-]?key|secret|access[_-]?token|auth[_-]?token)\s*[=:]\s*)["']?[A-Za-z0-9\-_.]{8,}["']?/gi, '$1<REDACTED>'],
+];
+
+// Replace any credentials in `text` with labelled placeholders. Non-strings pass
+// through unchanged (null/undefined stay as they are).
+function redact(text) {
+  if (typeof text !== 'string') return text;
+  let out = text;
+  for (const [re, repl] of RULES) out = out.replace(re, repl);
+  return out;
+}
+
+// True when redaction would change the text — i.e. a credential is present.
+function hasSecret(text) {
+  return typeof text === 'string' && redact(text) !== text;
+}
+
+module.exports = { redact, hasSecret, RULES };

package/scripts/lib/state-store/index.js

@@ -3,7 +3,6 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const initSqlJs = require('sql.js');
 
 const { applyMigrations, getAppliedMigrations } = require('./migrations');
 const { createQueryApi } = require('./queries');
@@ -11,6 +10,40 @@ const { assertValidEntity, validateEntity } = require('./schema');
 
 const DEFAULT_STATE_STORE_RELATIVE_PATH = path.join('.claude', 'ecc', 'state.db');
 
+// sql.js is OPTIONAL. It powers the session store, the status DB, and the
+// skill-evolution tracker — not the core (memory, RTK, Terse, codebase graph),
+// which stay pure-JS and need nothing. It used to be required at module load, so
+// importing state-store threw "Cannot find module 'sql.js'" for every install
+// that did not have it (which, since it was never a declared dependency, was all
+// of them) — before any caller's try/catch could run. Load it lazily and turn a
+// missing module into a clean, catchable error instead of an import-time crash.
+function loadSqlJs() {
+  try {
+    return require('sql.js');
+  } catch (cause) {
+    const err = new Error(
+      'SQLite support is unavailable: the optional dependency "sql.js" is not installed. ' +
+      'Install it (npm i sql.js, or reinstall kodelyth-ecc) to enable the session store, ' +
+      'status DB, and skill-evolution tracker. Core memory, RTK, Terse, and the codebase ' +
+      'graph do not need it.'
+    );
+    err.code = 'ECC_SQLITE_UNAVAILABLE';
+    err.cause = cause;
+    throw err;
+  }
+}
+
+// Non-throwing probe for callers and `doctor`: is the optional SQLite layer
+// usable on this install?
+function isSqliteAvailable() {
+  try {
+    require.resolve('sql.js');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function resolveStateStorePath(options = {}) {
   if (options.dbPath) {
     if (options.dbPath === ':memory:') {
@@ -163,6 +196,7 @@ async function openDatabase(SQL, dbPath) {
 
 async function createStateStore(options = {}) {
   const dbPath = resolveStateStorePath(options);
+  const initSqlJs = loadSqlJs();
   const SQL = await initSqlJs();
   const db = await openDatabase(SQL, dbPath);
   const appliedMigrations = applyMigrations(db);
@@ -188,4 +222,5 @@ module.exports = {
   DEFAULT_STATE_STORE_RELATIVE_PATH,
   createStateStore,
   resolveStateStorePath,
+  isSqliteAvailable,
 };

package/scripts/lib/state-store/schema.js

@@ -2,7 +2,11 @@
 
 const fs = require('fs');
 const path = require('path');
-const Ajv = require('ajv');
+// `ajv` is loaded lazily inside getAjv(), NOT at module top. It is an OPTIONAL
+// dependency (it validates the optional SQLite state-store's entities), and
+// requiring it here eagerly made importing state-store throw "Cannot find module
+// 'ajv'" on any install without it — which is every default install, and which
+// broke the pre-publish test step in CI. Same bug class as the sql.js one.
 
 const SCHEMA_PATH = path.join(__dirname, '..', '..', '..', 'schemas', 'state-store.schema.json');
 
@@ -33,6 +37,19 @@ function getAjv() {
     return cachedAjv;
   }
 
+  let Ajv;
+  try {
+    Ajv = require('ajv');
+  } catch (cause) {
+    const err = new Error(
+      'state-store schema validation needs the optional dependency "ajv", which is not installed. ' +
+      'Install it (or reinstall kodelyth-ecc) to enable session-store / status-DB validation.'
+    );
+    err.code = 'ECC_AJV_UNAVAILABLE';
+    err.cause = cause;
+    throw err;
+  }
+
   cachedAjv = new Ajv({
     allErrors: true,
     strict: false,