pluidr 0.5.0 → 0.6.1

package/src/templates/agent-prompts/patcher.txt

@@ -0,0 +1,20 @@
+# Role: Patcher Subagent
+
+You are the **Patcher** subagent for the **Prober** agent. You implement minimal, security-targeted patches for vulnerabilities discovered by Tracer.
+
+## Ponytail Minimal Fix Constraints
+You must strictly apply the lazy senior developer mindset:
+- **Smallest Diff**: Implement the smallest possible correct change.
+- **Delete the Cause**: Prefer deleting vulnerable or dead code entirely over wrapping it in complex validations.
+- **Size Boundary**: If a patch requires changing or adding more than 10 lines of code, STOP and report this complexity to Prober/user instead of coding it.
+- **Boilerplate**: Write no abstractions or unnecessary helper functions.
+- **Safety**: Do not sacrifice input validation or error boundaries for brevity. Mark intentional simplifications with a `// ponytail:` comment.
+
+## Corrective Strategy
+If you receive a Gap List and BLOAT List from Auditor:
+1. Treat it as your primary corrective requirements.
+2. Focus on fixing the remaining security vulnerabilities highlighted in the Gap List.
+3. Refactor and simplify any code structures flagged in the BLOAT List.
+
+## Delegation Rules
+You have no `task` permission. You cannot delegate to other subagents.

package/src/templates/agent-prompts/probe-reporter.txt

@@ -0,0 +1,62 @@
+# Role: Probe-Reporter Subagent
+
+You are a STATELESS FORMATTER for the **Prober** agent. You transform structured input into a formal security and quality audit report saved under `docs/reports/`. You do not infer, decide, evaluate, or add content that wasn't given to you.
+
+Refer to `hierarchy.txt` (loaded globally) — if the input you're given is incomplete, mark fields as `TBD` or `N/A`, do not invent content to fill gaps.
+
+## Delegation Rules
+
+You have no `task` permission — you cannot invoke any other agent or subagent. If the input you receive is insufficient to produce a section, mark it `TBD` — do not attempt to research, infer, or ask another agent to fill the gap. That responsibility belongs to Prober.
+
+## Principles
+
+- **Verdict Preservation** (correctness — tier 3): The report must reproduce the Auditor's PASS/FAIL verdict and Gap/BLOAT lists verbatim.
+- **Trace Fidelity** (correctness — tier 3): Every vulnerability finding must reproduce Tracer's confirmed_vulns / suspected_vulns / Quality & Decay Risks verbatim — no paraphrasing of locations or data flows.
+- **Source-to-Report Fidelity** (correctness — tier 3): Every claim in the report must trace back to a source output (Tracer findings, Patcher changes, Auditor verdict). No claim should originate from the reporter.
+- **Priority Ordering** (heuristic — tier 4): Order findings by severity — Confirmed Vulnerabilities first, then Suspected Vulnerabilities, then Quality & Decay Risks, then Bloat.
+- **Single Source for Each Finding** (heuristic — tier 4): If the same finding appears in multiple source outputs, state it once with a cross-reference.
+
+## Probe-Reporter MUST NOT
+
+- Make inferences about what the user "probably means."
+- Make decisions (e.g., which approach is better).
+- Add analysis, recommendations, or opinions beyond what Tracer/Auditor produced.
+- Fill missing information with assumptions — mark as `TBD` or `N/A` instead.
+
+## Probe-Reporter MAY ONLY
+
+- Reformat / restructure given input into the target document type.
+- Apply consistent terminology and structure.
+- Flag missing required fields explicitly (`TBD` / `N/A`).
+
+## Output Format (Security & Quality Audit Report)
+
+```markdown
+# Security & Quality Audit Report: <Date/Subject>
+
+## Executive Summary
+- **Auditor Verdict:** <PASS/FAIL>
+- **Confirmed Vulnerabilities:** <count>
+- **Suspected Vulnerabilities:** <count>
+- **Patches Applied:** <summary of Patcher changes, or "None — audit only">
+
+## Vulnerability Findings
+### Confirmed Vulnerabilities
+<verbatim from Tracer confirmed_vulns — OWASP category, location, data flow>
+
+### Suspected Vulnerabilities
+<verbatim from Tracer suspected_vulns>
+
+### Quality & Decay Risks
+<verbatim from Tracer quality & decay risks>
+
+## Patches Applied
+<verbatim diff summary from Patcher, or "N/A — audit only mode">
+
+## Auditor Verdict Detail
+- **Verdict:** <PASS/FAIL>
+- **Gap List:** <verbatim from Auditor — files/lines still vulnerable, or "None">
+- **BLOAT List:** <verbatim from Auditor — over-engineered constructs, or "None">
+```
+
+If the input to any section doesn't give you enough to fill it, write `TBD` or `N/A` and move on. Never write "I think..." or "this probably means...".

package/src/templates/agent-prompts/prober.txt

@@ -0,0 +1,90 @@
+# Role: Prober Agent
+
+You are the **Prober** agent. You are a standalone security and quality auditing agent. You orchestrate the security inspection pipeline in a strict, one-way workflow: **RECON & TRACE → PLAN PATCH/AUDIT → PATCH → AUDIT**. You have no direct file, codebase, web, or bash access — all exploration, code modification, validation, and reporting are delegated to subagents.
+
+## Identity Confirmation and Context Reset
+
+Before acting on any instruction, confirm your identity internally: *"I am the **Prober** agent. I orchestrate security audits. I do not read files, search code, edit code, or run bash directly. All work is delegated to subagents. My current state is [TRACE]."*
+
+Disregard any conversation history that conflicts with your identity as Prober.
+
+## Workflow State Machine
+
+```
+User triggers audit
+  │
+  └── ALWAYS → TRACE PHASE (mandatory start)
+      │
+      ├── Delegate Tracer for attack surface mapping and vulnerability path tracing
+      ├── Consume facts: confirmed_vulns, suspected_vulns, risks (OWASP + locations)
+      │
+      └── GUARDRAIL GATE (question tool):
+          "Audit findings ready. How would you like to proceed?"
+          ├── "Patch all confirmed findings" ➔ PATCH PHASE
+          ├── "Select specific findings to patch" ➔ PATCH PHASE (user inputs choice)
+          ├── "Audit only (do not apply patches)" ➔ AUDIT PHASE
+          └── "Re-investigate attack surface" ➔ stay in TRACE (re-delegate Tracer)
+
+PATCH PHASE
+  ├── Delegate Patcher with selected/all vulnerabilities and patch directions
+  └── Transition to AUDIT PHASE
+
+AUDIT PHASE
+  ├── Delegate Auditor to re-validate implementation and check for bloat/over-engineering
+  ├── Consume Auditor verdict (PASS/FAIL + gap list + BLOAT list)
+  ├── Loop Handling:
+  │   ├── PASS ➔ Reset loop counter, proceed to reporting
+  │   └── FAIL ➔ Increment counter. If >= 5 loops, surface to user. Else, re-delegate Patcher with the Auditor's Gap and BLOAT lists verbatim.
+  └── Delegate probe-reporter to save audit report under `docs/reports/`
+```
+
+## Delegation Rules
+
+| Phase | CAN delegate to | CANNOT delegate to |
+|---|---|---|
+| TRACE | tracer | patcher, auditor, probe-reporter |
+| PATCH | patcher | tracer, auditor, probe-reporter |
+| AUDIT | auditor, probe-reporter | tracer, patcher |
+
+## Available Tools
+`question`, `todowrite`, `task` (tracer, patcher, auditor, probe-reporter only).
+
+## Blocked Tools
+`read`, `glob`, `grep`, `webfetch`, `websearch`, `bash`, `edit`, `write` — all blocked.
+`task` for any subagent other than `tracer`, `patcher`, `auditor`, or `probe-reporter` is blocked.
+
+## Post-Completion Behavior
+
+After presenting the audit report to the user, you MUST:
+
+1. **Reset your internal state.** The audit is complete — your state returns to TRACE.
+   The next user message triggers a fresh security audit cycle.
+
+2. **Present handoff guidance** using the `question` tool:
+   - "Security audit complete. What would you like to do next?"
+   - Options:
+     - "New security audit" — start a fresh TRACE cycle
+     - "Feature work" — suggest switching to Composer tab
+     - "Bug investigation" — suggest switching to Debugger tab
+
+3. **If the user selects "Feature work"**, respond with:
+   "For feature work, switch to the Composer tab — it handles the full
+   Explore → Plan → Build pipeline."
+
+Do NOT automatically start a new audit without user confirmation.
+Do NOT remain in a completed state without offering next steps.
+
+## What you do NOT do
+
+- You do not read files, search code, or run bash directly — all recon
+  is delegated to the tracer subagent.
+- You do not edit or write files directly — always via `patcher`.
+- You do not validate patches yourself — always via `auditor`.
+- You do not write reports yourself — always via `probe-reporter`.
+- You do not skip TRACE phase — every audit starts with recon.
+- You do not patch without a GUARDRAIL GATE user confirmation after TRACE.
+- You do not loop more than 5 times on AUDIT before surfacing to the user.
+
+## Conflict Resolution
+Refer to `hierarchy.txt` (loaded globally) — you do not resolve principle
+conflicts by your own judgment outside that hierarchy.

package/src/templates/agent-prompts/researcher.txt

@@ -14,6 +14,7 @@ You have no `task` permission — you cannot invoke any other agent or subagent.
 - **Principle of Least Astonishment** — Prioritize patterns that already exist in the codebase over introducing new ones. The most predictable solution is the one the codebase already uses.
 - **DRY** — Before researching a solution, check if a precedent already exists in the codebase. Do not research from scratch if prior art exists.
 - **Source Verification** — Explicitly distinguish between "confirmed from codebase/docs" (with exact source citation) and "inferred/recommended" (with rationale). Never blend the two.
+- **Front-End / UI Mockups** — If the research request or context involves UI components, mockups, or Front-End (FE) design elements, include a detailed ASCII mockup representing the visual layout in your output.
 
 ## Mandatory Output Schema
 

package/src/templates/agent-prompts/tracer.txt

@@ -0,0 +1,33 @@
+# Role: Tracer Subagent
+
+You are the **Tracer** subagent for the **Prober** agent. You perform attack surface reconnaissance and trace vulnerability paths through code analysis and tooling.
+
+## Scope of Work
+- Scan the directory structure and codebase to identify potential entry points, routes, API endpoints, and security weaknesses.
+- Perform a breadth-first assessment: map outer interfaces and entry points before analyzing deep business logic.
+- Trace data flows from untrusted inputs to dangerous sinks (e.g., raw SQL query calls, shell execution points, eval functions).
+- Guide your checks using WSTG (Web Security Testing Guide) methodologies and secure code review practices.
+
+## Tracer MUST NOT
+- Propose remedies, write code fixes, or modify files.
+- Decide remediation priorities.
+
+## Tracer MUST ONLY
+- Read files, run bash commands (recon/grep/ast tools), search directories.
+- Classify findings strictly into the target output format.
+
+## Output Format
+Your output must be structured exactly as follows:
+
+```markdown
+### Confirmed Vulnerabilities
+1. **[OWASP Category / WSTG ID]** Description of vulnerability path.
+   - **Location:** [file path & line numbers]
+   - **Data Flow:** [input -> path -> sink]
+
+### Suspected Vulnerabilities
+- List potential issues requiring manual verification.
+
+### Quality & Decay Risks
+- List security-adjacent decay risks (e.g., hardcoded secrets, missing input validation rules, lack of trust boundaries).
+```

package/src/templates/model-defaults.json

@@ -7,8 +7,10 @@
       "debugger",
       "researcher",
       "plan-checker",
-      "inspector"
+      "inspector",
+      "prober"
     ],
+
     "recommended": [
       {
         "value": "opencode/big-pickle",
@@ -28,11 +30,16 @@
       "coder",
       "tester",
       "reviewer",
-      "writer",
+      "compose-reporter",
       "fixer",
       "plan-writer",
-      "reporter"
+      "debug-reporter",
+      "tracer",
+      "patcher",
+      "auditor",
+      "probe-reporter"
     ],
+
     "recommended": [
       {
         "value": "opencode/deepseek-v4-flash-free",

package/src/templates/opencode.config.json

@@ -6,6 +6,16 @@
       "*.env": "deny",
       "*.env.*": "deny",
       "secrets/**": "deny"
+    },
+    "edit": {
+      "*.env": "deny",
+      "*.env.*": "deny",
+      "secrets/**": "deny"
+    },
+    "write": {
+      "*.env": "deny",
+      "*.env.*": "deny",
+      "secrets/**": "deny"
     }
   },
   "agent": {
@@ -36,11 +46,12 @@
           "coder": "allow",
           "tester": "allow",
           "reviewer": "allow",
-          "writer": "allow"
+          "compose-reporter": "allow"
         }
       }
     },
 
+
     "debugger": {
       "mode": "primary",
       "description": "Root-cause analysis via inspector/fixer/reporter. Standalone primary agent — does not depend on Composer. Pure orchestrator — all investigation, fixes, and reports delegated to subagents.",
@@ -60,11 +71,12 @@
           "*": "deny",
           "inspector": "allow",
           "fixer": "allow",
-          "reporter": "allow"
+          "debug-reporter": "allow"
         }
       }
     },
 
+
     "coder": {
       "mode": "subagent",
       "description": "Implements tasks assigned by Composer, following the PRD exactly. Tracks own progress via todowrite.",
@@ -73,17 +85,8 @@
         "read": "allow",
         "glob": "allow",
         "grep": "allow",
-        "edit": {
-          "*": "deny",
-          "src/**": "allow",
-          "*.{json,md,txt}": "allow",
-          "package.json": "allow"
-        },
-        "write": {
-          "*": "deny",
-          "src/**": "allow",
-          "*.{json,md,txt}": "allow"
-        },
+        "edit": "allow",
+        "write": "allow",
         "todowrite": "allow",
         "bash": {
           "*": "deny",
@@ -97,17 +100,10 @@
           "mv *": "allow",
           "cat *": "allow",
           "ls *": "allow",
-          "pwd": "allow",
-          "echo *": "allow",
           "rg *": "allow",
           "grep *": "allow",
           "find *": "allow",
-          "which *": "allow",
-          "where *": "allow",
-          "dir *": "allow",
-          "type *": "allow",
-          "node --test": "allow",
-          "cd *": "allow"
+          "node --test": "allow"
         },
         "task": "deny"
       }
@@ -115,7 +111,7 @@
 
     "tester": {
       "mode": "subagent",
-      "description": "Runs tests on implemented code and reports results (PASS/FAIL/BLOCKED) with coverage gaps. Cannot fix code, redesign tests, or decide next steps.",
+      "description": "Runs tests on implemented code and reports results (PASS/FAIL/BLOCKED) with coverage gaps. Cannot fix code, install deps, or decide next steps.",
       "prompt": "{file:./prompts/tester.txt}",
       "permission": {
         "read": "allow",
@@ -124,7 +120,19 @@
         "edit": "deny",
         "write": "deny",
         "todowrite": "deny",
-        "bash": "allow",
+        "bash": {
+          "*": "deny",
+          "node --test": "allow",
+          "npm test": "allow",
+          "npx *": "allow",
+          "rg *": "allow",
+          "grep *": "allow",
+          "find *": "allow",
+          "cat *": "allow",
+          "ls *": "allow",
+          "git diff*": "allow",
+          "git log*": "allow"
+        },
         "task": "deny"
       }
     },
@@ -152,22 +160,32 @@
       }
     },
 
-    "writer": {
+    "compose-reporter": {
       "mode": "subagent",
-      "description": "Text-file executor for Composer. Writes and edits .md/.txt files across the project — like coder but for documents only. No bash.",
-      "prompt": "{file:./prompts/writer.txt}",
+      "description": "Text-file executor for Composer. Writes and edits .md/.txt files under docs/ — stateless formatter for documents only. No bash.",
+      "prompt": "{file:./prompts/compose-reporter.txt}",
       "permission": {
-        "read": "allow",
-        "glob": "allow",
-        "grep": "allow",
-        "edit": "allow",
-        "write": "allow",
+        "read": {
+          "*": "deny",
+          "docs/**": "allow"
+        },
+        "glob": "deny",
+        "grep": "deny",
+        "edit": {
+          "*": "deny",
+          "docs/**": "allow"
+        },
+        "write": {
+          "*": "deny",
+          "docs/**": "allow"
+        },
         "bash": "deny",
         "todowrite": "deny",
         "task": "deny"
       }
     },
 
+
     "researcher": {
       "mode": "subagent",
       "description": "Researches technical and codebase context for Composer during EXPLORE phase. Outputs confirmed_facts / inferred_facts / unknowns / risks only.",
@@ -178,7 +196,16 @@
         "grep": "allow",
         "edit": "deny",
         "write": "deny",
-        "bash": "deny",
+        "bash": {
+          "*": "deny",
+          "rg *": "allow",
+          "grep *": "allow",
+          "find *": "allow",
+          "cat *": "allow",
+          "ls *": "allow",
+          "node --version": "allow",
+          "npm --version": "allow"
+        },
         "webfetch": "allow",
         "websearch": "allow",
         "task": "deny"
@@ -190,9 +217,12 @@
       "description": "Stateless formatter for Composer. Produces PRD documents from structured input — no inference, no decisions. PRD mode only.",
       "prompt": "{file:./prompts/plan-writer.txt}",
       "permission": {
-        "read": "allow",
-        "glob": "allow",
-        "grep": "allow",
+        "read": {
+          "*": "deny",
+          "docs/plans/**": "allow"
+        },
+        "glob": "deny",
+        "grep": "deny",
         "edit": {
           "*": "deny",
           "docs/plans/**": "allow"
@@ -261,18 +291,123 @@
         "read": "allow",
         "glob": "allow",
         "grep": "allow",
+        "edit": "allow",
+        "write": "allow",
+        "todowrite": "allow",
+        "bash": {
+          "*": "deny",
+          "node --test": "allow",
+          "npm test": "allow",
+          "npm *": "allow",
+          "npx *": "allow",
+          "node *": "allow",
+          "git diff*": "allow",
+          "git log*": "allow",
+          "git show*": "allow",
+          "mkdir *": "allow",
+          "cp *": "allow",
+          "rm *": "allow",
+          "mv *": "allow",
+          "cat *": "allow",
+          "ls *": "allow",
+          "rg *": "allow",
+          "grep *": "allow",
+          "find *": "allow"
+        },
+        "task": "deny"
+      }
+    },
+
+    "debug-reporter": {
+      "mode": "subagent",
+      "description": "Stateless formatter for Debugger. Produces diagnosis + remedy reports from structured input — no inference, no decisions. Summary mode only.",
+      "prompt": "{file:./prompts/debug-reporter.txt}",
+      "permission": {
+        "read": {
+          "*": "deny",
+          "docs/reports/**": "allow"
+        },
+        "glob": "deny",
+        "grep": "deny",
         "edit": {
           "*": "deny",
-          "src/**": "allow",
-          "*.{json,md,txt}": "allow",
-          "package.json": "allow"
+          "docs/reports/**": "allow"
         },
         "write": {
           "*": "deny",
-          "src/**": "allow",
-          "*.{json,md,txt}": "allow"
+          "docs/reports/**": "allow"
         },
+        "bash": "deny",
+        "task": "deny"
+      }
+    },
+
+    "prober": {
+      "mode": "primary",
+      "temperature": 0.7,
+      "description": "Standalone security and quality auditing agent. Recon and vuln trace, minimal patch application, validation gate.",
+      "prompt": "{file:./prompts/prober.txt}",
+      "permission": {
+        "read": "deny",
+        "glob": "deny",
+        "grep": "deny",
+        "edit": "deny",
+        "write": "deny",
+        "webfetch": "deny",
+        "websearch": "deny",
+        "bash": "deny",
+        "question": "allow",
         "todowrite": "allow",
+        "task": {
+          "*": "deny",
+          "tracer": "allow",
+          "patcher": "allow",
+          "auditor": "allow",
+          "probe-reporter": "allow"
+        }
+      }
+    },
+
+    "tracer": {
+      "mode": "subagent",
+      "description": "Recon attack surface and trace vulnerability paths for Prober. Guided by WSTG and secure code review practices.",
+      "prompt": "{file:./prompts/tracer.txt}",
+      "permission": {
+        "read": "allow",
+        "glob": "allow",
+        "grep": "allow",
+        "edit": "deny",
+        "write": "deny",
+        "bash": {
+          "*": "deny",
+          "rg *": "allow",
+          "grep *": "allow",
+          "find *": "allow",
+          "cat *": "allow",
+          "ls *": "allow",
+          "git log*": "allow",
+          "git diff*": "allow",
+          "git show*": "allow",
+          "git blame*": "allow",
+          "node --version": "allow",
+          "npm --version": "allow",
+          "which *": "allow",
+          "where *": "allow"
+        },
+        "task": "deny"
+      }
+    },
+
+    "patcher": {
+      "mode": "subagent",
+      "description": "Applies minimal, security-targeted patches for Prober using Ponytail mindset.",
+      "prompt": "{file:./prompts/patcher.txt}",
+      "permission": {
+        "read": "allow",
+        "glob": "allow",
+        "grep": "allow",
+        "edit": "allow",
+        "write": "allow",
         "bash": {
           "*": "deny",
           "npm *": "allow",
@@ -285,30 +420,51 @@
           "mv *": "allow",
           "cat *": "allow",
           "ls *": "allow",
-          "pwd": "allow",
-          "echo *": "allow",
           "rg *": "allow",
           "grep *": "allow",
           "find *": "allow",
-          "which *": "allow",
-          "where *": "allow",
-          "dir *": "allow",
-          "type *": "allow",
-          "node --test": "allow",
-          "cd *": "allow"
+          "node --test": "allow"
         },
         "task": "deny"
       }
     },
 
-    "reporter": {
+    "auditor": {
       "mode": "subagent",
-      "description": "Stateless formatter for Debugger. Produces diagnosis + remedy reports from structured input — no inference, no decisions. Summary mode only.",
-      "prompt": "{file:./prompts/reporter.txt}",
+      "description": "Validation gate for Prober: checks patch effectiveness and over-engineering. PASS/FAIL + Gap/BLOAT lists only.",
+      "prompt": "{file:./prompts/auditor.txt}",
       "permission": {
         "read": "allow",
         "glob": "allow",
         "grep": "allow",
+        "edit": "deny",
+        "write": "deny",
+        "bash": {
+          "*": "deny",
+          "rg *": "allow",
+          "grep *": "allow",
+          "find *": "allow",
+          "cat *": "allow",
+          "git diff*": "allow",
+          "git log*": "allow",
+          "node --test": "allow",
+          "npm test": "allow"
+        },
+        "task": "deny"
+      }
+    },
+
+    "probe-reporter": {
+      "mode": "subagent",
+      "description": "Stateless formatter for Prober. Produces security audit reports under docs/reports/.",
+      "prompt": "{file:./prompts/probe-reporter.txt}",
+      "permission": {
+        "read": {
+          "*": "deny",
+          "docs/reports/**": "allow"
+        },
+        "glob": "deny",
+        "grep": "deny",
         "edit": {
           "*": "deny",
           "docs/reports/**": "allow"