promptgraph-mcp 2.4.6 → 2.4.7

package/registry/training/good/skills-store-evolve.md

@@ -0,0 +1,100 @@
+# /evolve — Self-Evolution Loop for dev-os
+
+Run the infinite self-improvement loop. Each cycle discovers new tech, analyzes the codebase, generates improvement proposals, runs experiments, and optionally applies safe changes.
+
+## Usage
+
+```
+/evolve
+```
+
+On first invocation, ask the user:
+
+1. **Mode**:
+   - `once` — Run one evolution cycle now
+   - `forever` — Infinite loop (runs every 6 hours)
+   - `status` — Show evolution history and stats
+   - `focus: llm` — Scan only new LLM models
+   - `focus: prompts` — Evolve agent prompts only
+   - `focus: features` — Discover new capabilities
+   - `focus: tech` — Scan new libraries/tools
+   - `focus: experimental` — Run strategy comparisons (ToT vs ReAct, MoA, Constitutional AI, prompt evolution)
+
+2. **Auto-apply safe improvements?** — yes / no
+
+## Execution by Mode
+
+### once
+```powershell
+cd "C:\Users\Sasha\.claude\dev-os"
+$env:PYTHONIOENCODING="utf-8"
+python -c "
+from dev_os.agents.evolution_loop import EvolutionLoop
+loop = EvolutionLoop()
+report = loop.run_once(focus='FOCUS_HERE')
+import json
+print(json.dumps(report, indent=2, ensure_ascii=False, default=str))
+"
+```
+
+### forever
+Start background process:
+```powershell
+Start-Process python -ArgumentList '-m dev_os.cli evolve --forever --interval 6' -WorkingDirectory "C:\Users\Sasha\.claude\dev-os" -WindowStyle Hidden
+```
+
+Alternatively, use `/loop` skill with this command to run every 6 hours:
+```
+/loop 6h python -c "from dev_os.agents.evolution_loop import EvolutionLoop; loop = EvolutionLoop(); loop.run_cycle(auto_apply=False)"
+```
+
+### status
+```powershell
+cd "C:\Users\Sasha\.claude\dev-os"
+$env:PYTHONIOENCODING="utf-8"
+python -c "
+from dev_os.agents.evolution_loop import EvolutionLoop
+import json
+s = EvolutionLoop().status()
+print(json.dumps(s, indent=2, ensure_ascii=False, default=str))
+"
+```
+
+### what-changed
+```powershell
+cd "C:\Users\Sasha\.claude\dev-os"
+$env:PYTHONIOENCODING="utf-8"
+python -c "
+from dev_os.agents.evolution_loop import EvolutionLoop
+import json
+changes = EvolutionLoop().what_changed()
+print(json.dumps(changes, indent=2, ensure_ascii=False, default=str))
+"
+```
+
+## Focus: experimental — Strategy Details
+
+When the user selects `focus: experimental`, Claude MUST run experiments comparing:
+
+1. **Tree of Thought vs ReAct** — Compare multi-step reasoning strategies on the LLM router agent
+2. **Mixture of Agents** — Test having multiple agent instances collaborate on a single task
+3. **Constitutional AI self-improvement** — Apply constitutional AI principles to the LLM router's prompt templates
+4. **Prompt evolution** — Evolve prompts on the market analysis agent using the experiment engine
+
+Steps for experimental focus:
+1. Run `EvolutionLoop().run_once(focus="experimental")` which calls `ExperimentEngine.compare_strategies()`
+2. Show the comparison results to the user
+3. Recommend which strategy to integrate
+4. If user agrees, implement the winning strategy using `mcp__opencode__opencode_run` or by spawning an agent
+
+## Output
+
+After any mode, display:
+
+- What was discovered (new LLMs, trending repos, arxiv papers, free APIs)
+- What proposals were generated
+- What was applied (if auto_apply)
+- What experiments ran and which ones passed
+- Current system quality score
+- Cycle number and next scheduled run (for `forever` mode)
+

package/registry/training/good/skills-store-game.md

@@ -0,0 +1,27 @@
+# Game Dev Skill Router
+
+Роутер для всех игровых скиллов из `C:\Users\Sasha\Desktop\SKILLS\`.
+
+Invoke: `/game <skill>`
+
+## Скиллы
+
+| Команда | Файл | Когда |
+|---------|------|-------|
+| `/game resume` | `game-resume.md` | Начало каждой сессии |
+| `/game arch` | `game-architecture-define.md` | Новый проект или хаос |
+| `/game progress` | `game-progress-check.md` | Глубокий анализ состояния |
+| `/game milestone` | `game-milestone-check.md` | Проверка готовности фазы |
+| `/game scope` | `game-scope-guard.md` | Новая идея — брать или нет |
+| `/game velocity` | `game-velocity.md` | Прогноз даты релиза |
+| `/game harvest` | `game-skill-harvest.md` | Создать скилл из фикса |
+| `/game hooks` | `setup-git-hooks.md` | Настройка git хуков |
+| `/game help` | `GUIDE.md` | Краткий гайд |
+
+## Выполнение
+
+По аргументу `$ARGUMENTS` определи нужный файл из таблицы выше.
+Прочитай `C:\Users\Sasha\Desktop\SKILLS\<файл>` и выполни инструкции.
+
+Если аргумент не указан или не распознан → покажи таблицу выше.
+

package/registry/training/good/skills-store-hunt.md

@@ -0,0 +1,102 @@
+---
+name: hunt
+description: Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]
+---
+
+# /hunt
+
+slim two-track dispatcher. one mode question, one branch, delegate. never asks about SOW — invoking `/hunt` implies SOW is signed.
+
+## step 0 — parse
+
+```
+target.com               single target
+*.target.com             wildcard — /recon <base> first, then hunt each live host
+targets.txt              multi-target — mode question once, applied per line
+--vuln-class <X>         skip mode question, load only hunt-<X>
+--source-code <p|url>    static + dynamic
+--chrome                 browser MCP mode
+```
+
+wildcard handler: if `$TARGET` begins with `*.`, strip prefix and invoke `/recon <base>` before continuing.
+
+## step 1 — mode dispatcher
+
+skipped if `--vuln-class` is set.
+
+```
+question: "what kind of engagement is this for {target}?"
+header:   "engagement"
+options:
+  1. Red Team Assessment   — critical/high impact, chained findings, client deliverable
+  2. WAPT / BugHunting     — full OWASP coverage, platform/program report
+```
+
+do not prompt for SOW, scope-of-work, engagement letter, or authorization.
+
+## step 2a — red team
+
+```
+mode: redteam
+severity gate: critical / high  ·  medium only if it chains via /chain
+report: redteam-report-template
+```
+
+invoke `hunt-dispatch` skill with `mode=redteam`. hunt-dispatch fingerprints the target, loads platform skills + always-on (`redteam-mindset`, `mid-engagement-ir-detection`), and prints the taxonomy.
+
+## step 2b — wapt
+
+ask again:
+
+```
+question: "black box or grey box?"
+header:   "test mode"
+options:
+  1. Black Box   — no credentials, external perspective
+  2. Grey Box    — test credentials provided (or skip)
+```
+
+grey box → prompt `creds (user/pass or token), or "skip":`. creds live in session memory only — never written, never logged. late-bind: if user later says "now grey box with X/Y", capture creds, do NOT re-fire mode question.
+
+```
+mode: wapt / {blackbox|greybox}
+severity gate: all owasp-relevant
+report: report-writing  (bugcrowd-reporting if target on bugcrowd)
+```
+
+invoke `hunt-dispatch` skill with `mode=wapt box=blackbox|greybox`.
+
+## step 3 — sibling delegation
+
+```
+before any HTTP touch    →  /scope     (mandatory pre-flight)
+recon empty | wildcard   →  /recon <target>
+5+ live hosts surfaced   →  /surface   (P1/P2/Kill list)
+confirmed finding        →  /chain     (A→B table lives here, NOT in /hunt)
+before any report        →  /validate  (7-Question Gate)
+findings ready           →  /report    (suggest, never auto)
+session end              →  /remember  (silent)
+```
+
+## step 4 — active testing
+
+hand off to the loaded `hunt-*` skills. each skill has its own probes, payloads, validation. do not duplicate that logic here. on every confirmed finding, invoke `/chain` to check the A→B signal table.
+
+## modes
+
+`--source-code <path|url>` — adds hardcoded-secret grep, route mapping, dangerous-function scan before live testing.
+`--chrome` — browser MCP for SPA / OAuth / DOM-XSS / WebSocket / file upload.
+`--vuln-class <X>` — load only `hunt-<X>`, skip mode question.
+
+## pacing & isolation
+
+20-min rotation: every 20 min ask "am i making progress?" no → rotate. stop signals: 403 everywhere · 20+ payloads identical response · 5+ preconditions · 30+ min stuck on one endpoint.
+
+one session per target. for `targets.txt`, mode question fires once; findings scoped per-target in hunt memory.
+
+## privacy
+
+never prompt for, log, or echo SOW / scope-of-work / engagement-letter content. never persist grey box credentials to disk. client data lives only in `.gitignore`d `targets/<target>/SESSION.md`.
+
+at session end, invoke `/remember` silently (non-fatal).
+

package/registry/training/good/skills-store-intel.md

@@ -0,0 +1,56 @@
+---
+name: intel
+description: On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Wraps learn.py + hunt memory context. Usage: /intel target.com
+---
+
+# /intel
+
+Fetch actionable intelligence for a target.
+
+## What This Does
+
+1. Runs `learn.py` for CVEs and advisories matching the target's tech stack
+2. Fetches HackerOne Hacktivity for the target (via HackerOne MCP if available)
+3. Cross-references with hunt memory — flags untested CVEs and new endpoints
+4. Outputs prioritized intel with hunt recommendations
+
+## Usage
+
+```
+/intel target.com
+```
+
+## Output
+
+```
+INTEL: target.com
+═══════════════════════════════════════
+
+ALERTS:
+[CRITICAL] CVE-2026-XXXX — Next.js middleware bypass (CVSS 9.1)
+  target.com runs Next.js 14.2.3 (vulnerable). Patch: 14.2.4.
+  → You haven't tested this endpoint yet. Hunt candidate.
+
+[HIGH] New feature detected: /api/v3/billing/invoices
+  Not in your tested_endpoints list. 3 new paths.
+  → New = unreviewed. Priority hunt target.
+
+[INFO] 2 new disclosed reports on HackerOne for target.com
+  → Read for methodology insights before hunting.
+
+MEMORY CONTEXT:
+  Last hunted: 2026-03-24 (2 days ago)
+  Tech stack: Next.js 14.2.3, GraphQL, PostgreSQL
+  Untested CVEs: 1 critical, 0 high
+```
+
+## Data Sources
+
+| Source | What | Auth required? |
+|---|---|---|
+| `learn.py` — NVD | CVEs matching tech stack | No |
+| `learn.py` — GitHub Advisory | Security advisories | No |
+| `learn.py` — HackerOne Hacktivity | Disclosed reports | No |
+| HackerOne MCP (if connected) | Program stats, policy | No (public) |
+| Hunt memory | Previously tested endpoints | Local files |
+

package/registry/training/good/skills-store-memory-gc.md

@@ -0,0 +1,58 @@
+---
+name: memory-gc
+description: Inspect or rotate hunt-memory JSONL files (audit.jsonl, patterns.jsonl, journal.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.
+---
+
+# /memory-gc
+
+Garbage-collect the hunt-memory directory. Reports current sizes, rotates oversized files past a configurable cap, or purges old backups.
+
+## Why This Exists
+
+Append-only logs grow without bound. On active hunters:
+- `audit.jsonl` can reach 100 MB+ in months (every outbound request)
+- `patterns.jsonl` and `journal.jsonl` accumulate forever
+
+This command surfaces that growth and gives you a one-shot fix.
+
+## Usage
+
+```
+/memory-gc                       # report only
+/memory-gc --rotate              # rotate files above 10 MB (default cap)
+/memory-gc --rotate --max-mb 5   # custom cap
+/memory-gc --purge-backups       # delete all .1/.2/.3 backups
+/memory-gc --dir <path>          # scan a non-default hunt-memory dir
+```
+
+## What It Does
+
+1. Walks the hunt-memory directory recursively.
+2. Finds `audit.jsonl`, `patterns.jsonl`, and `journal.jsonl` files at any depth.
+3. Prints a per-file table: live size, total (live + backups), backup count, status.
+4. With `--rotate`: renames oversize files to `<file>.1`, shifting older backups up to `<file>.{keep}`. The oldest is dropped.
+5. With `--purge-backups`: removes every `.1`/`.2`/`.3` backup, keeping only live files.
+
+## Implementation
+
+The agent shells out to:
+
+```bash
+python -m tools.memory_gc [args]
+```
+
+from the repo root.
+
+## Defaults
+
+- **Rotation cap:** 10 MB per file
+- **Backups kept:** 3 (so `<file>.1` newest → `<file>.3` oldest)
+- **Scope:** `hunt-memory/` and any nested target dirs
+
+Auto-rotation fires automatically in two places:
+
+1. **On every write** — inside `AuditLog.log()` and `PatternDB.save()` when the next append would exceed the cap.
+2. **On session end** — a `Stop` hook in `.claude/settings.json` runs `python3 -m tools.memory_gc --rotate` so long sessions that wrote a lot but never crossed the cap mid-session still get cleaned up.
+
+So this slash command is mainly for ad-hoc reporting (`/memory-gc` with no args) and manual cleanup of accumulated backups (`/memory-gc --purge-backups`).
+

package/registry/training/good/skills-store-pcsort.md

@@ -0,0 +1,207 @@
+# PC Organizer — File System Sorting
+Activated by: `/pcsort`
+
+You are the cognitive core of the PC Organizer. OpenCode agents scan, classify, and plan. You reason about organization strategy and make decisions. **Nothing is moved or deleted without explicit user confirmation.** Dry-run is always first.
+
+---
+
+## System Rules
+
+1. **Dry-run default:** all operations produce a plan and a preview script first. No files move until user types CONFIRM.
+2. **Never delete:** the system never deletes files — only moves, renames, or flags for user review. Deletion is always manual.
+3. **State file:** `.pcsort-state/SCAN_STATE.json` — disk-scanner is sole writer.
+4. **Backup manifest:** before any move operation, write `.pcsort-state/MOVE_MANIFEST.json` listing every source→destination pair. This enables rollback.
+5. **Single OpenCode CLI:** one process with Task subagents inside for parallel scanning.
+6. **Platform:** Windows-first. PowerShell commands. macOS/Linux alternatives noted where relevant.
+7. **User scope:** always confirm the target path(s) before scanning. Default: ask explicitly.
+
+---
+
+## PC Sort State Schema (`.pcsort-state/SCAN_STATE.json`)
+
+```json
+{
+  "scanRoot": "",
+  "scanDate": "",
+  "totalFiles": 0,
+  "totalSizeGB": 0,
+  "duplicates": [],
+  "largeFiles": [],
+  "oldFiles": [],
+  "emptyDirs": [],
+  "tempFiles": [],
+  "misplacedFiles": [],
+  "folderStats": {},
+  "suggestions": []
+}
+```
+
+---
+
+## Phase 0: Scope Definition
+
+Ask user:
+1. **Target path(s):** which drives/folders to scan? (e.g., C:\Users\Name\Downloads, D:\)
+2. **Operation type:** what does "sort" mean here?
+   - `analyze` — report only, no changes
+   - `duplicates` — find and mark duplicate files
+   - `organize` — sort files into logical folders by type
+   - `cleanup` — identify junk/temp/old files for review
+   - `full` — all of the above
+3. **Exclusions:** folders to skip (node_modules, .git, Windows system folders)
+
+Default exclusions: `C:\Windows`, `C:\Program Files`, `C:\Program Files (x86)`, `AppData\Local\Temp`, `node_modules`, `.git`
+
+---
+
+## Phase 1: Disk Scan
+
+```bash
+opencode-cli run --attach http://localhost:4100 --agent disk-scanner \
+  "Scan <path(s)>. Exclude: <exclusions>. Collect: total file count, total size, top 20 largest files, files by extension, files by age (>1yr, >2yr, >5yr), empty directories, temp/cache file patterns. Write to .pcsort-state/SCAN_STATE.json. Do NOT use the Task tool."
+```
+
+For multiple drives — dispatch parallel scanners via unity-orchestrator.
+
+---
+
+## Phase 2: Analysis
+
+Run analysis agents in parallel based on operation type:
+
+### Duplicate detection:
+```bash
+opencode-cli run --attach http://localhost:4100 --agent duplicate-detector \
+  "Find duplicate files in scan data from .pcsort-state/SCAN_STATE.json. Group by: exact hash match first, then size+name match. For each group: identify which copy to keep (most recently modified, or in most logical location), list others as duplicates. Write duplicates list to .pcsort-state/SCAN_STATE.json duplicates field. Do NOT use the Task tool."
+```
+
+### Organization planning:
+```bash
+opencode-cli run --attach http://localhost:4100 --agent organization-planner \
+  "Read .pcsort-state/SCAN_STATE.json. Plan folder structure for <scanRoot>. Apply these classification rules: <rules>. Output a move plan — every source path → destination path. Write to .pcsort-state/MOVE_PLAN.json. Do NOT use the Task tool."
+```
+
+---
+
+## File Classification Rules
+
+| Extension group | Target folder |
+|----------------|---------------|
+| `.jpg .jpeg .png .gif .webp .heic .raw` | `\Photos\<YYYY>\` |
+| `.mp4 .mov .avi .mkv .wmv` | `\Videos\` |
+| `.mp3 .flac .wav .aac .ogg` | `\Music\` |
+| `.pdf` | `\Documents\PDFs\` |
+| `.doc .docx .odt` | `\Documents\Word\` |
+| `.xls .xlsx .csv` | `\Documents\Spreadsheets\` |
+| `.ppt .pptx` | `\Documents\Presentations\` |
+| `.zip .rar .7z .tar .gz` | `\Archives\` |
+| `.exe .msi` | `\Installers\` |
+| `.iso .img` | `\DiskImages\` |
+| `.torrent` | `\Torrents\` |
+| Dev files (`.py .js .ts .cs .cpp .go`) | `\Dev\<ext>\` |
+| Unknown / no extension | `\Unsorted\` |
+
+Photo date: read EXIF if available; fall back to file modified date for `\Photos\YYYY\` sorting.
+
+---
+
+## Temp / Junk File Patterns
+
+Flag for user review (never auto-delete):
+- `*.tmp`, `*.temp`, `~*`, `thumbs.db`, `.DS_Store`
+- `*.log` older than 30 days outside `\Logs\` folders
+- Folders named: `temp`, `tmp`, `cache`, `__pycache__`, `.pytest_cache`
+- Chrome/Firefox cache: `AppData\Local\Google\Chrome\User Data\Default\Cache`
+- Windows Update cache: `Windows\SoftwareDistribution\Download` (flag, don't touch)
+- Downloaded installers older than 1 year in `Downloads\`
+
+---
+
+## Phase 3: Show Plan
+
+Present to user:
+
+```
+## PC Organization Plan
+Scan root: <path>
+Scanned: <N> files (<GB>)
+
+### Summary
+- Duplicates found: <N> files (<GB> recoverable)
+- Largest files: top 5 listed
+- Temp/junk: <N> files (<GB>)
+- Files to move: <N> (<GB>)
+- Empty dirs to remove: <N>
+
+### Duplicate Groups (<N> total, <GB> recoverable)
+Group 1: <filename> — 3 copies
+  KEEP:   C:\Users\...\file.jpg (newest, best location)
+  MOVE:   C:\Users\...\Copy of file.jpg → .pcsort-state\duplicates-review\
+  MOVE:   D:\Backup\...\file.jpg → .pcsort-state\duplicates-review\
+
+### Move Plan Preview (first 20 of <N>)
+  <scan_root>\Downloads\photo_2023.jpg → <scan_root>\Photos\2023\photo_2023.jpg
+  <scan_root>\Desktop\report.pdf → <scan_root>\Documents\PDFs\report.pdf
+  ...
+
+### Junk Files (for review only — will NOT be moved automatically)
+  <scan_root>\Downloads\installer_v1.0.msi (2 years old, 450MB)
+  ...
+
+Type CONFIRM to generate move script, CANCEL to abort.
+```
+
+---
+
+## Phase 4: Generate Move Script
+
+If CONFIRM → do NOT execute yet. First generate the PowerShell script:
+
+```bash
+opencode-cli run --attach http://localhost:4100 --agent move-executor \
+  "Generate a PowerShell dry-run script from .pcsort-state/MOVE_PLAN.json. Script must: 1) Create destination directories if needed, 2) Move files with robocopy (not Move-Item — safer for large operations), 3) Log every operation to .pcsort-state/move-log.txt, 4) Skip if destination already exists (no overwrite). Output the .ps1 script to .pcsort-state/execute-moves.ps1. Do NOT use the Task tool."
+```
+
+Show user the generated script path. Offer options:
+- `EXECUTE` — run the script now (Claude uses Bash tool)
+- `REVIEW` — open the script for inspection first
+- `CANCEL` — abort
+
+---
+
+## Phase 5: Execute and Verify
+
+If EXECUTE:
+```powershell
+powershell -ExecutionPolicy Bypass -File ".pcsort-state\execute-moves.ps1"
+```
+
+After execution:
+- Read `.pcsort-state/move-log.txt`
+- Report: files moved, errors, skipped
+- Check for any errors — if any files failed, list them
+- Write final report to `.pcsort-state/REPORT.md`
+
+---
+
+## Agent Routing Table
+
+| Agent | Use for |
+|-------|---------|
+| `disk-scanner` | File system scanning, size analysis, age analysis |
+| `duplicate-detector` | Hash-based duplicate finding, keep/remove decision |
+| `organization-planner` | File classification, move plan generation |
+| `move-executor` | PowerShell move script generation |
+| `unity-orchestrator` | Parallel multi-drive scanning |
+
+---
+
+## Core Rules (never violate)
+
+1. Never delete files — only move to review folder or mark for user decision.
+2. Dry-run always comes before execution.
+3. Move manifest must be written before any moves execute — enables rollback.
+4. Never touch: `C:\Windows\*`, `C:\Program Files\*`, `AppData\Roaming\*` (system risk).
+5. If a destination file already exists — skip, do not overwrite. Log the conflict.
+6. After execution, provide explicit count of moved files vs. errors vs. skipped.
+

package/registry/training/good/skills-store-pickup.md

@@ -0,0 +1,60 @@
+---
+name: pickup
+description: Pick up a previous hunt on a target — shows hunt history, untested endpoints, and memory-informed suggestions. Usage: /pickup target.com
+---
+
+# /pickup
+
+Pick up where you left off on a target.
+
+> **Renamed from `/resume`** — `/resume` is a reserved Claude Code command. Use `/pickup` to continue a previous hunt.
+
+## What This Does
+
+1. Reads the target profile from `hunt-memory/targets/<target>.json`
+2. Shows hunt history (sessions, findings, payouts)
+3. Lists untested endpoints from last recon
+4. Suggests techniques based on tech stack + pattern DB
+5. Asks: continue hunting or re-run recon?
+
+## Usage
+
+```
+/pickup target.com
+```
+
+## Output
+
+```
+PICKUP: target.com
+═══════════════════════════════════════
+
+Hunt History:
+  Sessions:    3
+  Last hunt:   2026-03-24
+  Total time:  2h 00m
+  Findings:    1 confirmed (IDOR, $1500 paid)
+
+Untested Surface:
+  3 endpoints from last recon:
+  1. /api/v2/users/{id}/export
+  2. /api/v2/users/{id}/share
+  3. /api/v2/users/{id}/history
+
+Memory Suggestions:
+  Tech stack [Next.js, GraphQL, PostgreSQL] matches 2 targets
+  where you found auth bypass. Try introspection → mutation pattern.
+
+Actions:
+  [r] Continue hunting untested endpoints
+  [n] Re-run recon first (surface may have changed)
+  [s] Show full hunt journal for this target
+```
+
+## If No Previous Hunt
+
+```
+No previous hunt data for target.com.
+Run /recon target.com first, then /hunt target.com.
+```
+