promptgraph-mcp 2.4.7 → 2.4.8

package/registry/training/good/skills-store-evolve.md

@@ -1,100 +0,0 @@
-# /evolve — Self-Evolution Loop for dev-os
-
-Run the infinite self-improvement loop. Each cycle discovers new tech, analyzes the codebase, generates improvement proposals, runs experiments, and optionally applies safe changes.
-
-## Usage
-
-```
-/evolve
-```
-
-On first invocation, ask the user:
-
-1. **Mode**:
-   - `once` — Run one evolution cycle now
-   - `forever` — Infinite loop (runs every 6 hours)
-   - `status` — Show evolution history and stats
-   - `focus: llm` — Scan only new LLM models
-   - `focus: prompts` — Evolve agent prompts only
-   - `focus: features` — Discover new capabilities
-   - `focus: tech` — Scan new libraries/tools
-   - `focus: experimental` — Run strategy comparisons (ToT vs ReAct, MoA, Constitutional AI, prompt evolution)
-
-2. **Auto-apply safe improvements?** — yes / no
-
-## Execution by Mode
-
-### once
-```powershell
-cd "C:\Users\Sasha\.claude\dev-os"
-$env:PYTHONIOENCODING="utf-8"
-python -c "
-from dev_os.agents.evolution_loop import EvolutionLoop
-loop = EvolutionLoop()
-report = loop.run_once(focus='FOCUS_HERE')
-import json
-print(json.dumps(report, indent=2, ensure_ascii=False, default=str))
-"
-```
-
-### forever
-Start background process:
-```powershell
-Start-Process python -ArgumentList '-m dev_os.cli evolve --forever --interval 6' -WorkingDirectory "C:\Users\Sasha\.claude\dev-os" -WindowStyle Hidden
-```
-
-Alternatively, use `/loop` skill with this command to run every 6 hours:
-```
-/loop 6h python -c "from dev_os.agents.evolution_loop import EvolutionLoop; loop = EvolutionLoop(); loop.run_cycle(auto_apply=False)"
-```
-
-### status
-```powershell
-cd "C:\Users\Sasha\.claude\dev-os"
-$env:PYTHONIOENCODING="utf-8"
-python -c "
-from dev_os.agents.evolution_loop import EvolutionLoop
-import json
-s = EvolutionLoop().status()
-print(json.dumps(s, indent=2, ensure_ascii=False, default=str))
-"
-```
-
-### what-changed
-```powershell
-cd "C:\Users\Sasha\.claude\dev-os"
-$env:PYTHONIOENCODING="utf-8"
-python -c "
-from dev_os.agents.evolution_loop import EvolutionLoop
-import json
-changes = EvolutionLoop().what_changed()
-print(json.dumps(changes, indent=2, ensure_ascii=False, default=str))
-"
-```
-
-## Focus: experimental — Strategy Details
-
-When the user selects `focus: experimental`, Claude MUST run experiments comparing:
-
-1. **Tree of Thought vs ReAct** — Compare multi-step reasoning strategies on the LLM router agent
-2. **Mixture of Agents** — Test having multiple agent instances collaborate on a single task
-3. **Constitutional AI self-improvement** — Apply constitutional AI principles to the LLM router's prompt templates
-4. **Prompt evolution** — Evolve prompts on the market analysis agent using the experiment engine
-
-Steps for experimental focus:
-1. Run `EvolutionLoop().run_once(focus="experimental")` which calls `ExperimentEngine.compare_strategies()`
-2. Show the comparison results to the user
-3. Recommend which strategy to integrate
-4. If user agrees, implement the winning strategy using `mcp__opencode__opencode_run` or by spawning an agent
-
-## Output
-
-After any mode, display:
-
-- What was discovered (new LLMs, trending repos, arxiv papers, free APIs)
-- What proposals were generated
-- What was applied (if auto_apply)
-- What experiments ran and which ones passed
-- Current system quality score
-- Cycle number and next scheduled run (for `forever` mode)
-

package/registry/training/good/skills-store-game.md

@@ -1,27 +0,0 @@
-# Game Dev Skill Router
-
-Роутер для всех игровых скиллов из `C:\Users\Sasha\Desktop\SKILLS\`.
-
-Invoke: `/game <skill>`
-
-## Скиллы
-
-| Команда | Файл | Когда |
-|---------|------|-------|
-| `/game resume` | `game-resume.md` | Начало каждой сессии |
-| `/game arch` | `game-architecture-define.md` | Новый проект или хаос |
-| `/game progress` | `game-progress-check.md` | Глубокий анализ состояния |
-| `/game milestone` | `game-milestone-check.md` | Проверка готовности фазы |
-| `/game scope` | `game-scope-guard.md` | Новая идея — брать или нет |
-| `/game velocity` | `game-velocity.md` | Прогноз даты релиза |
-| `/game harvest` | `game-skill-harvest.md` | Создать скилл из фикса |
-| `/game hooks` | `setup-git-hooks.md` | Настройка git хуков |
-| `/game help` | `GUIDE.md` | Краткий гайд |
-
-## Выполнение
-
-По аргументу `$ARGUMENTS` определи нужный файл из таблицы выше.
-Прочитай `C:\Users\Sasha\Desktop\SKILLS\<файл>` и выполни инструкции.
-
-Если аргумент не указан или не распознан → покажи таблицу выше.
-

package/registry/training/good/skills-store-hunt.md

@@ -1,102 +0,0 @@
----
-name: hunt
-description: Active vulnerability hunting. Two-track dispatcher — asks Red Team vs WAPT, hands off to hunt-dispatch skill and sibling commands. Usage: /hunt target.com | /hunt *.target.com | /hunt targets.txt [--vuln-class X] [--source-code P] [--chrome]
----
-
-# /hunt
-
-slim two-track dispatcher. one mode question, one branch, delegate. never asks about SOW — invoking `/hunt` implies SOW is signed.
-
-## step 0 — parse
-
-```
-target.com               single target
-*.target.com             wildcard — /recon <base> first, then hunt each live host
-targets.txt              multi-target — mode question once, applied per line
---vuln-class <X>         skip mode question, load only hunt-<X>
---source-code <p|url>    static + dynamic
---chrome                 browser MCP mode
-```
-
-wildcard handler: if `$TARGET` begins with `*.`, strip prefix and invoke `/recon <base>` before continuing.
-
-## step 1 — mode dispatcher
-
-skipped if `--vuln-class` is set.
-
-```
-question: "what kind of engagement is this for {target}?"
-header:   "engagement"
-options:
-  1. Red Team Assessment   — critical/high impact, chained findings, client deliverable
-  2. WAPT / BugHunting     — full OWASP coverage, platform/program report
-```
-
-do not prompt for SOW, scope-of-work, engagement letter, or authorization.
-
-## step 2a — red team
-
-```
-mode: redteam
-severity gate: critical / high  ·  medium only if it chains via /chain
-report: redteam-report-template
-```
-
-invoke `hunt-dispatch` skill with `mode=redteam`. hunt-dispatch fingerprints the target, loads platform skills + always-on (`redteam-mindset`, `mid-engagement-ir-detection`), and prints the taxonomy.
-
-## step 2b — wapt
-
-ask again:
-
-```
-question: "black box or grey box?"
-header:   "test mode"
-options:
-  1. Black Box   — no credentials, external perspective
-  2. Grey Box    — test credentials provided (or skip)
-```
-
-grey box → prompt `creds (user/pass or token), or "skip":`. creds live in session memory only — never written, never logged. late-bind: if user later says "now grey box with X/Y", capture creds, do NOT re-fire mode question.
-
-```
-mode: wapt / {blackbox|greybox}
-severity gate: all owasp-relevant
-report: report-writing  (bugcrowd-reporting if target on bugcrowd)
-```
-
-invoke `hunt-dispatch` skill with `mode=wapt box=blackbox|greybox`.
-
-## step 3 — sibling delegation
-
-```
-before any HTTP touch    →  /scope     (mandatory pre-flight)
-recon empty | wildcard   →  /recon <target>
-5+ live hosts surfaced   →  /surface   (P1/P2/Kill list)
-confirmed finding        →  /chain     (A→B table lives here, NOT in /hunt)
-before any report        →  /validate  (7-Question Gate)
-findings ready           →  /report    (suggest, never auto)
-session end              →  /remember  (silent)
-```
-
-## step 4 — active testing
-
-hand off to the loaded `hunt-*` skills. each skill has its own probes, payloads, validation. do not duplicate that logic here. on every confirmed finding, invoke `/chain` to check the A→B signal table.
-
-## modes
-
-`--source-code <path|url>` — adds hardcoded-secret grep, route mapping, dangerous-function scan before live testing.
-`--chrome` — browser MCP for SPA / OAuth / DOM-XSS / WebSocket / file upload.
-`--vuln-class <X>` — load only `hunt-<X>`, skip mode question.
-
-## pacing & isolation
-
-20-min rotation: every 20 min ask "am i making progress?" no → rotate. stop signals: 403 everywhere · 20+ payloads identical response · 5+ preconditions · 30+ min stuck on one endpoint.
-
-one session per target. for `targets.txt`, mode question fires once; findings scoped per-target in hunt memory.
-
-## privacy
-
-never prompt for, log, or echo SOW / scope-of-work / engagement-letter content. never persist grey box credentials to disk. client data lives only in `.gitignore`d `targets/<target>/SESSION.md`.
-
-at session end, invoke `/remember` silently (non-fatal).
-

package/registry/training/good/skills-store-intel.md

@@ -1,56 +0,0 @@
----
-name: intel
-description: On-demand intelligence fetch for a target — CVEs, disclosed reports, new features. Wraps learn.py + hunt memory context. Usage: /intel target.com
----
-
-# /intel
-
-Fetch actionable intelligence for a target.
-
-## What This Does
-
-1. Runs `learn.py` for CVEs and advisories matching the target's tech stack
-2. Fetches HackerOne Hacktivity for the target (via HackerOne MCP if available)
-3. Cross-references with hunt memory — flags untested CVEs and new endpoints
-4. Outputs prioritized intel with hunt recommendations
-
-## Usage
-
-```
-/intel target.com
-```
-
-## Output
-
-```
-INTEL: target.com
-═══════════════════════════════════════
-
-ALERTS:
-[CRITICAL] CVE-2026-XXXX — Next.js middleware bypass (CVSS 9.1)
-  target.com runs Next.js 14.2.3 (vulnerable). Patch: 14.2.4.
-  → You haven't tested this endpoint yet. Hunt candidate.
-
-[HIGH] New feature detected: /api/v3/billing/invoices
-  Not in your tested_endpoints list. 3 new paths.
-  → New = unreviewed. Priority hunt target.
-
-[INFO] 2 new disclosed reports on HackerOne for target.com
-  → Read for methodology insights before hunting.
-
-MEMORY CONTEXT:
-  Last hunted: 2026-03-24 (2 days ago)
-  Tech stack: Next.js 14.2.3, GraphQL, PostgreSQL
-  Untested CVEs: 1 critical, 0 high
-```
-
-## Data Sources
-
-| Source | What | Auth required? |
-|---|---|---|
-| `learn.py` — NVD | CVEs matching tech stack | No |
-| `learn.py` — GitHub Advisory | Security advisories | No |
-| `learn.py` — HackerOne Hacktivity | Disclosed reports | No |
-| HackerOne MCP (if connected) | Program stats, policy | No (public) |
-| Hunt memory | Previously tested endpoints | Local files |
-

package/registry/training/good/skills-store-memory-gc.md

@@ -1,58 +0,0 @@
----
-name: memory-gc
-description: Inspect or rotate hunt-memory JSONL files (audit.jsonl, patterns.jsonl, journal.jsonl). Caps file size and keeps N rotated backups so memory does not grow unbounded.
----
-
-# /memory-gc
-
-Garbage-collect the hunt-memory directory. Reports current sizes, rotates oversized files past a configurable cap, or purges old backups.
-
-## Why This Exists
-
-Append-only logs grow without bound. On active hunters:
-- `audit.jsonl` can reach 100 MB+ in months (every outbound request)
-- `patterns.jsonl` and `journal.jsonl` accumulate forever
-
-This command surfaces that growth and gives you a one-shot fix.
-
-## Usage
-
-```
-/memory-gc                       # report only
-/memory-gc --rotate              # rotate files above 10 MB (default cap)
-/memory-gc --rotate --max-mb 5   # custom cap
-/memory-gc --purge-backups       # delete all .1/.2/.3 backups
-/memory-gc --dir <path>          # scan a non-default hunt-memory dir
-```
-
-## What It Does
-
-1. Walks the hunt-memory directory recursively.
-2. Finds `audit.jsonl`, `patterns.jsonl`, and `journal.jsonl` files at any depth.
-3. Prints a per-file table: live size, total (live + backups), backup count, status.
-4. With `--rotate`: renames oversize files to `<file>.1`, shifting older backups up to `<file>.{keep}`. The oldest is dropped.
-5. With `--purge-backups`: removes every `.1`/`.2`/`.3` backup, keeping only live files.
-
-## Implementation
-
-The agent shells out to:
-
-```bash
-python -m tools.memory_gc [args]
-```
-
-from the repo root.
-
-## Defaults
-
-- **Rotation cap:** 10 MB per file
-- **Backups kept:** 3 (so `<file>.1` newest → `<file>.3` oldest)
-- **Scope:** `hunt-memory/` and any nested target dirs
-
-Auto-rotation fires automatically in two places:
-
-1. **On every write** — inside `AuditLog.log()` and `PatternDB.save()` when the next append would exceed the cap.
-2. **On session end** — a `Stop` hook in `.claude/settings.json` runs `python3 -m tools.memory_gc --rotate` so long sessions that wrote a lot but never crossed the cap mid-session still get cleaned up.
-
-So this slash command is mainly for ad-hoc reporting (`/memory-gc` with no args) and manual cleanup of accumulated backups (`/memory-gc --purge-backups`).
-

package/registry/training/good/skills-store-pcsort.md

@@ -1,207 +0,0 @@
-# PC Organizer — File System Sorting
-Activated by: `/pcsort`
-
-You are the cognitive core of the PC Organizer. OpenCode agents scan, classify, and plan. You reason about organization strategy and make decisions. **Nothing is moved or deleted without explicit user confirmation.** Dry-run is always first.
-
----
-
-## System Rules
-
-1. **Dry-run default:** all operations produce a plan and a preview script first. No files move until user types CONFIRM.
-2. **Never delete:** the system never deletes files — only moves, renames, or flags for user review. Deletion is always manual.
-3. **State file:** `.pcsort-state/SCAN_STATE.json` — disk-scanner is sole writer.
-4. **Backup manifest:** before any move operation, write `.pcsort-state/MOVE_MANIFEST.json` listing every source→destination pair. This enables rollback.
-5. **Single OpenCode CLI:** one process with Task subagents inside for parallel scanning.
-6. **Platform:** Windows-first. PowerShell commands. macOS/Linux alternatives noted where relevant.
-7. **User scope:** always confirm the target path(s) before scanning. Default: ask explicitly.
-
----
-
-## PC Sort State Schema (`.pcsort-state/SCAN_STATE.json`)
-
-```json
-{
-  "scanRoot": "",
-  "scanDate": "",
-  "totalFiles": 0,
-  "totalSizeGB": 0,
-  "duplicates": [],
-  "largeFiles": [],
-  "oldFiles": [],
-  "emptyDirs": [],
-  "tempFiles": [],
-  "misplacedFiles": [],
-  "folderStats": {},
-  "suggestions": []
-}
-```
-
----
-
-## Phase 0: Scope Definition
-
-Ask user:
-1. **Target path(s):** which drives/folders to scan? (e.g., C:\Users\Name\Downloads, D:\)
-2. **Operation type:** what does "sort" mean here?
-   - `analyze` — report only, no changes
-   - `duplicates` — find and mark duplicate files
-   - `organize` — sort files into logical folders by type
-   - `cleanup` — identify junk/temp/old files for review
-   - `full` — all of the above
-3. **Exclusions:** folders to skip (node_modules, .git, Windows system folders)
-
-Default exclusions: `C:\Windows`, `C:\Program Files`, `C:\Program Files (x86)`, `AppData\Local\Temp`, `node_modules`, `.git`
-
----
-
-## Phase 1: Disk Scan
-
-```bash
-opencode-cli run --attach http://localhost:4100 --agent disk-scanner \
-  "Scan <path(s)>. Exclude: <exclusions>. Collect: total file count, total size, top 20 largest files, files by extension, files by age (>1yr, >2yr, >5yr), empty directories, temp/cache file patterns. Write to .pcsort-state/SCAN_STATE.json. Do NOT use the Task tool."
-```
-
-For multiple drives — dispatch parallel scanners via unity-orchestrator.
-
----
-
-## Phase 2: Analysis
-
-Run analysis agents in parallel based on operation type:
-
-### Duplicate detection:
-```bash
-opencode-cli run --attach http://localhost:4100 --agent duplicate-detector \
-  "Find duplicate files in scan data from .pcsort-state/SCAN_STATE.json. Group by: exact hash match first, then size+name match. For each group: identify which copy to keep (most recently modified, or in most logical location), list others as duplicates. Write duplicates list to .pcsort-state/SCAN_STATE.json duplicates field. Do NOT use the Task tool."
-```
-
-### Organization planning:
-```bash
-opencode-cli run --attach http://localhost:4100 --agent organization-planner \
-  "Read .pcsort-state/SCAN_STATE.json. Plan folder structure for <scanRoot>. Apply these classification rules: <rules>. Output a move plan — every source path → destination path. Write to .pcsort-state/MOVE_PLAN.json. Do NOT use the Task tool."
-```
-
----
-
-## File Classification Rules
-
-| Extension group | Target folder |
-|----------------|---------------|
-| `.jpg .jpeg .png .gif .webp .heic .raw` | `\Photos\<YYYY>\` |
-| `.mp4 .mov .avi .mkv .wmv` | `\Videos\` |
-| `.mp3 .flac .wav .aac .ogg` | `\Music\` |
-| `.pdf` | `\Documents\PDFs\` |
-| `.doc .docx .odt` | `\Documents\Word\` |
-| `.xls .xlsx .csv` | `\Documents\Spreadsheets\` |
-| `.ppt .pptx` | `\Documents\Presentations\` |
-| `.zip .rar .7z .tar .gz` | `\Archives\` |
-| `.exe .msi` | `\Installers\` |
-| `.iso .img` | `\DiskImages\` |
-| `.torrent` | `\Torrents\` |
-| Dev files (`.py .js .ts .cs .cpp .go`) | `\Dev\<ext>\` |
-| Unknown / no extension | `\Unsorted\` |
-
-Photo date: read EXIF if available; fall back to file modified date for `\Photos\YYYY\` sorting.
-
----
-
-## Temp / Junk File Patterns
-
-Flag for user review (never auto-delete):
-- `*.tmp`, `*.temp`, `~*`, `thumbs.db`, `.DS_Store`
-- `*.log` older than 30 days outside `\Logs\` folders
-- Folders named: `temp`, `tmp`, `cache`, `__pycache__`, `.pytest_cache`
-- Chrome/Firefox cache: `AppData\Local\Google\Chrome\User Data\Default\Cache`
-- Windows Update cache: `Windows\SoftwareDistribution\Download` (flag, don't touch)
-- Downloaded installers older than 1 year in `Downloads\`
-
----
-
-## Phase 3: Show Plan
-
-Present to user:
-
-```
-## PC Organization Plan
-Scan root: <path>
-Scanned: <N> files (<GB>)
-
-### Summary
-- Duplicates found: <N> files (<GB> recoverable)
-- Largest files: top 5 listed
-- Temp/junk: <N> files (<GB>)
-- Files to move: <N> (<GB>)
-- Empty dirs to remove: <N>
-
-### Duplicate Groups (<N> total, <GB> recoverable)
-Group 1: <filename> — 3 copies
-  KEEP:   C:\Users\...\file.jpg (newest, best location)
-  MOVE:   C:\Users\...\Copy of file.jpg → .pcsort-state\duplicates-review\
-  MOVE:   D:\Backup\...\file.jpg → .pcsort-state\duplicates-review\
-
-### Move Plan Preview (first 20 of <N>)
-  <scan_root>\Downloads\photo_2023.jpg → <scan_root>\Photos\2023\photo_2023.jpg
-  <scan_root>\Desktop\report.pdf → <scan_root>\Documents\PDFs\report.pdf
-  ...
-
-### Junk Files (for review only — will NOT be moved automatically)
-  <scan_root>\Downloads\installer_v1.0.msi (2 years old, 450MB)
-  ...
-
-Type CONFIRM to generate move script, CANCEL to abort.
-```
-
----
-
-## Phase 4: Generate Move Script
-
-If CONFIRM → do NOT execute yet. First generate the PowerShell script:
-
-```bash
-opencode-cli run --attach http://localhost:4100 --agent move-executor \
-  "Generate a PowerShell dry-run script from .pcsort-state/MOVE_PLAN.json. Script must: 1) Create destination directories if needed, 2) Move files with robocopy (not Move-Item — safer for large operations), 3) Log every operation to .pcsort-state/move-log.txt, 4) Skip if destination already exists (no overwrite). Output the .ps1 script to .pcsort-state/execute-moves.ps1. Do NOT use the Task tool."
-```
-
-Show user the generated script path. Offer options:
-- `EXECUTE` — run the script now (Claude uses Bash tool)
-- `REVIEW` — open the script for inspection first
-- `CANCEL` — abort
-
----
-
-## Phase 5: Execute and Verify
-
-If EXECUTE:
-```powershell
-powershell -ExecutionPolicy Bypass -File ".pcsort-state\execute-moves.ps1"
-```
-
-After execution:
-- Read `.pcsort-state/move-log.txt`
-- Report: files moved, errors, skipped
-- Check for any errors — if any files failed, list them
-- Write final report to `.pcsort-state/REPORT.md`
-
----
-
-## Agent Routing Table
-
-| Agent | Use for |
-|-------|---------|
-| `disk-scanner` | File system scanning, size analysis, age analysis |
-| `duplicate-detector` | Hash-based duplicate finding, keep/remove decision |
-| `organization-planner` | File classification, move plan generation |
-| `move-executor` | PowerShell move script generation |
-| `unity-orchestrator` | Parallel multi-drive scanning |
-
----
-
-## Core Rules (never violate)
-
-1. Never delete files — only move to review folder or mark for user decision.
-2. Dry-run always comes before execution.
-3. Move manifest must be written before any moves execute — enables rollback.
-4. Never touch: `C:\Windows\*`, `C:\Program Files\*`, `AppData\Roaming\*` (system risk).
-5. If a destination file already exists — skip, do not overwrite. Log the conflict.
-6. After execution, provide explicit count of moved files vs. errors vs. skipped.
-

package/registry/training/good/skills-store-pickup.md

@@ -1,60 +0,0 @@
----
-name: pickup
-description: Pick up a previous hunt on a target — shows hunt history, untested endpoints, and memory-informed suggestions. Usage: /pickup target.com
----
-
-# /pickup
-
-Pick up where you left off on a target.
-
-> **Renamed from `/resume`** — `/resume` is a reserved Claude Code command. Use `/pickup` to continue a previous hunt.
-
-## What This Does
-
-1. Reads the target profile from `hunt-memory/targets/<target>.json`
-2. Shows hunt history (sessions, findings, payouts)
-3. Lists untested endpoints from last recon
-4. Suggests techniques based on tech stack + pattern DB
-5. Asks: continue hunting or re-run recon?
-
-## Usage
-
-```
-/pickup target.com
-```
-
-## Output
-
-```
-PICKUP: target.com
-═══════════════════════════════════════
-
-Hunt History:
-  Sessions:    3
-  Last hunt:   2026-03-24
-  Total time:  2h 00m
-  Findings:    1 confirmed (IDOR, $1500 paid)
-
-Untested Surface:
-  3 endpoints from last recon:
-  1. /api/v2/users/{id}/export
-  2. /api/v2/users/{id}/share
-  3. /api/v2/users/{id}/history
-
-Memory Suggestions:
-  Tech stack [Next.js, GraphQL, PostgreSQL] matches 2 targets
-  where you found auth bypass. Try introspection → mutation pattern.
-
-Actions:
-  [r] Continue hunting untested endpoints
-  [n] Re-run recon first (surface may have changed)
-  [s] Show full hunt journal for this target
-```
-
-## If No Previous Hunt
-
-```
-No previous hunt data for target.com.
-Run /recon target.com first, then /hunt target.com.
-```
-