tribunal-kit 5.8.1 → 5.8.3

package/.agent/skills/test-result-analyzer/SKILL.md

@@ -21,7 +21,7 @@ You are a specialist in analyzing test output — not writing tests, but _unders
 - After a test run with multiple failures.
 - When the user says "tests are failing", "analyze test results", "what broke?", or "test failed".
 - During CI/CD pipeline debugging.
-- When `test_runner.py` or any test command exits with failures.
+- When `test_runner.js` or any test command exits with failures.
 - When paired with `systematic-debugging` for deep root-cause investigation.
 
 ## Analysis Pipeline

package/.agent/workflows/fix.md

@@ -1,5 +1,5 @@
 ---
-description: Auto-fix known issues with lint, formatting, imports, and TypeScript errors. Runs lint_runner.py and auto-fixers. Human approval required before applying any changes. Shows a diff of what will change before writing to disk.
+description: Auto-fix known issues with lint, formatting, imports, and TypeScript errors. Runs lint_runner.js and auto-fixers. Human approval required before applying any changes. Shows a diff of what will change before writing to disk.
 required-skills: lint-and-validate, clean-code
 ---
 
@@ -55,7 +55,7 @@ Read BEFORE fixing:
 
 ```bash
 # 1. Run lint with auto-fix
-python .agent/scripts/lint_runner.py . --fix
+node .agent/scripts/lint_runner.js . --fix
 
 # 2. Fix remaining TypeScript errors (auto-detectable only)
 npx tsc --noEmit 2>&1 | grep "error TS"

package/.agent/workflows/generate.md

@@ -128,7 +128,7 @@ complexity-reviewer→ Enforces the Dependency Ladder to prevent over-engineerin
 | `aria`, `wcag`, `a11y`, `accessibility`                     | `accessibility-reviewer` + `ui-ux-auditor`                     |
 | `import`, `package`, `npm`, `require`                       | `dependency-reviewer`                                          |
 
-> For maximum safety on critical code: use `/tribunal-full` for all 19 reviewers simultaneously.
+> For maximum safety on critical code: use `/tribunal-full` for all 20 reviewers simultaneously.
 
 ---
 

package/.agent/workflows/preview.md

@@ -1,5 +1,5 @@
 ---
-description: Preview server start, stop, and status check. Local development server management. Uses auto_preview.py for automated lifecycle control. Shows current URL and hot-reload status.
+description: Preview server start, stop, and status check. Local development server management. Uses auto_preview.js for automated lifecycle control. Shows current URL and hot-reload status.
 required-skills: bash-linux, frontend-specialist
 ---
 
@@ -34,16 +34,16 @@ Read BEFORE managing preview:
 
 ```bash
 # Start
-python .agent/scripts/auto_preview.py start
+node .agent/scripts/auto_preview.js start
 
 # Stop
-python .agent/scripts/auto_preview.py stop
+node .agent/scripts/auto_preview.js stop
 
 # Restart
-python .agent/scripts/auto_preview.py restart
+node .agent/scripts/auto_preview.js restart
 
 # Status
-python .agent/scripts/auto_preview.py status
+node .agent/scripts/auto_preview.js status
 ```
 
 ---

package/.agent/workflows/status.md

@@ -44,7 +44,7 @@ git log --oneline -5
 find src/ -name "*.ts" -o -name "*.tsx" -newer package.json 2>/dev/null | head -10
 
 # 4. Server status (non-blocking)
-python .agent/scripts/auto_preview.py status 2>/dev/null
+node .agent/scripts/auto_preview.js status 2>/dev/null
 
 # 5. Quick type check
 npx tsc --noEmit 2>&1 | tail -5

package/.agent/workflows/tribunal-full.md

@@ -68,7 +68,7 @@ Tier 4: Performance Swarm (token-scoped specialists)
 
 ## Active Reviewers by Code Type
 
-Not all 19 reviewers produce meaningful findings on all code types. Active reviewers detect their first finding immediately — inactive reviewers auto-pass with "N/A for this code type."
+Not all 20 reviewers produce meaningful findings on all code types. Active reviewers detect their first finding immediately — inactive reviewers auto-pass with "N/A for this code type."
 
 | Code Under Review   | Critical Reviewers                                                |
 | :------------------ | :---------------------------------------------------------------- |
@@ -86,7 +86,7 @@ Not all 19 reviewers produce meaningful findings on all code types. Active revie
 ## Verdict Aggregation
 
 ```
-All 19 verdicts are collected. Aggregated result:
+All 20 verdicts are collected. Aggregated result:
 
 If ANY reviewer = ❌ REJECTED → Global verdict: ❌ REJECTED (must fix before Human Gate)
 If any reviewer = ⚠️ WARNING  → Global verdict: ⚠️ WARNINGS (proceed with attention)
@@ -124,7 +124,7 @@ After 3 failed attempts:
 
 | Outcome                    | Next Command                                   |
 | :------------------------- | :--------------------------------------------- |
-| All 19 reviewers approve   | → `/deploy` — highest confidence state         |
+| All 20 reviewers approve   | → `/deploy` — highest confidence state         |
 | Reject with multiple fixes | → `/fix` for simple issues, `/debug` for logic |
 | Performance rejection      | → `/tribunal-speed` for granular profiling     |
 | Security rejection         | → Immediate `/tribunal-backend` to resolve     |

package/.agent/workflows/tribunal-speed.md

@@ -181,7 +181,7 @@ If a specialist fails after 3 retries:
 | :------------------------- | :------------------------------- | :--------------------- | :--------------------------------------- |
 | `/tribunal-performance`    | logic + performance-reviewer     | Generic CWV check      | Quick single-file perf scan              |
 | `/tribunal-speed`          | vitals + db-latency + throughput | Deep 3-domain parallel | Full-stack perf audit                    |
-| `/tribunal-full`           | All 19 agents                    | Everything             | Maximum coverage (security + perf + all) |
+| `/tribunal-full`           | All 20 agents                    | Everything             | Maximum coverage (security + perf + all) |
 | `/performance-benchmarker` | Lighthouse + bundle              | Measurement only       | Get actual scores, not code review       |
 
 ---

package/CONTRIBUTING.md

@@ -0,0 +1,134 @@
+# Contributing to Tribunal Kit
+
+Thank you for your interest in contributing to Tribunal Kit! This guide will help you get started.
+
+## Quick Start
+
+```bash
+# Clone the repository
+git clone https://github.com/Harmitx7/tribunal-kit.git
+cd tribunal-kit
+
+# Install dependencies
+npm install
+
+# Run tests
+npm run test:unit
+
+# Run the CLI locally
+node bin/wrapper.js --help
+```
+
+## Development Setup
+
+### Prerequisites
+
+- **Node.js** >= 18.0.0 (LTS recommended)
+- **npm** >= 9
+- **Rust** (optional) — Only needed if modifying the Rust core engine in `crates/`
+
+### Project Structure
+
+```
+tribunal-kit/
+├── bin/                    # CLI entry points (JS monolith + MCP server)
+│   ├── wrapper.js          # Main entry: routes to Rust binary or JS fallback
+│   ├── tribunal-kit.js     # Legacy JS CLI (1,500+ lines)
+│   └── mcp-server.js       # MCP server over JSON-RPC 2.0 / stdio
+├── dist/                   # Modular CLI (lazy-loaded commands)
+│   ├── cli.js              # CLI core with command routing
+│   ├── commands/           # Individual command modules
+│   ├── utils/              # Logger, helpers, version checker, hasher
+│   └── index.d.ts          # TypeScript declarations
+├── crates/core/            # Rust core engine (Tokio-based)
+├── .agent/                 # The intelligence payload (agents, skills, workflows)
+│   ├── agents/             # 43 specialist agent definitions
+│   ├── skills/             # Reusable skill packs
+│   ├── workflows/          # 34 workflow definitions
+│   └── scripts/            # Automation scripts
+├── test/
+│   ├── unit/               # Unit tests (Jest)
+│   └── integration/        # Integration tests
+└── scripts/                # Build & release scripts
+```
+
+### Running Tests
+
+```bash
+# Unit tests with coverage
+npm run test:unit
+
+# All tests
+npm test
+
+# Run a specific test file
+npx jest test/unit/memory.test.js
+```
+
+### Building the Rust Core (Optional)
+
+```bash
+# Build in release mode
+cargo build --release
+
+# Run benchmarks comparing Rust vs JS
+npm run benchmark:rust
+```
+
+## How to Contribute
+
+### Reporting Bugs
+
+1. Check [existing issues](https://github.com/Harmitx7/tribunal-kit/issues) first
+2. Use the bug report template
+3. Include: Node.js version, OS, steps to reproduce, expected vs actual behavior
+
+### Suggesting Features
+
+1. Open a [GitHub Discussion](https://github.com/Harmitx7/tribunal-kit/discussions) first
+2. Describe the use case, not just the solution
+3. Be specific about which command or workflow this affects
+
+### Submitting Pull Requests
+
+1. **Fork** the repository and create a branch from `main`
+2. **Write tests** for any new functionality
+3. **Run the test suite** — all tests must pass: `npm run test:unit`
+4. **Follow existing code style** — the project uses ESLint
+5. **Write clear commit messages** following [Conventional Commits](https://www.conventionalcommits.org/):
+   ```
+   feat: add --json flag to status command
+   fix: handle symlinks in init --force
+   docs: update CLI reference for memory command
+   test: add coverage for marathon harness
+   ```
+6. **Open a PR** with a clear description of what changed and why
+
+### Contributing Agents or Skills
+
+Tribunal Kit's value comes from its agent and skill library. To contribute:
+
+1. **Agents** go in `.agent/agents/` as markdown files
+2. **Skills** go in `.agent/skills/<skill-name>/SKILL.md`
+3. Follow the existing format — check any existing agent/skill for the structure
+4. Include the YAML frontmatter (`name`, `description`)
+5. Add practical, non-obvious guidance — not generic advice
+
+### Code Style
+
+- **JavaScript**: CommonJS (`require`/`module.exports`), no transpilation needed
+- **Naming**: `camelCase` for functions/variables, `UPPER_SNAKE` for constants
+- **Error handling**: Always handle errors in async functions
+- **Comments**: Explain *why*, not *what*
+- **No new dependencies**: Zero production dependencies is a feature, not a limitation
+
+## Review Process
+
+1. All PRs are reviewed by a maintainer
+2. CI must pass (tests + lint)
+3. Changes to `.agent/` content are reviewed for accuracy and usefulness
+4. Breaking changes require a discussion before implementation
+
+## License
+
+By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE).

package/SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.x     | ✅ Active support  |
+| 4.x     | ⚠️ Critical fixes only |
+| < 4.0   | ❌ End of life     |
+
+## Reporting a Vulnerability
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Instead, please report vulnerabilities privately using one of these methods:
+
+1. **GitHub Security Advisory** (preferred): Use [GitHub's private vulnerability reporting](https://github.com/Harmitx7/tribunal-kit/security/advisories/new) to submit a confidential report.
+
+2. **Email**: Send details to the maintainer via the email listed in the npm package.
+
+### What to include
+
+- Description of the vulnerability
+- Steps to reproduce
+- Affected versions
+- Potential impact
+- Suggested fix (if any)
+
+### Response timeline
+
+| Action | Timeline |
+| --- | --- |
+| Acknowledgment | Within 48 hours |
+| Initial assessment | Within 5 business days |
+| Fix release (critical) | Within 7 days |
+| Fix release (moderate) | Within 30 days |
+
+## Security Design
+
+Tribunal Kit follows these security principles:
+
+- **No network requests at runtime** — The CLI operates entirely offline. The only network call is an optional npm registry version check during `init`/`update`, which can be skipped with `--skip-update-check`.
+- **No code execution from user input** — CLI arguments are parsed without `eval()` or shell interpolation. All subprocess spawning uses array-based arguments (never string concatenation).
+- **No secrets stored** — Tribunal Kit does not store, read, or transmit API keys, tokens, or credentials.
+- **Minimal dependencies** — Zero production dependencies. Only `jest`, `eslint`, and `typescript` as devDependencies.
+- **Platform binaries are optional** — The Rust core binary is distributed as optional dependencies. The CLI falls back to pure JavaScript if binaries are unavailable.
+
+## Supply Chain
+
+- All releases are published from CI via GitHub Actions
+- Platform binaries are built in GitHub-hosted runners with pinned action versions
+- The package uses `npm provenance` for verifiable supply chain attestation

package/bin/tribunal-kit.js

@@ -158,6 +158,34 @@ function parseArgs(argv) {
     if (arg.startsWith("--branch=")) {
       args.flags.branch = arg.split("=").slice(1).join("=");
     }
+    if (arg.startsWith("--log=")) {
+      args.flags.log = arg.split("=").slice(1).join("=");
+    }
+    if (arg === "--log") {
+      const idx = raw.indexOf("--log");
+      const nextVal = raw[idx + 1];
+      if (!nextVal || nextVal.startsWith("--")) {
+        console.error(
+          `  \x1b[91m✖ --log requires a file path argument\x1b[0m`,
+        );
+        process.exit(1);
+      }
+      args.flags.log = nextVal;
+    }
+    if (arg.startsWith("--strategy=")) {
+      args.flags.strategy = arg.split("=").slice(1).join("=");
+    }
+    if (arg === "--strategy") {
+      const idx = raw.indexOf("--strategy");
+      const nextVal = raw[idx + 1];
+      if (!nextVal || nextVal.startsWith("--")) {
+        console.error(
+          `  \x1b[91m✖ --strategy requires a strategy value (balanced/harden/repair-only)\x1b[0m`,
+        );
+        process.exit(1);
+      }
+      args.flags.strategy = nextVal;
+    }
   }
 
   return args;
@@ -412,8 +440,19 @@ function banner() {
   const _maxLen = Math.max(...art.map((line) => line.length));
   for (const line of art) {
     let gradientLine = "  " + C.bold;
-    for (let i = 0; i < line.length; i++) {
-      gradientLine += `\x1b[38;2;255;22;55m${line[i]}`;
+    const len = line.length;
+    for (let i = 0; i < len; i++) {
+      const char = line[i];
+      if (char === ' ') {
+        gradientLine += ' ';
+        continue;
+      }
+      // Horizontal gradient: flame red (left) to coral/orange (right)
+      const ratio = i / len;
+      const r = 255;
+      const g = Math.floor(30 + ratio * 100);
+      const b = Math.floor(60 - ratio * 40);
+      gradientLine += `\x1b[38;2;${r};${g};${b}m${char}`;
     }
     gradientLine += C.reset;
     log(gradientLine);
@@ -421,16 +460,13 @@ function banner() {
   console.log();
   // Subtitle strip
   const W = 84;
-  const sub = "Anti-Hallucination Agent System";
-  const sp = Math.max(0, W - sub.length);
-  const centred =
-    " ".repeat(Math.floor(sp / 2)) + sub + " ".repeat(Math.ceil(sp / 2));
-  const RED_ANSI = "\x1b[38;2;255;22;55m";
-  console.log(`  ${RED_ANSI}╔${"═".repeat(W)}╗${C.reset}`);
-  console.log(
-    `  ${RED_ANSI}║${C.reset}${c("gray", centred)}${RED_ANSI}║${C.reset}`,
-  );
-  console.log(`  ${RED_ANSI}╚${"═".repeat(W)}╝${C.reset}`);
+  const plainSub = '🛡️  ANTI-HALLUCINATION AGENT SYSTEM';
+  const coloredSub = `${bold(c('white', '🛡️  ANTI-HALLUCINATION AGENT SYSTEM'))}`;
+  const sp = Math.max(0, W - plainSub.length);
+  const centred = ' '.repeat(Math.floor(sp / 2)) + coloredSub + ' '.repeat(Math.ceil(sp / 2));
+  log(`  ${c('gray', `✦  ${'━'.repeat(W - 6)}  ✦`)}`);
+  log(`  ${centred}`);
+  log(`  ${c('gray', `✦  ${'━'.repeat(W - 6)}  ✦`)}`);
   console.log();
 }
 
@@ -560,6 +596,7 @@ async function cmdInit(flags) {
     } else {
       // ── Success card — W=62, rows padded by plain-text length ──
       const W = 62;
+      const borderCol = "red";
       const agentsCount = fs.readdirSync(path.join(agentDest, "agents")).length;
       const workflowsCount = fs.readdirSync(
         path.join(agentDest, "workflows"),
@@ -569,23 +606,28 @@ async function cmdInit(flags) {
         path.join(agentDest, "scripts"),
       ).length;
 
-      // Stat rows: compute trailing spaces from plain text so right ║ aligns
-      const statRow = (icon, label, val, col) => {
-        // emoji JS .length===2 == terminal display width 2 ✓
-        const plain = `  ${icon}  ${label.padEnd(10)}${String(val).padStart(3)} installed`;
-        const trail = " ".repeat(Math.max(0, W - plain.length));
-        return `  ${c("cyan", "║")}  ${icon}  ${c("white", label.padEnd(10))}${c(col, String(val).padStart(3))} ${c("gray", "installed")}${trail}${c("cyan", "║")}`;
+      const drawRow = (plainText, styledText) => {
+        const trail = " ".repeat(Math.max(0, W - plainText.length));
+        return `  ${c(borderCol, "│")}${styledText}${trail}${c(borderCol, "│")}`;
       };
-      // Plain-text rows (header / blank)
-      const plainRow = (text, wrapFn) => {
-        const trail = " ".repeat(Math.max(0, W - text.length));
-        return `  ${c("cyan", "║")}${wrapFn(text)}${trail}${c("cyan", "║")}`;
+
+      const compRow = (icon, label, count, color) => {
+        const leftPlain = `    ${icon}  ${label.padEnd(10)} `;
+        const rightPlain = ` [ ${String(count).padStart(3)} ]`;
+        const numDots = W - leftPlain.length - rightPlain.length - 4; // 4 spaces margin
+        const dots = ".".repeat(Math.max(0, numDots));
+
+        const plain = `${leftPlain}${dots}${rightPlain}`;
+        const styled = `    ${icon}  ${c("white", label.padEnd(10))} ${c("gray", dots)} ${c("gray", "[")} ${c(color, String(count).padStart(3))} ${c("gray", "]")}`;
+        return drawRow(plain, styled);
       };
-      // Next-step rows: fixed cmd column + description
+
       const stepRow = (cmd, desc) => {
-        const plain = `  ${cmd.padEnd(16)}${desc}`;
-        const trail = " ".repeat(Math.max(0, W - plain.length));
-        return `  ${c("cyan", "║")}  ${c("white", cmd.padEnd(16))}${c("gray", desc)}${trail}${c("cyan", "║")}`;
+        const leftPlain = `    ${cmd.padEnd(16)}`;
+        const rightPlain = `▸  ${desc}`;
+        const plain = `${leftPlain}${rightPlain}`;
+        const styled = `    ${c("white", cmd.padEnd(16))}${c("gray", "▸")}  ${c("gray", desc)}`;
+        return drawRow(plain, styled);
       };
 
       console.log(
@@ -593,27 +635,25 @@ async function cmdInit(flags) {
       );
       console.log(`  ${c("gray", "  ╰─")} ${c("gray", agentDest)}`);
       console.log();
-      console.log(`  ${c("cyan", "╔" + "═".repeat(W) + "╗")}`);
-      console.log(
-        plainRow(`  What's inside:`, (s) => c("bold", c("white", s))),
-      );
-      console.log(`  ${c("cyan", "╠" + "═".repeat(W) + "╣")}`);
-      console.log(statRow("🤖", "Agents", agentsCount, "magenta"));
-      console.log(statRow("⚡", "Workflows", workflowsCount, "yellow"));
-      console.log(statRow("🧠", "Skills", skillsCount, "blue"));
-      console.log(statRow("🔧", "Scripts", scriptsCount, "green"));
-      console.log(`  ${c("cyan", "╠" + "═".repeat(W) + "╣")}`);
-      console.log(plainRow("", () => ""));
-      console.log(plainRow(`  Next steps:`, (s) => c("gray", s)));
-      console.log(
-        stepRow("/generate", "Generate code with anti-hallucination"),
-      );
+      console.log(`  ${c(borderCol, "┌" + "─".repeat(W) + "┐")}`);
+      console.log(drawRow("  TRIBUNAL ENVIRONMENT SYNCHRONIZED", `${bold(c("white", "  TRIBUNAL ENVIRONMENT SYNCHRONIZED"))}`));
+      console.log(`  ${c(borderCol, "├" + "─".repeat(W) + "┤")}`);
+      console.log(drawRow("  Guarding:  Active & Enforcing", `${c("gray", "  Guarding:")}  ${c("green", "Active & Enforcing")}`));
+      console.log(drawRow("  Manifest:  Verified", `${c("gray", "  Manifest:")}  ${c("cyan", "Verified")}`));
+      console.log(drawRow("", ""));
+      console.log(drawRow("  Installed Components:", bold(c("white", "  Installed Components:"))));
+      console.log(compRow("🤖", "Agents", agentsCount, "magenta"));
+      console.log(compRow("⚡", "Workflows", workflowsCount, "yellow"));
+      console.log(compRow("🧠", "Skills", skillsCount, "blue"));
+      console.log(compRow("🔧", "Scripts", scriptsCount, "green"));
+      console.log(`  ${c(borderCol, "├" + "─".repeat(W) + "┤")}`);
+      console.log(drawRow("", ""));
+      console.log(drawRow("  Next Steps:", c("gray", "  Next Steps:")));
+      console.log(stepRow("/generate", "Generate code with reviews"));
       console.log(stepRow("/review", "Audit existing code for issues"));
-      console.log(
-        stepRow("/tribunal-full", "Run all 16 reviewers in parallel"),
-      );
-      console.log(plainRow("", () => ""));
-      console.log(`  ${c("cyan", "╚" + "═".repeat(W) + "╝")}`);
+      console.log(stepRow("/tribunal-full", "Run all 20 reviewers in parallel"));
+      console.log(drawRow("", ""));
+      console.log(`  ${c(borderCol, "└" + "─".repeat(W) + "┘")}`);
       console.log();
       log(`  ${c("gray", "✦ Updating .gitignore...")}`);
       await updateGitignore(targetDir, dryRun);
@@ -912,6 +952,8 @@ async function cmdLearn(flags) {
   const evoArgs = ["digest"];
   if (flags.dryRun) evoArgs.push("--dry-run");
   if (flags.head) evoArgs.push("--head");
+  if (flags.log) evoArgs.push(`--log=${flags.log}`);
+  if (flags.strategy) evoArgs.push(`--strategy=${flags.strategy}`);
 
   // Phase 1: Skill Evolution
   log(
@@ -1287,6 +1329,8 @@ function cmdHelp() {
   log(opt("--minimal", "Install core agents/skills only (~13 agents)"));
   log(opt("--skip-update-check", "Skip auto-update version check"));
   log(opt("--head", "(learn) Diff against last commit instead of staged"));
+  log(opt("--log <file>", "(learn) Extract signals and evolve from a log/transcript file"));
+  log(opt("--strategy <val>", "(learn) Evolution strategy: balanced, harden, repair-only"));
   console.log();
   log(bold("  Aliases"));
   log(`  ${c("gray", "─".repeat(40))}`);
@@ -1305,6 +1349,8 @@ function cmdHelp() {
   log(ex("tk learn"));
   log(ex("tk learn --dry-run"));
   log(ex("tk learn --head"));
+  log(ex("tk learn --log=run.log"));
+  log(ex("tk learn --log=eslint.log --strategy=harden"));
   log(ex("tk case add"));
   log(ex('tk case search "useEffect"'));
   log(ex("tk case list"));