cipher-security 1.1.0__tar.gz → 1.3.0__tar.gz

{cipher_security-1.1.0 → cipher_security-1.3.0}/.github/workflows/ci.yml

@@ -14,10 +14,10 @@ jobs:
         python-version: ["3.14"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -31,15 +31,15 @@ jobs:
         env:
           PYTHONPATH: src
         run: |
-          pytest tests/ -v --ignore=tests/test_integration.py --tb=short
+          pytest tests/ -v --ignore=tests/test_integration.py --ignore=tests/test_performance.py --ignore=tests/test_gateway.py --tb=short
 
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.14"
 
@@ -54,7 +54,7 @@ jobs:
   knowledge-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Verify knowledge base integrity
         run: |

cipher_security-1.3.0/.github/workflows/release.yml

@@ -0,0 +1,124 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  pypi:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.14"
+
+      - name: Install build tools
+        run: pip install build twine
+
+      - name: Build package
+        run: python -m build
+
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        run: twine upload dist/* --skip-existing
+
+  docker:
+    name: Push Docker image
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/defconxt/cipher:latest
+            ghcr.io/defconxt/cipher:${{ steps.version.outputs.VERSION }}
+
+  vscode:
+    name: Package VS Code extension
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Extract version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+
+      - name: Update extension version
+        working-directory: vscode
+        run: npm version ${{ steps.version.outputs.VERSION }} --no-git-tag-version
+
+      - name: Install dependencies and build
+        working-directory: vscode
+        run: |
+          npm install
+          npm run compile
+
+      - name: Package VSIX
+        working-directory: vscode
+        run: npx @vscode/vsce package --no-dependencies
+
+      - name: Upload VSIX to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: vscode/*.vsix
+
+  github-release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    needs: [pypi, docker, vscode]
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Extract version from tag
+        id: version
+        run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+
+      - name: Extract changelog for version
+        id: changelog
+        run: |
+          # Extract the section for this version from CHANGELOG.md
+          awk '/^## \['"${{ steps.version.outputs.VERSION }}"'\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md > /tmp/release-notes.md
+          echo "NOTES<<EOF" >> $GITHUB_OUTPUT
+          cat /tmp/release-notes.md >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      - name: Create/update GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          name: CIPHER v${{ steps.version.outputs.VERSION }}
+          body: ${{ steps.changelog.outputs.NOTES }}
+          generate_release_notes: false

{cipher_security-1.1.0 → cipher_security-1.3.0}/.gitignore

@@ -6,3 +6,4 @@ config.yaml
 __pycache__/
 .chromadb/
 site/
+dist/

cipher_security-1.3.0/CHANGELOG.md

@@ -0,0 +1,132 @@
+# Changelog
+
+All notable changes to CIPHER are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.3.0] - 2026-03-16
+
+### Added
+
+- **Multi-provider via LiteLLM** — `pip install cipher-security[multi]` enables any LiteLLM-supported model (OpenAI, Gemini, Mistral, Groq, Azure, etc.) via `--backend litellm` or `llm_backend: litellm` in config. Adapter wraps `litellm.completion()` behind Anthropic-compatible interface — no gateway branching needed.
+- **Plugin system** — extend CIPHER with custom skills. CLI: `cipher plugin list/install/remove/info`. Plugins discovered from `~/.config/cipher/plugins/` and Python entry points (`cipher.skills` group). Priority-sorted injection into system prompt. 12 tests.
+- **VS Code extension** — sidebar chat with streaming, right-click code analysis, mode/backend selectors. Subprocess-based (no daemon). Source in `vscode/`.
+- **Web UI** — `cipher web` launches a browser-accessible Textual interface via `textual-serve`. Requires `pip install cipher-security[web]`.
+- **Bash and Zsh shell completions** — `completions/cipher.bash` and `completions/cipher.zsh` alongside existing Fish completions.
+- **Setup wizard LiteLLM support** — `cipher setup` now offers LiteLLM as option 3 with model string, API key, and base URL prompts.
+- Optional dependency extras: `[multi]` (LiteLLM), `[web]` (Textual web), `[all]` (everything)
+
+### Changed
+
+- Architecture diagram updated: three backends (Ollama, Claude, LiteLLM), seven interfaces (CLI, Dashboard, Web, VS Code, Claude Code, Signal Bot, Docker)
+- README rewritten: multi-provider docs, plugin system, VS Code extension, web UI, shell completions, updated test count (485), corrected skill count (9)
+- CI updated to `actions/checkout@v6` and `actions/setup-python@v6` (Node.js 24 migration)
+- VS Code gateway simplified from spawn+fallback to clean `execFile` invocation
+
+### Fixed
+
+- Setup wizard only offered ollama/claude — added litellm as third option
+- Setup step 2 had no litellm config branch — added model, api_key, api_base prompts
+
+## [1.2.0] - 2026-03-16
+
+### Added
+
+- Dynamic version resolution from package metadata
+- Fish shell completions
+- **Context monitor hook** — PostToolUse hook warns at 35%/25% remaining context, engagement-aware messaging
+- **Statusline hook** — model, directory, and context usage bar for Claude Code
+- **`/cipher:update`** — self-update from PyPI with changelog display and confirmation
+- **`/cipher:setup-hooks`** — register hooks in Claude Code, GSD-aware coexistence
+- **Auto-install hooks** during `cipher setup` (detects and coexists with GSD)
+- **Complexity classifier** (`gateway/complexity.py`) — multi-signal heuristic routing: length, domain keywords, query structure, framework density
+- **Engagement persistence** — `.cipher/` directory with `ENGAGEMENT.md` as single source of truth
+- **`/cipher:engage`** — initialize security engagements (pentest, audit, IR, threat-model, assessment)
+- **`/cipher:resume`** — resume engagement with status briefing
+- **`/cipher:export`** — export engagement as formatted security report
+- **8 agent definitions** — cipher-red, cipher-blue, cipher-purple, cipher-incident, cipher-recon, cipher-privacy, cipher-architect, cipher-researcher
+- **Wave-based parallel dispatch** for `/cipher:audit` (4 parallel agents + synthesis)
+- **Wave-based parallel dispatch** for `/cipher:brief` (4 parallel agents + synthesis)
+- All 34 slash commands shipped in `commands/` directory for distribution
+- CHANGELOG.md
+
+### Changed
+
+- Smart routing upgraded from keyword matching to score-based complexity classifier (SIMPLE/MODERATE→Ollama, COMPLEX/EXPERT→Claude)
+- `/cipher:audit` rewritten with 2-wave parallel architecture (4x faster)
+- `/cipher:brief` rewritten with 2-wave parallel architecture (4x faster)
+- README updated with hooks, engagements, and update documentation (35 skills)
+
+## [1.1.0] - 2026-03-16
+
+Version bump only — no functional changes beyond 0.3.0.
+
+## [0.3.0] - 2026-03-16
+
+### Added
+
+- `/cipher:brief` orchestrator mode
+- Knowledge base expansion: tomnomnom recon tooling, abliteration techniques
+- Streaming responses in CLI
+- Signal bot RAG integration
+- Comprehensive test expansion — 10 new test modules (940+ total tests)
+- Config migrations framework with 7 tests
+- CONTRIBUTING.md and GitHub issue templates
+- Asciinema demo and PyPI badge in README
+
+### Changed
+
+- Require Python 3.14+, drop 3.10–3.13 support
+- Update Docker and release workflow to Python 3.14
+- Expand `threat-intel-deep.md` (800 to 2300 lines)
+- Expand `evasion-techniques-deep.md` (801 to 2073 lines)
+- Skip RAG ingestion during setup if index already populated (performance)
+- Update README — 29 skills, Python 3.14+, 940+ tests, new KB content
+
+### Fixed
+
+- Write config to `~/.config/cipher/` instead of pipx venv directory
+- Multi-word queries, graceful config errors, data bundling
+- Strip ANSI codes in CLI tests, skip ingest tests in CI
+- Resolve test failures — import paths, timeouts, and RAG assertions
+- CI test failures — ANSI escape codes and ingest timeouts
+
+## [0.2.0] - 2026-03-15
+
+### Added
+
+- Multi-interface architecture rewrite (CIPHER v2.0)
+- Typer CLI with Rich cyberpunk theme
+- Cyberpunk TUI dashboard (`cipher dashboard`)
+- Onboarding wizard (`cipher setup`)
+- RAG pipeline for knowledge base retrieval (ChromaDB)
+- Auto re-ingest RAG on `knowledge/` file changes
+- RAG retriever tests and GitHub Actions CI
+- ARCHITECT skill file and purple team exercise playbooks
+- Deep knowledge expansion — 7 documents, 18K+ new lines
+- Install scripts and Docker support
+- Release workflow — PyPI and GHCR on version tags
+- Config upgrade — env var substitution and secret redaction
+- Validation test suite — guardrails, RAG quality, mode routing
+- Cyberpunk knowledge base theme for cipher.blacktemple.net
+- Signal bot with E2E fixes, setup subcommand, session manager
+- Gateway orchestrator, LLM client factory, mode detection, prompt assembly
+- AGPL-3.0 license and copyright headers
+
+### Fixed
+
+- Docker build (use pip instead of uv) and PyPI skip-existing
+- Signal-api healthcheck (wget to curl)
+- Host install scripts via GitHub raw URLs
+- CI install all deps including signal extra
+- Resolve ruff lint errors (F401, F841)
+
+[Unreleased]: https://github.com/defconxt/CIPHER/compare/v1.3.0...HEAD
+[1.3.0]: https://github.com/defconxt/CIPHER/compare/v1.2.0...v1.3.0
+[1.2.0]: https://github.com/defconxt/CIPHER/compare/v1.1.0...v1.2.0
+[1.1.0]: https://github.com/defconxt/CIPHER/compare/v0.3.0...v1.1.0
+[0.3.0]: https://github.com/defconxt/CIPHER/compare/v0.2.0...v0.3.0
+[0.2.0]: https://github.com/defconxt/CIPHER/compare/v1.0...v0.2.0

{cipher_security-1.1.0 → cipher_security-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cipher-security
-Version: 1.1.0
+Version: 1.3.0
 Summary: CIPHER — Security Engineering Assistant with RAG-powered knowledge base
 Project-URL: Homepage, https://github.com/defconxt/CIPHER
 Project-URL: Documentation, https://blacktemple.net/cipher
@@ -27,9 +27,15 @@ Requires-Dist: rich>=13.0
 Requires-Dist: textual>=1.0
 Requires-Dist: typer>=0.12
 Provides-Extra: all
+Requires-Dist: litellm>=1.40.0; extra == 'all'
 Requires-Dist: signalbot>=0.25.0; extra == 'all'
+Requires-Dist: textual-serve>=1.1.0; extra == 'all'
+Provides-Extra: multi
+Requires-Dist: litellm>=1.40.0; extra == 'multi'
 Provides-Extra: signal
 Requires-Dist: signalbot>=0.25.0; extra == 'signal'
+Provides-Extra: web
+Requires-Dist: textual-serve>=1.1.0; extra == 'web'
 Description-Content-Type: text/markdown
 
 <!-- Copyright (c) 2026 defconxt. All rights reserved. -->
@@ -55,8 +61,8 @@ Description-Content-Type: text/markdown
 [![Python 3.14+](https://img.shields.io/badge/python-3.14+-00ff41.svg)](https://python.org)
 
 A principal-level security engineering assistant with 96 deep-dive knowledge docs,
-RAG-powered retrieval, 7 operating modes, and 29 specialized skills.
-Runs locally via Ollama or cloud via Claude API.
+RAG-powered retrieval, 7 operating modes, and a plugin system.
+Runs locally via Ollama, cloud via Claude API, or any provider via LiteLLM.
 
 [![Demo](https://asciinema.org/a/0MjCmtsarnsztdQ6.svg)](https://asciinema.org/a/0MjCmtsarnsztdQ6)
 
@@ -86,6 +92,14 @@ pip install cipher-security
 cipher setup
 ```
 
+**With optional extras:**
+```bash
+pip install cipher-security[multi]     # LiteLLM multi-provider support
+pip install cipher-security[web]       # Textual web UI
+pip install cipher-security[signal]    # Signal bot
+pip install cipher-security[all]      # Everything
+```
+
 **Docker:**
 ```bash
 docker run -it ghcr.io/defconxt/cipher "how do I detect Kerberoasting"
@@ -103,9 +117,15 @@ cipher "[MODE: RED] exploit AS-REP roasting in Active Directory"
 # Auto-route: simple queries → local Ollama, complex → Claude API
 cipher --smart "design a zero trust architecture for multi-cloud"
 
+# Use any LiteLLM-supported model
+cipher --backend litellm "analyze this CVE for exploitability"
+
 # Interactive dashboard
 cipher dashboard
 
+# Web UI (requires cipher-security[web])
+cipher web
+
 # System health check
 cipher doctor
 ```
@@ -138,7 +158,50 @@ RAG-powered retrieval over 145K+ lines of security knowledge:
 - **Emerging**: Breach case studies (12 major incidents), AI/ML security, abliteration/alignment attacks, vulnerability research, ransomware ecosystem
 - **Recon**: tomnomnom toolchain (assetfinder, waybackurls, kxss, unfurl), composable pipeline patterns, OSINT tradecraft
 
-### 29 Slash Commands (Claude Code)
+### Multi-Provider Support
+
+Three built-in backends with smart routing:
+
+| Backend | Setup | Use Case |
+|---------|-------|----------|
+| **Ollama** | `cipher setup` → option 1 | Free local inference, privacy-first |
+| **Claude** | `cipher setup` → option 2 | High-quality cloud reasoning |
+| **LiteLLM** | `pip install cipher-security[multi]` | Any provider: OpenAI, Gemini, Mistral, Groq, Azure, etc. |
+
+Smart routing (`--smart`) auto-classifies query complexity and routes between Ollama (simple/moderate) and Claude (complex/expert). LiteLLM is always explicit via `--backend litellm` or `llm_backend: litellm` in config.
+
+### Plugin System
+
+Extend CIPHER with custom skills:
+
+```bash
+cipher plugin list                    # Show installed plugins
+cipher plugin install ./my-plugin     # Install from directory
+cipher plugin remove my-plugin        # Remove a plugin
+cipher plugin info my-plugin          # Show plugin details
+```
+
+Plugins are discovered from `~/.config/cipher/plugins/` and Python entry points (`cipher.skills` group). Each plugin provides a `plugin.yaml` manifest with metadata, a priority (0–100), and optional skill content that's injected into the system prompt.
+
+See [Plugin Development](https://blacktemple.net/cipher/plugins) for the full spec.
+
+### VS Code Extension
+
+Full security assistant inside VS Code:
+
+- **Sidebar chat** — conversational security queries with streaming responses
+- **Right-click analysis** — select code, right-click → "Analyze with CIPHER"
+- **Mode & backend selectors** — switch modes and providers from the UI
+- **No daemon required** — queries go through the `cipher-gw` CLI
+
+Install from `vscode/` directory:
+```bash
+cd vscode && npm install && npm run compile
+# Then "Install from VSIX" in VS Code, or:
+npx @vscode/vsce package && code --install-extension cipher-security-*.vsix
+```
+
+### 34 Slash Commands (Claude Code)
 
 ```
 /cipher:redteam    /cipher:web        /cipher:phishing    /cipher:malware
@@ -148,7 +211,8 @@ RAG-powered retrieval over 145K+ lines of security knowledge:
 /cipher:ir         /cipher:cve        /cipher:threatintel  /cipher:aisec
 /cipher:audit      /cipher:report     /cipher:ics         /cipher:mobile
 /cipher:cc         /cipher:ollama     /cipher:claudeapi   /cipher:smart
-/cipher:brief
+/cipher:brief      /cipher:update     /cipher:setup-hooks
+/cipher:engage     /cipher:resume     /cipher:export
 ```
 
 `/cipher:brief` is the orchestrator — synthesizes a full target briefing from multiple
@@ -159,8 +223,10 @@ and a prioritized action plan. Inspired by [h1-brain](https://github.com/PatrikF
 
 | Interface | Command | Cost |
 |-----------|---------|------|
-| **CLI** | `cipher "query"` | Free (Ollama) or paid (Claude) |
-| **Dashboard** | `cipher dashboard` | Free (Ollama) or paid (Claude) |
+| **CLI** | `cipher "query"` | Free (Ollama) or paid (Claude/LiteLLM) |
+| **Dashboard** | `cipher dashboard` | Free (Ollama) or paid (Claude/LiteLLM) |
+| **Web UI** | `cipher web` | Free (Ollama) or paid (Claude/LiteLLM) |
+| **VS Code** | Extension sidebar | Free (Ollama) or paid (Claude/LiteLLM) |
 | **Claude Code** | `/cipher:cc "query"` | Included with Claude Code |
 | **Signal Bot** | Message the bot | Free (Ollama) or paid (Claude) |
 | **Docker** | `docker run -it cipher "query"` | Free (Ollama) or paid (Claude) |
@@ -173,6 +239,56 @@ Semantic search over the entire knowledge base:
 - Top-5 retrieval injected into system prompt before every query
 - Auto re-ingests on knowledge base changes (git hook)
 
+### Shell Completions
+
+Tab completions for all commands, options, and modes:
+
+```bash
+# Bash — add to ~/.bashrc
+source <(cipher completions bash)
+# or: cp completions/cipher.bash /etc/bash_completion.d/
+
+# Zsh — add to ~/.zshrc
+source <(cipher completions zsh)
+# or: cp completions/cipher.zsh ~/.zsh/completions/_cipher
+
+# Fish
+cp completions/cipher.fish ~/.config/fish/completions/
+```
+
+### Updating
+
+```bash
+# From Claude Code
+/cipher:update
+
+# From CLI
+pip install --upgrade cipher-security
+```
+
+`/cipher:update` checks PyPI for the latest version, shows the changelog, asks for confirmation, and runs the upgrade.
+
+### Claude Code Hooks
+
+CIPHER includes Claude Code hooks that install automatically during `cipher setup`:
+
+- **Statusline** — shows model, directory, and a context usage bar
+- **Context monitor** — warns when context window is running low (35% WARNING, 25% CRITICAL), with engagement-aware messaging when a `.cipher/` engagement is active
+
+Hooks coexist with [GSD](https://github.com/gsd-build/get-shit-done) — if GSD's statusline is already registered, CIPHER keeps it and adds its context monitor alongside. To manually (re)install hooks: `/cipher:setup-hooks`.
+
+### Engagements
+
+Persistent security engagement state across sessions:
+
+```bash
+/cipher:engage              # Start a new engagement (pentest, IR, audit, etc.)
+/cipher:resume              # Resume — shows findings, open questions, next actions
+/cipher:export              # Export engagement as a formatted security report
+```
+
+Engagement state lives in `.cipher/ENGAGEMENT.md` — human-readable, git-trackable, and automatically detected by the context monitor hook.
+
 ## CLI Commands
 
 ```
@@ -180,37 +296,42 @@ cipher "query"              Send a security query (default command)
 cipher --smart "query"      Auto-route: simple→Ollama, complex→Claude
 cipher --backend ollama     Force local inference
 cipher --backend claude     Force cloud inference
+cipher --backend litellm    Use LiteLLM provider (requires [multi] extra)
 cipher setup                Interactive onboarding wizard
 cipher dashboard            Cyberpunk terminal UI
+cipher web                  Web UI via Textual (requires [web] extra)
 cipher doctor               Diagnostics and health checks
 cipher doctor --fix         Auto-repair issues
 cipher status               Show system status
 cipher ingest               Re-index the knowledge base
+cipher plugin list          List installed plugins
+cipher plugin install DIR   Install a plugin
+cipher plugin remove NAME   Remove a plugin
 cipher version              Show version
 ```
 
 ## Architecture
 
 ```
-┌─────────────────────────────────────────────────────┐
-│                    Interfaces                        │
-│  CLI · Dashboard · Claude Code · Signal Bot · Docker │
-└──────────────────────┬──────────────────────────────┘
-                       │
-              ┌────────▼────────┐
-              │    Gateway      │
-              │  Mode Detection │──── 7 modes
-              │  Prompt Assembly│──── 13 skill files
-              │  RAG Retrieval  │──── 14,900 chunks
-              └────────┬────────┘
-                       │
-           ┌───────────┼───────────┐
-           │                       │
-    ┌──────▼──────┐        ┌──────▼──────┐
-    │   Ollama    │        │  Claude API │
-    │  (local)    │        │   (cloud)   │
-    │ qwen2.5:32b │        │ sonnet-4-5  │
-    └─────────────┘        └─────────────┘
+┌──────────────────────────────────────────────────────────────┐
+│                        Interfaces                            │
+│  CLI · Dashboard · Web · VS Code · Claude Code · Signal Bot  │
+└────────────────────────────┬─────────────────────────────────┘
+                             │
+                    ┌────────▼────────┐
+                    │     Gateway     │
+                    │  Mode Detection │──── 7 modes
+                    │  Prompt Assembly│──── 9 skills + plugins
+                    │  RAG Retrieval  │──── 14,900 chunks
+                    └────────┬────────┘
+                             │
+           ┌─────────────────┼─────────────────┐
+           │                 │                  │
+    ┌──────▼──────┐   ┌──────▼──────┐   ┌──────▼──────┐
+    │   Ollama    │   │  Claude API │   │   LiteLLM   │
+    │  (local)    │   │   (cloud)   │   │ (any model) │
+    │ qwen2.5:32b │   │ sonnet-4-5  │   │ gpt-4o, etc │
+    └─────────────┘   └─────────────┘   └─────────────┘
 ```
 
 ## Configuration
@@ -220,7 +341,7 @@ Config file: `config.yaml` (project root) or `~/.config/cipher/config.yaml`
 Supports `${VAR}` and `${VAR:-default}` environment variable substitution:
 
 ```yaml
-llm_backend: ollama
+llm_backend: ollama   # ollama | claude | litellm
 
 ollama:
   base_url: "http://127.0.0.1:11434"
@@ -231,6 +352,12 @@ claude:
   api_key: "${ANTHROPIC_API_KEY}"
   model: "claude-sonnet-4-5-20250929"
   timeout: 120
+
+litellm:
+  model: "openai/gpt-4o"           # Any LiteLLM model string
+  api_key: "${OPENAI_API_KEY}"
+  api_base: ""                      # Optional custom endpoint
+  timeout: 120
 ```
 
 Priority: env vars > project config > home config.
@@ -240,11 +367,11 @@ Priority: env vars > project config > home config.
 ```bash
 git clone https://github.com/defconxt/CIPHER.git && cd CIPHER
 python -m venv .venv && source .venv/bin/activate
-pip install -e ".[signal]"
+pip install -e ".[all]"
 pytest tests/ --ignore=tests/test_integration.py
 ```
 
-**940+ tests** covering gateway, mode routing, RAG quality, architecture guardrails, configuration, CLI commands, streaming, and security scanning.
+**485 tests** covering gateway, mode routing, RAG quality, architecture guardrails, configuration, CLI commands, streaming, plugins, multi-provider, and security scanning.
 
 ## Contributing