From 24c584ee50d86a0e83857d2969ad02ce127b7a33 Mon Sep 17 00:00:00 2001 From: Parfii-bot Date: Wed, 22 Apr 2026 14:11:22 +0800 Subject: [PATCH] fix: remove genesis-scan from public kit (internal tool, Bundle-only) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Per user decision: publishing the sensitive IP pattern blocklist via public scanner is leak of the blocklist itself (attack surface). genesis-scan remains in PROJECT-E (private); user-global ~/.claude/hooks/genesis-leak-guard.sh (runtime hook) separate. Deleted: - _primitives/_rust/genesis-scan/ (whole crate, 5 files) - hooks/git-pre-commit-genesis.sh (scanner companion) Modified: - workspace Cargo.toml -1 member (24→23) - MANIFEST.toml — removed [primitive.genesis-scan] + core/full profile refs - .github/workflows/ci.yml — removed genesis-scan job - README.md — 7 count/description edits (24→23 rust, 10→9 hooks, 37→36 full) - install.sh — 5 edits (--help + menus) - mcp-server tool-registry.ts + test — scanner removed from MCP surface - kei-sleep-queue.sh — removed scan_prompt() pre-submit hook - 2 sleep-on-it skill phases — removed genesis-scan references Tests: 160 Rust (was 167, -7 genesis-scan tests as expected), 24 assembler unchanged. --- .github/workflows/ci.yml | 11 -- README.md | 20 +- _primitives/MANIFEST.toml | 10 +- _primitives/_rust/Cargo.lock | 13 -- _primitives/_rust/Cargo.toml | 1 - _primitives/_rust/genesis-scan/Cargo.toml | 20 -- _primitives/_rust/genesis-scan/src/main.rs | 100 ---------- .../_rust/genesis-scan/src/patterns.rs | 91 --------- _primitives/_rust/genesis-scan/src/report.rs | 67 ------- _primitives/_rust/genesis-scan/src/scanner.rs | 179 ------------------ .../_rust/genesis-scan/tests/integration.rs | 155 --------------- _primitives/kei-sleep-queue.sh | 13 -- .../templates/sleep-incubation-prompt.md | 14 +- .../packages/mcp-server/src/tool-registry.ts | 1 - .../mcp-server/test/server-handshake.test.ts | 4 +- hooks/git-pre-commit-genesis.sh | 50 ----- install.sh | 16 +- skills/sleep-on-it/SKILL.md | 9 +- skills/sleep-on-it/phase-5-submit.md | 7 - 19 files changed, 28 insertions(+), 753 deletions(-) delete mode 100644 _primitives/_rust/genesis-scan/Cargo.toml delete mode 100644 _primitives/_rust/genesis-scan/src/main.rs delete mode 100644 _primitives/_rust/genesis-scan/src/patterns.rs delete mode 100644 _primitives/_rust/genesis-scan/src/report.rs delete mode 100644 _primitives/_rust/genesis-scan/src/scanner.rs delete mode 100644 _primitives/_rust/genesis-scan/tests/integration.rs delete mode 100755 hooks/git-pre-commit-genesis.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 817e17f..92b4bfe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -74,14 +74,3 @@ jobs: - name: shellcheck (advisory) run: find hooks _primitives -name '*.sh' -exec shellcheck -S warning {} + continue-on-error: true # warnings are advisory initially - - genesis-scan: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - uses: dtolnay/rust-toolchain@stable - - uses: Swatinem/rust-cache@v2 - with: - workspaces: _primitives/_rust - - run: cd _primitives/_rust && cargo build --release -p genesis-scan - - run: ./_primitives/_rust/target/release/genesis-scan --path . --format=human --exit-on-hit diff --git a/README.md b/README.md index a6fa317..54b63d8 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ Thanks. ## What it is -KeiSeiKit is a comprehensive drop-in toolkit for [Claude Code](https://claude.com/claude-code). It ships a curated set of composable behavioral blocks, a Rust assembler that builds agent `.md` files from TOML manifests deterministically, 10 pre-wired PreToolUse/PostToolUse hooks (three of them dedicated to RULE 0.14 session self-audit), 38 portable skills (including an interactive `/new-agent` wizard, 10 hub-and-spoke pipelines, and the `/self-audit` retrospective skill), **24 Rust primitive crates**, 13 opt-in shell primitives (plus 3 always-copied sleep-sync helpers), and 11 cross-tool bridge templates. Everything follows a Constructor Pattern: one file per concern, manifests as single source of truth, and the generated agent files are regenerated on every relevant edit. +KeiSeiKit is a comprehensive drop-in toolkit for [Claude Code](https://claude.com/claude-code). It ships a curated set of composable behavioral blocks, a Rust assembler that builds agent `.md` files from TOML manifests deterministically, 9 pre-wired PreToolUse/PostToolUse hooks (three of them dedicated to RULE 0.14 session self-audit), 38 portable skills (including an interactive `/new-agent` wizard, 10 hub-and-spoke pipelines, and the `/self-audit` retrospective skill), **23 Rust primitive crates**, 13 opt-in shell primitives (plus 3 always-copied sleep-sync helpers), and 11 cross-tool bridge templates. Everything follows a Constructor Pattern: one file per concern, manifests as single source of truth, and the generated agent files are regenerated on every relevant edit. The kit is MIT-licensed and fully generic — install it on a fresh machine and you get a sane 12-agent fleet (implementers, critics, researchers, cost-guardians, and more — all namespaced under `kei-*` so they won't collide with your own same-named agents), a wizard for spinning up new project specialists, 10 pipeline skills that combine primitives end-to-end (`/compose-solution`, `/site-create`, `/schema-design`, `/observability-setup`, `/auth-setup`, `/api-design`, `/ci-scaffold`, `/test-matrix`, `/docs-scaffold`, `/new-project`, `/vm-provision`), and a build pipeline that keeps every agent derivable from its manifest. @@ -87,11 +87,11 @@ By default `./install.sh` is **minimal** — agents + hooks + skills + bridges, | Profile | Primitives added | Install time | Disk (approx) | |---|---|---|---| | `minimal` (default) | none | ~5s | ~2 MB | -| `core` | `tomd` | ~5s | ~3 MB | +| `core` | `tomd` | ~5s | ~2 MB | | `frontend` | 8 site tools: `mock-render`, `visual-diff`, `tokens-sync`, `design-scrape`, `live-preview`, `figma-tokens`, `frontend-inspect`, `screenshot-decode` | ~60s | ~80 MB | | `ops` | 8 infra tools: `kei-ledger`, `ssh-check`, `firewall-diff`, `provision-hetzner`, `provision-vultr`, `harden-base`, `metrics-scrape`, `log-ship` | ~90s | ~50 MB | | `dev` | 4 dev tools: `kei-migrate`, `kei-changelog`, `kei-ci-lint`, `kei-docs-scaffold` | ~60s | ~40 MB | -| `full` | everything (37 primitives) | ~5 min | ~200 MB | +| `full` | everything (36 primitives) | ~5 min | ~200 MB | Examples: @@ -108,7 +108,7 @@ Examples: Profile resolution lives in `_primitives/MANIFEST.toml` — one `[primitive.]` entry per primitive plus a `[profile]` block. Edit the manifest to define new profiles without touching `install.sh`. -> **Migrating from a full install:** if you're re-running `install.sh` after an earlier version that installed all primitives unconditionally, the new default (`minimal`) will REMOVE them. To preserve the old behaviour explicitly, pass `--profile=full` (currently 37 primitives). +> **Migrating from a full install:** if you're re-running `install.sh` after an earlier version that installed all primitives unconditionally, the new default (`minimal`) will REMOVE them. To preserve the old behaviour explicitly, pass `--profile=full` (currently 36 primitives). > **Re-install disclaimer:** `install.sh` is idempotent for clean state but **overwrites kit-owned `_blocks/`, `_primitives/`, `_bridges/`, `_templates/`, `_assembler/`, `hooks/`, and `skills/` on re-run** — local modifications under those directories are backed up to `.bak-TIMESTAMP/` (or, for shared hook files, to `.bak-TIMESTAMP`). User-owned `_manifests/*.toml` are never overwritten. @@ -118,9 +118,9 @@ Profile resolution lives in `_primitives/MANIFEST.toml` — one `[primitive..md`, linked from the next morning's REM report. Biological analog: the REM-sleep "sleep on it" effect (Wagner et al. 2004, *Nature*). Queue mutations go through the `kei-sleep-queue` helper, which runs `genesis-scan` on submit as a second line of defense against patent-sensitive prompts leaking to the cloud agent. +Results in `sync-repo/sleep-results/.md`, linked from the next morning's REM report. Biological analog: the REM-sleep "sleep on it" effect (Wagner et al. 2004, *Nature*). Queue mutations go through the `kei-sleep-queue` helper. ### Deep-sleep NREM consolidation (v0.13.0) @@ -254,7 +254,7 @@ Requires the new `kei-conflict-scan`, `kei-refactor-engine`, `kei-graph-check`, ## Primitives (Rust) -`_primitives/_rust/` is a Cargo workspace with 24 single-binary crates (v0.13.0 added 4 deep-sleep primitives; v0.14.0 added 10 LBM-port MCP crates). `install.sh` builds `--release` for the subset selected by the active profile and drops binaries at `~/.claude/agents/_primitives/_rust/target/release/`. +`_primitives/_rust/` is a Cargo workspace with 23 single-binary crates (v0.13.0 added 4 deep-sleep primitives; v0.14.0 added 10 LBM-port MCP crates; v0.14.2 removed `genesis-scan` — internal-only tool, not shipped publicly). `install.sh` builds `--release` for the subset selected by the active profile and drops binaries at `~/.claude/agents/_primitives/_rust/target/release/`. | Crate | Purpose | |---|---| @@ -267,7 +267,6 @@ Requires the new `kei-conflict-scan`, `kei-refactor-engine`, `kei-graph-check`, | `visual-diff` | Pixel diff with tolerance — used in `/site-create` screenshot-regression loop | | `tokens-sync` | Design tokens JSON → Tailwind config extend + CSS variables under `:root` | | `kei-memory` | Session retrospective + recurring pattern detector; offline-first analyzer powering RULE 0.14 self-audit | -| `genesis-scan` | Patent-IP leak scanner (term blacklist + exempt-path rules; CI / pre-commit gate) | | `kei-conflict-scan` | v0.13.0 — deep-sleep conflict scanner across rules/hooks/blocks/orphans/CP violations | | `kei-refactor-engine` | v0.13.0 — consumes `kei-conflict-scan` JSON; emits plan markdown + auto-resolve review markdown (NOT a unified diff; v0.14.1 retraction) | | `kei-graph-check` | v0.13.0 — post-refactor wikilink + handoff + block-ref resolver gate | @@ -306,7 +305,7 @@ Requires the new `kei-conflict-scan`, `kei-refactor-engine`, `kei-graph-check`, Block edit (_blocks/.md) <-- triggers rebuild of ALL agents ``` -10 hooks enforce the pipeline (6 pipeline + 3 session-audit + 1 genesis-pre-commit): +9 hooks enforce the pipeline (6 pipeline + 3 session-audit): - **`assemble-agents`** (PostToolUse, Write/Edit) — rebuilds the affected agent(s) whenever a manifest or a block changes. No manual rebuild needed. - **`assemble-validate`** (PreToolUse, Bash) — blocks `git commit` inside `~/.claude` if any manifest fails validation. Keeps the repo in a buildable state at all times. @@ -317,7 +316,6 @@ Requires the new `kei-conflict-scan`, `kei-refactor-engine`, `kei-graph-check`, - **`session-end-dump`** (Stop event) — RULE 0.14 self-audit: archives the session JSONL trace and ingests it into `kei-memory`. - **`milestone-commit-hook`** (PostToolUse, Bash) — RULE 0.14 self-audit: appends a one-line session summary to `~/.claude/memory/audit-backlog.md` on every `feat:`/`refactor:`/merge commit. - **`error-spike-detector`** (PostToolUse, any tool) — RULE 0.14 self-audit: tags + logs the pattern when 3+ errors occur within the last 20 tool calls. -- **`git-pre-commit-genesis`** (PreToolUse, Bash) — runs `genesis-scan` on staged files to block patent-IP leaks before commit. ## Adding custom blocks diff --git a/_primitives/MANIFEST.toml b/_primitives/MANIFEST.toml index 71e3a55..c4335d9 100644 --- a/_primitives/MANIFEST.toml +++ b/_primitives/MANIFEST.toml @@ -17,12 +17,12 @@ [profile] minimal = [] -core = ["tomd", "genesis-scan"] +core = ["tomd"] frontend = ["mock-render", "visual-diff", "tokens-sync", "design-scrape", "live-preview", "figma-tokens", "frontend-inspect", "screenshot-decode"] ops = ["kei-ledger", "ssh-check", "firewall-diff", "provision-hetzner", "provision-vultr", "harden-base", "metrics-scrape", "log-ship"] dev = ["kei-migrate", "kei-changelog", "kei-ci-lint", "kei-docs-scaffold", "kei-memory", "kei-conflict-scan", "kei-refactor-engine", "kei-graph-check", "kei-store"] mcp = ["kei-router", "kei-sage", "kei-task", "kei-chat-store", "kei-crossdomain", "kei-search-core", "kei-content-store", "kei-social-store", "kei-curator", "kei-auth"] -full = ["tomd", "genesis-scan", "kei-ledger", "kei-migrate", "kei-changelog", "ssh-check", "firewall-diff", "mock-render", "visual-diff", "tokens-sync", "design-scrape", "live-preview", "figma-tokens", "frontend-inspect", "screenshot-decode", "provision-hetzner", "provision-vultr", "harden-base", "metrics-scrape", "log-ship", "kei-ci-lint", "kei-docs-scaffold", "kei-memory", "kei-conflict-scan", "kei-refactor-engine", "kei-graph-check", "kei-store", "kei-router", "kei-sage", "kei-task", "kei-chat-store", "kei-crossdomain", "kei-search-core", "kei-content-store", "kei-social-store", "kei-curator", "kei-auth"] +full = ["tomd", "kei-ledger", "kei-migrate", "kei-changelog", "ssh-check", "firewall-diff", "mock-render", "visual-diff", "tokens-sync", "design-scrape", "live-preview", "figma-tokens", "frontend-inspect", "screenshot-decode", "provision-hetzner", "provision-vultr", "harden-base", "metrics-scrape", "log-ship", "kei-ci-lint", "kei-docs-scaffold", "kei-memory", "kei-conflict-scan", "kei-refactor-engine", "kei-graph-check", "kei-store", "kei-router", "kei-sage", "kei-task", "kei-chat-store", "kei-crossdomain", "kei-search-core", "kei-content-store", "kei-social-store", "kei-curator", "kei-auth"] # --- shell primitives (13) ------------------------------------------------- @@ -160,12 +160,6 @@ crate = "kei-memory" deps = ["rusqlite bundled (no system sqlite required)"] desc = "Session retrospective + recurring pattern detector (offline-first, RULE 0.14)" -[primitive.genesis-scan] -kind = "rust" -crate = "genesis-scan" -deps = [] -desc = "Patent-IP leak scanner (Genesis-term blacklist, CI pre-commit gate)" - [primitive.kei-conflict-scan] kind = "rust" crate = "kei-conflict-scan" diff --git a/_primitives/_rust/Cargo.lock b/_primitives/_rust/Cargo.lock index 1d84aa8..f98df77 100644 --- a/_primitives/_rust/Cargo.lock +++ b/_primitives/_rust/Cargo.lock @@ -584,19 +584,6 @@ dependencies = [ "version_check", ] -[[package]] -name = "genesis-scan" -version = "0.1.0" -dependencies = [ - "anyhow", - "clap", - "regex", - "serde", - "serde_json", - "tempfile", - "walkdir", -] - [[package]] name = "getrandom" version = "0.2.17" diff --git a/_primitives/_rust/Cargo.toml b/_primitives/_rust/Cargo.toml index 36e041c..6424877 100644 --- a/_primitives/_rust/Cargo.toml +++ b/_primitives/_rust/Cargo.toml @@ -10,7 +10,6 @@ members = [ "visual-diff", "tokens-sync", "kei-memory", - "genesis-scan", "kei-conflict-scan", "kei-refactor-engine", "kei-graph-check", diff --git a/_primitives/_rust/genesis-scan/Cargo.toml b/_primitives/_rust/genesis-scan/Cargo.toml deleted file mode 100644 index 5bcca33..0000000 --- a/_primitives/_rust/genesis-scan/Cargo.toml +++ /dev/null @@ -1,20 +0,0 @@ -[package] -name = "genesis-scan" -version = "0.1.0" -edition.workspace = true -rust-version.workspace = true - -[[bin]] -name = "genesis-scan" -path = "src/main.rs" - -[dependencies] -clap = { workspace = true } -serde = { workspace = true } -serde_json = { workspace = true } -regex = "1" -walkdir = "2" -anyhow = "1" - -[dev-dependencies] -tempfile = "3" diff --git a/_primitives/_rust/genesis-scan/src/main.rs b/_primitives/_rust/genesis-scan/src/main.rs deleted file mode 100644 index 378f7ed..0000000 --- a/_primitives/_rust/genesis-scan/src/main.rs +++ /dev/null @@ -1,100 +0,0 @@ -//! genesis-scan — patent-IP leak scanner. -//! -//! Complements the runtime Claude-Code hook (`~/.claude/hooks/genesis-leak-guard.sh`) -//! by providing a binary suitable for `git` pre-commit hooks and CI pipelines. -//! -//! USAGE -//! genesis-scan --path walk a tree -//! genesis-scan --path single file -//! genesis-scan --staged scan `git diff --cached` -//! genesis-scan --stdin --file