@codemieai/code 0.0.45 → 0.0.47

package/dist/agents/plugins/claude/plugin/skills/claude-setup-audit/examples/good-command.md

@@ -0,0 +1,170 @@
+---
+# ✅ GOOD COMMAND EXAMPLE
+# Score: ~19/20 pts (Grade A)
+#
+# ✅ C1.1: Valid frontmatter with name + description
+# ✅ C1.2: argument-hint matches $ARGUMENTS usage
+# ✅ C1.3: Phase-based numbered workflow
+# ✅ C1.4: Usage examples section present
+# ✅ C2.1: Error handling table with failure cases
+# ✅ C2.2: Output format defined
+# ✅ C2.3: Validation gates (confirm before creating)
+# ✅ C2.4: Argument parsing with defaults shown
+#
+# ⚠️ Minor gap: C2.4 — could show more complex argument validation
+name: create-jira-ticket
+description: Create a structured Jira ticket from code context, error analysis, or user description
+argument-hint: "<type> <title> [--priority high|medium|low]"
+---
+
+# Create Jira Ticket
+
+Creates a well-structured Jira ticket in the EPM-CDME project based on code
+context, error analysis, or user description. Follows project template with
+acceptance criteria and technical notes.
+
+## Arguments
+
+| Argument | Values | Default | Description |
+|----------|--------|---------|-------------|
+| `<type>` | `bug`, `story`, `task`, `epic` | required | Ticket type |
+| `<title>` | string | required | Brief ticket title |
+| `--priority` | `high`, `medium`, `low` | `medium` | Priority level |
+
+## Usage
+
+```bash
+/create-jira-ticket bug "Login fails on mobile Safari"
+/create-jira-ticket story "Add dark mode toggle" --priority high
+/create-jira-ticket task "Update API documentation"
+/create-jira-ticket epic "Authentication system refactor"
+```
+
+---
+
+## Phase 1: Parse and Validate Arguments
+
+Parse `$ARGUMENTS`:
+
+1. Extract `<type>` — first token. If missing or invalid:
+   ```
+   Valid types: bug, story, task, epic
+   What type of ticket? [bug/story/task/epic]
+   ```
+
+2. Extract `<title>` — remaining text before flags. If missing:
+   ```
+   What should the ticket title be?
+   ```
+
+3. Extract `--priority` flag. Default: `medium`
+
+4. Validate:
+   - [ ] Type is one of: bug, story, task, epic
+   - [ ] Title is not empty
+   - [ ] Title length ≤ 255 characters (Jira limit)
+
+**Abort if**: `JIRA_TOKEN` env var is not set — print:
+```
+Error: JIRA_TOKEN environment variable is required.
+Set it with: export JIRA_TOKEN=your-token
+```
+
+---
+
+## Phase 2: Gather Context
+
+Collect relevant context based on type:
+
+**For `bug`**:
+- Run `git log --oneline -5` to show recent changes
+- Read any error output or stack traces mentioned by user
+- Identify affected file(s) if mentioned
+
+**For `story`**:
+- Read related files to understand current implementation
+- Note what's missing vs what's needed
+
+**For `task`** or **`epic`**:
+- Review scope from user description
+- Check for related existing tickets if mentioned
+
+---
+
+## Phase 3: Generate Ticket Description
+
+Use the EPM-CDME template:
+
+```markdown
+## Problem Statement
+[Concrete, observable description of the bug or need.
+For bugs: what happens vs what should happen.
+For stories: what capability is missing.]
+
+## Acceptance Criteria
+- [ ] Criterion 1 (testable, pass/fail)
+- [ ] Criterion 2
+- [ ] Criterion 3 (minimum 3 criteria)
+
+## Technical Notes
+[Implementation hints, related files, potential approach, dependencies]
+
+## Priority Justification
+[Why this priority level: high = user-blocking, medium = important, low = nice-to-have]
+```
+
+Checklist before proceeding:
+- [ ] Problem is concrete and observable (not vague)
+- [ ] Acceptance criteria are testable (binary pass/fail)
+- [ ] Technical notes reference actual files or components
+- [ ] Priority matches user impact
+
+---
+
+## Phase 4: Confirm Before Creating
+
+Show the draft ticket for user approval:
+
+```
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Creating Jira Ticket:
+  Project: EPM-CDME
+  Type: [Bug | Story | Task | Epic]
+  Title: [title]
+  Priority: [High | Medium | Low]
+
+Description preview:
+  [first 200 chars of description...]
+
+Create ticket? [y/n/edit]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+- If `n`: Print "Cancelled." Exit cleanly.
+- If `edit`: Re-prompt for which field to change.
+- If `y`: Proceed to Phase 5.
+
+---
+
+## Phase 5: Create and Report
+
+1. POST to Jira API using `JIRA_TOKEN`
+2. On success:
+   ```
+   ✓ Created: EPM-CDME-1234
+     https://jira.example.com/browse/EPM-CDME-1234
+   ```
+3. On failure: see Error Handling
+
+---
+
+## Error Handling
+
+| Error | Action |
+|-------|--------|
+| `JIRA_TOKEN` not set | Print setup instructions. Exit without saving draft. |
+| API 401 Unauthorized | "Invalid token. Check JIRA_TOKEN value." |
+| API 403 Forbidden | "No permission for EPM-CDME project. Contact admin." |
+| API 429 Rate Limited | Wait 30s, retry once. If fails again: save draft. |
+| Network unreachable | Save draft to `./jira-ticket-draft.md`, print path. |
+| Title >255 chars | Truncate to 252 chars, append "...", warn user. |

package/dist/agents/plugins/claude/plugin/skills/claude-setup-audit/examples/good-hooks.json

@@ -0,0 +1,46 @@
+{
+  "_comment": "✅ GOOD HOOKS EXAMPLE — Score: ~18/20 pts (Grade A)",
+  "_notes": {
+    "H1.1": "✅ Valid JSON structure",
+    "H1.2": "✅ All event types are recognized (PreToolUse, PostToolUse)",
+    "H2.1": "✅ No hardcoded credentials — uses env var $AUDIT_WEBHOOK_URL",
+    "H2.2": "✅ Bash scripts use set -e and trap for error handling",
+    "H3.1": "✅ Matchers are scoped to specific tools (Write|Edit, Bash) not .*",
+    "H3.2": "✅ Each hook has a description field explaining its purpose"
+  },
+  "hooks": [
+    {
+      "event": "PreToolUse",
+      "description": "Block direct file writes to main branch — prevents accidental commits to protected branch",
+      "matcher": "Write|Edit",
+      "hooks": [
+        {
+          "type": "command",
+          "command": "bash -c 'set -e; trap \"echo Hook check failed >&2\" ERR; BRANCH=$(git branch --show-current 2>/dev/null || echo \"\"); if [ \"$BRANCH\" = \"main\" ] || [ \"$BRANCH\" = \"master\" ]; then echo \"ERROR: Direct writes to $BRANCH are blocked. Create a feature branch first.\" >&2; exit 1; fi'"
+        }
+      ]
+    },
+    {
+      "event": "PostToolUse",
+      "description": "Run ESLint after TypeScript file modifications to catch issues immediately",
+      "matcher": "Edit|Write",
+      "hooks": [
+        {
+          "type": "command",
+          "command": "bash -c 'set -e; trap \"echo Lint hook failed on line $LINENO >&2\" ERR; FILE=$(echo \"$CLAUDE_TOOL_OUTPUT\" | grep -o \"[^ ]*\\.ts\" | head -1 || true); if [ -n \"$FILE\" ] && [ -f \"$FILE\" ]; then npx eslint \"$FILE\" --max-warnings=0 --quiet 2>&1 | tail -10; fi'"
+        }
+      ]
+    },
+    {
+      "event": "PostToolUse",
+      "description": "Log tool usage for audit trail — posts to team webhook for compliance tracking",
+      "matcher": "Bash",
+      "hooks": [
+        {
+          "type": "command",
+          "command": "bash -c 'set -e; if [ -n \"$AUDIT_WEBHOOK_URL\" ]; then curl -sf -X POST \"$AUDIT_WEBHOOK_URL\" -H \"Content-Type: application/json\" -d \"{\\\"event\\\": \\\"bash_used\\\", \\\"session\\\": \\\"$CLAUDE_SESSION_ID\\\"}\" > /dev/null 2>&1 || true; fi'"
+        }
+      ]
+    }
+  ]
+}

package/dist/agents/plugins/claude/plugin/skills/claude-setup-audit/examples/good-skill.md

@@ -0,0 +1,144 @@
+---
+# ✅ GOOD SKILL EXAMPLE
+# Score: ~30/32 pts (Grade A)
+# What makes it good: See inline comments marked ✅
+#
+# ✅ S1.1: Named SKILL.md in skills/ directory
+# ✅ S1.2: name is [a-z0-9-]+ pattern
+# ✅ S1.3: Description >20 chars, third-person, specific triggers
+# ✅ S1.4: allowed-tools explicitly specified
+# ✅ S2.1: Step-by-step methodology
+# ✅ S2.2: Output format section defined
+# ✅ S2.3: Concrete examples provided
+# ✅ S2.4: Actionable checklists present
+# ✅ S3.1: No absolute paths
+# ✅ S3.2: No secrets
+# ✅ S4.1: Single focused purpose
+# ✅ S4.2: "When to use" section present
+#
+# ⚠️ Minor gap: S3.4 — no dependencies section (would add 1 pt)
+---
+name: commit-helper
+description: This skill should be used when the user asks to "commit my changes",
+  "create a conventional commit", "write a commit message", "stage and commit files",
+  or wants to follow conventional commits format. Guides through staged file review,
+  semantic commit message generation, and commit creation with pre-commit validation.
+allowed-tools: [Read, Bash, Glob]
+version: 1.0.0
+
+---
+
+# Commit Helper
+
+Guides staged commit creation following the Conventional Commits specification.
+Generates semantic commit messages based on diff analysis and confirms before committing.
+
+## When to Use
+
+Use this skill when:
+- User has staged changes and wants a commit message
+- User wants to follow conventional commits format automatically
+- User needs to review staged changes before committing
+- User says "commit", "create a commit", "stage and commit"
+
+Do NOT use this skill for:
+- Pushing to remote (that's a separate action requiring user confirmation)
+- Creating pull requests (use `pr-creator` skill)
+- Branch management operations
+
+## Methodology
+
+### Step 1: Review Staged Changes
+
+1. Run `git status` to list staged and unstaged files
+2. Run `git diff --cached` to review the full staged diff
+3. If no files staged: warn user and exit — do not commit unstaged work
+
+### Step 2: Determine Commit Type
+
+Map changes to conventional commit types:
+
+| Type | When to use |
+|------|-------------|
+| `feat` | New feature or behavior added |
+| `fix` | Bug fix |
+| `refactor` | Code change that neither fixes a bug nor adds feature |
+| `docs` | Documentation only |
+| `test` | Adding or updating tests |
+| `chore` | Build process, tooling, dependencies |
+| `ci` | CI/CD pipeline changes |
+| `perf` | Performance improvement |
+
+### Step 3: Generate Commit Message
+
+Format:
+```
+<type>(<scope>): <description>
+
+[optional body]
+
+[optional footer]
+```
+
+Checklist:
+- [ ] Type is lowercase and from the table above
+- [ ] Scope is the module, component, or area affected
+- [ ] Description is imperative mood ("add" not "added"), lowercase, <72 chars, no period
+- [ ] Body explains WHY (not WHAT — the diff shows WHAT)
+- [ ] Breaking changes use `feat!:` or `fix!:` and include `BREAKING CHANGE:` footer
+
+### Step 4: Confirm and Commit
+
+Show the proposed commit for user approval:
+```
+Staged files:
+  modified: src/auth/login.ts
+  modified: src/auth/token.ts
+
+Proposed commit:
+  fix(auth): refresh OAuth token before expiry on 401 response
+
+  Tokens were silently expiring mid-session causing user logout.
+  Refresh is now triggered proactively when token age > 80% of TTL.
+
+Commit? [y/n/edit]
+```
+
+- [ ] User confirmed `y` before running `git commit`
+- [ ] If user says `edit`: re-prompt for message
+- [ ] Never use `--no-verify` unless user explicitly requests it
+
+## Output Format
+
+```
+Staged: [list of files]
+
+Proposed message:
+  [type(scope): description]
+
+  [body if needed]
+
+✓ Committed: [hash] [message]
+```
+
+## Error Handling
+
+| Situation | Action |
+|-----------|--------|
+| No staged files | Print: "No staged files. Use `git add` first." Exit. |
+| User cancels | Print: "Commit cancelled." Exit cleanly. |
+| Pre-commit hook fails | Print hook output, do NOT retry, suggest fixing the issue |
+| `git commit` fails | Show error message, do not suppress it |
+
+## Examples
+
+```bash
+# User: "commit my changes"
+→ Run git status + diff, generate message, show for confirmation
+
+# User: "commit the auth fix as a hotfix"
+→ Use type=fix, analyze staged auth files, generate message
+
+# User: "commit with message 'update readme'"
+→ Use user's message, format to conventional commits if needed
+```

package/dist/agents/plugins/claude/plugin/skills/claude-setup-audit/examples/sample-report.md

@@ -0,0 +1,223 @@
+# Claude Setup Audit Report
+
+**Project**: `/Users/developer/my-app`
+**Date**: 2026-03-02
+**Assessed by**: claude-setup-audit v1.0.0
+
+---
+
+## Overall Score: 71% (Grade C)
+
+> ⚠️ **3 of 8 components are below the production threshold (80% / Grade B)**
+
+| Component | Files | Avg Score | Grade | Production Ready |
+|-----------|-------|-----------|-------|-----------------|
+| Skills | 3 | 84% | B | 2/3 (67%) ✅ |
+| Agents | 2 | 58% | F | 0/2 (0%) ❌ |
+| CLAUDE.md | 1 | 73% | C | 0/1 ⚠️ |
+| Commands | 2 | 90% | A | 2/2 (100%) ✅ |
+| Hooks | 1 | 65% | D | 0/1 ❌ |
+| MCP Config | 1 | 85% | B | 1/1 (100%) ✅ |
+
+---
+
+## Issues by Priority
+
+### 🔴 Critical (Fix Before Production)
+
+**1. Hardcoded API key in `.claude/settings.json`** (Hook: `audit-logger`)
+- **Issue**: Literal API key `sk-prod-abc123` found in hook command string
+- **Risk**: Credential exposed in version control if file is committed
+- **Fix**: Replace with env var reference: `$AUDIT_API_KEY`
+- **Reference**: See `examples/bad-hooks.json` line 12 → `examples/good-hooks.json` line 18
+
+**2. Agent `analyzer.md` — Grade F (47%)**
+- **Issue**: No model specified, no role statement, no output format, Bash unjustified
+- **Risk**: Unpredictable behavior and cost; Bash access without constraints
+- **Fix**: Add frontmatter `model: claude-sonnet-4-6`; add "You are..." role; justify Bash
+- **Reference**: See `examples/bad-agent.md` → `examples/good-agent.md`
+
+---
+
+### 🟡 Important (Fix Soon)
+
+**3. Agent `summarizer.md` — Grade D (63%)**
+- Missing: model (−3 pts), anti-hallucination section (−2 pts), 3+ examples (−1 pt)
+- **Quick fix**: Add 3 lines to frontmatter + one "Source Verification" section
+
+**4. CLAUDE.md — Grade C (73%)**
+- Missing: quick-reference task classifier table (−2 pts), ✅/❌ pattern examples (−2 pts)
+- Has: coding standards, workflow policies, critical rules ✓
+- **Fix**: Add a "Task Classifier" table and one before/after code example per major rule
+
+**5. Hook `audit-logger` — Grade D (65%)** *(aside from the Critical security issue above)*
+- Matcher is `.*` (runs on every tool use) — should target `Bash` only
+- No `description` field on the hook object
+- No error handling in bash script (`set -e` missing)
+
+---
+
+### 🔵 Minor (Polish)
+
+**6. Skill `data-processor` — Grade B (81%)**
+- Missing: actionable checklists `- [ ]` (−2 pts)
+- Easy win: add 3 checkbox items to the workflow section
+
+**7. Naming inconsistency**
+- Agent file `Summarizer.md` uses PascalCase — rename to `summarizer.md`
+- Skill `data_processor/` uses underscore — rename to `data-processor/`
+
+---
+
+## Per-Component Details
+
+<details>
+<summary>Skills — 3 files, avg 84%, Grade B</summary>
+
+| File | Score | Grade | Top Issues |
+|------|-------|-------|------------|
+| `.claude/skills/commit-helper/SKILL.md` | 94% | A | None |
+| `.claude/skills/data-processor/SKILL.md` | 81% | B | Missing checklists (-2 pts) |
+| `.claude/skills/deploy-helper/SKILL.md` | 78% | C | No "When to use" triggers (-2), no output format (-2) |
+
+**deploy-helper gaps**:
+```
+❌ S4.2: No "When to use" section
+   → Add: "## When to Use / Do NOT use this for..."
+   → See: examples/good-skill.md line 14–22
+
+❌ S2.2: Output format not defined
+   → Add: "## Output Format" section
+```
+</details>
+
+<details>
+<summary>Agents — 2 files, avg 58%, Grade F</summary>
+
+| File | Score | Grade | Top Issues |
+|------|-------|-------|------------|
+| `.claude/agents/analyzer.md` | 47% | F | No model, no role, Bash unjustified, no examples |
+| `.claude/agents/summarizer.md` | 69% | D | No model, no anti-hallucination, weak examples |
+
+**analyzer.md failed criteria**:
+```
+❌ A1.3: No model specified (−3 pts)
+   → Add to frontmatter: model: claude-sonnet-4-6
+
+❌ A2.1: No role statement (−2 pts)
+   → Add: "You are a data analyst specializing in..."
+
+❌ A1.4: Bash in tools without justification (−3 pts)
+   → Add comment: # Bash required for: running analysis scripts
+
+❌ A2.4: No anti-hallucination measures (−2 pts)
+   → Add "## Source Verification" section
+   → See: examples/good-agent.md line 47–51
+
+❌ A3.1: Only 1 example (needs ≥3) (−1 pt)
+```
+</details>
+
+<details>
+<summary>CLAUDE.md — 73%, Grade C</summary>
+
+**Passing criteria** (19/30 pts):
+- ✅ R1.1: Coding standards section present
+- ✅ R1.2: Git workflow policy documented
+- ✅ R1.3: MANDATORY/NEVER directives present
+- ✅ R2.1: Instructions are actionable
+- ✅ R2.3: Prohibitions stated
+
+**Failing criteria** (−8 pts):
+```
+❌ R2.2: No trigger conditions on rules (−3 pts)
+   → Rules say "NEVER use --no-verify" but don't say when this applies
+   → Add: "When user says 'commit': NEVER use --no-verify"
+   → See: examples/good-claude-md-snippet.md line 18–22
+
+❌ R3.2: No quick-reference table (−2 pts)
+   → Add a "Task Classifier" table mapping keywords to policies
+   → See: examples/good-claude-md-snippet.md line 9–15
+
+❌ R3.3: No ✅/❌ pattern examples (−2 pts)
+   → Add one before/after code block for TypeScript imports or git commits
+   → See: examples/good-claude-md-snippet.md line 32–40
+
+❌ R4.2: Technology versions not mentioned (−1 pt)
+   → Add: "Node.js >=20.0.0 required"
+```
+</details>
+
+<details>
+<summary>Commands — 2 files, avg 90%, Grade A</summary>
+
+| File | Score | Grade | Notes |
+|------|-------|-------|-------|
+| `.claude/commands/create-ticket.md` | 95% | A | Excellent |
+| `.claude/commands/summarize-pr.md` | 85% | B | Missing validation gates |
+
+</details>
+
+<details>
+<summary>Hooks — 65%, Grade D (+ Critical security issue)</summary>
+
+See Critical issue #1 above. Additional failures:
+- H3.1: `.*` matcher runs on all tools (should be `Bash` only)
+- H3.2: No `description` field on hook
+- H2.2: No `set -e` in bash command
+</details>
+
+<details>
+<summary>MCP Config — 85%, Grade B</summary>
+
+**Passing**: Valid JSON, `mcpServers` structure, env var references, descriptive names.
+
+**Gaps**:
+```
+⚠️ M3.2: Required env vars not documented in README (−3 pts)
+   → Add a ## MCP Configuration section to README.md listing:
+     - JIRA_TOKEN: your Jira API token (Settings > Personal Access Tokens)
+     - GITHUB_TOKEN: GitHub PAT with repo scope
+```
+</details>
+
+---
+
+## Cross-Component Analysis
+
+### Coverage Gaps
+- ✅ CLAUDE.md present (agents exist)
+- ⚠️ `analyzer.md` references `parse-data` skill — but `.claude/skills/parse-data/` not found
+- ✅ Commands have corresponding agents
+
+### Naming Consistency Issues
+- `Summarizer.md` → rename to `summarizer.md`
+- `data_processor/` → rename to `data-processor/`
+
+### Duplication Check
+- `analyzer.md` and `summarizer.md` descriptions have 52% Jaccard overlap — consider merging or differentiating scope
+
+### Security Sweep
+```
+⚠️ .claude/settings.json: sk-prod-abc123  [line 14]
+```
+
+---
+
+## Recommended Action Plan
+
+**Week 1 (Critical)**:
+1. Remove hardcoded key from `settings.json` → use `$AUDIT_API_KEY`
+2. Fix `analyzer.md`: add model, role statement, Bash justification
+
+**Week 2 (Important)**:
+3. Fix `summarizer.md`: model + anti-hallucination + examples
+4. Improve CLAUDE.md: add task classifier table + pattern examples
+5. Fix hook matcher from `.*` to `Bash`
+
+**Week 3 (Polish)**:
+6. Add checklists to `data-processor` skill
+7. Fix file naming: PascalCase and underscore → kebab-case
+8. Document required MCP env vars in README
+
+**Re-run after fixes**: Target overall score ≥85% (Grade B).