@devflow-tools/claude-code-plugin 0.8.9

package/README.md

@@ -0,0 +1,26 @@
+# @devflow-tools/claude-code-plugin
+
+DevFlow plugin for Claude Code — provides developer intelligence platform inside Claude Code.
+
+> **Note:** This package is not published to npm directly. It's bundled within `@devflow-tools/cli` and deployed to `~/.claude/plugins/cache/`.
+
+## What You Get
+
+- **Context Engine** — Search code by natural language. Use `/devflow:context`
+- **Graph Engine** — View architecture layers and dependency graphs. Use `/devflow:graph`
+- **Memory Engine** — Access project conventions and past decisions. Use `/devflow:memory`
+- **Knowledge Engine** — Search official docs for React, Vue, NestJS, and more. Use `/devflow:knowledge`
+- **Workflow Engine** — Run standardized dev workflows. Use `/devflow:workflow`
+- **Domain Plugins** — Specialized expertise for 14 frameworks via `/devflow:react`, `/devflow:vue`, etc.
+
+## Installation
+
+```bash
+# The plugin is installed automatically via devflow init
+npm install -g @devflow-tools/cli
+devflow init
+```
+
+## License
+
+MIT

package/dist/command-registry.json

@@ -0,0 +1,235 @@
+{
+  "version": 1,
+  "commands": {
+    "devflow:context": {
+      "mcpTools": [
+        "get_project_context",
+        "search_symbol"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:graph": {
+      "mcpTools": [
+        "get_dependency_graph"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore"
+      ]
+    },
+    "devflow:knowledge": {
+      "mcpTools": [
+        "get_knowledge"
+      ],
+      "blockedNative": [
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:memory": {
+      "mcpTools": [
+        "get_memory"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore"
+      ]
+    },
+    "devflow:workflow": {
+      "mcpTools": [
+        "run_workflow"
+      ],
+      "blockedNative": []
+    },
+    "devflow:react": {
+      "mcpTools": [
+        "react_diagnose_bug",
+        "react_new_feature",
+        "react_audit_performance",
+        "react_review_hooks",
+        "react_refactor_component",
+        "react_new_component"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:vue": {
+      "mcpTools": [
+        "vue_diagnose_bug",
+        "vue_new_component",
+        "vue_debug_reactivity"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:tailwind": {
+      "mcpTools": [
+        "tailwind_new_component"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:taro": {
+      "mcpTools": [
+        "taro_new_page"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:nest": {
+      "mcpTools": [
+        "nest_new_module",
+        "nest_diagnose_bug"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:graphql": {
+      "mcpTools": [
+        "graphql_new_graphql_type",
+        "graphql_diagnose_bug"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:docker": {
+      "mcpTools": [
+        "docker_dockerize_project"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:performance": {
+      "mcpTools": [
+        "performance_audit_performance"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:nextjs": {
+      "mcpTools": [
+        "nextjs_new_page",
+        "nextjs_diagnose_bug"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    },
+    "devflow:electron": {
+      "mcpTools": [
+        "electron_diagnose_bug"
+      ],
+      "blockedNative": [
+        "grep",
+        "find",
+        "rg",
+        "ag",
+        "Grep",
+        "Glob",
+        "Explore",
+        "WebSearch",
+        "WebFetch"
+      ]
+    }
+  }
+}

package/dist/hooks/post-tool-use.js

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+/**
+ * DevFlow PostToolUse Hook
+ * 1. Records memory event with heuristic error detection
+ * 2. Backfills tool_call_events output (from PreToolUse's last-event-id)
+ */
+
+const http = require('http');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const SERVER_URL = process.env.DEVFLOW_SERVER_URL || 'http://127.0.0.1:13337';
+const API_KEY = process.env.DEVFLOW_API_KEY || 'dev-key-000000';
+const PROJECT_ROOT = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+const SESSION_ID = `session:${PROJECT_ROOT.split('/').pop() || 'default'}`;
+
+function postJSON(urlPath, data) {
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify(data);
+    const url = new URL(urlPath, SERVER_URL);
+    const options = {
+      hostname: url.hostname,
+      port: url.port,
+      path: url.pathname,
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'X-API-Key': API_KEY,
+        'Content-Length': Buffer.byteLength(body),
+      },
+      timeout: 5000,
+    };
+    const req = http.request(options, (res) => {
+      let chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve(Buffer.concat(chunks).toString()));
+    });
+    req.on('error', () => reject(new Error('request failed')));
+    req.write(body);
+    req.end();
+  });
+}
+
+async function main() {
+  const inputJson = process.argv[2];
+  if (!inputJson) {
+    process.exit(0);
+  }
+
+  let data;
+  try {
+    data = JSON.parse(inputJson);
+  } catch {
+    process.exit(0);
+  }
+
+  const toolName = data.tool_name || '';
+  const toolInput = data.tool_input || {};
+  const toolResponse = data.tool_response || {};
+
+  // Extract command from Bash tool input
+  const command = typeof toolInput === 'object' && toolInput.command
+    ? toolInput.command
+    : '';
+
+  // Heuristic error detection from tool_response
+  const responseStr = typeof toolResponse === 'string'
+    ? toolResponse
+    : JSON.stringify(toolResponse);
+  const hasErrorSignal = /error:|traceback|fatal|killed|command not found|ENOENT/i.test(responseStr);
+  const exitCode = hasErrorSignal ? 1 : 0;
+  const stderr = hasErrorSignal ? responseStr.slice(0, 500) : null;
+
+  // 1. Record memory event
+  const evt = {
+    id: `evt_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`,
+    sessionId: SESSION_ID,
+    tool: toolName,
+    command: command || toolName,
+    exitCode,
+    stderr,
+    durationMs: 0,
+    createdAt: Date.now(),
+  };
+
+  try {
+    await postJSON(`/api/memory/events?rootPath=${encodeURIComponent(PROJECT_ROOT)}`, evt);
+  } catch {}
+
+  // 2. Backfill tool_call_events output
+  try {
+    const devflowDir = path.join(os.homedir(), '.devflow');
+    const lastEventFile = path.join(devflowDir, 'last-event-id');
+    const execFile = path.join(devflowDir, 'current-execution-id');
+
+    if (fs.existsSync(lastEventFile) && fs.existsSync(execFile)) {
+      const eventId = fs.readFileSync(lastEventFile, 'utf-8').trim();
+      const execId = fs.readFileSync(execFile, 'utf-8').trim();
+
+      const output = typeof toolResponse === 'string'
+        ? { text: toolResponse.slice(0, 1000) }
+        : toolResponse;
+
+      await postJSON('/api/telemetry/tool-call/output', {
+        eventId,
+        executionId: execId,
+        output,
+      });
+    }
+  } catch {}
+}
+
+main().catch(() => process.exit(0));

package/dist/hooks/pre-tool-use.js

@@ -0,0 +1,2 @@
+import {existsSync,readFileSync,mkdirSync,writeFileSync,unlinkSync,readdirSync}from'fs';import {request}from'http';import {join}from'path';import {homedir}from'os';var k=1e4,M=300*1e3;function g(r,t,e){return new Promise(n=>{try{let o=new URL(r),i=request({hostname:o.hostname,port:o.port||80,path:o.pathname+o.search,method:"POST",headers:{"Content-Type":"application/json","X-API-Key":e,"Content-Length":Buffer.byteLength(t)},timeout:5e3},s=>{s.resume(),n(s.statusCode!=null&&s.statusCode>=200&&s.statusCode<300);});i.on("error",()=>n(!1)),i.on("timeout",()=>{i.destroy(),n(!1);}),i.write(t),i.end();}catch{n(false);}})}var l=class{constructor(t){this.retryScheduled=false;this.apiUrl=t?.apiUrl??process.env.DEVFLOW_API_URL??"http://127.0.0.1:13337",this.apiKey=t?.apiKey??process.env.DEVFLOW_API_KEY??"dev-key-000000",this.cacheDir=t?.cacheDir??join(homedir(),".devflow","telemetry-cache");}async sendEvent(t){let e=this.truncateInput(t.input),n={...t,input:e},o=`${this.apiUrl}/api/telemetry/tool-call`;await g(o,JSON.stringify(n),this.apiKey)||this.cacheEvent({type:"tool_call",payload:n});}async sendExecutionStart(t,e,n){let o={executionId:t,skillName:e,startedAt:n},i=`${this.apiUrl}/api/telemetry/skill-execution/start`;await g(i,JSON.stringify(o),this.apiKey)||this.cacheEvent({type:"execution_start",payload:o});}async flushCache(){if(!existsSync(this.cacheDir))return;let t=readdirSync(this.cacheDir).filter(e=>e.endsWith(".json"));for(let e of t)try{let n=join(this.cacheDir,e),o=readFileSync(n,"utf8"),i=JSON.parse(o),s=i.type==="execution_start"?"/api/telemetry/skill-execution/start":"/api/telemetry/tool-call",a=`${this.apiUrl}${s}`;await g(a,JSON.stringify(i.payload),this.apiKey)&&unlinkSync(n);}catch{}}cacheEvent(t){try{existsSync(this.cacheDir)||mkdirSync(this.cacheDir,{recursive:!0});let e=join(this.cacheDir,`${Date.now()}_${Math.random().toString(36).slice(2,11)}.json`);writeFileSync(e,JSON.stringify(t,null,2)),this.scheduleRetry();}catch{}}scheduleRetry(){this.retryScheduled||(this.retryScheduled=true,setTimeout(()=>{this.retryScheduled=false,this.flushCache().catch(()=>{});},M).unref());}truncateInput(t){let e=JSON.stringify(t);return e.length<=k?t:{_truncated:true,_original_size:e.length,_preview:e.substring(0,k)+"..."}}};var $=1800*1e3;function J(){return process.env.DEVFLOW_STATE_DIR??join(homedir(),".devflow")}var h=class{constructor(t){this.stateDir=J();}detect(){let t=join(this.stateDir,"current-skill.json");if(!existsSync(t))return null;try{let e=readFileSync(t,"utf8"),n=JSON.parse(e);return !n.registeredAt||Date.now()-n.registeredAt>$?(this.endExecution(),null):n}catch{return null}}startExecution(t,e){existsSync(this.stateDir)||mkdirSync(this.stateDir,{recursive:true});let n=this.getCurrentExecutionId();if(n)return n;let o=`exec_${Date.now()}_${Math.random().toString(36).slice(2,11)}`;return writeFileSync(join(this.stateDir,"current-execution-id"),o),writeFileSync(join(this.stateDir,"current-skill.json"),JSON.stringify({name:t,required_mcp_tools:e?.required_mcp_tools??[],registeredAt:Date.now()})),o}getCurrentExecutionId(){let t=join(this.stateDir,"current-execution-id");if(!existsSync(t))return null;try{return readFileSync(t,"utf8").trim()}catch{return null}}endExecution(){let t=join(this.stateDir,"current-skill.json"),e=join(this.stateDir,"current-execution-id");try{existsSync(t)&&unlinkSync(t);}catch{}try{existsSync(e)&&unlinkSync(e);}catch{}}};function p(){return {hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow"}}}function j(r){return {hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:r}}}async function A(r){try{if(!r||r.trim()==="")return p();let t=JSON.parse(r),e=new h;if(t.tool_name==="Skill"){let d=t.tool_input?.skill;if(d&&d.startsWith("devflow:")){let I=e.startExecution(d);new l().sendExecutionStart(I,d,Date.now()).catch(()=>{});}}let n=e.detect(),o=t.tool_name.startsWith("mcp__devflow__"),i=o?t.tool_name.replace("mcp__devflow__",""):void 0,s=n?.required_mcp_tools??[],a=s.length>0,y=a&&!o,m;y?m=j(`Skill "${n?.name||"unknown"}" requires MCP tools. Use one of: ${s.join(", ")}`):m=p();let D=e.getCurrentExecutionId()??`exec_orphan_${Date.now()}`,w=new l,E={eventId:`evt_${Date.now()}_${Math.random().toString(36).slice(2,11)}`,executionId:D,timestamp:Date.now(),toolName:t.tool_name,toolType:o?"mcp":t.tool_name==="Agent"?"subagent":"direct",isMcpTool:o,mcpToolName:i,mcpEnforced:o&&a,mcpFallback:!o&&a,input:t.tool_input,tokensUsed:0,duration:0,blocked:!1};return w.sendEvent(E).then(()=>{try{let f=require('fs'),p=require('path'),o=require('os'),d=p.join(o.homedir(),'.devflow');f.existsSync(d)||f.mkdirSync(d,{recursive:!0});f.writeFileSync(p.join(d,'last-event-id'),E.eventId)}catch{}}).catch(()=>{}),m}catch{return p()}}if(process.argv[1]?.endsWith("pre-tool-use")||process.argv[1]?.endsWith("pre-tool-use.js")){let r="";process.stdin.setEncoding("utf8"),process.stdin.on("data",t=>{r+=t;}),process.stdin.on("end",async()=>{let t=await A(r);console.log(JSON.stringify(t));}),process.stdin.on("error",()=>{console.log(JSON.stringify(p())),process.exit(0);}),setTimeout(()=>{console.log(JSON.stringify(p())),process.exit(0);},4e3).unref();}
+export{A as handlePreToolUse};

package/dist/hooks/stop.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+/**
+ * DevFlow Stop Hook
+ * 1. Completes pending skill execution with REAL aggregated data
+ * 2. Triggers memory extraction for the session
+ * 3. Outputs violation summary
+ */
+
+const http = require('http');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const SERVER_URL = process.env.DEVFLOW_SERVER_URL || 'http://127.0.0.1:13337';
+const API_KEY = process.env.DEVFLOW_API_KEY || 'dev-key-000000';
+const PROJECT_ROOT = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+
+function getJSON(urlPath) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(urlPath, SERVER_URL);
+    http.get(url.toString(), { headers: { 'X-API-Key': API_KEY }, timeout: 5000 }, (res) => {
+      let chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        try { resolve(JSON.parse(Buffer.concat(chunks).toString())); }
+        catch { resolve(null); }
+      });
+    }).on('error', () => resolve(null));
+  });
+}
+
+function postJSON(urlPath, data) {
+  return new Promise((resolve) => {
+    const body = JSON.stringify(data);
+    const url = new URL(urlPath, SERVER_URL);
+    const req = http.request(url.toString(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'X-API-Key': API_KEY, 'Content-Length': Buffer.byteLength(body) },
+      timeout: 5000,
+    }, (res) => { resolve(null); });
+    req.on('error', () => resolve(null));
+    req.write(body);
+    req.end();
+  });
+}
+
+async function main() {
+  const devflowDir = path.join(os.homedir(), '.devflow');
+  const execFile = path.join(devflowDir, 'current-execution-id');
+  const skillFile = path.join(devflowDir, 'current-skill.json');
+
+  // ── 1. Complete pending skill execution with REAL counts ──
+  if (fs.existsSync(execFile)) {
+    const execId = fs.readFileSync(execFile, 'utf-8').trim();
+    if (execId) {
+      try {
+        // Query real event data from the API
+        const result = await getJSON(`/api/telemetry/executions/${execId}/events`);
+        const events = result?.data || [];
+
+        const totalToolCalls = events.length;
+        const mcpToolCalls = events.filter(e => e.isMcpTool).length;
+        const directToolCalls = totalToolCalls - mcpToolCalls;
+        const subagentCount = events.filter(e => e.toolType === 'subagent').length;
+        const totalTokens = events.reduce((sum, e) => sum + (e.tokensUsed || 0), 0);
+
+        const timestamps = events.map(e => e.timestamp).filter(Boolean);
+        const totalDuration = timestamps.length >= 2
+          ? Math.max(...timestamps) - Math.min(...timestamps)
+          : 0;
+
+        const mcpRate = totalToolCalls > 0
+          ? Math.round((mcpToolCalls / totalToolCalls) * 10000) / 100
+          : 0;
+
+        const nowMs = Date.now();
+
+        await postJSON('/api/telemetry/skill-execution/complete', {
+          executionId: execId,
+          finishedAt: nowMs,
+          status: 'completed',
+          summary: {
+            totalToolCalls,
+            mcpToolCalls,
+            directToolCalls,
+            subagentCount,
+            totalTokens,
+            totalDuration,
+            mcpComplianceRate: mcpRate,
+          },
+        });
+      } catch (e) {
+        console.error('[devflow] Stop hook error:', e.message);
+      }
+    }
+    try { fs.unlinkSync(execFile); } catch {}
+    try { fs.unlinkSync(skillFile); } catch {}
+  }
+
+  // ── 2. Trigger memory extraction ──
+  try {
+    await postJSON(`/api/memory/process?rootPath=${encodeURIComponent(PROJECT_ROOT)}`, {});
+  } catch {}
+
+  // ── 3. Violation summary ──
+  try {
+    const sessionId = require('crypto').createHash('sha256').update(PROJECT_ROOT).digest('hex').slice(0, 16);
+    const receiptFile = path.join(os.tmpdir(), '.devflow-receipts', `${sessionId}.json`);
+    if (fs.existsSync(receiptFile)) {
+      const receipt = JSON.parse(fs.readFileSync(receiptFile, 'utf-8'));
+      const bypass = receipt.bypassCount || 0;
+      console.error(`会话违规统计: ${bypass}/3`);
+      try { fs.unlinkSync(receiptFile); } catch {}
+    }
+  } catch {}
+}
+
+main().catch(() => process.exit(0));

package/dist/skills/devflow:context/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: devflow:context
+description: 检索项目上下文 — 自然语言查询相关代码、符号、依赖关系
+required_mcp_tools:
+  - get_project_context
+  - search_symbol
+---
+
+<HARD-GATE>
+收到 devflow:context 时，必须先调用以下 MCP 工具之一：
+get_project_context / search_symbol
+</HARD-GATE>
+
+
+## MANDATORY FIRST STEP - Skill Registration
+
+> **IMPORTANT: Before ANY other action, execute the registration command below. This is NON-NEGOTIABLE.**
+
+```bash
+mkdir -p ~/.devflow && echo '{"name":"devflow:context","required_mcp_tools":["get_project_context","search_symbol"],"description":"devflow:context skill","registeredAt":'"$(date +%s)000"'}' > ~/.devflow/current-skill.json
+```
+
+After registration, you **MUST** use ONLY these MCP tools for all work in this skill:
+- `mcp__devflow__get_project_context`
+- `mcp__devflow__search_symbol`
+
+**Never use direct tools** (Read, Write, Edit, Bash, Grep, etc.) for tasks that can be handled by the MCP tools above.
+
+When the skill execution is complete, clean up:
+```bash
+rm -f ~/.devflow/current-skill.json ~/.devflow/current-execution-id
+```
+
+
+# /devflow:context
+
+## 执行
+
+1. 如果用户的查询包含中文，先将其中的中文关键词翻译为英文代码术语（空格分隔）
+2. 调用 `get_project_context` MCP 工具：
+
+```
+query = 用户的原始查询内容（包含中文）
+expandedTerms = 你翻译的英文关键词（如 "code review audit module"）
+mode = "fast"  (首次调用；如需更深入结果，再改用 "deep")
+```
+
+示例：
+- 用户查询 "代码审核模块的流程" → expandedTerms = "code review audit module workflow pipeline process"
+- 用户查询 "用户登录认证逻辑" → expandedTerms = "user login authentication auth logic service handler"
+- 用户查询 "数据库缓存策略" → expandedTerms = "database db cache memo redis storage strategy"

package/dist/skills/devflow:docker/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: devflow:docker
+description: Docker 专家 — 镜像优化、Compose 编排、安全扫描、多阶段构建
+required_mcp_tools:
+  - docker_dockerize_project
+---
+
+<HARD-GATE>
+收到 devflow:docker 时，必须先调用以下 MCP 工具之一：
+docker_dockerize_project
+</HARD-GATE>
+
+
+## MANDATORY FIRST STEP - Skill Registration
+
+> **IMPORTANT: Before ANY other action, execute the registration command below. This is NON-NEGOTIABLE.**
+
+```bash
+mkdir -p ~/.devflow && echo '{"name":"devflow:docker","required_mcp_tools":["docker_dockerize_project"],"description":"devflow:docker skill","registeredAt":'"$(date +%s)000"'}' > ~/.devflow/current-skill.json
+```
+
+After registration, you **MUST** use ONLY these MCP tools for all work in this skill:
+- `mcp__devflow__docker_dockerize_project`
+
+**Never use direct tools** (Read, Write, Edit, Bash, Grep, etc.) for tasks that can be handled by the MCP tools above.
+
+When the skill execution is complete, clean up:
+```bash
+rm -f ~/.devflow/current-skill.json ~/.devflow/current-execution-id
+```
+
+
+# 🐳 DOCKER
+
+你是一个 Docker 专家。使用多阶段构建优化镜像，遵循安全和性能最佳实践。遇到问题先查官方文档。
+
+## 适用场景
+
+**项目 Docker 化：分析项目 → 多阶段 Dockerfile → Compose → 构建验证**
+
+**镜像优化：体积分析 → 层优化 → 多阶段重构**
+
+**安全扫描：漏洞检测 → 配置审查 → 修复建议**
+
+**多服务 Compose 编排：依赖分析 → 网络设计 → 环境管理**
+
+## 核心规则
+
+- 使用多阶段构建减小镜像体积
+- 基础镜像固定版本标签（不使用 latest）
+- 利用层缓存优化构建顺序
+- 使用非 root 用户运行应用
+- 使用 .dockerignore 排除无用文件
+- 添加 HEALTHCHECK 监控容器健康状态
+- 不在镜像层中写入敏感信息
+- 修复安全问题时先查 Docker 官方文档确认方案
+
+## 当前版本
+
+- docker-docs: 26.0.0 — https://docs.docker.com/reference/
+
+## 工作流
+
+| 场景 | 触发方式 |
+|------|----------|
+| 项目 Docker 化：分析项目 → 多阶段 Dockerfile → Compose → 构建验证 | 调用 MCP 工具 `docker_dockerize_project` |
+| 镜像优化：体积分析 → 层优化 → 多阶段重构 | 调用 MCP 工具 `docker_optimize:image` |
+| 安全扫描：漏洞检测 → 配置审查 → 修复建议 | 调用 MCP 工具 `docker_scan:security` |
+| 多服务 Compose 编排：依赖分析 → 网络设计 → 环境管理 | 调用 MCP 工具 `docker_setup:compose` |

package/dist/skills/devflow:electron/SKILL.md

@@ -0,0 +1,69 @@
+---
+name: devflow:electron
+description: Electron 专家 — IPC 通信、窗口管理、原生模块、自动更新、安全配置
+required_mcp_tools:
+  - electron_diagnose_bug
+---
+
+<HARD-GATE>
+收到 devflow:electron 时，必须先调用以下 MCP 工具之一：
+electron_diagnose_bug
+</HARD-GATE>
+
+
+## MANDATORY FIRST STEP - Skill Registration
+
+> **IMPORTANT: Before ANY other action, execute the registration command below. This is NON-NEGOTIABLE.**
+
+```bash
+mkdir -p ~/.devflow && echo '{"name":"devflow:electron","required_mcp_tools":["electron_diagnose_bug"],"description":"devflow:electron skill","registeredAt":'"$(date +%s)000"'}' > ~/.devflow/current-skill.json
+```
+
+After registration, you **MUST** use ONLY these MCP tools for all work in this skill:
+- `mcp__devflow__electron_diagnose_bug`
+
+**Never use direct tools** (Read, Write, Edit, Bash, Grep, etc.) for tasks that can be handled by the MCP tools above.
+
+When the skill execution is complete, clean up:
+```bash
+rm -f ~/.devflow/current-skill.json ~/.devflow/current-execution-id
+```
+
+
+# ⚛️ ELECTRON
+
+你是一个 Electron 专家。使用 contextBridge + IPC 安全通信模式。严格遵循 Electron 安全最佳实践。
+
+## 适用场景
+
+**新建 IPC 通道：定义 API → Preload 暴露 → 主进程处理**
+
+**安全审计：配置检查 → IPC 暴露面 → CSP → 第三方依赖**
+
+**自动更新配置：electron-updater → 发布渠道 → 更新 UI**
+
+**Electron Bug 诊断：进程分类 → IPC 追踪 → 原生调试**
+
+## 核心规则
+
+- 使用 contextBridge + ipcRenderer/ipcMain 通信
+- 必须启用 contextIsolation，禁用 nodeIntegration
+- 主进程负责系统操作，渲染进程只做 UI
+- Preload 脚本只暴露最小必要的安全 API
+- 使用 electron-updater 实现自动更新
+- 启用 sandbox 和 CSP 安全策略
+- 避免使用 remote 模块（已废弃）
+- 构建使用 electron-builder 并配置代码签名
+
+## 当前版本
+
+- electron-docs: 30.0.0 — https://www.electronjs.org/docs/latest/
+
+## 工作流
+
+| 场景 | 触发方式 |
+|------|----------|
+| 新建 IPC 通道：定义 API → Preload 暴露 → 主进程处理 | 调用 MCP 工具 `electron_new:ipc` |
+| 安全审计：配置检查 → IPC 暴露面 → CSP → 第三方依赖 | 调用 MCP 工具 `electron_audit:security` |
+| 自动更新配置：electron-updater → 发布渠道 → 更新 UI | 调用 MCP 工具 `electron_setup:auto-update` |
+| Electron Bug 诊断：进程分类 → IPC 追踪 → 原生调试 | 调用 MCP 工具 `electron_diagnose_bug` |