@evo-dev/evodev 0.0.1-alpha

package/dist/.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "evodev",
+  "interface": {
+    "displayName": "EvoDev Plugins"
+  },
+  "plugins": [
+    {
+      "name": "evodev",
+      "source": {
+        "source": "local",
+        "path": "./plugins/evodev"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Productivity"
+    }
+  ]
+}

package/dist/.claude-plugin/marketplace.json

@@ -0,0 +1,22 @@
+{
+  "name": "evo-dev",
+  "owner": {
+    "name": "EvoDev"
+  },
+  "description": "EvoDev Claude Code hook plugins for AI-assisted R&D workflows.",
+  "version": "0.1.0",
+  "plugins": [
+    {
+      "name": "evodev",
+      "source": "./packages/plugin",
+      "description": "EvoDev hook integration for disciplined AI coding workflows.",
+      "version": "0.1.0",
+      "author": {
+        "name": "EvoDev"
+      },
+      "license": "MIT",
+      "category": "Productivity",
+      "tags": ["ai-coding", "workflow", "hooks"]
+    }
+  ]
+}

package/dist/assets/agents/review/code-reviewer/examples.md

@@ -0,0 +1,19 @@
+# Code Reviewer Examples
+
+## Finding with evidence
+
+```text
+- HIGH: src/core/assets/scanner.ts:93 Missing entry files are reported, but empty entry files are accepted -> Add or test a non-empty entry requirement if the task gate requires non-empty content.
+```
+
+This is useful because it includes severity, location, problem, and an actionable fix.
+
+## Scope finding
+
+```text
+- BLOCKER: packages/plugin/hooks/plugin.ts This task added Claude sync behavior while the current task only allows canonical assets -> Remove plugin implementation from this task and handle it in the plugin sync task.
+```
+
+## Non-finding
+
+Do not report “I prefer a different heading style” unless the heading makes the asset invalid, misleading, or hard to transform.

package/dist/assets/agents/review/code-reviewer/manifest.json

@@ -0,0 +1,10 @@
+{
+  "id": "code-reviewer",
+  "name": "Code Reviewer",
+  "version": "0.1.0",
+  "category": "review",
+  "description": "A focused code review agent that checks scoped changes for correctness, safety, maintainability, and verification gaps without modifying files.",
+  "targets": ["claude"],
+  "entry": "prompt.md",
+  "license": "MIT"
+}

package/dist/assets/agents/review/code-reviewer/prompt.md

@@ -0,0 +1,59 @@
+# Code Reviewer Agent
+
+## Role
+
+You are a focused code reviewer for EvoDev-managed work. Review only the provided diff, files, or task scope. Your job is to find actionable defects and boundary violations, not to rewrite the code or expand the feature.
+
+## Inputs
+
+Expect one or more of:
+
+- A git diff or list of changed files.
+- The task, todo item, or acceptance criteria being implemented.
+- Relevant source-of-truth documents or acceptance criteria.
+- Test or quality-gate results.
+
+If the review scope is unclear, ask for the missing context instead of guessing.
+
+## Permissions
+
+- Read code, tests, configuration, and relevant documentation.
+- Run read-only inspection commands and approved local verification commands when available.
+- Do not modify files.
+- Do not create commits.
+- Do not broaden the review into unrelated modules.
+
+## Review priorities
+
+1. **Correctness:** Does the change do what the task requires? Are edge cases, errors, and data shapes handled correctly?
+2. **Scope control:** Does the diff include unrelated refactors, new features, or future-roadmap work?
+3. **Safety and privacy:** Does the change avoid project-asset writes, user-data collection, secret exposure, and unsafe overwrites?
+4. **Maintainability:** Is the implementation understandable, localized, and consistent with nearby patterns?
+5. **Verification:** Are tests, scanner checks, typecheck, lint, or dry-runs sufficient for the claimed gate?
+
+## Severity levels
+
+- **BLOCKER:** Must fix before merge or delivery. Includes data loss, privacy boundary violations, project-asset writes outside scope, broken core behavior, or a failed required gate.
+- **HIGH:** Likely user-visible bug, unsafe default, missing required validation, or mismatch with the current acceptance criteria.
+- **MEDIUM:** Maintainability, incomplete edge handling, weak diagnostics, or test gap that should be addressed soon.
+- **LOW:** Minor clarity, naming, or documentation issue. Do not report pure style preference unless it affects comprehension.
+
+## Output format
+
+```text
+DECISION: APPROVE | APPROVE_WITH_CHANGES | REJECT
+FINDINGS:
+  - <severity>: <file:line or path> <problem> -> <recommended fix>
+REQUIRED CHANGES: [<change1>, <change2>, ...]
+VERIFICATION: <commands reviewed or run, with PASS/FAIL/not-run>
+```
+
+If there are no findings, write `FINDINGS: none` and still report verification evidence.
+
+## Review rules
+
+- Prefer a small number of high-confidence findings over a long list of preferences.
+- Each finding must explain why it matters and how to fix it.
+- Cite a file path and line when possible; use the closest path-level citation when line numbers are unavailable.
+- Distinguish actual defects from optional improvements.
+- Do not claim a command passed unless you observed it pass.

package/dist/assets/agents/review/code-reviewer/verification.md

@@ -0,0 +1,11 @@
+# Code Reviewer Verification
+
+Before returning a review decision, confirm:
+
+1. The reviewed scope matches the assigned task or diff.
+2. Findings are grouped by severity and include a concrete fix.
+3. Blockers cover safety, privacy, user-data, project-asset, and required-gate failures.
+4. Style-only comments are omitted unless they affect correctness or maintainability.
+5. Verification commands are reported with observed PASS, FAIL, or not-run status.
+
+Reject the change when a required gate failed, an entry file is missing, or the implementation crosses an explicit project boundary.

package/dist/assets/skills/coding/engineering-discipline/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: engineering-discipline
+description: Use when implementing, reviewing, or refactoring code to clarify assumptions, avoid overengineering, keep diffs focused, protect scope boundaries, and verify results.
+license: MIT
+---
+
+# Engineering Discipline
+
+## Purpose
+
+Engineering Discipline is a practical guardrail for AI-assisted development. It keeps each coding session anchored to the requested outcome, makes assumptions visible, and requires verification before reporting success.
+
+## Use this skill when
+
+- Implementing a feature, bug fix, refactor, or test change.
+- Reviewing code for correctness, safety, or maintainability.
+- Working under explicit MVP, privacy, release, or project-boundary constraints.
+- A task could expand into speculative architecture or unrelated cleanup.
+
+## Do not use this skill for
+
+- Pure brainstorming where no code or plan will be produced.
+- Tasks where the user explicitly asks for unconstrained exploration.
+- Replacing product, security, or legal review when those are required.
+
+## Core principles
+
+### 1. Assumption management
+
+State meaningful assumptions before acting. If an assumption changes the user-visible behavior, data boundary, or implementation scope, pause and ask instead of silently guessing.
+
+### 2. Simplicity control
+
+Prefer the smallest design that satisfies the current acceptance criteria. Avoid framework additions, broad abstractions, and future-facing features unless they are required now.
+
+### 3. Diff discipline
+
+Every modified file should have a clear reason tied to the task. Avoid drive-by formatting, unrelated refactors, and opportunistic rewrites.
+
+### 4. Verification loop
+
+Attach each important change to a verification method: test, typecheck, lint, dry-run, manual command, or explicit reason it cannot be run. Do not claim a gate passed unless it was actually executed.
+
+### 5. Scope boundary
+
+Respect project and privacy boundaries. Do not modify user project assets, user-level Code Agent configuration, secrets, logs, or learning data unless the task explicitly requires it and the relevant safeguards exist.
+
+## Operating steps
+
+1. Restate the goal and identify the current task, todo item, or acceptance criteria.
+2. Check the nearest source of truth: existing code, tests, implementation notes, or task instructions.
+3. List assumptions and ask when a choice is materially ambiguous.
+4. Make the smallest focused change that satisfies the goal.
+5. Verify with the most relevant local gate.
+6. Report what changed, what was tested, what failed or was skipped, and any remaining risk.
+
+## Output checklist
+
+- Goal remains unchanged from the request.
+- Modified files are directly related to the goal.
+- New behavior has a validation path.
+- User or project boundaries were not crossed.
+- Final report distinguishes PASS, FAIL, and not-run checks.

package/dist/assets/skills/coding/engineering-discipline/anti-patterns.md

@@ -0,0 +1,21 @@
+# Engineering Discipline Anti-Patterns
+
+## Scope creep
+
+Adding sync, plugin, workflow, or learning behavior while a task only asks for canonical assets.
+
+## Silent assumptions
+
+Choosing a destructive write path, external dependency, or user-data behavior without explaining the assumption or asking for confirmation.
+
+## Diff pollution
+
+Formatting unrelated files, renaming public APIs, or refactoring neighboring modules because they were nearby.
+
+## Verification theater
+
+Reporting success without running the relevant gate, or hiding a failed check behind vague wording.
+
+## Boundary violations
+
+Writing to project-level `CLAUDE.md`, `AGENTS.md`, `.claude/`, `.codex/`, or user private data unless the user explicitly requested it and the current task permits it.

package/dist/assets/skills/coding/engineering-discipline/examples.md

@@ -0,0 +1,19 @@
+# Engineering Discipline Examples
+
+## Focused implementation
+
+**Situation:** The task asks for a scanner-valid built-in asset.
+
+**Disciplined response:** Add only the asset directory, manifest, entry file, and concise support files. Validate with the asset scanner or project check. Do not implement plugin sync or CLI behavior in the same task.
+
+## Assumption handling
+
+**Situation:** Two output formats are possible and both affect users.
+
+**Disciplined response:** Explain the options and ask for direction, or choose the option already specified by the current source of truth.
+
+## Verification report
+
+**Good report:** `bun run check` was run and passed. Asset manifests scan with registry keys `coding/engineering-discipline` and `review/code-reviewer`.
+
+**Bad report:** “Looks good” without saying what was run or whether any gate failed.

package/dist/assets/skills/coding/engineering-discipline/manifest.json

@@ -0,0 +1,10 @@
+{
+  "id": "engineering-discipline",
+  "name": "Engineering Discipline",
+  "version": "0.1.0",
+  "category": "coding",
+  "description": "Engineering behavior guidelines for safer AI coding: clarify assumptions, keep changes focused, respect scope boundaries, and verify outcomes.",
+  "targets": ["claude", "codex"],
+  "entry": "SKILL.md",
+  "license": "MIT"
+}

package/dist/assets/skills/coding/engineering-discipline/verification.md

@@ -0,0 +1,11 @@
+# Engineering Discipline Verification
+
+Use this quick gate before reporting completion:
+
+1. **Scope:** Does every change map to the current request, todo item, or acceptance criteria?
+2. **Safety:** Did the work avoid project assets, secrets, private logs, and user configuration unless explicitly allowed?
+3. **Simplicity:** Is there any new abstraction, dependency, or feature not needed for the current goal?
+4. **Evidence:** Was the most relevant test, typecheck, lint, scanner, or dry-run executed?
+5. **Report:** Are failures and skipped checks stated plainly?
+
+If any answer is no, fix the issue or report the remaining risk instead of claiming the gate passed.

package/dist/assets/workflows/rd-bug-fix/WORKFLOW.json

@@ -0,0 +1,45 @@
+{
+  "id": "rd-bug-fix",
+  "version": "0.1.0",
+  "name": "Bug Fix",
+  "description": "Reproduce, root-cause, minimally fix, and verify a bug.",
+  "modes": ["standard", "rigorous"],
+  "steps": [
+    {
+      "id": "reproduce",
+      "name": "Record reproduction evidence",
+      "actor": "human",
+      "required": true,
+      "evidence": ["repro-summary"],
+      "summary": "Summarize repro without raw logs."
+    },
+    {
+      "id": "root-cause",
+      "name": "Identify root cause",
+      "actor": "human",
+      "required": true,
+      "evidence": ["root-cause-summary"],
+      "summary": "Document root cause."
+    },
+    {
+      "id": "verify",
+      "name": "Regression verification",
+      "actor": "tool",
+      "required": true,
+      "evidence": ["regression-verification"],
+      "summary": "Record regression verification summary."
+    }
+  ],
+  "requiredEvidence": ["repro-summary", "root-cause-summary", "regression-verification"],
+  "verification": {
+    "policy": "fail-closed",
+    "antiCriteria": ["no-scope-creep", "no-secret-capture"]
+  },
+  "privacy": {
+    "metadataOnly": true,
+    "storesRawPrompts": false,
+    "storesSourceContent": false,
+    "storesRawCommandOutput": false,
+    "usesNetwork": false
+  }
+}

package/dist/assets/workflows/rd-code-review/WORKFLOW.json

@@ -0,0 +1,45 @@
+{
+  "id": "rd-code-review",
+  "version": "0.1.0",
+  "name": "Code Review",
+  "description": "Review a scoped diff for correctness, risk, and verification gaps.",
+  "modes": ["standard", "rigorous"],
+  "steps": [
+    {
+      "id": "scope",
+      "name": "Confirm review scope",
+      "actor": "human",
+      "required": true,
+      "evidence": ["review-scope"],
+      "summary": "List reviewed files/areas."
+    },
+    {
+      "id": "findings",
+      "name": "Record findings",
+      "actor": "reviewer",
+      "required": true,
+      "evidence": ["review-findings"],
+      "summary": "Structured findings without source excerpts."
+    },
+    {
+      "id": "reverify",
+      "name": "Re-verify fixes",
+      "actor": "tool",
+      "required": false,
+      "evidence": ["reverification"],
+      "summary": "Optional metadata-only re-verification."
+    }
+  ],
+  "requiredEvidence": ["review-scope", "review-findings"],
+  "verification": {
+    "policy": "fail-closed",
+    "antiCriteria": ["no-unscoped-review", "no-secret-capture"]
+  },
+  "privacy": {
+    "metadataOnly": true,
+    "storesRawPrompts": false,
+    "storesSourceContent": false,
+    "storesRawCommandOutput": false,
+    "usesNetwork": false
+  }
+}

package/dist/assets/workflows/rd-docs-update/WORKFLOW.json

@@ -0,0 +1,45 @@
+{
+  "id": "rd-docs-update",
+  "version": "0.1.0",
+  "name": "Docs Update",
+  "description": "Update documentation consistently for scoped behavior changes.",
+  "modes": ["minimal", "standard"],
+  "steps": [
+    {
+      "id": "scope",
+      "name": "Identify docs scope",
+      "actor": "human",
+      "required": true,
+      "evidence": ["docs-scope"],
+      "summary": "List docs to update."
+    },
+    {
+      "id": "update",
+      "name": "Update docs",
+      "actor": "human",
+      "required": true,
+      "evidence": ["docs-change-summary"],
+      "summary": "Summarize docs changes."
+    },
+    {
+      "id": "check",
+      "name": "Check consistency",
+      "actor": "human",
+      "required": true,
+      "evidence": ["consistency-check"],
+      "summary": "Record consistency check."
+    }
+  ],
+  "requiredEvidence": ["docs-scope", "docs-change-summary", "consistency-check"],
+  "verification": {
+    "policy": "fail-closed",
+    "antiCriteria": ["no-stale-docs", "no-secret-capture"]
+  },
+  "privacy": {
+    "metadataOnly": true,
+    "storesRawPrompts": false,
+    "storesSourceContent": false,
+    "storesRawCommandOutput": false,
+    "usesNetwork": false
+  }
+}

package/dist/assets/workflows/rd-feature-implementation/WORKFLOW.json

@@ -0,0 +1,45 @@
+{
+  "id": "rd-feature-implementation",
+  "version": "0.1.0",
+  "name": "Feature Implementation",
+  "description": "Plan, implement, verify, review, and document a bounded feature change.",
+  "modes": ["standard", "rigorous"],
+  "steps": [
+    {
+      "id": "plan",
+      "name": "Plan scoped change",
+      "actor": "human",
+      "required": true,
+      "evidence": ["scope-plan"],
+      "summary": "Create implementation plan."
+    },
+    {
+      "id": "implement",
+      "name": "Implement approved scope",
+      "actor": "human",
+      "required": true,
+      "evidence": ["changed-files-summary"],
+      "summary": "Perform approved edits outside EvoDev workflow runtime."
+    },
+    {
+      "id": "verify",
+      "name": "Verify acceptance and anti-criteria",
+      "actor": "tool",
+      "required": true,
+      "evidence": ["verification-report"],
+      "summary": "Record metadata-only verification evidence."
+    }
+  ],
+  "requiredEvidence": ["scope-plan", "changed-files-summary", "verification-report"],
+  "verification": {
+    "policy": "fail-closed",
+    "antiCriteria": ["no-unapproved-project-write", "no-secret-capture"]
+  },
+  "privacy": {
+    "metadataOnly": true,
+    "storesRawPrompts": false,
+    "storesSourceContent": false,
+    "storesRawCommandOutput": false,
+    "usesNetwork": false
+  }
+}

package/dist/assets/workflows/rd-refactor/WORKFLOW.json

@@ -0,0 +1,45 @@
+{
+  "id": "rd-refactor",
+  "version": "0.1.0",
+  "name": "Refactor",
+  "description": "Plan and verify behavior-preserving structural changes.",
+  "modes": ["standard", "rigorous"],
+  "steps": [
+    {
+      "id": "behavior-lock",
+      "name": "Lock current behavior",
+      "actor": "human",
+      "required": true,
+      "evidence": ["behavior-lock"],
+      "summary": "Record behavior assumptions."
+    },
+    {
+      "id": "impact-map",
+      "name": "Map impact",
+      "actor": "human",
+      "required": true,
+      "evidence": ["impact-map"],
+      "summary": "Summarize impacted areas."
+    },
+    {
+      "id": "equivalence",
+      "name": "Verify equivalence",
+      "actor": "tool",
+      "required": true,
+      "evidence": ["equivalence-verification"],
+      "summary": "Record metadata-only verification."
+    }
+  ],
+  "requiredEvidence": ["behavior-lock", "impact-map", "equivalence-verification"],
+  "verification": {
+    "policy": "fail-closed",
+    "antiCriteria": ["no-behavior-change", "no-secret-capture"]
+  },
+  "privacy": {
+    "metadataOnly": true,
+    "storesRawPrompts": false,
+    "storesSourceContent": false,
+    "storesRawCommandOutput": false,
+    "usesNetwork": false
+  }
+}

package/dist/assets/workflows/rd-release-readiness/WORKFLOW.json

@@ -0,0 +1,49 @@
+{
+  "id": "rd-release-readiness",
+  "version": "0.1.0",
+  "name": "Release Readiness",
+  "description": "Plan release checks, package boundaries, and approval evidence.",
+  "modes": ["rigorous"],
+  "steps": [
+    {
+      "id": "quality",
+      "name": "Quality gate summary",
+      "actor": "tool",
+      "required": true,
+      "evidence": ["quality-gate-summary"],
+      "summary": "Record quality gate metadata."
+    },
+    {
+      "id": "package",
+      "name": "Package dry-run summary",
+      "actor": "tool",
+      "required": true,
+      "evidence": ["package-dry-run"],
+      "summary": "Record package inspection summary."
+    },
+    {
+      "id": "approval",
+      "name": "Release approval",
+      "actor": "human",
+      "required": true,
+      "evidence": ["release-approval"],
+      "summary": "Record explicit release authorization."
+    }
+  ],
+  "requiredEvidence": ["quality-gate-summary", "package-dry-run", "release-approval"],
+  "verification": {
+    "policy": "fail-closed",
+    "antiCriteria": [
+      "no-npm-publish-without-approval",
+      "no-protected-zone-leak",
+      "no-secret-capture"
+    ]
+  },
+  "privacy": {
+    "metadataOnly": true,
+    "storesRawPrompts": false,
+    "storesSourceContent": false,
+    "storesRawCommandOutput": false,
+    "usesNetwork": false
+  }
+}

package/dist/assets/workflows/rd-security-boundary-review/WORKFLOW.json

@@ -0,0 +1,45 @@
+{
+  "id": "rd-security-boundary-review",
+  "version": "0.1.0",
+  "name": "Security Boundary Review",
+  "description": "Review privacy, write, publish, and secret boundaries.",
+  "modes": ["rigorous"],
+  "steps": [
+    {
+      "id": "data-flow",
+      "name": "Review data flow",
+      "actor": "reviewer",
+      "required": true,
+      "evidence": ["data-flow-summary"],
+      "summary": "Metadata-only data-flow review."
+    },
+    {
+      "id": "write-boundary",
+      "name": "Review write boundary",
+      "actor": "reviewer",
+      "required": true,
+      "evidence": ["write-boundary-check"],
+      "summary": "Check writes stay in scope."
+    },
+    {
+      "id": "decision",
+      "name": "Record decision",
+      "actor": "human",
+      "required": true,
+      "evidence": ["security-decision"],
+      "summary": "Approve/block with rationale."
+    }
+  ],
+  "requiredEvidence": ["data-flow-summary", "write-boundary-check", "security-decision"],
+  "verification": {
+    "policy": "fail-closed",
+    "antiCriteria": ["no-secret-capture", "no-unapproved-write", "no-external-upload"]
+  },
+  "privacy": {
+    "metadataOnly": true,
+    "storesRawPrompts": false,
+    "storesSourceContent": false,
+    "storesRawCommandOutput": false,
+    "usesNetwork": false
+  }
+}

package/dist/assets/workflows/rd-test-generation/WORKFLOW.json

@@ -0,0 +1,45 @@
+{
+  "id": "rd-test-generation",
+  "version": "0.1.0",
+  "name": "Test Generation",
+  "description": "Identify coverage gaps and plan tests with verification evidence.",
+  "modes": ["standard"],
+  "steps": [
+    {
+      "id": "gap",
+      "name": "Identify coverage gap",
+      "actor": "human",
+      "required": true,
+      "evidence": ["coverage-gap"],
+      "summary": "Summarize gap."
+    },
+    {
+      "id": "tests",
+      "name": "Plan or add tests",
+      "actor": "human",
+      "required": true,
+      "evidence": ["test-plan"],
+      "summary": "Describe tests."
+    },
+    {
+      "id": "verify",
+      "name": "Verify tests",
+      "actor": "tool",
+      "required": true,
+      "evidence": ["test-output-summary"],
+      "summary": "Record test result summary."
+    }
+  ],
+  "requiredEvidence": ["coverage-gap", "test-plan", "test-output-summary"],
+  "verification": {
+    "policy": "fail-closed",
+    "antiCriteria": ["no-untested-claim", "no-secret-capture"]
+  },
+  "privacy": {
+    "metadataOnly": true,
+    "storesRawPrompts": false,
+    "storesSourceContent": false,
+    "storesRawCommandOutput": false,
+    "usesNetwork": false
+  }
+}

package/dist/evodev

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -eu
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "EvoDev CLI requires Node.js >=20 to run." >&2
+  echo "Install Node.js, then restart your shell and run: evodev doctor." >&2
+  exit 1
+fi
+
+SCRIPT_DIR="$(CDPATH= cd "$(dirname "$0")" && pwd)"
+exec node "$SCRIPT_DIR/index.js" "$@"