@hailer/mcp 1.2.0 → 1.3.9

package/.claude/commands/audit-squad.md

@@ -1,158 +0,0 @@
----
-description: Run parallel security and permissions audit
-argument-hint: [files, app name, or blank for full audit]
-allowed-tools: Task, Bash
----
-
-# Audit Squad
-
-Parallel security and permissions audit: code hardening, access control verification, and MCP tool validation.
-
-**Roles:**
-- **Code Reviewer** - Code review (hardcoded secrets, injection vulnerabilities, insecure patterns, OWASP top 10)
-- **Permissions Auditor** - Access control audit (effective permissions, team access levels, permission matrix)
-- **Tool Security Auditor** - MCP tools security (input validation, data exposure, security best practices)
-
-**Target:** $ARGUMENTS (if blank, use full project scope)
-
-**Scope options:**
-- Specific files or directory path
-- App name (checks that app's code and permissions)
-- Blank for full project audit
-
-## Protocol
-
-### Step 1: Determine Target
-
-If `$ARGUMENTS` has specific files/directories or app name, use those.
-Otherwise, scope is the entire project (workspace/ + apps/ + integrations/).
-
-If `$ARGUMENTS` contains `--code-only`:
-- Remove flag from target
-- Skip Permissions Auditor and Tool Security Auditor in Step 2
-
-If `$ARGUMENTS` contains `--permissions-only`:
-- Remove flag from target
-- Skip Code Reviewer and Tool Security Auditor in Step 2
-
-If `$ARGUMENTS` contains `--bg`:
-- Launch all agents in background mode
-
-### Step 2: Launch Audit Agents in Parallel
-
-Spawn all applicable agents simultaneously using multiple Task tool calls in a single message:
-
-**Code Reviewer:**
-```
-Task(prompt="Security audit of these files: [TARGET]. Focus on: hardcoded secrets, API keys, credentials, injection vulnerabilities (SQL/XSS/Command), insecure crypto usage, missing input validation, OWASP Top 10 issues, unsafe deserialization, missing authentication/authorization checks. Return verdict (PASS/FAIL), critical count, and detailed findings per file.")
-```
-
-**Permissions Auditor:**
-```
-Task(prompt="Load hailer-permissions-system skill for understanding the permissions model.\n\nAudit access control for the entire project. Map effective permissions: who has access to which apps, which teams have what access levels, which users are admins, workspace-wide versus app-specific permissions. Produce a permission matrix showing [User/Team] → [App] → [Access Level]. Flag any excessive or unclear permissions.")
-```
-
-**Tool Security Auditor:**
-```
-Task(prompt="Load tool-builder skill for understanding MCP tool patterns.\n\nSecurity audit of custom MCP tools (if any exist in src/mcp/tools/). Verify: input validation with Zod schemas, no unintended data exposure, proper error handling, rate limiting awareness, secure defaults. Report security posture per tool. If no custom tools exist, report that.")
-```
-
-### Step 3: Categorize and Aggregate Results
-
-Collect results from all agents. Categorize findings into three tiers:
-
-**CRITICAL:**
-- Hardcoded secrets/credentials
-- SQL injection, XSS, command injection vulnerabilities
-- Authentication/authorization bypasses
-- Excessive uncontrolled permissions
-- MCP tools exposing sensitive data
-
-**WARNING:**
-- Weak crypto usage
-- Missing input sanitization
-- Unclear permission delegations
-- Unvalidated MCP tool inputs
-- Missing rate limiting on tools
-
-**INFO:**
-- Best practice improvements
-- Code hardening suggestions
-- Permission clarity recommendations
-
-### Step 4: Report
-
-```markdown
-## Audit Squad Report
-
-### Scope
-[What was audited]
-
-### Overall Security Posture
-[Rating: PASS / WARNING / CRITICAL]
-- Critical findings: X
-- Warnings: X
-- Info items: X
-
-### Code Reviewer
-**Verdict:** PASS / FAIL / WARNINGS
-- Critical: X [list]
-- Warnings: X [list]
-- Info: X [list]
-- Files affected: [grouped summary]
-
-### Permissions Auditor
-**Matrix Status:** [OK / EXCESSIVE / UNCLEAR]
-- Total apps: X
-- Total teams: X
-- Users with admin access: X
-- Flagged permissions: [list]
-- [Permission matrix if findings exist]
-
-### Tool Security Auditor
-**Status:** [No tools / PASS / WARNINGS / CRITICAL]
-[If tools exist:]
-- Tools audited: X
-- Input validation issues: X
-- Data exposure risks: X
-- Best practice gaps: X
-
-### Findings by Severity
-
-#### CRITICAL (Require Immediate Action)
-[List all critical findings with file/tool and remediation steps]
-
-#### WARNING (Address in Next Sprint)
-[List all warnings with context]
-
-#### INFO (Consider for Hardening)
-[List informational recommendations]
-
-### Remediation Checklist
-- [ ] [Critical issue 1]: [Action]
-- [ ] [Critical issue 2]: [Action]
-- [ ] [Warning 1]: [Action]
-
-### Summary
-[1-2 sentence overall assessment of security posture and next steps]
-```
-
-If any agent fails or times out, report partial results from successful agents, note which failed, and offer to re-run individually.
-
-## Options
-
-| Flag | Effect |
-|------|--------|
-| `--code-only` | Skip permissions and MCP tools (code review only, faster) |
-| `--permissions-only` | Skip code review and MCP tools (permissions matrix only) |
-| `--bg` | Run all agents in background mode |
-
-If `--bg` is present, launch all agents with `run_in_background: true` and tell the user they'll be notified when complete.
-
-## Notes
-
-- Default scope is full project if no arguments provided
-- Code Reviewer focuses on secrets and injection attacks; general code quality is separate (/review-squad)
-- Permissions Auditor is organization-wide - includes team and app-level settings
-- Tool Security Auditor only validates if custom MCP tools exist in the project
-- Critical findings should block deployment; warnings should be tracked for next sprint

package/.claude/commands/cleanup-squad.md

@@ -1,98 +0,0 @@
----
-description: Clean up codebase with config audit, code simplification, and dead code detection
-argument-hint: [files, directory, or blank for recent changes]
-allowed-tools: Task, Bash
----
-# Cleanup Squad
-
-Run parallel codebase cleanup using three agents simultaneously.
-
-**Roles:**
-- **Config Auditor** - Configuration audit (verify CLAUDE.md, hooks, workspace structure)
-- **Code Simplifier** - Refactor (improve code clarity and maintainability)
-- **Dead Code Inspector** - Dead code detection (find unused imports, dead code, type errors)
-
-**Target:** $ARGUMENTS (if blank, use recent git changes)
-
-**Changed files (auto-injected):**
-!git diff --name-only HEAD
-
-## Protocol
-
-### Step 1: Determine Target
-
-If `$ARGUMENTS` has specific files/directories, use those.
-Otherwise, use the changed files list above as the target.
-
-If `$ARGUMENTS` contains `--skip-config`:
-- Remove flag from target
-- Skip Config Auditor in Step 2
-
-If `$ARGUMENTS` contains `--skip-dead-code`:
-- Remove flag from target
-- Skip Dead Code Inspector in Step 2
-
-### Step 2: Launch Agents in Parallel
-
-Spawn all agents simultaneously using multiple Task tool calls in a single message:
-
-**Config Auditor:**
-```
-Task(prompt="Audit codebase configuration for: [TARGET]. Check:\n- CLAUDE.md accuracy and completeness\n- Hook configurations\n- Workspace structure\n- Agent definitions\n\nReturn list of issues found with severity levels.")
-```
-
-**Code Simplifier:**
-```
-Task(prompt="Refactor these files for clarity and maintainability: [TARGET]. Focus on:\n- Variable naming\n- Function complexity\n- Comment clarity\n- Code organization\n\nReturn refactoring suggestions with before/after examples.")
-```
-
-**Dead Code Inspector:**
-```
-Task(prompt="Load lsp-setup skill for code inspection.\n\nInspect these files for dead code: [TARGET]. Find:\n- Unused imports\n- Unreachable code\n- Unused variables\n- Type errors\n\nUse LSP if available. Return detailed list grouped by file.")
-```
-
-### Step 3: Aggregate Results
-
-Compile a unified cleanup report:
-
-```markdown
-## Cleanup Squad Report
-
-### Config Auditor
-- Issues found: X
-- Critical: X
-- Warnings: X
-- [Issues grouped by category]
-
-### Code Simplifier
-- Files analyzed: X
-- Refactoring suggestions: X
-- [Suggestions grouped by file]
-
-### Dead Code Inspector
-- Unused imports: X
-- Dead code blocks: X
-- Type errors: X
-- [Details grouped by file]
-
-### Summary
-[Overall assessment of codebase health]
-[Prioritized action items]
-
-### Recommended Order
-1. [Fix critical config issues first]
-2. [Remove dead code]
-3. [Apply refactoring suggestions]
-```
-
-If any agent fails or times out, report partial results from successful agents, note which failed, and offer to re-run individually.
-
-## Options
-
-| Flag | Effect |
-|------|--------|
-| `--skip-config` | Skip Config Auditor (faster, no config validation) |
-| `--skip-dead-code` | Skip Dead Code Inspector (when LSP not configured) |
-| `--bg` | Run all agents in background mode |
-
-If `--bg` is present, launch all agents with `run_in_background: true` and tell the user they'll be notified when complete.

package/.claude/commands/config-squad.md

@@ -1,106 +0,0 @@
----
-description: Set up workflow config with infrastructure, functions, and insights
-argument-hint: "workflow/config description"
-allowed-tools: Task, Bash, Read
----
-# Config Squad
-
-Sequential pipeline: Create workflow infrastructure, then calculated fields, then insights.
-
-**Roles:**
-1. **Workflow Config** - Workflow configuration (fields, phases, teams, groups)
-2. **Function Fields** - Calculated fields and nameFunction
-3. **SQL Insights** - SQL insights for reporting
-
-**Goal:** $ARGUMENTS
-
-## Protocol
-
-### Step 1: Understand Scope
-
-Parse `$ARGUMENTS` to determine what's needed:
-
-| Keyword | Steps to Run |
-|---------|-------------|
-| "workflow", "fields", "phases" | Workflow Config (+ Function Fields if calculated fields mentioned) |
-| "insight", "report", "dashboard" | SQL Insights (may need schema discovery first) |
-| "function", "calculated", "nameFunction" | Function Fields only |
-| General description | All three in sequence |
-
-If scope is unclear, use AskUserQuestion:
-- What workflow(s) does this involve?
-- Do you need calculated fields?
-- Do you need reports/insights?
-
-If `$ARGUMENTS` contains `--skip-insights`: skip SQL Insights step.
-If `$ARGUMENTS` contains `--skip-functions`: skip Function Fields step.
-
-### Step 2: Workflow Config
-
-Spawn a workflow config agent:
-
-```
-Task(prompt="Load sdk-ws-config-skill for understanding workspace configuration.\n\n$ARGUMENTS")
-```
-
-Wait for result. If the agent returns `"status": "ready_to_push"`:
-- Run the push commands it provides (e.g., `npm run fields-push:force`)
-- Then run `npm run pull` to refresh local workspace with new IDs
-
-**Important:** The workflow config agent ALWAYS spawns a function fields agent for nameFunction after creating a workflow. Check the result - if it reports the function fields agent created the nameFunction and all needed function fields, skip Step 3. Only proceed to Step 3 if additional function fields are needed beyond what was already created.
-
-### Step 3: Function Fields
-
-Only if function fields or nameFunction are needed and weren't handled in Step 2.
-
-Spawn a function fields agent:
-
-```
-Task(prompt="Load sdk-function-fields and sdk-ws-config-skill skills for creating calculated fields.\n\nCreate function fields for: $ARGUMENTS. Workflow config agent created these workflows: [SUMMARIZE STEP 2 RESULT - workflow names and any IDs returned]. Read workspace/ to discover field IDs and types. New fields created in Step 2: [LIST FROM STEP 2 RESULT IF ANY].")
-```
-
-Wait for result. If `"status": "ready_to_push"`:
-- Run the push commands
-
-### Step 4: SQL Insights
-
-Only if reporting/insights are needed.
-
-Spawn an SQL insights agent:
-
-```
-Task(prompt="Load sdk-insight-queries and sdk-ws-config-skill skills for building insights.\n\nCreate insights for: $ARGUMENTS. Read workspace/ to discover workflow IDs and field IDs for SQL queries. Workflow config agent created: [SUMMARIZE STEP 2 RESULT].")
-```
-
-Wait for result. If `"status": "ready_to_push"`:
-- Run the push commands (e.g., `npm run insights-push:force`)
-
-### Step 5: Report
-
-```markdown
-## Config Squad Complete
-
-### Workflow Config
-- Workflows: [created/modified]
-- Fields: [count]
-- Phases: [count]
-- Commands run: [list]
-
-### Function Fields
-- Function fields: [list with formulas]
-- Name function: [pattern]
-- Skipped: [reason if skipped]
-
-### SQL Insights
-- Insights: [list with descriptions]
-- Skipped: [reason if skipped]
-
-### Workspace State
-Run `npm run pull` to ensure workspace/ is up to date.
-```
-
-## Notes
-
-- Each agent in the pipeline needs IDs from the previous step. Always `npm run pull` between steps.
-- Workflow config auto-spawns function fields agent for nameFunction - check the output before spawning separately.
-- SQL insights agent needs real field IDs for SQL queries - never let it guess.

package/.claude/commands/crud-squad.md

@@ -1,87 +0,0 @@
----
-description: Create, update, or manage activities with schema discovery and CRUD operations
-argument-hint: "what to create/update and in which workflow"
-allowed-tools: Task, Bash, Read
----
-# CRUD Squad
-
-Sequential pipeline: Discover schema, execute CRUD operations, verify results.
-
-**Roles:**
-1. **Data Reader** - Schema discovery + pre-read existing data
-2. **Activity Writer** - Create/update activities
-3. **Data Reader** - Verify results (count/list after changes)
-
-**Goal:** $ARGUMENTS
-
-## Protocol
-
-### Step 1: Schema Discovery
-
-Discover workflow schema and existing data relevant to the task:
-
-```
-Task(prompt="Load sdk-ws-config-skill and sdk-activity-patterns skills for data operations.\n\nFor this task: $ARGUMENTS\n\n1. List the relevant workflow(s) with field IDs, types, and dropdown/enum options\n2. List phases and their IDs\n3. If updating existing activities: list the activities that match (include their IDs)\n4. If creating new activities: show a sample existing activity so we know the expected field format")
-```
-
-Wait for result. This gives the activity writer the real IDs and field formats.
-
-### Step 2: CRUD Operations
-
-Spawn an activity writer with full schema context:
-
-```
-Task(prompt="Load sdk-activity-patterns skill for activity creation and updates.\n\nTask: $ARGUMENTS\n\nWorkflow schema from data reader:\n[PASTE DATA READER OUTPUT - workflow ID, field IDs, types, phase IDs, enum options]\n\n[IF UPDATING: Target activities:\nPASTE ACTIVITY IDs AND CURRENT VALUES]\n\nExecute the CRUD operations using the correct field IDs and value formats.")
-```
-
-Wait for result. Check for errors - if the activity writer reports validation failures, review field formats and retry once.
-
-### Step 3: Verify Results
-
-Skip if `--skip-verify` flag is set.
-
-Verify the operations succeeded:
-
-```
-Task(prompt="Load sdk-ws-config-skill for data verification.\n\nVerify CRUD operations for: $ARGUMENTS\n\nExpected changes:\n[PASTE ACTIVITY WRITER OUTPUT - created/updated activity IDs]\n\nCount activities in the workflow and list the recently created/modified ones to confirm they exist with correct values.")
-```
-
-### Step 4: Report
-
-```markdown
-## CRUD Squad Complete
-
-### Data Reader (Schema Discovery)
-- Workflow: [name] ([id])
-- Fields mapped: [count]
-- Existing activities found: [count or "N/A"]
-
-### Activity Writer (CRUD Operations)
-- Created: [count] activities
-- Updated: [count] activities
-- Errors: [count or "none"]
-
-### Data Reader (Verification)
-- Activities confirmed: [count]
-- Discrepancies: [list or "none"]
-
-### Summary
-[Brief description of what was done]
-```
-
-## Options
-
-| Flag | Effect |
-|------|--------|
-| `--skip-verify` | Skip verification (trust Activity Writer's response) |
-| `--skip-discovery` | Skip schema discovery (when you already know the workflow schema) |
-| `--dry-run` | Run Data Reader discovery only, show what Activity Writer would do, but don't execute |
-
-## Difference from Direct Activity Writer
-
-| | Direct Activity Writer | CRUD Squad |
-|---|---|---|
-| **Schema context** | You must provide IDs manually | Data Reader discovers IDs automatically |
-| **Verification** | Trust Activity Writer's response | Data Reader independently verifies |
-| **Bulk ops** | Single prompt | Discovery → execute → verify pipeline |
-| **Use when** | You already know exact IDs and format | "Create 5 customers" or "Update all overdue tasks" |

package/.claude/commands/data-squad.md

@@ -1,97 +0,0 @@
----
-description: Build reports with schema discovery, function fields, and insights
-argument-hint: "report/dashboard description"
-allowed-tools: Task, Bash, Read
----
-# Data Squad
-
-Sequential pipeline: Discover schema, create calculated fields if needed, then build insights.
-
-**Roles:**
-1. **Data Reader** - Schema discovery (workflow fields, types, IDs)
-2. **Function Fields** - Calculated fields (if needed)
-3. **SQL Insights** - SQL insights (queries, aggregations, reports)
-
-**Goal:** $ARGUMENTS
-
-## Protocol
-
-### Step 1: Schema Discovery
-
-Always start with schema discovery to get real IDs and field types:
-
-```
-Task(prompt="Load sdk-ws-config-skill for understanding workspace structure.\n\nList all workflows and their fields relevant to: $ARGUMENTS. Include field IDs, types, and dropdown options. Also list existing insights if any.")
-```
-
-Wait for result. This gives the function fields and SQL insights agents the real IDs they need.
-
-### Step 2: Check if Function Fields Needed
-
-Review the schema discovery output. Function fields are needed when:
-- The report needs **calculated values** not already in the schema (totals, percentages, date diffs)
-- An existing function field needs modification
-- A **nameFunction** is missing or needs updating
-
-If no calculated fields needed, skip to Step 3.
-
-If needed, spawn a function fields agent:
-
-```
-Task(prompt="Load sdk-function-fields and sdk-ws-config-skill skills for creating calculated fields.\n\nCreate function fields for: $ARGUMENTS.\n\nWorkflow schema from data reader:\n[PASTE SCHEMA DISCOVERY OUTPUT - workflow IDs, field IDs, types]\n\nCreate the calculated fields needed for this report.")
-```
-
-Wait for result. If `"status": "ready_to_push"`:
-- Run the push commands
-- Run `npm run pull` to get new field IDs
-
-### Step 3: SQL Insights
-
-Spawn an SQL insights agent with full schema context:
-
-```
-Task(prompt="Load sdk-insight-queries and sdk-ws-config-skill skills for building insights.\n\nCreate insights for: $ARGUMENTS.\n\nWorkflow schema:\n[Data reader found these workflows and fields: SUMMARIZE SCHEMA DISCOVERY RESULT.]\n\n[IF FUNCTION FIELDS AGENT RAN: It created these function fields: SUMMARIZE FUNCTION FIELDS RESULT.]\n\nBuild SQL queries with correct field IDs. Never guess IDs.")
-```
-
-Wait for result. If `"status": "ready_to_push"`:
-- Run the push commands (e.g., `npm run insights-push:force`)
-
-### Step 4: Report
-
-```markdown
-## Data Squad Complete
-
-### Data Reader (Schema Discovery)
-- Workflows found: [list]
-- Fields mapped: [count]
-- Existing insights: [list or "none"]
-
-### Function Fields
-- Created: [list with formulas]
-- Skipped: [reason if not needed]
-
-### SQL Insights
-- Insights created: [list]
-- Query summary: [brief description of each]
-- Public: [yes/no for each]
-
-### Next Steps
-- Preview insights in Hailer
-- Use insights as data source for apps (if needed)
-```
-
-## Options
-
-| Flag | Effect |
-|------|--------|
-| `--skip-functions` | Skip Function Fields step (when not needed) |
-| `--skip-insights` | Skip SQL Insights step (when not needed) |
-
-## Difference from Config Squad
-
-| | Config Squad | Data Squad |
-|---|---|---|
-| **Starting point** | New workflow needed | Workflow already exists |
-| **First agent** | Workflow Config (create workflow) | Data Reader (read existing schema) |
-| **Focus** | Infrastructure setup | Reporting and analytics |
-| **Use when** | "Create a Tasks workflow with..." | "Build a report showing..." |

package/.claude/commands/doc-squad.md

@@ -1,65 +0,0 @@
----
-description: Document API endpoints with code analysis and documentation generation
-argument-hint: "endpoint or module to document"
-allowed-tools: Task, Bash
----
-# Doc Squad
-
-Sequential pipeline: Code analysis, then generate documentation.
-
-**Roles:**
-1. **Code Inspector** - LSP code analysis (inspect types, schemas, function signatures)
-2. **Documentation Generator** - API documentation (generate endpoint docs from analysis)
-
-**Goal:** $ARGUMENTS
-
-## Protocol
-
-### Step 1: Code Analysis
-
-Spawn a code inspector to analyze code and extract types/schemas:
-
-```
-Task(prompt="Load lsp-setup skill for code inspection.\n\nInspect code for: $ARGUMENTS. Extract:\n- Function signatures\n- Type definitions\n- Return types\n- Parameter schemas\n- Joi/Zod validation rules\n\nUse LSP if available. Return structured analysis with types and schemas.")
-```
-
-Wait for result. Save the analysis output - the documentation generator needs these type definitions.
-
-### Step 2: Generate Documentation
-
-Spawn a documentation generator with the code analysis:
-
-```
-Task(prompt="Load api-documentation-patterns skill for creating API documentation.\n\nGenerate API documentation for: $ARGUMENTS.\n\nCode analysis from code inspector:\n[PASTE CODE INSPECTOR OUTPUT - types, schemas, function signatures]\n\nCreate comprehensive endpoint documentation including:\n- Endpoint path and method\n- Description\n- Parameters and types\n- Request/response examples\n- Error codes and handling\n- Usage examples with @hailer/cli")
-```
-
-Wait for result. If `"status": "ready_to_push"`:
-- Run the push commands provided
-
-### Step 3: Report
-
-```markdown
-## Doc Squad Complete
-
-### Code Inspector
-- Files analyzed: [count]
-- Functions found: [count]
-- Types extracted: [count]
-- Schemas identified: [list]
-
-### Documentation Generator
-- Endpoints documented: [count]
-- Examples created: [count]
-- Files generated: [list]
-
-### Next Steps
-- Review generated documentation
-- Add to API reference
-- Test examples with @hailer/cli
-```
-
-## Notes
-
-- Code Inspector runs first to extract accurate types - never guess schemas
-- Documentation Generator creates human-friendly docs from the type analysis
-- Documentation stays in sync with actual code signatures

package/.claude/commands/help.md

@@ -1,29 +0,0 @@
----
-description: Show help topics for Hailer MCP
----
-
-# Hailer MCP Help
-
-Display available help topics to the user.
-
-## Output
-
-```
-╭─────────────────────────────────────────╮
-│         HAILER MCP HELP SYSTEM          │
-╰─────────────────────────────────────────╯
-
-Available topics:
-
-  /help agents     How agents work and delegation
-  /help skills     Skills reference (patterns, templates, fixes)
-  /help commands   All slash commands
-  /help tools      MCP tools reference
-  /help plugins    Plugin system (install, uninstall, publish)
-  /help faq        Common questions
-
-───────────────────────────────────────────
-Type /help <topic> for details
-```
-
-## Always show this exactly as formatted above.