@hanhnd/agent-kit 1.0.5 → 1.0.7

package/README.md

@@ -11,6 +11,8 @@
 | `/ak:brainstorm [idea]`          | Strategic architectural analysis                                   |
 | `/ak:plan [file or idea]`        | Create an implementation blueprint                                 |
 | `/ak:code [file or task]`        | Implement from a plan                                              |
+| `/ak:code-simplify`              | Refactor modified code for readability                             |
+| `/ak:research [topic]`           | Research a topic                                                   |
 | `/ak:review-pr [PR URL]`         | Review a pull request                                              |
 | `/ak:review`                     | Review uncommitted local changes                                   |
 | `/ak:ticket [ID]`                | Fetch a Jira ticket and plan from it                               |
@@ -27,7 +29,7 @@
 
 ```bash
 claude plugin marketplace add https://github.com/hanh-nd/agent-kit
-claude plugin install agent-kit
+claude plugin install ak
 ```
 
 The plugin fetches from GitHub, registers the MCP server automatically, and makes all commands available immediately.
@@ -43,8 +45,8 @@ export BITBUCKET_API_TOKEN="your-atlassian-api-token"
 export BITBUCKET_DEFAULT_WORKSPACE="your-default-workspace-slug"
 ```
 
-To update: `claude plugin update agent-kit`
-To uninstall: `claude plugin uninstall agent-kit`
+To update: `claude plugin update ak`
+To uninstall: `claude plugin uninstall ak`
 
 ---
 
@@ -65,7 +67,7 @@ npm run build
 
 ```bash
 claude plugin marketplace add /absolute/path/to/agent-kit
-claude plugin install agent-kit
+claude plugin install ak
 ```
 
 This registers the MCP server automatically (pointing to your local build). Do **not** manually add a `kit-agents` entry to `settings.json` — the plugin handles that.
@@ -89,6 +91,16 @@ export BITBUCKET_DEFAULT_WORKSPACE="your-default-workspace-slug"
 
 ---
 
+### Option 3: Install as Gemini Extension (Optional)
+
+If you want to reuse the commands with [Gemini CLI](https://geminicli.com) (for `/ak:delegate` to Gemini), install it using:
+
+```bash
+gemini extension install https://github.com/hanh-nd/agent-kit
+```
+
+---
+
 ## Development
 
 ```bash

package/dist/kit-server.js

@@ -3223,8 +3223,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path5) {
-      let input = path5;
+    function removeDotSegments(path4) {
+      let input = path4;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3423,8 +3423,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path5, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path5 && path5 !== "/" ? path5 : void 0;
+        const [path4, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path4 && path4 !== "/" ? path4 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -7277,8 +7277,8 @@ function getErrorMap() {
 
 // node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path5, errorMaps, issueData } = params;
-  const fullPath = [...path5, ...issueData.path || []];
+  const { data, path: path4, errorMaps, issueData } = params;
+  const fullPath = [...path4, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -7394,11 +7394,11 @@ var errorUtil;
 
 // node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path5, key) {
+  constructor(parent, value, path4, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path5;
+    this._path = path4;
     this._key = key;
   }
   get path() {
@@ -11036,10 +11036,10 @@ function assignProp(target, prop, value) {
     configurable: true
   });
 }
-function getElementAtPath(obj, path5) {
-  if (!path5)
+function getElementAtPath(obj, path4) {
+  if (!path4)
     return obj;
-  return path5.reduce((acc, key) => acc?.[key], obj);
+  return path4.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -11359,11 +11359,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path5, issues) {
+function prefixIssues(path4, issues) {
   return issues.map((iss) => {
     var _a;
     (_a = iss).path ?? (_a.path = []);
-    iss.path.unshift(path5);
+    iss.path.unshift(path4);
     return iss;
   });
 }
@@ -20991,55 +20991,15 @@ var StdioServerTransport = class {
 
 // src/tools/core.ts
 import * as fs from "fs";
-import * as path2 from "path";
+import * as path from "path";
 
 // src/utils.ts
-import path from "path";
 function getWorkspaceRoot() {
   return process.env.WORKSPACE_DIR || process.env.CLAUDE_WORKSPACE || process.env.GEMINI_WORKSPACE || process.env.INIT_CWD || process.env.PWD || process.cwd();
 }
-function getExtensionRoot() {
-  if (process.env.CLAUDE_PLUGIN_ROOT) {
-    return process.env.CLAUDE_PLUGIN_ROOT;
-  }
-  const distDir = path.dirname(new URL(import.meta.url).pathname);
-  return path.resolve(distDir, "..");
-}
 
 // src/tools/core.ts
 function registerCoreTools(server2) {
-  server2.tool(
-    "kit_get_extension_info",
-    "Get absolute paths to the agent-kit extension directories (agents, skills, commands, scripts). Use the returned paths with the native Read tool to load agent personas and skill modules.",
-    {},
-    async () => {
-      try {
-        const root = getExtensionRoot();
-        return {
-          content: [
-            {
-              type: "text",
-              text: JSON.stringify(
-                {
-                  extensionRoot: root,
-                  agentsDir: path2.join(root, "agents"),
-                  skillsDir: path2.join(root, "skills"),
-                  commandsDir: path2.join(root, "commands"),
-                  scriptsDir: path2.join(root, "scripts")
-                },
-                null,
-                2
-              )
-            }
-          ]
-        };
-      } catch (error2) {
-        return {
-          content: [{ type: "text", text: `Error getting extension info: ${error2}` }]
-        };
-      }
-    }
-  );
   server2.tool(
     "kit_save_handoff",
     "Save a brainstorm, plan, or ticket handoff artifact to .agent-kit/handoffs/. Returns the saved file path to use in next-step instructions.",
@@ -21053,11 +21013,11 @@ function registerCoreTools(server2) {
         const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").slice(0, 19);
         const safeSlug = slug.replace(/[^a-zA-Z0-9-_]/g, "-").toLowerCase();
         const filename = `${type}-${timestamp}-${safeSlug}.md`;
-        const handoffDir = path2.join(getWorkspaceRoot(), ".agent-kit", "handoffs", `${type}s`);
+        const handoffDir = path.join(getWorkspaceRoot(), ".agent-kit", "handoffs", `${type}s`);
         if (!fs.existsSync(handoffDir)) {
           fs.mkdirSync(handoffDir, { recursive: true });
         }
-        const filePath = path2.join(handoffDir, filename);
+        const filePath = path.join(handoffDir, filename);
         fs.writeFileSync(filePath, content, "utf8");
         return {
           content: [{ type: "text", text: `\u2705 Saved to: ${filePath}` }]
@@ -21075,20 +21035,37 @@ function registerCoreTools(server2) {
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
 import * as fs2 from "fs";
-import * as path4 from "path";
+import * as path3 from "path";
 
 // src/tools/security.ts
 import { execFileSync } from "child_process";
-import * as path3 from "path";
+import * as path2 from "path";
 function sanitize(input) {
   return String(input).replace(/[;&|`$<>\\]/g, "").trim().slice(0, 500);
 }
+var FORBIDDEN_FILES = [
+  ".env",
+  ".bashrc",
+  ".zshrc",
+  ".profile",
+  ".bash_profile",
+  ".bash_history",
+  ".zsh_history",
+  "config.mjs"
+  // Some projects use this for sensitive config
+];
 function validatePath(filePath, baseDir = process.cwd()) {
-  const resolved = path3.resolve(baseDir, filePath);
-  const root = path3.resolve(baseDir);
-  if (resolved !== root && !resolved.startsWith(root + path3.sep)) {
+  const resolved = path2.resolve(baseDir, filePath);
+  const root = path2.resolve(baseDir);
+  if (resolved !== root && !resolved.startsWith(root + path2.sep)) {
     throw new Error(`Path traversal detected: ${filePath}`);
   }
+  const fileName = path2.basename(resolved);
+  if (FORBIDDEN_FILES.some(
+    (forbidden) => fileName === forbidden || fileName.startsWith(forbidden + ".")
+  )) {
+    throw new Error(`Access to sensitive file is FORBIDDEN: ${fileName}`);
+  }
   return resolved;
 }
 var GIT_TIMEOUT = parseInt(process.env.GEMINI_KIT_GIT_TIMEOUT || "30000", 10);
@@ -21114,9 +21091,9 @@ function taskSlug(task) {
   return task.toLowerCase().replace(/[^a-z0-9\s]/g, "").trim().split(/\s+/).slice(0, 6).join("-").slice(0, 48);
 }
 function initAgentLog(workspaceRoot, slug, agent) {
-  const logsDir = path4.join(workspaceRoot, ".agent-kit", "logs", "agents");
+  const logsDir = path3.join(workspaceRoot, ".agent-kit", "logs", "agents");
   fs2.mkdirSync(logsDir, { recursive: true });
-  const logFile = path4.join(logsDir, `delegate-${slug}.log`);
+  const logFile = path3.join(logsDir, `delegate-${slug}.log`);
   const header = `Agent: ${agent}
 Date: ${(/* @__PURE__ */ new Date()).toISOString()}
 ${"\u2500".repeat(60)}
@@ -21126,7 +21103,7 @@ ${"\u2500".repeat(60)}
   const logStream = fs2.createWriteStream(logFile, { flags: "a" });
   logStream.on("error", () => {
   });
-  return { logPath: path4.relative(workspaceRoot, logFile), logStream };
+  return { logPath: path3.relative(workspaceRoot, logFile), logStream };
 }
 function registerAgentTools(server2) {
   server2.tool(
@@ -21142,7 +21119,7 @@ function registerAgentTools(server2) {
       try {
         const workspaceRoot = getWorkspaceRoot();
         let prompt = task;
-        const resolvedTask = path4.resolve(workspaceRoot, task);
+        const resolvedTask = path3.resolve(workspaceRoot, task);
         if (fs2.existsSync(resolvedTask) && fs2.statSync(resolvedTask).isFile()) {
           try {
             validatePath(task, workspaceRoot);

package/dist/tools/core.js

@@ -4,41 +4,12 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { z } from 'zod';
-import { getExtensionRoot, getWorkspaceRoot } from '../utils.js';
+import { getWorkspaceRoot } from '../utils.js';
 import { DEFAULT_EXTENSIONS } from './config.js';
 /**
  * Register core tools with MCP server
  */
 export function registerCoreTools(server) {
-    // ═══════════════════════════════════════════════════════════════
-    // TOOL: GET EXTENSION INFO
-    // Returns absolute paths so agents can use native Read tool
-    // for loading agent personas and skill files
-    // ═══════════════════════════════════════════════════════════════
-    server.tool('kit_get_extension_info', 'Get absolute paths to the agent-kit extension directories (agents, skills, commands, scripts). Use the returned paths with the native Read tool to load agent personas and skill modules.', {}, async () => {
-        try {
-            const root = getExtensionRoot();
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: JSON.stringify({
-                            extensionRoot: root,
-                            agentsDir: path.join(root, 'agents'),
-                            skillsDir: path.join(root, 'skills'),
-                            commandsDir: path.join(root, 'commands'),
-                            scriptsDir: path.join(root, 'scripts'),
-                        }, null, 2),
-                    },
-                ],
-            };
-        }
-        catch (error) {
-            return {
-                content: [{ type: 'text', text: `Error getting extension info: ${error}` }],
-            };
-        }
-    });
     // ═══════════════════════════════════════════════════════════════
     // TOOL: SAVE HANDOFF
     // Writes brainstorm/plan/ticket artifacts to the workspace

package/dist/tools/security.d.ts

@@ -14,9 +14,8 @@
  */
 export declare function sanitize(input: string): string;
 /**
- * Validate file path to prevent path traversal attacks
- * Uses stricter path.sep check to prevent prefix matching flaws
- * (e.g., /.geminit-kit/handoffs/app should not match /.geminit-kit/handoffs/app-secret)
+ * Validate file path to prevent path traversal attacks and access to forbidden files.
+ * Uses stricter path.sep check to prevent prefix matching flaws.
  */
 export declare function validatePath(filePath: string, baseDir?: string): string;
 /**

package/dist/tools/security.js

@@ -25,17 +25,35 @@ export function sanitize(input) {
         .slice(0, 500); // Limit length
 }
 /**
- * Validate file path to prevent path traversal attacks
- * Uses stricter path.sep check to prevent prefix matching flaws
- * (e.g., /.geminit-kit/handoffs/app should not match /.geminit-kit/handoffs/app-secret)
+ * Sensitive files that agents are FORBIDDEN from reading/writing.
+ * Includes environment variables, shell configs, and system profiles.
+ */
+const FORBIDDEN_FILES = [
+    '.env',
+    '.bashrc',
+    '.zshrc',
+    '.profile',
+    '.bash_profile',
+    '.bash_history',
+    '.zsh_history',
+    'config.mjs', // Some projects use this for sensitive config
+];
+/**
+ * Validate file path to prevent path traversal attacks and access to forbidden files.
+ * Uses stricter path.sep check to prevent prefix matching flaws.
  */
 export function validatePath(filePath, baseDir = process.cwd()) {
     const resolved = path.resolve(baseDir, filePath);
     const root = path.resolve(baseDir);
-    // Stricter: exact match OR starts with root + separator
+    // 1. Path traversal check
     if (resolved !== root && !resolved.startsWith(root + path.sep)) {
         throw new Error(`Path traversal detected: ${filePath}`);
     }
+    // 2. Forbidden files check (exact filename or suffix)
+    const fileName = path.basename(resolved);
+    if (FORBIDDEN_FILES.some((forbidden) => fileName === forbidden || fileName.startsWith(forbidden + '.'))) {
+        throw new Error(`Access to sensitive file is FORBIDDEN: ${fileName}`);
+    }
     return resolved;
 }
 /**

package/dist/utils.d.ts

@@ -2,9 +2,3 @@
  * Utility functions for agent-kit
  */
 export declare function getWorkspaceRoot(): string;
-/**
- * Resolve path to plugin root.
- * When installed as a Claude Code plugin, CLAUDE_PLUGIN_ROOT is set automatically.
- * Falls back to resolving from the bundled file location for local development.
- */
-export declare function getExtensionRoot(): string;

package/dist/utils.js

@@ -1,7 +1,6 @@
 /**
  * Utility functions for agent-kit
  */
-import path from 'path';
 export function getWorkspaceRoot() {
     return (process.env.WORKSPACE_DIR ||
         process.env.CLAUDE_WORKSPACE ||
@@ -10,17 +9,3 @@ export function getWorkspaceRoot() {
         process.env.PWD ||
         process.cwd());
 }
-/**
- * Resolve path to plugin root.
- * When installed as a Claude Code plugin, CLAUDE_PLUGIN_ROOT is set automatically.
- * Falls back to resolving from the bundled file location for local development.
- */
-export function getExtensionRoot() {
-    // CLAUDE_PLUGIN_ROOT is set by Claude Code when plugin is installed
-    if (process.env.CLAUDE_PLUGIN_ROOT) {
-        return process.env.CLAUDE_PLUGIN_ROOT;
-    }
-    // Fallback: resolve from bundled file location (dist/kit-server.js → ../)
-    const distDir = path.dirname(new URL(import.meta.url).pathname);
-    return path.resolve(distDir, '..');
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanhnd/agent-kit",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Super Engineer - Team of AI Agents for software development (Claude Code Plugin)",
   "type": "module",
   "main": "dist/kit-server.js",