@hivehub/rulebook 5.4.1 → 5.5.1

package/templates/agents/web-app/security-reviewer.md

@@ -1,32 +1,32 @@
----
-name: security-reviewer
-domain: security
-filePatterns: ["*"]
-tier: standard
-model: sonnet
-description: "Security audit — OWASP top 10, dependency vulnerabilities, secrets detection"
-checklist:
-  - "Are there any hardcoded secrets or credentials?"
-  - "Is user input sanitized before use?"
-  - "Are dependencies free of known vulnerabilities?"
----
-
-You are a security reviewer. You find vulnerabilities before attackers do.
-
-## Review Priorities (OWASP Top 10)
-
-1. **Injection** — SQL, NoSQL, command, LDAP injection
-2. **Broken auth** — weak passwords, missing MFA, token issues
-3. **Sensitive data exposure** — secrets in code, logs, error messages
-4. **XSS** — unescaped user content in HTML/JS
-5. **CSRF** — missing tokens on state-changing requests
-6. **Insecure dependencies** — known CVEs in npm/pip/cargo packages
-
-## Output Format
-
-```
-[CRITICAL] <file>:<line> — <vulnerability type>: <description>
-[HIGH] <file>:<line> — <vulnerability type>: <description>
-```
-
-Only report CRITICAL and HIGH. Skip informational findings.
+---
+name: security-reviewer
+domain: security
+filePatterns: ["*"]
+tier: standard
+model: sonnet
+description: "Security audit — OWASP top 10, dependency vulnerabilities, secrets detection"
+checklist:
+  - "Are there any hardcoded secrets or credentials?"
+  - "Is user input sanitized before use?"
+  - "Are dependencies free of known vulnerabilities?"
+---
+
+You are a security reviewer. You find vulnerabilities before attackers do.
+
+## Review Priorities (OWASP Top 10)
+
+1. **Injection** — SQL, NoSQL, command, LDAP injection
+2. **Broken auth** — weak passwords, missing MFA, token issues
+3. **Sensitive data exposure** — secrets in code, logs, error messages
+4. **XSS** — unescaped user content in HTML/JS
+5. **CSRF** — missing tokens on state-changing requests
+6. **Insecure dependencies** — known CVEs in npm/pip/cargo packages
+
+## Output Format
+
+```
+[CRITICAL] <file>:<line> — <vulnerability type>: <description>
+[HIGH] <file>:<line> — <vulnerability type>: <description>
+```
+
+Only report CRITICAL and HIGH. Skip informational findings.

package/templates/ci/rulebook-review.yml

@@ -1,26 +1,26 @@
-name: Rulebook AI Review
-
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-jobs:
-  ai-review:
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Run Rulebook AI Review
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          npx @hivehub/rulebook@latest review --output github-comment --fail-on major
+name: Rulebook AI Review
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  ai-review:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Run Rulebook AI Review
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          npx @hivehub/rulebook@latest review --output github-comment --fail-on major

package/templates/cli/AIDER.md

@@ -1,49 +1,49 @@
-<!-- AIDER:START -->
-# Aider CLI Rules
-
-**Tool**: AI pair programming in terminal (`pip install aider-chat`)
-
-## Quick Start
-
-```bash
-# Always include AGENTS.md
-aider AGENTS.md src/feature.ts tests/feature.test.ts
-
-# In chat:
-"Follow AGENTS.md standards. Implement [feature] with tests first."
-```
-
-## Essential Commands
-
-```bash
-/add file.ts          # Add files to context
-/drop file.ts         # Remove from context
-/run npm test         # Run command
-/commit "message"     # Commit changes
-/undo                 # Undo last change
-/diff                 # Review changes
-```
-
-## Configuration (.aider.conf.yml)
-
-```yaml
-model: gpt-4
-read: [AGENTS.md]
-lint: true
-lint-cmd: "npm run lint"
-test-cmd: "npm test"
-auto-commits: true
-commit-prompt: true
-```
-
-## Workflow
-
-1. Start session with `aider AGENTS.md [files]`
-2. Request: "Follow AGENTS.md. Implement [feature] with tests first (95%+ coverage)"
-3. Review diffs with `/diff`
-4. Test with `/run npm test`
-5. Commit with `/commit "feat: description"`
-
-**Critical**: Always reference AGENTS.md in your requests for consistent standards.
-
-<!-- AIDER:END -->
+<!-- AIDER:START -->
+# Aider CLI Rules
+
+**Tool**: AI pair programming in terminal (`pip install aider-chat`)
+
+## Quick Start
+
+```bash
+# Always include AGENTS.md
+aider AGENTS.md src/feature.ts tests/feature.test.ts
+
+# In chat:
+"Follow AGENTS.md standards. Implement [feature] with tests first."
+```
+
+## Essential Commands
+
+```bash
+/add file.ts          # Add files to context
+/drop file.ts         # Remove from context
+/run npm test         # Run command
+/commit "message"     # Commit changes
+/undo                 # Undo last change
+/diff                 # Review changes
+```
+
+## Configuration (.aider.conf.yml)
+
+```yaml
+model: gpt-4
+read: [AGENTS.md]
+lint: true
+lint-cmd: "npm run lint"
+test-cmd: "npm test"
+auto-commits: true
+commit-prompt: true
+```
+
+## Workflow
+
+1. Start session with `aider AGENTS.md [files]`
+2. Request: "Follow AGENTS.md. Implement [feature] with tests first (95%+ coverage)"
+3. Review diffs with `/diff`
+4. Test with `/run npm test`
+5. Commit with `/commit "feat: description"`
+
+**Critical**: Always reference AGENTS.md in your requests for consistent standards.
+
+<!-- AIDER:END -->

package/templates/cli/AMAZON_Q.md

@@ -1,25 +1,25 @@
-<!-- AMAZON_Q:START -->
-# Amazon Q Developer Rules
-
-**Tool**: AWS-focused AI assistant with security scanning
-
-## Quick Start
-
-Available in AWS IDE Toolkit or via AWS Console.
-
-## Usage
-
-```
-"Follow @AGENTS.md standards. Implement [feature] with tests (95%+ coverage)."
-```
-
-## Workflow
-
-1. Reference AGENTS.md in prompts
-2. Leverage Q's security scanning for vulnerabilities
-3. Review generated code
-4. Run quality checks
-
-**Critical**: Q excels at AWS/security - combine with AGENTS.md standards.
-
-<!-- AMAZON_Q:END -->
+<!-- AMAZON_Q:START -->
+# Amazon Q Developer Rules
+
+**Tool**: AWS-focused AI assistant with security scanning
+
+## Quick Start
+
+Available in AWS IDE Toolkit or via AWS Console.
+
+## Usage
+
+```
+"Follow @AGENTS.md standards. Implement [feature] with tests (95%+ coverage)."
+```
+
+## Workflow
+
+1. Reference AGENTS.md in prompts
+2. Leverage Q's security scanning for vulnerabilities
+3. Review generated code
+4. Run quality checks
+
+**Critical**: Q excels at AWS/security - combine with AGENTS.md standards.
+
+<!-- AMAZON_Q:END -->

package/templates/cli/AUGGIE.md

@@ -1,32 +1,32 @@
-<!-- AUGGIE:START -->
-# Auggie (Augment CLI) Rules
-
-**Tool**: TDD mode and intelligent refactoring
-
-## Quick Start
-
-```bash
-npm install -g augment-cli
-augment --tdd
-```
-
-## Usage
-
-```bash
-# TDD mode with AGENTS.md:
-augment --tdd --context AGENTS.md
-
-# In prompts:
-"Follow @AGENTS.md. Write tests for [feature], then implement."
-```
-
-## Workflow
-
-1. Use `--tdd` flag for test-first development
-2. Include `--context AGENTS.md`
-3. Auggie writes tests, then implementation
-4. Review and verify coverage
-
-**Critical**: TDD mode aligns perfectly with AGENTS.md test-first approach.
-
-<!-- AUGGIE:END -->
+<!-- AUGGIE:START -->
+# Auggie (Augment CLI) Rules
+
+**Tool**: TDD mode and intelligent refactoring
+
+## Quick Start
+
+```bash
+npm install -g augment-cli
+augment --tdd
+```
+
+## Usage
+
+```bash
+# TDD mode with AGENTS.md:
+augment --tdd --context AGENTS.md
+
+# In prompts:
+"Follow @AGENTS.md. Write tests for [feature], then implement."
+```
+
+## Workflow
+
+1. Use `--tdd` flag for test-first development
+2. Include `--context AGENTS.md`
+3. Auggie writes tests, then implementation
+4. Review and verify coverage
+
+**Critical**: TDD mode aligns perfectly with AGENTS.md test-first approach.
+
+<!-- AUGGIE:END -->

package/templates/cli/CLAUDE.md

@@ -1,117 +1,117 @@
-<!-- CLAUDE:START -->
-# Claude API/CLI Rules
-
-**Tool**: Anthropic Claude API with 200K context window
-
-## Quick Start
-
-```bash
-export ANTHROPIC_API_KEY=your_key
-# Use via API or compatible CLIs
-```
-
-## Usage
-
-In API requests or CLI prompts, include:
-```
-"Follow these project standards from AGENTS.md:
-[paste relevant AGENTS.md sections]
-
-Implement [feature] with tests first (95%+ coverage)."
-```
-
-## Workflow
-
-1. Include AGENTS.md content in system prompt or context
-2. Request features with standards reference
-3. Review generated code
-4. Run quality checks
-5. Save learnings to persistent memory
-
-**Critical**: Claude has 200K context - paste full AGENTS.md for best results.
-
-## ⚠️ Token Optimization (CRITICAL)
-
-**MINIMIZE unnecessary output to reduce token consumption:**
-
-### DO ✅
-- Output code directly without explanations
-- Use code comments for complex logic instead of markdown
-- Return results concisely: "✅ Done" or "❌ Error: reason"
-- Use tables only when absolutely necessary
-- Combine multiple small outputs into single response
-
-### DON'T ❌
-- **NEVER generate markdown reports or summaries** unless explicitly requested
-- **NEVER use excessive heading levels** (#, ##, ###, etc.)
-- **NEVER create "Quality Checks" sections** with status boxes
-- **NEVER output commit messages verbatim** - just say "committed"
-- **NEVER explain what you did** - assume user knows project structure
-- **NEVER use emoji status lines** (✅ Type check: Passed) - too verbose
-- **NEVER generate "Next Steps" sections** - just do the work
-- **NEVER output implementation details in plain text** - put in code comments
-
-### Example: BAD (Wastes Tokens)
-```
-✅ Implementation Complete
-
-📝 Changes:
-- Added UserService class
-- Added authentication middleware
-- Updated routes configuration
-
-🧪 Quality Checks:
-- ✅ Type check: Passed
-- ✅ Linting: Passed (0 warnings)
-- ✅ Tests: 45/45 passed (100%)
-- ✅ Coverage: 96% (threshold: 95%)
-
-📊 Summary:
-This implementation adds...
-
-Next Steps:
-1. Review the code
-2. Deploy to production
-```
-
-### Example: GOOD (Efficient)
-```
-✅ Done. UserService added with auth middleware.
-```
-
-Put details in code comments, not markdown.
-
-## Persistent Memory Integration
-
-### Search for Past Context
-Before implementing a feature, search memory for similar past work:
-
-```bash
-# Search for past implementations
-rulebook memory search "feature name" --mode hybrid --type feature
-
-# View timeline of related work
-rulebook memory timeline --memoryId <id>
-```
-
-### Save Implementation Insights
-After completing implementation, capture key learnings:
-
-```bash
-# Save feature implementation
-rulebook memory save "Implemented [feature] with [approach]. Key decision: [why]. Gotcha: [edge case]. Pattern: [reusable solution]" --type feature --title "[Feature name]" --tags tag1,tag2
-
-# Save bugfix insights
-rulebook memory save "Fixed [bug] by [solution]. Root cause: [why it happened]. Test case: [added validation]" --type bugfix --title "[Bug description]" --tags bugfix,area
-
-# Save architectural decisions
-rulebook memory save "Chose [approach] over [alternative] because [reasoning]. Tradeoffs: [what was sacrificed]. Future implications: [impact on architecture]" --type decision --title "[Decision name]" --tags architecture,decision
-```
-
-### Use Context from Memory
-When Claude Code returns, your memory system auto-captures learnings. Review and augment:
-1. Search relevant memories: `rulebook memory search "your topic"`
-2. Review 3-layer search results: compact → timeline → full details
-3. Reference past patterns in new implementations
-
-<!-- CLAUDE:END -->
+<!-- CLAUDE:START -->
+# Claude API/CLI Rules
+
+**Tool**: Anthropic Claude API with 200K context window
+
+## Quick Start
+
+```bash
+export ANTHROPIC_API_KEY=your_key
+# Use via API or compatible CLIs
+```
+
+## Usage
+
+In API requests or CLI prompts, include:
+```
+"Follow these project standards from AGENTS.md:
+[paste relevant AGENTS.md sections]
+
+Implement [feature] with tests first (95%+ coverage)."
+```
+
+## Workflow
+
+1. Include AGENTS.md content in system prompt or context
+2. Request features with standards reference
+3. Review generated code
+4. Run quality checks
+5. Save learnings to persistent memory
+
+**Critical**: Claude has 200K context - paste full AGENTS.md for best results.
+
+## ⚠️ Token Optimization (CRITICAL)
+
+**MINIMIZE unnecessary output to reduce token consumption:**
+
+### DO ✅
+- Output code directly without explanations
+- Use code comments for complex logic instead of markdown
+- Return results concisely: "✅ Done" or "❌ Error: reason"
+- Use tables only when absolutely necessary
+- Combine multiple small outputs into single response
+
+### DON'T ❌
+- **NEVER generate markdown reports or summaries** unless explicitly requested
+- **NEVER use excessive heading levels** (#, ##, ###, etc.)
+- **NEVER create "Quality Checks" sections** with status boxes
+- **NEVER output commit messages verbatim** - just say "committed"
+- **NEVER explain what you did** - assume user knows project structure
+- **NEVER use emoji status lines** (✅ Type check: Passed) - too verbose
+- **NEVER generate "Next Steps" sections** - just do the work
+- **NEVER output implementation details in plain text** - put in code comments
+
+### Example: BAD (Wastes Tokens)
+```
+✅ Implementation Complete
+
+📝 Changes:
+- Added UserService class
+- Added authentication middleware
+- Updated routes configuration
+
+🧪 Quality Checks:
+- ✅ Type check: Passed
+- ✅ Linting: Passed (0 warnings)
+- ✅ Tests: 45/45 passed (100%)
+- ✅ Coverage: 96% (threshold: 95%)
+
+📊 Summary:
+This implementation adds...
+
+Next Steps:
+1. Review the code
+2. Deploy to production
+```
+
+### Example: GOOD (Efficient)
+```
+✅ Done. UserService added with auth middleware.
+```
+
+Put details in code comments, not markdown.
+
+## Persistent Memory Integration
+
+### Search for Past Context
+Before implementing a feature, search memory for similar past work:
+
+```bash
+# Search for past implementations
+rulebook memory search "feature name" --mode hybrid --type feature
+
+# View timeline of related work
+rulebook memory timeline --memoryId <id>
+```
+
+### Save Implementation Insights
+After completing implementation, capture key learnings:
+
+```bash
+# Save feature implementation
+rulebook memory save "Implemented [feature] with [approach]. Key decision: [why]. Gotcha: [edge case]. Pattern: [reusable solution]" --type feature --title "[Feature name]" --tags tag1,tag2
+
+# Save bugfix insights
+rulebook memory save "Fixed [bug] by [solution]. Root cause: [why it happened]. Test case: [added validation]" --type bugfix --title "[Bug description]" --tags bugfix,area
+
+# Save architectural decisions
+rulebook memory save "Chose [approach] over [alternative] because [reasoning]. Tradeoffs: [what was sacrificed]. Future implications: [impact on architecture]" --type decision --title "[Decision name]" --tags architecture,decision
+```
+
+### Use Context from Memory
+When Claude Code returns, your memory system auto-captures learnings. Review and augment:
+1. Search relevant memories: `rulebook memory search "your topic"`
+2. Review 3-layer search results: compact → timeline → full details
+3. Reference past patterns in new implementations
+
+<!-- CLAUDE:END -->