@ryuenn3123/agentic-senior-core 5.8.26 → 5.9.0

package/.agents/plugins/agentic-senior-core/hooks/lib/known-security-patterns.json

@@ -0,0 +1,26 @@
+{
+  "description": "Regex patterns for recurring security anti-patterns",
+  "patterns": [
+    {
+      "id": "insecure-redirect",
+      "regex": "location\\.href\\s*=\\s*(?!['\"`])([^;\\n]+)",
+      "message": "Unvalidated redirect target assigned to location.href. Ensure the variable is sanitized or use a safe routing method."
+    },
+    {
+      "id": "timing-unsafe-compare",
+      "regex": "(password|secret|token|key)\\s*(===|!==|==|!=)",
+      "message": "Non-timing-safe string comparison on a secret variable. Use crypto.timingSafeEqual instead."
+    },
+    {
+      "id": "user-input-http",
+      "regex": "(axios|fetch|got|superagent)\\s*\\(\\s*.*?(req\\.(query|body|params)|process\\.env)",
+      "message": "Potentially unsafe input passed directly into an HTTP client. Validate and sanitize URL parameters first."
+    }
+  ],
+  "fileSpecific": {
+    "Dockerfile": {
+      "require": "^(?=.*\\nUSER\\s).*$",
+      "message": "Missing USER instruction in Dockerfile. The container will run as root by default."
+    }
+  }
+}

package/.agents/plugins/agentic-senior-core/hooks/post-edit-enforce.js

@@ -29,6 +29,14 @@ try {
   }
 } catch (_) {}
 
+let SECURITY_PATTERNS = { patterns: [], fileSpecific: {} };
+try {
+  const secPath = path.join(__dirname, 'lib', 'known-security-patterns.json');
+  if (fs.existsSync(secPath)) {
+    SECURITY_PATTERNS = JSON.parse(fs.readFileSync(secPath, 'utf8'));
+  }
+} catch (_) {}
+
 const SOURCE_EXTENSIONS = new Set([
   'js', 'ts', 'mjs', 'cjs', 'jsx', 'tsx',
   'py', 'rb', 'go', 'rs', 'java', 'kt', 'swift', 'cs',
@@ -145,7 +153,6 @@ function processSingleEdit(toolName, toolInput, emitFn, skipArray) {
     checkDependencyAddition(toolName, toolInput, findings);
   }
 
-  const ext = path.extname(filePath).slice(1);
   if (SOURCE_EXTENSIONS.has(ext)) {
     if (toolName === 'Edit') {
       checkLocDelta(toolInput, filePath, findings);
@@ -154,6 +161,11 @@ function processSingleEdit(toolName, toolInput, emitFn, skipArray) {
     }
   }
 
+  checkSecurityPatterns(toolName, toolInput, filePath, findings);
+  if (ext === 'js' || ext === 'ts' || ext === 'jsx' || ext === 'tsx' || ext === 'mjs' || ext === 'cjs') {
+    checkLinter(filePath, findings);
+  }
+
   checkLivingDocNudge(filePath, findings);
 
   if (ext !== 'md') {
@@ -238,6 +250,58 @@ function checkNewFileSize(toolInput, filePath, findings) {
   }
 }
 
+function checkSecurityPatterns(toolName, toolInput, filePath, findings) {
+  var target = toolName === 'Edit' ? (toolInput.new_string || '') : (toolInput.content || '');
+  if (!target) return;
+  
+  if (SECURITY_PATTERNS.patterns) {
+    SECURITY_PATTERNS.patterns.forEach(function (p) {
+      try {
+        var regex = new RegExp(p.regex, 'ig');
+        if (regex.test(target)) {
+          findings.push('[ASC Security] ' + p.message);
+        }
+      } catch (_) {}
+    });
+  }
+
+  var basename = path.basename(filePath);
+  if (SECURITY_PATTERNS.fileSpecific && SECURITY_PATTERNS.fileSpecific[basename]) {
+    var spec = SECURITY_PATTERNS.fileSpecific[basename];
+    try {
+      var regex = new RegExp(spec.require, 'g');
+      if (target.trim().length > 0 && !regex.test(target)) {
+        findings.push('[ASC Security] ' + spec.message);
+      }
+    } catch (_) {}
+  }
+}
+
+function checkLinter(filePath, findings) {
+  try {
+    var cwd = process.cwd();
+    var hasEslint = fs.existsSync(path.join(cwd, '.eslintrc.json')) || 
+                    fs.existsSync(path.join(cwd, '.eslintrc.js')) || 
+                    fs.existsSync(path.join(cwd, 'eslint.config.js')) ||
+                    (fs.existsSync(path.join(cwd, 'package.json')) && fs.readFileSync(path.join(cwd, 'package.json'), 'utf8').includes('eslintConfig'));
+    
+    if (hasEslint) {
+      var execSync = require('child_process').execSync;
+      execSync('npx eslint "' + filePath + '" --format json', { cwd: cwd, stdio: 'pipe' });
+    }
+  } catch (error) {
+    if (error.stdout) {
+      try {
+        var out = JSON.parse(error.stdout.toString());
+        if (Array.isArray(out) && out.length > 0 && out[0].messages && out[0].messages.length > 0) {
+          var firstErr = out[0].messages[0];
+          findings.push('[ASC Linter] ' + firstErr.message + ' at line ' + firstErr.line + '.');
+        }
+      } catch (_) {}
+    }
+  }
+}
+
 function checkLivingDocNudge(filePath, findings) {
   var lower = filePath.toLowerCase();
   if (lower.includes('schema') || lower.includes('migration') || lower.includes('model') || lower.includes('prisma')) {

package/.agents/plugins/agentic-senior-core/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.8.26",
+  "version": "5.9.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "contextFileName": "rules/agentic-senior-core.md",
   "rules": [

package/.agents/plugins/agentic-senior-core/skills/asc-add-feature/SKILL.md

@@ -38,11 +38,12 @@ Format:
 
 1. On approval of Phase 1, update `workflow-gate.json` phase to `plan`.
 2. Ensure `docs/PRD.md` or feature brief exists.
-3. Create a numbered, step-by-step implementation plan with specific files, functions, and line references.
-4. Include a "Don't Build" list from the research phase.
-5. **Callout: Plan-Reading Illusion.** Ask the user to explicitly verify the plan against the codebase, not just skim it.
-6. Output the plan.
-7. **STOP and wait for user approval.** Do not implement.
+3. Check if `.github/workflows/asc-quality-gate.yml` exists. If not, include scaffolding it in your plan (must run linter, type-check, and audit) and remind the user to enable Branch Protection.
+4. Create a numbered, step-by-step implementation plan with specific files, functions, and line references.
+5. Include a "Don't Build" list from the research phase.
+6. **Callout: Plan-Reading Illusion.** Ask the user to explicitly verify the plan against the codebase, not just skim it.
+7. Output the plan.
+8. **STOP and wait for user approval.** Do not implement.
 
 ## Phase 3: Implement
 

package/.agents/plugins/agentic-senior-core/skills/asc-new-project/SKILL.md

@@ -53,6 +53,7 @@ Format:
 2. Run Anti Context-Blindness check: verify entities/tables mentioned in `Schema.md` or `Architecture.md` align with proposed code targets.
 3. Build against the approved specs. Apply the ASC decision ladder on every file.
 4. Run the decision ladder: does this need to exist? Does stdlib cover it? One function or full module?
+5. Generate a `.github/workflows/asc-quality-gate.yml` file that runs linter, type-check, and dependency audit on `push` and `pull_request`. Remind the user to enable Branch Protection in GitHub (require status checks to pass) to enforce this gate globally.
 
 ## Phase 4: Validate
 

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-senior-core",
-  "version": "5.8.26",
+  "version": "5.9.0",
   "description": "Universal AI coding rules. Write code like a staff engineer.",
   "author": "fatidaprilian",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ryuenn3123/agentic-senior-core",
-  "version": "5.8.26",
+  "version": "5.9.0",
   "type": "module",
   "description": "Agentic Senior Core: Universal AI coding rules and workflows. Write code like a staff engineer, not a junior.",
   "bin": {

package/plugin.yaml

@@ -1,5 +1,5 @@
 name: agentic-senior-core
-version: 5.8.26
+version: 5.9.0
 description: Universal AI coding rules. Write code like a staff engineer.
 author: fatidaprilian
 provides_hooks: