@sjawhar/claude-envoy 0.0.0 → 1.0.0

package/legion/skills/thermonuclear-code-quality/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cursor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/legion/skills/thermonuclear-code-quality/SKILL.md

@@ -0,0 +1,60 @@
+---
+name: thermonuclear-code-quality
+description: Use when asked for a thermonuclear code-quality review or a deep maintainability audit of a branch or PR diff. Also use when asked to review abstraction quality, oversized files or ad-hoc branching growth.
+disable-model-invocation: true
+---
+
+# Thermonuclear Code Quality
+
+If this skill disagrees with the code, a command's output or its `--help`, follow those and say which line of this skill is wrong.
+
+Make your own scratch with `mktemp -d` and delete only the paths you made, each by its exact
+path. Never delete by a glob in a shared directory: every role of this issue writes into the same
+`$TMPDIR` on the issue's volume, so a sweep like `rm -rf "$TMPDIR"/tmp.*` deletes directories
+another role has open.
+
+This is a maintainability review of one diff: the current branch's changes, or the range you are given. Every remedy keeps behavior the same and removes code or concepts, or moves code where a reader finds it without reading the rest of the file, because a behavior change is work for `skill://thermonuclear-deep-review`, not a cleanup. The table's last two rows change ordering or failure behavior: say so in the finding.
+
+## Report
+
+The first line is the verdict, with the short sha of the head you reviewed (`git rev-parse --short=8 HEAD`, or the sha your brief names when you have no shell):
+
+- `Verdict: APPROVE at <sha>` when no finding stands.
+- `Verdict: CHANGES at <sha>` when one does.
+
+Put nothing before it: a PR gate reads only the first line of a posted report.
+
+Then one entry per finding: `path:line`, the smell, the cost it adds, and the remedy, so the author can act on it without asking. Report few findings, each one you are sure of: a long list hides the ones that block. Order them so the costliest is read first: step 2's structural regressions and missed code-judo moves, then rows 2-3, 7-8, 1, 9-10, then the rest. Write each as a plain request: `this adds another special-case branch to an already busy flow. Move it into its own function.`
+
+## Steps
+
+1. Read the diff and each changed file around its hunks. Flag lines the diff adds or changes, and existing code it makes harder to follow, such as a function it lengthens or adds a branch or parameter to. A finding on code the diff leaves alone blocks the PR for work it did not cause.
+2. Look for the code-judo move first: a restructure onto the existing architecture that deletes whole branches, helpers, modes, conditionals or layers. A structural fix often removes the line-level findings with it.
+3. For a refactor, count the concepts (the types, functions, flags and modes) a reader must know before and after. A move that keeps the count is not a simplification: say so, rather than accept a cleaner version of the same idea. When the problem is structural, do not suggest a rename, which hides the finding that matters.
+4. Check every hunk against the table below, because each row is a smell this review blocks on. For file size, compare `git show <base>:<path> | wc -l` with `wc -l <path>`; `<base>` is the range start your brief names, else `git merge-base HEAD origin/<default branch>`.
+5. Before you report a finding, quote its line at the reviewed head. For a boundary, type or duplicate-helper claim, also read the callers (`grep` the symbol) and the existing helper you name. A finding built on a misread costs the author a round.
+6. Report only a cost you can name (the table's Cost column). A preference or a micro-optimization with no such cost is not a finding. When a structural finding exists, leave out naming and style nits, because they bury it.
+7. Ask for a new abstraction (a type, module or policy object) only when the code shows two real callers or two ways it will change. With one, the abstraction is the thin wrapper row 6 flags.
+
+## Smells and remedies
+
+| Smell | Cost | Remedy |
+|---|---|---|
+| The PR pushes a file from under 1000 lines to over 1000 | more to scan for every change | Decompose it first into helpers, modules or local abstractions. Accept the growth only when the PR names the caller or constraint that keeps the code in that file. |
+| Ad-hoc conditionals, special cases, one-off booleans, nullable modes or flags in unrelated or busy flows. A branch for one input value in the middle of a busy function. A branch whose name or comment says it is temporary. | each later change reads every branch | Reframe the state model so the conditionals disappear, not only move to one place. Make the special case part of a simpler default flow. Else move it into its own function, or behind an abstraction step 7 allows. |
+| Repeated conditionals or condition chains | each new case edits every chain | A typed model or an explicit dispatcher. |
+| Copy-pasted logic or duplicate branches | a fix lands in one copy | Extract a helper or pure function. Collapse into one flow. |
+| Hacky, brittle or "magic" behavior, such as reading a value by its string form or position. Generic mechanisms that hide simple data-shape assumptions. | the assumption breaks with no error | Direct code that states the assumption: a typed field, a named constant, an explicit check. |
+| Thin wrappers, identity abstractions, pass-through helpers | one more layer to cross | Delete the layer. |
+| Unnecessary optionality, `unknown`, `any`, casts, loose ad-hoc objects. A silent fallback over an unclear invariant. | the type hides what the value is | Explicit typed models or shared contracts, so the control flow gets simpler. |
+| Feature logic in shared paths. Implementation details leaking through APIs. Logic in the wrong file, layer or package. | every caller of the shared path pays | Move it to the package whose existing code already reads or writes that data (`grep` its type). |
+| A bespoke helper where the repository already has one that does the same | two helpers drift apart | Reuse the existing helper; name it as `path:line`. |
+| A module that became more coupled (a new import of another package), stateful (new module-level state) or hard to scan. Orchestration mixed with business logic. | a change to one concern touches the others | Split into focused modules. Separate orchestration from business logic. |
+| Independent work run in sequence | an order nothing needs | Run it in parallel, only when the parallel code is also simpler. |
+| Related updates that can leave state half-applied | a failure leaves state no code expects | A more atomic flow. |
+
+## Approval bar
+
+- A structural regression, a hacky or magic abstraction, a boundary leak, or a missed obvious decomposition blocks whatever the PR says, because no evidence makes the code easier to change.
+- Every other finding blocks, and the verdict is CHANGES, unless the PR gives evidence that the simpler form fails: a caller it breaks, a measured cost, or a constraint outside the diff that the PR names with `path:line` or a link. "It works" and "tests pass" are no such evidence, because this review judges structure, not behavior.
+- State a blocking finding as blocking, directly and without rudeness. A "maybe" or "consider" finding reads as optional and gets skipped.

package/legion/skills/thermonuclear-deep-review/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cursor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/legion/skills/thermonuclear-deep-review/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: thermonuclear-deep-review
+description: Use when asked for a thermonuclear or deep review, or for a security and correctness audit of a branch or PR diff. Covers bugs, breaking changes, security issues, developer-experience regressions and feature-gate leaks.
+disable-model-invocation: true
+---
+
+# Thermonuclear Deep Review
+
+If this skill disagrees with the code, a command's output or its `--help`, follow those and say which line of this skill is wrong.
+
+Make your own scratch with `mktemp -d` and delete only the paths you made, each by its exact
+path. Never delete by a glob in a shared directory: every role of this issue writes into the same
+`$TMPDIR` on the issue's volume, so a sweep like `rm -rf "$TMPDIR"/tmp.*` deletes directories
+another role has open.
+
+## Verdict
+
+The first line of the report is the verdict, in exactly this form, because a PR gate reads only that line:
+
+- `Verdict: CHANGES at <sha>` when the report has a Medium or High finding.
+- `Verdict: APPROVE at <sha>` when it has none. Minor findings do not block.
+
+Priority: trace each finding end to end first. Minor changes no behavior, hides no error and breaks no gate; any other finding is Medium, or High when the report holds its trace, because developers who get false High findings stop listening.
+
+`<sha>`: `git rev-parse --short=8 HEAD` at the head you reviewed, or the sha your brief names when you have no shell.
+
+## Scope
+
+Audit the checked-out branch. Report issues in code its diff adds or modifies, in the unchanged consumers check 2 finds, and in the PR body's claims (check 6), because the author fixes only this diff and the diff never shows them.
+
+## Checks
+
+1. **Breakage.** Trace each change through its callers and contracts, across packages and modules, because breaks show outside the changed lines.
+2. **Consumers.** For each behavior the diff changes, name its consumers and show that each one still works. Behaviors: log level, status code, exception type, metric or field name, payload shape, identity or uniqueness key, timing, retry, default. Tracing callers misses consumers, many outside the diff, the package or the repository:
+   - alert and monitor predicates (a monitor on `status:error` stops when a line goes down to WARNING)
+   - log-level contracts, structured-log field names, log-derived metric filters
+   - status codes and error-type strings in request logs, webhooks and audit records
+   - identity or uniqueness keys that a persistence layer arbitrates on
+   - dashboards, SLOs, saved queries, downstream parsers
+
+   If you cannot find a consumer, say so, because an assumed-away consumer breaks silently. A change that removes its own alarm is High, because it also removes the signal that would catch it.
+3. **Developer experience.** Find changes to how developers run or build the code locally, because no test catches them. Examples: where or how the code reads secrets, new or renamed environment variables, remapped ports or networking, a new script that must run for a feature to keep working. Not a break: a new alternative way to run or build, or a new package-manager dependency, unless it needs a step the README or AGENTS.md does not list, such as a manual install from a website or app store.
+4. **Feature leaks.** Trace each feature flag or internal-only check and its callers, because a leak ships a feature to users a gate excludes.
+5. **Intended breakage.** A high-risk effect the PR body names and bounds (who it affects, how to undo it) is not a defect, because the author chose it. Report one it does not, or one that removes a safeguard or feature gate.
+6. **PR body claims.** Attack each safety or correctness claim in the PR body, because the diff does not show whether a claim in prose is true. Attack these first:
+   - Order, not coverage: after a pipeline sanitizes, can any later pass create or recreate what the sanitizer neutralized?
+   - An input called safe because another program escapes it depends on that program: rate the finding as if it did not.
+
+## Security Guidelines
+
+For each row whose surface the diff touches, answer with a file:line citation, because an answer without one cannot be checked.
+
+| Tag | If the diff touches… | Answer, with file:line |
+| --- | --- | --- |
+| `authz` | an authorization or refusal check, or a new route, command, or tool | who may call it, who may not, where the diff enforces that, and what the unauthorized caller gets |
+| `secret` | a token, grant, secret file, credential helper, or its lifetime | what widened: who can read it, for how long, in which process |
+| `untrusted-input` | a subprocess, argv, path, template, or query built from text an outside party controls (an issue body, a PR comment, a webhook payload, model output) | the boundary that neutralizes it, and whether any later pass can re-create what it neutralized (order, not coverage) |
+| `prompt` | a prompt that embeds untrusted text into an agent's instructions | what delimits the untrusted region, and what the agent may do if it obeys that text (OWASP LLM01 prompt injection, LLM06 excessive agency) |
+| `supply-chain` | a dependency, lockfile, base image, or GitHub Action | the version, the pin (a digest or a SHA checked against its tag), and the permissions the workflow runs with |
+| `sandbox` | a sandbox or pod manifest, a capability, or a network policy | which isolation property changed, and against whom |
+| `agent-def` | an agent definition, skill, role prompt, `.omp/` config, or `AGENTS.md` | whether this diff can steer its own reviewers, and, if so, what a reviewer must check by hand |
+| `transport` | TLS or certificate verification, a signature, an HMAC, a randomness source, or a read or write that untrusted input sizes with no bound | what changed, the check or bound it relies on, and the ASVS identifier it maps to |
+
+- Cite an OWASP ASVS v5.0.0 identifier where one applies (`v5.0.0-1.2.5` style), so the author can find it.
+- A security finding with no stated exploit path is hardening, ranked Minor. One that states an exploit path is its own finding at its real priority, so no exploit is filed as optional.
+- Report at most two hardening items, ranked, and put the rest in one paragraph, so they do not bury findings.
+- Start each security finding with its row's tag, `Security[<tag>]:`, so readers can count findings by row.
+- End the report with one `Security:` line, because the Legion reviewer copies it: each touched row's tag and its answer with file:line, or `Security: no sensitive surface in this diff.` when the diff touches none.
+
+## Findings
+
+- Never report a finding whose open question you can settle by reading code, because the author cannot act on a guess. When you cannot settle it, say what you searched and where.
+
+## PR discussion
+
+Only after your own audit, so others' findings do not steer it, and only with a Medium or High finding on a branch that has a PR:
+
+1. Read the PR/MR's comments and review comments, bots' included, with `gh` or `glab`.
+2. Check their findings in the code: a comment is not evidence. Include the valid ones you missed; for one you share, add their evidence if yours lacks it.
+3. Mark each finding that came from that discussion, so readers can tell it from yours.

package/package.json

@@ -1 +1,49 @@
-{"name":"@sjawhar/claude-envoy","version":"0.0.0","description":"Placeholder. Real releases are published from cybermonklabs/legion with provenance.","license":"MIT","repository":{"type":"git","url":"git+https://github.com/cybermonklabs/legion.git"}}
+{
+  "name": "@sjawhar/claude-envoy",
+  "version": "1.0.0",
+  "license": "Apache-2.0",
+  "description": "Claude Code channel plugin for Legion's Envoy bus",
+  "type": "module",
+  "files": [
+    ".claude-plugin/**",
+    ".mcp.json",
+    ".omp-plugin/**",
+    "bin/**",
+    "dist/**",
+    "hooks/**",
+    "legion/**",
+    "scripts/**",
+    "skills/**",
+    "src/**",
+    "README.md",
+    "AGENTS.md"
+  ],
+  "legion": {
+    "daemonApiVersion": 49
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/cybermonklabs/legion"
+  },
+  "scripts": {
+    "channel": "bun bin/envoy-channel.ts",
+    "verify-build": "bash scripts/verify-build.sh",
+    "prepack": "bash scripts/pack-skills.sh",
+    "postpack": "bash scripts/pack-skills.sh --restore",
+    "typecheck": "bunx tsc --noEmit",
+    "test": "bun test --timeout=60000",
+    "lint": "bunx biome check src/ hooks/ scripts/"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "^2.3.14",
+    "@legion/contracts": "0.10.0",
+    "@legion/envoy-client": "0.1.0",
+    "@legion/pi-shared": "0.1.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "bun-types": "latest",
+    "ky": "^2.0.2",
+    "nats": "^2.29.2",
+    "typescript": "^5.3.0",
+    "zod": "4.3.6"
+  }
+}

package/scripts/build-inputs.txt

@@ -0,0 +1,84 @@
+# Every git pathspec whose files can change the Claude Code plugin's build (dist/ and legion/,
+# built by scripts/build.ts and checked by scripts/verify-build.sh).
+#
+# Format: one git pathspec per line, relative to the repository root. A line that is empty or
+# starts with # is ignored. Nothing else is special: a pathspec line holds the pathspec alone, with
+# no trailing comment.
+#
+# Who reads it:
+# - a person, and release.yaml's $CLAUDE_ENVOY_VERSION_ARGS, which carries this list's package
+#   and content paths by hand: the release's version is bumped from the commits since the newest
+#   claude-envoy-v* tag that touch them, so a source missing from both is one no release
+#   publishes a new version for. A path added or dropped here is owed the same change there.
+#   The toolchain entries below (.bun-version, bunfig.toml, bun.lock, the root package.json, the
+#   .gitattributes files and the .github paths) are not among them, as no plugin's version
+#   arguments carry theirs: a lockfile or runner change alone releases nothing, and the next
+#   source commit publishes whatever it built.
+# - tests/build-inputs.test.ts, which runs the build and fails when a file the bundles or the
+#   Legion plugin read is not matched: each bundle's sources, the manifest, tsconfig and license
+#   files of each workspace package they reach, the lockfile, root manifest and patches that decide
+#   what bun install puts in node_modules, and the skills and agents buildLegionPlugin reads. The
+#   rest is listed by hand and no test checks it: .bun-version, bunfig.toml, the
+#   .gitattributes files, scripts/third-party-notices.ts (and any other module build.ts imports
+#   from outside the packages below), scripts/pi-plugin-prepack.sh and the three .github paths at
+#   the end. A change that makes build.ts or verify-build.sh read a new file adds it here.
+#
+# The rule: whole package directories are listed and only known non-inputs are excluded, so a file
+# nobody thought of counts as an input. That is the safe direction: a false "changed" costs one
+# extra patch release, while a false "unchanged" leaves npm's newest release behind its inputs
+# with nothing queued to catch it up.
+#
+# This file is inside packages/claude-envoy, listed below, so a change to the list is itself an
+# input change.
+
+# build.ts assertPinnedBun refuses any other Bun; .github/actions/setup-bun installs this version.
+.bun-version
+
+# bun install: decides node_modules, which the bundles inline and whose licenses the notices carry.
+bun.lock
+package.json
+bunfig.toml
+patches
+
+# .gitattributes decides the bytes a checkout holds, which the bundler then reads.
+.gitattributes
+packages/.gitattributes
+
+# The bundles' sources and the workspace packages they reach: sources, manifests, tsconfig, license
+# and notice files (scripts/third-party-notices.ts). Also this package's build.ts, verify-build.sh
+# and this list.
+packages/claude-envoy
+packages/envoy-client
+packages/contracts
+packages/pi-shared
+packages/broker-client
+
+# The build's outputs themselves, not inputs.
+:(exclude)packages/claude-envoy/dist
+:(exclude)packages/claude-envoy/legion
+
+# Known non-inputs inside the packages above: changelogs, guides and tests, which no build reads.
+:(exclude,glob)packages/*/.changes/**
+:(exclude,glob)packages/*/CHANGELOG.md
+:(exclude,glob)packages/*/AGENTS.md
+:(exclude,glob)packages/*/README.md
+:(exclude,glob)packages/*/tests/**
+:(exclude,glob)packages/*/test/**
+:(exclude,glob)packages/**/__tests__/**
+:(exclude,glob)packages/**/*.test.ts
+
+# build.ts buildLegionPlugin converts these into legion/agents.
+packages/pi-legion/agents
+
+# scripts/pi-plugin-prepack.sh --stage-skills stages pi-legion's skills into legion/skills. All of
+# skills/ rather than pi-legion's share, so the partition is kept in that script alone.
+skills
+
+# build.ts runs these: the notices of the inlined packages, and the skill staging.
+scripts/third-party-notices.ts
+scripts/pi-plugin-prepack.sh
+
+# The build jobs run these through verify-build.sh, which runs check-built.
+.github/scripts/check-private-names.sh
+.github/scripts/release-push.sh
+.github/actions/setup-bun