@smartsoft001-mobilems/claude-plugins 2.76.0 → 2.78.0

package/plugins/flow/skills/review/SKILL.md

@@ -0,0 +1,443 @@
+---
+name: review
+description: Run parallel multi-dimensional code review using Agent Teams. Spawns specialized reviewers for quality, tests, security, and accessibility/performance.
+allowed-tools:
+  - Bash
+  - Read
+  - Glob
+  - Grep
+  - Task
+  - TaskCreate
+  - TaskUpdate
+  - TaskList
+  - TaskGet
+  - AskUserQuestion
+  - mcp__linear-server__get_issue
+  - mcp__linear-server__list_comments
+  - mcp__linear-server__create_comment
+---
+
+# Review Skill
+
+Run parallel multi-dimensional code review using Agent Teams. Spawns specialized reviewers for quality, tests, security, and accessibility/performance.
+
+## Execution Checklist
+
+Execute each step in order. Do not skip any step marked as MANDATORY.
+
+- [ ] **1. Determine review scope** — analyze git diff for changed files + affected projects
+- [ ] **2. Check team prerequisites** — verify `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1`
+- [ ] **3. Create Review Board team** — spawn 4 specialized reviewer teammates
+- [ ] **4. Monitor reviews** — track task completions, handle questions between reviewers
+- [ ] **5. Synthesize findings** — delegate to `shared-report-synthesizer`
+- [ ] **6. Post to Linear** — create single review comment in Polish
+- [ ] **7. Present to user** — show findings with severity ratings
+- [ ] **8. Cleanup team**
+
+### Task Progress Tracking
+
+**MANDATORY**: Use Claude Code's built-in task tracking to provide real-time progress visibility.
+
+**Task naming convention**: Every task subject MUST be prefixed with the Linear task ID (or scope):
+
+```
+[REVIEW] <linearTaskId> <step description>
+```
+
+**At skill start**: Create tasks for each review dimension:
+
+```
+TaskCreate({
+  subject: "[REVIEW] MM-123 Quality review",
+  description: "Lint, type-check, code style, import ordering",
+  activeForm: "[REVIEW] MM-123 Running quality review"
+})
+```
+
+## Role
+
+**You are an experienced code review lead** with:
+
+- Over 10 years of reviewing production code
+- Deep knowledge of TypeScript, Angular, NestJS security patterns
+- WCAG 2.1 accessibility expertise
+- Performance optimization and bundle analysis skills
+- Ability to coordinate multiple review perspectives
+
+You produce reviews that are:
+
+- **Thorough**: covering quality, tests, security, and accessibility
+- **Actionable**: each finding has a clear severity and fix recommendation
+- **Balanced**: acknowledging good patterns alongside issues
+- **Prioritized**: critical issues first, minor suggestions last
+
+## Usage
+
+```
+/review [linearTaskId]        # Review changes for a Linear task
+/review --staged              # Review all staged changes
+/review --diff=main           # Review diff against main branch
+```
+
+## Parameters
+
+- `linearTaskId` - Linear task ID (e.g., ENG-123)
+- `--staged` - Review all staged changes (no Linear task required)
+- `--diff=<branch>` - Review diff against specified branch
+
+## Instructions
+
+### Step 1: Determine Review Scope
+
+Analyze the changes to review:
+
+**If `linearTaskId` provided:**
+
+1. Fetch task from Linear via MCP
+2. Find related branch/commits via `git log --all --grep="<taskId>"`
+3. Determine changed files via `git diff main...<branch>`
+
+**If `--staged` provided:**
+
+1. Use `git diff --cached --name-only` to find staged files
+2. Use `git diff --cached` for full diff
+
+**If `--diff=<branch>` provided:**
+
+1. Use `git diff <branch>...HEAD --name-only` for changed files
+2. Use `git diff <branch>...HEAD` for full diff
+
+**Extract:**
+
+- List of changed files with change type (added/modified/deleted)
+- Affected Nx projects (from file paths)
+- Change statistics (lines added/removed per file)
+
+### Step 2: Check Team Prerequisites
+
+**Check `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1`**:
+
+If env var is NOT set:
+
+→ Fall back to sequential review using `shared-verification-orchestrator` agent.
+
+```
+Tryb zespołowy niedostępny — brak CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1.
+Uruchamiam sekwencyjną weryfikację...
+```
+
+Run the `shared-verification-orchestrator` pipeline and present results. Stop here.
+
+**If env var IS set** → Continue to Step 3.
+
+### Step 3: Create Review Board Team
+
+Create 4 specialized reviewer tasks and spawn teammates:
+
+#### Reviewer 1: Quality Reviewer
+
+```
+TaskCreate({
+  subject: "[REVIEW] <taskId> Quality review: lint and type-check",
+  description: "Check lint errors, TypeScript type safety, code style, import ordering",
+  activeForm: "[REVIEW] <taskId> Running quality review"
+})
+```
+
+**Spawn prompt:**
+
+```
+You are the Quality Reviewer in a Review Board for [scope description].
+
+Changed files:
+[list of changed files with diffs]
+
+YOUR FOCUS:
+- Run linting: `nx lint [project]` for each affected project
+- Run type-check: `npx tsc --noEmit` for affected projects
+- Check code style: naming conventions, function length, complexity
+- Verify import ordering matches ESLint rules
+- Check for unused imports, dead code, TODO comments
+- Verify Angular modern APIs (signals, @if/@for, inject())
+
+DELEGATE TO existing agents as needed:
+- `shared-style-enforcer` for detailed style analysis
+- `shared-verification-runner` for running lint/type-check commands
+
+OUTPUT FORMAT:
+## Quality Review Report
+
+### Critical Issues
+- [issue] — severity: CRITICAL — file: path/to/file.ts:line
+
+### Warnings
+- [warning] — severity: MEDIUM — file: path/to/file.ts:line
+
+### Passed Checks
+- [x] Check passed
+
+### Summary
+Issues found: X critical, Y medium, Z low
+Recommendation: PASS / PASS_WITH_WARNINGS / BLOCK
+```
+
+#### Reviewer 2: Test Reviewer
+
+```
+TaskCreate({
+  subject: "[REVIEW] <taskId> Test review: coverage and quality",
+  description: "Unit test coverage, test quality, AAA pattern compliance",
+  activeForm: "[REVIEW] <taskId> Running test review"
+})
+```
+
+**Spawn prompt:**
+
+```
+You are the Test Reviewer in a Review Board for [scope description].
+
+Changed files:
+[list of changed files with diffs]
+
+YOUR FOCUS:
+- Run unit tests: `nx test [project] --coverage` for affected projects
+- Check coverage meets 90% minimum for new code
+- Verify AAA pattern (Arrange-Act-Assert) in all test files
+- Check test naming: describe('@smartsoft001-mobilems/...'), it('should...')
+- Verify mock patterns match project conventions
+- Check for missing edge case tests
+- Verify no skipped tests (xit, xdescribe)
+
+DELEGATE TO existing agents as needed:
+- `shared-coverage-enforcer` for coverage analysis
+- `shared-test-runner` for test execution
+
+OUTPUT FORMAT:
+## Test Review Report
+
+### Critical Issues
+- [issue] — severity: CRITICAL — file: path/to/file.spec.ts:line
+
+### Warnings
+- [warning] — severity: MEDIUM — file: path/to/file.spec.ts:line
+
+### Coverage Report
+| Project | Coverage | Required | Status |
+| --- | --- | --- | --- |
+| [project] | 85% | 90% | ❌ BELOW |
+
+### Passed Checks
+- [x] Check passed
+
+### Summary
+Issues found: X critical, Y medium, Z low
+Recommendation: PASS / PASS_WITH_WARNINGS / BLOCK
+```
+
+#### Reviewer 3: Security Reviewer
+
+```
+TaskCreate({
+  subject: "[REVIEW] <taskId> Security review: OWASP and deps",
+  description: "OWASP top 10, dependency audit, secrets detection",
+  activeForm: "[REVIEW] <taskId> Running security review"
+})
+```
+
+**Spawn prompt:**
+
+```
+You are the Security Reviewer in a Review Board for [scope description].
+
+Changed files:
+[list of changed files with diffs]
+
+YOUR FOCUS:
+- Check for OWASP Top 10 vulnerabilities in changed code:
+  - XSS (innerHTML, bypassSecurityTrust*, template injection)
+  - SQL/NoSQL injection (unsanitized query parameters)
+  - Broken authentication (token handling, session management)
+  - Sensitive data exposure (logging secrets, hardcoded credentials)
+  - CSRF protection
+- Run dependency audit: `npm audit --audit-level=moderate`
+- Check for hardcoded secrets, API keys, tokens
+- Verify input validation at system boundaries
+- Check for insecure HTTP calls (http:// vs https://)
+- Review authorization checks in backend code
+
+DELEGATE TO existing agents as needed:
+- `shared-security-scanner` for automated security scanning
+
+OUTPUT FORMAT:
+## Security Review Report
+
+### Critical Issues
+- [issue] — severity: CRITICAL — file: path/to/file.ts:line — OWASP: [category]
+
+### Warnings
+- [warning] — severity: MEDIUM — file: path/to/file.ts:line
+
+### Dependency Audit
+- Vulnerabilities found: [count by severity]
+
+### Passed Checks
+- [x] Check passed
+
+### Summary
+Issues found: X critical, Y medium, Z low
+Recommendation: PASS / PASS_WITH_WARNINGS / BLOCK
+```
+
+#### Reviewer 4: A11y + Performance Reviewer
+
+```
+TaskCreate({
+  subject: "[REVIEW] <taskId> A11y + Performance review",
+  description: "WCAG 2.1 accessibility, bundle sizes, performance patterns",
+  activeForm: "[REVIEW] <taskId> Running a11y + performance review"
+})
+```
+
+**Spawn prompt:**
+
+```
+You are the Accessibility & Performance Reviewer in a Review Board for [scope description].
+
+Changed files:
+[list of changed files with diffs]
+
+YOUR FOCUS (Accessibility):
+- WCAG 2.1 compliance in templates:
+  - Alt text for images
+  - ARIA labels for interactive elements
+  - Keyboard navigation support
+  - Color contrast (check Tailwind classes)
+  - Focus management
+  - Semantic HTML usage
+- Screen reader compatibility
+
+YOUR FOCUS (Performance):
+- Bundle size impact (new imports, lazy loading)
+- Change detection optimization (OnPush, signals)
+- Template performance (trackBy/@for track, computed signals)
+- Memory leaks (unsubscribed observables, event listeners)
+- Unnecessary re-renders
+
+DELEGATE TO existing agents as needed:
+- `ui-a11y-validator` for accessibility scanning
+- `shared-performance-validator` for performance analysis
+
+OUTPUT FORMAT:
+## A11y + Performance Review Report
+
+### Critical Issues
+- [issue] — severity: CRITICAL — file: path/to/file.ts:line — type: A11Y/PERF
+
+### Warnings
+- [warning] — severity: MEDIUM — file: path/to/file.ts:line
+
+### Accessibility Audit
+- WCAG violations: [count]
+- Missing ARIA labels: [count]
+
+### Performance Impact
+- New dependencies added: [list]
+- Bundle size estimate: [impact]
+
+### Passed Checks
+- [x] Check passed
+
+### Summary
+Issues found: X critical, Y medium, Z low
+Recommendation: PASS / PASS_WITH_WARNINGS / BLOCK
+```
+
+### Step 4: Monitor Reviews
+
+While teammates are working:
+
+1. **Track progress** via `TaskList` — check which reviewers have completed
+2. **Handle cross-reviewer communication**:
+   - When a reviewer finishes with CRITICAL or HIGH findings, broadcast to other reviewers
+   - Example: Security reviewer finds XSS → notify Quality reviewer to check sanitization
+3. **Wait for all reviewers** to complete (or timeout after reasonable period)
+
+**Cross-reviewer broadcast logic:**
+
+```
+When reviewer finishes:
+  IF findings contain CRITICAL or HIGH severity:
+    FOR each other active reviewer:
+      Send broadcast: "[Reviewer] found [severity] issue: [summary]"
+      Ask them to check related areas
+```
+
+### Step 5: Synthesize Findings
+
+After all 4 reviewers complete:
+
+1. **Collect all reports** from reviewer tasks
+2. **Delegate to `shared-report-synthesizer`** with:
+   - Team type: REVIEW
+   - All 4 reviewer reports
+   - Linear task ID (if available)
+
+The synthesizer will:
+
+- Merge findings by category
+- Deduplicate identical issues
+- Flag conflicts between reviewers
+- Produce single Polish-language report
+
+### Step 6: Post to Linear
+
+**If `linearTaskId` was provided:**
+
+Post the synthesized review report as a comment on the Linear task via MCP.
+
+**If `--staged` or `--diff`:**
+
+Skip Linear posting (no task to attach to).
+
+### Step 7: Present to User
+
+Show the synthesized review results to the user:
+
+1. **Overall verdict**: PASS / PASS_WITH_WARNINGS / BLOCK
+2. **Summary table** with per-dimension results
+3. **Critical issues** requiring immediate attention
+4. **Warnings** for consideration
+5. **Passed checks** for confidence
+
+### Step 8: Cleanup Team
+
+Mark all review tasks as completed and clean up team resources.
+
+## Fallback: Sequential Review
+
+When `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` is NOT set, run a sequential review:
+
+1. Delegate to `shared-verification-orchestrator` for the full 5-stage pipeline
+2. Present results to user
+3. Post to Linear if task ID provided
+
+This provides the same verification coverage, just without the parallelism and specialization.
+
+## Guidelines
+
+1. **All Linear comments in Polish** — review reports posted to Linear must be in Polish
+2. **User-facing output can be in user's language** — terminal output matches user's language
+3. **Severity ratings are mandatory** — every finding must have CRITICAL/HIGH/MEDIUM/LOW
+4. **Recommendations must be actionable** — don't just flag issues, suggest fixes
+5. **Respect existing patterns** — don't flag patterns that are established conventions
+6. **Consider context** — new code vs modified code may have different standards
+7. **Be constructive** — balance criticism with positive observations
+8. **Track everything** — use TaskCreate/TaskUpdate for visibility into review progress
+
+## Agent Team Mode (Experimental)
+
+**Prerequisite**: `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` in settings.
+
+**Activation**: Automatic when env var is set.
+
+**Fallback**: If env var not set, skill runs in standard sequential mode via `shared-verification-orchestrator`.

package/plugins/flow-external/.claude-plugin/README.md

@@ -0,0 +1,152 @@
+# Flow-External Plugin for Claude Code
+
+Development flow skills for **standalone Angular 6-11 projects** without the MobileMS framework. These are external projects using Angular CLI with their own styling approach (Bootstrap 4, custom SCSS, or other).
+
+## Target Projects
+
+This plugin is designed for standalone MobileMS projects:
+
+- **mobilems-asp** (Angular 11)
+- **mobilems-etno** (Angular 11)
+- **mobilems-mnw** (Angular 9)
+- **mobilems-muzuem-malopolskie** (Angular 8)
+- **mobilems-muzeum-powstan-slaskich** (Angular 6)
+
+### Technology Stack
+
+| Feature | External Projects |
+|---------|-------------------|
+| Angular | 6 - 11 |
+| Build system | Angular CLI (`ng`) |
+| Styling | Project-specific (Bootstrap 4 / custom SCSS) |
+| i18n | ngx-translate + LocalizeRouter |
+| State | NgRx + localStorage sync |
+| Project structure | Standalone (app/cli/docker) |
+
+### Patterns (what this plugin supports)
+
+| Feature | External (Angular 6-11) | Legacy (Angular 14) | Modern (Angular 20+) |
+|---------|-------------------------|---------------------|----------------------|
+| Control flow | `*ngIf`, `*ngFor` | `*ngIf`, `*ngFor` | `@if`, `@for` |
+| DI | Constructor injection | Constructor injection | `inject()` |
+| Inputs/Outputs | `@Input()`, `@Output()` | `@Input()`, `@Output()` | `input()`, `output()` |
+| State | BehaviorSubject, NgRx | BehaviorSubject | Signals |
+| Components | NgModules | NgModules | Standalone |
+| Styling | Bootstrap 4 / custom SCSS | Tailwind CSS | Tailwind CSS |
+| Build | `ng build` | `nx build` | `nx build` |
+
+## Workflow Skills
+
+| Skill | Description |
+|-------|-------------|
+| `/commit` | Create conventional commit based on Linear task |
+| `/impl` | Implement plans from Linear task comments |
+| `/plan` | Create implementation plan and save to Linear |
+| `/push` | Push changes and update Linear status |
+
+## Installation
+
+### 1. Enable plugin in project's `.claude/settings.json`:
+
+```json
+{
+  "enabledPlugins": {
+    "flow-external@mobilems": true
+  }
+}
+```
+
+### 2. Merge permissions from template
+
+Run the merge script:
+
+```bash
+node node_modules/@smartsoft001-mobilems/claude-plugins/plugins/flow-external/.claude-plugin/merge-permissions.js
+```
+
+## Required MCP Servers
+
+Configure these in your `.mcp.json`:
+
+- `linear-server` - Linear API integration
+- `playwright` - Browser automation for screenshots
+
+## Permission Strategy
+
+### Automatic (allow)
+- Git read operations (status, diff, log, show)
+- Angular CLI commands (ng build, ng lint, ng serve)
+- Linear API (read/write issues, comments)
+- Playwright (screenshots)
+- Utility skills
+
+### Requires Confirmation (ask)
+- Workflow skills (/commit, /impl, /plan, /push)
+- `git commit` - creating commits
+- `git push` - pushing to remote
+- `gh pr create` - creating pull requests
+
+## Utility Skills
+
+| Skill | Description |
+|-------|-------------|
+| `maia-files-upload` | Upload files to Maia API |
+| `maia-files-delete` | Delete files from Maia API |
+| `browser-capture` | Capture screenshots with Playwright |
+| `linear-suggestion` | Create Linear issues for improvements |
+| `a11y-audit` | Accessibility audit |
+
+## Agents
+
+### Angular Agents (Legacy CLI patterns)
+- `angular-component-scaffolder` - Components with NgModules, `*ngIf`/`*ngFor`, constructor DI
+- `angular-service-builder` - Services with BehaviorSubject, constructor DI
+- `angular-state-builder` - NgRx state management with reducers and effects
+- `angular-directive-builder` - Directives with constructor DI
+- `angular-pipe-builder` - Pipes with constructor DI
+- `angular-guard-builder` - Class-based guards with constructor DI
+- `angular-resolver-builder` - Class-based resolvers with constructor DI
+
+### Shared Agents
+- `shared-impl-orchestrator` - Implementation orchestration
+- `shared-impl-reporter` - Implementation reporting
+- `shared-linear-subtask-iterator` - Linear subtask iteration
+- `shared-build-verifier` - Build verification via `ng build`
+- `shared-ui-classifier` - UI change classification
+- `ui-web-designer` - Styling with project-specific approach (Bootstrap 4 or custom SCSS)
+
+## Differences from other plugins
+
+| Aspect | `flow` (modern) | `flow-legacy` | `flow-external` |
+|--------|-----------------|---------------|-----------------|
+| Angular version | 20+ | 14 | 6-11 |
+| Build system | Nx | Nx | Angular CLI |
+| Styling | Tailwind | Tailwind | Project-specific |
+| State | Signals | BehaviorSubject | NgRx + BehaviorSubject |
+| Project structure | Nx monorepo | Nx monorepo | Standalone app/ |
+
+## Example Project Structure
+
+```
+project-root/
+  app/                    # Frontend Angular application
+    src/
+      app/
+        components/
+        services/
+        pipes/
+        directives/
+        interceptors/
+        guards/
+        state/            # NgRx store
+      assets/
+      environments/
+    angular.json
+    package.json
+    tsconfig.json
+  cli/                    # CLI scripts
+    frontend-cli
+  docker/                 # Docker configuration
+    Dockerfile
+  .env
+```

package/plugins/flow-external/.claude-plugin/merge-permissions.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * Merge flow-external plugin permissions into project's .claude/settings.json
+ *
+ * Usage:
+ *   npx @smartsoft001-mobilems/claude-plugins flow-external:merge-permissions
+ *
+ * Or directly:
+ *   node node_modules/@smartsoft001-mobilems/claude-plugins/plugins/flow-external/.claude-plugin/merge-permissions.js
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const SETTINGS_PATH = path.join(process.cwd(), '.claude', 'settings.json');
+const TEMPLATE_PATH = path.join(__dirname, 'settings.template.json');
+
+function loadJson(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch (e) {
+    return null;
+  }
+}
+
+function mergeArrays(existing, template) {
+  return [...new Set([...existing, ...template])];
+}
+
+function main() {
+  console.log('Flow-External Plugin - Merge Permissions\n');
+
+  // Load template
+  const template = loadJson(TEMPLATE_PATH);
+  if (!template) {
+    console.error('ERROR: Could not load template from:', TEMPLATE_PATH);
+    process.exit(1);
+  }
+
+  // Load or create settings
+  let settings = loadJson(SETTINGS_PATH);
+  if (!settings) {
+    console.log('Creating new .claude/settings.json...');
+    fs.mkdirSync(path.dirname(SETTINGS_PATH), { recursive: true });
+    settings = { permissions: { allow: [], deny: [], ask: [] } };
+  }
+
+  // Ensure permissions structure exists
+  settings.permissions = settings.permissions || { allow: [], deny: [], ask: [] };
+  settings.permissions.allow = settings.permissions.allow || [];
+  settings.permissions.ask = settings.permissions.ask || [];
+  settings.permissions.deny = settings.permissions.deny || [];
+
+  // Count before
+  const beforeAllow = settings.permissions.allow.length;
+  const beforeAsk = settings.permissions.ask.length;
+
+  // Merge permissions
+  settings.permissions.allow = mergeArrays(settings.permissions.allow, template.permissions.allow);
+  settings.permissions.ask = mergeArrays(settings.permissions.ask, template.permissions.ask);
+
+  // Enable plugin
+  settings.enabledPlugins = settings.enabledPlugins || {};
+  settings.enabledPlugins['flow-external@mobilems'] = true;
+
+  // Write back
+  fs.writeFileSync(SETTINGS_PATH, JSON.stringify(settings, null, 2) + '\n');
+
+  // Report
+  const addedAllow = settings.permissions.allow.length - beforeAllow;
+  const addedAsk = settings.permissions.ask.length - beforeAsk;
+
+  console.log('Permissions merged successfully!\n');
+  console.log(`  allow: ${beforeAllow} -> ${settings.permissions.allow.length} (+${addedAllow})`);
+  console.log(`  ask:   ${beforeAsk} -> ${settings.permissions.ask.length} (+${addedAsk})`);
+  console.log(`\nPlugin enabled: flow-external@mobilems`);
+  console.log(`\nFile updated: ${SETTINGS_PATH}`);
+}
+
+main();

package/plugins/flow-external/.claude-plugin/plugin.json

@@ -0,0 +1,5 @@
+{
+  "name": "flow-external",
+  "description": "Development flow skills for standalone Angular 6-11 museum projects without framework (Angular CLI, Karma/Jasmine, Bootstrap 4)",
+  "version": "2.78.0"
+}