aiblueprint-cli 1.4.40 → 1.4.42

package/claude-code-config/skills/{workflow-apex → apex}/steps/step-05-examine.md

@@ -21,10 +21,12 @@ next_step: steps/step-06-resolve.md
 
 ## EXECUTION PROTOCOLS:
 
-- 🎯 Launch parallel review agents (unless economy_mode)
+- 🎯 Launch 3+ parallel review agents via Task tool in ONE message (unless economy_mode)
+- 🛑 NEVER launch only 1 review agent — you MUST launch Security + Logic + Clean Code as separate agents
 - 💾 Document all findings with severity
 - 📖 Create todos for each finding
 - 🚫 FORBIDDEN to skip security analysis
+- 🚫 FORBIDDEN to combine review categories into a single agent
 
 ## CONTEXT BOUNDARIES:
 
@@ -32,6 +34,7 @@ next_step: steps/step-06-resolve.md
 - All tests pass
 - Now looking for issues that tests miss
 - Adversarial mindset - assume bugs exist
+- **If `{teams_mode}` = true:** Agent team is still alive. Do NOT shutdown teammates — that happens in step-09-finish only.
 
 ## YOUR TASK:
 
@@ -102,38 +105,80 @@ Group files: source, tests, config, other.
 ```
 
 **If `{economy_mode}` = false:**
-→ Launch parallel review agents
+→ Launch parallel review agents using the **Task tool**
 
-**CRITICAL: Launch ALL in a SINGLE message:**
+**🛑 CRITICAL: You MUST launch ALL 3 agents (or 4 if Next.js) in a SINGLE message using MULTIPLE Task tool calls. DO NOT launch them one at a time. DO NOT use only 1 agent. Each agent reviews a DIFFERENT aspect.**
 
-**Agent 1: Security** (`code-reviewer`)
+First, gather the list of modified files:
+```bash
+git diff --name-only HEAD~1
 ```
-Review for OWASP Top 10:
-- Injection flaws
-- Auth/authz issues
-- Data exposure
-- Security misconfiguration
+
+Then, in **ONE message with 3+ parallel Task tool calls**, launch:
+
+---
+
+**Agent 1: Security Review** — `subagent_type: "code-reviewer"`
+```
+prompt: |
+  You are a SECURITY reviewer. Review ONLY the following files for security vulnerabilities:
+  {list of modified files}
+
+  Focus exclusively on:
+  - OWASP Top 10: injection flaws (SQL, command, XSS)
+  - Authentication and authorization issues
+  - Sensitive data exposure (secrets, tokens, PII in logs)
+  - Security misconfiguration
+  - Insecure deserialization
+  - Missing input validation at system boundaries
+
+  For each finding, provide: file:line, severity (CRITICAL/HIGH/MEDIUM/LOW), description, and suggested fix.
+  If no security issues found, explicitly state "No security issues found."
 ```
 
-**Agent 2: Logic** (`code-reviewer`)
+---
+
+**Agent 2: Logic & Edge Cases Review** — `subagent_type: "code-reviewer"`
 ```
-Review for:
-- Edge cases not handled
-- Race conditions
-- Null handling
-- Incorrect logic
+prompt: |
+  You are a LOGIC reviewer. Review ONLY the following files for logic correctness:
+  {list of modified files}
+
+  Focus exclusively on:
+  - Edge cases not handled (empty arrays, null/undefined, boundary values)
+  - Race conditions and concurrency issues
+  - Incorrect conditional logic or off-by-one errors
+  - Missing error handling for failure modes
+  - State management bugs
+  - Incorrect assumptions about data shape or types
+
+  For each finding, provide: file:line, severity (CRITICAL/HIGH/MEDIUM/LOW), description, and suggested fix.
+  If no logic issues found, explicitly state "No logic issues found."
 ```
 
-**Agent 3: Clean Code** (`code-reviewer`)
+---
+
+**Agent 3: Clean Code & Quality Review** — `subagent_type: "code-reviewer"`
 ```
-Review for:
-- SOLID violations
-- Code smells
-- Complexity issues
-- Duplication >20 lines
+prompt: |
+  You are a CLEAN CODE reviewer. Review ONLY the following files for code quality:
+  {list of modified files}
+
+  Focus exclusively on:
+  - SOLID principle violations
+  - Code smells (long methods, god objects, feature envy)
+  - Cyclomatic complexity > 10
+  - Code duplication > 20 lines
+  - Naming that doesn't communicate intent
+  - Functions doing too many things
+
+  For each finding, provide: file:line, severity (CRITICAL/HIGH/MEDIUM/LOW), description, and suggested fix.
+  If no quality issues found, explicitly state "No quality issues found."
 ```
 
-**Agent 4: Vercel/Next.js Best Practices** (CONDITIONAL)
+---
+
+**Agent 4: Vercel/Next.js Best Practices** (CONDITIONAL — launch alongside Agents 1-3)
 
 → **Detection:** Check if modified files match Next.js/Vercel patterns:
 ```
@@ -145,22 +190,32 @@ Review for:
 - Server components, client components
 ```
 
-→ **If Next.js/Vercel code detected:**
+→ **If Next.js/Vercel code detected:** Add a 4th parallel Task tool call:
 
-Launch additional agent using Skill tool:
-```yaml
-skill: "vercel-react-best-practices"
+`subagent_type: "code-reviewer"`
+```
+prompt: |
+  You are a NEXT.JS / REACT PERFORMANCE reviewer. Review ONLY the following files:
+  {list of modified files}
+
+  Focus exclusively on:
+  - Sequential awaits that should use Promise.all for parallel fetching
+  - Barrel imports causing bundle bloat (import from index files)
+  - Missing dynamic imports for heavy client components
+  - Server-side caching opportunities (React cache, unstable_cache)
+  - Unnecessary re-renders (missing memo, useMemo, useCallback)
+  - Wrong Server vs Client component boundaries
+  - Data fetching patterns (preloading, parallel fetching, waterfall detection)
+
+  For each finding, provide: file:line, severity (CRITICAL/HIGH/MEDIUM/LOW), description, and suggested fix.
+  If no performance issues found, explicitly state "No performance issues found."
 ```
 
-This agent reviews for:
-- Async parallel patterns (Promise.all vs sequential awaits)
-- Bundle optimization (barrel imports, dynamic imports)
-- Server-side caching (React cache, unstable_cache)
-- Re-render optimization (memo, useMemo, useCallback usage)
-- Server vs Client component boundaries
-- Data fetching patterns (preloading, parallel fetching)
+→ **If NOT Next.js/Vercel code:** Skip this agent (launch only Agents 1-3)
+
+---
 
-→ **If NOT Next.js/Vercel code:** Skip this agent
+**🛑 REMINDER: You MUST have 3+ Task tool calls in a SINGLE response. If you only launched 1 agent, you are doing it WRONG. Go back and launch all agents.**
 
 ### 4. Classify Findings
 
@@ -257,10 +312,12 @@ Append to `{output_dir}/05-examine.md`:
 
 ## FAILURE MODES:
 
+❌ **CRITICAL**: Launching only 1 review agent instead of 3+ — each category (Security, Logic, Clean Code) MUST be a separate agent
+❌ Combining multiple review categories into a single agent prompt
 ❌ Skipping security review
 ❌ Not classifying by severity
 ❌ Auto-dismissing findings
-❌ Launching agents sequentially
+❌ Launching agents sequentially instead of in parallel
 ❌ Using subagents when economy_mode
 ❌ Skipping Vercel/Next.js review when React/Next.js files are modified
 ❌ **CRITICAL**: Not using AskUserQuestion for review → resolve/test transition

package/claude-code-config/skills/{workflow-apex → apex}/steps/step-06-resolve.md

@@ -31,6 +31,7 @@ next_step: COMPLETE
 - Some are Real, some Noise, some Uncertain
 - User may want different resolution strategies
 - Must validate after any changes
+- **If `{teams_mode}` = true:** Agent team is still alive. Do NOT shutdown teammates — that happens in step-09-finish only.
 
 ## YOUR TASK:
 

package/claude-code-config/skills/{workflow-apex → apex}/steps/step-09-finish.md

@@ -25,7 +25,7 @@ previous_step: step-08-run-tests.md (or step-04-validate.md if no tests)
 
 ## CONTEXT BOUNDARIES:
 
-- Variables available: `{task_id}`, `{task_description}`, `{branch_name}`, `{pr_mode}`, `{auto_mode}`, `{save_mode}`, `{output_dir}`
+- Variables available: `{task_id}`, `{task_description}`, `{branch_name}`, `{pr_mode}`, `{auto_mode}`, `{save_mode}`, `{teams_mode}`, `{output_dir}`
 - Previous steps completed: analyze, plan, execute, validate (+ optional: tests, examine)
 - All implementation should be done at this point
 
@@ -37,6 +37,32 @@ Finalize the APEX workflow by committing remaining changes, pushing to remote, a
 
 ## EXECUTION SEQUENCE:
 
+### 0. Shutdown Agent Team (if teams_mode)
+
+<critical>
+This is the ONLY step where team shutdown should happen.
+All previous steps (validate, examine, resolve) keep the team alive.
+</critical>
+
+**If `{teams_mode}` = true:**
+
+1. Send shutdown_request to each teammate:
+```
+SendMessage:
+  type: "shutdown_request"
+  recipient: "impl-{name}"
+  content: "APEX workflow complete. Shutting down team."
+```
+
+2. Wait for all teammates to confirm shutdown.
+
+3. Delete the team:
+```
+TeamDelete
+```
+
+→ This cleans up team files and task directories.
+
 ### 1. Verify Git Status
 
 ```bash
@@ -167,6 +193,8 @@ Display workflow completion summary:
 
 ## SUCCESS METRICS:
 
+✅ Agent team shut down gracefully via SendMessage shutdown_request (if teams_mode)
+✅ TeamDelete called to clean up team resources (if teams_mode)
 ✅ All changes committed
 ✅ Branch pushed to remote
 ✅ PR created with proper title and description (if pr_mode)
@@ -189,5 +217,7 @@ Display workflow completion summary:
 This is the final step of the APEX workflow. No next step to load.
 
 <critical>
-Remember: This step ONLY handles git operations and PR creation. All code changes should have been completed in earlier steps.
+Remember: This step handles git operations, PR creation, AND team shutdown (if teams_mode).
+All code changes should have been completed in earlier steps.
+Team shutdown MUST happen here — step 0 of execution sequence — before git operations.
 </critical>

package/claude-code-config/skills/{workflow-apex → apex}/templates/00-context.md

@@ -17,6 +17,7 @@
 | Branch mode (`-b`) | {{branch_mode}} |
 | PR mode (`-pr`) | {{pr_mode}} |
 | Interactive mode (`-i`) | {{interactive_mode}} |
+| Tasks mode (`-k`) | {{tasks_mode}} |
 | Branch name | {{branch_name}} |
 
 ---
@@ -42,6 +43,7 @@ _To be defined in step-01-analyze.md_
 | 00-init | ⏸ Pending | |
 | 01-analyze | ⏸ Pending | |
 | 02-plan | ⏸ Pending | |
+| 02b-tasks | {{tasks_status}} | |
 | 03-execute | ⏸ Pending | |
 | 04-validate | ⏸ Pending | |
 | 05-examine | {{examine_status}} | |

package/claude-code-config/skills/{meta-claude-memory → claude-memory}/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: claude-memory
 description: Create and optimize CLAUDE.md memory files or .claude/rules/ modular rules for Claude Code projects. Comprehensive guidance on file hierarchy, content structure, path-scoped rules, best practices, and anti-patterns. Use when working with CLAUDE.md files, .claude/rules directories, setting up new projects, or improving Claude Code's context awareness.
-argument-hint: [task description or "optimize"]
+argument-hint: [init | optimize | task description]
 ---
 
 <core_principle>
@@ -168,6 +168,64 @@ Before creating or updating memory files, use AskUserQuestion:
 | Path rules not applying | Verify glob pattern matches target files |
 </workflow>
 
+<init_workflow>
+## `/claude-memory init` — Create Minimal CLAUDE.md
+
+When the user argument contains "init", execute this workflow to scaffold a CLAUDE.md with only the essential sections.
+
+### Step 1: Detect project context
+
+Read `package.json` (or equivalent: `pyproject.toml`, `Cargo.toml`, `go.mod`, etc.) to detect:
+- Project name
+- Tech stack (framework, language)
+- Available scripts/commands (dev, build, test)
+
+Also check for existing linter configs (ESLint, Biome, Prettier, tsconfig) — do NOT include rules they already enforce.
+
+### Step 2: Identify important files
+
+Scan for non-obvious architecture-critical files. Look for:
+- Auth config files
+- Server action wrappers, API helpers
+- Database schema files
+- Custom middleware or shared utilities
+- Skip standard framework files (package.json, tsconfig, next.config, etc.)
+
+### Step 3: Generate CLAUDE.md
+
+Create the file with ONLY these sections. Each section should be compact — the whole file should be under 50 lines.
+
+```markdown
+# [Project Name]
+[One-line description of what this project is]
+
+## Tech Stack
+- [Only non-obvious technologies — skip deps detectable from config files]
+
+## Commands
+- `[dev command]` - Dev server
+- `[build command]` - Build
+- `[test command]` - Tests
+- [Any non-obvious commands like db:push, seed, etc.]
+
+## Important Files
+- [Only files the agent wouldn't discover naturally]
+
+## Rules
+- [Leave empty with a comment: "Add project-specific rules as you encounter friction"]
+```
+
+### Step 4: Present and write
+
+Show the generated file to the user. Write it to `./CLAUDE.md` after approval.
+
+**Rules:**
+- NEVER include directory structure, code style rules, generic best practices, or marketing text
+- NEVER include anything a linter or TypeScript already enforces
+- Target: 20-50 lines. If it's longer, you're including too much
+- The Rules section starts empty — it gets populated over time as mistakes happen
+</init_workflow>
+
 <optimize_workflow>
 ## `/claude-memory optimize` — Deep CLAUDE.md Cleanup
 

package/dist/cli.js

@@ -5,15 +5,29 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: () => mod[key],
+        get: __accessProp.bind(mod, key),
         enumerable: true
       });
+  if (canCache)
+    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
@@ -32921,45 +32935,78 @@ async function setupOpenCodeSymlink(claudeDir, customOpenCodeFolder, customClaud
 import { execSync } from "child_process";
 import path4 from "path";
 import os5 from "os";
-async function checkAndInstallDependencies() {
-  const isWindows = os5.platform() === "win32";
-  const checkCommand = (cmd) => {
-    try {
-      const whichCmd = isWindows ? `where ${cmd}` : `which ${cmd}`;
-      execSync(whichCmd, { stdio: "ignore" });
+var isWindows = os5.platform() === "win32";
+function checkCommand(cmd) {
+  try {
+    const whichCmd = isWindows ? `where ${cmd}` : `which ${cmd}`;
+    execSync(whichCmd, { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function silentExec(command, options) {
+  try {
+    execSync(command, {
+      stdio: "pipe",
+      timeout: options?.timeout ?? 60000,
+      cwd: options?.cwd,
+      env: { ...process.env, CI: "true" }
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function installBun() {
+  if (!isWindows) {
+    if (silentExec("curl -fsSL https://bun.sh/install | bash", { timeout: 120000 })) {
       return true;
-    } catch {
-      return false;
     }
-  };
+  }
+  return silentExec("npm install -g bun");
+}
+function installCcusage() {
+  return silentExec("npm install -g ccusage");
+}
+function logSkipped(name) {
+  console.log(source_default.gray(`  ${name} already installed, skipping...`));
+}
+function logInstalling(name) {
+  console.log(source_default.yellow(`
+  Installing ${name}...`));
+}
+function logInstalled(name) {
+  console.log(source_default.green(`  ✓ ${name} installed`));
+}
+function logInstallFailed(name, manualCommand) {
+  console.log("");
+  console.log(source_default.yellow(`  ⚠ Could not install ${name} automatically`));
+  console.log(source_default.gray(`    This is usually a permissions issue with npm global installs.`));
+  console.log(source_default.gray(`    Run this manually to fix it:
+`));
+  console.log(source_default.white(`    ${manualCommand}`));
+  console.log("");
+}
+async function checkAndInstallDependencies() {
   if (checkCommand("bun")) {
-    console.log(source_default.gray("  bun already installed, skipping..."));
+    logSkipped("bun");
   } else {
-    console.log(source_default.yellow(`
-  Installing bun...`));
-    try {
-      execSync("npm install -g bun", {
-        stdio: "inherit",
-        timeout: 60000,
-        env: { ...process.env, CI: "true" }
-      });
-    } catch {
-      console.log(source_default.yellow("  ⚠ Failed to install bun. Please install it manually: npm install -g bun"));
+    logInstalling("bun");
+    if (installBun()) {
+      logInstalled("bun");
+    } else {
+      logInstallFailed("bun", isWindows ? "npm install -g bun" : "curl -fsSL https://bun.sh/install | bash");
     }
   }
   if (checkCommand("ccusage")) {
-    console.log(source_default.gray("  ccusage already installed, skipping..."));
+    logSkipped("ccusage");
   } else {
-    console.log(source_default.yellow(`
-  Installing ccusage...`));
-    try {
-      execSync("npm install -g ccusage", {
-        stdio: "inherit",
-        timeout: 60000,
-        env: { ...process.env, CI: "true" }
-      });
-    } catch {
-      console.log(source_default.yellow("  ⚠ Failed to install ccusage. Please install it manually: npm install -g ccusage"));
+    logInstalling("ccusage");
+    if (installCcusage()) {
+      logInstalled("ccusage");
+    } else {
+      logInstallFailed("ccusage", "sudo npm install -g ccusage");
     }
   }
 }
@@ -32970,7 +33017,7 @@ async function installScriptsDependencies(claudeDir) {
   try {
     execSync("bun install --no-save", {
       cwd: scriptsDir,
-      stdio: "inherit",
+      stdio: "pipe",
       timeout: 60000,
       env: {
         ...process.env,
@@ -36510,10 +36557,10 @@ import { spawn as spawn2 } from "child_process";
 import { execSync as execSync4 } from "child_process";
 import path21 from "path";
 import os19 from "os";
-function checkCommand(cmd) {
+function checkCommand2(cmd) {
   try {
-    const isWindows = os19.platform() === "win32";
-    const whichCmd = isWindows ? `where ${cmd}` : `which ${cmd}`;
+    const isWindows2 = os19.platform() === "win32";
+    const whichCmd = isWindows2 ? `where ${cmd}` : `which ${cmd}`;
     execSync4(whichCmd, { stdio: "ignore" });
     return true;
   } catch {
@@ -36534,7 +36581,7 @@ Usage: aiblueprint ${prefix} <action>`));
 `));
 }
 async function executeScript(scriptName, claudeDir) {
-  if (!checkCommand("bun")) {
+  if (!checkCommand2("bun")) {
     console.error(source_default.red("Bun is not installed. Install with: npm install -g bun"));
     return 1;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aiblueprint-cli",
-  "version": "1.4.40",
+  "version": "1.4.42",
   "description": "AIBlueprint CLI for setting up Claude Code configurations",
   "author": "AIBlueprint",
   "license": "MIT",