all-for-claudecode 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/marketplace.json +21 -0
- package/.claude-plugin/plugin.json +12 -0
- package/LICENSE +21 -0
- package/MIGRATION.md +180 -0
- package/README.md +216 -0
- package/agents/afc-architect.md +49 -0
- package/agents/afc-security.md +49 -0
- package/bin/cli.mjs +111 -0
- package/commands/analyze.md +126 -0
- package/commands/architect.md +142 -0
- package/commands/auto.md +304 -0
- package/commands/checkpoint.md +88 -0
- package/commands/clarify.md +78 -0
- package/commands/debug.md +126 -0
- package/commands/doctor.md +179 -0
- package/commands/implement.md +206 -0
- package/commands/init.md +272 -0
- package/commands/plan.md +195 -0
- package/commands/principles.md +107 -0
- package/commands/research.md +109 -0
- package/commands/resume.md +81 -0
- package/commands/review.md +205 -0
- package/commands/security.md +131 -0
- package/commands/spec.md +149 -0
- package/commands/tasks.md +137 -0
- package/commands/test.md +123 -0
- package/docs/critic-loop-rules.md +104 -0
- package/docs/nfr-templates.md +40 -0
- package/docs/phase-gate-protocol.md +44 -0
- package/hooks/hooks.json +211 -0
- package/package.json +62 -0
- package/scripts/afc-auto-format.sh +70 -0
- package/scripts/afc-bash-guard.sh +85 -0
- package/scripts/afc-config-change.sh +58 -0
- package/scripts/afc-failure-hint.sh +78 -0
- package/scripts/afc-notify.sh +64 -0
- package/scripts/afc-parallel-validate.sh +158 -0
- package/scripts/afc-permission-request.sh +91 -0
- package/scripts/afc-pipeline-manage.sh +186 -0
- package/scripts/afc-preflight-check.sh +195 -0
- package/scripts/afc-session-end.sh +45 -0
- package/scripts/afc-stop-gate.sh +78 -0
- package/scripts/afc-subagent-context.sh +65 -0
- package/scripts/afc-subagent-stop.sh +60 -0
- package/scripts/afc-task-completed-gate.sh +66 -0
- package/scripts/afc-teammate-idle.sh +49 -0
- package/scripts/afc-timeline-log.sh +97 -0
- package/scripts/afc-user-prompt-submit.sh +35 -0
- package/scripts/pre-compact-checkpoint.sh +112 -0
- package/scripts/session-start-context.sh +80 -0
- package/scripts/track-afc-changes.sh +48 -0
- package/templates/afc.config.express-api.md +99 -0
- package/templates/afc.config.monorepo.md +98 -0
- package/templates/afc.config.nextjs-fsd.md +107 -0
- package/templates/afc.config.react-spa.md +96 -0
- package/templates/afc.config.template.md +90 -0
|
@@ -0,0 +1,81 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: afc:resume
|
|
3
|
+
description: "Restore session"
|
|
4
|
+
argument-hint: "[no arguments]"
|
|
5
|
+
disable-model-invocation: true
|
|
6
|
+
model: haiku
|
|
7
|
+
allowed-tools:
|
|
8
|
+
- Read
|
|
9
|
+
- Glob
|
|
10
|
+
- Bash
|
|
11
|
+
---
|
|
12
|
+
|
|
13
|
+
# /afc:resume — Restore Session
|
|
14
|
+
|
|
15
|
+
> Restores the previous session state from .claude/afc/memory/checkpoint.md and resumes work.
|
|
16
|
+
|
|
17
|
+
## Arguments
|
|
18
|
+
|
|
19
|
+
- `$ARGUMENTS` — (optional) none
|
|
20
|
+
|
|
21
|
+
## Execution Steps
|
|
22
|
+
|
|
23
|
+
### 1. Load Checkpoint
|
|
24
|
+
|
|
25
|
+
Read `.claude/afc/memory/checkpoint.md`:
|
|
26
|
+
- If not found: output "No saved checkpoint found." then **stop**
|
|
27
|
+
- If found: parse the full contents
|
|
28
|
+
|
|
29
|
+
### 2. Validate Environment
|
|
30
|
+
|
|
31
|
+
Compare the checkpoint state against the current environment:
|
|
32
|
+
|
|
33
|
+
1. **Branch check**: Does the checkpoint branch match the current branch?
|
|
34
|
+
- If different: warn + suggest switching
|
|
35
|
+
2. **File state**: Have any files changed since the checkpoint?
|
|
36
|
+
- Check for new commits with `git log {checkpoint hash}..HEAD --oneline`
|
|
37
|
+
3. **Feature directory**: Does .claude/afc/specs/{feature}/ still exist?
|
|
38
|
+
|
|
39
|
+
### 3. Report State
|
|
40
|
+
|
|
41
|
+
```markdown
|
|
42
|
+
## Session Restore
|
|
43
|
+
|
|
44
|
+
### Previous Checkpoint
|
|
45
|
+
- **Saved at**: {time}
|
|
46
|
+
- **Message**: {checkpoint message}
|
|
47
|
+
- **Branch**: {branch} {(matches current ✓ / differs ⚠)}
|
|
48
|
+
|
|
49
|
+
### Active Features
|
|
50
|
+
| Feature | Status | Progress |
|
|
51
|
+
|---------|--------|----------|
|
|
52
|
+
| {name} | {status} | {progress} |
|
|
53
|
+
|
|
54
|
+
### Changes Since Checkpoint
|
|
55
|
+
{list of new commits if any, or "No changes"}
|
|
56
|
+
|
|
57
|
+
### Incomplete Work
|
|
58
|
+
{incomplete work list from checkpoint.md}
|
|
59
|
+
|
|
60
|
+
### Recommended Next Steps
|
|
61
|
+
{recommended commands based on state}
|
|
62
|
+
- Tasks in progress → resume `/afc:implement`
|
|
63
|
+
- Plan complete → `/afc:tasks`
|
|
64
|
+
- Spec only → `/afc:plan`
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
### 4. Final Output
|
|
68
|
+
|
|
69
|
+
```
|
|
70
|
+
Session restored
|
|
71
|
+
├─ Checkpoint: {time}
|
|
72
|
+
├─ Feature: {name} ({status})
|
|
73
|
+
├─ Progress: {completed}/{total}
|
|
74
|
+
└─ Recommended: {next command}
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
## Notes
|
|
78
|
+
|
|
79
|
+
- **Read-only**: Does not modify the environment (branch switching is suggested only; user must confirm).
|
|
80
|
+
- **Mismatch warning**: Clearly warn if checkpoint and current environment differ.
|
|
81
|
+
- **Context restore**: Always display the "Context Notes" from the checkpoint to aid memory.
|
|
@@ -0,0 +1,205 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: afc:review
|
|
3
|
+
description: "Code review"
|
|
4
|
+
argument-hint: "[scope: file path, PR number, or staged]"
|
|
5
|
+
allowed-tools:
|
|
6
|
+
- Read
|
|
7
|
+
- Write
|
|
8
|
+
- Grep
|
|
9
|
+
- Glob
|
|
10
|
+
- Bash
|
|
11
|
+
- Task
|
|
12
|
+
model: sonnet
|
|
13
|
+
---
|
|
14
|
+
|
|
15
|
+
# /afc:review — Code Review
|
|
16
|
+
|
|
17
|
+
> Performs a comprehensive review of changed code (quality, security, performance, architecture compliance).
|
|
18
|
+
> Validates completeness of the review itself with convergence-based Critic Loop.
|
|
19
|
+
|
|
20
|
+
## Arguments
|
|
21
|
+
|
|
22
|
+
- `$ARGUMENTS` — (optional) Review scope (file path, PR number, or "staged")
|
|
23
|
+
- If not specified: full `git diff` of current branch (unstaged + staged)
|
|
24
|
+
|
|
25
|
+
## Project Config (auto-loaded)
|
|
26
|
+
|
|
27
|
+
!`cat .claude/afc.config.md 2>/dev/null || echo "[CONFIG NOT FOUND] .claude/afc.config.md not found. Create it with /afc:init."`
|
|
28
|
+
|
|
29
|
+
## Config Load
|
|
30
|
+
|
|
31
|
+
**Always** read `.claude/afc.config.md` first (read manually if not auto-loaded above). Abort if config file is missing.
|
|
32
|
+
|
|
33
|
+
## Execution Steps
|
|
34
|
+
|
|
35
|
+
### 1. Collect Review Targets
|
|
36
|
+
|
|
37
|
+
1. **Determine scope**:
|
|
38
|
+
- `$ARGUMENTS` = file path → that file only
|
|
39
|
+
- `$ARGUMENTS` = PR number → run `gh pr diff {number}`
|
|
40
|
+
- `$ARGUMENTS` = "staged" → `git diff --cached`
|
|
41
|
+
- Not specified → `git diff HEAD` (all uncommitted changes)
|
|
42
|
+
2. Extract **list of changed files**
|
|
43
|
+
3. Read **full content** of each changed file (not just the diff — full context)
|
|
44
|
+
|
|
45
|
+
### 2. Parallel Review (scaled by file count)
|
|
46
|
+
|
|
47
|
+
Choose review orchestration based on the number of changed files:
|
|
48
|
+
|
|
49
|
+
#### 5 or fewer files: Direct review
|
|
50
|
+
Review all files directly in the current context (no delegation).
|
|
51
|
+
|
|
52
|
+
#### 6–10 files: Parallel Batch
|
|
53
|
+
Distribute to parallel review agents (2–3 files per agent) in a **single message**:
|
|
54
|
+
```
|
|
55
|
+
Task("Review: {file1, file2}", subagent_type: "general-purpose")
|
|
56
|
+
Task("Review: {file3, file4}", subagent_type: "general-purpose")
|
|
57
|
+
```
|
|
58
|
+
Read each agent's returned output, then write consolidated review.
|
|
59
|
+
|
|
60
|
+
#### 11+ files: Review Swarm
|
|
61
|
+
Create a review task pool and spawn self-organizing review workers:
|
|
62
|
+
```
|
|
63
|
+
// 1. Register each file as a review task via TaskCreate
|
|
64
|
+
TaskCreate({ subject: "Review: src/auth/login.ts", description: "Review for quality, security, architecture, performance..." })
|
|
65
|
+
TaskCreate({ subject: "Review: src/auth/session.ts", ... })
|
|
66
|
+
// ... for all changed files
|
|
67
|
+
|
|
68
|
+
// 2. Spawn N review workers in a single message (N = min(5, file count / 2))
|
|
69
|
+
Task("Review Worker 1", subagent_type: "general-purpose",
|
|
70
|
+
prompt: "You are a review worker. Loop: TaskList → claim pending → read file + diff → review → record findings → repeat until empty.
|
|
71
|
+
Review criteria: {config.code_style}, {config.architecture}, security, performance.
|
|
72
|
+
Output findings as: severity (Critical/Warning/Info), file:line, issue, suggested fix.")
|
|
73
|
+
```
|
|
74
|
+
Collect all worker outputs, then write consolidated review.
|
|
75
|
+
|
|
76
|
+
### 3. Perform Review
|
|
77
|
+
|
|
78
|
+
For each changed file, examine from the following perspectives:
|
|
79
|
+
|
|
80
|
+
#### A. Code Quality
|
|
81
|
+
- {config.code_style} compliance (any usage, missing types)
|
|
82
|
+
- Naming conventions (handleX, isX, UPPER_SNAKE)
|
|
83
|
+
- Duplicate code
|
|
84
|
+
- Unnecessary complexity
|
|
85
|
+
|
|
86
|
+
#### B. {config.architecture}
|
|
87
|
+
- Layer dependency direction violations (lower→upper imports)
|
|
88
|
+
- Segment rules (api/, model/, ui/, lib/)
|
|
89
|
+
- Appropriate layer placement
|
|
90
|
+
|
|
91
|
+
#### C. Security
|
|
92
|
+
- XSS vulnerabilities (dangerouslySetInnerHTML, unvalidated user input)
|
|
93
|
+
- Sensitive data exposure
|
|
94
|
+
- SQL/Command injection
|
|
95
|
+
|
|
96
|
+
#### D. Performance
|
|
97
|
+
- Unnecessary re-renders (missing useCallback/useMemo)
|
|
98
|
+
- Infinite loop potential (useEffect dependencies)
|
|
99
|
+
- Large data processing
|
|
100
|
+
|
|
101
|
+
#### E. Project Pattern Compliance
|
|
102
|
+
- {config.state_management} usage patterns
|
|
103
|
+
- Server/client state management patterns (see {config.state_management})
|
|
104
|
+
- Component structure (Props type location, hook order)
|
|
105
|
+
|
|
106
|
+
### 4. Review Output
|
|
107
|
+
|
|
108
|
+
```markdown
|
|
109
|
+
## Code Review Results
|
|
110
|
+
|
|
111
|
+
### Summary
|
|
112
|
+
| Severity | Count | Items |
|
|
113
|
+
|----------|-------|-------|
|
|
114
|
+
| Critical | {N} | {summary} |
|
|
115
|
+
| Warning | {N} | {summary} |
|
|
116
|
+
| Info | {N} | {summary} |
|
|
117
|
+
|
|
118
|
+
### Detailed Findings
|
|
119
|
+
|
|
120
|
+
#### C-{N}: {title}
|
|
121
|
+
- **File**: {path}:{line}
|
|
122
|
+
- **Issue**: {description}
|
|
123
|
+
- **Suggested fix**: {code example}
|
|
124
|
+
|
|
125
|
+
#### W-{N}: {title}
|
|
126
|
+
{same format}
|
|
127
|
+
|
|
128
|
+
#### I-{N}: {title}
|
|
129
|
+
{same format}
|
|
130
|
+
|
|
131
|
+
### Positives
|
|
132
|
+
- {1-2 things done well}
|
|
133
|
+
```
|
|
134
|
+
|
|
135
|
+
### 5. Retrospective Check
|
|
136
|
+
|
|
137
|
+
If `.claude/afc/memory/retrospectives/` directory exists, load retrospective files and check:
|
|
138
|
+
- Were there recurring Critical finding categories in past reviews? Prioritize those perspectives.
|
|
139
|
+
- Were there false positives that wasted effort? Reduce sensitivity for those patterns.
|
|
140
|
+
|
|
141
|
+
### 6. Critic Loop
|
|
142
|
+
|
|
143
|
+
> **Always** read `${CLAUDE_PLUGIN_ROOT}/docs/critic-loop-rules.md` first and follow it.
|
|
144
|
+
|
|
145
|
+
Run the critic loop until convergence. Safety cap: 5 passes.
|
|
146
|
+
|
|
147
|
+
| Criterion | Validation |
|
|
148
|
+
|-----------|------------|
|
|
149
|
+
| **COMPLETENESS** | Were all changed files reviewed? Are there any missed perspectives? |
|
|
150
|
+
| **PRECISION** | Are the findings actual issues, not false positives? |
|
|
151
|
+
|
|
152
|
+
**On FAIL**: auto-fix and continue to next pass.
|
|
153
|
+
**On ESCALATE**: pause, present options to user, apply choice, resume.
|
|
154
|
+
**On DEFER**: record reason, mark criterion clean, continue.
|
|
155
|
+
**On CONVERGE**: `✓ Critic converged ({N} passes, {M} fixes, {E} escalations)`
|
|
156
|
+
**On SAFETY CAP**: `⚠ Critic safety cap ({N} passes). Review recommended.`
|
|
157
|
+
|
|
158
|
+
### 7. Retrospective Entry (if new pattern found)
|
|
159
|
+
|
|
160
|
+
If this review reveals a recurring pattern not previously documented in `.claude/afc/memory/retrospectives/`:
|
|
161
|
+
|
|
162
|
+
Append to `.claude/afc/memory/retrospectives/{YYYY-MM-DD}.md`:
|
|
163
|
+
```markdown
|
|
164
|
+
## Pattern: {category}
|
|
165
|
+
**What happened**: {concrete description}
|
|
166
|
+
**Root cause**: {why this keeps occurring}
|
|
167
|
+
**Prevention rule**: {actionable rule — usable in future plan/implement phases}
|
|
168
|
+
**Severity**: Critical | Warning
|
|
169
|
+
```
|
|
170
|
+
|
|
171
|
+
Only write if the pattern is new and actionable. Generic observations are prohibited.
|
|
172
|
+
|
|
173
|
+
### 8. Archive Review Report
|
|
174
|
+
|
|
175
|
+
When running inside a pipeline (.claude/afc/specs/{feature}/ exists), persist the review results:
|
|
176
|
+
|
|
177
|
+
1. Write full review output (Summary table + Detailed Findings + Positives) to `.claude/afc/specs/{feature}/review-report.md`
|
|
178
|
+
2. Include metadata header:
|
|
179
|
+
```markdown
|
|
180
|
+
# Review Report: {feature name}
|
|
181
|
+
> Date: {YYYY-MM-DD}
|
|
182
|
+
> Files reviewed: {count}
|
|
183
|
+
> Findings: Critical {N} / Warning {N} / Info {N}
|
|
184
|
+
```
|
|
185
|
+
3. This file survives Clean phase (copied to `.claude/afc/memory/reviews/{feature}-{date}.md` before .claude/afc/specs/ deletion)
|
|
186
|
+
|
|
187
|
+
When running standalone (no active pipeline), skip archiving — display results in console only.
|
|
188
|
+
|
|
189
|
+
### 9. Final Output
|
|
190
|
+
|
|
191
|
+
```
|
|
192
|
+
Review complete
|
|
193
|
+
├─ Files: {changed file count}
|
|
194
|
+
├─ Found: Critical {N} / Warning {N} / Info {N}
|
|
195
|
+
├─ Critic: converged ({N} passes, {M} fixes, {E} escalations)
|
|
196
|
+
└─ Conclusion: {one-line summary}
|
|
197
|
+
```
|
|
198
|
+
|
|
199
|
+
## Notes
|
|
200
|
+
|
|
201
|
+
- **Read-only**: do not modify code. Report findings only.
|
|
202
|
+
- **Full context**: read the entire file, not just the diff lines, to understand context before reviewing.
|
|
203
|
+
- **Avoid false positives**: classify uncertain issues as Info.
|
|
204
|
+
- **Respect patterns**: do not flag code simply because it differs from other patterns. Use CLAUDE.md and afc.config.md as the standard.
|
|
205
|
+
- **NEVER use `run_in_background: true` on Task calls**: review agents must run in foreground so results are returned before consolidation.
|
|
@@ -0,0 +1,131 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: afc:security
|
|
3
|
+
description: "Security scan (read-only)"
|
|
4
|
+
argument-hint: "[scan scope: file/directory path or full]"
|
|
5
|
+
disable-model-invocation: true
|
|
6
|
+
context: fork
|
|
7
|
+
agent: afc-security
|
|
8
|
+
allowed-tools:
|
|
9
|
+
- Read
|
|
10
|
+
- Grep
|
|
11
|
+
- Glob
|
|
12
|
+
- Bash
|
|
13
|
+
- Task
|
|
14
|
+
- WebSearch
|
|
15
|
+
model: sonnet
|
|
16
|
+
---
|
|
17
|
+
|
|
18
|
+
# /afc:security — Security Scan
|
|
19
|
+
|
|
20
|
+
> Detects and reports security vulnerabilities in the codebase.
|
|
21
|
+
> Inspects against OWASP Top 10. **Read-only** — does not modify code.
|
|
22
|
+
|
|
23
|
+
## Arguments
|
|
24
|
+
|
|
25
|
+
- `$ARGUMENTS` — (optional) scan scope (file/directory path, or "full" for full scan)
|
|
26
|
+
- If not specified: scans only files changed in the current branch
|
|
27
|
+
|
|
28
|
+
## Config Load
|
|
29
|
+
|
|
30
|
+
Read the following settings from `CLAUDE.md` or `.claude/CLAUDE.md` at the project root and assign to the `config` variable:
|
|
31
|
+
|
|
32
|
+
```
|
|
33
|
+
config.framework = the framework used in the project
|
|
34
|
+
(e.g., "Next.js", "Nuxt", "SvelteKit", "Express", "NestJS")
|
|
35
|
+
→ Framework specified in CLAUDE.md. Assume "unknown" if not present.
|
|
36
|
+
config.auditCmd = dependency audit command
|
|
37
|
+
(e.g., "yarn audit", "npm audit", "pnpm audit")
|
|
38
|
+
→ Infer from the packageManager field in package.json or the lockfile.
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
## Execution Steps
|
|
42
|
+
|
|
43
|
+
### 1. Determine Scan Scope
|
|
44
|
+
|
|
45
|
+
- `$ARGUMENTS` = path → that path only
|
|
46
|
+
- `$ARGUMENTS` = "full" → entire `src/`
|
|
47
|
+
- Not specified → changed files from `git diff --name-only HEAD`
|
|
48
|
+
|
|
49
|
+
### 2. Agent Teams (if more than 10 files)
|
|
50
|
+
|
|
51
|
+
Use parallel agents for wide-scope scans:
|
|
52
|
+
```
|
|
53
|
+
Task("Security scan: src/features/", subagent_type: general-purpose)
|
|
54
|
+
Task("Security scan: src/shared/api/", subagent_type: general-purpose)
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
### 3. Security Check Items
|
|
58
|
+
|
|
59
|
+
#### A. Injection (A03:2021)
|
|
60
|
+
- Uses of `dangerouslySetInnerHTML`
|
|
61
|
+
- User input inserted directly into DOM/URL/queries
|
|
62
|
+
- Uses of `eval()`, `new Function()`
|
|
63
|
+
|
|
64
|
+
#### B. Broken Authentication (A07:2021)
|
|
65
|
+
- Hardcoded tokens or credentials
|
|
66
|
+
- API routes accessible without authentication
|
|
67
|
+
- Session management vulnerabilities
|
|
68
|
+
|
|
69
|
+
#### C. Sensitive Data Exposure (A02:2021)
|
|
70
|
+
- `.env` values exposed to the client (check framework-specific public env variables for {config.framework})
|
|
71
|
+
- Sensitive information printed via console.log
|
|
72
|
+
- Internal details exposed in error messages
|
|
73
|
+
|
|
74
|
+
#### D. Security Misconfiguration (A05:2021)
|
|
75
|
+
- CORS configuration
|
|
76
|
+
- CSP headers
|
|
77
|
+
- Unnecessary debug mode enabled
|
|
78
|
+
|
|
79
|
+
#### E. XSS (A03:2021)
|
|
80
|
+
- Patterns that bypass React's default escaping
|
|
81
|
+
- URL parameters rendered without validation
|
|
82
|
+
- Dynamic injection of iframes or scripts
|
|
83
|
+
|
|
84
|
+
#### F. Dependencies (A06:2021)
|
|
85
|
+
- Packages with known vulnerabilities (dependency audit tool results)
|
|
86
|
+
- Outdated dependencies
|
|
87
|
+
|
|
88
|
+
### 4. Output Results
|
|
89
|
+
|
|
90
|
+
```markdown
|
|
91
|
+
## Security Scan Results
|
|
92
|
+
|
|
93
|
+
### Summary
|
|
94
|
+
| Severity | Count |
|
|
95
|
+
|----------|-------|
|
|
96
|
+
| Critical | {N} |
|
|
97
|
+
| High | {N} |
|
|
98
|
+
| Medium | {N} |
|
|
99
|
+
| Low | {N} |
|
|
100
|
+
|
|
101
|
+
### Findings
|
|
102
|
+
|
|
103
|
+
#### SEC-{NNN}: {title}
|
|
104
|
+
- **Category**: {OWASP code}
|
|
105
|
+
- **File**: {path}:{line}
|
|
106
|
+
- **Description**: {vulnerability details}
|
|
107
|
+
- **Impact**: {impact if exploited}
|
|
108
|
+
- **Mitigation**: {how to fix}
|
|
109
|
+
|
|
110
|
+
### Dependency Audit
|
|
111
|
+
{config.auditCmd} result summary — if executable
|
|
112
|
+
|
|
113
|
+
### Recommended Actions
|
|
114
|
+
{prioritized fix suggestions}
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
### 5. Final Output
|
|
118
|
+
|
|
119
|
+
```
|
|
120
|
+
Security scan complete
|
|
121
|
+
├─ Scope: {file count} files
|
|
122
|
+
├─ Found: Critical {N} / High {N} / Medium {N} / Low {N}
|
|
123
|
+
└─ Recommended: {most urgent action}
|
|
124
|
+
```
|
|
125
|
+
|
|
126
|
+
## Notes
|
|
127
|
+
|
|
128
|
+
- **Read-only**: Does not modify code. Reports security issues only.
|
|
129
|
+
- **Minimize false positives**: Account for React's default XSS defenses. Report only genuinely dangerous patterns.
|
|
130
|
+
- **Handle sensitive data carefully**: Do not include actual token or password values in scan results.
|
|
131
|
+
- **Consider context**: Reflect security specifics for the {config.framework} environment.
|
package/commands/spec.md
ADDED
|
@@ -0,0 +1,149 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: afc:spec
|
|
3
|
+
description: "Generate feature specification"
|
|
4
|
+
argument-hint: "[feature description in natural language]"
|
|
5
|
+
model: sonnet
|
|
6
|
+
---
|
|
7
|
+
# /afc:spec — Generate Feature Specification
|
|
8
|
+
|
|
9
|
+
> Converts a natural language feature description into a structured specification (spec.md).
|
|
10
|
+
> Validates completeness with convergence-based Critic Loop. Operates on pure prompts without external scripts.
|
|
11
|
+
|
|
12
|
+
## Arguments
|
|
13
|
+
|
|
14
|
+
- `$ARGUMENTS` — (required) Feature description in natural language
|
|
15
|
+
|
|
16
|
+
## Project Config (auto-loaded)
|
|
17
|
+
|
|
18
|
+
!`cat .claude/afc.config.md 2>/dev/null || echo "[CONFIG NOT FOUND] .claude/afc.config.md not found. Create it with /afc:init."`
|
|
19
|
+
|
|
20
|
+
## Config Load
|
|
21
|
+
|
|
22
|
+
**Always** read `.claude/afc.config.md` first (read manually if not auto-loaded above). Abort if config file is missing.
|
|
23
|
+
|
|
24
|
+
## Execution Steps
|
|
25
|
+
|
|
26
|
+
### 1. Set Up Feature Directory
|
|
27
|
+
|
|
28
|
+
1. Check **current branch** → `BRANCH_NAME`
|
|
29
|
+
2. Determine **feature name**:
|
|
30
|
+
- Extract 2-3 key keywords from `$ARGUMENTS`
|
|
31
|
+
- Convert to kebab-case (e.g., "add user authentication" → `user-auth`)
|
|
32
|
+
3. **Create directory**: `.claude/afc/specs/{feature-name}/` (create parent `.claude/afc/specs/` directory if it does not exist)
|
|
33
|
+
4. If already exists, confirm with user: "Overwrite existing spec?"
|
|
34
|
+
|
|
35
|
+
### 2. Explore Codebase
|
|
36
|
+
|
|
37
|
+
Before writing the spec, understand the current project structure:
|
|
38
|
+
|
|
39
|
+
1. Check key directories by `{config.architecture}` layer
|
|
40
|
+
2. Explore existing code related to the feature description (Grep/Glob)
|
|
41
|
+
3. Identify related type definitions, APIs, and components
|
|
42
|
+
|
|
43
|
+
### 3. Write Spec
|
|
44
|
+
|
|
45
|
+
Create `.claude/afc/specs/{feature-name}/spec.md`:
|
|
46
|
+
|
|
47
|
+
```markdown
|
|
48
|
+
# Feature Spec: {feature name}
|
|
49
|
+
|
|
50
|
+
> Created: {YYYY-MM-DD}
|
|
51
|
+
> Branch: {BRANCH_NAME}
|
|
52
|
+
> Status: Draft
|
|
53
|
+
|
|
54
|
+
## Overview
|
|
55
|
+
{2-3 sentences on the purpose and background of the feature}
|
|
56
|
+
|
|
57
|
+
## User Stories
|
|
58
|
+
|
|
59
|
+
### US1: {story title} [P1]
|
|
60
|
+
**Description**: {feature description from user perspective}
|
|
61
|
+
**Priority rationale**: {why this order}
|
|
62
|
+
**Independent testability**: {whether this story can be tested on its own}
|
|
63
|
+
|
|
64
|
+
#### Acceptance Scenarios
|
|
65
|
+
- [ ] Given {precondition}, When {action}, Then {result}
|
|
66
|
+
- [ ] Given {precondition}, When {action}, Then {result}
|
|
67
|
+
|
|
68
|
+
### US2: {story title} [P2]
|
|
69
|
+
{same format}
|
|
70
|
+
|
|
71
|
+
## Requirements
|
|
72
|
+
|
|
73
|
+
### Functional Requirements
|
|
74
|
+
- **FR-001**: {requirement}
|
|
75
|
+
- **FR-002**: {requirement}
|
|
76
|
+
|
|
77
|
+
### Non-Functional Requirements
|
|
78
|
+
- **NFR-001**: {performance/security/accessibility etc.}
|
|
79
|
+
|
|
80
|
+
### Auto-Suggested NFRs
|
|
81
|
+
{Load `${CLAUDE_PLUGIN_ROOT}/docs/nfr-templates.md` and select 3-5 relevant NFRs based on the project type detected from afc.config.md}
|
|
82
|
+
- **NFR-A01** [AUTO-SUGGESTED]: {suggestion from matching project type template}
|
|
83
|
+
- **NFR-A02** [AUTO-SUGGESTED]: {suggestion}
|
|
84
|
+
- **NFR-A03** [AUTO-SUGGESTED]: {suggestion}
|
|
85
|
+
{Tag each with [AUTO-SUGGESTED]. Users may accept, modify, or remove.}
|
|
86
|
+
|
|
87
|
+
### Key Entities
|
|
88
|
+
| Entity | Description | Related Existing Code |
|
|
89
|
+
|--------|-------------|-----------------------|
|
|
90
|
+
| {name} | {description} | {path or "new"} |
|
|
91
|
+
|
|
92
|
+
## Success Criteria
|
|
93
|
+
- **SC-001**: {measurable success indicator}
|
|
94
|
+
- **SC-002**: {measurable success indicator}
|
|
95
|
+
|
|
96
|
+
## Edge Cases
|
|
97
|
+
- {edge case 1}
|
|
98
|
+
- {edge case 2}
|
|
99
|
+
|
|
100
|
+
## Constraints
|
|
101
|
+
- {technical/business constraints}
|
|
102
|
+
|
|
103
|
+
## [NEEDS CLARIFICATION]
|
|
104
|
+
- {uncertain items — record if any, remove section if none}
|
|
105
|
+
```
|
|
106
|
+
|
|
107
|
+
### 4. Retrospective Check
|
|
108
|
+
|
|
109
|
+
If `.claude/afc/memory/retrospectives/` directory exists, load retrospective files and check:
|
|
110
|
+
- Were there previous `[AUTO-RESOLVED]` items that turned out wrong? Flag similar patterns.
|
|
111
|
+
- Were there scope-related issues in past specs? Warn about similar ambiguities.
|
|
112
|
+
|
|
113
|
+
### 5. Critic Loop
|
|
114
|
+
|
|
115
|
+
> **Always** read `${CLAUDE_PLUGIN_ROOT}/docs/critic-loop-rules.md` first and follow it.
|
|
116
|
+
|
|
117
|
+
Run the critic loop until convergence. Safety cap: 5 passes.
|
|
118
|
+
|
|
119
|
+
| Criterion | Validation |
|
|
120
|
+
|-----------|------------|
|
|
121
|
+
| **COMPLETENESS** | Does every User Story have acceptance scenarios? Are any requirements missing? |
|
|
122
|
+
| **MEASURABILITY** | Are the success criteria measurable, not subjective? |
|
|
123
|
+
| **INDEPENDENCE** | Are implementation details (code, library names) absent from the spec? |
|
|
124
|
+
| **EDGE_CASES** | Are at least 2 edge cases identified? Any missing boundary conditions? |
|
|
125
|
+
|
|
126
|
+
**On FAIL**: auto-fix and continue to next pass.
|
|
127
|
+
**On ESCALATE**: pause, present options to user, apply choice, resume.
|
|
128
|
+
**On DEFER**: record reason, mark criterion clean, continue.
|
|
129
|
+
**On CONVERGE**: `✓ Critic converged ({N} passes, {M} fixes, {E} escalations)`
|
|
130
|
+
**On SAFETY CAP**: `⚠ Critic safety cap ({N} passes). Review recommended.`
|
|
131
|
+
|
|
132
|
+
### 6. Final Output
|
|
133
|
+
|
|
134
|
+
```
|
|
135
|
+
Spec generated
|
|
136
|
+
├─ .claude/afc/specs/{feature-name}/spec.md
|
|
137
|
+
├─ User Stories: {count}
|
|
138
|
+
├─ Requirements: FR {count}, NFR {count}
|
|
139
|
+
├─ Unresolved: {[NEEDS CLARIFICATION] count}
|
|
140
|
+
└─ Next step: /afc:clarify (if unresolved) or /afc:plan
|
|
141
|
+
```
|
|
142
|
+
|
|
143
|
+
## Notes
|
|
144
|
+
|
|
145
|
+
- Do **not** write implementation details in the spec. Expressions like "manage with Zustand" belong in plan.md.
|
|
146
|
+
- Specify **actual paths** for entities related to existing code.
|
|
147
|
+
- If `$ARGUMENTS` is empty, ask user for a feature description.
|
|
148
|
+
- Do not pack too many features into one spec. Suggest splitting if User Stories exceed 5.
|
|
149
|
+
- When running `/afc:auto`, `[AUTO-SUGGESTED]` NFRs are included automatically. Review after completion is recommended.
|
|
@@ -0,0 +1,137 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: afc:tasks
|
|
3
|
+
description: "Task decomposition"
|
|
4
|
+
argument-hint: "[constraints/priority directives]"
|
|
5
|
+
user-invocable: false
|
|
6
|
+
model: sonnet
|
|
7
|
+
---
|
|
8
|
+
# /afc:tasks — Task Decomposition
|
|
9
|
+
|
|
10
|
+
> Generates an executable task list (tasks.md) based on plan.md.
|
|
11
|
+
> Validates coverage with convergence-based Critic Loop.
|
|
12
|
+
|
|
13
|
+
## Arguments
|
|
14
|
+
|
|
15
|
+
- `$ARGUMENTS` — (optional) additional constraints or priority directives
|
|
16
|
+
|
|
17
|
+
## Config Load
|
|
18
|
+
|
|
19
|
+
**Must** read `.claude/afc.config.md` first. Stop if the config file is not present.
|
|
20
|
+
|
|
21
|
+
## Execution Steps
|
|
22
|
+
|
|
23
|
+
### 1. Load Context
|
|
24
|
+
|
|
25
|
+
1. Load from `.claude/afc/specs/{feature}/`:
|
|
26
|
+
- **plan.md** (required) — stop if missing: "Run /afc:plan first."
|
|
27
|
+
- **spec.md** (required)
|
|
28
|
+
- **research.md** (if present)
|
|
29
|
+
2. Extract from plan.md:
|
|
30
|
+
- Phase breakdown
|
|
31
|
+
- File Change Map
|
|
32
|
+
- Architecture decisions
|
|
33
|
+
|
|
34
|
+
### 2. Decompose Tasks
|
|
35
|
+
|
|
36
|
+
Decompose tasks per Phase defined in plan.md.
|
|
37
|
+
|
|
38
|
+
#### Task Format (required)
|
|
39
|
+
|
|
40
|
+
```markdown
|
|
41
|
+
- [ ] T{NNN} {[P]} {[US*]} {description} `{file path}` {depends: [TXXX, TXXX]}
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
| Component | Required | Description |
|
|
45
|
+
|-----------|----------|-------------|
|
|
46
|
+
| `T{NNN}` | Yes | 3-digit sequential ID (T001, T002, ...) |
|
|
47
|
+
| `[P]` | No | Parallelizable — no file overlap with other [P] tasks in the same phase |
|
|
48
|
+
| `[US*]` | No | User Story label (US1, US2, ... from spec.md) |
|
|
49
|
+
| description | Yes | Clear task description (start with a verb) |
|
|
50
|
+
| file path | Yes | Primary target file (wrapped in backticks) |
|
|
51
|
+
| `depends:` | No | Explicit dependency list — task cannot start until all listed tasks complete |
|
|
52
|
+
|
|
53
|
+
#### Phase Structure
|
|
54
|
+
|
|
55
|
+
```markdown
|
|
56
|
+
# Tasks: {feature name}
|
|
57
|
+
|
|
58
|
+
## Phase 1: Setup
|
|
59
|
+
{type definitions, configuration, directory structure}
|
|
60
|
+
|
|
61
|
+
## Phase 2: Core
|
|
62
|
+
{core business logic, store, API}
|
|
63
|
+
|
|
64
|
+
## Phase 3: UI
|
|
65
|
+
{components, interactions}
|
|
66
|
+
|
|
67
|
+
## Phase 4: Integration & Polish
|
|
68
|
+
{integration, error handling, optimization}
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
#### Decomposition Principles
|
|
72
|
+
|
|
73
|
+
1. **1 task = 1 file** principle (where possible)
|
|
74
|
+
2. **Same file = sequential**, **different files = [P] candidate**
|
|
75
|
+
3. **Explicit dependencies**: Use `depends: [T001, T002]` to declare blocking dependencies. Tasks without `depends:` and with [P] marker are immediately parallelizable.
|
|
76
|
+
4. **[P] physical validation**: Before finalizing tasks.md, run `"${CLAUDE_PLUGIN_ROOT}/scripts/afc-parallel-validate.sh" .claude/afc/specs/{feature}/tasks.md` to verify no file path overlaps exist among [P] tasks within the same phase. Fix any conflicts before proceeding.
|
|
77
|
+
5. **Dependency graph must be a DAG**: no circular dependencies allowed. Validate before output.
|
|
78
|
+
6. **Test tasks**: Include a verification task for each testable unit
|
|
79
|
+
7. **Phase gate**: Add a `{config.gate}` validation task at the end of each Phase
|
|
80
|
+
|
|
81
|
+
### 3. Retrospective Check
|
|
82
|
+
|
|
83
|
+
If `.claude/afc/memory/retrospectives/` directory exists, load retrospective files and check:
|
|
84
|
+
- Were there previous parallel conflict issues ([P] file overlaps)? Flag similar file patterns.
|
|
85
|
+
- Were there tasks that were over-decomposed or under-decomposed? Adjust granularity.
|
|
86
|
+
|
|
87
|
+
### 4. Critic Loop
|
|
88
|
+
|
|
89
|
+
> **Always** read `${CLAUDE_PLUGIN_ROOT}/docs/critic-loop-rules.md` first and follow it.
|
|
90
|
+
|
|
91
|
+
Run the critic loop until convergence. Safety cap: 5 passes.
|
|
92
|
+
|
|
93
|
+
| Criterion | Validation |
|
|
94
|
+
|-----------|------------|
|
|
95
|
+
| **COVERAGE** | Are all files in plan.md's File Change Map included in tasks? Are all FR-* in spec.md covered? |
|
|
96
|
+
| **DEPENDENCIES** | Is the dependency graph a valid DAG? Do [P] tasks within the same phase have no file overlaps? Are all `depends:` targets valid task IDs? For physical validation of [P] file overlaps, reference the validation script: `"${CLAUDE_PLUGIN_ROOT}/scripts/afc-parallel-validate.sh"` can be called with the tasks.md path to verify no conflicts exist. |
|
|
97
|
+
|
|
98
|
+
**On FAIL**: auto-fix and continue to next pass.
|
|
99
|
+
**On ESCALATE**: pause, present options to user, apply choice, resume.
|
|
100
|
+
**On DEFER**: record reason, mark criterion clean, continue.
|
|
101
|
+
**On CONVERGE**: `✓ Critic converged ({N} passes, {M} fixes, {E} escalations)`
|
|
102
|
+
**On SAFETY CAP**: `⚠ Critic safety cap ({N} passes). Review recommended.`
|
|
103
|
+
|
|
104
|
+
### 5. Coverage Mapping
|
|
105
|
+
|
|
106
|
+
```markdown
|
|
107
|
+
## Coverage Mapping
|
|
108
|
+
| Requirement | Tasks |
|
|
109
|
+
|-------------|-------|
|
|
110
|
+
| FR-001 | T003, T007 |
|
|
111
|
+
| FR-002 | T005, T008 |
|
|
112
|
+
| NFR-001 | T012 |
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
Every FR-*/NFR-* must be mapped to at least one task.
|
|
116
|
+
|
|
117
|
+
### 6. Final Output
|
|
118
|
+
|
|
119
|
+
Save to `.claude/afc/specs/{feature}/tasks.md`, then:
|
|
120
|
+
|
|
121
|
+
```
|
|
122
|
+
Tasks generated
|
|
123
|
+
├─ .claude/afc/specs/{feature}/tasks.md
|
|
124
|
+
├─ Tasks: {total count} ({[P] count} parallelizable)
|
|
125
|
+
├─ Phases: {phase count}
|
|
126
|
+
├─ Coverage: FR {coverage}%, NFR {coverage}%
|
|
127
|
+
├─ Critic: converged ({N} passes, {M} fixes, {E} escalations)
|
|
128
|
+
└─ Next step: /afc:analyze (optional) or /afc:implement
|
|
129
|
+
```
|
|
130
|
+
|
|
131
|
+
## Notes
|
|
132
|
+
|
|
133
|
+
- **Do not write implementation code**: Write task descriptions only. Actual code is the responsibility of /afc:implement.
|
|
134
|
+
- **No over-decomposition**: Do not create separate tasks for single-line changes.
|
|
135
|
+
- **Accurate file paths**: Use paths based on the actual project structure (no guessing).
|
|
136
|
+
- **Use [P] sparingly**: Mark [P] only for truly independent tasks. When in doubt, keep sequential.
|
|
137
|
+
- **Dependencies unlock swarm**: explicit `depends:` enables /afc:implement to use native task orchestration with automatic dependency resolution. Tasks without dependencies can be claimed by parallel workers immediately.
|