axon-code 2.4.0 → 2.5.1

package/dist/skills/builtin/code-review/SKILL.md

@@ -0,0 +1,75 @@
+---
+description: Review code changes for quality, correctness, and maintainability. Use when the user asks to review code, a PR, staged changes, or specific files.
+user-invocable: true
+argument-hint: "[file/dir path or --staged]"
+---
+
+# Code Review
+
+Review code changes systematically against a quality checklist.
+
+## Arguments
+- `$ARGUMENTS` - Optional: file path, directory, or `--staged` flag. Defaults to all uncommitted changes.
+
+## Review Checklist
+
+For each changed file, check the following in order:
+
+### 1. Correctness
+- Does the logic do what it's supposed to do?
+- Are there off-by-one errors, null/undefined risks, or unhandled edge cases?
+- Are async operations properly awaited? Are error paths handled?
+
+### 2. Security
+- No command injection, XSS, SQL injection, or path traversal
+- No hardcoded secrets, credentials, or API keys
+- User input validated at system boundaries
+
+### 3. TypeScript Quality
+- Types are accurate, no unnecessary `any` or type assertions
+- No implicit `any` from missing type annotations on public APIs
+- Generics used appropriately (not over-engineered)
+
+### 4. Readability
+- Variable and function names are clear and descriptive
+- Complex logic has comments explaining *why*, not *what*
+- Functions are reasonably sized (flag functions > 50 lines for review)
+
+### 5. Performance
+- No obvious N+1 queries or unnecessary loops
+- Large data not loaded entirely into memory when streaming is possible
+- No synchronous I/O in hot paths
+
+### 6. Testing
+- Are new code paths covered by tests?
+- Are edge cases tested?
+- Do test names clearly describe what they verify?
+
+## Output Format
+
+For each file with findings, output:
+
+```
+## <file_path>
+
+### <severity>: <brief title>
+Line <N>: <description>
+Suggestion: <how to fix>
+```
+
+Severity levels:
+- **CRITICAL** - Must fix. Bugs, security issues, data loss risks.
+- **WARNING** - Should fix. Code smells, potential issues, maintainability concerns.
+- **NOTE** - Optional. Style suggestions, minor improvements.
+
+## Process
+
+1. Determine scope: parse `$ARGUMENTS` to decide what to review
+   - No args: `git diff` + `git diff --cached` (all uncommitted changes)
+   - `--staged`: `git diff --cached` only
+   - File/dir path: read those files directly
+2. For each changed file, read the full file for context (not just the diff)
+3. Apply the checklist above systematically
+4. Group findings by file, ordered by severity (CRITICAL first)
+5. End with a summary: total files reviewed, finding counts by severity
+6. If no issues found, say so explicitly -- don't invent problems

package/dist/skills/builtin/doc-coauthoring/SKILL.md

@@ -0,0 +1,375 @@
+---
+name: doc-coauthoring
+description: Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.
+---
+
+# Doc Co-Authoring Workflow
+
+This skill provides a structured workflow for guiding users through collaborative document creation. Act as an active guide, walking users through three stages: Context Gathering, Refinement & Structure, and Reader Testing.
+
+## When to Offer This Workflow
+
+**Trigger conditions:**
+- User mentions writing documentation: "write a doc", "draft a proposal", "create a spec", "write up"
+- User mentions specific doc types: "PRD", "design doc", "decision doc", "RFC"
+- User seems to be starting a substantial writing task
+
+**Initial offer:**
+Offer the user a structured workflow for co-authoring the document. Explain the three stages:
+
+1. **Context Gathering**: User provides all relevant context while Claude asks clarifying questions
+2. **Refinement & Structure**: Iteratively build each section through brainstorming and editing
+3. **Reader Testing**: Test the doc with a fresh Claude (no context) to catch blind spots before others read it
+
+Explain that this approach helps ensure the doc works well when others read it (including when they paste it into Claude). Ask if they want to try this workflow or prefer to work freeform.
+
+If user declines, work freeform. If user accepts, proceed to Stage 1.
+
+## Stage 1: Context Gathering
+
+**Goal:** Close the gap between what the user knows and what Claude knows, enabling smart guidance later.
+
+### Initial Questions
+
+Start by asking the user for meta-context about the document:
+
+1. What type of document is this? (e.g., technical spec, decision doc, proposal)
+2. Who's the primary audience?
+3. What's the desired impact when someone reads this?
+4. Is there a template or specific format to follow?
+5. Any other constraints or context to know?
+
+Inform them they can answer in shorthand or dump information however works best for them.
+
+**If user provides a template or mentions a doc type:**
+- Ask if they have a template document to share
+- If they provide a link to a shared document, use the appropriate integration to fetch it
+- If they provide a file, read it
+
+**If user mentions editing an existing shared document:**
+- Use the appropriate integration to read the current state
+- Check for images without alt-text
+- If images exist without alt-text, explain that when others use Claude to understand the doc, Claude won't be able to see them. Ask if they want alt-text generated. If so, request they paste each image into chat for descriptive alt-text generation.
+
+### Info Dumping
+
+Once initial questions are answered, encourage the user to dump all the context they have. Request information such as:
+- Background on the project/problem
+- Related team discussions or shared documents
+- Why alternative solutions aren't being used
+- Organizational context (team dynamics, past incidents, politics)
+- Timeline pressures or constraints
+- Technical architecture or dependencies
+- Stakeholder concerns
+
+Advise them not to worry about organizing it - just get it all out. Offer multiple ways to provide context:
+- Info dump stream-of-consciousness
+- Point to team channels or threads to read
+- Link to shared documents
+
+**If integrations are available** (e.g., Slack, Teams, Google Drive, SharePoint, or other MCP servers), mention that these can be used to pull in context directly.
+
+**If no integrations are detected and in Claude.ai or Claude app:** Suggest they can enable connectors in their Claude settings to allow pulling context from messaging apps and document storage directly.
+
+Inform them clarifying questions will be asked once they've done their initial dump.
+
+**During context gathering:**
+
+- If user mentions team channels or shared documents:
+  - If integrations available: Inform them the content will be read now, then use the appropriate integration
+  - If integrations not available: Explain lack of access. Suggest they enable connectors in Claude settings, or paste the relevant content directly.
+
+- If user mentions entities/projects that are unknown:
+  - Ask if connected tools should be searched to learn more
+  - Wait for user confirmation before searching
+
+- As user provides context, track what's being learned and what's still unclear
+
+**Asking clarifying questions:**
+
+When user signals they've done their initial dump (or after substantial context provided), ask clarifying questions to ensure understanding:
+
+Generate 5-10 numbered questions based on gaps in the context.
+
+Inform them they can use shorthand to answer (e.g., "1: yes, 2: see #channel, 3: no because backwards compat"), link to more docs, point to channels to read, or just keep info-dumping. Whatever's most efficient for them.
+
+**Exit condition:**
+Sufficient context has been gathered when questions show understanding - when edge cases and trade-offs can be asked about without needing basics explained.
+
+**Transition:**
+Ask if there's any more context they want to provide at this stage, or if it's time to move on to drafting the document.
+
+If user wants to add more, let them. When ready, proceed to Stage 2.
+
+## Stage 2: Refinement & Structure
+
+**Goal:** Build the document section by section through brainstorming, curation, and iterative refinement.
+
+**Instructions to user:**
+Explain that the document will be built section by section. For each section:
+1. Clarifying questions will be asked about what to include
+2. 5-20 options will be brainstormed
+3. User will indicate what to keep/remove/combine
+4. The section will be drafted
+5. It will be refined through surgical edits
+
+Start with whichever section has the most unknowns (usually the core decision/proposal), then work through the rest.
+
+**Section ordering:**
+
+If the document structure is clear:
+Ask which section they'd like to start with.
+
+Suggest starting with whichever section has the most unknowns. For decision docs, that's usually the core proposal. For specs, it's typically the technical approach. Summary sections are best left for last.
+
+If user doesn't know what sections they need:
+Based on the type of document and template, suggest 3-5 sections appropriate for the doc type.
+
+Ask if this structure works, or if they want to adjust it.
+
+**Once structure is agreed:**
+
+Create the initial document structure with placeholder text for all sections.
+
+**If access to artifacts is available:**
+Use `create_file` to create an artifact. This gives both Claude and the user a scaffold to work from.
+
+Inform them that the initial structure with placeholders for all sections will be created.
+
+Create artifact with all section headers and brief placeholder text like "[To be written]" or "[Content here]".
+
+Provide the scaffold link and indicate it's time to fill in each section.
+
+**If no access to artifacts:**
+Create a markdown file in the working directory. Name it appropriately (e.g., `decision-doc.md`, `technical-spec.md`).
+
+Inform them that the initial structure with placeholders for all sections will be created.
+
+Create file with all section headers and placeholder text.
+
+Confirm the filename has been created and indicate it's time to fill in each section.
+
+**For each section:**
+
+### Step 1: Clarifying Questions
+
+Announce work will begin on the [SECTION NAME] section. Ask 5-10 clarifying questions about what should be included:
+
+Generate 5-10 specific questions based on context and section purpose.
+
+Inform them they can answer in shorthand or just indicate what's important to cover.
+
+### Step 2: Brainstorming
+
+For the [SECTION NAME] section, brainstorm [5-20] things that might be included, depending on the section's complexity. Look for:
+- Context shared that might have been forgotten
+- Angles or considerations not yet mentioned
+
+Generate 5-20 numbered options based on section complexity. At the end, offer to brainstorm more if they want additional options.
+
+### Step 3: Curation
+
+Ask which points should be kept, removed, or combined. Request brief justifications to help learn priorities for the next sections.
+
+Provide examples:
+- "Keep 1,4,7,9"
+- "Remove 3 (duplicates 1)"
+- "Remove 6 (audience already knows this)"
+- "Combine 11 and 12"
+
+**If user gives freeform feedback** (e.g., "looks good" or "I like most of it but...") instead of numbered selections, extract their preferences and proceed. Parse what they want kept/removed/changed and apply it.
+
+### Step 4: Gap Check
+
+Based on what they've selected, ask if there's anything important missing for the [SECTION NAME] section.
+
+### Step 5: Drafting
+
+Use `str_replace` to replace the placeholder text for this section with the actual drafted content.
+
+Announce the [SECTION NAME] section will be drafted now based on what they've selected.
+
+**If using artifacts:**
+After drafting, provide a link to the artifact.
+
+Ask them to read through it and indicate what to change. Note that being specific helps learning for the next sections.
+
+**If using a file (no artifacts):**
+After drafting, confirm completion.
+
+Inform them the [SECTION NAME] section has been drafted in [filename]. Ask them to read through it and indicate what to change. Note that being specific helps learning for the next sections.
+
+**Key instruction for user (include when drafting the first section):**
+Provide a note: Instead of editing the doc directly, ask them to indicate what to change. This helps learning of their style for future sections. For example: "Remove the X bullet - already covered by Y" or "Make the third paragraph more concise".
+
+### Step 6: Iterative Refinement
+
+As user provides feedback:
+- Use `str_replace` to make edits (never reprint the whole doc)
+- **If using artifacts:** Provide link to artifact after each edit
+- **If using files:** Just confirm edits are complete
+- If user edits doc directly and asks to read it: mentally note the changes they made and keep them in mind for future sections (this shows their preferences)
+
+**Continue iterating** until user is satisfied with the section.
+
+### Quality Checking
+
+After 3 consecutive iterations with no substantial changes, ask if anything can be removed without losing important information.
+
+When section is done, confirm [SECTION NAME] is complete. Ask if ready to move to the next section.
+
+**Repeat for all sections.**
+
+### Near Completion
+
+As approaching completion (80%+ of sections done), announce intention to re-read the entire document and check for:
+- Flow and consistency across sections
+- Redundancy or contradictions
+- Anything that feels like "slop" or generic filler
+- Whether every sentence carries weight
+
+Read entire document and provide feedback.
+
+**When all sections are drafted and refined:**
+Announce all sections are drafted. Indicate intention to review the complete document one more time.
+
+Review for overall coherence, flow, completeness.
+
+Provide any final suggestions.
+
+Ask if ready to move to Reader Testing, or if they want to refine anything else.
+
+## Stage 3: Reader Testing
+
+**Goal:** Test the document with a fresh Claude (no context bleed) to verify it works for readers.
+
+**Instructions to user:**
+Explain that testing will now occur to see if the document actually works for readers. This catches blind spots - things that make sense to the authors but might confuse others.
+
+### Testing Approach
+
+**If access to sub-agents is available (e.g., in Claude Code):**
+
+Perform the testing directly without user involvement.
+
+### Step 1: Predict Reader Questions
+
+Announce intention to predict what questions readers might ask when trying to discover this document.
+
+Generate 5-10 questions that readers would realistically ask.
+
+### Step 2: Test with Sub-Agent
+
+Announce that these questions will be tested with a fresh Claude instance (no context from this conversation).
+
+For each question, invoke a sub-agent with just the document content and the question.
+
+Summarize what Reader Claude got right/wrong for each question.
+
+### Step 3: Run Additional Checks
+
+Announce additional checks will be performed.
+
+Invoke sub-agent to check for ambiguity, false assumptions, contradictions.
+
+Summarize any issues found.
+
+### Step 4: Report and Fix
+
+If issues found:
+Report that Reader Claude struggled with specific issues.
+
+List the specific issues.
+
+Indicate intention to fix these gaps.
+
+Loop back to refinement for problematic sections.
+
+---
+
+**If no access to sub-agents (e.g., claude.ai web interface):**
+
+The user will need to do the testing manually.
+
+### Step 1: Predict Reader Questions
+
+Ask what questions people might ask when trying to discover this document. What would they type into Claude.ai?
+
+Generate 5-10 questions that readers would realistically ask.
+
+### Step 2: Setup Testing
+
+Provide testing instructions:
+1. Open a fresh Claude conversation: https://claude.ai
+2. Paste or share the document content (if using a shared doc platform with connectors enabled, provide the link)
+3. Ask Reader Claude the generated questions
+
+For each question, instruct Reader Claude to provide:
+- The answer
+- Whether anything was ambiguous or unclear
+- What knowledge/context the doc assumes is already known
+
+Check if Reader Claude gives correct answers or misinterprets anything.
+
+### Step 3: Additional Checks
+
+Also ask Reader Claude:
+- "What in this doc might be ambiguous or unclear to readers?"
+- "What knowledge or context does this doc assume readers already have?"
+- "Are there any internal contradictions or inconsistencies?"
+
+### Step 4: Iterate Based on Results
+
+Ask what Reader Claude got wrong or struggled with. Indicate intention to fix those gaps.
+
+Loop back to refinement for any problematic sections.
+
+---
+
+### Exit Condition (Both Approaches)
+
+When Reader Claude consistently answers questions correctly and doesn't surface new gaps or ambiguities, the doc is ready.
+
+## Final Review
+
+When Reader Testing passes:
+Announce the doc has passed Reader Claude testing. Before completion:
+
+1. Recommend they do a final read-through themselves - they own this document and are responsible for its quality
+2. Suggest double-checking any facts, links, or technical details
+3. Ask them to verify it achieves the impact they wanted
+
+Ask if they want one more review, or if the work is done.
+
+**If user wants final review, provide it. Otherwise:**
+Announce document completion. Provide a few final tips:
+- Consider linking this conversation in an appendix so readers can see how the doc was developed
+- Use appendices to provide depth without bloating the main doc
+- Update the doc as feedback is received from real readers
+
+## Tips for Effective Guidance
+
+**Tone:**
+- Be direct and procedural
+- Explain rationale briefly when it affects user behavior
+- Don't try to "sell" the approach - just execute it
+
+**Handling Deviations:**
+- If user wants to skip a stage: Ask if they want to skip this and write freeform
+- If user seems frustrated: Acknowledge this is taking longer than expected. Suggest ways to move faster
+- Always give user agency to adjust the process
+
+**Context Management:**
+- Throughout, if context is missing on something mentioned, proactively ask
+- Don't let gaps accumulate - address them as they come up
+
+**Artifact Management:**
+- Use `create_file` for drafting full sections
+- Use `str_replace` for all edits
+- Provide artifact link after every change
+- Never use artifacts for brainstorming lists - that's just conversation
+
+**Quality over Speed:**
+- Don't rush through stages
+- Each iteration should make meaningful improvements
+- The goal is a document that actually works for readers

package/dist/skills/builtin/doctor/SKILL.md

@@ -0,0 +1,166 @@
+---
+description: Perform comprehensive security audit of Axon configuration, skills, browser settings, and environment. Use when asked to check security or diagnose potential vulnerabilities.
+user-invocable: true
+argument-hint: "[component=all|config|skills|browser|web|env]"
+---
+
+# Security Doctor Skill
+
+Perform a comprehensive security audit of the Axon environment, identifying potential security risks and misconfigurations.
+
+## Audit Components
+
+### 1. File Permissions Check
+
+**Purpose**: Ensure sensitive directories and files are properly protected.
+
+**Steps**:
+1. Check `~/.axon/` directory permissions
+   - Read using Bash: `ls -la ~/.axon`
+   - **CRITICAL**: Directory should NOT be world-readable (no `drwxrwxrwx`)
+   - **WARN**: Recommend `chmod 700 ~/.axon` if too permissive
+
+2. Check `~/.axon/settings.json` permissions
+   - Read using Bash: `ls -l ~/.axon/settings.json`
+   - **CRITICAL**: File should be readable only by owner (recommend `600`)
+
+3. Check browser profile directory
+   - Read using Bash: `ls -la ~/.axon/browser-profile` (or wherever browser profile is stored)
+   - **WARN**: Browser profile should not be world-accessible
+
+### 2. Configuration Security Check
+
+**Purpose**: Detect plain-text API keys and sensitive data in configuration files.
+
+**Steps**:
+1. Read `~/.axon/settings.json` using Read tool
+2. Check for sensitive patterns:
+   - **CRITICAL**: Plain-text API keys matching pattern `sk-ant-[a-zA-Z0-9-_]+`
+   - **CRITICAL**: AWS credentials (`aws_access_key_id`, `aws_secret_access_key`)
+   - **WARN**: Unencrypted passwords or tokens
+3. **Recommendation**: API keys should use environment variables or secure storage
+
+### 3. Skill Security Scan
+
+**Purpose**: Detect malicious or dangerous patterns in loaded skills.
+
+**Steps**:
+1. Scan all skills in:
+   - `~/.axon/skills/`
+   - `.axon/skills/` (project-level)
+   
+2. For each skill SKILL.md file, check for dangerous patterns:
+   - **CRITICAL**: `child_process` module usage
+   - **CRITICAL**: `exec(`, `spawn(`, `eval(` function calls
+   - **CRITICAL**: Crypto-mining keywords (`stratum+tcp`, `xmrig`, `coinhive`)
+   - **WARN**: Excessive `process.env.*` accesses (>=3 different env vars)
+   - **WARN**: Suspicious base64 strings (>100 chars)
+
+3. Use Grep tool with patterns:
+   ```
+   grep -rn "child_process\|exec(\|spawn(\|eval(" ~/.axon/skills .axon/skills
+   grep -rn "stratum+tcp\|xmrig\|coinhive" ~/.axon/skills .axon/skills
+   ```
+
+4. Report any matches with file path and line number
+
+### 4. Browser Security Check
+
+**Purpose**: Ensure browser usage doesn't expose sensitive data.
+
+**Steps**:
+1. Check if browser profile directory exists
+   - Bash: `ls ~/.axon/browser-profile 2>/dev/null`
+   
+2. **WARN** if profile directory is in a shared location (e.g., `/tmp/`)
+
+3. Check browser cookies for sensitive domains:
+   - Read using Browser tool (if running): action `cookies`
+   - **INFO**: List domains with stored cookies
+   - **WARN**: Cookies from banking/financial domains
+
+### 5. Web Server Security Check
+
+**Purpose**: Verify Web UI mode is properly secured (if enabled).
+
+**Steps**:
+1. Check if Web mode is running:
+   - Bash: `ps aux | grep -i "axon.*web\|axon.*server" | grep -v grep`
+   
+2. If running, check:
+   - **CRITICAL**: Port should not be exposed to 0.0.0.0 without authentication
+   - **WARN**: Check if authentication is enabled in settings.json (`webAuth` field)
+   - **WARN**: Check if HTTPS is enabled (`webSSL` field)
+
+3. Recommendations:
+   - Use authentication for Web UI
+   - Bind to localhost (127.0.0.1) only, use SSH tunneling for remote access
+   - Enable HTTPS for production use
+
+### 6. Environment Variable Check
+
+**Purpose**: Detect potential environment variable leakage.
+
+**Steps**:
+1. Check for sensitive environment variables:
+   - Bash: `printenv | grep -E "(API|KEY|SECRET|TOKEN|PASSWORD)" | wc -l`
+   
+2. **INFO**: Report count of potentially sensitive env vars
+
+3. **WARN** if any skill or config attempts to log environment variables:
+   - Grep: `grep -rn "console.log.*process.env\|console.error.*process.env" ~/.axon .axon`
+
+## Output Format
+
+Produce a structured security report with three severity levels:
+
+```
+# Security Audit Report
+
+Date: [current date/time]
+Audit Scope: [all|component name]
+
+## CRITICAL Issues (Immediate Action Required)
+
+- [Issue description with file path/command to fix]
+- [Another critical issue]
+
+## WARNINGS (Recommended to Address)
+
+- [Warning description]
+- [Another warning]
+
+## INFO (Good to Know)
+
+- [Informational finding]
+
+## Summary
+
+- Total Issues: X (Critical: Y, Warnings: Z)
+- Security Score: [Green/Yellow/Red based on critical count]
+  - Green: 0 critical issues
+  - Yellow: 1-2 critical issues
+  - Red: 3+ critical issues
+
+## Recommendations
+
+1. [Specific actionable recommendation]
+2. [Another recommendation]
+```
+
+## Important Notes
+
+- **Read-only operations**: This skill should NEVER modify files or execute destructive commands
+- Use Bash tool for permission checks (ls, stat) and process checks (ps, netstat)
+- Use Read tool for file content analysis
+- Use Grep tool for pattern scanning across multiple files
+- If any command fails (e.g., file doesn't exist), note as INFO and continue
+- Provide clear remediation steps for each finding
+- Save summary to project notebook for tracking fixes across sessions
+
+## Usage Examples
+
+- `/doctor` - Full security audit
+- `/doctor config` - Check configuration security only
+- `/doctor skills` - Scan all skills for dangerous patterns
+- `/doctor browser` - Check browser-related security

package/dist/skills/builtin/docx/LICENSE.txt

@@ -0,0 +1,30 @@
+© 2025 Anthropic, PBC. All rights reserved.
+
+LICENSE: Use of these materials (including all code, prompts, assets, files,
+and other components of this Skill) is governed by your agreement with
+Anthropic regarding use of Anthropic's services. If no separate agreement
+exists, use is governed by Anthropic's Consumer Terms of Service or
+Commercial Terms of Service, as applicable:
+https://www.anthropic.com/legal/consumer-terms
+https://www.anthropic.com/legal/commercial-terms
+Your applicable agreement is referred to as the "Agreement." "Services" are
+as defined in the Agreement.
+
+ADDITIONAL RESTRICTIONS: Notwithstanding anything in the Agreement to the
+contrary, users may not:
+
+- Extract these materials from the Services or retain copies of these
+  materials outside the Services
+- Reproduce or copy these materials, except for temporary copies created
+  automatically during authorized use of the Services
+- Create derivative works based on these materials
+- Distribute, sublicense, or transfer these materials to any third party
+- Make, offer to sell, sell, or import any inventions embodied in these
+  materials
+- Reverse engineer, decompile, or disassemble these materials
+
+The receipt, viewing, or possession of these materials does not convey or
+imply any license or right beyond those expressly granted above.
+
+Anthropic retains all right, title, and interest in these materials,
+including all copyrights, patents, and other intellectual property rights.