cc-codeconductor 0.2.8 → 0.2.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-codeconductor",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "A multi-agent orchestration framework for AI-assisted software engineering workflows.",
   "keywords": [
     "ai",

package/presets/agy/AGENTS.md

@@ -0,0 +1,354 @@
+<!-- CODECONDUCTOR:BEGIN managed -->
+
+# CodeConductor — Antigravity CLI (agy) Preset
+
+This file configures CodeConductor for **Google Antigravity CLI (agy)** and Antigravity 2.0. Place it at `.agents/AGENTS.md` relative to your project root.
+
+---
+
+## Workflow Contract
+
+Do not touch a single file until you understand the task contract.
+
+Required flow:
+
+1. Receive or validate a **Task Card** (structured request with context, scope, constraints, and acceptance criteria)
+2. Classify risk: `low` / `medium` / `high`
+3. Route to the correct **Conductor Agent** based on task type and risk
+4. Implement **minimal diff** — only what the task requires
+5. Run tests and verify behavior
+6. Produce a **Deliverable** that meets the Scorecard criteria
+7. Wait for human review before merging
+
+Skipping any step is not an optimization. It is a defect.
+
+---
+
+## Trigger Commands
+
+Antigravity CLI loads custom slash commands from `.agents/workflows/*.md`. The following commands are registered:
+
+| Slash Command    | Workflow Description                                                |
+| ---------------- | ------------------------------------------------------------------ |
+| `/cc-feature`    | Runs the full feature design, implementation, and review workflow |
+| `/cc-fix`        | Runs the bug fix verification and repair workflow                  |
+| `/cc-refactor`   | Runs the code refactoring and test safety workflow                 |
+| `/cc-review`     | Runs a structured, multi-perspective code review and audit         |
+| `/cc-test-plan`  | Generates a structured test plan for a given scope                 |
+| `/cc-tdd-cycle`  | Runs a Test-Driven Development (TDD) cycle                         |
+| `/cc-api-contract`| Handles API contract modification and validation                  |
+| `/cc-db-migration`| Coordinates database schema migrations safely                      |
+| `/cc-pagespeed`  | Performs a web performance and Core Web Vitals audit               |
+
+---
+
+## Routing Policy
+
+### Risk Classification
+
+| Signal                                    | Risk Level |
+| ----------------------------------------- | ---------- |
+| New behavior, no existing tests           | medium     |
+| Changes to public API or contracts        | high       |
+| Database migration                        | high       |
+| Security, auth, or payment paths          | high       |
+| Internal refactor with full test coverage | low        |
+| Documentation only                        | low        |
+| Bug fix in isolated component             | low–medium |
+| New feature (no existing path)            | high       |
+
+When multiple signals apply, take the highest risk level. Do not average.
+
+### Agent Routing Table
+
+| Task Type            | Risk        | Route                                               |
+| -------------------- | ----------- | --------------------------------------------------- |
+| New feature design   | any         | `architect` → `implementer`                         |
+| Bug fix              | low         | `implementer`                                       |
+| Bug fix              | medium–high | `task-coach` → `implementer` → `tester`             |
+| Refactor             | low         | `implementer`                                       |
+| Refactor             | medium–high | `architect` → `implementer` → `reviewer`            |
+| API change           | any         | `architect` → `implementer` → `reviewer`            |
+| Database migration   | any         | `architect` → `implementer` → `tester` → `reviewer` |
+| Test coverage        | any         | `tester`                                            |
+| Documentation update | any         | `docs`                                              |
+| Codebase exploration | any         | `repo-explorer`                                     |
+| Code review          | any         | `reviewer`                                          |
+
+---
+
+## Conductor Agents
+
+---
+
+### orchestrator
+
+**Role:** Coordinates the workflow. Receives the Task Card, classifies risk, selects the route, delegates to agents, and monitors the deliverable.
+
+**Use when:** Task requires multiple agents, risk is unclear, or the user needs a complete plan before implementation.
+
+**Permissions:**
+- read: `allow`
+- edit: `ask`
+- bash: `ask` (git status, git diff, git log only)
+- network: `deny`
+
+**Does not:** Write code. Execute tests. Push to any branch.
+
+**Model:** `{{MODEL_GEMINI}}`
+
+**Responsibilities:**
+1. Validate the Task Card before doing anything else.
+2. Classify the risk level using the table above.
+3. Select and document the agent route.
+4. Surface blockers rather than working around them.
+5. Declare completion only when all Deliverables are produced and verified.
+
+**Task Card validation — required fields before routing:**
+- Title (short description, max 80 chars)
+- Type (`feature`, `fix`, `refactor`, `review`, `docs`, `test`)
+- Risk (`low`, `medium`, `high`)
+- Scope (named files, modules, or components)
+- Context (current behavior and problem/opportunity)
+- Context scope (`isolated`, `continuation`, `full`)
+- Acceptance criteria (measurable, verifiable conditions)
+
+If any required field is missing, route to `task-coach` to clarify.
+
+**Routing documentation format:**
+```markdown
+## Routing Decision
+
+Task: [title] Type: [type] Risk: [low | medium | high] Route: [agent1] → [agent2] → ...
+Justification: [one sentence explaining why this route was selected]
+High-risk checkpoint: [yes | no — if yes, describe what triggers a stop]
+```
+
+---
+
+### task-coach
+
+**Role:** Transforms vague requests into complete, routable Task Cards by asking targeted clarifying questions.
+
+**Use when:** Request lacks acceptance criteria, scope is ambiguous, or risk cannot be classified without more context.
+
+**Permissions:**
+- read: `allow`
+- edit: `deny`
+- bash: `deny`
+- network: `deny`
+
+**Model:** `{{MODEL_GEMINI}}`
+
+**Intake process:**
+1. Read the entire request before asking anything.
+2. Identify missing or ambiguous fields.
+3. Ask one focused question at a time.
+4. Wait for the answer.
+5. Produce the Task Card.
+
+**Task Card format:**
+```markdown
+## Task Card
+
+**Objective**: [one sentence]
+
+**Acceptance Criteria**:
+1. [verifiable condition]
+2. [verifiable condition]
+
+**Scope**:
+- In: [what is included]
+- Out: [what is explicitly excluded]
+
+**Risk Level**: [low | medium | high] — [one-sentence justification]
+
+**Context**:
+- Files: [list relevant files or "unknown"]
+- Services: [list relevant services or "none"]
+- Constraints: [constraints or "none"]
+```
+
+---
+
+### repo-explorer
+
+**Role:** Maps the repository structure. Identifies conventions. Locates relevant files. Estimates impact radius.
+
+**Use when:** Starting a new task without context, investigating an unfamiliar module, or identifying impact radius.
+
+**Permissions:**
+- read: `allow`
+- edit: `deny`
+- bash: `allow` (git log, git diff, git status)
+- network: `deny`
+
+**Model:** `{{MODEL_GEMINI}}`
+
+**Repo Map format:**
+```markdown
+## Repo Map
+
+**Task**: [objective from Task Card]
+
+### Structure
+[directory tree — relevant portions only]
+
+### Conventions
+| Concern | Convention |
+| ------- | ---------- |
+| Naming  | ...        |
+| Testing | ...        |
+
+### Relevant Files
+- [path/to/file] — [relevance]
+```
+
+---
+
+### architect
+
+**Role:** Designs the technical approach. Produces ADRs, module boundaries, and API contracts.
+
+**Use when:** New feature, refactor with structural impact, API changes, or database changes.
+
+**Permissions:**
+- read: `allow`
+- edit: `ask` (docs and ADRs only)
+- bash: `deny`
+- network: `deny`
+
+**Model:** `{{MODEL_GEMINI}}`
+
+**Technical Plan format:**
+```markdown
+## Technical Plan
+
+**Task**: [objective]
+**Approach**: [chosen strategy and why]
+
+**Tradeoffs**:
+- Chosen: [approach] because [reason]
+- Rejected: [alternative] because [reason]
+
+**Files Affected**:
+- [path/to/file] — [what changes]
+
+**Risks**:
+- [risk] — mitigation: [how to handle]
+
+**Open Questions**:
+- [questions for human input]
+```
+
+---
+
+### implementer
+
+**Role:** Executes the Technical Plan. Writes code following accepted designs.
+
+**Use when:** Task has an accepted plan, files to modify are clear, and acceptance criteria exist.
+
+**Permissions:**
+- read: `allow`
+- edit: `ask`
+- bash: `allow` (build, test, and lint commands only)
+- network: `deny`
+
+**Model:** `{{MODEL_GEMINI}}`
+
+**Pre-implementation checklist:**
+1. Create a Git Worktree: `git worktree add ../<branch>-session <branch>`
+2. Read the Technical Plan completely.
+3. Read the target files.
+4. Verify tests pass before starting.
+
+**Implementation Summary format:**
+```markdown
+## Implementation Summary
+
+**Task**: [objective] **Status**: complete | blocked
+**Worktree**: [path to worktree]
+
+**Changes Made**:
+- [path/to/file] — [summary of change]
+
+**Tests**:
+- Runner: [npm test | pytest | ...]
+- Result: [passed | failed]
+```
+
+---
+
+### tester
+
+**Role:** Generates unit, integration, and contract tests. Verifies behavior against acceptance criteria.
+
+**Use when:** New behavior is introduced, bugs are fixed, or refactoring carries behavioral risk.
+
+**Permissions:**
+- read: `allow`
+- edit: `ask` (test files only)
+- bash: `allow` (test commands only)
+- network: `deny`
+
+**Model:** `{{MODEL_GEMINI}}`
+
+**Coverage Summary format:**
+```markdown
+## Coverage Summary
+
+**Task**: [objective]
+**Test Files Added/Modified**:
+- [path/to/test] — [cases covered]
+
+**Test Run Results**:
+- Passed: [count]
+- Failed: [count]
+```
+
+---
+
+### reviewer
+
+**Role:** Reviews diffs for correctness, architecture alignment, security, and technical debt.
+
+**Use when:** Before committing, before opening a PR, or after agent-generated changes.
+
+**Permissions:**
+- read: `allow`
+- edit: `deny`
+- bash: `allow` (git diff, git status, test commands)
+- network: `deny`
+
+**Model:** `{{MODEL_GEMINI}}`
+
+**Review Report format:**
+```markdown
+## Review Report
+
+**Task**: [objective]
+
+### Findings
+- **CRITICAL**: [must be fixed before merge]
+- **WARNING**: [resolve before merge]
+- **SUGGESTION**: [optional enhancement]
+```
+
+---
+
+### docs
+
+**Role:** Updates README, OpenAPI specs, ADRs, and changelogs.
+
+**Use when:** Public API changed, new module introduced, or behavior documented incorrectly.
+
+**Permissions:**
+- read: `allow`
+- edit: `ask` (docs and markdown only)
+- bash: `deny`
+- network: `deny`
+
+**Model:** `{{MODEL_GEMINI}}`
+
+<!-- CODECONDUCTOR:END managed -->

package/presets/agy/README.md

@@ -0,0 +1,47 @@
+# Antigravity CLI (agy) Preset for CodeConductor
+
+This preset configures CodeConductor for **Google Antigravity CLI (agy)** and Antigravity 2.0.
+
+## Structure
+
+When installed, this preset writes files into your project's workspace customizations root:
+
+- **`.agents/AGENTS.md`**: Core agent contracts, routing policy, and workflow instructions.
+- **`.agents/rules/`**: Target rules and style guidelines (e.g., commit messages, knowledge graphs).
+- **`.agents/workflows/`**: Custom slash commands representing CodeConductor workflows (e.g., `/cc-feature`, `/cc-fix`).
+- **`.agents/skills/`**: Domain-specific skills (e.g., Spring Boot, Django, Next.js).
+
+---
+
+## Orchestrator Agent Workflow
+
+Antigravity CLI automatically parses `.agents/AGENTS.md` and registered workflows under `.agents/workflows/`.
+
+To run any CodeConductor workflow:
+
+1. Start the Antigravity CLI:
+   ```bash
+   agy
+   ```
+2. Run one of the custom slash commands:
+   ```text
+   /cc-feature "Describe the new feature to build"
+   /cc-fix "Describe the bug and where it is"
+   /cc-refactor "Describe the refactoring scope"
+   ```
+
+---
+
+## Configuration Settings (`settings.json`)
+
+To configure permissions, models, and execution modes for the Antigravity CLI, update your global settings at `~/.gemini/antigravity-cli/settings.json` or project-scoped settings.
+
+Recommended settings:
+```json
+{
+  "model": "gemini-3.5-pro",
+  "toolPermission": "request-review",
+  "enableTerminalSandbox": true,
+  "allowNonWorkspaceAccess": false
+}
+```

package/presets/agy/hooks.json

@@ -0,0 +1,30 @@
+{
+  "code-formatter": {
+    "enabled": true,
+    "PostToolUse": [
+      {
+        "matcher": "write_to_file|replace_file_content|multi_replace_file_content",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if [ -f \"./.agents/scripts/post-tool.sh\" ]; then bash ./.agents/scripts/post-tool.sh; else bash \"$HOME/.gemini/config/scripts/post-tool.sh\"; fi"
+          }
+        ]
+      }
+    ]
+  },
+  "safety-gate": {
+    "enabled": true,
+    "PreToolUse": [
+      {
+        "matcher": "run_command|write_to_file|replace_file_content|multi_replace_file_content|view_file",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "if [ -f \"./.agents/scripts/pre-tool.sh\" ]; then bash ./.agents/scripts/pre-tool.sh; else bash \"$HOME/.gemini/config/scripts/pre-tool.sh\"; fi"
+          }
+        ]
+      }
+    ]
+  }
+}

package/presets/agy/mcp_config.json

@@ -0,0 +1,3 @@
+{
+  "mcpServers": {}
+}

package/presets/agy/rules/commit-style.md

@@ -0,0 +1 @@
+{{COMMIT_STYLE}}

package/presets/agy/rules/graphify.md

@@ -0,0 +1,14 @@
+---
+trigger: always_on
+description: Consult the graphify knowledge graph at graphify-out/ for codebase and architecture questions.
+---
+
+## graphify
+
+This project has a graphify knowledge graph at graphify-out/.
+
+Rules:
+- For codebase or architecture questions, when `graphify-out/graph.json` exists, first run `graphify query "<question>"` (CLI) or `query_graph` (MCP). Use `graphify path "<A>" "<B>"` / `shortest_path` for relationships and `graphify explain "<concept>"` / `get_node` for focused concepts. These return a scoped subgraph, usually much smaller than `GRAPH_REPORT.md` or raw grep output.
+- If graphify-out/wiki/index.md exists, navigate it instead of reading raw files
+- Read graphify-out/GRAPH_REPORT.md only for broad architecture review or when query/path/explain do not surface enough context
+- After modifying code files in this session, run `graphify update .` to keep the graph current (AST-only, no API cost)

package/presets/agy/scripts/post-tool.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# Read stdin JSON payload
+JSON_INPUT=$(cat)
+TOOL_NAME=$(echo "$JSON_INPUT" | jq -r '.toolName')
+
+if [[ "$TOOL_NAME" == "write_to_file" || "$TOOL_NAME" == "replace_file_content" || "$TOOL_NAME" == "multi_replace_file_content" ]]; then
+  FILE_PATH=$(echo "$JSON_INPUT" | jq -r '.arguments.TargetFile')
+  if [ -f "$FILE_PATH" ]; then
+    # Run Prettier
+    if echo "$FILE_PATH" | grep -qE '\.(ts|tsx|js|jsx|mjs|cjs|json|jsonc|md|mdx|css|scss|html|astro|yaml|yml)$'; then
+      npx --no-install prettier --write "$FILE_PATH" 2>/dev/null || true
+    fi
+    # Run ESLint
+    if echo "$FILE_PATH" | grep -qE '\.(ts|tsx|js|jsx|mjs|cjs)$'; then
+      npx --no-install eslint --fix "$FILE_PATH" 2>/dev/null || true
+    fi
+    # Run Ruff (Python)
+    if echo "$FILE_PATH" | grep -qE '\.py$'; then
+      ruff format "$FILE_PATH" 2>/dev/null && ruff check --fix "$FILE_PATH" 2>/dev/null || true
+    fi
+  fi
+fi
+
+# Return an empty JSON object to stdout
+echo "{}"

package/presets/agy/scripts/pre-tool.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# Read stdin JSON payload
+JSON_INPUT=$(cat)
+TOOL_NAME=$(echo "$JSON_INPUT" | jq -r '.toolName')
+
+# Check paths for write/edit/read operations
+TARGET_PATH=""
+if [[ "$TOOL_NAME" == "write_to_file" || "$TOOL_NAME" == "replace_file_content" || "$TOOL_NAME" == "multi_replace_file_content" ]]; then
+  TARGET_PATH=$(echo "$JSON_INPUT" | jq -r '.arguments.TargetFile')
+elif [[ "$TOOL_NAME" == "view_file" ]]; then
+  TARGET_PATH=$(echo "$JSON_INPUT" | jq -r '.arguments.AbsolutePath')
+fi
+
+if [[ ! -z "$TARGET_PATH" ]]; then
+  if echo "$TARGET_PATH" | grep -qE '(\.env|secrets/|/\.ssh/|/\.aws/|/\.kube/)'; then
+    echo '{"action": "deny", "error": "Blocked: Attempt to access sensitive path"}'
+    exit 0
+  fi
+fi
+
+if [[ "$TOOL_NAME" == "run_command" ]]; then
+  COMMAND_LINE=$(echo "$JSON_INPUT" | jq -r '.arguments.CommandLine')
+
+  # 1. Deny patterns
+  if echo "$COMMAND_LINE" | grep -qE '(\.env|secrets/|id_rsa|\\.pem|\\.key)\\b' && echo "$COMMAND_LINE" | grep -qE '(cat|less|more|head|tail|cp |mv |scp )'; then
+    echo '{"action": "deny", "error": "Blocked: Attempt to read sensitive files"}'
+    exit 0
+  fi
+
+  if echo "$COMMAND_LINE" | grep -qE '^rm\s+-rf\s+\*' || \
+     echo "$COMMAND_LINE" | grep -qE '^sudo\s+' || \
+     echo "$COMMAND_LINE" | grep -qE '^git\s+push\s+.*--force' || \
+     echo "$COMMAND_LINE" | grep -qE '^git\s+push\s+.*-f' || \
+     echo "$COMMAND_LINE" | grep -qE '^git\s+rebase\s+' || \
+     echo "$COMMAND_LINE" | grep -qE '^git\s+reset\s+--hard\s+' || \
+     echo "$COMMAND_LINE" | grep -qE 'curl\s+.*\s*\|\s*(sh|bash)' || \
+     echo "$COMMAND_LINE" | grep -qE 'wget\s+.*\s*\|\s*(sh|bash)' || \
+     echo "$COMMAND_LINE" | grep -qE '^chmod\s+777\s+' || \
+     echo "$COMMAND_LINE" | grep -qE '^dd\s+' || \
+     echo "$COMMAND_LINE" | grep -qE '^mkfs\s+'; then
+    echo '{"action": "deny", "error": "Blocked: Command violated security policy"}'
+    exit 0
+  fi
+
+  # 2. Ask patterns
+  if echo "$COMMAND_LINE" | grep -qE '^git\s+commit\s*' || \
+     echo "$COMMAND_LINE" | grep -qE '^git\s+checkout\s*' || \
+     echo "$COMMAND_LINE" | grep -qE '^git\s+switch\s*' || \
+     echo "$COMMAND_LINE" | grep -qE '^docker\s+compose\s*'; then
+    echo '{"action": "ask"}'
+    exit 0
+  fi
+fi
+
+# Default: allow
+echo '{"action": "allow"}'

package/presets/agy/settings.json

@@ -0,0 +1,8 @@
+{
+  "model": "gemini-3.5-pro",
+  "toolPermission": "request-review",
+  "enableTerminalSandbox": true,
+  "allowNonWorkspaceAccess": false,
+  "verbosity": "low",
+  "alwaysThinkingEnabled": true
+}

package/presets/agy/skills/cc-api-contract/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: cc-api-contract
+description:
+  Run the API contract workflow for request/response shape changes,
+  compatibility constraints, contract tests, documentation, and review.
+---
+
+# API Contract Workflow
+
+API contract request: $ARGUMENTS
+
+## Step 1 — Task Card validation (task-coach)
+
+Invoke `task-coach` with the request above.
+
+The Task Card must classify the task as `feature` or `refactor` with `high`
+risk unless the human provides a narrower validated risk. It must include:
+
+- affected endpoint, command, or public interface
+- request and response examples
+- backward compatibility and versioning impact
+- consumers that must remain compatible
+- contract tests and documentation acceptance criteria
+
+**STOP here. Show the Task Card and wait for human confirmation.**
+
+---
+
+## Step 2 — Technical Plan (architect)
+
+Invoke `architect` with the approved Task Card.
+
+architect must define the API contract, compatibility strategy, validation
+rules, docs/OpenAPI impact, and migration path for consumers.
+
+**STOP here. Show the Technical Plan and wait for explicit human approval.**
+
+---
+
+## Step 3 — Implementation (implementer)
+
+Invoke `implementer` with the approved plan.
+
+implementer must apply the minimal diff, preserve compatible behavior unless a
+breaking change was explicitly approved, and update only the files named in the
+plan.
+
+---
+
+## Step 4 — Contract tests (tester)
+
+Invoke `tester`.
+
+tester must add or update contract tests covering request shape, response shape,
+status/error behavior, and backward compatibility constraints.
+
+---
+
+## Step 5 — Review (reviewer)
+
+Invoke `reviewer`.
+
+reviewer must block on missing contract tests, undocumented breaking changes,
+or docs/OpenAPI drift.
+
+---
+
+## Completion
+
+Report the final Task Card, Technical Plan, implementation summary, test report,
+review report, docs updated, compatibility impact, and residual risks.

package/presets/agy/skills/cc-db-migration/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: cc-db-migration
+description:
+  Run the database migration workflow for schema/data changes, operational
+  sequencing, tests, and review.
+---
+
+# Database Migration Workflow
+
+Migration request: $ARGUMENTS
+
+## Step 1 — Task Card validation (task-coach)
+
+Invoke `task-coach` with the request above.
+
+The Task Card must classify the task as `high` risk and include:
+
+- tables, collections, models, or migration files in scope
+- data backfill or data cleanup requirements
+- deployment ordering and compatibility window
+- rollback or forward-fix strategy
+- lock risk, data risk, and verification commands
+
+**STOP here. Show the Task Card and wait for human confirmation.**
+
+---
+
+## Step 2 — Migration Plan (architect)
+
+Invoke `architect` with the approved Task Card.
+
+architect must define the schema/data plan, operational sequencing,
+compatibility strategy, rollback/forward-fix notes, and test approach.
+
+**STOP here. Show the Technical Plan and wait for explicit human approval.**
+
+---
+
+## Step 3 — Implementation (implementer)
+
+Invoke `implementer` with the approved plan.
+
+implementer must keep model and migration changes together, avoid unrelated
+refactors, and preserve the deployment order specified by architect.
+
+---
+
+## Step 4 — Migration tests (tester)
+
+Invoke `tester`.
+
+tester must cover migration-sensitive behavior where the stack supports it,
+including happy path, existing-data edge cases, and rollback/forward-fix notes
+when automated rollback tests are not practical.
+
+---
+
+## Step 5 — Review (reviewer)
+
+Invoke `reviewer`.
+
+reviewer must block on missing migration tests, missing data-risk notes,
+undocumented deployment sequencing, or model/migration drift.
+
+---
+
+## Completion
+
+Report migration files changed, model files changed, tests run, lock risk, data
+risk, operational sequencing, rollback/forward-fix notes, and residual risk.