chati-dev 3.2.5 → 3.3.0

package/framework/tasks/architect-dep-audit.md

@@ -0,0 +1,128 @@
+---
+id: architect-dep-audit
+agent: architect
+trigger: architect-stack-selection
+phase: plan
+requires_input: false
+parallelizable: false
+outputs: [dep-audit.yaml]
+handoff_to: architect-api-design
+autonomous_gate: true
+criteria:
+  - All chosen dependencies verified against vulnerability databases
+  - No critical or high severity CVEs at selected versions
+  - No deprecated packages in the stack
+  - Peer dependency compatibility confirmed
+  - License compliance verified (no GPL in proprietary projects)
+---
+# Dependency Audit (Greenfield)
+
+## Purpose
+Verify that the technology stack chosen in `architect-stack-selection` has no known vulnerabilities, deprecated packages, or compatibility issues BEFORE implementation begins.
+
+This prevents the scenario where `npm install` on day 1 reveals critical vulnerabilities that require breaking changes to resolve.
+
+## Prerequisites
+- `stack-selection.yaml` exists with chosen technologies and versions
+- Version verification from stack-selection completed
+
+## Steps
+
+### 1. Generate Dependency Manifest
+From `stack-selection.yaml`, create a virtual dependency list:
+- Extract all packages with their chosen versions
+- Include both production and development dependencies
+- Include peer dependencies implied by framework choices
+
+### 2. Check Vulnerabilities
+For each dependency at the chosen version:
+- Query known CVE databases (npm audit, GitHub Advisory Database)
+- Check for known security advisories
+- Classify findings by severity: critical, high, moderate, low
+
+```yaml
+# Example finding
+- package: "lodash"
+  version: "4.17.15"
+  vulnerability:
+    id: "CVE-2021-23337"
+    severity: high
+    description: "Prototype pollution in lodash"
+    fixed_in: "4.17.21"
+    recommendation: "Upgrade to 4.17.21+"
+```
+
+### 3. Verify Deprecation Status
+For each dependency:
+- Check if the package is deprecated on its registry
+- Check if the chosen version is in an unsupported/EOL branch
+- Flag packages with no updates in > 12 months (potential abandonment)
+
+### 4. Verify Peer Dependency Compatibility
+- Check that all chosen packages are compatible with each other at selected versions
+- Verify Node.js runtime compatibility
+- Verify TypeScript version compatibility across packages
+- Flag any known conflicts between chosen packages
+
+### 5. Check License Compliance
+- Extract license for each dependency
+- Flag GPL/AGPL dependencies in proprietary projects
+- Flag any license that requires attribution and document it
+- Flag packages with no license specified
+
+### 6. Generate Audit Report
+
+## Output Format
+```yaml
+# dep-audit.yaml
+audit:
+  status: clean | warnings | blocked
+  audited_at: "{ISO timestamp}"
+  stack_source: stack-selection.yaml
+
+  summary:
+    total_packages: 0
+    vulnerabilities:
+      critical: 0
+      high: 0
+      moderate: 0
+      low: 0
+    deprecated: 0
+    incompatible: 0
+    license_issues: 0
+
+  findings: []
+  # Each finding:
+  # - package: "{name}"
+  #   version: "{chosen version}"
+  #   category: vulnerability | deprecated | incompatible | license
+  #   severity: critical | high | moderate | low | info
+  #   description: "{what's wrong}"
+  #   recommendation: "{what to do}"
+  #   alternative: "{alternative package if applicable}"
+
+  recommendations:
+    version_pins: []
+    # Specific version pins that resolve issues
+    package_swaps: []
+    # Alternative packages if current choice is problematic
+
+  decision_required: true | false
+  # true if any critical/high findings need user decision before proceeding
+```
+
+## Gate Criteria
+- **PASS**: 0 critical, 0 high vulnerabilities; 0 deprecated packages; all peer deps compatible
+- **WARN**: moderate vulnerabilities exist (document and proceed)
+- **BLOCK**: critical or high vulnerabilities, deprecated packages, or incompatible peer deps
+
+If BLOCKED:
+1. Present findings to user with alternatives
+2. User must approve resolution (upgrade version, swap package, accept risk)
+3. Update `stack-selection.yaml` with approved changes
+4. Re-run audit to verify resolution
+
+## Notes
+- This task runs BEFORE implementation, saving the user from discovering issues after scaffolding
+- Pattern adapted from `brownfield-wu-dependency-scan` (simplified for greenfield where no lock file exists yet)
+- If web search or context7 MCP is available, use them for real-time CVE lookups

package/framework/tasks/architect-stack-selection.md

@@ -12,6 +12,7 @@ criteria:
   - Specific technologies chosen for each layer
   - Choices justified with technical reasoning
   - Compatibility verified
+  - Version verification completed (no deprecated packages, no critical CVEs at chosen versions)
 ---
 # Select Technology Stack
 
@@ -30,6 +31,33 @@ Expand with specific versions and libraries:
 
 Document rationale for each choice.
 
+### Version Verification (mandatory before finalizing)
+For each technology in the stack:
+1. Verify the chosen version is NOT deprecated or end-of-life
+2. Check if a newer stable version exists (flag if major version behind)
+3. Verify runtime alignment (Node.js version, TypeScript version compatibility)
+4. Check peer dependency compatibility between all chosen packages
+5. If context7 MCP is available: query for latest stable versions and known issues
+6. If web search is available: check npm registry for deprecation notices
+
+Output a compatibility matrix as part of stack-selection.yaml:
+```yaml
+version_check:
+  status: verified | warnings | blocked
+  verified_at: "{ISO timestamp}"
+  findings:
+    - package: "{name}"
+      chosen: "{version}"
+      latest_stable: "{version}"
+      deprecated: true | false
+      known_cves: [] | [{id, severity}]
+      note: "{explanation}"
+```
+
+If any package has critical CVEs or is deprecated:
+  → Present alternatives to user before proceeding
+  → Do NOT finalize stack with known critical vulnerabilities
+
 ## Output Format
 ```yaml
 # stack-selection.yaml

package/framework/workflows/brownfield-fullstack.yaml

@@ -88,7 +88,7 @@ phases:
         action: implement-tasks
       - agent: qa-implementation
         action: validate-code
-        creates: [chati.dev/artifacts/8-Validation/qa-implementation-report.md]
+        creates: [chati.dev/artifacts/9-QA-Implementation/qa-implementation-report.md]
 
   - phase: 7
     name: Deployment
@@ -96,7 +96,7 @@ phases:
     sequence:
       - agent: devops
         action: deploy
-        creates: [chati.dev/artifacts/8-Validation/deploy-report.md]
+        creates: [chati.dev/artifacts/10-Deploy/deploy-report.md]
 
 transitions:
   discover_to_plan:

package/framework/workflows/brownfield-service.yaml

@@ -70,7 +70,7 @@ phases:
         action: implement-tasks
       - agent: qa-implementation
         action: validate-code
-        creates: [chati.dev/artifacts/8-Validation/qa-implementation-report.md]
+        creates: [chati.dev/artifacts/9-QA-Implementation/qa-implementation-report.md]
 
   - phase: 6
     name: Deployment
@@ -78,7 +78,7 @@ phases:
     sequence:
       - agent: devops
         action: deploy
-        creates: [chati.dev/artifacts/8-Validation/deploy-report.md]
+        creates: [chati.dev/artifacts/10-Deploy/deploy-report.md]
 
 transitions:
   discover_to_plan:

package/framework/workflows/brownfield-ui.yaml

@@ -76,7 +76,7 @@ phases:
         notes: "Design System token enforcement is critical for UI work"
       - agent: qa-implementation
         action: validate-code
-        creates: [chati.dev/artifacts/8-Validation/qa-implementation-report.md]
+        creates: [chati.dev/artifacts/9-QA-Implementation/qa-implementation-report.md]
 
   - phase: 6
     name: Deployment
@@ -84,7 +84,7 @@ phases:
     sequence:
       - agent: devops
         action: deploy
-        creates: [chati.dev/artifacts/8-Validation/deploy-report.md]
+        creates: [chati.dev/artifacts/10-Deploy/deploy-report.md]
 
 transitions:
   discover_to_plan:

package/framework/workflows/greenfield-fullstack.yaml

@@ -51,6 +51,10 @@ phases:
         creates: [chati.dev/artifacts/3-Architecture/architecture.md]
         template: fullstack-architecture-tmpl.yaml
         notes: "Tech stack selection, data model, deployment strategy"
+      - agent: architect
+        action: dep-audit
+        creates: [chati.dev/artifacts/3-Architecture/dep-audit.yaml]
+        notes: "Verify dependency versions, vulnerabilities, and compatibility before implementation"
       - agent: ux
         action: define-experience
         creates: [chati.dev/artifacts/4-UX/ux-specification.md]
@@ -89,7 +93,7 @@ phases:
         notes: "Interactive or autonomous (Ralph Wiggum) mode"
       - agent: qa-implementation
         action: validate-code
-        creates: [chati.dev/artifacts/8-Validation/qa-implementation-report.md]
+        creates: [chati.dev/artifacts/9-QA-Implementation/qa-implementation-report.md]
         template: qa-gate-tmpl.yaml
         notes: "Tests + SAST + code review. Must pass to deploy"
 
@@ -99,7 +103,7 @@ phases:
     sequence:
       - agent: devops
         action: deploy
-        creates: [chati.dev/artifacts/8-Validation/deploy-report.md]
+        creates: [chati.dev/artifacts/10-Deploy/deploy-report.md]
         notes: "Git operations, deployment, documentation"
 
 transitions:

package/framework/workflows/quick-flow.yaml

@@ -23,10 +23,12 @@ detection:
     - "Configuration or environment change"
     - "Small refactoring with clear scope"
     - "User says 'just do it' or 'quick fix' or similar urgency signals"
+    - "Simple, fun, or experimental project (single-purpose tool, game, prototype)"
+    - "Single-page utility or learning project with no production requirements"
   disqualifiers:
-    - "New feature requiring architecture decisions"
-    - "Multiple interconnected requirements"
-    - "Greenfield project (no existing codebase)"
+    - "New feature requiring architecture decisions (multiple services, database design, auth system)"
+    - "Multiple interconnected requirements (>3 distinct features)"
+    - "Complex greenfield project (enterprise, multi-service, compliance requirements)"
     - "Enterprise or compliance context"
     - "User explicitly requests full pipeline"
     - "Scope involves more than 5 files"
@@ -70,7 +72,7 @@ phases:
     sequence:
       - agent: qa-implementation
         action: validate-code
-        creates: [chati.dev/artifacts/8-Validation/qa-implementation-report.md]
+        creates: [chati.dev/artifacts/9-QA-Implementation/qa-implementation-report.md]
         notes: >
           Full QA-Implementation validation still applies (no shortcuts on quality).
           Adversarial review still mandatory.
@@ -85,7 +87,7 @@ phases:
     sequence:
       - agent: devops
         action: deploy
-        creates: [chati.dev/artifacts/8-Validation/deploy-report.md]
+        creates: [chati.dev/artifacts/10-Deploy/deploy-report.md]
         notes: "Standard deployment process"
 
 transitions:

package/framework/workflows/standard-flow.yaml

@@ -0,0 +1,171 @@
+# Standard Flow Workflow
+# Mid-tier pipeline for moderate tasks: new features, integrations, brownfield enhancements
+# Uses 8 agents — between Quick Flow (4) and Full Flow (12)
+
+workflow:
+  id: standard-flow
+  name: Standard Flow — Balanced Development
+  version: "1.0.0"
+  type: any
+  project_types: [feature, integration, enhancement, module, component, brownfield-moderate]
+  description: >
+    Balanced pipeline for moderate complexity tasks that need proper planning
+    but not the full 12-agent pipeline. Skips WU (assumes existing codebase
+    context), UX (no design-heavy work), and Phases (tasks agent handles
+    scope directly). Ideal for 2-5 requirements in brownfield projects.
+
+detection:
+  triggers:
+    - "Moderate complexity feature with 2-5 requirements"
+    - "Brownfield project enhancement or integration"
+    - "New module or component within existing architecture"
+    - "User explicitly requests standard flow"
+    - "Feature that needs architecture review but not full UX design"
+    - "API integration or service connection"
+    - "Database-backed feature with clear data model"
+  disqualifiers:
+    - "Quick fix, hotfix, or single-line change (use Quick Flow)"
+    - "Enterprise-scale project with compliance requirements (use Full Flow)"
+    - "Greenfield project requiring full discovery (use Full Flow)"
+    - "UX-heavy feature requiring design system work (use Full Flow)"
+    - "Multi-service architecture changes (use Full Flow)"
+    - "User explicitly requests full pipeline"
+
+  confidence_threshold: 0.8
+  user_confirmation: true
+
+agents:
+  included:
+    - brief
+    - detail
+    - architect
+    - tasks
+    - qa-planning
+    - dev
+    - qa-implementation
+    - devops
+  excluded:
+    - greenfield-wu
+    - brownfield-wu
+    - ux
+    - phases
+
+phases:
+  - phase: 0
+    name: Discovery
+    category: DISCOVER
+    sequence:
+      - agent: brief
+        action: extract-requirements
+        creates: [chati.dev/artifacts/1-Brief/brief.md]
+        notes: >
+          Full brief extraction (5 phases). Since no WU precedes it,
+          Brief must also capture codebase context from user input.
+        config:
+          max_rounds: 5
+          require_approval: true
+
+  - phase: 1
+    name: Planning
+    category: PLAN
+    sequence:
+      - agent: detail
+        action: expand-requirements
+        creates: [chati.dev/artifacts/2-Detail/prd.md]
+        notes: "Full PRD from brief output"
+        parallel_with: [architect]
+
+      - agent: architect
+        action: design-architecture
+        creates: [chati.dev/artifacts/3-Architecture/architecture.md]
+        notes: "Architecture decisions, no UX constraints needed"
+        parallel_with: [detail]
+
+      - agent: tasks
+        action: create-tasks
+        creates: [chati.dev/artifacts/5-Tasks/tasks.md]
+        notes: >
+          Tasks agent works directly from PRD + Architecture.
+          No phases agent — tasks agent determines task breakdown directly.
+
+      - agent: qa-planning
+        action: validate-plan
+        creates: [chati.dev/artifacts/6-QA-Planning/qa-planning-report.md]
+        notes: "Full QA-Planning validation. Score >= 95% required to advance."
+        config:
+          minimum_score: 95
+
+  - phase: 2
+    name: Implementation
+    category: BUILD
+    sequence:
+      - agent: dev
+        action: implement-tasks
+        notes: "Dev works from full PRD + architecture + tasks"
+
+      - agent: qa-implementation
+        action: validate-code
+        creates: [chati.dev/artifacts/9-QA-Implementation/qa-implementation-report.md]
+        notes: >
+          Full QA-Implementation validation. Score >= 95% required.
+          Adversarial review mandatory.
+        config:
+          adversarial_review: true
+          minimum_findings: 5
+          minimum_score: 95
+
+  - phase: 3
+    name: Deployment
+    category: DEPLOY
+    sequence:
+      - agent: devops
+        action: deploy
+        creates: [chati.dev/artifacts/10-Deploy/deploy-report.md]
+        notes: "Standard deployment process"
+
+transitions:
+  discover_to_plan:
+    trigger: "brief.status == completed"
+    type: automatic
+    action: "Advance to PLAN phase"
+  plan_to_build:
+    trigger: "qa-planning.score >= 95"
+    type: automatic
+    action: "Advance to BUILD phase"
+  build_to_validate:
+    trigger: "dev.status == completed"
+    type: automatic
+    action: "Run QA-Implementation"
+  validate_to_deploy:
+    trigger: "qa-implementation.score >= 95"
+    type: user_preview
+    action: "User preview gate, then advance to DEPLOY"
+  deploy_to_completed:
+    trigger: "devops.status == completed"
+    type: automatic
+    action: "Pipeline complete"
+
+escalation:
+  to_full_flow:
+    triggers:
+      - "Architect discovers multi-service complexity"
+      - "QA-Planning finds UX requirements not addressed"
+      - "Scope creep: more than 5 distinct requirements discovered"
+      - "User requests full pipeline"
+    action: >
+      Pause standard-flow, notify user:
+      "This task is more complex than the standard flow can handle.
+      Options:
+      1. Switch to full pipeline (Recommended)
+      2. Continue with standard flow (document gaps)
+      3. Reduce scope and continue"
+  to_quick_flow:
+    triggers:
+      - "Detail agent finds only 1 simple requirement"
+      - "Architect confirms no architecture changes needed"
+    action: >
+      Suggest downgrade:
+      "This task might be simpler than expected.
+      Options:
+      1. Switch to quick flow (faster)
+      2. Continue with standard flow"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chati-dev",
-  "version": "3.2.5",
+  "version": "3.3.0",
   "description": "AI-Powered Multi-Agent Orchestration System — Structured vibe coding for Full Stack Development",
   "type": "module",
   "bin": {
@@ -10,6 +10,7 @@
   "main": "src/wizard/index.js",
   "exports": {
     ".": "./src/wizard/index.js",
+    "./api": "./src/api/index.js",
     "./installer": "./src/installer/core.js",
     "./dashboard": "./src/dashboard/renderer.js",
     "./upgrade": "./src/upgrade/checker.js"
@@ -19,7 +20,8 @@
     "src/",
     "assets/",
     "framework/",
-    "scripts/"
+    "scripts/",
+    "LICENSE"
   ],
   "scripts": {
     "start": "node bin/chati.js",

package/src/api/index.js

@@ -0,0 +1,129 @@
+/**
+ * @fileoverview Public API surface for chati-dev.
+ *
+ * Re-exports stable functions from core modules, providing
+ * a clean entry point for programmatic usage.
+ *
+ * @example
+ * import { createSession, runHealthChecks, classifyIntent } from 'chati-dev/api';
+ */
+
+// ---------------------------------------------------------------------------
+// Health & Diagnostics
+// ---------------------------------------------------------------------------
+
+export { runHealthChecks } from '../health/engine.js';
+
+// ---------------------------------------------------------------------------
+// Context Engine (PRISM)
+// ---------------------------------------------------------------------------
+
+export { runPrism } from '../context/engine.js';
+
+// ---------------------------------------------------------------------------
+// Orchestrator
+// ---------------------------------------------------------------------------
+
+export { classifyIntent, INTENT_TYPES } from '../orchestrator/intent-classifier.js';
+export {
+  initPipeline,
+  advancePipeline,
+  initQuickFlowPipeline,
+  initStandardFlowPipeline,
+} from '../orchestrator/pipeline-manager.js';
+export { selectAgent } from '../orchestrator/agent-selector.js';
+
+// ---------------------------------------------------------------------------
+// Session Management
+// ---------------------------------------------------------------------------
+
+import {
+  initSession as _initSession,
+  loadSession as _loadSession,
+  updateSession as _updateSession,
+  validateSession as _validateSession,
+  getSessionSummary as _getSessionSummary,
+  claimSession as _claimSession,
+  releaseSession as _releaseSession,
+  getSessionOwner as _getSessionOwner,
+} from '../orchestrator/session-manager.js';
+
+export {
+  _initSession as initSession,
+  _loadSession as loadSession,
+  _updateSession as updateSession,
+  _validateSession as validateSession,
+  _getSessionSummary as getSessionSummary,
+  _claimSession as claimSession,
+  _releaseSession as releaseSession,
+  _getSessionOwner as getSessionOwner,
+};
+
+// ---------------------------------------------------------------------------
+// Autonomy
+// ---------------------------------------------------------------------------
+
+export { runBuildLoop } from '../autonomy/build-loop.js';
+export { checkSafety, SAFETY_TRIGGERS } from '../autonomy/safety-net.js';
+
+// ---------------------------------------------------------------------------
+// Memory
+// ---------------------------------------------------------------------------
+
+export { recordError, getGotchas } from '../memory/gotchas.js';
+
+// ---------------------------------------------------------------------------
+// Quality
+// ---------------------------------------------------------------------------
+
+export { getMetricsHistory, getQualityDashboard, recordMetric } from '../quality/metrics-collector.js';
+
+// ---------------------------------------------------------------------------
+// Extensions
+// ---------------------------------------------------------------------------
+
+export {
+  registerExtension,
+  getExtensions,
+  executeExtensions,
+  clearExtensions,
+  EXTENSION_POINTS,
+} from '../extensions/registry.js';
+export { loadProjectExtensions, validateExtension } from '../extensions/loader.js';
+
+// ---------------------------------------------------------------------------
+// Configuration
+// ---------------------------------------------------------------------------
+
+export { loadCustomization, applyCustomization, validateCustomization } from '../config/agent-customizer.js';
+export { IDE_CONFIGS, getIDEChoices } from '../config/ide-configs.js';
+
+// ---------------------------------------------------------------------------
+// Convenience Wrapper
+// ---------------------------------------------------------------------------
+
+/**
+ * Create and initialize a new chati.dev session.
+ *
+ * Convenience wrapper that initializes session state.
+ *
+ * @param {string} projectDir - Project root directory
+ * @param {object} [options]
+ * @param {string} [options.mode='discover'] - Initial pipeline mode
+ * @param {boolean} [options.isGreenfield=true] - Project type
+ * @param {string} [options.language='en'] - Interaction language
+ * @param {string} [options.projectName=''] - Project name
+ * @param {string[]} [options.ides=[]] - Selected IDEs
+ * @param {string[]} [options.mcps=[]] - Selected MCPs
+ * @returns {{ created: boolean, session: object, path: string }}
+ */
+export function createSession(projectDir, options = {}) {
+  return _initSession(projectDir, {
+    mode: options.mode || 'discover',
+    isGreenfield: options.isGreenfield !== false,
+    language: options.language || 'en',
+    projectName: options.projectName || '',
+    ides: options.ides || [],
+    mcps: options.mcps || [],
+  });
+}