chati-dev 4.0.11 → 4.1.0

package/src/orchestrator/handoff-engine.js

@@ -8,6 +8,7 @@
 import { buildHandoff, saveHandoff, loadHandoff } from '../tasks/handoff.js';
 import { readAgentMemory } from '../memory/agent-memory.js';
 import { getRelevantGotchas } from '../memory/gotchas.js';
+import { updateClaudeMd } from '../memory/magic-docs.js';
 import { existsSync, readdirSync } from 'fs';
 import { join } from 'path';
 
@@ -65,6 +66,23 @@ export function executeHandoff(projectDir, params) {
       };
     }
 
+    // Auto-update CLAUDE.md with current state (Magic Docs)
+    try {
+      const agentName = params.fromTask?.agent || params.fromTask?.name || params.fromTask?.id?.split('-')[0] || 'agent';
+      updateClaudeMd(projectDir, {
+        currentAgent: agentName,
+        pipelinePosition: handoff.status || 'in_progress',
+        activeTask: params.fromTask?.title || params.fromTask?.id || null,
+        progress: params.validation?.score || null,
+        decisions: params.decisions
+          ? Object.entries(params.decisions).map(([what, why]) => ({ what, why: String(why) }))
+          : [],
+        nextSteps: params.blockers && params.blockers.length > 0
+          ? [`Resolve ${params.blockers.length} blocker(s)`]
+          : ['Continue to next agent'],
+      });
+    } catch { /* Magic Docs update is non-critical */ }
+
     return {
       success: true,
       handoff,
@@ -156,9 +174,12 @@ export function loadHandoffContext(projectDir, fromAgent) {
   // Load agent memories
   const memoryResult = readAgentMemory(projectDir, fromAgent);
   if (memoryResult.loaded && memoryResult.entries.length > 0) {
-    context.memories = memoryResult.entries.filter(
-      e => e.confidence === 'high' || e.confidence === 'medium'
-    );
+    context.memories = memoryResult.entries.filter(e => {
+      // Support both legacy string confidence ("high"/"medium") and
+      // numeric confidence (0.0-1.0) from memory-extractor
+      if (typeof e.confidence === 'number') return e.confidence >= 0.5;
+      return e.confidence === 'high' || e.confidence === 'medium';
+    });
     sources.push(`${context.memories.length} memory entries from ${fromAgent}`);
   }
 
@@ -217,7 +238,7 @@ export function getHandoffHistory(projectDir) {
     files.sort((a, b) => new Date(a.timestamp) - new Date(b.timestamp));
 
     return files;
-  } catch {
+  } catch { /* expected: operation may fail gracefully */
     return [];
   }
 }

package/src/orchestrator/index.js

@@ -6,6 +6,8 @@
 export {
   INTENT_TYPES,
   classifyIntent,
+  detectQuickFlow,
+  detectStandardFlow,
   getIntentPhase,
   checkModeAlignment,
 } from './intent-classifier.js';
@@ -24,17 +26,21 @@ export {
   PIPELINE_PHASES,
   AGENT_STATUS,
   initPipeline,
+  initQuickFlowPipeline,
+  initStandardFlowPipeline,
   advancePipeline,
   checkPhaseTransition,
   getPipelineProgress,
   resetPipelineTo,
   isPipelineComplete,
   markAgentInProgress,
+  confirmPreview,
 } from './pipeline-manager.js';
 
 export {
   executeHandoff,
   validateHandoffPreconditions,
+  validateHandoffIntegrity,
   loadHandoffContext,
   getHandoffHistory,
   checkRollbackFeasibility,
@@ -56,4 +62,7 @@ export {
   recordAgentCompletion,
   getSessionSummary,
   validateSession,
+  claimSession,
+  releaseSession,
+  getSessionOwner,
 } from './session-manager.js';

package/src/orchestrator/session-manager.js

@@ -159,7 +159,7 @@ export function loadSession(projectDir) {
       try {
         const yamlContent = yaml.dump(session, { lineWidth: -1, noRefs: true });
         writeFileSync(sessionPath, yamlContent, 'utf-8');
-      } catch {
+      } catch { /* expected: operation may fail gracefully */
         // Migration write failed — continue with migrated in-memory session
       }
     }

package/src/preview/detector.js

@@ -107,7 +107,7 @@ export function detectDevCommand(projectDir) {
           };
         }
       }
-    } catch {
+    } catch { /* expected: operation may fail gracefully */
       // Invalid package.json — skip
     }
   }
@@ -164,7 +164,7 @@ export function detectProjectKind(projectDir) {
       if ((pkg.main || pkg.exports) && !pkg.scripts?.dev && !pkg.scripts?.start) {
         return 'library';
       }
-    } catch {
+    } catch { /* expected: operation may fail gracefully */
       // Invalid package.json
     }
   }
@@ -222,7 +222,7 @@ function resolveFrameworkCommand(projectDir, detector) {
           };
         }
       }
-    } catch {
+    } catch { /* expected: operation may fail gracefully */
       // Fall through to default
     }
   }

package/src/preview/launcher.js

@@ -134,7 +134,7 @@ function killProcess(proc) {
     const forceKillTimer = setTimeout(() => {
       try {
         proc.kill('SIGKILL');
-      } catch {
+      } catch { /* expected: process may already be dead */
         // Already dead
       }
       resolve();
@@ -147,7 +147,7 @@ function killProcess(proc) {
 
     try {
       proc.kill('SIGTERM');
-    } catch {
+    } catch { /* expected: process may already be dead */
       clearTimeout(forceKillTimer);
       resolve();
     }

package/src/quality/metrics-collector.js

@@ -70,7 +70,7 @@ function loadMetrics(projectDir) {
     const raw = readFileSync(filePath, 'utf-8');
     const data = JSON.parse(raw);
     return { metrics: Array.isArray(data.metrics) ? data.metrics : [] };
-  } catch {
+  } catch { /* expected: file may not exist */
     return { metrics: [] };
   }
 }

package/src/quality/test-runner.js

@@ -47,8 +47,7 @@ export function detectTestCommand(projectDir) {
         const runner = detectRunnerFromScript(testScript);
         return { command: 'npm test', runner, detected: true };
       }
-    } catch {
-      // Malformed package.json — continue detection
+    } catch { /* expected: package.json may be malformed or missing */
     }
   }
 
@@ -198,8 +197,7 @@ export function runLint(projectDir, options = {}) {
         if (pkg.scripts?.lint) {
           command = 'npm run lint';
         }
-      } catch {
-        // ignore
+      } catch { /* expected: package.json may be malformed */
       }
     }
   }

package/src/scanning/density-scanner.js

@@ -0,0 +1,51 @@
+/**
+ * Information Density Scanner -- Detects LLM-generated filler phrases
+ * that dilute requirements in planning artifacts.
+ * Deterministic regex scan. Zero LLM dependency.
+ */
+
+import { readFileSync } from 'fs';
+
+const FILLER_PATTERNS = [
+  { pattern: /it is important to note that/gi, suggestion: 'Remove — state the fact directly' },
+  { pattern: /it(?:'s| is) worth (?:noting|mentioning)/gi, suggestion: 'Remove — state directly' },
+  { pattern: /\bfurthermore\b/gi, suggestion: 'Remove or replace with specific connector' },
+  { pattern: /\bmoreover\b/gi, suggestion: 'Remove or replace with specific connector' },
+  { pattern: /\bin conclusion\b/gi, suggestion: 'Remove — let content conclude itself' },
+  { pattern: /as (?:mentioned|noted|stated) (?:earlier|above|before|previously)/gi, suggestion: 'Remove — reader has context' },
+  { pattern: /needless to say/gi, suggestion: 'Remove — if needless, do not say it' },
+  { pattern: /it goes without saying/gi, suggestion: 'Remove' },
+  { pattern: /at the end of the day/gi, suggestion: 'Replace with specific conclusion' },
+  { pattern: /\bin order to\b/gi, suggestion: 'Replace with "to"' },
+  { pattern: /\butilize\b/gi, suggestion: 'Replace with "use"' },
+  { pattern: /\bleverage\b/gi, suggestion: 'Replace with "use"' },
+  { pattern: /\bfacilitate\b/gi, suggestion: 'Replace with simpler verb' },
+  { pattern: /\bdelve into\b/gi, suggestion: 'Replace with "explore" or "examine"' },
+  { pattern: /\bdive into\b/gi, suggestion: 'Replace with "examine" or remove' },
+  { pattern: /\brobust\b/gi, suggestion: 'Be specific — what makes it robust?' },
+  { pattern: /\bseamless(?:ly)?\b/gi, suggestion: 'Be specific — what makes it seamless?' },
+  { pattern: /\bcomprehensive\b/gi, suggestion: 'Be specific — what does it cover?' },
+];
+
+/**
+ * Scan a file for LLM-generated filler phrases.
+ * @param {string} filePath - Path to file to scan
+ * @returns {{ clean: boolean, findings: Array<{phrase: string, line: number, suggestion: string}>, count: number }}
+ */
+export function scanInformationDensity(filePath) {
+  const content = readFileSync(filePath, 'utf-8');
+  const findings = [];
+
+  for (const { pattern, suggestion } of FILLER_PATTERNS) {
+    const re = new RegExp(pattern.source, pattern.flags);
+    let match;
+    while ((match = re.exec(content)) !== null) {
+      const line = content.slice(0, match.index).split('\n').length;
+      findings.push({ phrase: match[0], line, suggestion });
+    }
+  }
+
+  return { clean: findings.length === 0, findings, count: findings.length };
+}
+
+export { FILLER_PATTERNS };

package/src/scanning/env-scanner.js

@@ -0,0 +1,97 @@
+/**
+ * Environment Variable Scanner -- Cross-checks .env.example against
+ * actual env var usage in source code.
+ * Deterministic file comparison. Zero LLM dependency.
+ */
+
+import { readFileSync, existsSync, readdirSync } from 'fs';
+import { join, extname } from 'path';
+
+const ENV_USAGE_PATTERNS = [
+  /process\.env\.(\w+)/g,
+  /import\.meta\.env\.(\w+)/g,
+  /Deno\.env\.get\(['"](\w+)['"]\)/g,
+];
+
+const SOURCE_EXTENSIONS = new Set(['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs', '.py']);
+const SKIP_DIRS = new Set(['node_modules', '.git', '.chati', 'chati.dev', 'dist', 'build', '.next']);
+
+/**
+ * Parse .env.example for declared variable names.
+ */
+function parseEnvFile(filePath) {
+  if (!existsSync(filePath)) return [];
+  const content = readFileSync(filePath, 'utf-8');
+  const vars = [];
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const match = trimmed.match(/^([A-Z_][A-Z0-9_]*)\s*=/);
+    if (match) vars.push(match[1]);
+  }
+  return vars;
+}
+
+/**
+ * Recursively find all source files.
+ */
+function findSourceFiles(dir, files = []) {
+  if (!existsSync(dir)) return files;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (SKIP_DIRS.has(entry.name)) continue;
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      findSourceFiles(fullPath, files);
+    } else if (SOURCE_EXTENSIONS.has(extname(entry.name))) {
+      files.push(fullPath);
+    }
+  }
+  return files;
+}
+
+/**
+ * Grep all source files for env var usage.
+ */
+function grepEnvUsage(projectDir) {
+  const files = findSourceFiles(projectDir);
+  const usedVars = new Set();
+
+  for (const file of files) {
+    try {
+      const content = readFileSync(file, 'utf-8');
+      for (const pattern of ENV_USAGE_PATTERNS) {
+        const re = new RegExp(pattern.source, pattern.flags);
+        let match;
+        while ((match = re.exec(content)) !== null) {
+          usedVars.add(match[1]);
+        }
+      }
+    } catch { /* expected: file may be unreadable */ }
+  }
+
+  return [...usedVars];
+}
+
+/**
+ * Scan for env var synchronization issues.
+ * @param {string} projectDir - Project root
+ * @returns {{ synced: boolean, missing: string[], extra: string[], declared: number, used: number }}
+ */
+export function scanEnvSync(projectDir) {
+  const envExamplePath = join(projectDir, '.env.example');
+  const declared = parseEnvFile(envExamplePath);
+  const used = grepEnvUsage(projectDir);
+
+  const missing = used.filter(v => !declared.includes(v));
+  const extra = declared.filter(v => !used.includes(v));
+
+  return {
+    synced: missing.length === 0,
+    missing,
+    extra,
+    declared: declared.length,
+    used: used.length,
+  };
+}
+
+export { parseEnvFile, grepEnvUsage };

package/src/scanning/index.js

@@ -0,0 +1,7 @@
+// Barrel exports for scanning system
+
+export { scanPlaceholders } from './placeholder-scanner.js';
+export { scanImplementationLeakage, extractFRSection, TECH_NAMES } from './leakage-scanner.js';
+export { scanInformationDensity, FILLER_PATTERNS } from './density-scanner.js';
+export { scanEnvSync, parseEnvFile, grepEnvUsage } from './env-scanner.js';
+export { scanProjectSecurity, detectLanguage } from './security-scanner.js';

package/src/scanning/leakage-scanner.js

@@ -0,0 +1,54 @@
+/**
+ * Implementation Leakage Scanner -- Detects technology names inside
+ * Functional Requirements (FRs) where only WHAT should be specified, not HOW.
+ * Deterministic regex scan. Zero LLM dependency.
+ */
+
+import { readFileSync } from 'fs';
+
+const TECH_NAMES = [
+  /\bReact\b/g, /\bNext\.?js\b/gi, /\bVue\.?js\b/gi, /\bAngular\b/g, /\bSvelte\b/g,
+  /\bPostgreSQL\b/gi, /\bMongoDB\b/gi, /\bMySQL\b/gi, /\bSupabase\b/gi, /\bFirebase\b/gi,
+  /\bTailwind\b/gi, /\bPrisma\b/gi, /\bDrizzle\b/gi, /\bSequelize\b/gi,
+  /\bExpress\b/g, /\bFastify\b/g, /\bDjango\b/g, /\bFlask\b/g, /\bLaravel\b/g,
+  /\bAWS\b/g, /\bVercel\b/g, /\bNetlify\b/g, /\bRailway\b/g, /\bCloudflare\b/g,
+  /\bDocker\b/g, /\bKubernetes\b/g, /\bRedis\b/g, /\bGraphQL\b/gi,
+  /\bTypeScript\b/gi, /\bJavaScript\b/gi, /\bPython\b/g, /\bRust\b/g, /\bGo\b/g,
+  /\bZod\b/g, /\bJoi\b/g, /\bZustand\b/g, /\bRedux\b/g, /\bJotai\b/g,
+];
+
+/**
+ * Extract the Functional Requirements section from a PRD.
+ * @param {string} content - Full PRD content
+ * @returns {string|null} FR section text, or null if not found
+ */
+function extractFRSection(content) {
+  const frMatch = content.match(/#{1,3}\s*(?:\d+\.\s*)?Functional Requirements[\s\S]*?(?=#{1,3}\s*(?:\d+\.\s*)?(?:Non-Functional|Business Rules|Risks|Dependencies)|$)/i);
+  return frMatch ? frMatch[0] : null;
+}
+
+/**
+ * Scan a PRD file for technology names inside Functional Requirements.
+ * @param {string} filePath - Path to PRD file
+ * @returns {{ clean: boolean, findings: Array<{tech: string, context: string}>, count: number }}
+ */
+export function scanImplementationLeakage(filePath) {
+  const content = readFileSync(filePath, 'utf-8');
+  const frSection = extractFRSection(content);
+  if (!frSection) return { clean: true, findings: [], count: 0, note: 'No FR section found' };
+
+  const findings = [];
+  for (const pattern of TECH_NAMES) {
+    const re = new RegExp(pattern.source, pattern.flags);
+    let match;
+    while ((match = re.exec(frSection)) !== null) {
+      const start = Math.max(0, match.index - 40);
+      const end = Math.min(frSection.length, match.index + match[0].length + 40);
+      findings.push({ tech: match[0], context: frSection.slice(start, end).replace(/\n/g, ' ').trim() });
+    }
+  }
+
+  return { clean: findings.length === 0, findings, count: findings.length };
+}
+
+export { extractFRSection, TECH_NAMES };

package/src/scanning/placeholder-scanner.js

@@ -0,0 +1,40 @@
+/**
+ * Placeholder Scanner -- Detects [TODO], [TBD], and similar placeholders in artifacts.
+ * Deterministic regex scan. Zero LLM dependency.
+ */
+
+import { readFileSync } from 'fs';
+
+const PLACEHOLDER_PATTERNS = [
+  /\[TODO\]/gi,
+  /\[TBD\]/gi,
+  /\{TODO\}/gi,
+  /\{TBD\}/gi,
+  /\bPLACEHOLDER\b/gi,
+  /\bXXX\b/g,
+  /\bFIXME\b/g,
+  /\bHACK\b/g,
+  /\[INSERT\b/gi,
+  /\bTBA\b/g,
+];
+
+/**
+ * Scan a file for placeholder patterns.
+ * @param {string} filePath - Path to file to scan
+ * @returns {{ clean: boolean, findings: Array<{pattern: string, line: number}>, count: number }}
+ */
+export function scanPlaceholders(filePath) {
+  const content = readFileSync(filePath, 'utf-8');
+  const findings = [];
+
+  for (const pattern of PLACEHOLDER_PATTERNS) {
+    const re = new RegExp(pattern.source, pattern.flags);
+    let match;
+    while ((match = re.exec(content)) !== null) {
+      const line = content.slice(0, match.index).split('\n').length;
+      findings.push({ pattern: match[0], line });
+    }
+  }
+
+  return { clean: findings.length === 0, findings, count: findings.length };
+}

package/src/scanning/security-scanner.js

@@ -0,0 +1,94 @@
+/**
+ * Security Scanner -- Scans project source files for language-specific
+ * security vulnerabilities using regex patterns.
+ * Uses LANGUAGE_SECURITY_CHECKS from bash-security.js.
+ * Deterministic file scanning. Zero LLM dependency.
+ */
+
+import { readFileSync, readdirSync, existsSync } from 'fs';
+import { join, extname, relative } from 'path';
+import { runLanguageSecurityChecks } from '../security/bash-security.js';
+
+const LANGUAGE_MAP = {
+  '.js': 'javascript',
+  '.jsx': 'javascript',
+  '.mjs': 'javascript',
+  '.cjs': 'javascript',
+  '.ts': 'typescript',
+  '.tsx': 'typescript',
+  '.py': 'python',
+};
+
+const SKIP_DIRS = new Set(['node_modules', '.git', '.chati', 'chati.dev', 'dist', 'build', '.next', 'coverage', '__pycache__']);
+
+/**
+ * Recursively find source files by language.
+ */
+function findFiles(dir, language, files = []) {
+  if (!existsSync(dir)) return files;
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (SKIP_DIRS.has(entry.name)) continue;
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      findFiles(fullPath, language, files);
+    } else {
+      const ext = extname(entry.name);
+      const lang = LANGUAGE_MAP[ext];
+      if (lang && (!language || lang === language)) {
+        files.push({ path: fullPath, language: lang });
+      }
+    }
+  }
+  return files;
+}
+
+/**
+ * Detect primary language from project structure.
+ */
+export function detectLanguage(projectDir) {
+  const pkgPath = join(projectDir, 'package.json');
+  if (existsSync(pkgPath)) {
+    const tsConfig = join(projectDir, 'tsconfig.json');
+    return existsSync(tsConfig) ? 'typescript' : 'javascript';
+  }
+  const reqPath = join(projectDir, 'requirements.txt');
+  if (existsSync(reqPath)) return 'python';
+  return 'javascript';
+}
+
+/**
+ * Scan project source files for security vulnerabilities.
+ * @param {string} projectDir - Project root
+ * @param {object} [options={}]
+ * @param {string} [options.language] - Filter by language
+ * @param {string} [options.dir] - Subdirectory to scan (default: project root)
+ * @returns {{ scanned: number, safe: boolean, findings: Array, critical: number, high: number, medium: number }}
+ */
+export function scanProjectSecurity(projectDir, options = {}) {
+  const language = options.language || null;
+  const scanDir = options.dir ? join(projectDir, options.dir) : projectDir;
+
+  const files = findFiles(scanDir, language);
+  const allFindings = [];
+
+  for (const file of files) {
+    try {
+      const content = readFileSync(file.path, 'utf-8');
+      const result = runLanguageSecurityChecks(content, file.language);
+      if (!result.safe) {
+        for (const f of result.findings) {
+          allFindings.push({ ...f, file: relative(projectDir, file.path), language: file.language });
+        }
+      }
+    } catch { /* expected: file may be unreadable */ }
+  }
+
+  return {
+    scanned: files.length,
+    safe: allFindings.length === 0,
+    findings: allFindings,
+    critical: allFindings.filter(f => f.severity === 'critical').length,
+    high: allFindings.filter(f => f.severity === 'high').length,
+    medium: allFindings.filter(f => f.severity === 'medium').length,
+  };
+}