claude-code-session-manager 0.26.0 → 0.28.0

package/plugins/session-manager-dev/skills/requesting-code-review/code-reviewer.md

@@ -0,0 +1,146 @@
+# Code Review Agent
+
+You are reviewing code changes for production readiness.
+
+**Your task:**
+1. Review {WHAT_WAS_IMPLEMENTED}
+2. Compare against {PLAN_OR_REQUIREMENTS}
+3. Check code quality, architecture, testing
+4. Categorize issues by severity
+5. Assess production readiness
+
+## What Was Implemented
+
+{DESCRIPTION}
+
+## Requirements/Plan
+
+{PLAN_REFERENCE}
+
+## Git Range to Review
+
+**Base:** {BASE_SHA}
+**Head:** {HEAD_SHA}
+
+```bash
+git diff --stat {BASE_SHA}..{HEAD_SHA}
+git diff {BASE_SHA}..{HEAD_SHA}
+```
+
+## Review Checklist
+
+**Code Quality:**
+- Clean separation of concerns?
+- Proper error handling?
+- Type safety (if applicable)?
+- DRY principle followed?
+- Edge cases handled?
+
+**Architecture:**
+- Sound design decisions?
+- Scalability considerations?
+- Performance implications?
+- Security concerns?
+
+**Testing:**
+- Tests actually test logic (not mocks)?
+- Edge cases covered?
+- Integration tests where needed?
+- All tests passing?
+
+**Requirements:**
+- All plan requirements met?
+- Implementation matches spec?
+- No scope creep?
+- Breaking changes documented?
+
+**Production Readiness:**
+- Migration strategy (if schema changes)?
+- Backward compatibility considered?
+- Documentation complete?
+- No obvious bugs?
+
+## Output Format
+
+### Strengths
+[What's well done? Be specific.]
+
+### Issues
+
+#### Critical (Must Fix)
+[Bugs, security issues, data loss risks, broken functionality]
+
+#### Important (Should Fix)
+[Architecture problems, missing features, poor error handling, test gaps]
+
+#### Minor (Nice to Have)
+[Code style, optimization opportunities, documentation improvements]
+
+**For each issue:**
+- File:line reference
+- What's wrong
+- Why it matters
+- How to fix (if not obvious)
+
+### Recommendations
+[Improvements for code quality, architecture, or process]
+
+### Assessment
+
+**Ready to merge?** [Yes/No/With fixes]
+
+**Reasoning:** [Technical assessment in 1-2 sentences]
+
+## Critical Rules
+
+**DO:**
+- Categorize by actual severity (not everything is Critical)
+- Be specific (file:line, not vague)
+- Explain WHY issues matter
+- Acknowledge strengths
+- Give clear verdict
+
+**DON'T:**
+- Say "looks good" without checking
+- Mark nitpicks as Critical
+- Give feedback on code you didn't review
+- Be vague ("improve error handling")
+- Avoid giving a clear verdict
+
+## Example Output
+
+```
+### Strengths
+- Clean database schema with proper migrations (db.ts:15-42)
+- Comprehensive test coverage (18 tests, all edge cases)
+- Good error handling with fallbacks (summarizer.ts:85-92)
+
+### Issues
+
+#### Important
+1. **Missing help text in CLI wrapper**
+   - File: index-conversations:1-31
+   - Issue: No --help flag, users won't discover --concurrency
+   - Fix: Add --help case with usage examples
+
+2. **Date validation missing**
+   - File: search.ts:25-27
+   - Issue: Invalid dates silently return no results
+   - Fix: Validate ISO format, throw error with example
+
+#### Minor
+1. **Progress indicators**
+   - File: indexer.ts:130
+   - Issue: No "X of Y" counter for long operations
+   - Impact: Users don't know how long to wait
+
+### Recommendations
+- Add progress reporting for user experience
+- Consider config file for excluded projects (portability)
+
+### Assessment
+
+**Ready to merge: With fixes**
+
+**Reasoning:** Core implementation is solid with good architecture and tests. Important issues (help text, date validation) are easily fixed and don't affect core functionality.
+```

package/plugins/session-manager-dev/skills/security-review/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: security-review
+description: >-
+  Check for common security vulnerabilities before shipping code — focus on what
+  actually gets exploited (OWASP Top 10: injection, auth, secrets, access control),
+  not compliance theater. Use before committing code that handles user input, auth,
+  or data storage; when adding API endpoints or external integrations; when
+  reviewing dependencies; or when asked to do a security review. Keywords: security,
+  vulnerability, OWASP, injection, auth, secrets, review.
+---
+
+# Security Review
+
+## Overview
+
+Check for common security vulnerabilities before shipping code. Focus on what actually gets exploited, not compliance theater.
+
+## When to Use
+
+- Before committing code that handles user input, auth, or data storage
+- When adding new API endpoints or external integrations
+- When reviewing dependencies or updating packages
+- When asked to do a security review
+
+## OWASP Top 10 Checklist
+
+### Injection (SQL, NoSQL, OS Command, LDAP)
+- All user input parameterized or escaped before use in queries
+- No string concatenation in SQL/NoSQL queries
+- No `eval()`, `exec()`, `shell=True`, or `child_process.exec()` with user input
+- ORM/query builder used instead of raw queries where possible
+
+### Broken Authentication
+- Passwords hashed with bcrypt/argon2 (never MD5/SHA1)
+- Session tokens are random, long, and expire
+- MFA available for sensitive operations
+- No credentials in URLs, logs, or error messages
+
+### Sensitive Data Exposure
+- No secrets in code, config files, or git history (.env, API keys, tokens)
+- Data encrypted at rest (AES-256) and in transit (TLS)
+- Sensitive fields excluded from logs and API responses
+- PII handled according to data classification
+
+### XSS (Cross-Site Scripting)
+- All output HTML-encoded by default (React JSX handles this)
+- No `dangerouslySetInnerHTML` or `v-html` without sanitization
+- Content-Security-Policy headers set
+- User input never inserted into `<script>` tags or event handlers
+
+### Broken Access Control
+- Every API endpoint checks authentication AND authorization
+- No direct object references without ownership verification
+- CORS configured to specific allowed origins (not `*`)
+- Rate limiting on auth and sensitive endpoints
+
+### Security Misconfiguration
+- No default credentials or debug modes in production
+- Error messages don't leak stack traces or internal details
+- HTTP security headers set (HSTS, X-Frame-Options, X-Content-Type-Options)
+- Unnecessary features and endpoints disabled
+
+### CSRF (Cross-Site Request Forgery)
+- State-changing requests use CSRF tokens or SameSite cookies
+- POST/PUT/DELETE endpoints reject requests without valid tokens
+
+## Dependency Check
+
+```bash
+# Node.js
+npm audit
+# Check for known vulnerabilities
+npx audit-ci --moderate
+
+# Python
+pip-audit
+safety check
+```
+
+Flag: outdated packages with known CVEs, unmaintained dependencies, packages with suspiciously few downloads or recent ownership transfers.
+
+## Secrets Scan
+
+Look for accidentally committed secrets:
+- API keys, tokens, passwords in source files
+- `.env` files not in `.gitignore`
+- Hardcoded connection strings
+- Private keys or certificates
+
+## Input Validation Rules
+
+- Validate at system boundaries (API endpoints, form handlers, file uploads)
+- Reject unexpected input types and sizes
+- Whitelist over blacklist
+- Validate on the server, never trust client-only validation
+
+## When Reporting Issues
+
+Classify findings:
+- **Critical**: Exploitable now, data at risk (injection, auth bypass, exposed secrets)
+- **High**: Exploitable with effort (XSS, CSRF, broken access control)
+- **Medium**: Defense-in-depth gap (missing headers, weak config)
+- **Low**: Best practice deviation (could become a problem later)
+
+Always provide the fix, not just the finding.

package/src/main/__tests__/scheduler-autofix-select.test.cjs

@@ -0,0 +1,95 @@
+/**
+ * scheduler-autofix-select.test.cjs — unit tests for selectAutoFixTargets.
+ *
+ * Run: timeout 120 node --test src/main/__tests__/scheduler-autofix-select.test.cjs
+ */
+
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { selectAutoFixTargets } = require('../scheduler.cjs');
+
+const noSiblingOnDisk = () => false;
+
+function makeJob(overrides = {}) {
+  return {
+    slug: '05-my-feature',
+    status: 'needs_review',
+    runId: '2026-06-16T10-00-00-000Z',
+    parallelGroup: 5,
+    ...overrides,
+  };
+}
+
+test('selects a fresh needs_review job', () => {
+  const jobs = [makeJob()];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 1);
+  assert.strictEqual(result[0].slug, '05-my-feature');
+});
+
+test('excludes job with autoFixAttempted: true', () => {
+  const jobs = [makeJob({ autoFixAttempted: true })];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 0);
+});
+
+test('excludes a fix-plan slug (05-fix-foo)', () => {
+  const jobs = [makeJob({ slug: '05-fix-foo' })];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 0);
+});
+
+test('excludes a failed job', () => {
+  const jobs = [makeJob({ status: 'failed' })];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 0);
+});
+
+test('excludes a completed job', () => {
+  const jobs = [makeJob({ status: 'completed' })];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 0);
+});
+
+test('excludes a job missing runId', () => {
+  const jobs = [makeJob({ runId: null })];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 0);
+});
+
+test('excludes when fix sibling exists on disk', () => {
+  const jobs = [makeJob()];
+  // fixSlug = '05-fix-my-feature'
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: (s) => s === '05-fix-my-feature' });
+  assert.strictEqual(result.length, 0);
+});
+
+test('excludes when fix sibling already in the queue', () => {
+  const sibling = { slug: '05-fix-my-feature', status: 'pending', runId: null };
+  const jobs = [makeJob(), sibling];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 0);
+});
+
+test('fixSlug uses padded parallelGroup and strips leading digits from slug', () => {
+  const jobs = [makeJob({ slug: '07-some-task', parallelGroup: 7 })];
+  // Expected fixSlug: '07-fix-some-task'
+  const seen = [];
+  selectAutoFixTargets(jobs, {
+    fixSlugExists: (s) => { seen.push(s); return false; },
+  });
+  assert.strictEqual(seen[0], '07-fix-some-task');
+});
+
+test('defaults parallelGroup to 99 when absent', () => {
+  const jobs = [makeJob({ slug: '05-my-feature', parallelGroup: undefined })];
+  const seen = [];
+  selectAutoFixTargets(jobs, {
+    fixSlugExists: (s) => { seen.push(s); return false; },
+  });
+  assert.strictEqual(seen[0], '99-fix-my-feature');
+});
+
+console.log('scheduler-autofix-select tests: PASS');

package/src/main/__tests__/scheduler-autopromote.test.cjs

@@ -0,0 +1,33 @@
+/**
+ * scheduler-autopromote.test.cjs — unit tests for isPromotableOriginal.
+ *
+ * Run: timeout 120 node --test src/main/__tests__/scheduler-autopromote.test.cjs
+ */
+
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { isPromotableOriginal } = require('../scheduler.cjs');
+
+test('isPromotableOriginal: failed → true', () => {
+  assert.strictEqual(isPromotableOriginal('failed'), true);
+});
+
+test('isPromotableOriginal: needs_review → true', () => {
+  assert.strictEqual(isPromotableOriginal('needs_review'), true);
+});
+
+test('isPromotableOriginal: completed → false', () => {
+  assert.strictEqual(isPromotableOriginal('completed'), false);
+});
+
+test('isPromotableOriginal: running → false', () => {
+  assert.strictEqual(isPromotableOriginal('running'), false);
+});
+
+test('isPromotableOriginal: pending → false', () => {
+  assert.strictEqual(isPromotableOriginal('pending'), false);
+});
+
+console.log('scheduler-autopromote tests: PASS');

package/src/main/hives.cjs

@@ -1,29 +1,28 @@
 /**
- * hives.cjs — pre-baked subagent swarm templates ("Hives").
+ * hives.cjs — subagent recipe templates ("Hives").
  *
- * A Hive is a named collection of subagent roles + an optional default plan,
- * launchable as one unit. Concept ported from ClaudeCodeUnleashed; our shape
- * is `{ slug, name, description, roles: [{ label, prompt }], defaultPlan? }`
- * (renderer launches by configuring Orchestrator with those roles).
+ * A Recipe is a named sequence of steps, each referencing an agent by name
+ * from `~/.claude/agents/<agentName>.md`. Shape:
+ *   { slug, name, description, brief?, steps: [{ agentName, note? }] }
+ *
+ * Legacy hives (old shape: `roles: [{ label, prompt }]`) are migrated on
+ * first read: each role is materialized as an agent .md and replaced by a
+ * step referencing it. Migration is idempotent and permanent (re-saved).
  *
  * Storage: `~/.claude/session-manager/hives/<slug>.json`
  *   - slug must match SLUG_RE: /^[a-z0-9-_]{1,64}$/
- *   - up to 32 roles per hive
+ *   - up to 32 steps per recipe
  *   - per-field byte caps mirrored in the inline zod schemas below
  *
- * IPC namespace:
- *   - hives:list   -> { hives: Hive[], error: string | null }
- *   - hives:get    -> { hive: Hive | null, error: string | null }
+ * IPC namespace (channel names kept for backwards compat):
+ *   - hives:list   -> { hives: Recipe[], error: string | null }
+ *   - hives:get    -> { hive: Recipe | null, error: string | null }
  *   - hives:save   -> { ok: boolean, error: string | null }
  *   - hives:delete -> { ok: boolean, error: string | null }
  *
- * All mutations go through config.cjs::writeJson (atomic tmp+rename) and
- * config.cjs::validatePath (allowedRoots = home dir). Never raw fs.writeFile.
- *
- * Default hives (Code review / Build feature / Bug hunt) ship in the renderer
- * (src/renderer/lib/defaultHives.ts) and are NOT writable to disk — they exist
- * only as in-memory starter examples so a fresh install has content. The IPC
- * layer only sees user-saved hives.
+ * All mutations go through config.cjs::writeJson / writeTextAtomic (atomic
+ * tmp+rename) and config.cjs::validatePath (allowedRoots = home dir).
+ * Never raw fs.writeFile.
  */
 
 'use strict';
@@ -37,34 +36,35 @@ const config = require('./config.cjs');
 
 // ──────────────────────────────────────────── caps
 const SLUG_RE = /^[a-z0-9-_]{1,64}$/;
+const AGENT_NAME_RE = /^[a-z0-9-_]{1,64}$/;
 const MAX_NAME_LEN = 128;
 const MAX_DESC_LEN = 2048;
-const MAX_LABEL_LEN = 128;
-const MAX_PROMPT_LEN = 16 * 1024;
-const MAX_PLAN_LEN = 8 * 1024;
-const MAX_ROLES = 32;
+const MAX_BRIEF_LEN = 8 * 1024;
+const MAX_NOTE_LEN = 2048;
+const MAX_STEPS = 32;
 
 // ──────────────────────────────────────────── inline zod schemas
-const hiveRoleSchema = z.object({
-  label: z.string().min(1).max(MAX_LABEL_LEN),
-  prompt: z.string().min(1).max(MAX_PROMPT_LEN),
+const recipeStepSchema = z.object({
+  agentName: z.string().regex(AGENT_NAME_RE),
+  note: z.string().max(MAX_NOTE_LEN).optional(),
 }).strict();
 
-const hiveSchema = z.object({
+const recipeSchema = z.object({
   slug: z.string().regex(SLUG_RE),
   name: z.string().min(1).max(MAX_NAME_LEN),
   description: z.string().max(MAX_DESC_LEN).default(''),
-  roles: z.array(hiveRoleSchema).min(1).max(MAX_ROLES),
-  defaultPlan: z.string().max(MAX_PLAN_LEN).optional(),
+  brief: z.string().max(MAX_BRIEF_LEN).optional(),
+  steps: z.array(recipeStepSchema).min(1).max(MAX_STEPS),
 }).strict();
 
 const slugPayload = z.object({
   slug: z.string().regex(SLUG_RE),
 }).strict();
 
+// Field name "hive" kept for IPC channel backwards compatibility.
 const savePayload = z.object({
   slug: z.string().regex(SLUG_RE),
-  hive: hiveSchema,
+  hive: recipeSchema,
 }).strict();
 
 // ──────────────────────────────────────────── paths
@@ -72,6 +72,10 @@ function rootDir() {
   return path.join(os.homedir(), '.claude', 'session-manager', 'hives');
 }
 
+function agentsDir() {
+  return path.join(os.homedir(), '.claude', 'agents');
+}
+
 function hivePath(slug) {
   if (!SLUG_RE.test(slug)) {
     throw new Error(`invalid hive slug (must match ${SLUG_RE.source})`);
@@ -83,6 +87,58 @@ async function ensureRoot() {
   await fsp.mkdir(rootDir(), { recursive: true });
 }
 
+// ──────────────────────────────────────────── helpers
+function kebabCase(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 64) || 'agent';
+}
+
+// ──────────────────────────────────────────── legacy migration
+async function migrateLegacyHive(slug, raw) {
+  const adir = agentsDir();
+  await fsp.mkdir(adir, { recursive: true });
+
+  const usedNames = new Set();
+  const steps = [];
+
+  for (const role of (raw.roles ?? [])) {
+    let base = kebabCase(role.label ?? 'agent');
+    let agentName = base;
+    let suffix = 2;
+    while (usedNames.has(agentName)) {
+      agentName = `${base.slice(0, 62)}-${suffix++}`;
+    }
+    usedNames.add(agentName);
+
+    const agentFilePath = path.join(adir, `${agentName}.md`);
+    // validatePath ensures we stay within allowedRoots (home dir).
+    const validPath = config.validatePath(agentFilePath);
+
+    let exists = false;
+    try { await fsp.stat(validPath); exists = true; } catch { /* ENOENT = not yet created */ }
+
+    if (!exists) {
+      const descLine = (role.prompt ?? '').replace(/[\r\n]+/g, ' ').slice(0, 200);
+      const content = `---\nname: ${role.label}\ndescription: ${descLine}\n---\n\n${role.prompt ?? ''}\n`;
+      await config.writeTextAtomic(validPath, content);
+    }
+
+    steps.push({ agentName });
+  }
+
+  const recipe = {
+    slug,
+    name: raw.name,
+    description: raw.description ?? '',
+    steps,
+    ...(raw.defaultPlan ? { brief: raw.defaultPlan } : {}),
+  };
+
+  // Persist migrated shape permanently so subsequent reads skip migration.
+  await saveHive(slug, recipe);
+
+  return { hive: recipe, error: null };
+}
+
 // ──────────────────────────────────────────── core ops
 async function listHives() {
   try {
@@ -118,13 +174,20 @@ async function readHive(slug) {
   const r = await config.readJson(abs);
   if (!r || !r.exists) return { hive: null, error: null };
   if (r.parseError) return { hive: null, error: `parse error: ${r.parseError}` };
+
+  const raw = r.data;
+
+  // Legacy migration: old shape has `roles` array instead of `steps`.
+  if (raw && Array.isArray(raw.roles) && !Array.isArray(raw.steps)) {
+    return migrateLegacyHive(slug, raw);
+  }
+
   // Re-validate stored shape so a hand-edited file can't smuggle in bad data.
-  const parsed = hiveSchema.safeParse(r.data);
+  const parsed = recipeSchema.safeParse(raw);
   if (!parsed.success) {
-    return { hive: null, error: `invalid hive on disk: ${parsed.error.issues[0]?.message ?? 'unknown'}` };
+    return { hive: null, error: `invalid recipe on disk: ${parsed.error.issues[0]?.message ?? 'unknown'}` };
   }
-  // Trust the file's own slug only if it matches the filename; otherwise force
-  // them to agree (filename wins — that's the storage key).
+  // Trust the file's own slug only if it matches the filename; filename wins.
   const hive = { ...parsed.data, slug };
   return { hive, error: null };
 }
@@ -139,8 +202,7 @@ async function getHive(slug) {
 
 async function saveHive(slug, hive) {
   try {
-    // Body slug must match path slug. Reject mismatches loudly so the renderer
-    // can't accidentally overwrite the wrong file by tampering with `slug`.
+    // Body slug must match path slug.
     if (hive.slug !== slug) {
       return { ok: false, error: `slug mismatch: payload slug "${hive.slug}" != path "${slug}"` };
     }
@@ -148,10 +210,9 @@ async function saveHive(slug, hive) {
     const abs = hivePath(slug);
     const out = {
       ...hive,
-      // Strip undefined for clean JSON on disk.
       description: hive.description ?? '',
     };
-    if (out.defaultPlan === undefined || out.defaultPlan === '') delete out.defaultPlan;
+    if (out.brief === undefined || out.brief === '') delete out.brief;
     const result = await config.writeJson(abs, out);
     if (!result || !result.ok) {
       return { ok: false, error: result?.error ?? 'write failed' };
@@ -178,7 +239,6 @@ async function deleteHive(slug) {
       await fsp.unlink(real);
     } catch (e) {
       if (e.code === 'ENOENT') {
-        // Treat missing as success — idempotent delete, same as fs unlink ENOENT.
         return { ok: true, error: null };
       }
       return { ok: false, error: e.message };