claude-flow-novice 2.15.11 → 2.16.1

package/claude-assets/commands/cfn-loop-frontend.md

@@ -561,7 +561,7 @@ Before running frontend CFN Loop:
 
 - Guide: `.claude/commands/cfn/CFN_LOOP_FRONTEND.md` (742 lines, complete workflow)
 - Coordinator: `.claude/agents/cfn-dev-team/coordinators/cfn-frontend-coordinator.md`
-- Task Mode: `.claude/commands/cfn/CFN_LOOP_TASK_MODE.md`
+- Task Mode: `.claude/commands/CFN_LOOP_TASK_MODE.md`
 - Standard CFN Loop: `.claude/commands/cfn/cfn-loop.md`
 
 ---

package/claude-assets/commands/cfn-loop-task.md

@@ -106,7 +106,7 @@ You must execute this CFN Loop directly using the Task() tool to spawn agents.
 Read the complete Task Mode guide for detailed workflow:
 
 ```
-Read('.claude/commands/cfn/CFN_LOOP_TASK_MODE.md')
+Read('.claude/commands/CFN_LOOP_TASK_MODE.md')
 ```
 
 **Expected output:** Complete guide with agent selection, workflow steps, helper scripts
@@ -450,7 +450,7 @@ parse-decision.sh --output "$PO_OUTPUT"
 
 ## Related Documentation
 
-- **Task Mode Guide**: `.claude/commands/cfn/CFN_LOOP_TASK_MODE.md` (complete reference)
+- **Task Mode Guide**: `.claude/commands/CFN_LOOP_TASK_MODE.md` (complete reference)
 - Coordinator Parameters: `.claude/commands/cfn/CFN_COORDINATOR_PARAMETERS.md`
 - Agent Output Standards: `docs/AGENT_OUTPUT_STANDARDS.md`
 - ACE System: `.claude/skills/cfn-ace-system/SKILL.md`

package/claude-assets/commands/cfn-loop-trigger.md

@@ -0,0 +1,114 @@
+---
+description: "Execute CFN Loop via trigger.dev (replaces Redis coordination)"
+argument-hint: "<task description> [--mode=mvp|standard|enterprise] [--test-command=<cmd>] [--pass-rate=<0.0-1.0>]"
+allowed-tools: ["Bash", "TodoWrite", "Read"]
+---
+
+# CFN Loop trigger.dev Mode - Production Execution
+
+**IMPORTANT: This slash command MUST auto-execute the trigger.dev workflow via Bash tool.**
+
+**DO NOT just show instructions. EXECUTE the bash command immediately after reading this.**
+
+---
+
+## Execution Instructions (AUTO-EXECUTE)
+
+**Step 1: Parse Arguments**
+```
+TASK_DESCRIPTION: $ARGUMENTS (extract task, remove flags)
+MODE: Parse from --mode flag or default to "standard"
+TEST_COMMAND: Parse from --test-command flag or default to "npm test"
+PASS_RATE: Parse from --pass-rate flag or default based on mode (mvp=0.70, standard=0.95, enterprise=0.98)
+```
+
+**Step 2: Verify trigger.dev Environment**
+```bash
+# Check TRIGGER_API_KEY is set
+if [ -z "$TRIGGER_API_KEY" ]; then
+  # Try loading from trigger-test-app
+  if [ -f "/mnt/c/Users/masha/Documents/trigger-test-app/.env.local" ]; then
+    export $(grep -E '^TRIGGER_' /mnt/c/Users/masha/Documents/trigger-test-app/.env.local | xargs)
+    echo "✅ Loaded trigger.dev credentials from trigger-test-app"
+  else
+    echo "❌ ERROR: TRIGGER_API_KEY not set"
+    echo "   Set TRIGGER_API_KEY environment variable or create .env.local"
+    exit 1
+  fi
+fi
+
+export TRIGGER_API_URL="${TRIGGER_API_URL:-http://localhost:3040}"
+echo "✅ trigger.dev API: $TRIGGER_API_URL"
+```
+
+**Step 3: Generate Task ID**
+```bash
+TASK_ID="cfn-trigger-$(date +%s%N | tail -c 7)-${RANDOM}"
+echo "📋 Task ID: $TASK_ID"
+```
+
+**Step 4: Trigger CFN Loop Workflow (REQUIRED - Execute via Bash)**
+```bash
+cd /mnt/c/Users/masha/Documents/claude-flow-novice/trigger-dev && \
+TRIGGER_API_KEY="$TRIGGER_API_KEY" \
+TRIGGER_API_URL="$TRIGGER_API_URL" \
+npx tsx src/cli/trigger-cfn-loop.ts \
+  --task-id "$TASK_ID" \
+  --description "$TASK_DESCRIPTION" \
+  --mode "$MODE" \
+  --test-command "$TEST_COMMAND" \
+  --pass-rate "$PASS_RATE"
+```
+
+**Step 5: Inform User**
+After triggering workflow, tell user:
+- ✅ CFN Loop triggered via trigger.dev with task ID: $TASK_ID
+- 📊 Monitor in dashboard: http://localhost:3040
+- 🔍 Check status: `npx tsx trigger-dev/src/cli/index.ts cfn-loop status <event-id>`
+
+---
+
+## Background Information (DO NOT show unless asked)
+
+**Task**: $ARGUMENTS
+
+## What is trigger.dev Mode?
+
+**trigger.dev Mode Architecture:**
+- Main Chat triggers workflow via trigger.dev SDK event
+- trigger.dev orchestrates Loop 3 agents, gate checks, Loop 2 validators
+- No Redis required - uses trigger.dev's built-in job coordination
+- Dashboard visibility at http://localhost:3040
+- Automatic retries and error handling built-in
+
+**Advantages over CLI/Redis mode:**
+- ✅ No Redis dependency or BLPOP coordination issues
+- ✅ Visual dashboard for job monitoring
+- ✅ Built-in retry logic and error handling
+- ✅ Event-driven architecture (no polling)
+- ✅ Persistent job history and logs
+
+**Mode Thresholds:**
+| Mode | Pass Rate | Consensus | Max Iterations |
+|------|-----------|-----------|----------------|
+| MVP | 0.70 | 0.80 | 5 |
+| Standard | 0.95 | 0.90 | 10 |
+| Enterprise | 0.98 | 0.95 | 15 |
+
+---
+
+## Troubleshooting
+
+**trigger.dev not running:**
+```bash
+cd /mnt/c/Users/masha/Documents/docker/trigger.dev && docker-compose up -d
+```
+
+**Check service health:**
+```bash
+curl http://localhost:3040/api/v1/health
+```
+
+**View job logs:**
+- Dashboard: http://localhost:3040
+- Or: `npx tsx trigger-dev/src/cli/index.ts cfn-loop status <event-id> --poll`

package/claude-assets/commands/deprecated/cfn-loop.md

@@ -95,7 +95,7 @@ Extract parameters from command:
 
 ```javascript
 // Read Task Mode guide for agent specialization and workflow
-const taskModeGuide = await Read('.claude/commands/cfn/CFN_LOOP_TASK_MODE.md');
+const taskModeGuide = await Read('.claude/commands/CFN_LOOP_TASK_MODE.md');
 
 // Guide provides:
 // - Agent specialization (Loop 3: implementers, Loop 2: validators, Loop 4: PO)
@@ -274,7 +274,7 @@ Main Chat does NOT spawn a coordinator. Instead, it coordinates directly followi
 
 ```javascript
 // Step 1: Read Task Mode Guide
-const guide = await Read('.claude/commands/cfn/CFN_LOOP_TASK_MODE.md');
+const guide = await Read('.claude/commands/CFN_LOOP_TASK_MODE.md');
 
 // Step 2: Analyze Task Complexity (from guide)
 const complexity = analyzeComplexity({

package/claude-assets/hooks/GIT-HOOKS-USAGE-EXAMPLES.md

@@ -0,0 +1,116 @@
+# Git Hooks: Usage Examples
+
+Real-world examples of the pre-commit credential detection system in action.
+
+## Example 1: Developer Accidentally Commits API Key
+
+Developer edits a configuration file and forgets to redact their Anthropic API key.
+
+```bash
+$ git add config.ts
+$ git commit -m "feat: add anthropic integration"
+
+Pre-Commit Hook: Scanning for credential exposure...
+
+COMMIT BLOCKED: 1 credential(s) detected
+
+CREDENTIAL DETECTED:
+   File: config.ts
+   Line: 1
+   Match: ANTHROPIC_API_KEY=[CREDENTIAL_REDACTED]
+```
+
+Resolution: Replace with placeholder, move to .env, use environment variable.
+
+## Example 2: Database Password in Connection String
+
+Hardcoded PostgreSQL password in database configuration.
+
+```bash
+$ git commit -m "chore: database configuration"
+
+COMMIT BLOCKED: 1 credential(s) detected
+
+CREDENTIAL DETECTED:
+   File: database.ts
+   Line: 4
+   Match: password: [CREDENTIAL_REDACTED]
+```
+
+Resolution: Replace with process.env.DB_PASSWORD.
+
+## Example 3: Test File with Mock Credentials (Whitelisted)
+
+Tests with legitimate test credentials that are whitelisted.
+
+```bash
+$ git add auth.test.ts
+$ git commit -m "test: add API key format validation"
+
+No credentials detected - proceeding with commit
+
+# Success! 'sk-ant-mock' and 'npm_MockTestKey'
+# are whitelisted patterns for testing
+```
+
+## Example 4: Documentation with [REDACTED] Placeholder
+
+Documentation showing API setup with redacted values.
+
+```bash
+$ git add API_SETUP.md
+$ git commit -m "docs: add API setup instructions"
+
+No credentials detected - proceeding with commit
+
+# Success! [REDACTED] is a whitelisted pattern
+```
+
+## Example 5: Multiple Files Scanned
+
+Multiple files scanned before commit.
+
+```bash
+$ git add src/auth.ts src/config.ts docs/SETUP.md tests/auth.test.ts
+$ git commit -m "feat: complete authentication setup"
+
+Pre-Commit Hook: Scanning for credential exposure...
+
+   Scanning: src/auth.ts
+   Scanning: src/config.ts
+   Scanning: docs/SETUP.md
+   Scanning: tests/auth.test.ts
+
+   Scanned: 4 files
+
+No credentials detected - proceeding with commit
+```
+
+## Example 6: Bypassing the Hook (Emergency Only)
+
+Emergency override when absolutely necessary.
+
+```bash
+$ git commit --no-verify -m "emergency: temporary workaround"
+
+# WARNING: CI/CD will still catch credentials!
+# This should only be used in true emergencies
+```
+
+## Example 7: Audit Trail Review
+
+Security team reviewing credential detection history.
+
+```bash
+$ cat .artifacts/logs/git-hooks.log
+
+2025-11-23T10:30:45Z | PRE-COMMIT BLOCKED | CREDENTIALS:1 | FILES_SCANNED:1
+2025-11-23T10:31:12Z | PRE-COMMIT SUCCESS | FILES_SCANNED:2
+2025-11-23T10:32:15Z | PRE-COMMIT SUCCESS | FILES_SCANNED:4
+```
+
+## Related Documentation
+
+- Complete Guide: `.claude/hooks/README-GIT-HOOKS.md`
+- Installation: `.claude/hooks/install-git-hooks.sh`
+- Pre-Commit Hook: `.git/hooks/pre-commit`

package/claude-assets/hooks/README-GIT-HOOKS.md

@@ -0,0 +1,443 @@
+# Git Hooks: Credential Exposure Prevention
+
+Automated pre-commit security validation to prevent accidental credential exposure.
+
+## Overview
+
+This system provides a multi-layered defense against credential exposure:
+
+1. **Pre-Commit Hook** (.git/hooks/pre-commit)
+   - Scans staged files before commit
+   - Blocks commits with exposed credentials
+   - Provides clear remediation guidance
+
+2. **Installation Script** (.claude/hooks/install-git-hooks.sh)
+   - Automated hook installation
+   - Validation and verification
+   - Project setup
+
+3. **Integration Points**
+   - Post-edit credential scanner (.claude/hooks/validators/credential-scanner.sh)
+   - CI/CD credential scanning (.github/workflows/security-credential-scan.yml)
+   - Git history scanning (git-secrets)
+
+## Installation
+
+### Quick Start
+
+```bash
+bash .claude/hooks/install-git-hooks.sh
+```
+
+### With Force Overwrite (CI/CD)
+
+```bash
+bash .claude/hooks/install-git-hooks.sh --force
+```
+
+### Manual Installation
+
+```bash
+# Copy pre-commit hook
+cp .git/hooks/pre-commit .git/hooks/pre-commit.bak  # Backup existing
+chmod +x .git/hooks/pre-commit
+
+# Verify installation
+ls -l .git/hooks/pre-commit
+```
+
+## Detected Credential Patterns
+
+### API Keys
+
+| Provider | Pattern | Example |
+|----------|---------|---------|
+| Anthropic | `sk-ant-[a-zA-Z0-9_-]{40,}` | `sk-ant-v1-abcd1234...` |
+| Z.ai | `sk-zai-[a-zA-Z0-9._-]{20,}` | `sk-zai-12345678...` |
+| NPM | `npm_[a-zA-Z0-9]{36}` | `npm_1a2b3c4d5e6f...` |
+| Trigger.dev | `tr_dev_[a-zA-Z0-9]{16,}` | `tr_dev_abc123...` |
+| Google | `AIzaSy[a-zA-Z0-9_-]{33}` | `AIzaSy_1234567...` |
+| XAi/Grok | `xai-[a-zA-Z0-9]{32,}` | `xai-abc123...` |
+
+### Z.ai Token Formats
+
+| Format | Pattern |
+|--------|---------|
+| Current | `[a-zA-Z0-9]{32,}\.SUs3hnpAZAGsQDHX` |
+| Legacy | `[a-zA-Z0-9]{32,}\.QO8R0JxF4fucsoWL` |
+| Legacy | `[a-zA-Z0-9]{32,}\.gDXkwrMNlYcqE8mF` |
+
+### Environment Variable Assignments
+
+Detects suspicious assignments like:
+
+```bash
+ANTHROPIC_API_KEY="sk-ant-..."
+ZAI_API_KEY="sk-zai-..."
+REDIS_PASSWORD="password123"
+POSTGRES_PASSWORD="secure_pass"
+```
+
+### Database Credentials
+
+- PostgreSQL passwords
+- MySQL passwords
+- MongoDB passwords
+- Redis passwords
+
+### JSON/YAML Structures
+
+```json
+{
+  "api_key": "long_credential_string",
+  "apiKey": "secret_value",
+  "auth_token": "bearer_token",
+  "password": "database_password"
+}
+```
+
+## Whitelisted Patterns
+
+The following patterns are automatically whitelisted and won't trigger blocks:
+
+| Pattern | Usage |
+|---------|-------|
+| `[REDACTED]` | Already redacted credentials |
+| `YOUR_API_KEY` | Documentation placeholders |
+| `YOUR_.*_KEY` | Generic placeholders |
+| `CHANGE_ME` | Configuration templates |
+| `test_key` / `mock_key` | Test credentials |
+| `sk-ant-mock` | Mock Anthropic keys |
+| `npm_MockTestKey` | Mock NPM keys |
+| `example.com` | Example domains |
+
+## Usage
+
+### Normal Development
+
+```bash
+# Stage and commit files
+git add src/feature.ts docs/FEATURE.md
+git commit -m "feat: add new feature"
+
+# If credentials detected, you'll see:
+# ❌ COMMIT BLOCKED: 1 credential(s) detected
+# File: src/feature.ts
+# Match: ANTHROPIC_API_KEY="[CREDENTIAL_REDACTED]"
+```
+
+### Remediation Steps
+
+When the hook blocks your commit:
+
+1. **Identify the exposed credential:**
+   ```bash
+   git diff --cached src/feature.ts  # Review staged changes
+   ```
+
+2. **Replace with placeholder:**
+   ```bash
+   # Replace actual value with [REDACTED]
+   sed -i 's/sk-ant-.*/[REDACTED]/g' src/feature.ts
+   ```
+
+3. **Move to secure location:**
+   ```bash
+   # Add to .env (add to .gitignore)
+   echo "ANTHROPIC_API_KEY=sk-ant-..." >> .env
+   ```
+
+4. **Update code to use environment variable:**
+   ```typescript
+   // Before
+   const apiKey = "sk-ant-...";
+
+   // After
+   const apiKey = process.env.ANTHROPIC_API_KEY;
+   ```
+
+5. **Re-stage and commit:**
+   ```bash
+   git add src/feature.ts
+   git commit -m "feat: add new feature"
+   ```
+
+### Test Files with Mock Credentials
+
+For test files, use whitelisted mock credentials:
+
+```typescript
+// tests/auth.test.ts
+describe('Authentication', () => {
+  it('should validate API key format', () => {
+    const mockKey = 'sk-ant-mock';  // Whitelisted
+    expect(validateKey(mockKey)).toBe(true);
+  });
+});
+```
+
+Whitelisted mock patterns:
+- `sk-ant-mock` (Anthropic)
+- `npm_MockTestKey` (NPM)
+- `test_key` or `test-key` (Generic)
+- `mock_key` or `mock-key` (Generic)
+- `[REDACTED]` (Documentation)
+
+### Bypass (NOT RECOMMENDED)
+
+To bypass the pre-commit hook:
+
+```bash
+git commit --no-verify
+```
+
+**WARNING:** This disables all pre-commit hooks. Only use if absolutely necessary, and ensure credentials are removed before pushing.
+
+## File Scanning
+
+### Files Scanned
+
+The pre-commit hook scans these file types:
+
+```
+*.ts, *.tsx, *.js, *.jsx
+*.json, *.md, *.sh, *.bash
+*.env*, *.yaml, *.yml, *.txt
+```
+
+### Files Skipped
+
+Files in these directories are automatically skipped:
+
+- `.git/`
+- `node_modules/`
+- `.venv/`
+- `dist/`, `build/`
+- `.next/`, `.artifacts/`
+
+Binary files larger than 1MB are also skipped.
+
+## Integration with Other Tools
+
+### Post-Edit Credential Scanner
+
+The post-edit hook runs the same credential scanner:
+
+```bash
+.claude/hooks/validators/credential-scanner.sh
+```
+
+### CI/CD Credential Scanning
+
+GitHub Actions workflow validates credentials:
+
+```yaml
+# .github/workflows/security-credential-scan.yml
+- Credential scanning (git-secrets)
+- TruffleHog scanning
+- Custom pattern validation
+```
+
+### Git History Scanning
+
+To scan git history for past credential exposure:
+
+```bash
+git secrets --scan-history --since=HEAD~10
+```
+
+## Audit Trail
+
+All pre-commit hook activity is logged to:
+
+```
+.artifacts/logs/git-hooks.log
+```
+
+Log entries include:
+
+```
+2025-11-23T10:30:45Z | PRE-COMMIT BLOCKED | CREDENTIALS:2 | FILES_SCANNED:5
+2025-11-23T10:31:12Z | PRE-COMMIT SUCCESS | FILES_SCANNED:3
+```
+
+## Troubleshooting
+
+### Hook Not Executing
+
+Check if the hook is executable:
+
+```bash
+ls -l .git/hooks/pre-commit
+# Should show: -rwxr-xr-x
+```
+
+Make it executable:
+
+```bash
+chmod +x .git/hooks/pre-commit
+```
+
+### Hook Conflicts
+
+If you have other pre-commit hooks, they may conflict. Check:
+
+```bash
+cat .git/hooks/pre-commit
+```
+
+Merge hooks using a wrapper script.
+
+### False Positives
+
+If a legitimate pattern is blocked, add it to WHITELIST in the hook:
+
+```bash
+# Edit .git/hooks/pre-commit
+WHITELIST=(
+    # ... existing patterns ...
+    "my_specific_pattern"
+)
+```
+
+Then reinstall:
+
+```bash
+bash .claude/hooks/install-git-hooks.sh --force
+```
+
+### Permission Issues
+
+If you can't install hooks:
+
+```bash
+# Check .git directory permissions
+ls -ld .git
+chmod 755 .git
+chmod 755 .git/hooks
+
+# Retry installation
+bash .claude/hooks/install-git-hooks.sh
+```
+
+## Best Practices
+
+### 1. Use Environment Variables
+
+Never hardcode credentials:
+
+```typescript
+// WRONG
+const apiKey = "sk-ant-v1-...";
+
+// RIGHT
+const apiKey = process.env.ANTHROPIC_API_KEY;
+```
+
+### 2. Create .env.example
+
+Document required variables without values:
+
+```bash
+# .env.example
+ANTHROPIC_API_KEY=YOUR_API_KEY
+DATABASE_URL=postgresql://user:pass@localhost/db
+REDIS_PASSWORD=CHANGE_ME
+```
+
+### 3. Add .env to .gitignore
+
+```bash
+echo ".env*" >> .gitignore
+git add .gitignore
+git commit -m "chore: add .env to gitignore"
+```
+
+### 4. Use Secure Configuration
+
+For deployments, use:
+- Environment variable injection
+- Secret management services (HashiCorp Vault, AWS Secrets Manager)
+- Encrypted configuration files (git-crypt, SOPS)
+
+### 5. Redact Documentation
+
+When documenting credentials in code examples:
+
+```bash
+# DO: Use [REDACTED] placeholder
+ANTHROPIC_API_KEY=sk-ant-[REDACTED]
+
+# DON'T: Show actual credentials
+ANTHROPIC_API_KEY=sk-ant-v1-abc123...
+```
+
+## Exit Codes
+
+| Code | Meaning | Action |
+|------|---------|--------|
+| 0 | No credentials detected | Commit proceeds |
+| 1 | Credentials detected | Commit blocked |
+
+## Configuration
+
+### Modify Detection Patterns
+
+Edit `.git/hooks/pre-commit` and modify the PATTERNS array:
+
+```bash
+declare -a PATTERNS=(
+    "your-new-pattern"
+    # ... existing patterns ...
+)
+```
+
+### Modify Whitelist
+
+Edit `.git/hooks/pre-commit` and modify the WHITELIST array:
+
+```bash
+declare -a WHITELIST=(
+    "\\[REDACTED\\]"
+    "your-safe-pattern"
+    # ... existing patterns ...
+)
+```
+
+### Customize Scanned File Types
+
+Edit `.git/hooks/pre-commit` and modify SCANNABLE_TYPES:
+
+```bash
+declare -a SCANNABLE_TYPES=(
+    "*.ts" "*.tsx"
+    "*.custom"  # Add custom type
+)
+```
+
+## Related Documentation
+
+- **Credential Scanner**: `.claude/hooks/validators/credential-scanner.sh`
+- **CI/CD Workflow**: `.github/workflows/security-credential-scan.yml`
+- **Installation Script**: `.claude/hooks/install-git-hooks.sh`
+- **Project Standards**: `CLAUDE.md` (Redaction Protocol section)
+
+## Support
+
+For issues or improvements:
+
+1. Review `.git/hooks/pre-commit` for current implementation
+2. Check `.artifacts/logs/git-hooks.log` for audit trail
+3. Test with: `git commit --no-verify` (temporary bypass)
+4. Refer to post-edit scanner for pattern reference
+
+## Summary
+
+The git hooks system provides:
+
+- **Automated Detection**: Pre-commit scanning catches credentials before commit
+- **Consistent Patterns**: Same detection rules across pre-commit, post-edit, and CI/CD
+- **Clear Remediation**: Detailed guidance when credentials are detected
+- **Flexible Whitelisting**: Safe patterns for tests and documentation
+- **Audit Trail**: Complete logging of all credential detection events
+- **Easy Installation**: Single command setup with validation