claude-flow-novice 2.18.5 → 2.18.6

package/.claude/hooks/detect-hardcoded-credentials.sh

@@ -0,0 +1,212 @@
+#!/bin/bash
+#
+# Pre-commit Hook: Detect Hardcoded Credentials
+# Version: 1.0.0
+#
+# This hook prevents accidental commits of hardcoded credentials including:
+# - API keys (Anthropic, Z.ai, OpenRouter, etc)
+# - Database passwords
+# - JWT/Session secrets
+# - Bearer tokens
+# - Private keys
+#
+# Installation:
+#   cp .claude/hooks/detect-hardcoded-credentials.sh .git/hooks/pre-commit
+#   chmod +x .git/hooks/pre-commit
+#
+# Usage:
+#   Runs automatically before every git commit
+#   Bypass (NOT RECOMMENDED): git commit --no-verify
+#
+# Exit Codes:
+#   0 = No credentials found (safe to commit)
+#   1 = Credentials detected (commit blocked)
+#
+
+set -euo pipefail
+
+# Color codes for output
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+NC='\033[0m' # No Color
+
+# Configuration
+EXCLUDE_PATTERNS=(
+  "*.example"
+  "*.template"
+  "docs/"
+  "tests/"
+  "legacy/"
+  "node_modules/"
+  ".git/"
+  "*.md"
+  "tests/fixtures/"  # Only exclude test fixtures, not all tests
+  "legacy/"
+  "node_modules/"
+  ".git/"
+  # REMOVED: "docs/" exclusion - now validates documentation files
+  # REMOVED: "*.md" exclusion - now validates markdown files
+)
+
+# High-entropy patterns (likely credentials)
+CREDENTIAL_PATTERNS=(
+  # API Keys
+  "sk-ant-v1-[a-zA-Z0-9_-]{50,}"                      # Anthropic keys
+  "sk-[a-zA-Z0-9]{20,}"                               # Generic API keys
+  "api_key\s*=\s*['\"][^'\"]{20,}['\"]"               # api_key assignments
+  "apikey\s*=\s*['\"][^'\"]{20,}['\"]"                # apikey assignments
+  "API_KEY\s*=\s*['\"][^'\"]{20,}['\"]"               # API_KEY assignments
+
+  # Passwords
+  "password\s*=\s*['\"][^'\"]{8,}['\"]"               # password assignments
+  "passwd\s*=\s*['\"][^'\"]{8,}['\"]"                 # passwd assignments
+  "pwd\s*=\s*['\"][^'\"]{8,}['\"]"                    # pwd assignments
+  "PASSWORD\s*=\s*['\"][^'\"]{8,}['\"]"               # PASSWORD assignments
+
+  # Database credentials
+  "POSTGRES_PASSWORD\s*=\s*['\"][^'\"]{8,}['\"]"      # PostgreSQL password
+  "MYSQL_PASSWORD\s*=\s*['\"][^'\"]{8,}['\"]"         # MySQL password
+  "MONGO_PASSWORD\s*=\s*['\"][^'\"]{8,}['\"]"         # MongoDB password
+  "DB_PASSWORD\s*=\s*['\"][^'\"]{8,}['\"]"            # Generic DB password
+  "REDIS_PASSWORD\s*=\s*['\"][^'\"]{8,}['\"]"         # Redis password
+
+  # Tokens & Secrets
+  "token\s*=\s*['\"][^'\"]{20,}['\"]"                 # token assignments
+  "secret\s*=\s*['\"][^'\"]{20,}['\"]"                # secret assignments
+  "jwt\s*=\s*['\"][^'\"]{20,}['\"]"                   # JWT assignments
+  "Bearer\s+[a-zA-Z0-9_.-]{20,}"                      # Bearer tokens
+
+  # AWS Credentials
+  "AKIA[0-9A-Z]\{16\}"                                # AWS Access Key ID
+  "aws_access_key_id\s*=\s*[^[:space:]]+"             # AWS key assignment
+  "aws_secret_access_key\s*=\s*[^[:space:]]+"         # AWS secret assignment
+
+  # Private Keys
+  "-----BEGIN PRIVATE KEY-----"                       # PEM private key start
+  "-----BEGIN RSA PRIVATE KEY-----"                   # RSA private key start
+  "-----BEGIN EC PRIVATE KEY-----"                    # EC private key start
+)
+
+# Build grep pattern
+PATTERN=""
+for p in "${CREDENTIAL_PATTERNS[@]}"; do
+  if [ -z "$PATTERN" ]; then
+    PATTERN="$p"
+  else
+    PATTERN="$PATTERN|$p"
+  fi
+done
+
+# Build exclude pattern for grep
+EXCLUDE_GREP=""
+for exc in "${EXCLUDE_PATTERNS[@]}"; do
+  if [ -z "$EXCLUDE_GREP" ]; then
+    EXCLUDE_GREP="--exclude=$exc"
+  else
+    EXCLUDE_GREP="$EXCLUDE_GREP --exclude=$exc"
+  fi
+done
+
+# Function to check staged files
+check_staged_files() {
+  local found_credentials=0
+
+  # Get list of staged files
+  local staged_files=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || echo "")
+
+  if [ -z "$staged_files" ]; then
+    return 0
+  fi
+
+  # Check each staged file
+  while IFS= read -r file; do
+    # Skip excluded patterns
+    local skip=0
+    for exc in "${EXCLUDE_PATTERNS[@]}"; do
+      if [[ "$file" == $exc ]]; then
+        skip=1
+        break
+      fi
+    done
+
+    if [ $skip -eq 1 ]; then
+      continue
+    fi
+
+    # Get staged content
+    local staged_content=$(git show ":$file" 2>/dev/null || echo "")
+
+    # Check for credentials in staged content
+    if echo "$staged_content" | grep -E "$PATTERN" >/dev/null 2>&1; then
+      echo -e "${RED}[SECURITY] Hardcoded credential detected in: ${NC}$file"
+      found_credentials=1
+    fi
+  done <<< "$staged_files"
+
+  return $found_credentials
+}
+
+# Function to check for dangerous files
+check_dangerous_files() {
+  local staged_files=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || echo "")
+
+  if [ -z "$staged_files" ]; then
+    return 0
+  fi
+
+  # Check for .env files (should never be committed)
+  if echo "$staged_files" | grep -E "^\.(env|env\.production|env\.staging)" >/dev/null; then
+    echo -e "${RED}[SECURITY] Attempting to commit .env file (BLOCKED)${NC}"
+    echo "        Use .env.example instead and add .env to .gitignore"
+    return 1
+  fi
+
+  # Check for private key files
+  if echo "$staged_files" | grep -E "\.(pem|key|pk|priv)$" >/dev/null; then
+    echo -e "${RED}[SECURITY] Attempting to commit private key file (BLOCKED)${NC}"
+    echo "        Private keys should never be committed to version control"
+    return 1
+  fi
+
+  return 0
+}
+
+# Main execution
+main() {
+  echo -e "${YELLOW}[CREDENTIAL DETECTION] Scanning staged files...${NC}"
+
+  # Check dangerous file types first
+  if ! check_dangerous_files; then
+    echo ""
+    echo -e "${RED}[SECURITY] Commit blocked: dangerous files detected${NC}"
+    echo ""
+    echo "How to fix:"
+    echo "  1. Add .env to .gitignore: echo '.env' >> .gitignore"
+    echo "  2. Remove the file from staging: git reset HEAD <file>"
+    echo "  3. Remove from history (if already committed):"
+    echo "     git filter-branch --tree-filter 'rm -f <file>' HEAD"
+    echo ""
+    return 1
+  fi
+
+  # Check for hardcoded credentials
+  if ! check_staged_files; then
+    echo ""
+    echo -e "${RED}[SECURITY] Commit blocked: hardcoded credentials detected${NC}"
+    echo ""
+    echo "How to fix:"
+    echo "  1. Remove hardcoded values: git checkout -- <file>"
+    echo "  2. Use environment variables instead"
+    echo "  3. Add values to .env.example (without real values)"
+    echo "  4. Re-stage the corrected file"
+    echo ""
+    echo "Reference: docs/CREDENTIAL_MANAGEMENT.md"
+    return 1
+  fi
+
+  echo -e "${GREEN}[CREDENTIAL DETECTION] ✓ No credentials detected${NC}"
+  return 0
+}
+
+main "$@"

package/.claude/hooks/install-git-hooks.sh

@@ -0,0 +1,243 @@
+#!/bin/bash
+# Git Hooks Installation Script
+# Installs security-focused git hooks to prevent credential exposure
+# Usage: bash .claude/hooks/install-git-hooks.sh [--force]
+
+set -euo pipefail
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+BOLD='\033[1m'
+NC='\033[0m'
+
+# Configuration
+PROJECT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+GIT_HOOKS_DIR="$PROJECT_ROOT/.git/hooks"
+HOOKS_SOURCE_DIR="$PROJECT_ROOT/.claude/hooks"
+FORCE_INSTALL=false
+
+# Exit codes
+EXIT_SUCCESS=0
+EXIT_ERROR=1
+
+# Parse arguments
+parse_arguments() {
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --force)
+                FORCE_INSTALL=true
+                shift
+                ;;
+            --help)
+                show_help
+                exit $EXIT_SUCCESS
+                ;;
+            *)
+                echo "Unknown argument: $1"
+                show_help
+                exit $EXIT_ERROR
+                ;;
+        esac
+    done
+}
+
+# Show help message
+show_help() {
+    cat << 'EOF'
+Usage: bash .claude/hooks/install-git-hooks.sh [OPTIONS]
+
+Install git hooks to prevent credential exposure and ensure code quality.
+
+Options:
+  --force         Overwrite existing hooks without confirmation
+  --help          Show this help message
+
+Installed Hooks:
+  .git/hooks/pre-commit - Scans staged files for credentials before commit
+
+Exit Codes:
+  0 - Installation successful
+  1 - Installation failed
+
+Examples:
+  # Install with confirmation prompts
+  bash .claude/hooks/install-git-hooks.sh
+
+  # Install with force overwrite (CI/CD)
+  bash .claude/hooks/install-git-hooks.sh --force
+
+For more information, see .claude/hooks/README-GIT-HOOKS.md
+EOF
+}
+
+# Validate project structure
+validate_project() {
+    if [ ! -d "$PROJECT_ROOT/.git" ]; then
+        echo -e "${RED}ERROR: Not a git repository${NC}"
+        echo "Run this script from the root of a git repository"
+        return $EXIT_ERROR
+    fi
+
+    if [ ! -d "$HOOKS_SOURCE_DIR" ]; then
+        echo -e "${RED}ERROR: .claude/hooks directory not found${NC}"
+        echo "Expected location: $HOOKS_SOURCE_DIR"
+        return $EXIT_ERROR
+    fi
+
+    return $EXIT_SUCCESS
+}
+
+# Check if .artifacts/logs directory exists, create if needed
+ensure_logs_directory() {
+    local logs_dir="$PROJECT_ROOT/.artifacts/logs"
+    if [ ! -d "$logs_dir" ]; then
+        mkdir -p "$logs_dir"
+        echo -e "${BLUE}Created logs directory: $logs_dir${NC}"
+    fi
+}
+
+# Install a single git hook
+install_hook() {
+    local hook_source="$1"
+    local hook_name=$(basename "$hook_source")
+    local hook_dest="$GIT_HOOKS_DIR/$hook_name"
+
+    # Check if hook source exists
+    if [ ! -f "$hook_source" ]; then
+        echo -e "${YELLOW}WARNING: Hook source not found: $hook_source${NC}"
+        return 1
+    fi
+
+    # Check if destination hook already exists
+    if [ -f "$hook_dest" ]; then
+        if [ "$FORCE_INSTALL" = false ]; then
+            echo -e "${YELLOW}Hook already exists: $hook_name${NC}"
+            read -p "Overwrite? (y/n) " -n 1 -r
+            echo
+            if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+                echo -e "${BLUE}Skipped: $hook_name${NC}"
+                return 0
+            fi
+        else
+            echo -e "${BLUE}Overwriting: $hook_name${NC}"
+        fi
+    fi
+
+    # Copy hook file
+    cp "$hook_source" "$hook_dest"
+    chmod +x "$hook_dest"
+
+    # Validate installation
+    if [ ! -f "$hook_dest" ] || [ ! -x "$hook_dest" ]; then
+        echo -e "${RED}FAILED to install: $hook_name${NC}"
+        return $EXIT_ERROR
+    fi
+
+    echo -e "${GREEN}Installed: $hook_name${NC}"
+    return $EXIT_SUCCESS
+}
+
+# Validate hook is functional
+validate_hook() {
+    local hook_name="$1"
+    local hook_path="$GIT_HOOKS_DIR/$hook_name"
+
+    if [ ! -f "$hook_path" ]; then
+        echo -e "${RED}VALIDATION FAILED: Hook file not found${NC}"
+        return $EXIT_ERROR
+    fi
+
+    if [ ! -x "$hook_path" ]; then
+        echo -e "${RED}VALIDATION FAILED: Hook is not executable${NC}"
+        return $EXIT_ERROR
+    fi
+
+    # Check for bash shebang
+    if ! head -1 "$hook_path" | grep -q "^#!/bin/bash"; then
+        echo -e "${RED}VALIDATION FAILED: Hook missing bash shebang${NC}"
+        return $EXIT_ERROR
+    fi
+
+    echo -e "${GREEN}VALIDATION PASSED: $hook_name${NC}"
+    return $EXIT_SUCCESS
+}
+
+# Main installation logic
+main() {
+    echo -e "${BOLD}Git Hooks Installation${NC}"
+    echo "========================================"
+    echo ""
+
+    # Parse arguments
+    parse_arguments "$@"
+
+    # Validate project structure
+    if ! validate_project; then
+        exit $EXIT_ERROR
+    fi
+
+    # Ensure logs directory exists
+    ensure_logs_directory
+
+    echo -e "${BLUE}Installing git hooks to: $GIT_HOOKS_DIR${NC}"
+    echo ""
+
+    local install_count=0
+    local fail_count=0
+
+    # Install pre-commit hook
+    if install_hook "$PROJECT_ROOT/.git/hooks/pre-commit"; then
+        install_count=$((install_count + 1))
+    else
+        fail_count=$((fail_count + 1))
+    fi
+
+    echo ""
+
+    # Validate installations
+    echo -e "${BOLD}Validating installations...${NC}"
+    echo ""
+
+    if ! validate_hook "pre-commit"; then
+        fail_count=$((fail_count + 1))
+    fi
+
+    echo ""
+    echo -e "${BOLD}Installation Summary${NC}"
+    echo "========================================"
+    echo "Installed hooks: $install_count"
+    echo "Failed hooks: $fail_count"
+    echo ""
+
+    if [ $fail_count -eq 0 ]; then
+        echo -e "${GREEN}✅ All hooks installed successfully${NC}"
+        echo ""
+        echo -e "${BOLD}Next steps:${NC}"
+        echo "  1. Try committing a file with a mock credential:"
+        echo "     git add test.txt"
+        echo "     echo 'API_KEY=sk-ant-test123456789' >> test.txt"
+        echo "     git commit -m 'Test credential detection'"
+        echo ""
+        echo "  2. The pre-commit hook will block the commit"
+        echo ""
+        echo "  3. For test files, use whitelisted patterns:"
+        echo "     - sk-ant-mock"
+        echo "     - npm_MockTestKey"
+        echo "     - test_key / mock_key"
+        echo "     - [REDACTED]"
+        echo ""
+        echo -e "${BOLD}Documentation:${NC}"
+        echo "  .claude/hooks/README-GIT-HOOKS.md"
+        echo ""
+        return $EXIT_SUCCESS
+    else
+        echo -e "${RED}❌ Installation failed${NC}"
+        return $EXIT_ERROR
+    fi
+}
+
+# Execute main function
+main "$@"

package/.claude/hooks/post-commit-codebase-index

@@ -0,0 +1,75 @@
+#!/bin/bash
+# Post-commit hook for incremental codebase indexing
+# Automatically updates RuVector index with committed files
+#
+# Install: ln -s ../../.claude/hooks/post-commit-codebase-index .git/hooks/post-commit
+
+set -euo pipefail
+
+SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../skills/ruvector-codebase-index" && pwd)"
+INDEX_SCRIPT="$SKILL_DIR/index.sh"
+MOVE_HANDLER="$SKILL_DIR/handle-file-moves.sh"
+
+# Colors
+BLUE='\033[0;34m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+echo -e "${BLUE}[RuVector]${NC} Post-commit indexing hook triggered"
+
+# Check if indexing is enabled
+if [[ "${RUVECTOR_AUTO_INDEX:-true}" != "true" ]]; then
+  echo -e "${YELLOW}[RuVector]${NC} Auto-indexing disabled (set RUVECTOR_AUTO_INDEX=true to enable)"
+  exit 0
+fi
+
+# Check if API key is available
+if [[ -z "${OPENAI_API_KEY:-}" && -z "${ZAI_API_KEY:-}" ]]; then
+  echo -e "${YELLOW}[RuVector]${NC} Skipping indexing: No API key found"
+  exit 0
+fi
+
+# STEP 1: Handle file moves/renames (delete old entries, index new locations)
+echo -e "${BLUE}[RuVector]${NC} Checking for file moves..."
+"$MOVE_HANDLER" --from-commit 2>&1 | tee -a /tmp/ruvector-moves.log
+
+# STEP 2: Get list of added/modified files from the last commit
+COMMITTED_FILES=$(git diff-tree --no-commit-id --name-only --diff-filter=AM -r HEAD 2>/dev/null || echo "")
+
+if [[ -z "$COMMITTED_FILES" ]]; then
+  echo -e "${YELLOW}[RuVector]${NC} No files to index"
+  exit 0
+fi
+
+# Filter for indexable files
+CONFIG_FILE="$SKILL_DIR/config.json"
+INDEXABLE_EXTENSIONS=$(jq -r '.indexableExtensions[]' "$CONFIG_FILE" 2>/dev/null || echo "")
+
+INDEXABLE_FILES=()
+while IFS= read -r file; do
+  if [[ -f "$file" ]]; then
+    ext=".${file##*.}"
+    if echo "$INDEXABLE_EXTENSIONS" | grep -q "$ext"; then
+      INDEXABLE_FILES+=("$file")
+    fi
+  fi
+done <<< "$COMMITTED_FILES"
+
+if [[ ${#INDEXABLE_FILES[@]} -eq 0 ]]; then
+  echo -e "${YELLOW}[RuVector]${NC} No indexable files in commit"
+  exit 0
+fi
+
+echo -e "${BLUE}[RuVector]${NC} Indexing ${#INDEXABLE_FILES[@]} file(s)..."
+
+# Run indexing in background to not block git operations
+(
+  "$INDEX_SCRIPT" --files "${INDEXABLE_FILES[@]}" > /tmp/ruvector-index.log 2>&1
+  echo -e "${GREEN}[RuVector]${NC} Index updated successfully"
+) &
+
+# Don't wait for indexing to complete
+echo -e "${BLUE}[RuVector]${NC} Indexing started in background (check /tmp/ruvector-index.log for details)"
+
+exit 0

package/.claude/hooks/subagent-start.sh

@@ -0,0 +1,98 @@
+#!/bin/bash
+# SubagentStart Hook - Claude Code v2.0.43+
+# Automatically invoked when Main Chat spawns a Task() agent
+#
+# High-value features:
+# 1. Automatic SQLite lifecycle tracking
+# 2. Protocol dependency validation (prevents "consensus on vapor")
+
+set -euo pipefail
+
+# Hook input (provided by Claude Code)
+AGENT_ID="${AGENT_ID:-unknown}"
+AGENT_TYPE="${AGENT_TYPE:-unknown}"
+TASK_ID="${TASK_ID:-unknown}"
+SPAWNED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+# Project paths
+PROJECT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || echo ".")
+DB_PATH="${PROJECT_ROOT}/claude-assets/skills/cfn-redis-coordination/data/cfn-loop.db"
+LOG_PATH="${PROJECT_ROOT}/.artifacts/logs/subagent-lifecycle.log"
+
+# Ensure directories exist
+mkdir -p "$(dirname "$DB_PATH")"
+mkdir -p "$(dirname "$LOG_PATH")"
+
+# ============================================================================
+# Feature 1: Automatic SQLite Lifecycle Tracking
+# ============================================================================
+
+# Initialize database schema if needed
+sqlite3 "$DB_PATH" <<EOF
+CREATE TABLE IF NOT EXISTS agents (
+    id TEXT PRIMARY KEY,
+    type TEXT NOT NULL,
+    status TEXT NOT NULL,
+    confidence REAL,
+    spawned_at TEXT,
+    completed_at TEXT,
+    metadata TEXT
+);
+EOF
+
+# Insert spawn record
+sqlite3 "$DB_PATH" <<EOF
+INSERT OR REPLACE INTO agents (id, type, status, spawned_at, metadata)
+VALUES (
+    '$AGENT_ID',
+    '$AGENT_TYPE',
+    'spawned',
+    '$SPAWNED_AT',
+    '{"source": "subagent_start_hook", "task_id": "$TASK_ID"}'
+);
+EOF
+
+echo "[SubagentStart] Lifecycle tracking: $AGENT_ID ($AGENT_TYPE) spawned at $SPAWNED_AT" | tee -a "$LOG_PATH"
+
+# ============================================================================
+# Feature 2: Protocol Dependency Validation
+# ============================================================================
+
+# Extract phase from agent type (e.g., "loop2-validator" -> "loop2")
+if [[ "$AGENT_TYPE" =~ ^loop([0-9]+)- ]]; then
+    PHASE="${BASH_REMATCH[1]}"
+
+    # Loop 2 validators must wait for Loop 3 completion
+    if [ "$PHASE" = "2" ] && [ "$TASK_ID" != "unknown" ]; then
+        LOOP3_COMPLETED=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM agents WHERE metadata LIKE '%\"task_id\": \"$TASK_ID\"%' AND type LIKE 'loop3-%' AND status='completed';")
+
+        if [ "$LOOP3_COMPLETED" -eq 0 ]; then
+            echo "[SubagentStart] ERROR: Loop 2 agent spawned before Loop 3 completion (task: $TASK_ID)" | tee -a "$LOG_PATH"
+            echo "WARN: Protocol violation detected - Loop 2 validator spawning before Loop 3 implementers complete"
+            echo "This may indicate 'consensus on vapor' anti-pattern"
+            # Don't exit 1 - allow spawn but log warning for debugging
+        else
+            echo "[SubagentStart] Protocol check passed: Loop 3 completed ($LOOP3_COMPLETED agents) before Loop 2 spawn" | tee -a "$LOG_PATH"
+        fi
+    fi
+
+    # Product Owner must wait for Loop 2 completion
+    if [[ "$AGENT_TYPE" =~ product-owner ]] && [ "$TASK_ID" != "unknown" ]; then
+        LOOP2_COMPLETED=$(sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM agents WHERE metadata LIKE '%\"task_id\": \"$TASK_ID\"%' AND type LIKE 'loop2-%' AND status='completed';")
+
+        if [ "$LOOP2_COMPLETED" -eq 0 ]; then
+            echo "[SubagentStart] ERROR: Product Owner spawned before Loop 2 completion (task: $TASK_ID)" | tee -a "$LOG_PATH"
+            echo "WARN: Protocol violation - Product Owner making decisions before validator review"
+            # Don't exit 1 - allow spawn but log warning
+        else
+            echo "[SubagentStart] Protocol check passed: Loop 2 completed ($LOOP2_COMPLETED agents) before Product Owner spawn" | tee -a "$LOG_PATH"
+        fi
+    fi
+fi
+
+# ============================================================================
+# Success Exit
+# ============================================================================
+
+echo "[SubagentStart] Hook completed successfully for $AGENT_ID" | tee -a "$LOG_PATH"
+exit 0