claude-skill-lord 2.1.0 → 2.1.1

package/.claude-plugin/marketplace.json

@@ -9,8 +9,8 @@
     {
       "name": "claude-skill-lord",
       "source": "./",
-      "description": "Curated Claude Code plugin — 22 agents, 61 skills, 40+ commands with intelligent skill routing and UI/UX design intelligence",
-      "version": "1.5.1",
+      "description": "Curated Claude Code plugin — 43 agents, 161 skills, 114 commands, 11 language rules",
+      "version": "2.1.0",
       "category": "workflow",
       "tags": ["agents", "skills", "commands", "hooks", "skill-routing", "quality-gate", "tdd", "code-review"],
       "strict": false

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "claude-skill-lord",
-  "version": "2.0.6",
-  "description": "Curated Claude Code plugin — 43 agents, 170 skills, 114 commands, 11 language rules",
+  "version": "2.1.0",
+  "description": "Curated Claude Code plugin — 43 agents, 161 skills, 114 commands, 11 language rules",
   "author": {
     "name": "Dong Anh",
     "email": "donganhvu20@gmail.com"

package/CLAUDE.md

@@ -11,7 +11,7 @@ Curated Claude Code plugin with intelligent skill routing, structured agents, an
 
 **IMPORTANT:** Follow development rules strictly. Research & Reuse is mandatory FIRST step before implementation.
 
-## Agents (44)
+## Agents (43)
 
 ### Core Agents
 | Agent | Role |
@@ -72,7 +72,7 @@ Curated Claude Code plugin with intelligent skill routing, structured agents, an
 
 All skills live in `./skills/<name>/SKILL.md` — flat structure, no tiers.
 
-## Commands (115)
+## Commands (114)
 
 ### Core Commands
 | Command | Description |
@@ -85,7 +85,7 @@ All skills live in `./skills/<name>/SKILL.md` — flat structure, no tiers.
 | /tdd | Test-driven development workflow |
 | /debug | Deep issue analysis |
 | /code-review | Code review |
-| /route | Get skill recommendations for your task |
+| /model-route | Get skill recommendations for your task |
 | /audit | Run quality checks |
 | /scout | Search codebase (variants: ext) |
 | /bootstrap | Initialize new projects (variants: auto, auto/fast) |

package/README.md

@@ -139,7 +139,7 @@ The most common workflow — plan first, then implement, then validate:
 
 ```
 /scout src/ find all API endpoints
-/route I need to refactor the authentication module
+/model-route I need to refactor the authentication module
 /review:codebase
 ```
 

package/hooks/scripts/check-console-log.js

@@ -14,7 +14,7 @@
  */
 
 const fs = require('fs');
-const { isGitRepo, getGitModifiedFiles, readFile, log } = require('../lib/utils');
+const { isGitRepo, getGitModifiedFiles, readFile, log } = require('../../scripts/lib/utils');
 
 // Files where console.log is expected and should not trigger warnings
 const EXCLUDED_PATTERNS = [

package/hooks/scripts/discord-notify.sh

@@ -27,19 +27,16 @@ fi
 
 send_discord_embed() {
     local title="$1" description="$2" color="$3" fields="$4"
-    local payload=$(cat <<EOF
-{
-    "embeds": [{
-        "title": "$title",
-        "description": "$description",
-        "color": $color,
-        "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)",
-        "footer": {"text": "CSL • ${PROJECT_NAME}"},
-        "fields": $fields
-    }]
-}
-EOF
-)
+    # Use jq to safely construct JSON (prevents injection from unescaped variables)
+    local payload
+    payload=$(jq -n \
+        --arg title "$title" \
+        --arg desc "$description" \
+        --argjson color "$color" \
+        --arg ts "$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" \
+        --arg footer "CSL • ${PROJECT_NAME}" \
+        --argjson fields "$fields" \
+        '{embeds: [{title: $title, description: $desc, color: $color, timestamp: $ts, footer: {text: $footer}, fields: $fields}]}')
     curl -s -X POST "$DISCORD_WEBHOOK_URL" -H "Content-Type: application/json" -d "$payload" > /dev/null 2>&1
 }
 

package/hooks/scripts/post-edit-format.js

@@ -23,7 +23,7 @@ const path = require('path');
 // Shell metacharacters that cmd.exe interprets as command separators/operators
 const UNSAFE_PATH_CHARS = /[&|<>^%!]/;
 
-const { findProjectRoot, detectFormatter, resolveFormatterBin } = require('../lib/resolve-formatter');
+const { findProjectRoot, detectFormatter, resolveFormatterBin } = require('../../scripts/lib/resolve-formatter');
 
 const MAX_STDIN = 1024 * 1024; // 1MB limit
 

package/hooks/scripts/quality-gate.js

@@ -18,7 +18,7 @@ const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
 
-const { findProjectRoot, detectFormatter, resolveFormatterBin } = require('../lib/resolve-formatter');
+const { findProjectRoot, detectFormatter, resolveFormatterBin } = require('../../scripts/lib/resolve-formatter');
 
 const MAX_STDIN = 1024 * 1024;
 

package/hooks/scripts/run-with-flags.js

@@ -11,7 +11,7 @@
 const fs = require('fs');
 const path = require('path');
 const { spawnSync } = require('child_process');
-const { isHookEnabled } = require('../lib/hook-flags');
+const { isHookEnabled } = require('../../scripts/lib/hook-flags');
 
 const MAX_STDIN = 1024 * 1024;
 

package/hooks/scripts/session-end.js

@@ -23,7 +23,7 @@ const {
   runCommand,
   stripAnsi,
   log
-} = require('../lib/utils');
+} = require('../../scripts/lib/utils');
 
 const SUMMARY_START_MARKER = '<!-- SL:SUMMARY:START -->';
 const SUMMARY_END_MARKER = '<!-- SL:SUMMARY:END -->';

package/hooks/scripts/telegram-notify.sh

@@ -27,10 +27,15 @@ fi
 
 send_telegram() {
     local message="$1"
-    local escaped=$(echo "$message" | jq -Rs .)
+    # Use jq to safely construct JSON payload (prevents injection from unescaped variables)
+    local payload
+    payload=$(jq -n \
+        --arg chat_id "$TELEGRAM_CHAT_ID" \
+        --arg text "$message" \
+        '{chat_id: $chat_id, text: $text, parse_mode: "Markdown", disable_web_page_preview: true}')
     curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
         -H "Content-Type: application/json" \
-        -d "{\"chat_id\":\"${TELEGRAM_CHAT_ID}\",\"text\":${escaped},\"parse_mode\":\"Markdown\",\"disable_web_page_preview\":true}" > /dev/null
+        -d "$payload" > /dev/null
 }
 
 case "$HOOK_TYPE" in

package/hooks/telegram-hook-setup.md

@@ -2,7 +2,7 @@
 
 ## Overview
 
-The Telegram hook (`telegram_notify.sh`) automatically sends notifications when Claude Code sessions stop or subagents complete tasks. It provides detailed summaries including tool usage, files modified, and operation counts.
+The Telegram hook (`telegram-notify.sh`) automatically sends notifications when Claude Code sessions stop or subagents complete tasks. It provides detailed summaries including tool usage, files modified, and operation counts.
 
 ## Features
 
@@ -181,13 +181,13 @@ Hooks are configured in `.claude/settings.local.json`:
     "Stop": [{
       "hooks": [{
         "type": "command",
-        "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/telegram_notify.sh"
+        "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/telegram-notify.sh"
       }]
     }],
     "SubagentStop": [{
       "hooks": [{
         "type": "command",
-        "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/telegram_notify.sh"
+        "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/telegram-notify.sh"
       }]
     }]
   }
@@ -203,7 +203,7 @@ Hooks are configured in `.claude/settings.local.json`:
 ### 5. Make Script Executable
 
 ```bash
-chmod +x .claude/hooks/telegram_notify.sh
+chmod +x .claude/hooks/telegram-notify.sh
 ```
 
 ### 6. Verify Setup
@@ -220,7 +220,7 @@ echo '{
     {"tool": "Edit", "parameters": {"file_path": "test.ts"}},
     {"tool": "Bash", "parameters": {"command": "npm test"}}
   ]
-}' | ./.claude/hooks/telegram_notify.sh
+}' | ./.claude/hooks/telegram-notify.sh
 ```
 
 **Expected output:**
@@ -492,13 +492,13 @@ jq --version
 
 3. **Verify script is executable:**
    ```bash
-   ls -l .claude/hooks/telegram_notify.sh
+   ls -l .claude/hooks/telegram-notify.sh
    # Should show: -rwxr-xr-x
    ```
 
 4. **Make script executable if needed:**
    ```bash
-   chmod +x .claude/hooks/telegram_notify.sh
+   chmod +x .claude/hooks/telegram-notify.sh
    ```
 
 5. **Test hook manually (see "Verify Setup" section)**
@@ -519,7 +519,7 @@ jq --version
    - Script uses `"parse_mode": "Markdown"`
 
 2. **Check message escaping in script:**
-   - Edit `telegram_notify.sh`
+   - Edit `telegram-notify.sh`
    - Look for line: `local escaped_message=$(echo "$message" | jq -Rs .)`
    - This should properly escape for JSON
 
@@ -536,12 +536,12 @@ jq --version
 
 **Solution:**
 ```bash
-chmod +x .claude/hooks/telegram_notify.sh
+chmod +x .claude/hooks/telegram-notify.sh
 ```
 
 **Verify:**
 ```bash
-ls -l .claude/hooks/telegram_notify.sh
+ls -l .claude/hooks/telegram-notify.sh
 # Output should show: -rwxr-xr-x
 ```
 
@@ -561,7 +561,7 @@ TELEGRAM_CHAT_ID_ERROR=987654321    # Error notifications
 
 **Modified script logic:**
 ```bash
-# In telegram_notify.sh, add conditional chat ID selection
+# In telegram-notify.sh, add conditional chat ID selection
 if [[ "$HOOK_TYPE" == "Stop" ]] && [[ $TOTAL_TOOLS -gt 20 ]]; then
     # Large operations go to success channel
     TELEGRAM_CHAT_ID="${TELEGRAM_CHAT_ID_SUCCESS:-$TELEGRAM_CHAT_ID}"
@@ -572,7 +572,7 @@ fi
 
 Only send notifications for significant events:
 
-**Edit `telegram_notify.sh`:**
+**Edit `telegram-notify.sh`:**
 ```bash
 # After line 65 (TOTAL_TOOLS calculation), add:
 
@@ -604,7 +604,7 @@ fi
 
 ### Custom Message Formatting
 
-Modify notification format in `telegram_notify.sh`:
+Modify notification format in `telegram-notify.sh`:
 
 **Add Git branch info:**
 ```bash
@@ -650,7 +650,7 @@ Prevent notification spam:
 
 **Create rate limit file:**
 ```bash
-# Add to telegram_notify.sh, after line 55:
+# Add to telegram-notify.sh, after line 55:
 
 RATE_LIMIT_FILE="/tmp/telegram_notify_last_sent"
 RATE_LIMIT_SECONDS=60
@@ -690,7 +690,7 @@ echo '{
     {"tool": "Bash", "parameters": {"command": "npm test"}},
     {"tool": "TodoWrite", "parameters": {}}
   ]
-}' | ./.claude/hooks/telegram_notify.sh
+}' | ./.claude/hooks/telegram-notify.sh
 ```
 
 **SubagentStop event:**
@@ -700,7 +700,7 @@ echo '{
   "projectDir": "'"$(pwd)"'",
   "sessionId": "test-456",
   "subagentType": "planner"
-}' | ./.claude/hooks/telegram_notify.sh
+}' | ./.claude/hooks/telegram-notify.sh
 ```
 
 ## Security Best Practices
@@ -748,7 +748,7 @@ echo '{
 
 ## Reference
 
-**Script Location:** `.claude/hooks/telegram_notify.sh`
+**Script Location:** `.claude/hooks/telegram-notify.sh`
 
 **Configuration:** `.claude/config.json`
 

package/manifests/install-modules.json

@@ -22,7 +22,7 @@
     {
       "id": "skills",
       "kind": "skills",
-      "description": "All 170 skills — debugging, testing, frontend/backend, databases, security, UI/UX, patterns, languages, frameworks, and more",
+      "description": "All 161 skills — debugging, testing, frontend/backend, databases, security, UI/UX, patterns, languages, frameworks, and more",
       "paths": ["skills/"],
       "defaultInstall": true,
       "cost": "medium",
@@ -31,7 +31,7 @@
     {
       "id": "rules",
       "kind": "rules",
-      "description": "Language-specific coding rules — 13 languages (TypeScript, Python, Go, Rust, Java, Kotlin, C++, C#, PHP, Perl, Swift) + common",
+      "description": "Language-specific coding rules — 11 languages (TypeScript, Python, Go, Rust, Java, Kotlin, C++, C#, PHP, Perl, Swift) + common",
       "paths": ["rules/"],
       "defaultInstall": true,
       "cost": "light",
@@ -69,7 +69,7 @@
       "id": "hooks-essential",
       "kind": "hooks",
       "description": "Essential hooks — security, formatting, type checking, notifications",
-      "paths": ["hooks/"],
+      "paths": ["hooks/", "scripts/lib/"],
       "defaultInstall": true,
       "cost": "light",
       "stability": "stable"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-skill-lord",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Curated Claude Code plugin — 43 agents, 161 skills, 114 commands, 11 language rules",
   "author": {
     "name": "Dong Anh",
@@ -9,7 +9,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/donganhvuphp/Claude-Skills-Lord.git"
+    "url": "git+https://github.com/donganhvuphp/Claude-Skills-Lord.git"
   },
   "homepage": "https://github.com/donganhvuphp/Claude-Skills-Lord",
   "bugs": {
@@ -27,8 +27,8 @@
     "code-review"
   ],
   "bin": {
-    "csl": "./scripts/sl.js",
-    "skill-lord": "./scripts/sl.js"
+    "csl": "scripts/sl.js",
+    "skill-lord": "scripts/sl.js"
   },
   "files": [
     ".claude-plugin/",

package/scripts/install.js

@@ -54,7 +54,13 @@ if (!fs.existsSync(modulesPath)) {
   process.exit(1);
 }
 
-const modules = JSON.parse(fs.readFileSync(modulesPath, 'utf8'));
+let modules;
+try {
+  modules = JSON.parse(fs.readFileSync(modulesPath, 'utf8'));
+} catch (err) {
+  console.error(`Error: Failed to parse install-modules.json: ${err.message}`);
+  process.exit(1);
+}
 
 // Install all modules (optionally skip fonts)
 let allModules = modules.modules;

package/scripts/lib/package-manager.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+
+/**
+ * Package Manager Detection
+ *
+ * Detects which package manager (npm, yarn, pnpm, bun) the project uses
+ * by checking lock files and environment variables.
+ *
+ * Used by: resolve-formatter.js, session hooks
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * Package manager configurations
+ */
+const PM_CONFIGS = {
+  bun: {
+    name: 'bun',
+    lockFile: 'bun.lockb',
+    execCmd: 'bunx',
+    installCmd: 'bun install',
+    runCmd: 'bun run',
+  },
+  pnpm: {
+    name: 'pnpm',
+    lockFile: 'pnpm-lock.yaml',
+    execCmd: 'pnpm exec',
+    installCmd: 'pnpm install',
+    runCmd: 'pnpm run',
+  },
+  yarn: {
+    name: 'yarn',
+    lockFile: 'yarn.lock',
+    execCmd: 'yarn dlx',
+    installCmd: 'yarn install',
+    runCmd: 'yarn run',
+  },
+  npm: {
+    name: 'npm',
+    lockFile: 'package-lock.json',
+    execCmd: 'npx',
+    installCmd: 'npm install',
+    runCmd: 'npm run',
+  },
+};
+
+/**
+ * Detect which package manager a project uses.
+ *
+ * Priority:
+ * 1. CLAUDE_PACKAGE_MANAGER env variable
+ * 2. Lock file detection (bun > pnpm > yarn > npm)
+ * 3. Default to npm
+ *
+ * @param {{ projectDir?: string }} [options]
+ * @returns {{ name: string, config: object }}
+ */
+function getPackageManager(options = {}) {
+  const projectDir = options.projectDir || process.cwd();
+
+  // 1. Environment variable override
+  const envPm = process.env.CLAUDE_PACKAGE_MANAGER;
+  if (envPm && PM_CONFIGS[envPm]) {
+    return { name: envPm, config: PM_CONFIGS[envPm] };
+  }
+
+  // 2. Lock file detection (ordered by specificity)
+  for (const [name, config] of Object.entries(PM_CONFIGS)) {
+    const lockPath = path.join(projectDir, config.lockFile);
+    if (fs.existsSync(lockPath)) {
+      return { name, config };
+    }
+  }
+
+  // 3. Default to npm
+  return { name: 'npm', config: PM_CONFIGS.npm };
+}
+
+module.exports = { getPackageManager, PM_CONFIGS };

package/scripts/lib/utils.js

@@ -6,7 +6,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { execSync, spawnSync } = require('child_process');
+const { execSync } = require('child_process');
 
 // Platform detection
 const isWindows = process.platform === 'win32';
@@ -41,13 +41,6 @@ function getLearnedSkillsDir() {
   return path.join(getClaudeDir(), 'skills', 'learned');
 }
 
-/**
- * Get the temp directory (cross-platform)
- */
-function getTempDir() {
-  return os.tmpdir();
-}
-
 /**
  * Ensure a directory exists (create if not)
  * @param {string} dirPath - Directory path to create
@@ -119,20 +112,6 @@ function getSessionIdShort(fallback = 'default') {
   return getProjectName() || fallback;
 }
 
-/**
- * Get current datetime in YYYY-MM-DD HH:MM:SS format
- */
-function getDateTimeString() {
-  const now = new Date();
-  const year = now.getFullYear();
-  const month = String(now.getMonth() + 1).padStart(2, '0');
-  const day = String(now.getDate()).padStart(2, '0');
-  const hours = String(now.getHours()).padStart(2, '0');
-  const minutes = String(now.getMinutes()).padStart(2, '0');
-  const seconds = String(now.getSeconds()).padStart(2, '0');
-  return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
-}
-
 /**
  * Find files matching a pattern in a directory (cross-platform alternative to find)
  * @param {string} dir - Directory to search
@@ -296,38 +275,6 @@ function writeFile(filePath, content) {
   fs.writeFileSync(filePath, content, 'utf8');
 }
 
-/**
- * Append to a text file
- */
-function appendFile(filePath, content) {
-  ensureDir(path.dirname(filePath));
-  fs.appendFileSync(filePath, content, 'utf8');
-}
-
-/**
- * Check if a command exists in PATH
- * Uses execFileSync to prevent command injection
- */
-function commandExists(cmd) {
-  // Validate command name - only allow alphanumeric, dash, underscore, dot
-  if (!/^[a-zA-Z0-9_.-]+$/.test(cmd)) {
-    return false;
-  }
-
-  try {
-    if (isWindows) {
-      // Use spawnSync to avoid shell interpolation
-      const result = spawnSync('where', [cmd], { stdio: 'pipe' });
-      return result.status === 0;
-    } else {
-      const result = spawnSync('which', [cmd], { stdio: 'pipe' });
-      return result.status === 0;
-    }
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Run a command and return output
  *
@@ -405,65 +352,6 @@ function getGitModifiedFiles(patterns = []) {
   return files;
 }
 
-/**
- * Replace text in a file (cross-platform sed alternative)
- * @param {string} filePath - Path to the file
- * @param {string|RegExp} search - Pattern to search for. String patterns replace
- *   the FIRST occurrence only; use a RegExp with the `g` flag for global replacement.
- * @param {string} replace - Replacement string
- * @param {object} options - Options
- * @param {boolean} options.all - When true and search is a string, replaces ALL
- *   occurrences (uses String.replaceAll). Ignored for RegExp patterns.
- * @returns {boolean} true if file was written, false on error
- */
-function replaceInFile(filePath, search, replace, options = {}) {
-  const content = readFile(filePath);
-  if (content === null) return false;
-
-  try {
-    let newContent;
-    if (options.all && typeof search === 'string') {
-      newContent = content.replaceAll(search, replace);
-    } else {
-      newContent = content.replace(search, replace);
-    }
-    writeFile(filePath, newContent);
-    return true;
-  } catch (err) {
-    log(`[Utils] replaceInFile failed for ${filePath}: ${err.message}`);
-    return false;
-  }
-}
-
-/**
- * Count occurrences of a pattern in a file
- * @param {string} filePath - Path to the file
- * @param {string|RegExp} pattern - Pattern to count. Strings are treated as
- *   global regex patterns. RegExp instances are used as-is but the global
- *   flag is enforced to ensure correct counting.
- * @returns {number} Number of matches found
- */
-function countInFile(filePath, pattern) {
-  const content = readFile(filePath);
-  if (content === null) return 0;
-
-  let regex;
-  try {
-    if (pattern instanceof RegExp) {
-      // Always create new RegExp to avoid shared lastIndex state; ensure global flag
-      regex = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : pattern.flags + 'g');
-    } else if (typeof pattern === 'string') {
-      regex = new RegExp(pattern, 'g');
-    } else {
-      return 0;
-    }
-  } catch {
-    return 0; // Invalid regex pattern
-  }
-  const matches = content.match(regex);
-  return matches ? matches.length : 0;
-}
-
 /**
  * Strip all ANSI escape sequences from a string.
  *
@@ -482,39 +370,6 @@ function stripAnsi(str) {
   return str.replace(/\x1b(?:\[[0-9;?]*[A-Za-z]|\][^\x07\x1b]*(?:\x07|\x1b\\)|\([A-Z]|[A-Z])/g, '');
 }
 
-/**
- * Search for pattern in file and return matching lines with line numbers
- */
-function grepFile(filePath, pattern) {
-  const content = readFile(filePath);
-  if (content === null) return [];
-
-  let regex;
-  try {
-    if (pattern instanceof RegExp) {
-      // Always create a new RegExp without the 'g' flag to prevent lastIndex
-      // state issues when using .test() in a loop (g flag makes .test() stateful,
-      // causing alternating match/miss on consecutive matching lines)
-      const flags = pattern.flags.replace('g', '');
-      regex = new RegExp(pattern.source, flags);
-    } else {
-      regex = new RegExp(pattern);
-    }
-  } catch {
-    return []; // Invalid regex pattern
-  }
-  const lines = content.split('\n');
-  const results = [];
-
-  lines.forEach((line, index) => {
-    if (regex.test(line)) {
-      results.push({ lineNumber: index + 1, content: line });
-    }
-  });
-
-  return results;
-}
-
 module.exports = {
   // Platform info
   isWindows,
@@ -522,17 +377,14 @@ module.exports = {
   isLinux,
 
   // Directories
-  getHomeDir,
   getClaudeDir,
   getSessionsDir,
   getLearnedSkillsDir,
-  getTempDir,
   ensureDir,
 
   // Date/Time
   getDateString,
   getTimeString,
-  getDateTimeString,
 
   // Session/Project
   getSessionIdShort,
@@ -543,10 +395,6 @@ module.exports = {
   findFiles,
   readFile,
   writeFile,
-  appendFile,
-  replaceInFile,
-  countInFile,
-  grepFile,
 
   // String sanitisation
   stripAnsi,
@@ -557,7 +405,6 @@ module.exports = {
   output,
 
   // System
-  commandExists,
   runCommand,
   isGitRepo,
   getGitModifiedFiles