claudex-setup 1.7.0 → 1.9.0

package/src/setup.js

@@ -1,6 +1,6 @@
 /**
  * Setup engine - applies recommended Claude Code configuration to a project.
- * v1.7.0 - Starter-safe setup engine with reusable planning primitives.
+ * v1.8.0 - Starter-safe setup engine with reusable planning primitives.
  */
 
 const fs = require('fs');
@@ -8,6 +8,7 @@ const path = require('path');
 const { TECHNIQUES, STACKS } = require('./techniques');
 const { ProjectContext } = require('./context');
 const { audit } = require('./audit');
+const { buildSettingsForProfile } = require('./governance');
 
 // ============================================================
 // Helper: detect project scripts from package.json
@@ -826,6 +827,19 @@ mkdir -p "$LOG_DIR"
 TIMESTAMP=$(date +"%Y-%m-%d %H:%M:%S")
 echo "[$TIMESTAMP] $TOOL_NAME: $FILE_PATH" >> "$LOG_FILE"
 
+exit 0
+`,
+    'session-start.sh': `#!/bin/bash
+# SessionStart hook - prepares logs and records session entry
+
+LOG_DIR=".claude/logs"
+LOG_FILE="$LOG_DIR/sessions.log"
+
+mkdir -p "$LOG_DIR"
+
+TIMESTAMP=$(date +"%Y-%m-%d %H:%M:%S")
+echo "[$TIMESTAMP] session started" >> "$LOG_FILE"
+
 exit 0
 `,
   }),
@@ -877,6 +891,15 @@ exit 0
 1. Run \`git diff\` to see all changes
 2. Check for: bugs, security issues, missing tests, code style
 3. Provide actionable feedback
+`;
+
+    cmds['security-review.md'] = `Run a focused security review using Claude Code's built-in security workflow.
+
+## Steps:
+1. Review auth, permissions, secrets handling, and data access paths
+2. Run \`/security-review\` for OWASP-focused analysis
+3. Check for unsafe shell commands, token leakage, and risky file access
+4. Report findings ordered by severity with concrete fixes
 `;
 
     // Deploy - stack-specific
@@ -980,6 +1003,17 @@ Fix the GitHub issue: $ARGUMENTS
 3. Implement the fix
 4. Write tests
 5. Create a descriptive commit
+`,
+    'release-check/SKILL.md': `---
+name: release-check
+description: Prepare a release candidate and verify publish readiness
+---
+Prepare a release candidate for: $ARGUMENTS
+
+1. Read CHANGELOG.md and package.json version
+2. Run the test suite and packaging checks
+3. Verify docs, tags, and release notes are aligned
+4. Flag anything that would make the release unsafe or misleading
 `,
   }),
 
@@ -1027,6 +1061,12 @@ Fix the GitHub issue: $ARGUMENTS
 - Never skip or disable tests without a tracking issue
 - Mock external dependencies, not internal logic
 - Include both happy path and edge case tests
+`;
+    rules['repository.md'] = `When changing release, packaging, or workflow files:
+- Keep package.json, CHANGELOG.md, README.md, and docs in sync
+- Prefer tagged release references over floating branch references in public docs
+- Preserve backward compatibility in CLI flags where practical
+- Any automation that writes files must document rollback expectations
 `;
     return rules;
   },
@@ -1037,12 +1077,26 @@ name: security-reviewer
 description: Reviews code for security vulnerabilities
 tools: [Read, Grep, Glob]
 model: sonnet
+maxTurns: 50
 ---
 Review code for security issues:
 - Injection vulnerabilities (SQL, XSS, command injection)
 - Authentication and authorization flaws
 - Secrets or credentials in code
 - Insecure data handling
+`,
+    'release-manager.md': `---
+name: release-manager
+description: Checks release readiness and packaging consistency
+tools: [Read, Grep, Glob]
+model: sonnet
+maxTurns: 50
+---
+Review release readiness:
+- version alignment across package.json, changelog, and docs
+- publish safety and packaging scope
+- missing rollback or migration notes
+- documentation drift that would confuse adopters
 `,
   }),
 
@@ -1164,41 +1218,11 @@ async function setup(options) {
   if (fs.existsSync(hooksDir) && !fs.existsSync(settingsPath)) {
     const hookFiles = fs.readdirSync(hooksDir).filter(f => f.endsWith('.sh'));
     if (hookFiles.length > 0) {
-      const settings = {
-        permissions: {
-          defaultMode: "acceptEdits",
-          deny: [
-            "Read(./.env*)",
-            "Read(./secrets/**)",
-            "Bash(rm -rf *)",
-            "Bash(git reset --hard *)",
-            "Bash(git checkout -- *)",
-            "Bash(git clean *)",
-            "Bash(git push --force *)"
-          ]
-        },
-        hooks: {
-          PostToolUse: [{
-            matcher: "Write|Edit",
-            hooks: hookFiles.filter(f => f !== 'protect-secrets.sh').map(f => ({
-              type: "command",
-              command: `bash .claude/hooks/${f}`,
-              timeout: 10
-            }))
-          }]
-        }
-      };
-      // Add protect-secrets as PreToolUse if it exists
-      if (hookFiles.includes('protect-secrets.sh')) {
-        settings.hooks.PreToolUse = [{
-          matcher: "Read|Write|Edit",
-          hooks: [{
-            type: "command",
-            command: "bash .claude/hooks/protect-secrets.sh",
-            timeout: 5
-          }]
-        }];
-      }
+      const settings = buildSettingsForProfile({
+        profileKey: options.profile || 'safe-write',
+        hookFiles,
+        mcpPackKeys: options.mcpPacks || [],
+      });
       fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), 'utf8');
       writtenFiles.push('.claude/settings.json');
       log(`  \x1b[32m✅\x1b[0m Created .claude/settings.json (hooks registered)`);

package/src/techniques.js

@@ -4,6 +4,12 @@
  * Each technique includes: what to check, how to fix, impact level.
  */
 
+function hasFrontendSignals(ctx) {
+  const pkg = ctx.fileContent('package.json') || '';
+  return /react|vue|angular|next|svelte|tailwind|vite|astro/i.test(pkg) ||
+    ctx.files.some(f => /tailwind\.config|vite\.config|next\.config|svelte\.config|nuxt\.config|pages\/|components\/|app\//i.test(f));
+}
+
 const TECHNIQUES = {
   // ============================================================
   // === MEMORY & CONTEXT (category: 'memory') ==================
@@ -142,8 +148,13 @@ const TECHNIQUES = {
     name: '.claude/ tracked in git',
     check: (ctx) => {
       if (!ctx.fileContent('.gitignore')) return true; // no gitignore = ok
-      const content = ctx.fileContent('.gitignore');
-      return !content.includes('.claude/') || content.includes('!.claude/');
+      const lines = ctx.fileContent('.gitignore')
+        .split(/\r?\n/)
+        .map(line => line.trim())
+        .filter(line => line && !line.startsWith('#'));
+      const ignoresClaudeDir = lines.some(line => /^(\/|\*\*\/)?\.claude\/?$/.test(line));
+      const unignoresClaudeDir = lines.some(line => /^!(\/)?\.claude(\/|\*\*)?$/.test(line));
+      return !ignoresClaudeDir || unignoresClaudeDir;
     },
     impact: 'high',
     rating: 4,
@@ -318,7 +329,7 @@ const TECHNIQUES = {
     name: 'Permission configuration',
     check: (ctx) => {
       const settings = ctx.jsonFile('.claude/settings.local.json') || ctx.jsonFile('.claude/settings.json');
-      return settings && settings.permissions;
+      return !!(settings && settings.permissions);
     },
     impact: 'medium',
     rating: 4,
@@ -347,9 +358,15 @@ const TECHNIQUES = {
     id: 2402,
     name: 'Default mode is not bypassPermissions',
     check: (ctx) => {
-      const settings = ctx.jsonFile('.claude/settings.local.json') || ctx.jsonFile('.claude/settings.json');
-      if (!settings || !settings.permissions) return null; // no settings = skip (not applicable)
-      return settings.permissions.defaultMode !== 'bypassPermissions';
+      // Check shared settings first (committed to git) — if the shared baseline
+      // is safe, a personal settings.local.json override should not fail the audit.
+      const shared = ctx.jsonFile('.claude/settings.json');
+      if (shared && shared.permissions) {
+        return shared.permissions.defaultMode !== 'bypassPermissions';
+      }
+      const local = ctx.jsonFile('.claude/settings.local.json');
+      if (!local || !local.permissions) return null;
+      return local.permissions.defaultMode !== 'bypassPermissions';
     },
     impact: 'critical',
     rating: 5,
@@ -362,7 +379,8 @@ const TECHNIQUES = {
     id: 1096,
     name: 'Secrets protection configured',
     check: (ctx) => {
-      const settings = ctx.jsonFile('.claude/settings.local.json') || ctx.jsonFile('.claude/settings.json');
+      // Prefer shared settings.json (committed) over local override
+      const settings = ctx.jsonFile('.claude/settings.json') || ctx.jsonFile('.claude/settings.local.json');
       if (!settings || !settings.permissions) return false;
       const deny = JSON.stringify(settings.permissions.deny || []);
       return deny.includes('.env') || deny.includes('secrets');
@@ -471,6 +489,7 @@ const TECHNIQUES = {
     id: 1025,
     name: 'Frontend design skill for anti-AI-slop',
     check: (ctx) => {
+      if (!hasFrontendSignals(ctx)) return null;
       const md = ctx.fileContent('CLAUDE.md') || '';
       return md.includes('frontend_aesthetics') || md.includes('anti-AI-slop') || md.includes('frontend-design');
     },
@@ -485,6 +504,7 @@ const TECHNIQUES = {
     id: 102501,
     name: 'Tailwind CSS configured',
     check: (ctx) => {
+      if (!hasFrontendSignals(ctx)) return null;
       const pkg = ctx.fileContent('package.json') || '';
       return pkg.includes('tailwind') ||
         ctx.files.some(f => /tailwind\.config/.test(f));
@@ -613,7 +633,7 @@ const TECHNIQUES = {
       if (!hasNodeSignals) return null;
       if (ctx.files.includes('.nvmrc') || ctx.files.includes('.node-version')) return true;
       const pkg = ctx.jsonFile('package.json');
-      return pkg && pkg.engines && pkg.engines.node;
+      return !!(pkg && pkg.engines && pkg.engines.node);
     },
     impact: 'low',
     rating: 3,
@@ -663,7 +683,7 @@ const TECHNIQUES = {
     name: 'MCP servers configured',
     check: (ctx) => {
       const settings = ctx.jsonFile('.claude/settings.local.json') || ctx.jsonFile('.claude/settings.json');
-      return settings && settings.mcpServers && Object.keys(settings.mcpServers).length > 0;
+      return !!(settings && settings.mcpServers && Object.keys(settings.mcpServers).length > 0);
     },
     impact: 'medium',
     rating: 3,
@@ -677,7 +697,7 @@ const TECHNIQUES = {
     name: '2+ MCP servers for rich tooling',
     check: (ctx) => {
       const settings = ctx.jsonFile('.claude/settings.local.json') || ctx.jsonFile('.claude/settings.json');
-      return settings && settings.mcpServers && Object.keys(settings.mcpServers).length >= 2;
+      return !!(settings && settings.mcpServers && Object.keys(settings.mcpServers).length >= 2);
     },
     impact: 'medium',
     rating: 4,