claudify-agent 0.0.0-stage → 1.0.0

package/.claude/scripts/auto-validate.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+
+/**
+ * Multi-Language Auto-Validate Hook
+ * Supports TypeScript/JS, Go, and Solidity (Foundry/Hardhat)
+ */
+
+import { execSync } from 'child_process';
+import { existsSync } from 'fs';
+
+console.log('⚡ Running Claudify Multi-Language Verification Pipeline...\n');
+
+let hasErrors = false;
+
+function runStep(name, command) {
+  process.stdout.write(`⏳ [Check] ${name}... `);
+  try {
+    execSync(command, { stdio: 'pipe' });
+    console.log('✅ PASSED');
+    return true;
+  } catch (error) {
+    console.log('❌ FAILED');
+    console.error(`\nError Output for ${name}:\n`, error.stdout?.toString() || error.message);
+    hasErrors = true;
+    return false;
+  }
+}
+
+// 1. Golang Pipeline
+if (existsSync('go.mod')) {
+  console.log('🐹 Detected Go Project');
+  runStep('Go Vet Static Analysis', 'go vet ./...');
+  try {
+    execSync('golangci-lint --version', { stdio: 'ignore' });
+    runStep('GolangCI-Lint', 'golangci-lint run ./...');
+  } catch {
+    // Optional if not installed
+  }
+}
+
+// 2. Solidity / Smart Contract Pipeline
+if (existsSync('foundry.toml')) {
+  console.log('⛓️ Detected Foundry Smart Contract Project');
+  runStep('Foundry Build & Compilation', 'forge build');
+  runStep('Foundry Tests', 'forge test');
+} else if (existsSync('hardhat.config.js') || existsSync('hardhat.config.ts')) {
+  console.log('⛓️ Detected Hardhat Smart Contract Project');
+  runStep('Hardhat Compile', 'npx hardhat compile');
+  runStep('Hardhat Test', 'npx hardhat test');
+}
+
+// 3. Node.js / TypeScript Pipeline
+if (existsSync('package.json')) {
+  if (existsSync('eslint.config.js') || existsSync('.eslintrc.json')) {
+    runStep('ESLint Syntax & Formatting', 'npm run lint');
+  }
+  if (existsSync('tsconfig.json')) {
+    runStep('TypeScript Type Check', 'npm run typecheck');
+  }
+}
+
+console.log('\n----------------------------------------');
+if (hasErrors) {
+  console.error('❌ Verification failed. Fix issues before concluding the task.');
+  process.exit(1);
+} else {
+  console.log('🎉 All language checks passed cleanly (0 LLM tokens spent)!');
+  process.exit(0);
+}

package/.claude/scripts/security-scan.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+
+/**
+ * Security & Secret Leak Scanner
+ * Scans local workspace for hardcoded secrets before committing or sending to LLMs.
+ */
+
+import { execSync } from 'child_process';
+
+console.log('🛡️ Running Claudify Security & Secret Scanner...\n');
+
+const DANGEROUS_PATTERNS = [
+  { name: 'AWS Access Key', regex: 'AKIA[0-9A-Z]{16}' },
+  { name: 'Generic API Secret', regex: 'api_secret[\\s]*=[\\s]*["\'][a-zA-Z0-9_-]{16,}["\']' },
+  { name: 'Private Key Block', regex: '-----BEGIN [A-Z ]+ PRIVATE KEY-----' },
+  { name: 'Hardcoded Password Assignment', regex: 'password[\\s]*=[\\s]*["\'][^"\']{6,}["\']' },
+  { name: 'GitHub Personal Token', regex: 'ghp_[0-9a-zA-Z]{36}' }
+];
+
+let leakFound = false;
+
+for (const pattern of DANGEROUS_PATTERNS) {
+  try {
+    // Search in git-tracked or current files, excluding node_modules and .git
+    const grepCmd = process.platform === 'win32'
+      ? `git grep -E -I -i "${pattern.regex}" 2>$null`
+      : `git grep -E -I -i "${pattern.regex}" 2>/dev/null`;
+
+    const result = execSync(grepCmd, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }).trim();
+    if (result) {
+      console.warn(`⚠️ Potential secret detected (${pattern.name}):\n${result}\n`);
+      leakFound = true;
+    }
+  } catch (_e) {
+    // Exit code 1 means pattern not found (safe)
+  }
+}
+
+if (leakFound) {
+  console.error('❌ SECURITY ALERT: Potential secrets detected in local code! Move them to .env before continuing.');
+  process.exit(1);
+} else {
+  console.log('✅ Clean! No leaked secrets or dangerous credentials found.');
+  process.exit(0);
+}

package/.claude/security-dashboard.md

@@ -0,0 +1,142 @@
+# Security Dashboard
+
+**Last Updated**: Auto-generated after each security scan  
+**Scan Frequency**: After every code change
+
+---
+
+## Recent Scans (Last 10)
+
+| # | Timestamp | Files Changed | Vulnerabilities | Severity | Status |
+|---|-----------|---------------|-----------------|----------|--------|
+| 1 | - | - | - | - | Pending first scan |
+
+---
+
+## Vulnerability Trends
+
+### This Week
+- **Total Scans**: 0
+- **Vulnerabilities Found**: 0
+- **Critical**: 0
+- **High**: 0
+- **Medium**: 0
+- **Low**: 0
+
+### Trend Analysis
+- **Vulnerability Rate**: 0% (target: <5%)
+- **Detection Accuracy**: >80% (OWASP Top 10)
+- **False Positive Rate**: Tracking...
+
+---
+
+## Common Patterns Detected
+
+### Critical/High Severity
+1. **Hardcoded Credentials**
+   - Pattern: `password = "..."`, `api_key = '...'`
+   - Fix: Use environment variables
+   - Occurrences: 0
+
+2. **SQL Injection**
+   - Pattern: Unparameterized queries
+   - Fix: Use parameterized queries or ORM
+   - Occurrences: 0
+
+3. **XSS (Cross-Site Scripting)**
+   - Pattern: Unsanitized user input in HTML
+   - Fix: Sanitize with DOMPurify or similar
+   - Occurrences: 0
+
+4. **Insecure Crypto**
+   - Pattern: MD5, SHA1, weak algorithms
+   - Fix: Use SHA-256+, bcrypt, argon2
+   - Occurrences: 0
+
+5. **Path Traversal**
+   - Pattern: Unvalidated file paths
+   - Fix: Validate and sanitize paths
+   - Occurrences: 0
+
+6. **Command Injection**
+   - Pattern: Shell execution with user input
+   - Fix: Avoid shell, use safe APIs
+   - Occurrences: 0
+
+---
+
+## False Positive Tracking
+
+| Date | Pattern | Reason | Action Taken |
+|------|---------|--------|--------------|
+| - | - | - | - |
+
+---
+
+## Security Health Score
+
+**Current Score**: 100/100 (No vulnerabilities detected)
+
+**Calculation**:
+- Base score: 100
+- Critical vulnerabilities: -20 each
+- High vulnerabilities: -10 each
+- Medium vulnerabilities: -5 each
+- Low vulnerabilities: -2 each
+
+**Target**: >90/100
+
+---
+
+## Auto-Scan Configuration
+
+**Enabled**: ✅ Yes  
+**Trigger**: After every code change  
+**Severity Threshold**: High  
+**Scan Patterns**:
+- ✅ Hardcoded credentials
+- ✅ SQL injection
+- ✅ XSS
+- ✅ Insecure crypto
+- ✅ Path traversal
+- ✅ Command injection
+
+---
+
+## Action Items
+
+### Immediate (Critical/High found)
+- [ ] None
+
+### This Week (Medium found)
+- [ ] None
+
+### Review (Low/Info found)
+- [ ] None
+
+---
+
+## Related Documentation
+
+- `.cursor/hooks/auto-security-review.ts` - Security scan hook
+- `.cursor/rules/security-critical.md` - Security rules
+- `.cursor/hooks.config.json` - Configuration
+- `AGENT-INSTRUCTION-BEST-PRACTICES.md` - Security research (AppSec Santa findings)
+
+---
+
+## Maintenance
+
+**Weekly Review**:
+- [ ] Review false positives
+- [ ] Update scan patterns if needed
+- [ ] Check detection accuracy
+
+**Monthly Review**:
+- [ ] Analyze vulnerability trends
+- [ ] Update severity thresholds
+- [ ] Add new OWASP Top 10 patterns
+
+---
+
+*This dashboard is automatically updated by the auto-security-review hook*

package/.claude/skills/backend-concurrency/SKILL.md

@@ -0,0 +1,203 @@
+---
+name: backend-concurrency
+description: Deep dive guide for concurrency control, distributed locking, transaction isolation, race conditions, deadlocks, and idempotency in high-load backend systems.
+---
+
+# Backend Concurrency, Locking & Data Consistency Guide
+
+## Quick Start
+When architecting concurrent backend services:
+1. **Never Check-Then-Act**: Eliminate race conditions at the database level using atomic updates.
+2. **Deterministic Lock Ordering**: Always acquire locks in numeric/lexicographical order to avoid deadlocks.
+3. **Short-Lived Transactions**: Never perform external HTTP, third-party RPCs, or file I/O inside database transactions.
+4. **Idempotency by Design**: Every state-changing API or message consumer must enforce deduplication via unique keys.
+5. **Right Isolation Level**: Choose Read Committed for standard CRUD, Serializable/Pessimistic for financial ledger balance updates.
+
+---
+
+## 1. Concurrency Anomalies & Data Hazards
+
+### Lost Updates (The Classical Race Condition)
+Occurs when two concurrent transactions read the same initial state, compute a new value, and overwrite each other's changes.
+
+```
+Request A: Read Balance ($100)
+Request B: Read Balance ($100)
+Request A: Compute 100 - 40 = $60  --> Write Balance ($60)
+Request B: Compute 100 - 30 = $70  --> Write Balance ($70) (A's update lost!)
+```
+
+#### Solution 1: Single Atomic Query (Best Performance)
+```sql
+-- Safe under concurrent execution; the database engine guarantees atomic row-level serialization
+UPDATE accounts
+SET balance = balance - :amount, updated_at = NOW()
+WHERE id = :id AND balance >= :amount;
+```
+
+#### Solution 2: Optimistic Concurrency Control (OCC)
+Best for read-heavy workloads with low-to-medium contention:
+```sql
+-- 1. Read record with current version
+SELECT id, balance, version FROM accounts WHERE id = 123; -- version = 5
+
+-- 2. Update asserting the version hasn't drifted
+UPDATE accounts
+SET balance = :newBalance, version = version + 1
+WHERE id = 123 AND version = 5;
+
+-- If rows affected == 0, another request intervened. Abort or retry with exponential jitter.
+```
+
+---
+
+## 2. Pessimistic Locking & Safe Transaction Boundaries
+
+### `SELECT FOR UPDATE` Pattern
+Use when calculations are complex and cannot be expressed in a single atomic SQL statement:
+
+```typescript
+// TypeORM / NestJS Example
+await dataSource.transaction(async (manager) => {
+  // 1. Lock the row exclusively until the transaction commits
+  const account = await manager.findOne(Account, {
+    where: { id: accountId },
+    lock: { mode: 'pessimistic_write' }, // SELECT ... FOR UPDATE
+  });
+
+  if (account.balance < amount) {
+    throw new BadRequestException('Insufficient funds');
+  }
+
+  account.balance -= amount;
+  await manager.save(account);
+
+  // 2. Insert audit log within the same transaction boundary
+  await manager.insert(AuditLog, {
+    accountId,
+    amount: -amount,
+    action: 'WITHDRAWAL',
+  });
+});
+```
+
+### ⚠️ The Cardinal Sin: I/O inside Database Locks
+```typescript
+// ❌ HORRIBLE: Holding database lock during network latency
+await queryRunner.startTransaction();
+const account = await queryRunner.manager.findOne(Account, { lock: { mode: 'pessimistic_write' } });
+
+// DANGER: If Stripe takes 3 seconds, all other requests to this account (and connection pool) FREEZE!
+await stripe.charges.create({ ... }); 
+
+await queryRunner.commitTransaction();
+
+// ✅ CORRECT: Do external I/O before or after database transaction locks!
+const preAuth = await stripe.paymentIntents.create({ ... });
+await dataSource.transaction(async (manager) => {
+  // Ultra-fast DB update in milliseconds
+  await manager.update(Account, id, { ... });
+});
+```
+
+---
+
+## 3. Distributed Locking (Redis / Redlock)
+
+When concurrency spans multiple service nodes, database row locks may be insufficient (e.g., rate-limiting, preventing multiple cron workers from firing, external API quota limits).
+
+### Safe Redis Lock Pattern
+```typescript
+import { Redis } from 'ioredis';
+import { randomUUID } from 'crypto';
+
+export class DistributedLockService {
+  constructor(private readonly redis: Redis) {}
+
+  async acquireLock(resource: string, ttlMs: number): Promise<string | null> {
+    const lockToken = randomUUID();
+    // NX: Only set if not exists, PX: Millisecond expiration
+    const acquired = await this.redis.set(`lock:${resource}`, lockToken, 'PX', ttlMs, 'NX');
+    return acquired === 'OK' ? lockToken : null;
+  }
+
+  async releaseLock(resource: string, lockToken: string): Promise<boolean> {
+    // Lua script guarantees that we ONLY delete the key if value matches our token!
+    // Prevents deleting someone else's lock if ours expired due to unexpected lag.
+    const luaScript = `
+      if redis.call("get", KEYS[1]) == ARGV[1] then
+        return redis.call("del", KEYS[1])
+      else
+        return 0
+      end
+    `;
+    const result = await this.redis.eval(luaScript, 1, `lock:${resource}`, lockToken);
+    return result === 1;
+  }
+}
+```
+
+---
+
+## 4. Deadlock Prevention: Deterministic Ordering
+
+### The Problem
+- **Transaction 1:** Locks Account 1 $\rightarrow$ Attempts to lock Account 2.
+- **Transaction 2:** Locks Account 2 $\rightarrow$ Attempts to lock Account 1.
+- **Result:** Mutual deadlock. The DB engine terminates one transaction with an error.
+
+### The Solution: Global Lock Ordering
+Always sort resource identifiers prior to locking:
+
+```go
+// Go implementation for multi-account transfer
+func TransferFunds(ctx context.Context, db *sql.DB, fromID, toID int64, amount float64) error {
+    tx, err := db.BeginTx(ctx, &sql.TxOptions{Isolation: sql.LevelReadCommitted})
+    if err != nil {
+        return err
+    }
+    defer tx.Rollback()
+
+    // Deterministic Lock Ordering: always lock smaller ID first
+    firstID, secondID := fromID, toID
+    if firstID > secondID {
+        firstID, secondID = toID, fromID
+    }
+
+    // Acquire lock 1
+    if _, err := tx.ExecContext(ctx, "SELECT id FROM accounts WHERE id = $1 FOR UPDATE", firstID); err != nil {
+        return err
+    }
+    // Acquire lock 2
+    if _, err := tx.ExecContext(ctx, "SELECT id FROM accounts WHERE id = $1 FOR UPDATE", secondID); err != nil {
+        return err
+    }
+
+    // Perform balances updates safely...
+    return tx.Commit()
+}
+```
+
+---
+
+## 5. Idempotent Consumer & Deduplication
+
+For Kafka consumers, RabbitMQ listeners, and Webhook handlers:
+```
+Message Arrives --> Check Redis for MessageID
+  ├─ If Exists: Acknowledge & Ignore (Duplicate)
+  └─ If Not Exists: 
+        Set MessageID in Redis (TTL = 24h)
+        Process Business Logic
+        Ack Message
+```
+
+```sql
+-- Database Level Idempotency Ledger
+CREATE TABLE idempotency_keys (
+    key VARCHAR(255) PRIMARY KEY,
+    response_body JSONB NOT NULL,
+    status_code INT NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+);
+```