claudify-agent 0.0.0-stage → 1.0.1

package/.claude/hooks/auto-learning-review.ts

@@ -0,0 +1,195 @@
+// .cursor/hooks/auto-learning-review.ts
+// Automated weekly learning loop review - runs every 10 plans or weekly
+
+import { writeFileSync, readFileSync, existsSync } from "fs";
+import { join } from "path";
+
+const METRICS_FILE = join(process.cwd(), ".cursor/plan-metrics.json");
+const WEEKLY_REPORT_FILE = join(process.cwd(), ".cursor/weekly-learning-report.md");
+const ANTI_PATTERNS_FILE = join(process.cwd(), ".cursor/rules/anti-patterns.md");
+
+interface PlanMetrics {
+  plan_accuracy: number;
+  iteration_count: number;
+  tool_efficiency: number;
+  cost_estimate?: number;
+  anti_patterns_detected?: string[];
+  timestamp: string;
+}
+
+interface AntiPattern {
+  id: string;
+  name: string;
+  count: number;
+  lastOccurrence: string;
+  suggestion: string;
+}
+
+// Read input from stdin (hook trigger)
+const stdin = await new Promise<string>((resolve) => {
+  let data = "";
+  process.stdin.on("data", (chunk) => (data += chunk));
+  process.stdin.on("end", () => resolve(data));
+});
+
+console.error("[Auto Learning Review] Starting automated review...");
+
+// Load metrics
+if (!existsSync(METRICS_FILE)) {
+  console.error("[Auto Learning Review] No metrics file found. Run some plans first.");
+  process.exit(0);
+}
+
+const allMetrics: PlanMetrics[] = JSON.parse(readFileSync(METRICS_FILE, "utf-8"));
+const recentMetrics = allMetrics.slice(-10); // Last 10 plans
+
+if (recentMetrics.length < 3) {
+  console.error("[Auto Learning Review] Not enough data (need 3+ plans). Current:", recentMetrics.length);
+  process.exit(0);
+}
+
+// Calculate averages
+const avgAccuracy = recentMetrics.reduce((sum, m) => sum + m.plan_accuracy, 0) / recentMetrics.length;
+const avgIterations = recentMetrics.reduce((sum, m) => sum + m.iteration_count, 0) / recentMetrics.length;
+const avgEfficiency = recentMetrics.reduce((sum, m) => sum + m.tool_efficiency, 0) / recentMetrics.length;
+const totalCost = recentMetrics.reduce((sum, m) => sum + (m.cost_estimate || 0), 0);
+
+// Detect patterns
+const patternCounts: Record<string, number> = {};
+recentMetrics.forEach(m => {
+  if (m.anti_patterns_detected) {
+    m.anti_patterns_detected.forEach(pattern => {
+      patternCounts[pattern] = (patternCounts[pattern] || 0) + 1;
+    });
+  }
+});
+
+// Identify repeated patterns (3+ occurrences)
+const repeatedPatterns: AntiPattern[] = Object.entries(patternCounts)
+  .filter(([_, count]) => count >= 3)
+  .map(([name, count]) => ({
+    id: name.toLowerCase().replace(/\s+/g, '-'),
+    name,
+    count,
+    lastOccurrence: recentMetrics.find(m => m.anti_patterns_detected?.includes(name))?.timestamp || '',
+    suggestion: getSuggestionForPattern(name)
+  }));
+
+// Generate report
+const report = generateReport({
+  planCount: recentMetrics.length,
+  avgAccuracy,
+  avgIterations,
+  avgEfficiency,
+  totalCost,
+  repeatedPatterns,
+  trend: calculateTrend(recentMetrics)
+});
+
+// Write report
+writeFileSync(WEEKLY_REPORT_FILE, report, 'utf-8');
+console.error(`[Auto Learning Review] Report generated: ${WEEKLY_REPORT_FILE}`);
+
+// Auto-update rules if patterns detected
+if (repeatedPatterns.length > 0) {
+  console.error(`[Auto Learning Review] Detected ${repeatedPatterns.length} repeated patterns (3+ occurrences)`);
+  console.error("[Auto Learning Review] Review .cursor/weekly-learning-report.md for details");
+} else {
+  console.error("[Auto Learning Review] No repeated patterns detected. Great job!");
+}
+
+function getSuggestionForPattern(patternName: string): string {
+  const suggestions: Record<string, string> = {
+    "Over-Engineering": "Follow tool escalation protocol: Tier 1 (Read/Glob/Grep) → Tier 2 → Tier 3 → Tier 4",
+    "Planning Without Research": "Always run SemanticSearch before creating plans. Spend 2-3 min on research.",
+    "Repeated Execution Failures": "Add validation subagent before plan execution. Create checkpoints.",
+    "MCP Overuse": "Use MCP tools only when essential. Prefer built-in tools for simple tasks.",
+    "Skipping Validation": "Enable auto-validate hook. Run ReadLints after EVERY code change.",
+    "Context Bloat": "Keep rules under 20 lines. Use references over content."
+  };
+  return suggestions[patternName] || "Review pattern in learning-loop skill documentation.";
+}
+
+function calculateTrend(metrics: PlanMetrics[]): "improving" | "stable" | "declining" {
+  if (metrics.length < 5) return "stable";
+  
+  const firstHalf = metrics.slice(0, Math.floor(metrics.length / 2));
+  const secondHalf = metrics.slice(Math.floor(metrics.length / 2));
+  
+  const firstAvg = firstHalf.reduce((sum, m) => sum + m.plan_accuracy, 0) / firstHalf.length;
+  const secondAvg = secondHalf.reduce((sum, m) => sum + m.plan_accuracy, 0) / secondHalf.length;
+  
+  if (secondAvg > firstAvg + 5) return "improving";
+  if (secondAvg < firstAvg - 5) return "declining";
+  return "stable";
+}
+
+function generateReport(data: any): string {
+  const date = new Date().toISOString().split('T')[0];
+  
+  return `# Weekly Learning Report
+
+**Generated**: ${date}  
+**Analysis Period**: Last ${data.planCount} plans  
+**Trend**: ${data.trend.toUpperCase()}
+
+---
+
+## Performance Summary
+
+| Metric | Current | Target | Status |
+|--------|---------|--------|--------|
+| Avg Accuracy | ${data.avgAccuracy.toFixed(1)}% | >80% | ${data.avgAccuracy >= 80 ? '✅' : '⚠️'} |
+| Avg Iterations | ${data.avgIterations.toFixed(1)} | <2.0 | ${data.avgIterations < 2 ? '✅' : '⚠️'} |
+| Tool Efficiency | ${data.avgEfficiency.toFixed(1)}% | >70% | ${data.avgEfficiency >= 70 ? '✅' : '⚠️'} |
+| Total Cost | ${data.totalCost.toLocaleString()} tokens | Optimize | ${data.totalCost < 100000 ? '✅' : '⚠️'} |
+
+---
+
+## Repeated Patterns Detected (3+ Occurrences)
+
+${data.repeatedPatterns.length > 0 ? data.repeatedPatterns.map((p: AntiPattern) => `### ${p.name}
+
+**Occurrences**: ${p.count} times  
+**Last Seen**: ${p.lastOccurrence || 'Unknown'}  
+**Suggestion**: ${p.suggestion}
+
+---
+`).join('\n') : '✅ No repeated patterns detected! Great job maintaining best practices.'}
+
+## Action Items
+
+${data.repeatedPatterns.length > 0 ? `
+### Critical (Fix This Week)
+${data.repeatedPatterns.filter((p: AntiPattern) => p.count >= 5).map((p: AntiPattern) => `- [ ] ${p.name}: ${p.suggestion}`).join('\n') || '- [ ] None'}
+
+### Important (Fix Next Week)
+${data.repeatedPatterns.filter((p: AntiPattern) => p.count >= 3 && p.count < 5).map((p: AntiPattern) => `- [ ] ${p.name}: ${p.suggestion}`).join('\n') || '- [ ] None'}
+` : `
+### Continue Current Practices
+- [ ] Maintain research-first approach
+- [ ] Keep following tool escalation protocol
+- [ ] Continue automatic validation
+`}
+
+---
+
+## Trend Analysis
+
+${data.trend === 'improving' ? '📈 **Performance is IMPROVING** - Keep doing what works!' : 
+  data.trend === 'declining' ? '📉 **Performance is DECLINING** - Review recent changes and patterns.' : 
+  '➡️ **Performance is STABLE** - Look for optimization opportunities.'}
+
+---
+
+## Next Review
+
+**Scheduled**: In 10 plans or 7 days (whichever comes first)  
+**Focus Areas**: 
+${data.repeatedPatterns.length > 0 ? data.repeatedPatterns.slice(0, 3).map((p: AntiPattern) => `- ${p.name}`) : '- Continue monitoring current practices'}
+
+---
+
+*This report was automatically generated by the auto-learning-review hook*
+`;
+}

package/.claude/hooks/auto-lint-fix.ts

@@ -0,0 +1,104 @@
+import { execSync } from "child_process";
+import { readFileSync, writeFileSync, existsSync } from "fs";
+import { join } from "path";
+
+interface StopHookInput {
+  conversation_id: string;
+  status: "completed" | "aborted" | "error";
+  loop_count: number;
+}
+
+interface StopHookOutput {
+  followup_message?: string;
+}
+
+const LINT_REPORT_PATH = join(process.cwd(), ".cursor/lint-report.md");
+
+// Read input from stdin
+const stdin = await new Promise<string>((resolve) => {
+  let data = "";
+  process.stdin.on("data", (chunk) => (data += chunk));
+  process.stdin.on("end", () => resolve(data));
+});
+
+const input: StopHookInput = JSON.parse(stdin);
+
+// Only lint on completion
+if (input.status !== "completed") {
+  console.log(JSON.stringify({}));
+  process.exit(0);
+}
+
+// Check if any code changes were made (simplified check)
+// In real implementation, would track file changes in conversation
+const codeChanged = true; // Assume code changed for now
+
+if (!codeChanged) {
+  console.log(JSON.stringify({}));
+  process.exit(0);
+}
+
+// Run ESLint on changed files
+try {
+  // Try to run ESLint with auto-fix
+  console.log("Running ESLint with auto-fix...");
+  
+  let lintOutput = "";
+  let hasErrors = false;
+  let hasWarnings = false;
+  
+  try {
+    // First try auto-fix
+    lintOutput = execSync("npm run lint -- --fix", { 
+      encoding: "utf-8",
+      stdio: "pipe",
+      timeout: 60000 // 60s timeout
+    }).toString();
+  } catch (error: any) {
+    lintOutput = error.stdout?.toString() || error.stderr?.toString() || error.message;
+    hasErrors = true;
+  }
+  
+  // Check for remaining issues
+  if (lintOutput.includes("error")) {
+    hasErrors = true;
+  }
+  if (lintOutput.includes("warning")) {
+    hasWarnings = true;
+  }
+  
+  // Generate lint report
+  const timestamp = new Date().toISOString();
+  const report = `## ${timestamp}\n\n### ESLint Results\n\n${lintOutput}\n\n`;
+  
+  if (existsSync(LINT_REPORT_PATH)) {
+    writeFileSync(LINT_REPORT_PATH, report, { flag: 'a' });
+  } else {
+    writeFileSync(LINT_REPORT_PATH, `# ESLint Report\n\n${report}`);
+  }
+  
+  // Return appropriate message
+  if (hasErrors) {
+    const output: StopHookOutput = {
+      followup_message: `⚠️ ESLint found errors that couldn't be auto-fixed. Please review and fix manually.`,
+    };
+    console.log(JSON.stringify(output));
+  } else if (hasWarnings) {
+    const output: StopHookOutput = {
+      followup_message: `✅ ESLint auto-fixed issues. Some warnings remain (check ${LINT_REPORT_PATH}).`,
+    };
+    console.log(JSON.stringify(output));
+  } else {
+    const output: StopHookOutput = {
+      followup_message: `✅ ESLint passed with no issues.`,
+    };
+    console.log(JSON.stringify(output));
+  }
+  
+} catch (error: any) {
+  // ESLint not available or failed
+  const output: StopHookOutput = {
+    followup_message: `⚠️ ESLint check failed: ${error.message}. Continuing without linting.`,
+  };
+  console.log(JSON.stringify(output));
+}

package/.claude/hooks/auto-security-review.ts

@@ -0,0 +1,354 @@
+// .cursor/hooks/auto-security-review.ts
+// Automatic security vulnerability scanning for AI-generated code
+
+import { readFileSync, writeFileSync, existsSync } from "fs";
+import { join } from "path";
+
+export {};
+
+interface SecurityHookInput {
+  conversation_id: string;
+  status: "completed" | "aborted" | "error";
+  loop_count: number;
+}
+
+interface SecurityFinding {
+  severity: "critical" | "high" | "medium" | "low";
+  type: string;
+  description: string;
+  location?: string;
+  suggestion: string;
+}
+
+interface SecurityConfig {
+  enableSecurityReview?: boolean;
+  severityThreshold?: "critical" | "high" | "medium" | "low";
+  scanPatterns?: {
+    hardcodedCredentials?: boolean;
+    sqlInjection?: boolean;
+    xss?: boolean;
+    insecureCrypto?: boolean;
+    pathTraversal?: boolean;
+    commandInjection?: boolean;
+  };
+}
+
+// Security pattern definitions (OWASP Top 10 inspired)
+const SECURITY_PATTERNS = {
+  hardcodedCredentials: [
+    {
+      pattern: /(password|passwd|pwd)\s*[=:]\s*["'][^"']+["']/gi,
+      type: "Hardcoded Password",
+      severity: "critical" as const,
+      suggestion: "Use environment variables or secure secret management (e.g., AWS Secrets Manager, Azure Key Vault)"
+    },
+    {
+      pattern: /(api[_-]?key|apikey)\s*[=:]\s*["'][^"']+["']/gi,
+      type: "Hardcoded API Key",
+      severity: "critical" as const,
+      suggestion: "Store API keys in environment variables or secure vault"
+    },
+    {
+      pattern: /(secret|token|auth)\s*[=:]\s*["'][^"']+["']/gi,
+      type: "Hardcoded Secret/Token",
+      severity: "critical" as const,
+      suggestion: "Use environment variables for secrets"
+    },
+    {
+      pattern: /AWS[_A-Z]*KEY|AWS[_A-Z]*SECRET/gi,
+      type: "AWS Credentials",
+      severity: "critical" as const,
+      suggestion: "Use IAM roles or AWS Secrets Manager"
+    }
+  ],
+  sqlInjection: [
+    {
+      pattern: /(execute|query|raw)\s*\(\s*`[^`]*\$\{[^}]+\}/gi,
+      type: "Potential SQL Injection",
+      severity: "critical" as const,
+      suggestion: "Use parameterized queries or ORM methods instead of string interpolation"
+    },
+    {
+      pattern: /execute\s*\(\s*["'][^"']*["']\s*\+/gi,
+      type: "SQL String Concatenation",
+      severity: "critical" as const,
+      suggestion: "Use parameterized queries"
+    }
+  ],
+  xss: [
+    {
+      pattern: /dangerouslySetInnerHTML\s*=/gi,
+      type: "Dangerous HTML Rendering",
+      severity: "high" as const,
+      suggestion: "Avoid dangerouslySetInnerHTML or sanitize input with DOMPurify"
+    },
+    {
+      pattern: /innerHTML\s*=/gi,
+      type: "Inner HTML Assignment",
+      severity: "high" as const,
+      suggestion: "Use textContent or sanitize HTML before assignment"
+    },
+    {
+      pattern: /eval\s*\(/gi,
+      type: "Eval Usage",
+      severity: "high" as const,
+      suggestion: "Avoid eval() - use safer alternatives"
+    }
+  ],
+  insecureCrypto: [
+    {
+      pattern: /crypto\s*\.\s*createHash\s*\(\s*["']md5["']/gi,
+      type: "Weak Hash Algorithm (MD5)",
+      severity: "high" as const,
+      suggestion: "Use SHA-256 or stronger (crypto.createHash('sha256'))"
+    },
+    {
+      pattern: /crypto\s*\.\s*createHash\s*\(\s*["']sha1["']/gi,
+      type: "Weak Hash Algorithm (SHA1)",
+      severity: "medium" as const,
+      suggestion: "Use SHA-256 or stronger for security-critical applications"
+    },
+    {
+      pattern: /Math\.random\s*\(/gi,
+      type: "Insecure Random Number Generator",
+      severity: "medium" as const,
+      suggestion: "Use crypto.randomBytes() for security-sensitive randomness"
+    }
+  ],
+  pathTraversal: [
+    {
+      pattern: /fs\s*\.\s*(readFile|writeFile|appendFile)\s*\([^)]*\+/gi,
+      type: "Potential Path Traversal",
+      severity: "high" as const,
+      suggestion: "Validate and sanitize file paths, use path.resolve() and path.normalize()"
+    },
+    {
+      pattern: /require\s*\(\s*[^)]*\+/gi,
+      type: "Dynamic Require with User Input",
+      severity: "high" as const,
+      suggestion: "Avoid dynamic require with user-controlled paths"
+    }
+  ],
+  commandInjection: [
+    {
+      pattern: /exec\s*\(\s*`[^`]*\$\{[^}]+\}/gi,
+      type: "Command Injection via Template Literal",
+      severity: "critical" as const,
+      suggestion: "Avoid shell commands with user input, use execFile with arguments array"
+    },
+    {
+      pattern: /spawn\s*\(\s*[^)]*\+/gi,
+      type: "Command Injection via String Concatenation",
+      severity: "critical" as const,
+      suggestion: "Use spawn with arguments array instead of string concatenation"
+    },
+    {
+      pattern: /child_process\s*\.\s*exec\s*\(/gi,
+      type: "Unsafe exec Usage",
+      severity: "medium" as const,
+      suggestion: "Prefer execFile or spawn with argument separation"
+    }
+  ]
+};
+
+// Read input from stdin
+const stdin = await new Promise<string>((resolve) => {
+  let data = "";
+  process.stdin.on("data", (chunk) => (data += chunk));
+  process.stdin.on("end", () => resolve(data));
+});
+
+const input: SecurityHookInput = JSON.parse(stdin);
+
+// Load configuration
+const configPath = join(process.cwd(), '.cursor/hooks.config.json');
+const config: SecurityConfig = existsSync(configPath) 
+  ? JSON.parse(readFileSync(configPath, 'utf-8')) 
+  : {};
+
+const securityConfig = {
+  enableSecurityReview: (config as any).validation?.enableSecurityReview !== false,
+  severityThreshold: (config as any).validation?.securitySeverityThreshold || "high",
+  scanPatterns: (config as any).validation?.securityScanPatterns || {
+    hardcodedCredentials: true,
+    sqlInjection: true,
+    xss: true,
+    insecureCrypto: true,
+    pathTraversal: true,
+    commandInjection: true
+  }
+};
+
+// Only run on completion
+if (input.status !== "completed") {
+  console.log(JSON.stringify({}));
+  process.exit(0);
+}
+
+if (!securityConfig.enableSecurityReview) {
+  console.error("[Security Review] ⚠ Security review disabled in config");
+  console.log(JSON.stringify({}));
+  process.exit(0);
+}
+
+console.error("[Security Review] Running automatic security scan...");
+
+const findings: SecurityFinding[] = [];
+
+// Try to scan changed files
+const conversationFile = join(process.cwd(), `.cursor/conversations/${input.conversation_id}.json`);
+let conversation;
+try {
+  if (existsSync(conversationFile)) {
+    conversation = JSON.parse(readFileSync(conversationFile, 'utf-8'));
+  }
+} catch {
+  console.error("[Security Review] Could not read conversation file, proceeding with scan");
+  conversation = null;
+}
+
+// Extract code from conversation messages
+function extractCodeFromConversation(conv: any): string[] {
+  const codeBlocks: string[] = [];
+  
+  if (!conv?.messages) return codeBlocks;
+  
+  for (const message of conv.messages) {
+    if (message.content) {
+      // Extract code blocks
+      const codeBlockRegex = /```(?:typescript|javascript|tsx|ts|js)?\n([\s\S]*?)```/g;
+      let match;
+      while ((match = codeBlockRegex.exec(message.content)) !== null) {
+        codeBlocks.push(match[1]);
+      }
+    }
+  }
+  
+  return codeBlocks;
+}
+
+// Scan code for security issues
+function scanCodeForSecurity(code: string, patternCategory: string): SecurityFinding[] {
+  const categoryFindings: SecurityFinding[] = [];
+  const patterns = SECURITY_PATTERNS[patternCategory as keyof typeof SECURITY_PATTERNS];
+  
+  if (!patterns || !securityConfig.scanPatterns[patternCategory as keyof typeof securityConfig.scanPatterns]) {
+    return categoryFindings;
+  }
+  
+  for (const { pattern, type, severity, suggestion } of patterns) {
+    const matches = code.match(pattern);
+    if (matches) {
+      categoryFindings.push({
+        severity,
+        type,
+        description: `Found ${matches.length} occurrence(s) of potentially insecure pattern`,
+        suggestion
+      });
+    }
+  }
+  
+  return categoryFindings;
+}
+
+// Scan all pattern categories
+const codeToScan = conversation ? extractCodeFromConversation(conversation) : [];
+
+// If no code extracted, skip scan
+if (codeToScan.length === 0) {
+  console.error("[Security Review] ⚠ No code blocks found to scan");
+  console.log(JSON.stringify({}));
+  process.exit(0);
+}
+
+const combinedCode = codeToScan.join('\n');
+
+// Run security scans
+const patternCategories = Object.keys(SECURITY_PATTERNS);
+for (const category of patternCategories) {
+  const categoryFindings = scanCodeForSecurity(combinedCode, category);
+  findings.push(...categoryFindings);
+}
+
+// Filter by severity threshold
+const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 };
+const thresholdLevel = severityOrder[securityConfig.severityThreshold];
+
+const filteredFindings = findings.filter(
+  finding => severityOrder[finding.severity] <= thresholdLevel
+);
+
+// Generate security report
+const criticalCount = filteredFindings.filter(f => f.severity === "critical").length;
+const highCount = filteredFindings.filter(f => f.severity === "high").length;
+const mediumCount = filteredFindings.filter(f => f.severity === "medium").length;
+const lowCount = filteredFindings.filter(f => f.severity === "low").length;
+
+const reportPath = join(process.cwd(), '.cursor/security-report.md');
+
+const securityReport = `## Security Scan Report
+
+Generated: ${new Date().toISOString()}
+Conversation: ${input.conversation_id}
+Severity Threshold: ${securityConfig.severityThreshold}
+
+## Summary
+
+- 🔴 Critical: ${criticalCount}
+- 🟠 High: ${highCount}
+- 🟡 Medium: ${mediumCount}
+- 🟢 Low: ${lowCount}
+- **Total Findings**: ${filteredFindings.length}
+
+## Findings
+
+${filteredFindings.length === 0 ? '✅ No security issues found!' : filteredFindings.map((finding, i) => `
+### ${i + 1}. ${finding.type}
+
+**Severity**: ${finding.severity.toUpperCase()}
+
+**Description**: ${finding.description}
+
+**Recommendation**: ${finding.suggestion}
+
+---
+`).join('\n')}
+
+## Security Checklist (OWASP Top 10)
+
+- [ ] All user input validated and sanitized
+- [ ] SQL injection prevented (parameterized queries)
+- [ ] XSS prevented (escaping/sanitization)
+- [ ] Authentication/authorization verified
+- [ ] No hardcoded credentials or secrets
+- [ ] Error handling doesn't leak sensitive info
+- [ ] Rate limiting on auth endpoints
+- [ ] Secure random number generation used
+- [ ] Strong cryptographic algorithms used
+- [ ] File paths validated and normalized
+
+## Next Steps
+
+${criticalCount > 0 ? '🚨 CRITICAL issues found! Address immediately before deployment.' : 
+  highCount > 0 ? '⚠️ HIGH severity issues found. Review and fix before production.' :
+  mediumCount > 0 ? '📋 Medium severity issues found. Schedule for next sprint.' :
+  lowCount > 0 ? '💡 Low severity issues found. Consider fixing for best practices.' :
+  '✅ No security issues detected at current threshold.'}
+`;
+
+writeFileSync(reportPath, securityReport);
+console.error(`[Security Review] Report saved to ${reportPath}`);
+
+// Provide feedback to user
+if (criticalCount > 0 || highCount > 0) {
+  const output = {
+    followup_message: `🚨 Security scan found ${criticalCount} critical and ${highCount} high severity issues. See \`.cursor/security-report.md\` for details.`,
+  };
+  console.log(JSON.stringify(output));
+} else if (filteredFindings.length > 0) {
+  console.error(`[Security Review] ⚠️ Found ${filteredFindings.length} security finding(s). Report saved.`);
+  console.log(JSON.stringify({}));
+} else {
+  console.error("[Security Review] ✓ No security issues found");
+  console.log(JSON.stringify({}));
+}