claudify-agent 1.0.1 → 1.0.3

package/.claude/rules/tool-auto-selection.md

@@ -1,45 +1,45 @@
-# Tool Auto-Selection
-
-## Tool Cost Hierarchy (Start Cheap, Escalate)
-
-**Tier 1 (Cheapest)**: Read, Glob, Grep, Shell  
-**Tier 2 (Moderate)**: SemanticSearch, StrReplace, Write  
-**Tier 3 (Higher)**: Task, ReadLints  
-**Tier 4 (Most Expensive)**: Parallel subagents, Browser MCP
-
-## Automatic Triggers
-
-### After Code Changes
-- After StrReplace/Write → ReadLints (automatic)
-- After substantive changes → Shell (tests)
-
-### For Exploration
-- Know path? → Read  
-- Pattern? → Glob + Read  
-- Exact text? → Grep  
-- Concept? → SemanticSearch  
-- Broad? → Task (explore)
-
-### For Implementation
-- New file? → Write  
-- <50 lines? → StrReplace  
-- >50 lines? → Write (entire file)
-
-### For Complex Tasks
-- >10 steps or >5 files → Launch 3-4 parallel subagents
-
-## Rules
-
-1. Always start with Tier 1, escalate only if needed
-2. Never skip tiers unless justified
-3. Run ReadLints after EVERY code change
-4. Use parallel subagents for broad exploration (>3 files)
-
-## Decision Trees
-See `.cursor/skills/tool-selection/SKILL.md` for complete decision trees and patterns.
-
-## Anti-Patterns to Avoid
-- ❌ Tool hoarding (using 5 tools when 1 works)
-- ❌ Using expensive tools for simple tasks
-- ❌ Skipping validation after edits
-- ❌ No checkpoints for risky changes
+# Tool Auto-Selection
+
+## Tool Cost Hierarchy (Start Cheap, Escalate)
+
+**Tier 1 (Cheapest)**: Read, Glob, Grep, Bash  
+**Tier 2 (Moderate)**: Explore (quick), Edit, Write  
+**Tier 3 (Higher)**: Agent, Lint check  
+**Tier 4 (Most Expensive)**: Parallel subagents, Browser MCP
+
+## Automatic Triggers
+
+### After Code Changes
+- After Edit/Write → Lint check (automatic)
+- After substantive changes → Bash (tests)
+
+### For Exploration
+- Know path? → Read  
+- Pattern? → Glob + Read  
+- Exact text? → Grep  
+- Concept? → Explore (quick)  
+- Broad? → Agent (Explore)
+
+### For Implementation
+- New file? → Write  
+- <50 lines? → Edit  
+- >50 lines? → Write (entire file)
+
+### For Complex Tasks
+- >10 steps or >5 files → Launch 3-4 parallel subagents
+
+## Rules
+
+1. Always start with Tier 1, escalate only if needed
+2. Never skip tiers unless justified
+3. Run Lint check after EVERY code change
+4. Use parallel subagents for broad exploration (>3 files)
+
+## Decision Trees
+See `.claude/skills/tool-selection/SKILL.md` for complete decision trees and patterns.
+
+## Anti-Patterns to Avoid
+- ❌ Tool hoarding (using 5 tools when 1 works)
+- ❌ Using expensive tools for simple tasks
+- ❌ Skipping validation after edits
+- ❌ No checkpoints for risky changes

package/.claude/rules/tool-strategy.md

@@ -1,22 +1,22 @@
-# Tool Selection Strategy
-
-## Cost Hierarchy (Start Cheap)
-Tier 1: Read, Glob, Grep (fastest)
-Tier 2: SemanticSearch, StrReplace, Write
-Tier 3: Task, Shell, ReadLints
-Tier 4: Parallel subagents, Browser MCP
-
-## Automatic Triggers
-- After edits → ReadLints automatically
-- After substantive changes → Shell (tests)
-- Ambiguous requirements → AskQuestion (batch)
-- Complex exploration → Task (parallel subagents)
-
-## MCP Servers
-- cursor-ide-browser: UI changes, visual verification
-- user-github: PR/issue operations
-- user-ESLint: Code quality checks
-- user-context7: Library documentation
-
-## Pattern
-Follow tool selection examples in @.cursor/skills/tool-selection/SKILL.md
+# Tool Selection Strategy
+
+## Cost Hierarchy (Start Cheap)
+Tier 1: Read, Glob, Grep (fastest)
+Tier 2: Explore (quick), Edit, Write
+Tier 3: Agent, Bash, Lint check
+Tier 4: Parallel subagents, Browser MCP
+
+## Automatic Triggers
+- After edits → Lint check automatically
+- After substantive changes → Bash (tests)
+- Ambiguous requirements → AskUserQuestion (batch)
+- Complex exploration → Agent (parallel subagents)
+
+## MCP Servers
+- claude-in-chrome: UI changes, visual verification
+- github: PR/issue operations
+- eslint: Code quality checks
+- context7: Library documentation
+
+## Pattern
+Follow tool selection examples in @.claude/skills/tool-selection/SKILL.md

package/.claude/scripts/security-scan.js

@@ -31,7 +31,7 @@ for (const pattern of DANGEROUS_PATTERNS) {
       console.warn(`⚠️ Potential secret detected (${pattern.name}):\n${result}\n`);
       leakFound = true;
     }
-  } catch (_e) {
+  } catch {
     // Exit code 1 means pattern not found (safe)
   }
 }

package/.claude/security-dashboard.md

@@ -1,142 +1,142 @@
-# Security Dashboard
-
-**Last Updated**: Auto-generated after each security scan  
-**Scan Frequency**: After every code change
-
----
-
-## Recent Scans (Last 10)
-
-| # | Timestamp | Files Changed | Vulnerabilities | Severity | Status |
-|---|-----------|---------------|-----------------|----------|--------|
-| 1 | - | - | - | - | Pending first scan |
-
----
-
-## Vulnerability Trends
-
-### This Week
-- **Total Scans**: 0
-- **Vulnerabilities Found**: 0
-- **Critical**: 0
-- **High**: 0
-- **Medium**: 0
-- **Low**: 0
-
-### Trend Analysis
-- **Vulnerability Rate**: 0% (target: <5%)
-- **Detection Accuracy**: >80% (OWASP Top 10)
-- **False Positive Rate**: Tracking...
-
----
-
-## Common Patterns Detected
-
-### Critical/High Severity
-1. **Hardcoded Credentials**
-   - Pattern: `password = "..."`, `api_key = '...'`
-   - Fix: Use environment variables
-   - Occurrences: 0
-
-2. **SQL Injection**
-   - Pattern: Unparameterized queries
-   - Fix: Use parameterized queries or ORM
-   - Occurrences: 0
-
-3. **XSS (Cross-Site Scripting)**
-   - Pattern: Unsanitized user input in HTML
-   - Fix: Sanitize with DOMPurify or similar
-   - Occurrences: 0
-
-4. **Insecure Crypto**
-   - Pattern: MD5, SHA1, weak algorithms
-   - Fix: Use SHA-256+, bcrypt, argon2
-   - Occurrences: 0
-
-5. **Path Traversal**
-   - Pattern: Unvalidated file paths
-   - Fix: Validate and sanitize paths
-   - Occurrences: 0
-
-6. **Command Injection**
-   - Pattern: Shell execution with user input
-   - Fix: Avoid shell, use safe APIs
-   - Occurrences: 0
-
----
-
-## False Positive Tracking
-
-| Date | Pattern | Reason | Action Taken |
-|------|---------|--------|--------------|
-| - | - | - | - |
-
----
-
-## Security Health Score
-
-**Current Score**: 100/100 (No vulnerabilities detected)
-
-**Calculation**:
-- Base score: 100
-- Critical vulnerabilities: -20 each
-- High vulnerabilities: -10 each
-- Medium vulnerabilities: -5 each
-- Low vulnerabilities: -2 each
-
-**Target**: >90/100
-
----
-
-## Auto-Scan Configuration
-
-**Enabled**: ✅ Yes  
-**Trigger**: After every code change  
-**Severity Threshold**: High  
-**Scan Patterns**:
-- ✅ Hardcoded credentials
-- ✅ SQL injection
-- ✅ XSS
-- ✅ Insecure crypto
-- ✅ Path traversal
-- ✅ Command injection
-
----
-
-## Action Items
-
-### Immediate (Critical/High found)
-- [ ] None
-
-### This Week (Medium found)
-- [ ] None
-
-### Review (Low/Info found)
-- [ ] None
-
----
-
-## Related Documentation
-
-- `.cursor/hooks/auto-security-review.ts` - Security scan hook
-- `.cursor/rules/security-critical.md` - Security rules
-- `.cursor/hooks.config.json` - Configuration
-- `AGENT-INSTRUCTION-BEST-PRACTICES.md` - Security research (AppSec Santa findings)
-
----
-
-## Maintenance
-
-**Weekly Review**:
-- [ ] Review false positives
-- [ ] Update scan patterns if needed
-- [ ] Check detection accuracy
-
-**Monthly Review**:
-- [ ] Analyze vulnerability trends
-- [ ] Update severity thresholds
-- [ ] Add new OWASP Top 10 patterns
-
----
-
-*This dashboard is automatically updated by the auto-security-review hook*
+# Security Dashboard
+
+**Last Updated**: Auto-generated after each security scan  
+**Scan Frequency**: After every code change
+
+---
+
+## Recent Scans (Last 10)
+
+| # | Timestamp | Files Changed | Vulnerabilities | Severity | Status |
+|---|-----------|---------------|-----------------|----------|--------|
+| 1 | - | - | - | - | Pending first scan |
+
+---
+
+## Vulnerability Trends
+
+### This Week
+- **Total Scans**: 0
+- **Vulnerabilities Found**: 0
+- **Critical**: 0
+- **High**: 0
+- **Medium**: 0
+- **Low**: 0
+
+### Trend Analysis
+- **Vulnerability Rate**: 0% (target: <5%)
+- **Detection Accuracy**: >80% (OWASP Top 10)
+- **False Positive Rate**: Tracking...
+
+---
+
+## Common Patterns Detected
+
+### Critical/High Severity
+1. **Hardcoded Credentials**
+   - Pattern: `password = "..."`, `api_key = '...'`
+   - Fix: Use environment variables
+   - Occurrences: 0
+
+2. **SQL Injection**
+   - Pattern: Unparameterized queries
+   - Fix: Use parameterized queries or ORM
+   - Occurrences: 0
+
+3. **XSS (Cross-Site Scripting)**
+   - Pattern: Unsanitized user input in HTML
+   - Fix: Sanitize with DOMPurify or similar
+   - Occurrences: 0
+
+4. **Insecure Crypto**
+   - Pattern: MD5, SHA1, weak algorithms
+   - Fix: Use SHA-256+, bcrypt, argon2
+   - Occurrences: 0
+
+5. **Path Traversal**
+   - Pattern: Unvalidated file paths
+   - Fix: Validate and sanitize paths
+   - Occurrences: 0
+
+6. **Command Injection**
+   - Pattern: Shell execution with user input
+   - Fix: Avoid shell, use safe APIs
+   - Occurrences: 0
+
+---
+
+## False Positive Tracking
+
+| Date | Pattern | Reason | Action Taken |
+|------|---------|--------|--------------|
+| - | - | - | - |
+
+---
+
+## Security Health Score
+
+**Current Score**: 100/100 (No vulnerabilities detected)
+
+**Calculation**:
+- Base score: 100
+- Critical vulnerabilities: -20 each
+- High vulnerabilities: -10 each
+- Medium vulnerabilities: -5 each
+- Low vulnerabilities: -2 each
+
+**Target**: >90/100
+
+---
+
+## Auto-Scan Configuration
+
+**Enabled**: ✅ Yes  
+**Trigger**: After every code change  
+**Severity Threshold**: High  
+**Scan Patterns**:
+- ✅ Hardcoded credentials
+- ✅ SQL injection
+- ✅ XSS
+- ✅ Insecure crypto
+- ✅ Path traversal
+- ✅ Command injection
+
+---
+
+## Action Items
+
+### Immediate (Critical/High found)
+- [ ] None
+
+### This Week (Medium found)
+- [ ] None
+
+### Review (Low/Info found)
+- [ ] None
+
+---
+
+## Related Documentation
+
+- `.claude/hooks/auto-security-review.ts` - Security scan hook
+- `.claude/rules/security-critical.md` - Security rules
+- `.claude/hooks.config.json` - Configuration
+- `AGENT-INSTRUCTION-BEST-PRACTICES.md` - Security research (AppSec Santa findings)
+
+---
+
+## Maintenance
+
+**Weekly Review**:
+- [ ] Review false positives
+- [ ] Update scan patterns if needed
+- [ ] Check detection accuracy
+
+**Monthly Review**:
+- [ ] Analyze vulnerability trends
+- [ ] Update severity thresholds
+- [ ] Add new OWASP Top 10 patterns
+
+---
+
+*This dashboard is automatically updated by the auto-security-review hook*

package/.claude/settings.json

@@ -0,0 +1,50 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y tsx \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-lint-fix.ts\"",
+            "timeout": 90
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y tsx \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-validate.ts\"",
+            "timeout": 300
+          },
+          {
+            "type": "command",
+            "command": "npx -y tsx \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-security-review.ts\"",
+            "timeout": 60
+          },
+          {
+            "type": "command",
+            "command": "npx -y tsx \"$CLAUDE_PROJECT_DIR/.claude/hooks/plan-quality-tracker.ts\"",
+            "timeout": 60
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "matcher": "startup",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "npx -y tsx \"$CLAUDE_PROJECT_DIR/.claude/hooks/auto-learning-review.ts\"",
+            "timeout": 60
+          }
+        ]
+      }
+    ]
+  }
+}