code-ai-installer 2.0.1 → 2.1.0

package/locales/en/.agents/skills/dependency-supply-chain-review/agents/copilot.json

@@ -1,13 +1,13 @@
 {
   "name": "dependency-supply-chain-review",
   "display_name": "Dependency & Supply Chain Review",
-  "description": "Dependency review — minimization, updates, vulnerability audit, licenses, prohibition of unsafe packages.",
+  "description": "Dependency review with mandatory socket.dev MCP check (depscore) — supply chain, vulnerability, licenses. P0 alerts block installation.",
   "default_prompt": "Use $dependency-supply-chain-review when the task matches the \"Dependency & Supply Chain Review\" skill.",
   "triggers": [
     "dependency-supply-chain-review",
     "dependency supply chain review",
     "Dependency & Supply Chain Review",
-    "Dependency review — minimization, updates, vulnerability audit, licenses, prohibition of unsafe packages"
+    "Dependency review with mandatory socket.dev MCP check (depscore) — supply chain, vulnerability, licenses. P0 alerts block installation"
   ],
   "capabilities": [
     "dependency",

package/locales/en/.agents/skills/dependency-supply-chain-review/agents/gemini.json

@@ -1,13 +1,13 @@
 {
   "name": "dependency-supply-chain-review",
   "display_name": "Dependency & Supply Chain Review",
-  "description": "Dependency review — minimization, updates, vulnerability audit, licenses, prohibition of unsafe packages.",
+  "description": "Dependency review with mandatory socket.dev MCP check (depscore) — supply chain, vulnerability, licenses. P0 alerts block installation.",
   "default_prompt": "Use $dependency-supply-chain-review when the task matches the \"Dependency & Supply Chain Review\" skill.",
   "triggers": [
     "dependency-supply-chain-review",
     "dependency supply chain review",
     "Dependency & Supply Chain Review",
-    "Dependency review — minimization, updates, vulnerability audit, licenses, prohibition of unsafe packages"
+    "Dependency review with mandatory socket.dev MCP check (depscore) — supply chain, vulnerability, licenses. P0 alerts block installation"
   ],
   "capabilities": [
     "dependency",

package/locales/en/.agents/skills/dependency-supply-chain-review/agents/openai.yaml

@@ -1,6 +1,6 @@
 interface:
   display_name: "Dependency & Supply Chain Review"
-  short_description: "Dependency review — minimization, updates, vulnerability audit, licenses, prohibition of unsafe…"
+  short_description: "Dependency review with socket.dev MCP (depscore) — supply chain, vuln, licenses. P0 blocks."
   default_prompt: "Use $dependency-supply-chain-review when the task matches the \"Dependency & Supply Chain Review\" skill."
 dependencies:
   tools: []

package/locales/en/.agents/skills/dependency-supply-chain-review/agents/qwen.json

@@ -1,13 +1,13 @@
 {
   "name": "dependency-supply-chain-review",
   "display_name": "Dependency & Supply Chain Review",
-  "description": "Dependency review — minimization, updates, vulnerability audit, licenses, prohibition of unsafe packages.",
+  "description": "Dependency review with mandatory socket.dev MCP check (depscore) — supply chain, vulnerability, licenses. P0 alerts block installation.",
   "default_prompt": "Use $dependency-supply-chain-review when the task matches the \"Dependency & Supply Chain Review\" skill.",
   "triggers": [
     "dependency-supply-chain-review",
     "dependency supply chain review",
     "Dependency & Supply Chain Review",
-    "Dependency review — minimization, updates, vulnerability audit, licenses, prohibition of unsafe packages"
+    "Dependency review with mandatory socket.dev MCP check (depscore) — supply chain, vulnerability, licenses. P0 alerts block installation"
   ],
   "capabilities": [
     "dependency",

package/locales/en/.agents/skills/dependency-supply-chain-review/agents/skill.yaml

@@ -1,13 +1,13 @@
 version: 1
 name: "dependency-supply-chain-review"
 display_name: "Dependency & Supply Chain Review"
-description: "Dependency review — minimization, updates, vulnerability audit, licenses, prohibition of unsafe packages."
+description: "Dependency review with mandatory socket.dev MCP check (depscore) — supply chain, vulnerability, licenses. P0 alerts block installation."
 default_prompt: "Use $dependency-supply-chain-review when the task matches the \"Dependency & Supply Chain Review\" skill."
 triggers:
   - "dependency-supply-chain-review"
   - "dependency supply chain review"
   - "Dependency & Supply Chain Review"
-  - "Dependency review — minimization, updates, vulnerability audit, licenses, prohibition of unsafe packages"
+  - "Dependency review with mandatory socket.dev MCP check (depscore) — supply chain, vulnerability, licenses. P0 alerts block installation"
 capabilities:
   - "dependency"
   - "supply"

package/locales/en/agents/reviewer.md

@@ -21,6 +21,7 @@ Reviewer is the “quality gate” before Tester and Release Gate.
 - API Contracts + Data Model + Threat Model baseline (if available)
 - Deployment/CI Plan + Observability Plan (if relevant)
 - PR diff / file list / branch link / CI results
+- **socket-mcp tool availability** — mandatory check before reviewing `package.json` / `package-lock.json` changes. If unavailable → degraded mode (see [`$dependency-supply-chain-review`](.agents/skills/dependency-supply-chain-review/) → section 0 Prerequisites).
 
 ---
 
@@ -30,6 +31,7 @@ Reviewer is the “quality gate” before Tester and Release Gate.
 - Before starting a review, it is **required** to read the “Important vs Not Important” section of the Architecture Doc - do not block what the architect deliberately put out of scope.
 - Git hygiene checks (commit structure, branch/commit naming, diff cosmetics) are classified as 🟡 P2 if there is no direct impact on security/data/architecture.
 - Classify git hygiene checks (commit structure, branch/commit naming, cosmetic diff issues) as ?? P2 if they do not directly affect security, data, or architecture.
+- **Supply chain via socket.dev is mandatory** for any change to `package.json` / `package-lock.json`. Run `$dependency-supply-chain-review` → `depscore` for all new/updated packages. P0 alerts (`supply_chain<0.5` / `vulnerability<0.5` / `license<0.5`) = 🔴 NO-GO until explicit user confirmation or package removal. In **degraded mode** (socket-mcp unavailable) — review is allowed, but the `Degraded` status must be recorded in the Handoff Envelope.
 
 ---
 
@@ -244,10 +246,11 @@ OPEN ITEMS: [list P1/P2 for tracking]
 ## HANDOFF (Mandatory)
 MERGE STATUS: GO ✅ / NO-GO ❌
 CONTAINER RELOAD VERIFIED: ✅ / ❌
+SOCKET.DEV MODE: Active ✅ / Degraded ⚠️ / N/A (no package.json changes)
 ```
 
 ## HANDOFF (Mandatory)
 - Every REV output must end with a completed `Handoff Envelope`.
-- Required fields: `HANDOFF TO`, `ARTIFACTS PRODUCED`, `REQUIRED INPUTS FULFILLED`, `OPEN ITEMS`, `BLOCKERS FOR NEXT PHASE`, `MERGE STATUS`, `CONTAINER RELOAD VERIFIED`.
+- Required fields: `HANDOFF TO`, `ARTIFACTS PRODUCED`, `REQUIRED INPUTS FULFILLED`, `OPEN ITEMS`, `BLOCKERS FOR NEXT PHASE`, `MERGE STATUS`, `CONTAINER RELOAD VERIFIED`, `SOCKET.DEV MODE`.
 - If `OPEN ITEMS` is not empty, include owner and due date per item.
 - Missing HANDOFF block means REV phase is `BLOCKED` and cannot move to QA/RG.

package/locales/en/agents/senior_full_stack.md

@@ -49,6 +49,7 @@ If it is explicitly stated that the project is a Wix iFrame app:
 7. **JSDoc is required** on all public functions/methods
 8. **Feedback loop** - after each slice a DEMO instruction is required
 9. **Batch tasks** - tasks are performed in batches (10–15), forming a tested vertical slice
+10. **Socket.dev pre-install gate** — before every `npm install <pkg>` / `npm update` / major version bump, mandatory call to `depscore` via socket-mcp. P0 alerts (`supply_chain<0.5` / `vulnerability<0.5` / `license<0.5`) → **hard block**: stop, escalate to user, wait for explicit confirmation. In **degraded mode** (socket-mcp unavailable) — follow the degraded protocol from [`$dependency-supply-chain-review`](.agents/skills/dependency-supply-chain-review/) → section 0.
 
 ---
 
@@ -129,6 +130,12 @@ According to Threat Model from the architect:
 - Uniform safe error format (no stack trace)
 - No secrets/PII in code and logs
 - Dependency hygiene
+- **Socket.dev pre-install check** — before every `npm install <pkg>`:
+  1. Call `depscore({ packages: [{ ecosystem: "npm", depname, version }] })` via socket-mcp
+  2. If `supply_chain < 0.5` OR `vulnerability < 0.5` OR `license < 0.5` → **STOP**, escalate to user with metrics, wait for explicit confirmation
+  3. If all metrics are OK → proceed with installation
+  4. If socket-mcp is unavailable → degraded protocol (see `$dependency-supply-chain-review` section 0)
+  5. Record metrics in DEV report for the next gate
 
 ### 6) Demo Gate
 After each `DEV-xx` provide `DEMO-xx`:
@@ -154,6 +161,7 @@ The report for the conductor contains:
 - Secrets are not in the code/logs
 - There is a DEMO instruction
 - Basic security: login validation, authorization, dependency hygiene
+- **Socket.dev depscore performed for all new/updated deps; no P0 alerts (or explicit user confirmation recorded)**
 - Production-ready: no mock functions in production scripts
 - Anti-pattern self-check: PASS
 
@@ -275,6 +283,7 @@ BLOCKERS FOR REVIEW: no / [list if available]
 ANTI-PATTERN CHECK: PASS ✅ / FAIL ❌
 JSDOC COVERAGE: X/Y
 CI STATUS: GREEN ✅ / RED ❌
+SOCKET.DEV PRE-INSTALL: Active ✅ (N packages scanned, 0 P0) / Degraded ⚠️ / N/A (no new deps)
 ```
 
 
@@ -284,5 +293,5 @@ CI STATUS: GREEN ✅ / RED ❌
 
 ## HANDOFF (Mandatory)
 - Every DEV output must end with a completed `Handoff Envelope`.
-- Required fields: `HANDOFF TO`, `ARTIFACTS PRODUCED`, `REQUIRED INPUTS FULFILLED`, `OPEN ITEMS`, `BLOCKERS FOR REVIEW`, `ANTI-PATTERN CHECK`, `JSDOC COVERAGE`, `CI STATUS`.
+- Required fields: `HANDOFF TO`, `ARTIFACTS PRODUCED`, `REQUIRED INPUTS FULFILLED`, `OPEN ITEMS`, `BLOCKERS FOR REVIEW`, `ANTI-PATTERN CHECK`, `JSDOC COVERAGE`, `CI STATUS`, `SOCKET.DEV PRE-INSTALL`.
 - If `OPEN ITEMS` is not empty, include owner and due date per item.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-ai-installer",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "Production-ready CLI to install code-ai agents and skills for multiple AI coding assistants.",
   "license": "MIT",
   "author": "Denis Harchenko",
@@ -35,7 +35,8 @@
     "dev": "tsx src/index.ts",
     "lint": "tsc --noEmit -p tsconfig.json",
     "test": "vitest run",
-    "prepack": "npm run clean && npm run build"
+    "doctor:all": "node dist/index.js doctor --target claude --domain development && node dist/index.js doctor --target claude --domain content",
+    "prepack": "npm run clean && npm run build && npm run doctor:all"
   },
   "engines": {
     "node": ">=20"