codeninja 3.1.0 → 4.0.0

package/README.md

@@ -16,10 +16,11 @@ npx codeninja init
 Auto-detects your IDE. Force a specific one with `--ide`:
 
 ```bash
+npx codeninja init --ide=claude-code   # Claude Code
 npx codeninja init --ide=antigravity   # Google Antigravity IDE
 npx codeninja init --ide=cursor        # Cursor
 npx codeninja init --ide=vscode        # VS Code + GitHub Copilot
-npx codeninja init --ide=all           # All three
+npx codeninja init --ide=all           # All four
 ```
 
 ---
@@ -154,6 +155,17 @@ Add to your Claude Desktop config:
 
 ---
 
+## What is new in v4.0
+
+- **Multi-agent architecture** — True parallel sub-agents in Claude Code and Antigravity. Orchestrator spawns `nodejs-agent` and `database-agent` simultaneously during `/codeninja:init`
+- **Claude Code support** — Full `.claude/` integration: `CLAUDE.md` orchestrator, 20 slash commands, 3 dedicated sub-agents
+- **TypeScript support** — NodeJS services can now be scaffolded in TypeScript. All generated files support both JS and TS
+- **Prisma ORM** — Optional Prisma support for PostgreSQL, MySQL, and MongoDB alongside the existing raw driver path
+- **Password hashing** — Replaced reversible AES encryption of passwords with bcrypt/argon2 hashing via `utilities/hashing.js`
+- **5 missing task files** — Fixed workflow references to previously missing tasks
+
+---
+
 ## What is new in v3.0
 
 - **IDE-aware installer** — detects Antigravity, Cursor, or VS Code automatically

package/agent/database-agent.md

@@ -296,7 +296,11 @@ Tables that NEVER receive seed data in the table file:
 
 Seed data rules:
 - Seed INSERT always comes AFTER the GRANT line
-- Passwords in seed data must be pre-encrypted/hashed — never plaintext
+- Passwords in seed data MUST be pre-hashed using bcrypt (salt rounds 12+). Never store
+  plaintext passwords. Never store AES-encrypted passwords (reversible — security risk).
+  When the user needs to seed a password value, show this instruction:
+  "Generate a bcrypt hash first: node -e \"require('bcryptjs').hash('yourpassword', 12).then(console.log)\""
+  The agent never generates a hash value — the developer provides it.
 - Use multi-row INSERT (single INSERT with multiple value tuples) for efficiency
 
 ---
@@ -439,6 +443,25 @@ echo "Database reset complete."
 
 ---
 
+## Prisma Schema Generation (orm == "prisma" only)
+
+When `context.db.orm == "prisma"`, the `@db:create-table` command generates BOTH:
+1. The SQL migration file (always — source of truth for DBA review and version control)
+2. A Prisma model block appended to `prisma/schema.prisma`
+
+### SQL table → Prisma model mapping rules:
+- `tbl_users` → `model Users` (strip `tbl_`, PascalCase)
+- `id` BIGINT IDENTITY → `id BigInt @id @default(autoincrement())`
+- `created_at TIMESTAMPTZ` → `createdAt DateTime @default(now()) @map("created_at")`
+- `updated_at TIMESTAMPTZ` → `updatedAt DateTime? @updatedAt @map("updated_at")`
+- `is_deleted BOOLEAN` → `isDeleted Boolean @default(false) @map("is_deleted")`
+- FK `user_id BIGINT` → `userId BigInt @map("user_id")` + relation field pointing to Users
+- Always add `@@map("tbl_users")` at the end of every model (maps Prisma name to actual table)
+
+After appending to schema.prisma → always tell user: `npx prisma generate`
+
+---
+
 ## ══════════════════════════════════════
 ## SUPPORTED COMMANDS
 ## ══════════════════════════════════════

package/agent/nodejs-agent.md

@@ -230,6 +230,85 @@ Both use AES-256-CBC with KEY (32 chars) and IV (16 chars) from .env.
 
 ---
 
+## Password Hashing Utility
+
+`utilities/hashing.js` (or `.ts`) is the ONLY file that handles password hashing.
+Never use `utilities/encryption.js` for passwords — encryption is reversible.
+
+| Library | When used | Notes |
+|---|---|---|
+| `bcryptjs` | Fast init (default) + most deployments | Pure JS, no native build tools required |
+| `argon2` | Manual init, user preference | Stronger algorithm, requires native build tools |
+
+**Usage in model files (JavaScript):**
+```javascript
+const { hashPassword, verifyPassword } = require('../../utilities/hashing');
+// Register: const hash = await hashPassword(plainText)
+// Login:    const ok = await verifyPassword(plainText, storedHash)
+```
+
+**Usage in model files (TypeScript):**
+```typescript
+import { hashPassword, verifyPassword } from '../../utilities/hashing';
+```
+
+Wave 1 generation: `generate-hashing` runs in Wave 1 alongside `generate-encryption`.
+Both are independent foundation utilities with no dependencies on each other.
+
+---
+
+## ORM / Database Access
+
+Read `context.db.orm`:
+
+| `orm` value | Config file | Query style |
+|---|---|---|
+| `"none"` | `config/database.js` or `.ts` — pg/mysql2/mongoose Pool | Parameterized SQL: `$1`, `$2` placeholders |
+| `"prisma"` | `config/prisma.js` or `.ts` — PrismaClient singleton | Prisma Client API methods |
+
+**Prisma rules (when orm == "prisma"):**
+- NEVER instantiate `new PrismaClient()` in model files — always import from `config/prisma`
+- Accessor naming: `tbl_users` → `prisma.users` (lowercase, no `tbl_` prefix)
+- Always use `select` — never return all columns
+- After generating `prisma/schema.prisma` → tell user to run `npx prisma generate`
+- After `@db:create-table` with Prisma → append model block to schema.prisma AND run `npx prisma generate`
+
+---
+
+## TypeScript Support
+
+Read `context.services[name].language` (or `context.current_init.language`).
+
+### When `language == "typescript"`:
+- All generated service files use `.ts` extension
+- Use `import`/`export` syntax (ES modules, compiled to CommonJS via tsconfig)
+- Every function and parameter has explicit type annotations
+- `app.ts` entry point imports: `import express, { Application } from 'express'`
+- Route files import: `import { Router, Request, Response } from 'express'`
+- `tsconfig.json` generated at service root (Wave 1)
+- `package.json` includes typescript, ts-node, nodemon, and all @types/* packages
+- Build: `npm run build` compiles to `dist/`; `npm run dev` runs via ts-node
+
+### When `language == "javascript"`:
+- All generated service files use `.js` extension (existing behavior)
+- Use `require()`/`module.exports` (CommonJS)
+- No type annotations, no tsconfig.json, no typescript in package.json
+
+### File extension mapping:
+| File | JS | TS |
+|---|---|---|
+| app | `app.js` | `app.ts` |
+| config/database | `database.js` | `database.ts` |
+| config/prisma | `prisma.js` | `prisma.ts` |
+| utilities/encryption | `encryption.js` | `encryption.ts` |
+| utilities/hashing | `hashing.js` | `hashing.ts` |
+| utilities/response | `response.js` | `response.ts` |
+| middleware/headerValidator | `headerValidator.js` | `headerValidator.ts` |
+| modules/v1/*/route | `route.js` | `route.ts` |
+| modules/v1/*/_model | `_model.js` | `_model.ts` |
+
+---
+
 ## Response Wrapper Behavior
 
 Read `context.services[<name>].encrypted_transport`:

package/cli.js

@@ -12,10 +12,11 @@
  *   codeninja version           Show installed version
  *
  * Supported IDEs:
+ *   claude-code   Claude Code (.claude/ structure with CLAUDE.md + commands + agents)
  *   antigravity   Google Antigravity IDE (.agents/ structure + slash commands)
  *   cursor        Cursor IDE (.cursor/rules/ + .cursor/mcp.json)
  *   vscode        VS Code / GitHub Copilot (.github/ + .vscode/mcp.json)
- *   all           Install files for all three IDEs
+ *   all           Install files for all four IDEs
  */
 
 const fs   = require('fs');
@@ -49,9 +50,18 @@ process.exit(1);
 
 /**
  * Detects which IDE is likely active by checking for known config files and env vars.
- * @returns {'antigravity'|'cursor'|'vscode'|'unknown'}
+ * @returns {'claude-code'|'antigravity'|'cursor'|'vscode'|'unknown'}
  */
+// IDE detection priority:
+// 1. .claude/   → claude-code
+// 2. .agents/   → antigravity
+// 3. .cursor/   → cursor
+// 4. .vscode/   → vscode
 function detectIDE() {
+    // Check for Claude Code (highest priority)
+    if (fs.existsSync(path.join(projectRoot, '.claude'))) {
+        return 'claude-code';
+    }
     // Antigravity: ~/.gemini/antigravity/ directory exists
     if (process.env.ANTIGRAVITY_IDE ||
         fs.existsSync(path.join(os.homedir(), '.gemini', 'antigravity'))) {
@@ -79,13 +89,13 @@ function runInit() {
     if (!ideFlag && targetIDE === 'unknown') {
         console.log('\ncodeninja could not auto-detect your IDE.');
         console.log('Installing for all supported IDEs instead.');
-        console.log('(Use --ide=antigravity | --ide=cursor | --ide=vscode to be specific)\n');
+        console.log('(Use --ide=claude-code | --ide=antigravity | --ide=cursor | --ide=vscode to be specific)\n');
         targetIDE = 'all';
     }
 
     const detectedLabel = ideFlag ? 'forced via --ide' : 'auto-detected';
     console.log('\ncodeninja — installing into ' + projectRoot);
-    console.log('IDE: ' + (installAll ? 'all (antigravity + cursor + vscode)' : targetIDE)
+    console.log('IDE: ' + (installAll ? 'all (claude-code + antigravity + cursor + vscode)' : targetIDE)
         + '  (' + detectedLabel + ')\n');
 
     if (fs.existsSync(destDir)) {
@@ -124,10 +134,11 @@ function runInit() {
 
     // ── 4: IDE-specific project files ─────────────────────────────────────
     console.log('\n[ 4/6 ]  Writing IDE-specific files...');
-    const ides = installAll ? ['antigravity', 'cursor', 'vscode'] : [targetIDE];
+    const ides = installAll ? ['claude-code', 'antigravity', 'cursor', 'vscode'] : [targetIDE];
     for (const ide of ides) {
         console.log('\n         ── ' + ide.toUpperCase() + ' ──');
-        if (ide === 'antigravity') installAntigravityFiles();
+        if (ide === 'claude-code') installClaudeCodeFiles();
+        else if (ide === 'antigravity') installAntigravityFiles();
         else if (ide === 'cursor') installCursorFiles();
         else if (ide === 'vscode') installVSCodeFiles();
         else console.log('         Unknown IDE: ' + ide + ' — skipped');
@@ -176,6 +187,14 @@ function runInit() {
 
 // ─── IDE file installers ──────────────────────────────────────────────────────
 
+function installClaudeCodeFiles() {
+    const src  = path.join(srcDir, 'ide', 'claude-code', '.claude');
+    const dest = path.join(projectRoot, '.claude');
+    if (!fs.existsSync(src)) { console.log('         [SKIP] ide/claude-code source not found'); return; }
+    copyDir(src, dest);
+    console.log('✓ Installed .claude/ (CLAUDE.md + 20 commands + 3 agents)');
+}
+
 function installAntigravityFiles() {
     const src  = path.join(srcDir, 'ide', 'antigravity', '.agents');
     const dest = path.join(projectRoot, '.agents');
@@ -342,10 +361,11 @@ Usage:
   codeninja help               Show this help
 
 IDE values for --ide:
+  claude-code  →  .claude/ (CLAUDE.md + 20 commands + 3 agents)
   antigravity  →  .agents/ structure (slash commands)
   cursor       →  .cursor/rules/ + mcp.json
   vscode       →  .github/copilot-instructions.md + .vscode/mcp.json
-  all          →  all three IDEs
+  all          →  all four IDEs
 
 Examples:
   codeninja init

package/commands/audit.workflow.md

@@ -66,7 +66,10 @@ a major refactor.
 - [ ] All model functions return exactly { responsecode, responsemsg,
       responsedata } — no extra keys, no throws?
 - [ ] No req/res objects in any model file?
-- [ ] Passwords encrypted using utilities/encryption.js before storage?
+- [ ] Passwords HASHED (not encrypted) using `utilities/hashing.js` before storage?
+      Correct: `await hashPassword(plainText)` — one-way bcrypt/argon2 hash
+      Wrong: `encrypt(password)` from encryption.js — reversible AES, not safe for passwords
+- [ ] No direct bcrypt/argon2 imports in route.js or model files? All hashing routed through utilities/hashing.js?
 - [ ] Session tokens generated only via common.generateSessionCode?
 - [ ] No crypto-js or cryptlib imported directly in model files?
 - [ ] No direct res.json() calls in route.js files?

package/commands/db-create-table.workflow.md

@@ -105,7 +105,7 @@ file must pass ALL rules defined in database-agent.md.
 11. Run task: `ask-table-seed-data`
     - Ask: "Does this table need seed/initial data?"
     - Guidance: suggest YES only for reference/master data tables
-    - If yes → run task: `ask-seed-data-input`
+    - If yes → run task: `collect-seed-data`
     - Stores: `context.current_db.seed_rows[]`
 
 ---

package/commands/initialize-project.workflow.md

@@ -89,6 +89,10 @@ After all three tasks:
     - Run task: `ask-encrypted-transport`
       Stores: `context.current_init.encrypted_transport`
 
+    - Run task: `ask-language-type`
+      Stores: `context.current_init.language`
+      Only runs for project_type == nodejs. Skipped for reactjs and database-only.
+
     - Run task: `ask-supported-languages`
       Stores: `context.current_init.supported_languages[]`
 
@@ -118,6 +122,10 @@ After all three tasks:
      use existing or configure new?
    - Stores: `context.db.type`
 
+4.5. Run task: `ask-orm-type`
+     - Stores: `context.db.orm`
+     - Fast mode: silently sets orm = "none"
+
 5. If `init_mode == "manual"`:
    Run task: `ask-database-config`
    - Collects: name, host, port, user in one grouped display
@@ -241,6 +249,11 @@ not encrypted.
       `context.current_init.redis_port`
     (If init_mode == "fast" → handled by generate-fast-defaults)
 
+21. If `init_mode == "manual"` AND `project_type == "nodejs"`:
+    Run task: `ask-hashing-library`
+    - Options: bcryptjs (recommended) / argon2
+    - Stores: `context.current_init.hashing_library`
+
 ---
 
 ### Phase 5b — Auto-populate Defaults (fast mode, nodejs only)
@@ -254,6 +267,7 @@ Run task: `generate-fast-defaults`
 - Silently sets all values not yet in context.current_init
 - No output, no questions — values appear in summary
 - See task description for full list of what is auto-generated
+- `hashing_library` → "bcryptjs" (fast mode default — no native bindings, production-safe)
 
 ---
 
@@ -326,7 +340,13 @@ Run task: `generate-fast-defaults`
     - config/template.js → task: generate-template
     - logger/logging.js → task: generate-logging
     - utilities/encryption.js → task: generate-encryption
+    - utilities/hashing.js (or .ts) → task: generate-hashing
+    - tsconfig.json → task: generate-tsconfig
+      (Only generated when language == "typescript")
     - languages/<lang>.js for each in supported_languages[] → task: generate-language-en
+    - If `context.db.orm == "prisma"`:
+      - prisma/schema.prisma → task: generate-prisma-schema
+      - config/prisma.js (or .ts) → task: generate-prisma-client
     - enc_dec.html OR enc_dec.php (based on client_type) → task: generate-enc-dec-html or generate-enc-dec-php
     - <service_name>/pem/ directory with .gitkeep
     - <service_name>/images/ directory with .gitkeep
@@ -338,6 +358,7 @@ Run task: `generate-fast-defaults`
     while Wave 1 is still completing.
 
     - config/database.js → task: generate-database
+      (Skipped when orm == "prisma" — Prisma client replaces it)
     - utilities/ioRedis.js → task: generate-ioRedis
     - utilities/response.js → task: generate-response