crewly 1.5.18 → 1.5.20

package/config/skills/agent/computer-use/lib/playwright.sh

@@ -1,153 +0,0 @@
-#!/usr/bin/env bash
-# =============================================================================
-# Playwright CDP Integration — Layer 4
-# Connect to Chrome via Chrome DevTools Protocol for web app automation.
-# Requires Chrome launched with --remote-debugging-port.
-# =============================================================================
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "${SCRIPT_DIR}/../../_common/lib.sh"
-
-DEFAULT_CDP_PORT=9222
-
-# -----------------------------------------------------------------------------
-# chrome_connect — Test CDP connection to Chrome
-# Params: port (default 9222)
-# -----------------------------------------------------------------------------
-chrome_connect() {
-  local port="${1:-$DEFAULT_CDP_PORT}"
-
-  # Check if Chrome is reachable via CDP
-  local response
-  response=$(curl -s --connect-timeout 3 "http://127.0.0.1:${port}/json/version" 2>&1) || {
-    echo "{\"success\":false,\"action\":\"chrome-connect\",\"port\":$port,\"error\":\"Cannot connect to Chrome CDP on port $port. Launch Chrome with: open -a 'Google Chrome' --args --remote-debugging-port=$port\"}"
-    return 1
-  }
-
-  local browser
-  browser=$(echo "$response" | jq -r '.Browser // "unknown"' 2>/dev/null || echo "unknown")
-  local ws_url
-  ws_url=$(echo "$response" | jq -r '.webSocketDebuggerUrl // "unknown"' 2>/dev/null || echo "unknown")
-
-  echo "{\"success\":true,\"action\":\"chrome-connect\",\"port\":$port,\"browser\":\"$browser\",\"wsUrl\":\"$ws_url\"}"
-}
-
-# -----------------------------------------------------------------------------
-# chrome_tabs — List open Chrome tabs via CDP
-# Params: port (default 9222)
-# -----------------------------------------------------------------------------
-chrome_tabs() {
-  local port="${1:-$DEFAULT_CDP_PORT}"
-
-  local response
-  response=$(curl -s --connect-timeout 3 "http://127.0.0.1:${port}/json/list" 2>&1) || {
-    echo "{\"success\":false,\"action\":\"chrome-tabs\",\"error\":\"Cannot connect to Chrome CDP on port $port\"}"
-    return 1
-  }
-
-  # Filter to page type only and extract useful fields
-  local tabs
-  tabs=$(echo "$response" | jq '[.[] | select(.type == "page") | {id: .id, title: .title, url: .url}]' 2>/dev/null || echo "[]")
-
-  local count
-  count=$(echo "$tabs" | jq 'length' 2>/dev/null || echo "0")
-
-  echo "{\"success\":true,\"action\":\"chrome-tabs\",\"port\":$port,\"count\":$count,\"tabs\":$tabs}"
-}
-
-# -----------------------------------------------------------------------------
-# chrome_eval — Run JavaScript in a Chrome tab via CDP
-# Params: port, tabIndex, code
-# Uses the REST endpoint for simple evaluations.
-# -----------------------------------------------------------------------------
-chrome_eval() {
-  local port="${1:-$DEFAULT_CDP_PORT}"
-  local tab_index="${2:-0}"
-  local code="$3"
-
-  # Get tab list
-  local tabs_response
-  tabs_response=$(curl -s --connect-timeout 3 "http://127.0.0.1:${port}/json/list" 2>&1) || {
-    echo "{\"success\":false,\"action\":\"chrome-eval\",\"error\":\"Cannot connect to Chrome CDP\"}"
-    return 1
-  }
-
-  # Get the specific tab's webSocketDebuggerUrl
-  local ws_url
-  ws_url=$(echo "$tabs_response" | jq -r ".[$tab_index].webSocketDebuggerUrl // empty" 2>/dev/null)
-
-  if [ -z "$ws_url" ]; then
-    echo "{\"success\":false,\"action\":\"chrome-eval\",\"error\":\"Tab index $tab_index not found\"}"
-    return 1
-  fi
-
-  local tab_id
-  tab_id=$(echo "$tabs_response" | jq -r ".[$tab_index].id // empty" 2>/dev/null)
-
-  # Use CDP REST API to evaluate: activate tab first, then use the evaluate endpoint
-  # Note: For simple evaluations, we use osascript to run JS in Chrome via AppleScript
-  local tab_url
-  tab_url=$(echo "$tabs_response" | jq -r ".[$tab_index].url // empty" 2>/dev/null)
-  local tab_title
-  tab_title=$(echo "$tabs_response" | jq -r ".[$tab_index].title // empty" 2>/dev/null)
-
-  # Use the CDP WebSocket via a simple node script if available
-  if command -v node &>/dev/null; then
-    local result
-    result=$(node -e "
-      const http = require('http');
-      const data = JSON.stringify({
-        id: 1,
-        method: 'Runtime.evaluate',
-        params: { expression: $(echo "$code" | jq -Rs .), returnByValue: true }
-      });
-
-      // Use HTTP endpoint to send CDP command
-      const ws = require('ws');
-      const client = new ws('$ws_url');
-      let timeout = setTimeout(() => {
-        console.log(JSON.stringify({success: false, error: 'Timeout'}));
-        process.exit(1);
-      }, 10000);
-
-      client.on('open', () => {
-        client.send(data);
-      });
-      client.on('message', (msg) => {
-        clearTimeout(timeout);
-        const resp = JSON.parse(msg);
-        if (resp.result && resp.result.result) {
-          console.log(JSON.stringify({
-            success: true,
-            action: 'chrome-eval',
-            tabId: '$tab_id',
-            value: resp.result.result.value,
-            type: resp.result.result.type
-          }));
-        } else if (resp.result && resp.result.exceptionDetails) {
-          console.log(JSON.stringify({
-            success: false,
-            action: 'chrome-eval',
-            error: resp.result.exceptionDetails.text || 'Evaluation error'
-          }));
-        }
-        client.close();
-      });
-      client.on('error', (err) => {
-        clearTimeout(timeout);
-        console.log(JSON.stringify({success: false, error: err.message}));
-        process.exit(1);
-      });
-    " 2>&1) || {
-      # Fallback if ws module not available
-      echo "{\"success\":false,\"action\":\"chrome-eval\",\"error\":\"Node.js 'ws' module required. Install: npm install -g ws\"}"
-      return 1
-    }
-    echo "$result"
-  else
-    echo "{\"success\":false,\"action\":\"chrome-eval\",\"error\":\"Node.js required for chrome-eval. Install Node.js first.\"}"
-    return 1
-  fi
-}

package/config/skills/agent/computer-use/lib/screenshot.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-# =============================================================================
-# Screenshot Utility — captures screen or specific app windows
-# =============================================================================
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "${SCRIPT_DIR}/../../_common/lib.sh"
-
-# -----------------------------------------------------------------------------
-# take_screenshot — Capture the screen or a specific app window
-# Params: output (file path), appName (optional, for window capture)
-# -----------------------------------------------------------------------------
-take_screenshot() {
-  local output="${1:-/tmp/screenshot.png}"
-  local app_name="${2:-}"
-
-  mkdir -p "$(dirname "$output")"
-
-  if [ -n "$app_name" ]; then
-    # Get the window ID for the app, then capture that window
-    local window_id
-    window_id=$(osascript -l JavaScript -e "
-      var app = Application('System Events');
-      var proc = app.processes.byName('$app_name');
-      var wins = proc.windows();
-      if (wins.length > 0) {
-        // Get the window number via attributes
-        try {
-          var attrs = wins[0].attributes();
-          for (var i = 0; i < attrs.length; i++) {
-            if (attrs[i].name() === 'AXWindow') {
-              // Fall through to full screen capture with app focus
-            }
-          }
-        } catch(e) {}
-      }
-      '';
-    " 2>/dev/null || echo "")
-
-    # Focus the app first, then capture the frontmost window
-    osascript -e "tell application \"$app_name\" to activate" 2>/dev/null || true
-    sleep 0.5
-    screencapture -x -o -l "$(osascript -e 'tell application "System Events" to get id of first window of first process whose frontmost is true' 2>/dev/null || echo "")" "$output" 2>/dev/null || {
-      # Fallback: capture full screen
-      screencapture -x "$output" 2>/dev/null
-    }
-  else
-    # Full screen capture
-    screencapture -x "$output" 2>/dev/null
-  fi
-
-  if [ -f "$output" ]; then
-    local size
-    size=$(stat -f%z "$output" 2>/dev/null || stat -c%s "$output" 2>/dev/null || echo "0")
-    echo "{\"success\":true,\"action\":\"screenshot\",\"file\":\"$output\",\"size\":$size,\"appName\":\"${app_name:-full-screen}\"}"
-  else
-    error_exit "Screenshot failed — file not created"
-  fi
-}

package/config/templates/cloud-deploy.json

@@ -1,119 +0,0 @@
-{
-  "$schema": "https://crewlyai.com/schemas/cloud-deploy-manifest.json",
-  "version": "1.0.0",
-  "generatedAt": "2026-03-26T00:00:00.000Z",
-  "templates": [
-    {
-      "templateId": "dev-fullstack",
-      "displayName": "Fullstack Development Team",
-      "description": "A Tech Lead orchestrates 2 developers and 1 QA engineer to build web applications. Includes code review, quality gates, browser testing, and E2E pipelines.",
-      "category": "development",
-      "icon": "laptop",
-      "tags": ["development", "web", "fullstack", "testing"],
-      "agentCount": 4,
-      "roles": [
-        { "role": "team-leader", "label": "Tech Lead", "count": 1 },
-        { "role": "developer", "label": "Developer", "count": 2 },
-        { "role": "qa-engineer", "label": "QA Engineer", "count": 1 }
-      ],
-      "compatibleRuntimes": ["claude-code", "crewly-agent"],
-      "defaultRuntime": "crewly-agent",
-      "estimatedTokenUsage": {
-        "perTaskAvg": 50000,
-        "dailyBudget": 5000000,
-        "modelBreakdown": {
-          "claude-sonnet-4-20250514": 85,
-          "claude-haiku-3.5": 15
-        }
-      },
-      "features": [
-        "hierarchical-delegation",
-        "code-review-pipeline",
-        "quality-gates",
-        "browser-verification",
-        "e2e-testing"
-      ],
-      "deployConfig": {
-        "minMemoryMb": 512,
-        "requiresBrowser": true,
-        "requiresGit": true,
-        "normFiles": ["code-commit-sop.md", "quality-gates.md"],
-        "suggestedProviders": ["anthropic"]
-      }
-    },
-    {
-      "templateId": "research-analysis",
-      "displayName": "Research & Analysis Team",
-      "description": "A Research Lead directs 2 analysts for competitive analysis, market research, and strategic planning. Includes source verification, fact-checking, and data validation pipelines.",
-      "category": "research",
-      "icon": "microscope",
-      "tags": ["research", "analysis", "strategy", "competitive"],
-      "agentCount": 3,
-      "roles": [
-        { "role": "team-leader", "label": "Research Lead", "count": 1 },
-        { "role": "analyst", "label": "Research Analyst", "count": 2 }
-      ],
-      "compatibleRuntimes": ["claude-code", "crewly-agent"],
-      "defaultRuntime": "crewly-agent",
-      "estimatedTokenUsage": {
-        "perTaskAvg": 40000,
-        "dailyBudget": 3000000,
-        "modelBreakdown": {
-          "claude-sonnet-4-20250514": 90,
-          "claude-haiku-3.5": 10
-        }
-      },
-      "features": [
-        "hierarchical-delegation",
-        "source-verification",
-        "fact-checking",
-        "data-validation",
-        "web-research"
-      ],
-      "deployConfig": {
-        "minMemoryMb": 256,
-        "requiresBrowser": true,
-        "requiresGit": false,
-        "normFiles": ["research-methodology.md", "source-citation.md"],
-        "suggestedProviders": ["anthropic"]
-      }
-    },
-    {
-      "templateId": "social-media-ops",
-      "displayName": "Social Media Operations Team",
-      "description": "A Content Director manages 2 creators for social media content creation, visual review, and multi-platform publishing. Includes visual QA with AI vision analysis.",
-      "category": "content",
-      "icon": "smartphone",
-      "tags": ["content", "social-media", "visual", "marketing"],
-      "agentCount": 3,
-      "roles": [
-        { "role": "team-leader", "label": "Content Director", "count": 1 },
-        { "role": "creator", "label": "Content Creator", "count": 2 }
-      ],
-      "compatibleRuntimes": ["claude-code", "crewly-agent"],
-      "defaultRuntime": "crewly-agent",
-      "estimatedTokenUsage": {
-        "perTaskAvg": 30000,
-        "dailyBudget": 2000000,
-        "modelBreakdown": {
-          "claude-sonnet-4-20250514": 70,
-          "claude-haiku-3.5": 30
-        }
-      },
-      "features": [
-        "hierarchical-delegation",
-        "visual-screenshot-review",
-        "ai-vision-analysis",
-        "content-guidelines",
-        "multi-platform"
-      ],
-      "deployConfig": {
-        "minMemoryMb": 256,
-        "requiresBrowser": true,
-        "requiresGit": false,
-        "normFiles": ["posting-schedule.md", "engagement-rules.md"],
-        "suggestedProviders": ["anthropic"]
-      }
-    }
-  ]
-}

package/config/templates/code-review-team/README.md

@@ -1,176 +0,0 @@
-# Code Review Pipeline — Quick Start
-
-## Overview
-
-An AI team that automatically reviews pull requests for code quality, security vulnerabilities, and test coverage. Produces structured, actionable review feedback with a clear verdict.
-
-**Target Users**: SaaS teams, dev agencies, engineering organizations
-**Team Size**: 2 agents (Senior Reviewer + Security Auditor)
-
-## Prerequisites
-
-- Crewly installed and running (`npx crewly start`)
-- Git repository with PR workflow (GitHub, GitLab, or Bitbucket)
-
-## Quick Start
-
-```bash
-# 1. Create the team from template
-npx crewly create-team --template code-review-team
-
-# 2. Start the team in your project directory
-npx crewly start --project /path/to/your/repo
-```
-
-## Required Skills
-
-| Skill | Purpose | Config Required |
-|-------|---------|----------------|
-| `code-review` | Analyze git diffs for quality, style, complexity | None |
-| `test-runner` | Run test suite and verify coverage | None |
-| `bug-triage` | Classify and prioritize security findings | None |
-| `git-commit-helper` | Analyze commit messages for conventional format | None |
-
-## Optional Skills
-
-| Skill | Purpose |
-|-------|---------|
-| `send-pdf-to-slack` | Post review summary to Slack channel |
-| `daily-standup-report` | Daily PR review activity summary |
-
-## Workflow
-
-```
-  New PR Detected
-       │
-       ▼
-  Senior Reviewer                Security Auditor
-       │                              │
-       ├─ Run code-review skill        │
-       ├─ Analyze architecture         │
-       ├─ Check naming, patterns       │
-       ├─ Review error handling        │
-       │                              │
-       ├─ Run test-runner skill        │
-       ├─ Verify tests pass            │
-       ├─ Check coverage threshold     │
-       │                              │
-       │         Parallel              │
-       │──────────────────────────────▶│
-       │                              ├─ Scan for OWASP Top 10
-       │                              ├─ Check for secrets
-       │                              ├─ Review auth/authz
-       │                              ├─ Classify findings
-       │                              │  (bug-triage skill)
-       │                              │
-       │◀─────── Security Report ─────┤
-       │                              │
-       ├─ Consolidate all findings     │
-       ├─ Produce final verdict        │
-       │  (approve / request changes)  │
-       │                              │
-       └─ Post review comment ─────────┘
-```
-
-## Expected Output Examples
-
-### Code Quality Review (from Senior Reviewer)
-```markdown
-## Code Review: PR #142 — Add user preferences API
-
-### Summary
-**Verdict**: REQUEST CHANGES (2 blockers, 3 suggestions)
-
-**Files changed**: 6 | **Lines**: +284 / -12
-**Tests**: 14 passing, 0 failing | **Coverage**: 87% (+3%)
-
-### Findings
-
-#### Blockers
-1. **Missing input validation** — `preferences.controller.ts:45`
-   The `updatePreferences` handler accepts raw body without validation.
-   Any malformed JSON crashes the service with unhandled TypeError.
-   **Fix**: Add Zod schema validation before processing.
-
-2. **N+1 query in getAll** — `preferences.service.ts:78`
-   Loading preferences with `Promise.all(users.map(u => getPrefs(u.id)))`.
-   With 1000 users this fires 1000 queries.
-   **Fix**: Batch query with `WHERE user_id IN (...)`.
-
-#### Suggestions
-1. **Consider extracting preference keys to constants** — `preferences.types.ts:12`
-   String literals `'theme'`, `'language'`, `'timezone'` appear 4 times.
-   Extract to a `PREFERENCE_KEYS` constant.
-
-2. **Add JSDoc to public methods** — `preferences.service.ts`
-   3 public methods missing documentation. Project convention requires JSDoc.
-
-3. **Test edge case: empty preferences object** — `preferences.service.test.ts`
-   No test for `updatePreferences({})`. Should return 400 or no-op.
-
-### Test Results
-✅ All 14 tests passing
-✅ Coverage: 87% (above 80% threshold)
-⚠️ Missing edge case test (see suggestion #3)
-```
-
-### Security Assessment (from Security Auditor)
-```markdown
-## Security Assessment: PR #142
-
-### Risk Rating: MEDIUM (1 high, 1 low finding)
-
-### Findings
-
-| # | Severity | Category | Location | Description |
-|---|----------|----------|----------|-------------|
-| 1 | HIGH | Injection | `preferences.controller.ts:45` | No input validation — potential NoSQL injection if using MongoDB, or payload manipulation with any DB. Aligns with OWASP A03:2021 (Injection). |
-| 2 | LOW | Information Disclosure | `preferences.controller.ts:67` | Error response includes full stack trace in non-production. Recommend stripping in all environments. |
-
-### Remediation
-1. **[HIGH] Add input validation**: Use Zod or Joi to validate request body schema before processing. Whitelist allowed preference keys.
-2. **[LOW] Strip stack traces**: Use error middleware that omits stack traces regardless of NODE_ENV.
-
-### Checks Passed
-- ✅ No hardcoded secrets or API keys
-- ✅ Authentication middleware present on all routes
-- ✅ No use of `eval()` or dynamic code execution
-- ✅ Dependencies have no known CVEs (checked via `npm audit`)
-
-### Recommendation: BLOCK until HIGH finding is resolved
-```
-
-### Final Verdict (from Senior Reviewer)
-```markdown
-## Final Review: PR #142 — Add user preferences API
-
-**Verdict**: ❌ REQUEST CHANGES
-
-### Consolidated Findings
-- 🔴 2 Blockers (1 code quality + 1 security HIGH)
-- 🟡 3 Suggestions
-- 🟢 Tests passing, coverage above threshold
-
-### Required Before Merge
-1. Add input validation with Zod schema (blocks both code quality + security findings)
-2. Fix N+1 query in `getAll`
-
-### Nice to Have
-3. Extract preference key constants
-4. Add JSDoc to public methods
-5. Add empty-object edge case test
-
-### What's Good
-- Clean API design following RESTful conventions
-- Good test coverage (87%)
-- Proper error handling in happy path
-- Consistent with existing codebase patterns
-```
-
-## Customization
-
-- **Add linting**: Include quality gates for ESLint/Prettier checks
-- **Adjust thresholds**: Modify coverage requirements in Senior Reviewer's prompt
-- **Add CI integration**: Trigger review on GitHub webhook events
-- **Scale**: Add a third agent for performance review (benchmarks, load testing)
-- **Customize rules**: Edit Security Auditor's prompt to focus on your tech stack's specific vulnerabilities

package/config/templates/code-review-team/team-config.json

@@ -1,23 +0,0 @@
-{
-  "name": "Code Review Pipeline",
-  "description": "AI team that automatically reviews pull requests for code quality, security vulnerabilities, and test coverage. Built for SaaS teams, dev shops, and any team that wants faster, more consistent code reviews.",
-  "norms": {
-    "enabled": true,
-    "files": [
-      { "file": "pr-review-checklist.md", "trigger": "before_merge", "roles": ["architect", "qa-engineer"] },
-      { "file": "security-scan.md", "trigger": "before_merge", "roles": ["qa-engineer"] }
-    ]
-  },
-  "members": [
-    {
-      "name": "Senior Reviewer",
-      "role": "architect",
-      "systemPrompt": "You are the senior code reviewer on a code review team. You review pull requests for architecture, code quality, maintainability, and adherence to project conventions. Use the code-review skill to analyze git diffs and produce structured reviews. Use the test-runner skill to verify test coverage and ensure all tests pass. Focus on: naming conventions, separation of concerns, error handling, performance implications, and API design. Coordinate with the Security Auditor on security findings. Produce a final review verdict (approve / request changes) with clear, actionable feedback."
-    },
-    {
-      "name": "Security Auditor",
-      "role": "qa-engineer",
-      "systemPrompt": "You are the security auditor on a code review team. You scan every PR for security vulnerabilities: injection flaws (SQL, XSS, command injection), authentication/authorization issues, secrets exposure, insecure dependencies, and OWASP Top 10 violations. Use the code-review skill with security focus to analyze changes. Use the bug-triage skill to classify and prioritize any findings. Produce a security assessment for each PR: list of findings (severity + remediation), overall risk rating, and approval/block recommendation. Coordinate with the Senior Reviewer on the final review verdict."
-    }
-  ]
-}

package/config/templates/code-review-team.json

@@ -1,62 +0,0 @@
-{
-  "id": "code-review-team",
-  "name": "Code Review Pipeline",
-  "description": "AI team that automatically reviews pull requests for code quality, security vulnerabilities, and test coverage. Built for SaaS teams, dev shops, and any team that wants faster, more consistent code reviews.",
-  "category": "development",
-  "targetVertical": "SaaS Team / Dev Agency / Engineering Org",
-  "members": [
-    {
-      "name": "Senior Reviewer",
-      "role": "architect",
-      "systemPrompt": "You are the senior code reviewer on a code review team. You review pull requests for architecture, code quality, maintainability, and adherence to project conventions. Use the code-review skill to analyze git diffs and produce structured reviews. Use the test-runner skill to verify test coverage and ensure all tests pass. Focus on: naming conventions, separation of concerns, error handling, performance implications, and API design. Coordinate with the Security Auditor on security findings. Produce a final review verdict (approve / request changes) with clear, actionable feedback."
-    },
-    {
-      "name": "Security Auditor",
-      "role": "qa-engineer",
-      "systemPrompt": "You are the security auditor on a code review team. You scan every PR for security vulnerabilities: injection flaws (SQL, XSS, command injection), authentication/authorization issues, secrets exposure, insecure dependencies, and OWASP Top 10 violations. Use the code-review skill with security focus to analyze changes. Use the bug-triage skill to classify and prioritize any findings. Produce a security assessment for each PR: list of findings (severity + remediation), overall risk rating, and approval/block recommendation. Coordinate with the Senior Reviewer on the final review verdict."
-    }
-  ],
-  "requiredSkills": [
-    "code-review",
-    "test-runner",
-    "bug-triage",
-    "git-commit-helper"
-  ],
-  "optionalSkills": [
-    "send-pdf-to-slack",
-    "daily-standup-report"
-  ],
-  "workflow": {
-    "name": "PR Review Pipeline",
-    "steps": [
-      {
-        "step": 1,
-        "name": "PR Detection & Initial Analysis",
-        "owner": "Senior Reviewer",
-        "description": "Detect new or updated PR. Run code-review skill on the diff to produce structured analysis of changes.",
-        "output": "Structured code review (markdown) with findings by category"
-      },
-      {
-        "step": 2,
-        "name": "Test Verification",
-        "owner": "Senior Reviewer",
-        "description": "Run test suite via test-runner skill. Verify all tests pass and coverage meets threshold.",
-        "output": "Test results with coverage report"
-      },
-      {
-        "step": 3,
-        "name": "Security Scan",
-        "owner": "Security Auditor",
-        "description": "Analyze changes for security vulnerabilities. Classify findings by severity using bug-triage skill.",
-        "output": "Security assessment (findings list + severity + risk rating)"
-      },
-      {
-        "step": 4,
-        "name": "Final Verdict",
-        "owner": "Senior Reviewer",
-        "description": "Consolidate code quality review + test results + security assessment. Produce final verdict with actionable feedback.",
-        "output": "PR review comment (approve / request changes) with consolidated feedback"
-      }
-    ]
-  }
-}