npm - devflow-kit - Versions diffs - 1.8.3 → 2.0.1 - Mend

devflow-kit 1.8.3 → 2.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (867) hide show

package/plugins/devflow-code-review/skills/review-methodology/references/patterns.md DELETED Viewed

@@ -1,186 +0,0 @@
-# Review Methodology Patterns
-Correct patterns for effective code reviews.
----
-## 6-Step Review Process
-1. **Understand Context** - Read PR description, linked issues
-2. **Get Diff** - Analyze changed files
-3. **Review by Category** - Security, architecture, performance, etc.
-4. **Classify Issues** - CRITICAL, HIGH, MEDIUM, LOW
-5. **Write Report** - Structured format with file:line references
-6. **Post Comments** - Use GitHub API for PR comments
----
-## Issue Classification
-| Category | Criteria |
-|----------|----------|
-| CRITICAL | Security vulnerabilities, data loss, crashes |
-| HIGH | Bugs, significant performance issues |
-| MEDIUM | Code quality, maintainability |
-| LOW | Style, documentation, minor improvements |
----
-## Diff Analysis Commands
-### Getting the Diff
-```bash
-# Get the base branch
-BASE_BRANCH=""
-for branch in main master develop; do
-  if git show-ref --verify --quiet refs/heads/$branch; then
-    BASE_BRANCH=$branch
-    break
-  fi
-done
-# Get changed files
-git diff --name-only $BASE_BRANCH...HEAD > /tmp/changed_files.txt
-# Get detailed diff with line numbers
-git diff $BASE_BRANCH...HEAD > /tmp/full_diff.txt
-# Extract exact line numbers that changed
-git diff $BASE_BRANCH...HEAD --unified=0 | grep -E '^@@' > /tmp/changed_lines.txt
-# Get diff statistics
-git diff $BASE_BRANCH...HEAD --stat > /tmp/diff_stats.txt
-echo "Changed files: $(wc -l < /tmp/changed_files.txt)"
-echo "Base branch: $BASE_BRANCH"
-echo "Current branch: $(git branch --show-current)"
-```
-### Useful Git Commands
-| Command | Purpose |
-|---------|---------|
-| `git diff --name-only BASE...HEAD` | List changed files |
-| `git diff BASE...HEAD --stat` | Summary of changes |
-| `git diff BASE...HEAD --unified=0` | Only changed lines (no context) |
-| `git diff BASE...HEAD -- path/` | Diff for specific directory |
-| `git log BASE..HEAD --oneline` | Commits in this branch |
-| `git show --stat HEAD` | Last commit details |
-### Branch Detection
-```bash
-# Detect base branch (in priority order)
-for branch in main master develop; do
-  if git show-ref --verify --quiet refs/heads/$branch; then
-    BASE_BRANCH=$branch
-    break
-  fi
-done
-# Get current branch
-CURRENT_BRANCH=$(git branch --show-current)
-# Get branch slug for filenames
-BRANCH_SLUG=$(echo "$CURRENT_BRANCH" | sed 's/\//-/g')
-```
----
-## Report File Conventions
-```bash
-# Get timestamp and branch slug
-TIMESTAMP=$(date +%Y-%m-%d_%H%M)
-BRANCH_SLUG=$(git branch --show-current | sed 's/\//-/g')
-# When invoked by /code-review command
-REPORT_FILE=".docs/reviews/${BRANCH_SLUG}/{domain}-report.${TIMESTAMP}.md"
-# When invoked standalone
-REPORT_FILE="${REPORT_FILE:-.docs/reviews/standalone/{domain}-report.${TIMESTAMP}.md}"
-# Ensure directory exists
-mkdir -p "$(dirname "$REPORT_FILE")"
-# Save report
-cat > "$REPORT_FILE" <<'REPORT'
-{Generated report content}
-REPORT
-echo "Review saved: $REPORT_FILE"
-```
----
-## PR Comment Integration
-### Comment Creation Function
-```bash
-REPO=$(gh repo view --json nameWithOwner -q '.nameWithOwner')
-COMMIT_SHA=$(git rev-parse HEAD)
-COMMENTS_CREATED=0
-COMMENTS_SKIPPED=0
-create_pr_comment() {
-    local FILE="$1" LINE="$2" BODY="$3"
-    # Only comment on lines in the PR diff
-    if gh pr diff "$PR_NUMBER" --name-only 2>/dev/null | grep -q "^${FILE}$"; then
-        gh api "repos/${REPO}/pulls/${PR_NUMBER}/comments" \
-            -f body="$BODY" \
-            -f commit_id="$COMMIT_SHA" \
-            -f path="$FILE" \
-            -f line="$LINE" \
-            -f side="RIGHT" 2>/dev/null \
-            && COMMENTS_CREATED=$((COMMENTS_CREATED + 1)) \
-            || COMMENTS_SKIPPED=$((COMMENTS_SKIPPED + 1))
-    else
-        COMMENTS_SKIPPED=$((COMMENTS_SKIPPED + 1))
-    fi
-    # Rate limiting
-    sleep 1
-}
-# Only create comments for BLOCKING issues (Category 1)
-# Category 2 and 3 go in the summary report only
-```
-### Comment Rules
-1. **Only comment on blocking issues** - Category 1 (Issues in Your Changes)
-2. **Verify file is in PR diff** - Skip files not part of the PR
-3. **Rate limit API calls** - 1 second delay between comments
-4. **Track statistics** - Count created vs skipped comments
-### API Parameters
-| Parameter | Value | Description |
-|-----------|-------|-------------|
-| `body` | Comment text | Markdown-formatted comment |
-| `commit_id` | HEAD SHA | The commit to attach comment to |
-| `path` | File path | Relative path to file |
-| `line` | Line number | Line number in the diff |
-| `side` | "RIGHT" | Comment on new file version |
-### Comment Summary Section
-Add to report footer:
-```markdown
----
-## PR Comment Summary
-- **Comments Created**: ${COMMENTS_CREATED}
-- **Comments Skipped**: ${COMMENTS_SKIPPED} (lines not in PR diff)
-```
----
-## Quick Reference
-See [report-template.md](report-template.md) for full report format.

package/plugins/devflow-code-review/skills/review-methodology/references/report-template.md DELETED Viewed

@@ -1,142 +0,0 @@
-# Review Report Template
-Full template for generating review reports.
-## Report Structure
-```markdown
-# {Domain} Review Report
-**Branch**: ${CURRENT_BRANCH}
-**Base**: ${BASE_BRANCH}
-**Date**: $(date +%Y-%m-%d %H:%M:%S)
-**Files Analyzed**: ${FILE_COUNT}
-**Lines Changed**: ${LINES_CHANGED}
----
-## Issues in Your Changes (BLOCKING)
-These issues were introduced in lines you added or modified:
-### CRITICAL
-**[Issue Title]** - `file.ts:123` (line ADDED in this branch)
-- **Issue**: {description}
-- **Impact**: {why it matters}
-- **Code**:
-  ```typescript
-  {problematic code}
-  ```
-- **Fix**:
-  ```typescript
-  {corrected code}
-  ```
-### HIGH
-{More findings in lines you changed}
----
-## Issues in Code You Touched (Should Fix)
-These issues exist in code you modified or functions you updated:
-### HIGH
-**[Issue Title]** - `file.ts:89` (in function you modified)
-- **Issue**: {description}
-- **Context**: You modified this function but didn't fix this
-- **Recommendation**: Fix while you're here
-{More findings in touched code}
----
-## Pre-existing Issues (Not Blocking)
-These issues exist in files you reviewed but are unrelated to your changes:
-### MEDIUM
-**[Issue Title]** - `file.ts:456` (pre-existing, line not changed)
-- **Issue**: {description}
-- **Recommendation**: Fix in separate PR
-- **Reason not blocking**: Existed before your changes
-{More pre-existing findings}
----
-## Summary
-**Your Changes:**
-- CRITICAL: X (MUST FIX)
-- HIGH: Y (MUST FIX)
-- MEDIUM: Z
-**Code You Touched:**
-- HIGH: X (SHOULD FIX)
-- MEDIUM: Y (SHOULD FIX)
-**Pre-existing:**
-- MEDIUM: X (OPTIONAL)
-- LOW: Y (OPTIONAL)
-**{Domain} Score**: {X}/10
-**Merge Recommendation**:
-- BLOCK MERGE (if critical/high issues in your changes)
-- REVIEW REQUIRED (if medium issues in your changes)
-- APPROVED WITH CONDITIONS (if only touched/pre-existing issues)
-- APPROVED (if no issues in your changes)
----
-## Remediation Priority
-**Fix before merge:**
-1. {Critical issue in your changes}
-2. {High issue in your changes}
-**Fix while you're here:**
-1. {Issue in code you touched}
-**Future work:**
-- Create issues for pre-existing problems
-- Track technical debt separately
-```
-## PR Line Comment Format
-For individual line comments on PRs:
-```markdown
-**{Icon} {Domain}: {Issue Title}**
-{Brief description of the issue}
-**Current:**
-```{language}
-{problematic code}
-```
-**Suggested Fix:**
-```{language}
-{fixed code}
-```
-**Why:** {Explanation of impact}
----
-*Severity: {CRITICAL/HIGH/MEDIUM} | Category: {Your Changes/Code You Touched/Pre-existing}*
-<sub>Claude Code `/code-review`</sub>
-```
-## File Naming
-Reports use this naming convention:
-- Directory: `.docs/reviews/{branch-slug}/`
-- Filename: `{domain}-report.{YYYY-MM-DD_HHMM}.md`
-- Summary: `review-summary.{YYYY-MM-DD_HHMM}.md`

package/plugins/devflow-code-review/skills/review-methodology/references/violations.md DELETED Viewed

@@ -1,125 +0,0 @@
-# Review Methodology Violations
-Common anti-patterns that undermine effective code reviews.
----
-## Review Process Violations
-| Violation | Problem | Fix |
-|-----------|---------|-----|
-| Blocking for pre-existing issues | Unfair to author | Only flag issues in changed code |
-| Missing severity classification | Unclear priority | Use CRITICAL/HIGH/MEDIUM/LOW |
-| No file:line references | Hard to locate | Always include specific locations |
-| Vague feedback | Not actionable | Provide concrete fixes |
-| Mixing concerns | Confusing review | Separate by category |
-| Opinion as requirement | Overreach | Distinguish style from correctness |
----
-## Diff Analysis Violations
-### Incorrect Base Branch Detection
-```bash
-# VIOLATION: Hardcoding base branch
-BASE_BRANCH="main"  # Fails if repo uses master or develop
-# VIOLATION: Not verifying branch exists
-git diff main...HEAD  # Errors if main doesn't exist
-```
-### Missing Change Context
-```bash
-# VIOLATION: Getting all files instead of changed files
-git ls-files  # Wrong - includes unchanged files
-# VIOLATION: Missing line-level precision
-git diff --name-only  # Only file names, no line numbers
-```
----
-## PR Comment Violations
-### Commenting on Wrong Lines
-```bash
-# VIOLATION: Commenting without checking if file is in diff
-gh api "repos/${REPO}/pulls/${PR_NUMBER}/comments" \
-    -f path="$FILE" \
-    -f line="$LINE"  # May fail if file not in PR
-# VIOLATION: No rate limiting
-for issue in "${ISSUES[@]}"; do
-    create_pr_comment "$issue"  # Will hit API rate limits
-done
-```
-### Wrong Comment Scope
-```bash
-# VIOLATION: Commenting on pre-existing issues
-# Category 3 issues should NOT get PR comments
-create_pr_comment "file.ts" "456" "Pre-existing bug"  # Wrong!
-# VIOLATION: Missing severity indicator
-create_pr_comment "file.ts" "123" "This is a problem"  # No severity
-```
----
-## Report Violations
-### Missing Structure
-```markdown
-# VIOLATION: Flat list without categories
-- Bug in file.ts:123
-- Security issue in auth.ts:45
-- Style problem in utils.ts:89
-```
-### Missing Context
-```markdown
-# VIOLATION: Issue without remediation
-**Issue**: SQL injection in query.ts:34
-<!-- No fix provided, no severity, no impact -->
-```
-### Incorrect File Naming
-```bash
-# VIOLATION: Non-standard naming
-REPORT_FILE="review.md"  # No timestamp, no branch
-# VIOLATION: Wrong directory
-REPORT_FILE="./reviews/report.md"  # Should be .docs/reviews/
-```
----
-## Detection Patterns
-Use these to find violations in review code:
-```bash
-# Find hardcoded base branches
-grep -r 'BASE_BRANCH="main"' --include="*.sh"
-# Find missing rate limiting
-grep -r 'gh api.*comments' --include="*.sh" | grep -v 'sleep'
-# Find missing severity classifications
-grep -r 'create_pr_comment' --include="*.sh" | grep -v 'CRITICAL\|HIGH\|MEDIUM\|LOW'
-```
----
-## Quick Reference
-See [report-template.md](report-template.md) for proper review format.

package/plugins/devflow-code-review/skills/security-patterns/SKILL.md DELETED Viewed

@@ -1,156 +0,0 @@
----
-name: security-patterns
-description: This skill should be used when reviewing code for injection flaws, auth bypasses, or hardcoded secrets.
-user-invocable: false
-allowed-tools: Read, Grep, Glob
----
-# Security Patterns
-Domain expertise for security vulnerability detection. Use alongside `review-methodology` for complete security reviews.
-## Iron Law
-> **ASSUME ALL INPUT IS MALICIOUS**
->
-> Every user input, URL parameter, header, and cookie is an attack vector. Use parameterized
-> queries always. Escape output always. Validate schemas always. "This field is internal"
-> is not a defense. Defense in depth, not wishful thinking.
----
-## Vulnerability Categories
-### 1. Input Validation & Injection
-**SQL Injection**
-```typescript
-// VULNERABLE
-const query = `SELECT * FROM users WHERE email = '${email}'`;
-// SECURE
-await db.execute("SELECT * FROM users WHERE email = ?", [email]);
-```
-**XSS (Cross-Site Scripting)**
-```typescript
-// VULNERABLE
-element.innerHTML = userInput;
-// SECURE
-element.textContent = userInput;
-```
-> See `references/injection.md` for NoSQL, command injection, path traversal patterns.
-### 2. Authentication & Authorization
-**Missing Auth Checks**
-```typescript
-// VULNERABLE
-app.delete('/api/users/:id', async (req, res) => {
-  await deleteUser(req.params.id);  // No auth!
-});
-// SECURE
-app.delete('/api/users/:id', requireAuth, requireRole('admin'), handler);
-```
-> See `references/auth.md` for password policies, session management, JWT patterns.
-### 3. Cryptography & Secrets
-**Hardcoded Secrets**
-```typescript
-// VULNERABLE
-const API_KEY = 'sk-abc123xyz789';
-// SECURE
-const API_KEY = process.env.API_KEY;
-```
-**Insecure Random**
-```typescript
-// VULNERABLE
-const token = Math.random().toString(36);
-// SECURE
-const token = crypto.randomBytes(32).toString('hex');
-```
-> See `references/crypto.md` for weak crypto detection, encryption patterns.
-### 4. Configuration & Headers
-```typescript
-// REQUIRED: Use helmet or set manually
-app.use(helmet());
-res.setHeader('Content-Security-Policy', "default-src 'self'");
-res.setHeader('X-Frame-Options', 'DENY');
-res.setHeader('Strict-Transport-Security', 'max-age=31536000');
-// CORS: Never use origin: '*'
-app.use(cors({ origin: ['https://myapp.com'], credentials: true }));
-```
-### 5. Business Logic
-**Race Conditions**
-```typescript
-// VULNERABLE
-if (balance >= amount) await withdraw(userId, amount);
-// SECURE: Use transactions with row locks
-await db.transaction(async (tx) => {
-  const balance = await tx.getBalance(userId, { forUpdate: true });
-  if (balance >= amount) await tx.withdraw(userId, amount);
-});
-```
-**Mass Assignment**
-```typescript
-// VULNERABLE
-await User.create(req.body);  // All fields accepted!
-// SECURE: Explicitly list allowed fields
-await User.create({ email: req.body.email, name: req.body.name });
-```
----
-## Extended References
-| Reference | Content |
-|-----------|---------|
-| `references/injection.md` | NoSQL, command, path traversal, LDAP, template injection |
-| `references/auth.md` | Password policy, session management, JWT, RBAC/ABAC |
-| `references/crypto.md` | Secret management, weak crypto, encryption, timing attacks |
-| `references/detection.md` | All grep patterns for automated scanning |
----
-## Severity Guidelines
-| Level | Criteria | Examples |
-|-------|----------|----------|
-| **CRITICAL** | Immediate exploitation | SQL injection in auth, RCE, hardcoded admin creds |
-| **HIGH** | Significant risk | XSS, broken access control, weak crypto, CSRF |
-| **MEDIUM** | Moderate with conditions | Missing headers, permissive CORS, missing rate limits |
-| **LOW** | Minor improvement | Outdated deps (no CVE), suboptimal CSP |
----
-## OWASP Reference
-| ID | Category | Examples |
-|----|----------|----------|
-| A01 | Broken Access Control | Missing auth, IDOR, privilege escalation |
-| A02 | Cryptographic Failures | Weak hashing, hardcoded secrets |
-| A03 | Injection | SQL, NoSQL, command, XSS |
-| A04 | Insecure Design | Missing rate limits, mass assignment |
-| A05 | Security Misconfiguration | Debug enabled, missing headers |
-| A06 | Vulnerable Components | Outdated deps with known CVEs |
-| A07 | Auth Failures | Weak passwords, session issues |
-| A08 | Data Integrity Failures | Untrusted deserialization |
-| A09 | Logging Failures | Missing security logs |
-| A10 | SSRF | Unvalidated URLs in server requests |