devflow-kit 1.8.3 → 2.0.1

package/shared/skills/dependencies-patterns/references/violations.md

@@ -1,247 +0,0 @@
-# Extended Violation Examples
-
-Detailed examples of dependency violations by category.
-
----
-
-## Security Vulnerability Violations
-
-### Known CVEs - Extended Examples
-
-```bash
-# Check for known vulnerabilities
-npm audit
-# or
-yarn audit
-# or
-pnpm audit
-
-# Output example:
-# High: Prototype Pollution in lodash
-# Package: lodash
-# Dependency of: my-package
-# Path: my-package > lodash
-# More info: https://github.com/advisories/GHSA-xxx
-```
-
-### Vulnerable Version Ranges
-
-```json
-// PROBLEM: Wide version range includes vulnerable versions
-{
-  "dependencies": {
-    "lodash": "^4.0.0"  // Includes vulnerable 4.17.0-4.17.20
-  }
-}
-
-// SOLUTION: Pin to safe version or use range excluding vulnerable
-{
-  "dependencies": {
-    "lodash": "^4.17.21"  // First safe version
-  }
-}
-```
-
-### Malicious Package Red Flags
-
-```json
-// RED FLAGS for potentially malicious packages:
-{
-  "dependencies": {
-    "loadsh": "1.0.0",           // Typosquat of "lodash"
-    "event-stream": "3.3.6",     // Known compromised version
-    "random-unknown-pkg": "0.0.1" // No downloads, no repo
-  }
-}
-
-// VERIFY packages:
-// - Check npm page for download counts
-// - Verify repository link
-// - Check maintainer history
-// - Look for typosquatting
-```
-
----
-
-## Version Management Violations
-
-### Unpinned Versions
-
-```json
-// PROBLEM: Can get different versions on each install
-{
-  "dependencies": {
-    "express": "*",           // Any version!
-    "lodash": "latest",       // Whatever is latest
-    "moment": ""              // Empty = latest
-  }
-}
-
-// SOLUTION: Pin exact or use caret with lockfile
-{
-  "dependencies": {
-    "express": "4.18.2",      // Exact pin
-    "lodash": "^4.17.21",     // Caret + lockfile
-    "moment": "~2.29.4"       // Tilde for patch only
-  }
-}
-```
-
-### Missing Lockfile
-
-```bash
-# PROBLEM: No lockfile committed
-.gitignore:
-package-lock.json  # Don't ignore this!
-yarn.lock          # Don't ignore this!
-
-# SOLUTION: Commit lockfile
-git add package-lock.json  # or yarn.lock
-git commit -m "Add lockfile for reproducible builds"
-```
-
-### Dependency Conflicts
-
-```bash
-# PROBLEM: Multiple versions of same package
-npm ls react
-# my-app
-# +-- react@18.2.0
-# \-- some-library
-#     \-- react@17.0.2  # Conflict!
-
-# SOLUTION: Use resolutions/overrides
-# package.json (yarn)
-{
-  "resolutions": {
-    "react": "18.2.0"
-  }
-}
-
-# package.json (npm)
-{
-  "overrides": {
-    "react": "18.2.0"
-  }
-}
-```
-
----
-
-## Dependency Health Violations
-
-### Outdated Packages
-
-```bash
-# Check for outdated
-npm outdated
-
-# Package          Current  Wanted  Latest
-# lodash           4.17.15  4.17.21 4.17.21  # Security update!
-# typescript       4.9.5    4.9.5   5.3.2    # Major version
-# @types/node      18.0.0   18.19.0 20.10.0  # Minor updates
-
-# Prioritize:
-# 1. Security patches (lodash)
-# 2. Bug fixes (minor updates)
-# 3. Major versions (careful review)
-```
-
-### Unused Dependencies
-
-```bash
-# Find unused dependencies
-npx depcheck
-
-# Unused dependencies:
-# * moment           # Listed but never imported
-# * lodash           # Listed but never imported
-
-# SOLUTION: Remove unused
-npm uninstall moment lodash
-```
-
-### Unnecessary Heavy Dependencies
-
-```json
-// PROBLEM: Heavy dependencies for simple tasks
-{
-  "dependencies": {
-    "moment": "^2.29.4",     // 300KB for date formatting
-    "lodash": "^4.17.21",    // 70KB for one function
-    "left-pad": "^1.3.0"     // 1KB for string padding
-  }
-}
-
-// SOLUTION: Use native or lighter alternatives
-// Native date formatting
-new Date().toLocaleDateString();
-
-// Native array methods instead of lodash
-array.filter(x => x.active);
-
-// Native string padding
-'5'.padStart(2, '0');
-
-// Or import only what you need
-import { debounce } from 'lodash/debounce';
-```
-
----
-
-## License Violations
-
-### Incompatible Licenses
-
-```bash
-# Check licenses
-npx license-checker --summary
-
-# Watch for incompatible combinations:
-# - GPL in MIT project (viral license)
-# - Commercial-only licenses
-# - AGPL in SaaS (requires source disclosure)
-
-# Example problematic output:
-# GPL-3.0: some-package  # Requires your code to be GPL too!
-```
-
-### Missing License
-
-```bash
-# Find packages without license
-npx license-checker --onlyunknown
-
-# Packages with unknown license:
-# - internal-company-pkg@1.0.0  # Verify this is intentional
-```
-
----
-
-## Supply Chain Violations
-
-### Transitive Dependencies
-
-```bash
-# Check dependency tree depth
-npm ls --all | wc -l
-# If > 1000, high supply chain risk
-
-# Audit transitive deps
-npm audit --all
-
-# SOLUTION: Minimize dependencies, audit regularly
-```
-
-### Maintainer Concerns
-
-```json
-// RED FLAGS:
-// - Package with 1 maintainer who's inactive
-// - No recent releases but many open issues
-// - Repository archived or deleted
-// - Maintainer account compromised (check news)
-
-// Check package health:
-// https://snyk.io/advisor/npm-package/{package-name}
-```

package/shared/skills/docs-framework/SKILL.md

@@ -1,143 +0,0 @@
----
-name: docs-framework
-description: This skill should be used when the user asks to "create a review report", "write a status log", "add documentation", "name this artifact", or creates files in the .docs/ directory. Provides naming conventions, templates, and directory structure for reviews, debug sessions, design docs, and all persistent DevFlow documentation artifacts.
-user-invocable: false
-allowed-tools: Read, Bash, Glob
----
-
-# Documentation Framework
-
-The canonical source for documentation conventions in DevFlow. All agents that persist artifacts must follow these standards.
-
-## Iron Law
-
-> **ALL ARTIFACTS FOLLOW NAMING CONVENTIONS**
->
-> Timestamps are `YYYY-MM-DD_HHMM`. Branch slugs replace `/` with `-`. Topic slugs are
-> lowercase alphanumeric with dashes. No exceptions. Inconsistent naming breaks tooling,
-> searching, and automation. Follow the pattern or fix the pattern for everyone.
-
----
-
-## Directory Structure
-
-All generated documentation lives under `.docs/` in the project root:
-
-```
-.docs/
-├── reviews/{branch-slug}/              # Code review reports per branch
-│   ├── {type}-report.{timestamp}.md
-│   └── review-summary.{timestamp}.md
-├── status/                             # Development logs
-│   ├── {timestamp}.md
-│   ├── compact/{timestamp}.md
-│   └── INDEX.md
-└── swarm/                              # Swarm operation state
-    ├── state.json
-    └── plans/
-
-.memory/
-├── WORKING-MEMORY.md                   # Auto-maintained by Stop hook (overwritten)
-├── backup.json                         # Pre-compact git state snapshot
-└── knowledge/
-    ├── decisions.md                    # Architectural decisions (ADR-NNN format)
-    └── pitfalls.md                     # Known pitfalls (PF-NNN format)
-```
-
----
-
-## Naming Conventions
-
-### Timestamps
-Format: `YYYY-MM-DD_HHMM` (sortable, readable)
-```bash
-TIMESTAMP=$(date +%Y-%m-%d_%H%M)  # Example: 2025-12-26_1430
-```
-
-### Branch Slugs
-Replace `/` with `-`, sanitize special characters:
-```bash
-BRANCH_SLUG=$(git branch --show-current 2>/dev/null | sed 's/\//-/g' || echo "standalone")
-```
-
-### Topic Slugs
-Lowercase, dashes, alphanumeric only, max 50 chars:
-```bash
-TOPIC_SLUG=$(echo "$TOPIC" | tr '[:upper:]' '[:lower:]' | tr ' ' '-' | sed 's/[^a-z0-9-]//g' | cut -c1-50)
-```
-
-### File Naming Patterns
-
-| Type | Pattern | Example |
-|------|---------|---------|
-| Special indexes | `UPPERCASE.md` | `WORKING-MEMORY.md`, `INDEX.md` |
-| Reports | `{type}-report.{timestamp}.md` | `security-report.2025-12-26_1430.md` |
-| Status logs | `{timestamp}.md` | `2025-12-26_1430.md` |
-
----
-
-## Helper Functions
-
-Source helpers for consistent naming:
-
-```bash
-source .devflow/scripts/docs-helpers.sh 2>/dev/null || {
-    get_timestamp() { date +%Y-%m-%d_%H%M; }
-    get_branch_slug() { git branch --show-current 2>/dev/null | sed 's/\//-/g' || echo "standalone"; }
-    get_topic_slug() { echo "$1" | tr '[:upper:]' '[:lower:]' | tr ' ' '-' | sed 's/[^a-z0-9-]//g' | cut -c1-50; }
-    ensure_docs_dir() { mkdir -p ".docs/$1"; }
-}
-```
-
----
-
-## Agent Persistence Rules
-
-### Agents That Persist Artifacts
-
-| Agent | Output Location | Behavior |
-|-------|-----------------|----------|
-| Reviewer | `.docs/reviews/{branch-slug}/{type}-report.{timestamp}.md` | Creates new |
-| Working Memory | `.memory/WORKING-MEMORY.md` | Overwrites (auto-maintained by Stop hook) |
-| Knowledge (decisions) | `.memory/knowledge/decisions.md` | Append-only (ADR-NNN sequential IDs) |
-| Knowledge (pitfalls) | `.memory/knowledge/pitfalls.md` | Append-only (PF-NNN sequential IDs) |
-
-### Agents That Don't Persist
-
-- Git (fetch-issue: read-only, comment-pr: PR comments only)
-- Coder (commits to git, no .docs/ output)
-
----
-
-## Implementation Checklist
-
-When creating or modifying persisting agents:
-
-- [ ] Use standard timestamp format (`YYYY-MM-DD_HHMM`)
-- [ ] Sanitize branch names (replace `/` with `-`)
-- [ ] Sanitize topic names (lowercase, dashes, alphanumeric)
-- [ ] Create directory with `mkdir -p .docs/{subdir}`
-- [ ] Document output location in agent's final message
-- [ ] Follow special file naming (UPPERCASE for indexes)
-- [ ] Use helper functions when possible
-- [ ] Update relevant index files
-
----
-
-## Integration
-
-This framework is used by:
-- **Review agents**: Creates review reports
-- **Working Memory hooks**: Auto-maintains `.memory/WORKING-MEMORY.md`
-- **Command flows**: `/implement` appends ADRs to `decisions.md`; `/code-review`, `/debug`, `/resolve` append PFs to `pitfalls.md`
-
-All persisting agents should load this skill to ensure consistent documentation.
-
----
-
-## Extended References
-
-For detailed patterns and violation examples:
-
-- **[patterns.md](./references/patterns.md)** - Full templates, helper functions, naming examples, edge cases
-- **[violations.md](./references/violations.md)** - Common violations with detection patterns and fixes