liteagents 2.8.0 → 2.8.2

package/CHANGELOG.md

@@ -17,6 +17,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.8.2] - 2026-05-24
+
+Maintenance release: removes the last of the legacy 3-variant system, fixes the broken `liteag` alias and post-install message, and trims the shipped documentation down to the README plus an accurate installer guide. No changes to the installed agents/commands/skills.
+
+### Fixed
+- **`npm test` (the CI publish gate) was failing, blocking releases.** The installer test suites still assumed the removed 3-variant system (Lite/Standard/Pro). The multi-tool suite has been rewritten for the single-variant installer (one `pro` package per tool), and the cross-platform suite's terminal checks no longer assert raw environment presence (`stdout` TTY, `TERM`, `SHELL`) — those failed whenever output is piped (i.e. always under the runner and in CI). They now verify the installer's graceful fallback instead. `npm test` passes 138/138, including under a minimal CI environment.
+- **The `liteag` short alias was broken.** Its `cli.js` was a leftover 3-variant wrapper that defaulted to a non-existent `standard` variant, looked for a `.claude-plugin/plugin-standard.json` that no longer exists, and exited 1. It now simply forwards all arguments to the real interactive installer (`installer/cli.js`), so `liteag` and `liteagents` behave identically (check existing installs, backup, install, uninstall). The actual installer was not modified.
+- **`postinstall` pointed at a command that doesn't exist.** The post-install message told users to run `$ agentic-kit`; the published bin is `liteagents`. Corrected.
+
+### Added
+- **Content-integrity check in the multi-tool test suite.** It now pins the expected per-tool counts of agents, commands, skills, and plugins (counting `.md` dispatch entries and skill/plugin directories, not raw files). Accidentally adding or removing a command/skill/agent fails the publish gate with the exact delta until the expected number is updated deliberately — so the CI gate now protects what actually ships, not just installer plumbing.
+
+### Changed
+- **Rewrote `docs/INSTALLER_GUIDE.md` to match the actual installer** (1586 → ~430 lines). Removed the entire fictional "Command-Line Flags" section (the installer takes no flags — it is interactive only), the Lite/Standard/Pro variant system, invented agent lists and component counts, and corrected the default install paths (`~/.config/opencode`, `~/.config/amp`, `~/.factory` — the old guide listed `~/.opencode`/`~/.ampcode`/`~/.droid`, none of which the installer uses). Added an accurate interactive walkthrough and an Uninstalling section, and dropped links to deleted/nonexistent docs.
+
+### Removed
+- **Trimmed `docs/` to one guide.** Removed 20 internal/maintainer/stale docs (~7,500 lines) that shipped to users — implementation notes, QA/test reports, `pass`/publishing guides, the variant-era `MIGRATION.md`/`RELEASE_NOTES_1.2.0.md`, `KNOWLEDGE_BASE.md`, `CONTRIBUTING.md`, `PRIVACY.md` (telemetry is a no-op stub), `SECURITY.md`, etc. The README plus the rewritten `docs/INSTALLER_GUIDE.md` are the documentation now.
+- **Stopped shipping `docs/` in the npm package** (dropped from `package.json` `files`, along with the broken root `QUICK-START.md`/`TROUBLESHOOTING.md` entries that never existed). End users get the README; the installer guide lives in the repo. Fixed the README's broken doc links and pointed `CLAUDE.md` and the package validator at the surviving guide.
+- Stale `variant-system` npm keyword — there is one package per tool, not a variant matrix.
+- Dead 3-variant migration code in `installer/path-manager.js` (`detectLegacyInstallation`, `countLegacyComponents`, `classifyVariantFromComponents`, `createManifestForLegacy`). These classified pre-1.2.0 installs into lite/standard/pro by counting `resources`/`hooks` dirs that no longer exist, and nothing in the installer ever called them. Verified the installer still installs, backs up, and uninstalls correctly after removal; `npm test` 138/138 and the installation-engine suite 60/60 still pass.
+- Obsolete documentation describing removed features: `docs/VARIANT_CONFIGURATION.md`, `docs/UPDATED_VARIANT_CONFIGURATION.md` (the 3-variant matrix), `docs/SILENT_MODE_GUIDE.md` and `docs/INSTALLATION_DEMO.md` (a `--variant`/`--tools`/`--silent` flag CLI the installer never had — it is interactive only). Dropped the stale `VARIANT_CONFIGURATION.md` entry from `scripts/validate-package.js`.
+
+---
+
+## [2.8.1] - 2026-05-22
+
+### Changed
+- **`/security` and `/ship` rewritten across all four tools (claude, opencode, ampcode, droid).** Both were thin stubs; they're now substantive, stack-agnostic gates that apply to libraries, CLIs, web apps, and services alike.
+  - `/security` leads with the six failure classes that recur in nearly every quickly-built app — secrets committed to the repo, data-access / tenant isolation, rate limiting (including authenticated write routes), error handling past the happy path, authorization-beyond-authentication (IDOR / privilege), and N+1 / unindexed data access — plus a trust-boundary pass (spoofable headers like `X-Forwarded-For`, services bound to `0.0.0.0`, unvalidated untrusted input) and severity-ranked, coverage-auditable output.
+  - `/ship` is now stack-adaptive: it detects the toolchain (`package.json`, `pyproject.toml`, `go.mod`, `Cargo.toml`, `Makefile`) and runs only the checks that exist instead of assuming `npm run lint`/`build`/`migrate`, and adds gates for authorization, rate limiting, data-access scoping, error handling, and secret-scanning before deploy.
+
+### Fixed
+- **`allowed-tools` permission syntax normalized to the canonical colon form** (`Bash(git:*)`) in the claude package's `ship.md`, `security.md`, and `git-commit.md` — the space form (`Bash(git *)`) is not a valid Claude Code permission wildcard. The opencode/ampcode/droid packages retain their existing space-form syntax (their runners parse `allowed-tools` differently, if at all), so there is no behavior change there.
+
+---
+
 ## [2.8.0] - 2026-05-18
 
 ### Added

package/README.md

@@ -166,10 +166,7 @@ Results land in `.claude/friction/antigen_review.md` with projects, error patter
 
 | Document | Description |
 |----------|-------------|
-| **[INSTALLER_GUIDE.md](docs/INSTALLER_GUIDE.md)** | Complete installation guide with troubleshooting |
-| **[KNOWLEDGE_BASE.md](docs/KNOWLEDGE_BASE.md)** | Complete reference: agents, commands, architecture |
-| **[QUICK-START.md](QUICK-START.md)** | 15-minute onboarding guide |
-| **[TROUBLESHOOTING.md](TROUBLESHOOTING.md)** | Common issues and solutions |
+| **[INSTALLER_GUIDE.md](docs/INSTALLER_GUIDE.md)** | Complete installation guide, troubleshooting, and FAQ |
 | **[subagentic-manual.md](packages/subagentic-manual.md)** | Detailed agent/command reference |
 
 ---
@@ -224,4 +221,4 @@ Apache-2.0 © 2026 hamr0 — see [LICENSE](LICENSE).
 
 ---
 
-**Need help?** Check [TROUBLESHOOTING.md](TROUBLESHOOTING.md) or [open an issue](https://github.com/hamr0/liteagents/issues)
+**Need help?** See the [Installer Guide](docs/INSTALLER_GUIDE.md) or [open an issue](https://github.com/hamr0/liteagents/issues)

package/cli.js

@@ -1,230 +1,20 @@
 #!/usr/bin/env node
 
 /**
- * Agentic Toolkit CLI Wrapper
+ * `liteag` — short alias for the `liteagents` installer.
  *
- * This script provides npx support for the agentic-toolkit package.
- * It handles variant selection and provides helpful CLI output for users.
- *
- * Usage:
- *   npx liteagents              # Install standard variant (default)
- *   npx liteagents --variant=lite   # Install lite variant via flag
- *   npx liteagents --variant=pro    # Install pro variant via flag
- *   npx agkit                              # Shorter alias
- *   npx liteagents --help       # Show help message
+ * Forwards all arguments to the interactive installer (installer/cli.js),
+ * which checks for existing installs, backs up, installs to each tool's
+ * path, and uninstalls. This wrapper adds no behavior of its own.
  */
 
-const fs = require('fs');
 const path = require('path');
+const { spawnSync } = require('child_process');
 
-// ANSI color codes for terminal output
-const colors = {
-  reset: '\x1b[0m',
-  bright: '\x1b[1m',
-  green: '\x1b[32m',
-  blue: '\x1b[34m',
-  yellow: '\x1b[33m',
-  cyan: '\x1b[36m',
-  magenta: '\x1b[35m'
-};
-
-// Parse command line arguments
-const args = process.argv.slice(2);
-const hasHelpFlag = args.includes('--help') || args.includes('-h');
-const variantFlag = args.find(arg => arg.startsWith('--variant='));
-const requestedVariant = variantFlag ? variantFlag.split('=')[1] : null;
-
-/**
- * Display help message
- */
-function showHelp() {
-  console.log(`
-${colors.bright}${colors.cyan}Agentic Toolkit${colors.reset} - AI-Driven Software Development Toolkit
-
-${colors.bright}DESCRIPTION:${colors.reset}
-  Comprehensive toolkit with 13 specialized agents and 14 powerful skills
-  for agile software development, product management, and content creation.
-
-${colors.bright}VARIANTS:${colors.reset}
-  ${colors.green}lite${colors.reset}        3 agents, 0 skills  - Minimal dependencies
-  ${colors.blue}standard${colors.reset}    13 agents, 8 skills - Recommended for most users
-  ${colors.magenta}pro${colors.reset}         13 agents, 14 skills - Maximum capabilities
-
-${colors.bright}USAGE:${colors.reset}
-  ${colors.cyan}npx liteagents${colors.reset}                # Install standard variant (default)
-  ${colors.cyan}npx liteagents --variant=lite${colors.reset} # Install lite variant via flag
-  ${colors.cyan}npx liteagents --variant=pro${colors.reset}  # Install pro variant via flag
-  ${colors.cyan}npx agkit${colors.reset}                                # Shorter alias
-
-${colors.bright}CLAUDE CODE MARKETPLACE:${colors.reset}
-  You can also install this plugin directly in Claude Code:
-
-  ${colors.cyan}/plugin marketplace add agentic-kit${colors.reset}          # Standard variant
-  ${colors.cyan}/plugin marketplace add agentic-kit-lite${colors.reset}     # Lite variant
-  ${colors.cyan}/plugin marketplace add agentic-kit-pro${colors.reset}      # Pro variant
-
-${colors.bright}AGENT INVOCATION:${colors.reset}
-  After installation, invoke agents using:
-  ${colors.cyan}@Master:${colors.reset} [your request]
-  ${colors.cyan}@Orchestrator:${colors.reset} [your request]
-  ${colors.cyan}@ProductManager:${colors.reset} [your request]
-
-${colors.bright}MORE INFORMATION:${colors.reset}
-  README:        https://github.com/yourusername/agentic-toolkit#readme
-  Documentation: See README.md, QUICK-START.md, and VARIANTS.md
-  Issues:        https://github.com/yourusername/agentic-toolkit/issues
-
-${colors.bright}VERSION:${colors.reset}
-  1.0.0
-`);
-}
-
-/**
- * Display variant information
- */
-function showVariantInfo(variant) {
-  const variantInfo = {
-    lite: {
-      name: 'Lite',
-      color: colors.green,
-      agents: 3,
-      skills: 0,
-      description: 'Minimal dependencies with 3 core agents',
-      agents_list: ['Master', 'Orchestrator', 'Scrum Master']
-    },
-    standard: {
-      name: 'Standard',
-      color: colors.blue,
-      agents: 13,
-      skills: 8,
-      description: 'All 13 agents with 8 core production skills',
-      skills_list: ['PDF', 'DOCX', 'XLSX', 'PPTX', 'Canvas Design', 'Theme Factory', 'Brand Guidelines', 'Internal Communications']
-    },
-    pro: {
-      name: 'Pro',
-      color: colors.magenta,
-      agents: 13,
-      skills: 16,
-      description: 'All 13 agents with complete skill set (16 skills)',
-      skills_list: ['All Standard skills', '+ 8 advanced skills']
-    }
-  };
-
-  const info = variantInfo[variant];
-
-  console.log(`
-${colors.bright}${info.color}Agentic Toolkit - ${info.name} Variant${colors.reset}
-
-${colors.bright}SELECTED VARIANT:${colors.reset}
-  ${info.color}${info.name}${colors.reset} - ${info.description}
-
-${colors.bright}FEATURES:${colors.reset}
-  Agents: ${colors.cyan}${info.agents}${colors.reset}
-  Skills: ${colors.cyan}${info.skills}${colors.reset}
-
-${colors.bright}INSTALLATION:${colors.reset}
-  This plugin is now ready to use with Claude Code.
-
-${colors.bright}GETTING STARTED:${colors.reset}
-  1. Verify installation by typing: ${colors.cyan}@Master: *help${colors.reset}
-  2. See available agents and their capabilities
-  3. Read QUICK-START.md for example workflows
-
-${colors.bright}EXAMPLE COMMANDS:${colors.reset}
-  ${colors.cyan}@Master:${colors.reset} Show me what you can do
-  ${colors.cyan}@Orchestrator:${colors.reset} Help me plan a new feature
-  ${colors.cyan}@ProductManager:${colors.reset} Create a PRD for user authentication
-
-${colors.bright}DOCUMENTATION:${colors.reset}
-  ${colors.yellow}README.md${colors.reset}           - Full documentation
-  ${colors.yellow}QUICK-START.md${colors.reset}      - Getting started guide
-  ${colors.yellow}VARIANTS.md${colors.reset}         - Variant comparison
-  ${colors.yellow}TROUBLESHOOTING.md${colors.reset}  - Common issues and solutions
-
-${colors.green}Installation successful!${colors.reset}
-`);
-}
-
-/**
- * Detect variant from npm package tag or flags
- */
-function detectVariant() {
-  // Check for explicit variant flag
-  if (requestedVariant) {
-    if (['lite', 'standard', 'pro'].includes(requestedVariant)) {
-      return requestedVariant;
-    } else {
-      console.error(`${colors.yellow}Warning:${colors.reset} Invalid variant '${requestedVariant}'. Using 'standard' instead.`);
-      console.error(`Valid variants: lite, standard, pro`);
-      return 'standard';
-    }
-  }
-
-  // Check npm package tag (when installed via npm install agentic-kit@lite, etc.)
-  // This would be available in process.env.npm_package_config_variant
-  // For now, default to 'standard'
-  return 'standard';
-}
-
-/**
- * Verify plugin manifest exists for selected variant
- */
-function verifyManifest(variant) {
-  const manifestPath = path.join(__dirname, '.claude-plugin', `plugin-${variant}.json`);
-
-  if (!fs.existsSync(manifestPath)) {
-    console.error(`${colors.yellow}Warning:${colors.reset} Manifest file not found: ${manifestPath}`);
-    console.error(`This may indicate an incomplete installation.`);
-    return false;
-  }
-
-  try {
-    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-    if (manifest.variant !== variant) {
-      console.error(`${colors.yellow}Warning:${colors.reset} Manifest variant mismatch. Expected '${variant}', found '${manifest.variant}'`);
-      return false;
-    }
-    return true;
-  } catch (error) {
-    console.error(`${colors.yellow}Error:${colors.reset} Failed to parse manifest: ${error.message}`);
-    return false;
-  }
-}
-
-/**
- * Main CLI execution
- */
-function main() {
-  // Show help if requested
-  if (hasHelpFlag) {
-    showHelp();
-    process.exit(0);
-  }
-
-  // Detect which variant to use
-  const variant = detectVariant();
-
-  // Display welcome message
-  console.log(`${colors.bright}${colors.cyan}Initializing Agentic Toolkit...${colors.reset}\n`);
-
-  // Verify the manifest exists
-  const manifestValid = verifyManifest(variant);
-
-  if (!manifestValid) {
-    console.error(`\n${colors.yellow}Installation may be incomplete. Please check the package contents.${colors.reset}`);
-    console.error(`If problems persist, reinstall with: ${colors.cyan}npm install agentic-kit@${variant}${colors.reset}\n`);
-    process.exit(1);
-  }
-
-  // Show variant information
-  showVariantInfo(variant);
-
-  // For Claude Code plugin installation, the actual plugin loading
-  // is handled by Claude Code itself. This CLI just provides helpful
-  // output and verification.
-
-  process.exit(0);
-}
+const installer = path.join(__dirname, 'installer', 'cli.js');
+const result = spawnSync(process.execPath, [installer, ...process.argv.slice(2)], {
+  stdio: 'inherit'
+});
 
-// Run the CLI
-main();
+// Mirror the installer's exit code; treat signal termination as failure.
+process.exit(result.status === null ? 1 : result.status);

package/installer/path-manager.js

@@ -223,205 +223,6 @@ class PathManager {
     return fullPath;
   }
 
-  /**
-   * Detect legacy installation (from version < 1.2.0)
-   * Legacy installations don't have manifest.json
-   *
-   * @param {string} toolId - Tool identifier (claude, opencode, ampcode, droid)
-   * @returns {Promise<Object>} Detection result with installation details
-   */
-  async detectLegacyInstallation(toolId) {
-    const installPath = this.getDefaultPath(toolId);
-    if (!installPath) {
-      return { isLegacy: false, exists: false };
-    }
-
-    const fullPath = this.expandPath(installPath);
-
-    try {
-      // Check if directory exists
-      const dirStats = await fs.promises.stat(fullPath);
-      if (!dirStats.isDirectory()) {
-        return { isLegacy: false, exists: false };
-      }
-
-      // Check for manifest.json
-      const manifestPath = path.join(fullPath, 'manifest.json');
-      const hasManifest = fs.existsSync(manifestPath);
-
-      if (hasManifest) {
-        // Has manifest, not a legacy installation
-        return {
-          isLegacy: false,
-          exists: true,
-          path: fullPath,
-          reason: 'Installation has manifest.json (v1.2.0+)'
-        };
-      }
-
-      // No manifest - this is a legacy installation
-      // Count components to classify variant
-      const components = await this.countLegacyComponents(fullPath);
-
-      // Classify variant based on component counts
-      const variant = this.classifyVariantFromComponents(components);
-
-      return {
-        isLegacy: true,
-        exists: true,
-        path: fullPath,
-        components: components,
-        suggestedVariant: variant,
-        reason: 'No manifest.json found (pre-1.2.0 installation)'
-      };
-    } catch (error) {
-      return {
-        isLegacy: false,
-        exists: false,
-        error: error.message
-      };
-    }
-  }
-
-  /**
-   * Count components in legacy installation
-   *
-   * @private
-   * @param {string} installPath - Installation directory path
-   * @returns {Promise<Object>} Component counts
-   */
-  async countLegacyComponents(installPath) {
-    const components = {
-      agents: 0,
-      skills: 0,
-      resources: 0,
-      hooks: 0
-    };
-
-    // Count agents
-    try {
-      const agentsDir = path.join(installPath, 'agents');
-      const agentFiles = await fs.promises.readdir(agentsDir);
-      components.agents = agentFiles.filter(f => f.endsWith('.md')).length;
-    } catch (error) {
-      // Directory doesn't exist or can't read
-      components.agents = 0;
-    }
-
-    // Count skills
-    try {
-      const skillsDir = path.join(installPath, 'skills');
-      const skillFiles = await fs.promises.readdir(skillsDir);
-      components.skills = skillFiles.filter(f => f.endsWith('.md')).length;
-    } catch (error) {
-      components.skills = 0;
-    }
-
-    // Count resources
-    try {
-      const resourcesDir = path.join(installPath, 'resources');
-      const resourceFiles = await fs.promises.readdir(resourcesDir);
-      components.resources = resourceFiles.length;
-    } catch (error) {
-      components.resources = 0;
-    }
-
-    // Count hooks
-    try {
-      const hooksDir = path.join(installPath, 'hooks');
-      const hookFiles = await fs.promises.readdir(hooksDir);
-      components.hooks = hookFiles.filter(f => f.endsWith('.js')).length;
-    } catch (error) {
-      components.hooks = 0;
-    }
-
-    return components;
-  }
-
-  /**
-   * Classify variant based on component counts
-   *
-   * @private
-   * @param {Object} components - Component counts
-   * @returns {string} Suggested variant (lite, standard, pro, or custom)
-   */
-  classifyVariantFromComponents(components) {
-    const { agents, skills } = components;
-
-    // Lite: 3 agents, 0 skills
-    if (agents === 3 && skills === 0) {
-      return 'lite';
-    }
-
-    // Pro: 13 agents, 9+ skills
-    if (agents >= 13 && skills >= 9) {
-      return 'pro';
-    }
-
-    // Standard: 13 agents, 1-8 skills (or close to it)
-    if (agents >= 10 && skills >= 1 && skills <= 8) {
-      return 'standard';
-    }
-
-    // If 3 agents or fewer, likely lite
-    if (agents <= 3) {
-      return 'lite';
-    }
-
-    // If many agents (10+), likely standard or pro
-    if (agents >= 10) {
-      return skills >= 9 ? 'pro' : 'standard';
-    }
-
-    // Default to standard for anything in between
-    return 'standard';
-  }
-
-  /**
-   * Create manifest for legacy installation
-   *
-   * @param {string} toolId - Tool identifier
-   * @param {Object} components - Component counts
-   * @param {string} variant - Classified variant
-   * @returns {Promise<Object>} Created manifest
-   */
-  async createManifestForLegacy(toolId, components, variant) {
-    const installPath = this.expandPath(this.getDefaultPath(toolId));
-    const manifestPath = path.join(installPath, 'manifest.json');
-
-    const manifest = {
-      tool: toolId,
-      variant: variant,
-      version: '1.2.0',
-      installed_at: new Date().toISOString(),
-      migrated_from: 'legacy',
-      components: components,
-      paths: {
-        agents: path.join(installPath, 'agents'),
-        skills: path.join(installPath, 'skills'),
-        resources: path.join(installPath, 'resources'),
-        hooks: path.join(installPath, 'hooks')
-      },
-      files: {
-        total: components.agents + components.skills + components.resources + components.hooks,
-        size: 'unknown'
-      },
-      migration: {
-        from_version: 'unknown',
-        migrated_at: new Date().toISOString(),
-        migration_type: 'automatic'
-      }
-    };
-
-    // Write manifest with secure permissions
-    await fs.promises.writeFile(
-      manifestPath,
-      JSON.stringify(manifest, null, 2),
-      { mode: 0o600 }
-    );
-
-    return manifest;
-  }
 }
 
 module.exports = PathManager;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "liteagents",
-  "version": "2.8.0",
+  "version": "2.8.2",
   "description": "AI development toolkit with 11 specialized agents and 23 commands including live-canvas UI design with click-to-annotate feedback. Simple one-question installer for Claude, Opencode, Ampcode, and Droid.",
   "main": "index.js",
   "bin": {
@@ -42,8 +42,7 @@
     "xlsx",
     "pptx",
     "document-generation",
-    "cli",
-    "variant-system"
+    "cli"
   ],
   "author": "hamr0 <avoidaccess@msn.com>",
   "license": "Apache-2.0",
@@ -66,13 +65,10 @@
     "installer/",
     "packages/",
     "tools/",
-    "docs/",
     "cli.js",
     "index.js",
     "postinstall.js",
     "README.md",
-    "QUICK-START.md",
-    "TROUBLESHOOTING.md",
     "CHANGELOG.md",
     "LICENSE"
   ],

package/packages/ampcode/commands/security.md

@@ -3,19 +3,57 @@ name: security
 description: Scan security [target]
 usage: /security
 argument-hint: [file, directory, or leave empty for full scan]
-allowed-tools: Read, Grep, Glob
+allowed-tools: Read, Grep, Glob, Bash(git log *), Bash(git grep *), Bash(rg *)
 ---
-Audit $ARGUMENTS for security vulnerabilities.
+Audit $ARGUMENTS for security vulnerabilities. Adapt scope to what the target
+actually is — a library, CLI, web app, and service won't all have every
+category. Skip what genuinely doesn't apply; never invent findings to fill a
+section.
 
-## Check For
-- Injection: SQL, command, XSS, template
-- Auth: Weak passwords, session issues, CSRF
-- Data: Exposure, logging secrets, insecure storage
-- Config: Debug mode, default creds, missing headers
-- Dependencies: Known CVEs
+## The recurring six (check every project, where applicable)
+These show up in nearly every quickly-built app regardless of stack:
+
+1. **Secrets in the repo.** Tokens / API keys / `.env` files committed to
+   tracked files or anywhere in git history. Verify `.env` is gitignored and
+   only a value-less `.env.example` is tracked; scan history (`git log -p`,
+   `git grep`) for leaked keys. Secrets must load from env / a secret store at
+   runtime — never hardcoded, never logged.
+2. **Data-access authorization (tenant isolation).** Every record read or
+   written must be scoped to the requesting principal — via DB-level rules
+   (RLS / row policies) and/or application-layer ownership checks. Flag any
+   query that trusts a client-supplied id without an ownership or role gate,
+   and any table/collection with a policy that's too broad or missing.
+3. **Rate limiting.** Every externally reachable endpoint and abuse-prone
+   inbound path is bounded — including **authenticated mutation/write routes**,
+   not just the obvious public GETs. Note any unbounded route.
+4. **Error handling past the happy path.** Third-party / IO / DB failures are
+   caught; nothing fails silently; no internal detail (stack traces, queries,
+   secrets) leaks to the client. Background/async work has its own catch.
+5. **Authorization beyond authentication (IDOR / privilege).** "Logged in" is
+   not "allowed to do this". Confirm ownership AND role/permission checks on
+   every state-changing or privileged action. Mentally swap an id in a request
+   — does it return 403, or does it leak/modify another user's data?
+6. **Inefficient data access (N+1 / unindexed).** Queries inside loops,
+   per-render repeated calls, missing indexes on filtered/joined columns.
+   Correct but falls over under load — a real availability risk.
+
+## Also scan for
+- **Injection:** SQL, command, XSS, template, path traversal.
+- **Auth/session:** weak token handling, CSRF, session fixation, predictable ids.
+- **Trust boundaries:** spoofable headers (e.g. `X-Forwarded-For`) trusted
+  without a vetted proxy; unvalidated untrusted input (uploads, inbound mail,
+  webhooks); services bound to `0.0.0.0` that should be loopback-only.
+- **Config:** debug mode on in prod, default creds, missing security headers,
+  permissive CORS.
+- **Dependencies:** known CVEs; unmaintained or single-maintainer deps in
+  security-critical paths.
 
 ## Output
-Severity-ranked findings with:
-- Location (file:line)
-- Risk explanation
-- Remediation steps
+Severity-ranked findings (Critical → High → Medium → Low), each with:
+- **Location** (`file:line`)
+- **Risk** — what an attacker actually gains
+- **Remediation** — concrete, minimal fix
+
+End with: which of the six classes were checked and found **clean**, and any
+marked **N/A** for this target — so the scan's coverage is auditable, not just
+its hits.

package/packages/ampcode/commands/ship.md

@@ -2,17 +2,39 @@
 name: ship
 description: Check pre-deployment
 usage: /ship
-allowed-tools: Bash(npm *), Bash(git *)
+allowed-tools: Read, Grep, Glob, Bash(git *), Bash(npm *), Bash(pnpm *), Bash(yarn *), Bash(pytest *), Bash(python *), Bash(go *), Bash(cargo *), Bash(make *)
 ---
-Pre-deploy checklist:
+Pre-deploy / pre-merge gate. **Detect the stack first** (look for
+`package.json`, `pyproject.toml`/`setup.cfg`, `go.mod`, `Cargo.toml`,
+`Makefile`) and run only the checks that actually exist — never assume a
+script (`lint`, `build`, `migrate`) is present. Report each item as
+**pass / fail / N/A**.
 
-- [ ] Tests pass (`npm test`)
-- [ ] Lint clean (`npm run lint`)
-- [ ] Build succeeds (`npm run build`)
-- [ ] No console.log/debugger statements
-- [ ] Env vars documented
-- [ ] No hardcoded secrets
-- [ ] Error handling complete
-- [ ] Migrations ready
+## Checklist
+- [ ] **Tests pass** — run the project's real test command (`npm test`,
+      `pytest`, `go test ./...`, `cargo test`, `make test`).
+- [ ] **Lint / format clean** — only if a linter or formatter is configured.
+- [ ] **Build succeeds** — only if the project has a build step.
+- [ ] **No debug leftovers** — stray `console.log` / `print` / `debugger` /
+      `dbg!` / commented-out blocks / blocker `TODO`s in the changed files.
+- [ ] **No hardcoded secrets** — scan the diff. Secrets load from env / a
+      secret store; `.env` is gitignored and only a value-less `.env.example`
+      is tracked.
+- [ ] **Error handling complete** — every new IO / network / DB call has a
+      failure path; nothing fails silently; no internal detail leaks to clients.
+- [ ] **Authorization** — new endpoints/actions check **ownership + role**,
+      not just authentication (no IDOR via id-swapping).
+- [ ] **Rate limiting** — new externally reachable routes, including
+      authenticated writes, are bounded.
+- [ ] **Data access scoped & scales** — new queries are constrained to the
+      requesting principal (no cross-tenant leak) and avoid obvious N+1 /
+      unindexed scans on hot paths.
+- [ ] **Migrations ready** — only if the project has a schema / migrations.
+- [ ] **Docs & config in sync** — `.env.example`, README, and any
+      threat-model / PRD updated for new config or new attack surface.
+- [ ] **Clean tree, correct branch, in sync with `origin`.**
 
-Run checks and report: Ready 🚀 or Blocked 🛑 with issues.
+For any security-sensitive change in the diff, run **`/security`** on the
+changed files before shipping.
+
+Report: **Ready 🚀** or **Blocked 🛑** with the specific failing items.

package/packages/claude/commands/git-commit.md

@@ -2,7 +2,7 @@
 name: git-commit
 description: Analyze changes and commit
 usage: /git-commit
-allowed-tools: Bash(git *)
+allowed-tools: Bash(git:*)
 ---
 1. Run `git diff --staged` to see changes
 2. Analyze what was changed and why