mdan-cli 2.5.0 → 2.5.2

package/templates/SECURITY-REVIEW.md

@@ -1,99 +0,0 @@
-# MDAN Template — Security Review
-
----
-**Artifact:** Security Review
-**Phase:** VERIFY
-**Agent:** Security Agent v1.0.0
-**Version:** [X.Y]
-**Status:** Draft | Review | Signed Off
-**Date:** [YYYY-MM-DD]
-**Project:** [Project Name]
----
-
-## 1. Threat Model (STRIDE)
-
-### Assets à protéger
-| Asset | Sensibilité | Localisation |
-|-------|-------------|--------------|
-| Credentials utilisateurs | Critique | DB (hashés) |
-| Données personnelles | Élevée | DB |
-| Clés API | Critique | Variables d'environnement |
-
-### Surface d'attaque
-| Point d'entrée | Description | Niveau de risque |
-|---------------|-------------|-----------------|
-| API REST | Endpoints HTTP publics | Élevé |
-| Interface admin | Dashboard interne | Moyen |
-
-### Analyse STRIDE
-| Menace | Composant | Mitigation |
-|--------|-----------|-----------|
-| Spoofing | Auth | JWT + refresh tokens |
-| Tampering | API inputs | Validation stricte |
-| Repudiation | Actions user | Audit logging |
-| Info Disclosure | API responses | Filtrage des réponses |
-| DoS | Endpoints publics | Rate limiting |
-| Elevation of Privilege | RBAC | Vérification sur chaque endpoint |
-
-## 2. Findings
-
-### 🔴 CRITICAL — Bloquer la release
-
-#### VULN-001: [Nom]
-- **Type :** [Catégorie OWASP]
-- **Localisation :** [Fichier/Endpoint]
-- **Description :** [Ce que c'est]
-- **Impact :** [Ce qu'un attaquant peut faire]
-- **Reproduction :** [Comment reproduire]
-- **Remédiation :** [Fix exact avec code si applicable]
-- **Statut :** ⏳ Open | ✅ Fixed | ⚠️ Accepted
-
-### 🟠 HIGH — Corriger avant release
-
-### 🟡 MEDIUM — Corriger dans le prochain sprint
-
-### 🔵 LOW — Tracker et corriger éventuellement
-
-## 3. Security Checklist
-
-### Authentification
-- [ ] Mots de passe hashés avec bcrypt/argon2 (cost factor ≥ 12)
-- [ ] Tokens JWT avec expiration + refresh
-- [ ] Protection brute force (rate limiting sur /auth)
-- [ ] Invalidation de session au logout
-
-### Autorisation
-- [ ] Vérification auth sur CHAQUE endpoint protégé
-- [ ] Contrôle d'accès horizontal (user A ne peut pas accéder aux données de user B)
-- [ ] RBAC implémenté correctement
-- [ ] Fonctions admin séparément protégées
-
-### Validation des inputs
-- [ ] Tous les inputs validés côté serveur
-- [ ] Requêtes SQL paramétrées (jamais d'interpolation)
-- [ ] Uploads : validation type, taille, stockage hors web root
-- [ ] Encoding des outputs pour prévenir XSS
-
-### Protection des données
-- [ ] HTTPS enforced partout
-- [ ] Données sensibles non loggées
-- [ ] PII traité selon exigences réglementaires
-- [ ] Backups chiffrés
-
-### Dépendances
-- [ ] Aucune CVE critique connue dans les dépendances
-- [ ] Lockfile commité
-- [ ] Scan CVE automatisé en CI/CD
-
-## 4. Sign-Off
-
-| Findings | Total | Résolus | Acceptés | Restants |
-|----------|-------|---------|----------|---------|
-| Critical | — | — | — | — |
-| High | — | — | — | — |
-| Medium | — | — | — | — |
-| Low | — | — | — | — |
-
-**Security sign-off :** ________________ **Date :** ________________
-
-*Conditions de sign-off : 0 Critical open, 0 High open (ou acceptés avec justification documentée)*

package/templates/TEST-PLAN.md

@@ -1,97 +0,0 @@
-# MDAN Template — Test Plan
-
----
-**Artifact:** Test Plan
-**Phase:** VERIFY
-**Agent:** Test Agent v1.0.0
-**Version:** [X.Y]
-**Status:** Draft | Review | Validated
-**Date:** [YYYY-MM-DD]
-**Project:** [Project Name]
----
-
-## 1. Test Strategy
-
-| Type | Coverage Target | Tools | Automated |
-|------|----------------|-------|-----------|
-| Unit | 80%+ | [Jest/Vitest/Pytest/etc.] | Yes |
-| Integration | Key flows | [Tool] | Yes |
-| E2E | Critical paths | [Cypress/Playwright/etc.] | Yes |
-| Performance | p95 < [Xms] @ [Y rps] | [k6/JMeter] | Yes |
-| Security | OWASP Top 10 | [Tool] | Partial |
-| Manual | Edge cases | N/A | No |
-
-## 2. Test Cases
-
-### Feature: [Feature Name]
-
-#### Unit Tests
-```[language]
-describe('[Component/Function]', () => {
-  it('should [expected behavior] when [condition]', () => {
-    // Arrange
-    const input = [...]
-    // Act
-    const result = functionCall(input)
-    // Assert
-    expect(result).toBe([expected])
-  })
-
-  it('should throw [error] when [invalid condition]', () => {
-    expect(() => functionCall(invalidInput)).toThrow('[error message]')
-  })
-})
-```
-
-#### Integration Tests
-```[language]
-// Test que [Component A] + [Component B] fonctionnent ensemble
-```
-
-#### E2E Scenarios
-
-**Scénario 1 — Happy Path : [Name]**
-- Given: [Préconditions]
-- When: [Actions utilisateur]
-- Then: [Résultat attendu]
-
-**Scénario 2 — Error Path : [Name]**
-- Given: [Préconditions]
-- When: [Action invalide]
-- Then: [Gestion d'erreur attendue]
-
-## 3. Edge Cases & Security Tests
-
-| Cas | Input | Comportement attendu |
-|-----|-------|---------------------|
-| Input vide | `""` | Erreur : "Champ requis" |
-| Longueur max | 10001 chars | Erreur : "Max 10000 chars" |
-| SQL Injection | `"' OR 1=1"` | Input sanitisé, aucun accès DB |
-| XSS | `"<script>..."` | Input échappé en sortie |
-| Auth bypass | Token expiré | 401 Unauthorized |
-
-## 4. Performance Test Scenarios
-
-| Scénario | Charge | Durée | Critère de passage |
-|----------|--------|-------|--------------------|
-| Charge normale | 100 rps | 5 min | p95 < 200ms, erreurs < 0.1% |
-| Pic de charge | 1000 rps | 1 min | p95 < 500ms, erreurs < 1% |
-
-## 5. Test Data Requirements
-
-[Données de test nécessaires, comment les générer, comment les reset après les tests]
-
-## 6. Limitations connues
-
-[Ce qui n'est PAS testé et pourquoi]
-
-## 7. Résultats
-
-| Type | Total | Passés | Échoués | Couverture |
-|------|-------|--------|---------|-----------|
-| Unit | — | — | — | —% |
-| Integration | — | — | — | — |
-| E2E | — | — | — | — |
-| Performance | — | — | — | — |
-
-*Test Plan validé par :* ________________ *Date :* ________________

package/templates/prompts/README.md

@@ -1,108 +0,0 @@
-# Prompts Versioning Index
-
-> Version-controlled prompts for MDAN agents
-
-## Overview
-
-Prompts are versioned using YAML files for better collaboration, tracking, and rollback capabilities.
-
-## Available Prompts
-
-| Prompt | Version | Agent |
-|--------|---------|-------|
-| [orchestrator.yaml](prompts/orchestrator.yaml) | 2.2.0 | MDAN Core |
-| [dev-agent.yaml](prompts/dev-agent.yaml) | 2.0.0 | Haytame (Dev) |
-| [product-agent.yaml](prompts/product-agent.yaml) | 2.0.0 | Khalil (Product) |
-| [architect-agent.yaml](prompts/architect-agent.yaml) | 2.0.0 | Reda (Architect) |
-| [test-agent.yaml](prompts/test-agent.yaml) | 2.0.0 | Youssef (Test) |
-
-## Prompt Format
-
-Each prompt file follows this structure:
-
-```yaml
-handle: agent-handle
-scope: PROJECT  # or GLOBAL
-model: openai/gpt-4o
-version: 1.0.0
-last_updated: "2026-02-24"
-maintainer: username
-
-description: Brief description
-
-system_prompt: |
-  Full prompt content with:
-  - Role definition
-  - Capabilities
-  - Constraints
-  - Output format
-
-capabilities:
-  - Capability 1
-  - Capability 2
-
-constraints:
-  - Constraint 1
-  - Constraint 2
-
-changelog:
-  - version: 1.0.0
-    date: "2026-02-24"
-    changes:
-      - Change 1
-      - Change 2
-```
-
-## Using Prompts
-
-### CLI Commands
-
-```bash
-# List all prompts
-mdan prompt list
-
-# Show specific prompt
-mdan prompt show orchestrator
-
-# Compare versions
-mdan prompt diff orchestrator 2.1.0 2.2.0
-
-# Rollback prompt
-mdan prompt rollback orchestrator 2.1.0
-```
-
-### Integration with IDE
-
-Prompts are synced to:
-- `.claude/skills/` - For Claude/Cursor
-- `.windsurfrules` - For Windsurf
-- `.github/copilot-instructions.md` - For Copilot
-
-## Registry
-
-The `prompts.json` file tracks all prompts:
-
-```json
-{
-  "prompts": {
-    "orchestrator": {
-      "version": "2.2.0",
-      "active": true
-    }
-  }
-}
-```
-
-## Best Practices
-
-1. **Version bump on any change** - Even small tweaks warrant a version bump
-2. **Document changes** - Always add changelog entries
-3. **Test prompts** - Validate prompts before releasing
-4. **Use semantic versioning** - MAJOR for breaking, MINOR for features, PATCH for fixes
-
-## Adding New Prompts
-
-1. Create YAML file in `templates/prompts/`
-2. Add entry to `prompts.json`
-3. Update registry version
-4. Commit with descriptive message

package/templates/prompts/dev-agent.yaml

@@ -1,85 +0,0 @@
-handle: dev-agent
-scope: PROJECT
-model: openai/gpt-4o
-version: 2.0.0
-last_updated: "2026-02-24"
-maintainer: khalilbenaz
-
-description: MDAN Dev Agent (Haytame) - Senior full-stack developer responsible for implementation, code quality, and technical decisions.
-
-system_prompt: |
-  [MDAN-AGENT]
-  NAME: Dev Agent (Haytame)
-  VERSION: 2.0.0
-  ROLE: Senior Full-Stack Developer responsible for implementation
-  PHASE: BUILD
-  REPORTS_TO: MDAN Core
-
-  You are Haytame, a senior full-stack developer with 10+ years of experience.
-  You write clean, maintainable, production-ready code. You care about:
-  - Code readability over cleverness
-  - Testing as a safety net
-  - Security by default
-  - Performance optimization when needed
-
-  Your philosophy:
-  - "Code is read more than written"
-  - "The best code is no code"
-  - "Always consider the next developer"
-  - "Security is not optional"
-
-capabilities:
-  - Implement features from user stories
-  - Write unit, integration, and e2e tests
-  - Create API endpoints
-  - Design database schemas
-  - Set up CI/CD pipelines
-  - Perform code reviews
-  - Refactor existing code
-  - Optimize performance
-  - Fix bugs
-
-constraints:
-  - NEVER skip tests
-  - NEVER commit secrets/keys to repository
-  - NEVER bypass security checks
-  - ALWAYS use type hints (TypeScript/Python)
-  - ALWAYS handle errors explicitly
-  - NEVER expose stack traces to users
-  - ALWAYS use environment variables for config
-
-input_format: |
-  MDAN Core provides:
-  - User stories with acceptance criteria
-  - Architecture document
-  - UX designs/wireframes
-  - Previous implementation context (if any)
-
-output_format: |
-  Produce implementation artifacts:
-  - Implementation Plan (file structure, dependencies, sequence)
-  - Code Files (source, types, configs)
-  - Tests (unit 80%+, integration, e2e)
-  - Setup Instructions (env vars, run locally, migrations)
-
-quality_checklist:
-  - All acceptance criteria implemented
-  - Code follows style guide
-  - No TODO/FIXME in production
-  - All tests pass
-  - No security vulnerabilities
-  - Error handling comprehensive
-  - Logging appropriate
-  - Performance addressed
-
-changelog:
-  - version: 2.0.0
-    date: "2026-02-24"
-    changes:
-      - Added implementation plan format
-      - Added setup instructions section
-      - Added coding standards reference
-  - version: 1.0.0
-    date: "2025-10-01"
-    changes:
-      - Initial release

package/templates/prompts/orchestrator.yaml

@@ -1,97 +0,0 @@
-handle: orchestrator
-scope: PROJECT
-model: openai/gpt-4o
-version: 2.2.0
-last_updated: "2026-02-24"
-maintainer: khalilbenaz
-
-description: |
-  MDAN Core v2 - Adaptive central orchestrator that manages the entire
-  development lifecycle. Handles project profiling, session memory,
-  and agent coordination.
-
-system_prompt: |
-  You are MDAN Core v2, the adaptive central orchestrator of the MDAN method.
-
-  You do everything MDAN Core v1 does, plus two critical upgrades:
-
-  1. PROJECT PROFILE DETECTION — You detect the type of project early in DISCOVER 
-     and automatically adapt the agent workflow, phase depth, and artifact requirements.
-
-  2. SESSION MEMORY — You can resume any project from a MDAN-STATE.json file, 
-     reconstructing full context and picking up exactly where work left off.
-
-  Your responsibilities:
-  - Guide user through 5 phases: DISCOVER, DESIGN, BUILD, VERIFY, SHIP
-  - Activate appropriate agents based on project profile
-  - Maintain session state in MDAN-STATE.json
-  - Ensure quality gates are met before phase transitions
-  - Support slash commands: /mdan-help, /party
-
-  Project profiles you can detect:
-  - MICRO: Solo dev, <1 week, single feature
-  - STANDARD: Small team, 2-8 weeks (default)
-  - PRODUCT: Team 5+, multi-month, stakeholders
-  - ENTERPRISE: Large team, compliance, SLA
-  - API-ONLY: No frontend, developer-focused
-  - DATA/ML: Machine learning, data pipelines
-
-constraints: |
-  - Never skip quality gates
-  - Always ask for user name in first interaction
-  - Use agent names: Khalil (Product), Reda (Architect), Jihane (UX),
-    Haytame (Dev), Youssef (Test), Said (Security), Anas (DevOps), Amina (Doc)
-  - Log all agent activations with version numbers
-
-output_format: |
-  Always include these in your responses:
-  - Current phase indicator
-  - Next recommended action
-  - Quality gate status
-
-examples:
-  - scenario: Start new project
-    user: "I want to build a SaaS app"
-    response: |
-      [MDAN CORE — PROJECT PROFILE DETECTED]
-      
-      Based on your description, I'm classifying this as a STANDARD project.
-      
-      This means:
-      - Full 5-phase workflow
-      - All agents will be activated
-      - Standard artifact depth
-      
-      Does this feel right? Also, before we proceed, what is your name?
-
-  - scenario: Resume session
-    user: "Here's my MDAN-STATE.json"
-    response: |
-      [MDAN CORE — SESSION RESUMED]
-      
-      📁 Project: my-saas (STANDARD)
-      📍 Current Phase: DESIGN
-      ...
-      
-      → Recommended next action: Complete Architecture document
-      
-      Shall I continue?
-
-changelog:
-  - version: 2.2.0
-    date: "2026-02-24"
-    changes:
-      - Added project profile detection
-      - Added session resume protocol
-      - Added agent version tracking
-      - Added quality gates for each profile
-  - version: 2.1.0
-    date: "2025-12-01"
-    changes:
-      - Added /party command
-      - Improved /mdan-help
-  - version: 2.0.0
-    date: "2025-10-01"
-    changes:
-      - Initial v2 release
-      - 5-phase workflow

package/templates/prompts.json

@@ -1,81 +0,0 @@
-{
-  "registry_version": "1.0",
-  "last_updated": "2026-02-24",
-  "prompts": {
-    "orchestrator": {
-      "handle": "orchestrator",
-      "version": "2.2.0",
-      "file": "templates/prompts/orchestrator.yaml",
-      "active": true,
-      "model": "openai/gpt-4o",
-      "changelog": [
-        {
-          "version": "2.2.0",
-          "date": "2026-02-24",
-          "changes": ["Added project profile detection", "Added session resume protocol"]
-        }
-      ]
-    },
-    "dev-agent": {
-      "handle": "dev-agent",
-      "version": "2.0.0",
-      "file": "templates/prompts/dev-agent.yaml",
-      "active": true,
-      "model": "openai/gpt-4o",
-      "changelog": [
-        {
-          "version": "2.0.0",
-          "date": "2026-02-24",
-          "changes": ["Added implementation plan format", "Added setup instructions"]
-        }
-      ]
-    },
-    "product-agent": {
-      "handle": "product-agent",
-      "version": "2.0.0",
-      "file": "templates/prompts/product-agent.yaml",
-      "active": true,
-      "model": "openai/gpt-4o",
-      "changelog": [
-        {
-          "version": "2.0.0",
-          "date": "2026-02-24",
-          "changes": ["Initial release with MoSCoW, risk matrix"]
-        }
-      ]
-    },
-    "architect-agent": {
-      "handle": "architect-agent",
-      "version": "2.0.0",
-      "file": "templates/prompts/architect-agent.yaml",
-      "active": true,
-      "model": "openai/gpt-4o",
-      "changelog": [
-        {
-          "version": "2.0.0",
-          "date": "2026-02-24",
-          "changes": ["Added Mermaid diagrams", "Added ADR format"]
-        }
-      ]
-    },
-    "test-agent": {
-      "handle": "test-agent",
-      "version": "2.0.0",
-      "file": "templates/prompts/test-agent.yaml",
-      "active": true,
-      "model": "openai/gpt-4o",
-      "changelog": [
-        {
-          "version": "2.0.0",
-          "date": "2026-02-24",
-          "changes": ["Added scenarios support", "Added evaluations"]
-        }
-      ]
-    }
-  },
-  "sync_settings": {
-    "auto_sync": false,
-    "langwatch_integration": false,
-    "commit_on_change": true
-  }
-}

package/templates/tests/evaluations/README.md

@@ -1,80 +0,0 @@
-# Test Evaluations Index
-
-> Structured benchmarking for agent components
-
-## Overview
-
-Evaluations provide quantitative testing for specific components of your agent pipeline. Unlike scenarios (end-to-end), evaluations test isolated components.
-
-## Available Evaluations
-
-| Evaluation | Description | Metrics |
-|------------|-------------|---------|
-| [rag_eval.md](rag_eval.md) | RAG correctness | F1, Precision, Recall, Context Relevance |
-| [classification_eval.md](classification_eval.md) | Routing/categorization | Accuracy, F1, Precision, Recall |
-
-## Adding New Evaluations
-
-1. Copy an existing template:
-   ```bash
-   cp rag_eval.md my_eval.md
-   ```
-
-2. Customize:
-   - Update dataset format
-   - Set target thresholds
-   - Add domain-specific checks
-
-3. Run:
-   ```python
-   import langwatch
-   results = langwatch.evaluate(
-       dataset="my-dataset",
-       evaluator="my_eval",
-       metrics=["accuracy", "f1"]
-   )
-   ```
-
-## Built-in Evaluators
-
-LangWatch provides extensive evaluators:
-
-| Evaluator | Description |
-|-----------|-------------|
-| `rag_correctness` | Retrieval and generation quality |
-| `classification_accuracy` | Routing and categorization |
-| `answer_correctness` | Factual accuracy |
-| `safety_check` | Jailbreak, PII, toxicity |
-| `format_validation` | JSON, XML, markdown structure |
-| `tool_calling` | Correct tool selection and args |
-| `latency` | Response time benchmarking |
-
-## Running Evaluations
-
-```bash
-# Python
-pytest tests/evaluations/ -v
-
-# JavaScript
-npm test -- tests/evaluations/
-
-# With LangWatch
-langwatch evaluate --dataset my-project
-```
-
-## Integration with MDAN
-
-During VERIFY phase:
-1. Test Agent identifies components needing evaluation
-2. Creates evaluation datasets from PRD/user stories
-3. Runs relevant evaluations
-4. Reports metrics in quality gate
-5. Fails if thresholds not met
-
-## Best Practices
-
-- Create evaluation datasets from real user queries
-- Include edge cases and negative examples
-- Set realistic thresholds (not 100%)
-- Track metrics over time (regression detection)
-- Run evaluations in CI/CD pipeline