mop-flow 0.1.8

package/.agents/AGENTS.md

@@ -0,0 +1,85 @@
+# MOP Core - Antigravity Instructions
+
+This is the Antigravity managed-agent entry point. The provider-neutral project
+rules are in the root `AGENTS.md`; apply those rules first when the root is
+available in the environment.
+
+## Authentication Gate
+
+Before doing anything, read `.MOP/STATE.json` and follow
+`.MOP/PROTOCOL.md`.
+
+- If setup is pending, run only the setup wizard.
+- If login is required, ask only for codename and password.
+- After login, run the Agent Router: every conversation and action must route
+  to one primary named agent. Check with `mop-core.mjs agent route --actor
+  <codename> --task "<user task>"`.
+- Before answering, restore monthly memory with
+  `mop-core.mjs memory brief --actor <codename>`.
+- Every authenticated user-facing answer must start with the routed
+  `answerContract.firstLine`, for example:
+  `agent: <agent-name> (<agent-role>) to <user>`.
+- After meaningful work, save memory with
+  `mop-core.mjs memory add --actor <codename> --kind conversation --summary "<outcome>"`.
+- If the router says clarification is needed, ask the clarifying questions
+  before implementation.
+- If the router returns `nextAction: "name-required-party-agents"`, ask every
+  question in `missingAgentQuestions` and stop until those agents are named.
+- Before browser, scraping, extraction, click automation, login flow,
+  bot-detection, or form-filling work, run `mop-core.mjs browser preflight`. If
+  it reports Edge, Brave, or Opera, use browser-act `chrome-direct` mode and
+  guide the user to start remote debugging (`--remote-debugging-port`). If it
+  cannot detect a supported browser, ask which browser they use before doing
+  browser work.
+- If the router activates Party Mode, show visible agent-to-agent dialogue using
+  the exact format in `.MOP/PROTOCOL.md`, with `PARTY MODE` shown in
+  large uppercase before the dialogue. Party Mode normally uses at least 3
+  agents and prefers 4 when relevant roles exist.
+- For complex work or "what next?" questions, use MOP Workflow:
+  `mop-workflow.mjs help --actor <codename> --task "<user task>"`.
+- Before implementation, run the readiness gate. If it is not `ready`, ask
+  clarification or update the needed artifact before coding.
+- For risky changes, run adversarial review before implementation or merge.
+- When a role agent first appears, ask the user to name it before using it as a
+  personal agent.
+- Autosycn member commits must use the active member GitHub account. By default,
+  MOP derives `ID+USERNAME@users.noreply.github.com` from `gh api user` and
+  refuses mismatched GitHub accounts. `BURHAN-MOP` identity is reserved for
+  merge guardian commits only.
+
+## MOP Flow Canonical Layer
+
+- User-facing brand: MOP Flow.
+- Canonical MCP server name: `mop-flow`.
+- Portable skill source: `.agents/skills/`.
+- Runtime-native skill source: `.claude/skills/`, bridged through MOP Flow when
+  needed outside Claude.
+- Check parity with `node .MOP/scripts/mop-flow.mjs status --json` when work
+  involves skills, MCP, swarm, hooks, or provider behavior.
+
+## Operating Rules
+
+- Treat this workspace as a MOP Flow portable agent core.
+- Use `.agents/skills/` for Antigravity-native skills.
+- Use `.claude/skills/` as bridged reference material only; do not assume Claude
+  Code tools are available in Antigravity.
+- Treat the current workspace root as the project root. Do not create a nested
+  project wrapper like `portfolio/`, `my-app/`, or `<project-name>/`; scaffold
+  app files directly in root using normal app folders.
+- Do not read or expose `.env` or `.env.*`.
+- Run validation after configuration edits.
+- Stop once the requested task is complete; do not keep expanding scope.
+
+## Useful Local Paths
+
+- Root instructions: `AGENTS.md`
+- Claude instructions: `CLAUDE.md`
+- Gemini instructions: `GEMINI.md`
+- MCP server map: `.mcp.json`
+- MOP Flow runtime config: `.claude-flow/config.yaml`
+- Antigravity skills: `.agents/skills/`
+
+Installer command: `npx mop-flow install`.
+Legacy compatibility command: `npx burhan-mop install`.
+GitHub source fallback for development builds:
+`npx --yes github:BURHANDEV-ENTERPRISE/BURHAN-MOP install`.

package/.agents/skills/auto-deploy/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: auto-deploy
+description: Use when the user asks to prepare, activate, or discuss deployment for GitHub, Docker, or Vercel. Must ask for confirmation before making deployment files or running deploy commands.
+---
+
+# Auto Deploy
+
+Auto-deploy supports GitHub, Docker, and Vercel, but it is opt-in.
+
+## Confirmation Gate
+
+Before creating deployment files, linking services, or running deployment
+commands, ask:
+
+```text
+Nak aktifkan auto deploy sekarang? Pilih provider: GitHub, Docker, Vercel.
+```
+
+If the user says `nanti`, `tidak`, `tak`, `x`, `no`, `later`, or equivalent,
+reply exactly:
+
+```text
+Okey, nanti kalau nak deploy beri tahu saya. Saya setup auto deploy.
+```
+
+Then record the defer action:
+
+```bash
+node .MOP/scripts/mop-auto-deploy.mjs defer --actor <codename> --answer nanti
+```
+
+## Activation
+
+Only after explicit confirmation:
+
+```bash
+node .MOP/scripts/mop-auto-deploy.mjs enable --actor <codename> --provider github|docker|vercel|all --confirm yes
+```
+
+## Provider Intent
+
+- `github`: GitHub Pages or GitHub Actions deployment.
+- `docker`: Dockerfile, compose file, and container build/run flow.
+- `vercel`: Vercel project link and framework-aware deploy settings.
+
+Do not guess provider details. Inspect the project framework first, then create
+the smallest provider-specific config needed.
+

package/.agents/skills/autosycn/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: autosycn
+description: Use this after every meaningful MOP state or file change to save memory, commit as the real active user, push to the correct branch, and merge to main when allowed.
+---
+
+# Autosycn
+
+Autosycn is MOP's identity-safe autosync skill. The name keeps the
+project spelling `autosycn`, but the behavior is autosync.
+
+## Required Identity Rule
+
+Never let commits fall back to the AI tool identity. Before pushing, the helper
+must have a user Git identity:
+
+```bash
+node .MOP/scripts/mop-core.mjs member git-identity --actor <codename> --name "<display name>" --email "<github-verified-email>" --github-username "<github-login>"
+```
+
+Use a GitHub-verified email or the user's GitHub noreply email. The branch name
+alone, such as `dev/moon`, does not make GitHub attribute the commit to Moon.
+GitHub maps commit authors by email, and push actor by the credentials or SSH
+key used for `git push`.
+
+## Flow
+
+First-time git setup:
+
+```bash
+node .MOP/scripts/mop-autosycn.mjs init --actor <owner-codename> --url "<github-url>"
+```
+
+Before starting new work, after login, or after a long break:
+
+```bash
+node .MOP/scripts/mop-autosycn.mjs preflight --actor <codename>
+```
+
+After a state or file change:
+
+```bash
+node .MOP/scripts/mop-autosycn.mjs run --actor <codename> --reason "<what changed>"
+```
+
+Manual steps:
+
+```bash
+node .MOP/scripts/mop-autosycn.mjs memory --actor <codename> --summary "<what changed>"
+node .MOP/scripts/mop-autosycn.mjs push --actor <codename> --reason "<what changed>"
+node .MOP/scripts/mop-autosycn.mjs merge --actor <codename> --from <codename> --reason "Merge dev/<codename>: <what changed>"
+```
+
+## Guarantees
+
+- Can initialize a missing git repository, set `origin`, commit a baseline, and
+  push `main`.
+- In team mode, keeps `main` as trunk and uses `dev/<codename>` as the user
+  work branch.
+- `preflight` pulls `origin/main` and syncs the work branch before new work.
+- `run` pushes `dev/<codename>` for every small or large change.
+- BURHAN-MOP reviews the pushed branch and merges to `main` only when checks
+  pass.
+- Sets `GIT_AUTHOR_NAME`, `GIT_AUTHOR_EMAIL`, `GIT_COMMITTER_NAME`, and
+  `GIT_COMMITTER_EMAIL` from MOP member state.
+- Sets local `git config user.name` and `user.email` before commit/merge.
+- Refuses to push when the user's Git email is missing.
+- If a GitHub username is configured, refuses to push unless `gh api user`
+  verifies the same username. Disable `verifyGhUserWhenConfigured` only for
+  deliberate SSH-only workflows.
+
+## Limit
+
+No script can fake the GitHub push actor. The push actor is controlled by the
+GitHub credential or SSH key on the machine. If GitHub still shows a bot as the
+pusher, fix `gh auth login`, Git Credential Manager, or the SSH key account.

package/.agents/skills/mop-flow/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: mop-flow
+description: Use this when work involves MOP Flow, provider parity, skill bridging, MCP runtime setup, swarm/runtime orchestration, or translating Claude-native skills for Codex, Gemini, Antigravity, or Claude.
+---
+
+# MOP Flow
+
+MOP Flow is the provider-neutral orchestration layer owned by MOP. Ruflo and
+Claude Flow are upstream runtime compatibility names only; user-facing work
+should identify the system as MOP Flow.
+
+## When To Use
+
+- The task mentions MOP Flow, Claude Flow, Ruflo, swarm, MCP, hooks, skills, or
+  provider parity.
+- A non-Claude provider needs access to skills stored under `.claude/skills/`.
+- The agent is deciding which skill, provider entrypoint, or runtime tool to use.
+
+## Required Flow
+
+1. Read `.MOP/STATE.json` and `.MOP/PROTOCOL.md` first.
+2. Use MOP auth, Agent Router, memory, readiness, and autosycn rules before any
+   provider-specific runtime behavior.
+3. Run the MOP Flow status helper when skill/provider routing matters:
+
+```bash
+node .MOP/scripts/mop-flow.mjs status --json
+```
+
+4. Prefer portable skills in `.agents/skills/`.
+5. If a needed skill exists only in `.claude/skills/`, bridge it through MOP Flow:
+   read the skill file as reference, translate Claude-only tools into the
+   current provider's tools, and keep MOP policy as the top authority.
+6. Prefer MCP server name `mop-flow`. Keep `CLAUDE_FLOW_*` env vars only because
+   the upstream runtime still expects them.
+
+## Useful Commands
+
+```bash
+node .MOP/scripts/mop-flow.mjs providers
+node .MOP/scripts/mop-flow.mjs skills list
+node .MOP/scripts/mop-flow.mjs manifest refresh
+```
+
+## Rules
+
+- Do not call the user-facing system Claude Flow when MOP is the installed core.
+- Do not assume Claude hooks or slash commands exist in Codex, Gemini, or
+  Antigravity.
+- Do not let runtime suggestions bypass MOP auth, agent role, memory, readiness,
+  autosycn, or project-root rules.
+- If MCP is unavailable, continue with filesystem and shell inspection, then
+  report which provider runtime could not be verified.

package/.agents/skills/mop-help/SKILL.md

@@ -0,0 +1,35 @@
+# mop-help
+
+Use this skill when the user asks what to do next, feels unsure, asks for a plan,
+or asks which agent/workflow/artifact should be used.
+
+## Behavior
+
+1. Read `.MOP/STATE.json`.
+2. Respect auth and Agent Router gates from `.MOP/PROTOCOL.md`.
+3. Run:
+
+```bash
+node .MOP/scripts/mop-workflow.mjs help --actor <codename> --task "<user task>"
+```
+
+4. Explain the next step in the user's language.
+5. Include:
+   - primary agent role
+   - party roles if needed
+   - next artifact
+   - next artifact category/path pattern
+   - readiness gate if coding is being requested
+   - adversarial review if risk is high
+
+## Rules
+
+- Do not invent a workflow phase if the helper returns one.
+- Keep artifacts under `.MOP/artifacts/<category>/<artifact-slug>/<type>.md`.
+- Treat the current workspace root as the project root. Do not suggest a nested
+  project wrapper folder unless the user explicitly asks for a monorepo or
+  multiple apps.
+- If implementation is requested and readiness is not clear, ask clarification
+  before coding.
+- If Party Mode is active, show `PARTY MODE` before agent dialogue.
+- Keep the answer practical: tell the user what happens next and why.

package/.agents/skills/ruflo-core/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: ruflo-core
+description: Legacy alias for MOP Flow runtime compatibility. Use mop-flow first, then this file when inspecting Ruflo or Claude Flow upstream behavior.
+---
+
+# Ruflo Core Skill (Legacy Alias)
+
+## Goal
+
+Keep upstream Ruflo / Claude Flow runtime behavior portable under the MOP Flow
+brand across Claude Code, Codex, ChatGPT coding surfaces, Gemini CLI, and
+Antigravity.
+
+## Instructions
+
+1. Prefer `.agents/skills/mop-flow/SKILL.md` for provider parity and branding.
+2. Read the active provider entry point:
+   - Codex / ChatGPT coding agents: `AGENTS.md`
+   - Gemini CLI: `GEMINI.md`
+   - Antigravity: `.agents/AGENTS.md`
+   - Claude Code: `CLAUDE.md`
+3. Inspect `.mcp.json`, `.claude-flow/config.yaml`, and provider-specific config
+   before changing integration behavior.
+4. Keep Claude-only hooks in `.claude/`; do not copy them blindly into other
+   providers.
+5. For Antigravity and cross-provider skills, use `.agents/skills/<skill-name>/SKILL.md`.
+6. Validate JSON/TOML/YAML after edits and report any tool or auth requirement
+   that cannot be verified locally.
+
+## Constraints
+
+- Do not create or expose secrets.
+- Do not start background daemons unless explicitly requested.
+- Do not assume MCP is available; degrade to filesystem and shell inspection.
+- Do not modify runtime state, logs, sessions, or memory data unless the user
+  specifically asks.

package/.claude/agents/analysis/analyze-code-quality.md

@@ -0,0 +1,179 @@
+---
+name: "code-analyzer"
+description: "Advanced code quality analysis agent for comprehensive code reviews and improvements"
+color: "purple"
+type: "analysis"
+version: "1.0.0"
+created: "2025-07-25"
+author: "Claude Code"
+metadata:
+  specialization: "Code quality, best practices, refactoring suggestions, technical debt"
+  complexity: "complex"
+  autonomous: true
+  
+triggers:
+  keywords:
+    - "code review"
+    - "analyze code"
+    - "code quality"
+    - "refactor"
+    - "technical debt"
+    - "code smell"
+  file_patterns:
+    - "**/*.js"
+    - "**/*.ts"
+    - "**/*.py"
+    - "**/*.java"
+  task_patterns:
+    - "review * code"
+    - "analyze * quality"
+    - "find code smells"
+  domains:
+    - "analysis"
+    - "quality"
+
+capabilities:
+  allowed_tools:
+    - Read
+    - Grep
+    - Glob
+    - WebSearch  # For best practices research
+  restricted_tools:
+    - Write  # Read-only analysis
+    - Edit
+    - MultiEdit
+    - Bash  # No execution needed
+    - Task  # No delegation
+  max_file_operations: 100
+  max_execution_time: 600
+  memory_access: "both"
+  
+constraints:
+  allowed_paths:
+    - "src/**"
+    - "lib/**"
+    - "app/**"
+    - "components/**"
+    - "services/**"
+    - "utils/**"
+  forbidden_paths:
+    - "node_modules/**"
+    - ".git/**"
+    - "dist/**"
+    - "build/**"
+    - "coverage/**"
+  max_file_size: 1048576  # 1MB
+  allowed_file_types:
+    - ".js"
+    - ".ts"
+    - ".jsx"
+    - ".tsx"
+    - ".py"
+    - ".java"
+    - ".go"
+
+behavior:
+  error_handling: "lenient"
+  confirmation_required: []
+  auto_rollback: false
+  logging_level: "verbose"
+  
+communication:
+  style: "technical"
+  update_frequency: "summary"
+  include_code_snippets: true
+  emoji_usage: "minimal"
+  
+integration:
+  can_spawn: []
+  can_delegate_to:
+    - "analyze-security"
+    - "analyze-performance"
+  requires_approval_from: []
+  shares_context_with:
+    - "analyze-refactoring"
+    - "test-unit"
+
+optimization:
+  parallel_operations: true
+  batch_size: 20
+  cache_results: true
+  memory_limit: "512MB"
+  
+hooks:
+  pre_execution: |
+    echo "🔍 Code Quality Analyzer initializing..."
+    echo "📁 Scanning project structure..."
+    # Count files to analyze
+    find . -name "*.js" -o -name "*.ts" -o -name "*.py" | grep -v node_modules | wc -l | xargs echo "Files to analyze:"
+    # Check for linting configs
+    echo "📋 Checking for code quality configs..."
+    ls -la .eslintrc* .prettierrc* .pylintrc tslint.json 2>/dev/null || echo "No linting configs found"
+  post_execution: |
+    echo "✅ Code quality analysis completed"
+    echo "📊 Analysis stored in memory for future reference"
+    echo "💡 Run 'analyze-refactoring' for detailed refactoring suggestions"
+  on_error: |
+    echo "⚠️ Analysis warning: {{error_message}}"
+    echo "🔄 Continuing with partial analysis..."
+    
+examples:
+  - trigger: "review code quality in the authentication module"
+    response: "I'll perform a comprehensive code quality analysis of the authentication module, checking for code smells, complexity, and improvement opportunities..."
+  - trigger: "analyze technical debt in the codebase"
+    response: "I'll analyze the entire codebase for technical debt, identifying areas that need refactoring and estimating the effort required..."
+---
+
+# Code Quality Analyzer
+
+You are a Code Quality Analyzer performing comprehensive code reviews and analysis.
+
+## Key responsibilities:
+1. Identify code smells and anti-patterns
+2. Evaluate code complexity and maintainability
+3. Check adherence to coding standards
+4. Suggest refactoring opportunities
+5. Assess technical debt
+
+## Analysis criteria:
+- **Readability**: Clear naming, proper comments, consistent formatting
+- **Maintainability**: Low complexity, high cohesion, low coupling
+- **Performance**: Efficient algorithms, no obvious bottlenecks
+- **Security**: No obvious vulnerabilities, proper input validation
+- **Best Practices**: Design patterns, SOLID principles, DRY/KISS
+
+## Code smell detection:
+- Long methods (>50 lines)
+- Large classes (>500 lines)
+- Duplicate code
+- Dead code
+- Complex conditionals
+- Feature envy
+- Inappropriate intimacy
+- God objects
+
+## Review output format:
+```markdown
+## Code Quality Analysis Report
+
+### Summary
+- Overall Quality Score: X/10
+- Files Analyzed: N
+- Issues Found: N
+- Technical Debt Estimate: X hours
+
+### Critical Issues
+1. [Issue description]
+   - File: path/to/file.js:line
+   - Severity: High
+   - Suggestion: [Improvement]
+
+### Code Smells
+- [Smell type]: [Description]
+
+### Refactoring Opportunities
+- [Opportunity]: [Benefit]
+
+### Positive Findings
+- [Good practice observed]
+```