reis-mobile 0.3.5

package/core/install/claude-plugin.mjs

@@ -0,0 +1,76 @@
+import { spawnSync } from 'node:child_process';
+
+export const MARKETPLACE_NAME = 'reis-mobile';
+export const PLUGIN_ID = `reis-mobile@${MARKETPLACE_NAME}`;
+/** v0.3.2 and v0.3.3 shipped the plugin as `mobile`, with commands under /mobile:*. */
+export const LEGACY_PLUGIN_IDS = [`mobile@${MARKETPLACE_NAME}`];
+export const MARKETPLACE_URL = 'https://github.com/wrsilva/reis-mobile.git';
+export const SCOPES = ['user', 'project', 'local'];
+
+/**
+ * Registers the reis-mobile marketplace and installs the plugin through the `claude` CLI.
+ * Both steps are idempotent in Claude Code, so running `init` twice is safe.
+ *
+ * The marketplace is refreshed after being added: a checkout from v0.3.2 or v0.3.3 only
+ * knows the plugin as `mobile`. A plugin installed under that name is removed once
+ * reis-mobile is in place, so its commands do not show up twice.
+ *
+ * `source` is the GitHub repository by default, so `claude plugin update` keeps working;
+ * pass a local directory for offline or development installs.
+ */
+export function installClaudePlugin({ source = MARKETPLACE_URL, scope = 'user', run = runClaude, list = listClaudePlugins } = {}) {
+  assertScope(scope);
+  const result = runSteps(run, [
+    ['plugin', 'marketplace', 'add', source, '--scope', scope],
+    ['plugin', 'marketplace', 'update', MARKETPLACE_NAME],
+    ['plugin', 'install', PLUGIN_ID, '--scope', scope],
+  ]);
+  if (!result.ok) return result;
+  return runSteps(run, legacyUninstallSteps(list(), scope));
+}
+
+export function uninstallClaudePlugin({ scope = 'user', run = runClaude, list = listClaudePlugins } = {}) {
+  assertScope(scope);
+  return runSteps(run, [
+    ['plugin', 'uninstall', PLUGIN_ID, '--scope', scope],
+    ...legacyUninstallSteps(list(), scope),
+    ['plugin', 'marketplace', 'remove', MARKETPLACE_NAME],
+  ]);
+}
+
+function legacyUninstallSteps(installed, scope) {
+  return LEGACY_PLUGIN_IDS.filter((id) => installed.includes(id)).map((id) => ['plugin', 'uninstall', id, '--scope', scope]);
+}
+
+function runSteps(run, steps) {
+  for (const args of steps) {
+    const status = run(args);
+    if (status !== 0) return { ok: false, failedStep: `claude ${args.join(' ')}`, status };
+  }
+  return { ok: true };
+}
+
+function assertScope(scope) {
+  if (!SCOPES.includes(scope)) throw new Error(`Unknown scope "${scope}". Use one of: ${SCOPES.join(', ')}`);
+}
+
+function runClaude(args) {
+  // npm-based Claude Code installs expose `claude.cmd` on Windows, which needs a shell.
+  const result = spawnSync('claude', args, { stdio: 'inherit', shell: process.platform === 'win32' });
+  if (result.error?.code === 'ENOENT') {
+    throw new Error('Claude Code CLI not found in PATH. Install it from https://claude.com/claude-code and run `reis-mobile init` again.');
+  }
+  if (result.error) throw result.error;
+  return result.status ?? 1;
+}
+
+/** Installed plugin ids. An unreadable list only means there is nothing to migrate. */
+function listClaudePlugins() {
+  const result = spawnSync('claude', ['plugin', 'list', '--json'], { encoding: 'utf8', shell: process.platform === 'win32' });
+  if (result.status !== 0) return [];
+  try {
+    return JSON.parse(result.stdout).map((plugin) => plugin.id);
+  } catch {
+    return [];
+  }
+}

package/core/paths.mjs

@@ -0,0 +1,4 @@
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const PLUGIN_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');

package/core/registry/frontmatter.mjs

@@ -0,0 +1,81 @@
+// Minimal YAML frontmatter parser, dependency-free on purpose: the plugin must run
+// straight from the Claude Code plugin cache without `npm install`.
+//
+// Supported subset: `key: scalar`, `key: [a, b]`, block lists (`key:` followed by
+// `  - item` lines) and block scalars (`key: |`, `|-`, `>`, `>-`). Nested maps, such as
+// the `metadata:` block of upstream skills, are skipped.
+
+const FRONTMATTER = /^---\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)([\s\S]*)$/;
+const BLOCK_SCALAR = /^([|>])([+-]?)$/;
+
+export function parseFrontmatter(source) {
+  const match = FRONTMATTER.exec(source);
+  if (!match) return { data: {}, body: source };
+  return { data: parseYamlSubset(match[1]), body: match[2] };
+}
+
+function parseYamlSubset(text) {
+  const data = {};
+  const lines = text.split(/\r?\n/);
+  let listKey = null;
+
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index];
+    if (!line.trim() || line.trimStart().startsWith('#')) continue;
+
+    const item = /^\s+-\s+(.*)$/.exec(line);
+    if (item && listKey) {
+      data[listKey].push(parseScalar(item[1]));
+      continue;
+    }
+
+    const pair = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
+    if (!pair) continue;
+
+    const [, key, value] = pair;
+    listKey = null;
+    const block = BLOCK_SCALAR.exec(value);
+
+    if (block) {
+      const collected = [];
+      while (index + 1 < lines.length && (lines[index + 1].trim() === '' || /^\s/.test(lines[index + 1]))) {
+        collected.push(lines[++index]);
+      }
+      data[key] = foldBlock(collected, block[1], block[2]);
+    } else if (value === '') {
+      data[key] = [];
+      listKey = key;
+    } else {
+      data[key] = parseValue(value);
+    }
+  }
+  return data;
+}
+
+function foldBlock(lines, style, chomping) {
+  const indent = Math.min(...lines.filter((line) => line.trim()).map((line) => line.match(/^\s*/)[0].length));
+  const content = lines.map((line) => line.slice(Number.isFinite(indent) ? indent : 0));
+  const text = style === '|' ? content.join('\n') : content.map((line) => line.trim()).join(' ').replace(/ {2,}/g, ' ');
+  return chomping === '+' ? `${text}\n` : text.trimEnd();
+}
+
+function parseValue(value) {
+  if (value.startsWith('[') && value.endsWith(']')) {
+    return value
+      .slice(1, -1)
+      .split(',')
+      .map((part) => parseScalar(part.trim()))
+      .filter((part) => part !== '');
+  }
+  return parseScalar(value);
+}
+
+function parseScalar(raw) {
+  const value = raw.trim();
+  if (value.length >= 2 && value[0] === value.at(-1) && (value[0] === '"' || value[0] === "'")) {
+    return value.slice(1, -1).replaceAll(`\\${value[0]}`, value[0]);
+  }
+  if (value === 'true') return true;
+  if (value === 'false') return false;
+  return value;
+}

package/core/registry/registry.mjs

@@ -0,0 +1,140 @@
+import { readFile, readdir } from 'node:fs/promises';
+import { basename, join } from 'node:path';
+
+import { DETECTABLE_STACKS } from '../detection/stack-detector.mjs';
+import { PLUGIN_ROOT } from '../paths.mjs';
+import { INTENT_IDS } from '../router/intents.mjs';
+import { parseFrontmatter } from './frontmatter.mjs';
+
+export const ANY_STACK = '*';
+
+/**
+ * Loads stacks (`stacks/<id>/stack.json`), agents (`agents/<name>.md`) and skills
+ * (`skills/<name>/SKILL.md`). Routing metadata lives in the same frontmatter Claude Code
+ * reads, so the router and the plugin can never disagree about what exists.
+ */
+export async function loadRegistry(root = PLUGIN_ROOT) {
+  const [stacks, agents, skills] = await Promise.all([
+    loadStacks(join(root, 'stacks')),
+    loadAgents(join(root, 'agents')),
+    loadSkills(join(root, 'skills')),
+  ]);
+  return { root, stacks, agents, skills };
+}
+
+async function loadStacks(dir) {
+  const stacks = [];
+  for (const entry of await listDir(dir)) {
+    if (!entry.isDirectory()) continue;
+    const path = join(dir, entry.name, 'stack.json');
+    const data = JSON.parse(await readFile(path, 'utf8'));
+    stacks.push({ ...data, dirName: entry.name, path });
+  }
+  return sortByName(stacks, 'id');
+}
+
+async function loadAgents(dir) {
+  const agents = [];
+  for (const entry of await listDir(dir)) {
+    if (!entry.isFile() || !entry.name.endsWith('.md')) continue;
+    const path = join(dir, entry.name);
+    agents.push(toComponent('agent', path, basename(entry.name, '.md'), await readFile(path, 'utf8')));
+  }
+  return sortByName(agents);
+}
+
+async function loadSkills(dir) {
+  const skills = [];
+  for (const entry of await listDir(dir)) {
+    if (!entry.isDirectory()) continue;
+    const path = join(dir, entry.name, 'SKILL.md');
+    let source;
+    try {
+      source = await readFile(path, 'utf8');
+    } catch {
+      continue;
+    }
+    skills.push(toComponent('skill', path, entry.name, source));
+  }
+  return sortByName(skills);
+}
+
+function toComponent(kind, path, fileName, source) {
+  const { data } = parseFrontmatter(source);
+  return {
+    kind,
+    name: data.name,
+    fileName,
+    description: data.description,
+    intents: asList(data.intents),
+    stacks: asList(data.stacks),
+    // `routing: manual` marks helpers that Claude invokes by description only.
+    routed: data.routing !== 'manual',
+    // Third-party components declare where they came from (see THIRD_PARTY_NOTICES.md).
+    source: data.source ?? null,
+    license: data.license ?? null,
+    path,
+  };
+}
+
+/** Structural checks for everything the plugin ships. Returns human-readable errors. */
+export function validateRegistry({ stacks, agents, skills }) {
+  const errors = [];
+  const stackIds = new Set(stacks.map((stack) => stack.id));
+
+  for (const stack of stacks) {
+    if (stack.id !== stack.dirName) errors.push(`stack ${stack.path}: id "${stack.id}" must match its folder`);
+  }
+  for (const id of DETECTABLE_STACKS) {
+    if (!stackIds.has(id)) errors.push(`stack "${id}" has a detector but no stacks/${id}/stack.json`);
+  }
+
+  const seen = new Set();
+  for (const component of [...agents, ...skills]) {
+    const label = `${component.kind} ${component.path}`;
+    if (!component.name) errors.push(`${label}: missing "name"`);
+    else if (component.name !== component.fileName) {
+      errors.push(`${label}: name "${component.name}" must match "${component.fileName}"`);
+    }
+    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(component.name ?? '')) {
+      errors.push(`${label}: name must be kebab-case`);
+    }
+    if (!component.description) errors.push(`${label}: missing "description"`);
+    if (component.routed && !component.intents.length) {
+      errors.push(`${label}: declare at least one intent in "intents" or set "routing: manual"`);
+    }
+    if (!component.stacks.length) errors.push(`${label}: declare "stacks" (use "*" for any stack)`);
+
+    if (component.source && !component.license) errors.push(`${label}: "source" requires "license"`);
+
+    for (const intent of component.intents) {
+      if (!INTENT_IDS.includes(intent)) errors.push(`${label}: unknown intent "${intent}"`);
+    }
+    for (const stack of component.stacks) {
+      if (stack !== ANY_STACK && !stackIds.has(stack)) errors.push(`${label}: unknown stack "${stack}"`);
+    }
+
+    const key = `${component.kind}:${component.name}`;
+    if (seen.has(key)) errors.push(`${label}: duplicate ${component.kind} name "${component.name}"`);
+    seen.add(key);
+  }
+
+  return errors;
+}
+
+function asList(value) {
+  if (value === undefined || value === '') return [];
+  return Array.isArray(value) ? value.map(String) : [String(value)];
+}
+
+async function listDir(dir) {
+  try {
+    return await readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+
+function sortByName(items, key = 'name') {
+  return items.sort((a, b) => String(a[key] ?? a.fileName).localeCompare(String(b[key] ?? b.fileName)));
+}

package/core/router/intent-detector.mjs

@@ -0,0 +1,75 @@
+import { AREAS, DEBUG_DOMINATES, INTENTS, INTENT_IDS, STACK_HINTS } from './intents.mjs';
+
+export function normalize(text) {
+  return String(text ?? '')
+    .normalize('NFD')
+    .replace(/\p{Diacritic}/gu, '')
+    .toLowerCase();
+}
+
+/**
+ * Detects what the user wants from a free-text prompt.
+ *
+ * @returns {{ intent: string|null, confidence: number, scores: Record<string, number>,
+ *   stack: string|null, stackHints: string[], area: string|null }}
+ */
+export function detectIntent(prompt) {
+  const text = normalize(prompt);
+  const scores = matchTerms(text, Object.entries(INTENTS));
+  const stackHints = Object.keys(matchTerms(text, STACK_HINTS));
+  const area = Object.keys(matchTerms(text, AREAS))[0] ?? null;
+
+  const ranked = INTENT_IDS.filter((id) => scores[id]).sort((a, b) => scores[b] - scores[a]);
+  let intent = ranked[0] ?? null;
+  if (intent && DEBUG_DOMINATES.has(intent) && scores.debug) intent = 'debug';
+
+  const total = Object.values(scores).reduce((sum, value) => sum + value, 0);
+  const confidence = intent ? round(scores[intent] / total) : 0;
+  const stack = stackHints[0] ?? null;
+
+  return {
+    intent,
+    confidence,
+    scores,
+    stack,
+    stackHints,
+    area: area ?? inferArea(intent, stack),
+  };
+}
+
+// Longest terms claim their span first, so "testflight" never also counts as "test"
+// and "kotlin multiplatform" never also counts as "kotlin". Groups with no match are
+// omitted; the returned keys keep the declaration order of `groups`.
+function matchTerms(text, groups) {
+  const terms = groups
+    .flatMap(([id, words]) => words.map((word) => ({ id, word })))
+    .sort((a, b) => b.word.length - a.word.length);
+  const claimed = new Array(text.length).fill(false);
+  const counts = new Map();
+
+  for (const { id, word } of terms) {
+    const pattern = new RegExp(`(?<![\\p{L}\\p{N}])${escapeRegExp(word)}`, 'gu');
+    for (const match of text.matchAll(pattern)) {
+      const start = match.index;
+      const end = start + word.length;
+      if (claimed.slice(start, end).some(Boolean)) continue;
+      claimed.fill(true, start, end);
+      counts.set(id, (counts.get(id) ?? 0) + 1);
+    }
+  }
+
+  return Object.fromEntries(groups.filter(([id]) => counts.has(id)).map(([id]) => [id, counts.get(id)]));
+}
+
+function inferArea(intent, stack) {
+  if (intent !== 'debug' && intent !== 'build') return null;
+  return { android: 'gradle', ios: 'xcode', 'react-native': 'metro' }[stack] ?? null;
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+}
+
+function round(value) {
+  return Math.round(value * 100) / 100;
+}

package/core/router/intents.mjs

@@ -0,0 +1,91 @@
+// Keyword stems are matched against normalized text (lowercase, no diacritics) at word
+// boundaries, so "compil" matches "compilar", "compile" and "compilação".
+// Order matters: it is the tie-break priority when two intents score the same. Specific
+// concerns (security, performance...) come before the generic "review".
+export const INTENTS = {
+  debug: [
+    'debug', 'erro', 'error', 'crash', 'falh', 'fail', 'exception', 'excecao', 'bug',
+    'quebr', 'parou', 'nao compila', 'nao funciona', 'not working', 'stack trace',
+    'stacktrace', 'broken', 'fatal', 'anr',
+  ],
+  security: [
+    'seguranca', 'security', 'vulnerab', 'owasp', 'secret', 'credencia', 'criptograf',
+    'encrypt', 'ssl pinning', 'certificate pinning', 'jailbreak', 'root detection',
+    'keychain', 'secure storage', 'autentica',
+  ],
+  performance: [
+    'performance', 'desempenho', 'lento', 'lentidao', 'slow', 'jank', 'fps', 'memoria',
+    'memory', 'leak', 'startup', 'rebuild', 'bateria', 'battery', 'app size', 'apk size',
+    'ipa size', 'tamanho do app', 'tamanho do apk', 'tamanho do ipa', 'lag',
+    'travando', 'engasg',
+  ],
+  test: [
+    'test', 'teste', 'cobertura', 'coverage', 'golden', 'espresso', 'xctest', 'maestro',
+    'appium', 'patrol', 'tdd', 'mock',
+  ],
+  architecture: [
+    'arquitetura', 'architecture', 'modulariza', 'clean architecture', 'feature-first',
+    'feature first', 'estrutura de pastas', 'state management', 'gerenciamento de estado',
+    'injecao de dependencia', 'dependency injection', 'design pattern', 'camada',
+  ],
+  release: [
+    'release', 'publica', 'publish', 'loja', 'app store', 'play store', 'testflight',
+    'lancamento', 'submission', 'store review', 'rejeita', 'reject',
+  ],
+  accessibility: [
+    'acessibilidade', 'accessibility', 'a11y', 'leitor de tela', 'screen reader',
+    'talkback', 'voiceover', 'contraste', 'semantics',
+  ],
+  review: [
+    'review', 'revis', 'code review', 'pull request', 'pr', 'analis', 'avali', 'audit',
+    'code smell',
+  ],
+  migration: ['migra', 'migrate', 'upgrade', 'null safety'],
+  dependency: [
+    'dependencia', 'dependenc', 'pacote', 'package', 'pubspec', 'podfile', 'outdated',
+    'desatualizad', 'npm audit',
+  ],
+  build: [
+    'build', 'compil', 'gradle', 'xcodebuild', 'archive', 'apk', 'aab', 'ipa', 'assemble',
+  ],
+  deployment: [
+    'deploy', 'pipeline', 'ci/cd', 'github actions', 'fastlane', 'codemagic', 'bitrise',
+    'azure devops',
+  ],
+};
+
+export const INTENT_IDS = Object.keys(INTENTS);
+
+// A failing build or pipeline is a debugging task, not a build/deploy task.
+export const DEBUG_DOMINATES = new Set(['build', 'deployment', 'dependency', 'migration']);
+
+// First match wins, so the most specific stacks come first.
+export const STACK_HINTS = [
+  ['flutter', ['flutter', 'dart', 'pubspec']],
+  ['react-native', ['react native', 'react-native', 'expo', 'metro']],
+  ['kotlin-multiplatform', ['kotlin multiplatform', 'kmp', 'compose multiplatform']],
+  ['android', ['android', 'kotlin', 'gradle', 'jetpack compose', 'play store', 'apk', 'aab']],
+  ['ios', ['ios', 'swift', 'swiftui', 'xcode', 'cocoapods', 'testflight', 'app store', 'ipa']],
+];
+
+export const AREAS = [
+  ['gradle', ['gradle', 'agp', 'compiledebugkotlin', 'kapt', 'ksp']],
+  ['xcode', ['xcode', 'xcodebuild', 'derived data', 'deriveddata']],
+  ['cocoapods', ['cocoapods', 'pod install', 'podfile']],
+  ['spm', ['swift package', 'spm']],
+  ['metro', ['metro']],
+  ['signing', ['signing', 'assinatura', 'provisioning', 'certificado', 'certificate', 'keystore']],
+  ['manifest', ['androidmanifest', 'manifest']],
+  ['proguard', ['proguard', 'r8', 'minify']],
+  ['pub', ['pub get', 'pubspec', 'version solving']],
+];
+
+// Areas that only exist on one native platform, used to focus cross-platform projects.
+export const AREA_PLATFORM = {
+  gradle: 'android',
+  manifest: 'android',
+  proguard: 'android',
+  xcode: 'ios',
+  cocoapods: 'ios',
+  spm: 'ios',
+};

package/core/router/router.mjs

@@ -0,0 +1,83 @@
+import { detectStack } from '../detection/stack-detector.mjs';
+import { ANY_STACK, loadRegistry } from '../registry/registry.mjs';
+import { AREA_PLATFORM, INTENT_IDS } from './intents.mjs';
+import { detectIntent } from './intent-detector.mjs';
+
+/**
+ * prompt → intent → stack → agent → skills.
+ *
+ * The project on disk decides the stack. Prompt hints only fill in an unknown stack or
+ * narrow a cross-platform project to one of its native platforms ("the Android build of
+ * my Flutter app fails" loads Flutter and Android skills).
+ */
+export async function route({ prompt = '', intent: explicitIntent, projectDir = process.cwd(), registry } = {}) {
+  if (explicitIntent && !INTENT_IDS.includes(explicitIntent)) {
+    throw new Error(`Unknown intent "${explicitIntent}". Known intents: ${INTENT_IDS.join(', ')}`);
+  }
+
+  const components = registry ?? (await loadRegistry());
+  const parsed = detectIntent(prompt);
+  const detection = await detectStack(projectDir);
+  const warnings = [];
+
+  const intent = explicitIntent ?? parsed.intent;
+  const stack = detection.stack !== 'unknown' ? detection.stack : (parsed.stack ?? 'unknown');
+  const platformFocus = [...new Set([...parsed.stackHints, AREA_PLATFORM[parsed.area]])].filter(
+    (hint) => hint && hint !== stack && detection.platforms.includes(hint),
+  );
+
+  if (detection.stack === 'unknown') {
+    warnings.push(
+      parsed.stack
+        ? `No mobile project found in ${detection.projectDir}; using "${parsed.stack}" from the prompt.`
+        : `No mobile project found in ${detection.projectDir}; only stack-agnostic skills apply.`,
+    );
+  }
+  if (!intent) warnings.push('Could not infer an intent from the prompt; pass --intent explicitly.');
+
+  const agent = intent ? selectAgent(components.agents, intent, stack) : null;
+  if (intent && !agent) warnings.push(`No agent handles intent "${intent}" yet.`);
+
+  const skills = intent ? selectSkills(components.skills, intent, [stack, ...platformFocus]) : [];
+
+  return {
+    intent,
+    intentSource: explicitIntent ? 'explicit' : 'prompt',
+    confidence: explicitIntent ? 1 : parsed.confidence,
+    area: parsed.area,
+    stack,
+    platformFocus,
+    detection,
+    agent,
+    skills,
+    warnings,
+  };
+}
+
+export function selectAgent(agents, intent, stack) {
+  return (
+    agents
+      .filter((agent) => agent.routed && agent.intents.includes(intent))
+      .map((agent) => ({ agent, score: stackScore(agent.stacks, [stack]) }))
+      .filter(({ score }) => score > 0)
+      .sort((a, b) => b.score - a.score || a.agent.name.localeCompare(b.agent.name))[0]?.agent ?? null
+  );
+}
+
+/** Skills for the primary stack first, then focused platforms, then stack-agnostic ones. */
+export function selectSkills(skills, intent, stacks) {
+  return skills
+    .filter((skill) => skill.routed && skill.intents.includes(intent))
+    .map((skill) => ({ skill, score: stackScore(skill.stacks, stacks) }))
+    .filter(({ score }) => score > 0)
+    .sort((a, b) => b.score - a.score || a.skill.name.localeCompare(b.skill.name))
+    .map(({ skill }) => skill);
+}
+
+// Earlier stacks weigh more; "*" matches anything with the lowest weight.
+function stackScore(declared, stacks) {
+  for (const [index, stack] of stacks.entries()) {
+    if (declared.includes(stack)) return stacks.length - index + 1;
+  }
+  return declared.includes(ANY_STACK) ? 1 : 0;
+}

package/core/security/redact.mjs

@@ -0,0 +1,24 @@
+const MASK = '********';
+
+// Patterns target literal secrets, not identifiers: `final token = await read()` must stay
+// readable in a code review, while `apiKey = "AIza..."` must not leak to a model.
+const RULES = [
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, `-----BEGIN PRIVATE KEY-----\n${MASK}\n-----END PRIVATE KEY-----`],
+  [/(authorization["']?\s*[:=]\s*["']?(?:bearer|basic|token)\s+)[^\s"'`]+/gi, `$1${MASK}`],
+  [/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, MASK],
+  [/\bAKIA[0-9A-Z]{16}\b/g, MASK],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/g, MASK],
+  [/\bgh[pousr]_[A-Za-z0-9]{36,}\b/g, MASK],
+  [/\bsk-[A-Za-z0-9_-]{20,}\b/g, MASK],
+  // apiKey = "…", "client_secret": "…", password: '…'
+  [/(\b[\w.-]*(?:password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)[\w.-]*["']?\s*[:=]\s*)(["'])([^"'\n]{8,})\2/gi, `$1$2${MASK}$2`],
+  // .env / gradle.properties / key.properties: API_KEY=…, storePassword=…
+  [/^([+\- ]?\s*(?:export\s+)?[A-Z0-9_]*(?:PASSWORD|SECRET|TOKEN|API_KEY|APIKEY|PRIVATE_KEY|ACCESS_KEY)[A-Z0-9_]*\s*=\s*)\S+/gm, `$1${MASK}`],
+  [/^([+\- ]?\s*\w*[Pp]assword\s*=\s*)\S+/gm, `$1${MASK}`],
+];
+
+export function redactSecrets(text) {
+  let result = String(text ?? '');
+  for (const [pattern, replacement] of RULES) result = result.replace(pattern, replacement);
+  return result;
+}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "reis-mobile",
+  "version": "0.3.5",
+  "description": "AI agents, skills and workflows for Flutter, Android, iOS and React Native development.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Warleson Reis",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wrsilva/reis-mobile.git"
+  },
+  "bin": {
+    "reis-mobile": "bin/reis-mobile.mjs"
+  },
+  "files": [
+    ".claude-plugin",
+    "agents",
+    "bin",
+    "commands",
+    "core",
+    "skills",
+    "stacks",
+    "THIRD_PARTY_NOTICES.md",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node --test",
+    "validate": "node bin/reis-mobile.mjs validate",
+    "check": "npm run validate && npm test"
+  },
+  "keywords": ["mobile", "flutter", "android", "ios", "react-native", "claude-code", "plugin", "agents"]
+}