slashdev 0.1.0 → 1.1.0

package/.gitmodules

@@ -0,0 +1,3 @@
+[submodule "vendor/gstack"]
+	path = vendor/gstack
+	url = https://github.com/garrytan/gstack.git

package/CLAUDE.md

@@ -0,0 +1,88 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Slashdev is a Node.js CLI tool that provides AI-powered "skills" (specialized agents) for developers. It uses the Anthropic Claude API to deliver expert assistance across domains like front-end design, product management, GitHub workflows, and testing.
+
+- **Version:** 0.2.0 (early stage)
+- **Runtime:** Node.js >= 18.0.0
+- **Module system:** ES modules (`"type": "module"`)
+- **Package manager:** npm
+- **Claude Code integration:** Installs hooks + skills to `~/.claude/` via `slashdev setup`
+- **Logging API:** `https://v1api.slashdev.io/api/logs` — prompt/response logs sent via post-response hook
+- **Auth (Claude Code):** Email domain validation (`@slashdev.io`), no tokens
+
+## Commands
+
+```bash
+npm start              # Run CLI (node bin/slashdev.js)
+npm test               # Currently just runs the CLI (no test framework yet)
+```
+
+No linter or formatter is configured.
+
+## Architecture
+
+**Entry flow:** `bin/slashdev.js` → `src/cli.js` (commander setup) → individual command handlers
+
+**Core modules (`src/core/`):**
+- `config.js` — Two separate `conf` stores: `~/.slashdev/config.json` (settings) and `~/.slashdev/credentials.json` (API keys + connections)
+- `claude.js` — Anthropic SDK wrapper with streaming/non-streaming chat. Default model: `claude-sonnet-4-20250514`, max tokens: 4096
+- `codebase.js` — Project context detection (frameworks, file listing). Ignores: node_modules, .git, dist, build, .next, .nuxt, coverage, .cache
+
+**Skill system (`src/skills/` + `skills/`):**
+Skills are registered in `src/skills/index.js` as a SKILLS object mapping. Each skill has:
+1. A registry entry (name, description, commands, optional `requiredConnections`)
+2. A system prompt markdown file at `skills/<skill-name>/prompts/system.md`
+3. A CLI command registered in `src/cli.js`
+
+The skill runner loads the system prompt, gathers project context via `codebase.js`, checks required connections, and streams Claude responses to stdout.
+
+**Installed skills:** front-end-design, product-expert, github-manager (requires github connection), front-end-testing, server-admin (requires servers connection)
+
+**Auth (`src/auth/`):** Interactive login with API key validation, stored separately in credentials config.
+
+**Claude Code integration (`src/commands/` + `hooks/` + `claude-skills/`):**
+- `src/commands/setup.js` — Prompts for `@slashdev.io` email, writes `~/.slashdev/config.json`, copies hooks to `~/.claude/hooks/`, copies skills to `~/.claude/skills/`, registers Stop + PreToolUse hooks in `~/.claude/settings.json`, writes Slashdev rules section to `~/.claude/CLAUDE.md`
+- `src/commands/update.js` — Re-copies hooks/skills without re-prompting for email, updates packageVersion in config, refreshes the Slashdev rules section in `~/.claude/CLAUDE.md`
+- `src/commands/setup-internals.js` — Shared `installHooks()`, `installSkills()`, `installGstack()`, and `writeGlobalClaudeMd()` used by both setup and update. The global CLAUDE.md writer is idempotent — it manages a single section bracketed by `<!-- SLASHDEV:RULES:START -->` / `<!-- SLASHDEV:RULES:END -->` markers, leaving any other user content untouched.
+- `hooks/post-response.sh` — Claude Code Stop hook that reads JSON from stdin, extracts session/prompt/response, POSTs to Slashdev logging API (fire-and-forget, async curl)
+- `hooks/pre-install-guard.sh` — Claude Code PreToolUse hook for the Bash tool. Reads tool-call JSON from stdin, detects bare dependency install commands (`npm/pnpm/yarn/bun install`, `composer install`, `pip install`, etc.), and returns `{"permissionDecision":"deny","message":"..."}` to force a retry with the `sfw` (Socket Firewall) prefix. Strips leading `cd <dir> &&` and env-var prefixes before matching. Fails open on parse errors so it can never break Claude Code. Smoke tests: `echo '{"tool_name":"Bash","tool_input":{"command":"npm install lodash"}}' | bash hooks/pre-install-guard.sh`.
+- `claude-skills/` — Claude Code skill files (SKILL.md with YAML frontmatter) copied to `~/.claude/skills/` during setup. Current skills: agentswarm, code-review, pr-description, scope-estimate, bug-diagnosis, frontend-design, secure-deploy. The `secure-deploy` skill walks Claude through retrofitting CI/CD configs (GitHub Actions, Dockerfiles, GitLab CI, deploy scripts, package.json) to wrap dependency installs with `sfw`.
+- `bin/check-setup.js` — Postinstall script that prints setup reminder if `~/.slashdev/config.json` is missing
+
+**Connections system (`src/connections/`):**
+Registry-based system for external service integrations. Each provider (in `providers/`) defines `promptForCredentials()`, `validate()`, and `createClient()`. Connections are stored in `~/.slashdev/credentials.json` under a `connections` key. Skills can declare `requiredConnections` to enforce availability. Providers can set `multiple: true` to support multiple entries (e.g. servers stores an array, GitHub stores a single object). SSH key auto-detection is in `src/utils/ssh-keys.js`. To add a new provider: create a provider file in `providers/`, register it in `registry.js` — no other changes needed.
+
+## CLI Commands
+
+```bash
+# Claude Code integration
+slashdev setup               # Install hooks + skills, configure email
+slashdev update              # Update hooks + skills to latest version
+
+# Authentication & connections
+slashdev login               # Set API key
+slashdev logout              # Clear credentials
+slashdev whoami              # Show auth status
+slashdev connect [service]   # Connect an external service (e.g. github, servers)
+slashdev disconnect [service] # Remove a connection
+slashdev connections         # List all connections and status
+
+# Skills (standalone, uses Anthropic API directly)
+slashdev skills              # List installed skills
+slashdev design <prompt>     # Front-end design help
+slashdev product <prompt>    # Product management help
+slashdev github <prompt>     # GitHub workflow help (alias: gh)
+slashdev test <prompt>       # Testing assistance
+slashdev server <prompt>     # Server administration (alias: ssh)
+```
+
+## Conventions
+
+- File names: camelCase (`codebase.js`)
+- Skill/command names: kebab-case (`front-end-design`)
+- Constants: UPPER_SNAKE_CASE (`BRAND_BLUE`, `IGNORE_DIRS`)
+- Brand color: `#215ff6` (blue) — used throughout terminal output via chalk

package/GETTING-STARTED.md

@@ -0,0 +1,68 @@
+# Slashdev CLI — Getting Started
+
+## Install
+
+```bash
+npm install -g slashdev
+slashdev setup
+```
+
+You'll be prompted for your `@slashdev.io` email. After setup, all skills are immediately available in Claude Code.
+
+## The Big One: Agentswarm
+
+In any project, open Claude Code and run:
+
+```
+/agentswarm "describe your task here"
+```
+
+This launches a full agent team that automatically:
+1. **Analyzes** your codebase and detects the stack
+2. **Plans** the implementation with test coverage
+3. **Implements** the code (backend + frontend in parallel)
+4. **Reviews** code quality, security, and performance
+5. **QA tests** — verifies test quality and audits API request counts per page
+
+It works with Laravel, React, Flutter, and whatever else is in the project.
+
+## Other Slashdev Skills
+
+| Command | What it does |
+|---------|-------------|
+| `/frontend-design` | Distinctive UI design — avoids generic AI aesthetics |
+| `/code-review` | Security, performance, and maintainability review |
+| `/pr-description` | Generate PR descriptions from your diff |
+| `/scope-estimate` | Effort estimation for tasks |
+| `/bug-diagnosis` | Systematic root-cause analysis |
+
+## gstack Skills (Bundled)
+
+We've bundled [gstack](https://github.com/garrytan/gstack) — 29 additional skills from Garry Tan. Highlights:
+
+| Command | What it does |
+|---------|-------------|
+| `/plan-ceo-review` | CEO-level plan review — challenges premises, finds the 10-star product |
+| `/plan-eng-review` | Eng manager review — locks in architecture and edge cases |
+| `/qa` | Opens a real browser, finds bugs, fixes them, re-verifies |
+| `/ship` | Automates testing, review, version bump, and PR creation |
+| `/review` | Pre-landing PR review for production bugs |
+| `/cso` | Security audit with OWASP Top 10 and secrets archaeology |
+| `/investigate` | Systematic debugging — no fixes without root cause |
+| `/design-consultation` | Builds a complete design system from scratch |
+| `/retro` | Weekly engineering retrospective with metrics |
+| `/careful` | Warns before destructive commands |
+
+All gstack skills are available immediately after `slashdev setup`.
+
+## Heads Up: Prompt Logging
+
+All prompts and responses in Claude Code are logged to our API so we can run analytics and help improve the team's prompting. This happens automatically via a background hook — no action needed on your part.
+
+## Updating
+
+```bash
+slashdev update
+```
+
+This pulls the latest skills and hooks. If you run into issues, `slashdev setup` will re-initialize everything.

package/README.md

@@ -1,6 +1,6 @@
 # Slashdev CLI
 
-Skills & workflows for AI agents in the Slashdev ecosystem.
+AI-powered skills and agent workflows for developers, built for Claude Code.
 
 ```
     _____ __           __        __
@@ -14,42 +14,179 @@ Skills & workflows for AI agents in the Slashdev ecosystem.
 
 ```bash
 npm install -g slashdev
+slashdev setup
 ```
 
-## Usage
+`slashdev setup` prompts for your `@slashdev.io` email, then installs hooks and skills to `~/.claude/`. After setup, all skills are immediately available in Claude Code.
+
+## What You Get
+
+### Claude Code Skills
+
+Installed to `~/.claude/skills/` and invoked directly in Claude Code:
+
+| Skill | Command | Description |
+|-------|---------|-------------|
+| **Agentswarm** | `/agentswarm` | Launch a full agent team to analyze, plan, implement, and review a task. Adapts to any stack. |
+| **Frontend Design** | `/frontend-design` | Distinctive, production-grade UI design. Avoids generic AI aesthetics. |
+| **Code Review** | `/code-review` | Security, performance, and maintainability review. |
+| **PR Description** | `/pr-description` | Generate structured pull request descriptions from diffs. |
+| **Scope Estimate** | `/scope-estimate` | Estimate effort for development tasks. |
+| **Bug Diagnosis** | `/bug-diagnosis` | Systematic root-cause analysis. |
+
+### gstack Skills
+
+[gstack](https://github.com/garrytan/gstack) by Garry Tan is bundled as a vendored submodule. After setup, all 29 gstack skills are available in Claude Code.
+
+#### Planning & Strategy
+
+| Skill | Description |
+|-------|-------------|
+| `/plan-ceo-review` | CEO/founder-level plan review — rethinks the problem, finds the 10-star product, challenges premises with four scope modes |
+| `/plan-eng-review` | Engineering manager plan review — locks in architecture, data flow, diagrams, and edge cases |
+| `/plan-design-review` | Designer's eye plan review — rates design dimensions 0-10 and iteratively improves the plan |
+| `/office-hours` | YC Office Hours mode — startup diagnostic or builder brainstorming with design doc output |
+| `/autoplan` | Auto-review pipeline with auto-decisions; surfaces taste decisions at the final approval gate |
+
+#### Design
+
+| Skill | Description |
+|-------|-------------|
+| `/design-consultation` | Proposes a complete design system and generates font + color preview pages |
+| `/design-review` | Designer's eye QA — finds visual inconsistency, spacing issues, and hierarchy problems, then fixes them |
+| `/design-shotgun` | Design exploration — generates multiple AI design variants and iterates on structured feedback |
+
+#### Building & Testing
+
+| Skill | Description |
+|-------|-------------|
+| `/qa` | Systematically QA tests your web app and fixes bugs found — iterative fix-verify loop with health scores |
+| `/qa-only` | Report-only QA testing — structured bug report without making code changes |
+| `/review` | Pre-landing PR review — analyzes diff for SQL safety, LLM trust violations, and structural issues |
+| `/investigate` | Systematic debugging with root cause investigation — four phases, no fixes without root cause |
+| `/browse` | Fast headless browser — navigate URLs, interact with elements, verify state, take screenshots |
+| `/benchmark` | Performance regression detection — establishes baselines and compares before/after on every PR |
+| `/codex` | OpenAI Codex CLI wrapper with code review, challenge mode, and consult |
+
+#### Shipping & Deployment
+
+| Skill | Description |
+|-------|-------------|
+| `/ship` | Ship workflow — merge base branch, run tests, review diff, bump version, update changelog, create PR |
+| `/land-and-deploy` | Merges PR, waits for CI/deploy, verifies production health via canary checks |
+| `/canary` | Post-deploy monitoring — watches live app for console errors, performance regressions, and page failures |
+| `/document-release` | Updates README, ARCHITECTURE, CONTRIBUTING, and CLAUDE.md to match what shipped |
+| `/retro` | Weekly engineering retrospective — analyzes commit history, work patterns, and code quality |
+
+#### Safety & Control
+
+| Skill | Description |
+|-------|-------------|
+| `/careful` | Warns before destructive commands (rm -rf, DROP TABLE, force-push, git reset --hard) |
+| `/cso` | Chief Security Officer mode — infrastructure-first security audit with secrets archaeology and OWASP Top 10 |
+| `/freeze` | Restrict file edits to a specific directory for the session |
+| `/unfreeze` | Clear the freeze boundary, allowing edits to all directories again |
+| `/guard` | Full safety mode — combines destructive command warnings with directory-scoped edits |
+
+#### Setup & Utilities
+
+| Skill | Description |
+|-------|-------------|
+| `/connect-chrome` | Launch real Chrome controlled by gstack with Side Panel extension for real-time action watching |
+| `/setup-browser-cookies` | Import cookies from your real browser into headless browse sessions |
+| `/setup-deploy` | Configure deployment settings for land-and-deploy; detects platform and writes config |
+| `/gstack-upgrade` | Upgrade gstack to latest version; detects global vs vendored install |
+
+### Standalone CLI Skills
+
+These use the Anthropic API directly from your terminal (requires `slashdev login`):
 
 ```bash
-# Show banner and info
-slashdev
+slashdev design "review my Button component"
+slashdev product "write a PRD for user authentication"
+slashdev github "create a PR description for the auth feature"
+slashdev test "write unit tests for the UserService"
+slashdev server "harden the SSH config"
+```
 
-# Display help
-slashdev --help
+## Agentswarm
+
+The headline feature. `/agentswarm` in Claude Code launches a hierarchical team of specialized agents:
 
-# Show version
-slashdev --version
 ```
+/agentswarm "Add user profiles with edit page"
 
-## What is Slashdev?
+  Analyst    → Scans codebase, detects stack (Laravel, React, Flutter, etc.)
+  Planner    → Creates file-by-file implementation plan with test plan
+  Implementer(s) → Writes code AND tests (backend + frontend in parallel)
+  Reviewer   → Code quality, security, performance review
+  QA Agent   → Test quality audit + API request count audit
+```
 
-Slashdev is a collection of skills and workflows designed for AI agents. It provides:
+**Key behaviors:**
+- **Stack-agnostic** — Detects and adapts to Laravel, React, Flutter, Vue, Rails, Django, or any framework
+- **Tests are mandatory** — Planner plans tests, Implementers write tests, QA Agent verifies test quality
+- **API request audit** — QA Agent counts API calls per frontend page and flags pages making too many requests (a common performance mistake)
+- **`/frontend-design` enforced** — Every frontend implementer invokes the design skill for distinctive UI
+- **Reviewer + QA run in parallel** — Code quality and behavioral correctness checked simultaneously
 
-- **Agent Skills** — Reusable capabilities for AI agents
-- **Workflows** — Orchestrated sequences of agent actions
-- **MCP Integrations** — Connect with Model Context Protocol servers
-- **Team Tools** — Collaboration utilities for agent teams
+## Setup & Authentication
 
-## Roadmap
+```bash
+# Initial setup (installs hooks + skills to ~/.claude/)
+slashdev setup
+
+# Set your Anthropic API key (for standalone CLI skills)
+slashdev login
+
+# Connect external services
+slashdev connect github    # GitHub personal access token
+slashdev connect servers   # SSH server connections
+```
 
-- [x] v0.1.0 — Initial CLI with banner display
-- [ ] v0.2.0 — `slashdev init` for project scaffolding
-- [ ] v0.3.0 — Skill management commands
-- [ ] v0.4.0 — Workflow definitions
-- [ ] v0.5.0 — MCP server integration
-- [ ] v1.0.0 — Stable API release
+## Updating
+
+```bash
+# Update slashdev skills and hooks
+slashdev update
+
+# Update gstack to latest from upstream
+cd /path/to/slashdev-cli
+git submodule update --remote vendor/gstack
+slashdev update
+```
+
+## All Commands
+
+```bash
+# Setup & updates
+slashdev setup               # Install hooks + skills, configure email
+slashdev update              # Update hooks + skills to latest version
+
+# Authentication
+slashdev login               # Set Anthropic API key
+slashdev logout              # Clear credentials
+slashdev whoami              # Show auth status
+
+# Connections
+slashdev connect [service]   # Connect external service (github, servers)
+slashdev disconnect [service] # Remove a connection
+slashdev connections         # List all connections
+
+# Standalone skills
+slashdev skills              # List installed skills
+slashdev design <prompt>     # Front-end design
+slashdev product <prompt>    # Product management
+slashdev github <prompt>     # GitHub workflows (alias: gh)
+slashdev test <prompt>       # Testing assistance
+slashdev server <prompt>     # Server administration (alias: ssh)
+```
 
 ## Requirements
 
 - Node.js >= 18.0.0
+- Claude Code (for Claude Code skills)
+- Anthropic API key (for standalone CLI skills)
 
 ## License
 

package/bin/check-setup.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+
+const configPath = join(homedir(), '.slashdev', 'config.json');
+
+function hasEngineer(filePath) {
+  try {
+    const data = JSON.parse(readFileSync(filePath, 'utf-8'));
+    return !!data.engineer;
+  } catch {
+    return false;
+  }
+}
+
+if (!existsSync(configPath) || !hasEngineer(configPath)) {
+  console.log('');
+  console.log('\x1b[36m  ┌──────────────────────────────────────────────────┐\x1b[0m');
+  console.log('\x1b[36m  │                                                  │\x1b[0m');
+  console.log('\x1b[36m  │\x1b[0m   Run \x1b[1mslashdev setup\x1b[0m to complete installation.   \x1b[36m│\x1b[0m');
+  console.log('\x1b[36m  │\x1b[0m   This will install Claude Code hooks & skills.  \x1b[36m│\x1b[0m');
+  console.log('\x1b[36m  │                                                  │\x1b[0m');
+  console.log('\x1b[36m  └──────────────────────────────────────────────────┘\x1b[0m');
+  console.log('');
+}