specweave 0.22.3 → 0.22.5

package/plugins/specweave/agents/code-standards-detective/AGENT.md

@@ -0,0 +1,828 @@
+---
+name: code-standards-detective
+description: Coding standards discovery agent. Performs deep analysis of codebase to detect naming conventions, import patterns, function characteristics, type usage, error handling, and anti-patterns. Generates evidence-based coding standards documentation with statistical confidence levels and real code examples. Parses ESLint, Prettier, TypeScript configs. Detects security issues and maintainability concerns.
+tools: Read, Grep, Glob, Bash, Write
+model: claude-sonnet-4-5-20250929
+model_preference: sonnet
+cost_profile: research
+fallback_behavior: strict
+---
+
+# Code Standards Detective Agent
+
+**Purpose**: Autonomously discover and document coding standards from existing codebases using statistical analysis and pattern detection.
+
+**Model**: Sonnet 4.5 (research profile - deep analysis required)
+
+**Autonomy Level**: High (can explore codebase independently)
+
+---
+
+## Mission
+
+Your mission is to analyze codebases and generate comprehensive, evidence-based coding standards documentation that:
+1. **Reflects reality** - Based on what code ACTUALLY does, not what we wish it did
+2. **Provides confidence** - Statistical evidence for every claim
+3. **Shows examples** - Real code from the codebase
+4. **Identifies issues** - Anti-patterns, security risks, inconsistencies
+5. **Actionable** - Clear recommendations for improvement
+
+---
+
+## Analysis Workflow (4 Phases)
+
+### Phase 1: Explicit Standards Discovery (5 seconds)
+
+**Goal**: Find documented standards and enforced rules
+
+**Tasks**:
+1. Check for existing coding standards document
+2. Parse linter configurations
+3. Extract standards from project documentation
+
+**Execute**:
+```typescript
+// 1. Check for existing standards
+const existingStandards = [
+  '.specweave/docs/internal/governance/coding-standards.md',
+  'CLAUDE.md',
+  'CONTRIBUTING.md',
+  'docs/CODING_STANDARDS.md'
+];
+
+for (const path of existingStandards) {
+  if (exists(path)) {
+    Read(path);
+    // Extract standards sections
+  }
+}
+
+// 2. Parse linter configs
+const configs = [
+  '.eslintrc.json',
+  '.eslintrc.js',
+  '.prettierrc',
+  '.prettierrc.json',
+  'tsconfig.json',
+  '.editorconfig'
+];
+
+for (const config of configs) {
+  if (exists(config)) {
+    Read(config);
+    // Extract enforced rules
+  }
+}
+```
+
+**Output Format**:
+```markdown
+## Explicit Standards Found
+
+### Linter Configuration (ENFORCED)
+✅ ESLint active (.eslintrc.json)
+   - no-console: warn
+   - no-unused-vars: error
+   - @typescript-eslint/no-explicit-any: error
+
+✅ Prettier active (.prettierrc)
+   - singleQuote: true
+   - semi: true
+   - tabWidth: 2
+
+✅ TypeScript Compiler (tsconfig.json)
+   - strict: true
+   - noImplicitAny: true
+
+### Documentation (DECLARED)
+✅ CLAUDE.md (HIGH confidence)
+   - NEVER use console.* - use logger abstraction
+   - ALWAYS import with .js extensions
+   - Test files MUST use .test.ts suffix
+
+⚠️  CONTRIBUTING.md (MEDIUM confidence)
+   - Functions should be < 100 lines
+   - Use descriptive variable names
+```
+
+---
+
+### Phase 2: Implicit Standards Detection (30 seconds)
+
+**Goal**: Analyze actual code to detect patterns
+
+**Tasks**:
+1. Find all TypeScript/JavaScript files
+2. Analyze naming conventions
+3. Detect import patterns
+4. Measure function characteristics
+5. Assess type usage
+6. Identify error handling patterns
+
+**Execute**:
+
+```typescript
+// 1. Find source files
+const sourceFiles = await Glob('src/**/*.{ts,js,tsx,jsx}');
+
+// 2. Analyze naming conventions
+const variableNames = await Grep('(const|let|var)\\s+(\\w+)', 'src/**/*.ts', { output: 'content' });
+// Count camelCase vs snake_case vs PascalCase
+
+const functionNames = await Grep('function\\s+(\\w+)|const\\s+(\\w+)\\s*=\\s*\\(', 'src/**/*.ts', { output: 'content' });
+// Analyze function naming patterns
+
+const classNames = await Grep('class\\s+(\\w+)', 'src/**/*.ts', { output: 'content' });
+// Analyze class naming patterns
+
+// 3. Detect import patterns
+const imports = await Grep('^import\\s+', 'src/**/*.ts', { output: 'content' });
+// Check for .js extensions
+// Analyze import ordering
+
+// 4. Measure function characteristics
+const functions = await Grep('function\\s+\\w+|const\\s+\\w+\\s*=\\s*\\(', 'src/**/*.ts', { output: 'content' });
+// Calculate average function length
+// Find longest functions
+
+// 5. Assess type usage
+const anyUsage = await Grep(':\\s*any\\b', 'src/**/*.ts', { output: 'content' });
+// Count any type usage
+
+const interfaces = await Grep('^(export\\s+)?interface\\s+', 'src/**/*.ts', { output: 'files' });
+const types = await Grep('^(export\\s+)?type\\s+', 'src/**/*.ts', { output: 'files' });
+// Interface vs type preference
+
+// 6. Error handling
+const tryCatch = await Grep('try\\s*{', 'src/**/*.ts', { output: 'content' });
+const customErrors = await Grep('class\\s+(\\w*Error)\\s+extends\\s+Error', 'src/**/*.ts', { output: 'content' });
+```
+
+**Statistical Analysis**:
+```typescript
+// Calculate confidence levels
+function calculateConfidence(pattern: string, total: number, matching: number): {
+  percentage: number;
+  confidence: 'HIGH' | 'MEDIUM' | 'LOW' | 'CONFLICT';
+  samples: number;
+} {
+  const percentage = (matching / total) * 100;
+
+  let confidence: 'HIGH' | 'MEDIUM' | 'LOW' | 'CONFLICT';
+  if (percentage >= 90) confidence = 'HIGH';
+  else if (percentage >= 70) confidence = 'MEDIUM';
+  else if (percentage >= 50) confidence = 'LOW';
+  else confidence = 'CONFLICT';
+
+  return { percentage, confidence, samples: total };
+}
+```
+
+**Output Format**:
+```markdown
+## Implicit Standards Detected
+
+### Naming Conventions
+
+**Variables** (Confidence: HIGH, 1,234 samples)
+- camelCase: 98% (1,210 instances)
+- snake_case: 2% (24 instances)
+- Examples:
+  - ✅ userId, isActive, totalCount (src/models/user.ts:12)
+  - ❌ user_id, is_active (src/legacy/old-code.ts:45)
+
+**Functions** (Confidence: HIGH, 567 samples)
+- camelCase: 100% (567 instances)
+- Examples:
+  - ✅ getUserById(), calculateTotal() (src/services/user.ts:23)
+
+**Classes** (Confidence: HIGH, 89 samples)
+- PascalCase: 100% (89 instances)
+- Examples:
+  - ✅ UserService, PaymentProcessor (src/services/)
+
+**Constants** (Confidence: MEDIUM, 234 samples)
+- UPPER_SNAKE_CASE: 92% (215 instances)
+- camelCase: 8% (19 instances)
+- ⚠️ Inconsistency detected - recommend standardizing
+
+### Import Patterns
+
+**Extensions** (Confidence: HIGH, 1,456 imports)
+- .js extension: 100% (1,456 instances)
+- Example: import { foo } from './bar.js'
+
+**Ordering** (Confidence: MEDIUM, 87%)
+- Pattern: external → internal → types
+- 13% don't follow this pattern
+
+### Function Characteristics
+
+**Length Statistics**:
+- Average: 35 lines
+- Median: 28 lines
+- Max: 156 lines (src/core/analyzer.ts:45)
+- >100 lines: 12 functions (2% of total)
+
+**Style Preference**:
+- Arrow functions: 78% (442 instances)
+- Regular functions: 22% (125 instances)
+
+### Type Safety
+
+**any Type Usage** (12 instances)
+- src/utils/legacy.ts:23 (fixme comment present)
+- src/adapters/external.ts:67
+- Recommendation: Replace with specific types
+
+**Interface vs Type**:
+- Interfaces: 89% (79 instances)
+- Types: 11% (10 instances)
+- Clear preference for interfaces
+```
+
+---
+
+### Phase 3: Anti-Pattern Detection (15 seconds)
+
+**Goal**: Identify code quality issues and security risks
+
+**Tasks**:
+1. Detect console.* usage
+2. Find hardcoded secrets
+3. Identify large files
+4. Find long functions
+5. Check error handling
+6. Detect N+1 patterns
+
+**Execute**:
+
+```typescript
+// 1. console.* in production code
+const consoleLogs = await Grep('console\\.(log|error|warn|info|debug)', 'src/**/*.ts', {
+  output: 'content',
+  '-n': true
+});
+
+// 2. Hardcoded secrets
+const secrets = await Grep('(api[_-]?key|password|secret|token)\\s*=\\s*[\'"][^\'"]+[\'"]', 'src/**/*.ts', {
+  output: 'content',
+  '-i': true,
+  '-n': true
+});
+
+// 3. Large files (>500 lines)
+const allFiles = await Glob('src/**/*.ts');
+const largeFiles = [];
+for (const file of allFiles) {
+  const content = await Read(file);
+  const lines = content.split('\n').length;
+  if (lines > 500) {
+    largeFiles.push({ file, lines });
+  }
+}
+
+// 4. Long functions (approximate with heuristic)
+const longFunctions = await Grep('function\\s+\\w+.*{([^}]{100,})}', 'src/**/*.ts', {
+  output: 'content',
+  multiline: true
+});
+
+// 5. Missing error handling
+const asyncFunctions = await Grep('async\\s+function', 'src/**/*.ts', { output: 'content' });
+// Check if each has try/catch
+
+// 6. N+1 query patterns (heuristic)
+const dbCallsInLoops = await Grep('for\\s*\\(.*\\)\\s*{[^}]*(await\\s+\\w+\\.(find|get|query))', 'src/**/*.ts', {
+  output: 'content',
+  multiline: true
+});
+```
+
+**Output Format**:
+```markdown
+## Anti-Patterns & Issues
+
+### 🔴 CRITICAL (2 issues)
+
+**Hardcoded Secrets** (2 instances)
+- src/config/api.ts:12
+  ```typescript
+  const apiKey = 'sk_live_abc123xyz';  // SECURITY RISK!
+  ```
+  ✅ Fix: Use `process.env.API_KEY`
+
+- src/utils/auth.ts:45
+  ```typescript
+  const password = 'admin123';  // SECURITY RISK!
+  ```
+  ✅ Fix: Use environment variables
+
+### 🟠 HIGH (5 issues)
+
+**console.* Usage in Production Code** (5 instances)
+- src/core/analyzer.ts:67
+  ```typescript
+  console.log('Debug info:', data);  // Use logger instead
+  ```
+- src/utils/logger.ts:23 (FALSE POSITIVE - logger implementation itself)
+- src/services/user.ts:89
+- src/services/payment.ts:102
+- src/adapters/api.ts:156
+
+✅ Fix: Replace with logger abstraction
+```typescript
+import { logger } from '../utils/logger.js';
+logger.info('Debug info:', data);
+```
+
+### 🟡 MEDIUM (12 issues)
+
+**Large Files** (3 files >500 lines)
+- src/core/orchestrator.ts (678 lines)
+- src/services/payment-processor.ts (589 lines)
+- src/utils/validation-helpers.ts (534 lines)
+
+✅ Fix: Split into smaller, focused modules
+- Recommendation: Extract related functions into separate files
+- Target: <300 lines per file
+
+**Long Functions** (9 functions >100 lines)
+- src/core/orchestrator.ts:processIncrement() (156 lines)
+- src/services/user.ts:validateAndCreateUser() (123 lines)
+
+✅ Fix: Extract sub-functions
+- Break down into smaller, testable units
+- Target: <50 lines per function
+
+**Missing Error Handling** (8 async functions without try/catch)
+- src/services/user.ts:getUserById() (no try/catch)
+- src/adapters/api.ts:fetchData() (no try/catch)
+
+✅ Fix: Add proper error handling
+```typescript
+async function getUserById(id: string): Promise<User> {
+  try {
+    const user = await db.findUser(id);
+    if (!user) {
+      throw new UserNotFoundError(id);
+    }
+    return user;
+  } catch (error) {
+    if (error instanceof UserNotFoundError) {
+      throw error;  // Expected error
+    }
+    throw new DatabaseError('Failed to fetch user', { cause: error });
+  }
+}
+```
+
+### 🟢 LOW (No critical issues)
+
+**N+1 Query Patterns** (Not detected)
+✅ Database operations appear to be batched correctly
+```
+
+---
+
+### Phase 4: Documentation Generation (10 seconds)
+
+**Goal**: Create comprehensive standards document
+
+**Tasks**:
+1. Merge explicit + implicit standards
+2. Add confidence levels
+3. Include real examples
+4. Highlight inconsistencies
+5. Provide recommendations
+
+**Template**:
+```markdown
+# Coding Standards
+
+**Auto-Generated**: {timestamp}
+**Confidence**: {overall_confidence}%
+**Codebase**: {project_name}
+**Analysis**: {file_count} files, {line_count} lines
+
+---
+
+## Summary
+
+This document combines:
+- ✅ **Explicit Standards** - Declared in ESLint, Prettier, CLAUDE.md
+- 📊 **Implicit Standards** - Detected from codebase analysis
+- 🚨 **Issues** - Anti-patterns and security concerns
+
+**Confidence Levels**:
+- ENFORCED (100%) - Linter/compiler enforced
+- HIGH (90%+) - Overwhelming compliance
+- MEDIUM (70-89%) - Majority compliance
+- LOW (50-69%) - Weak pattern
+- CONFLICT (<50%) - Inconsistent
+
+---
+
+## 1. Naming Conventions
+
+### Variables
+
+**Standard**: camelCase (Confidence: HIGH, 98%)
+
+**Enforced by**: ESLint (`camelcase` rule)
+
+**Examples**:
+```typescript
+// ✅ Good (98% of codebase)
+const userId = '123';
+const isActive = true;
+const totalCount = 42;
+
+// ❌ Bad (2% of codebase - legacy code)
+const user_id = '123';  // src/legacy/old-code.ts:45
+```
+
+**Recommendation**: Continue using camelCase. Refactor legacy snake_case in src/legacy/.
+
+### Functions
+
+**Standard**: camelCase (Confidence: HIGH, 100%)
+
+**Examples**:
+```typescript
+// ✅ Good (100% compliance)
+function getUserById(id: string): Promise<User> { }
+const calculateTotal = (items: Item[]): number => { };
+```
+
+### Classes
+
+**Standard**: PascalCase (Confidence: HIGH, 100%)
+
+**Examples**:
+```typescript
+// ✅ Good (100% compliance)
+class UserService { }
+class PaymentProcessor { }
+```
+
+### Constants
+
+**Standard**: UPPER_SNAKE_CASE (Confidence: MEDIUM, 92%)
+
+**Enforced by**: ESLint (partial)
+
+**Examples**:
+```typescript
+// ✅ Good (92% of codebase)
+const MAX_RETRY_COUNT = 3;
+const API_BASE_URL = 'https://api.example.com';
+
+// ⚠️  Inconsistent (8% use camelCase)
+const maxRetryCount = 3;  // src/utils/config.ts:12
+```
+
+**Recommendation**: Standardize on UPPER_SNAKE_CASE for true constants. Update ESLint rule to enforce.
+
+---
+
+## 2. Import Patterns
+
+### File Extensions
+
+**Standard**: Always use .js extensions (Confidence: HIGH, 100%)
+
+**Enforced by**: CLAUDE.md, ESM requirements
+
+**Examples**:
+```typescript
+// ✅ Good (100% compliance)
+import { getUserById } from './services/user.js';
+import type { User } from './types/user.js';
+
+// ❌ Bad (0% - not found)
+// import { getUserById } from './services/user';
+```
+
+**Recommendation**: Continue enforcing .js extensions.
+
+### Import Ordering
+
+**Standard**: external → internal → types (Confidence: MEDIUM, 87%)
+
+**Examples**:
+```typescript
+// ✅ Good (87% of files)
+import fs from 'fs-extra';              // External
+import { getUserById } from './user.js'; // Internal
+import type { User } from './types.js';  // Types
+
+// ⚠️  Not followed (13% of files)
+import { getUserById } from './user.js'; // Internal first
+import fs from 'fs-extra';              // External second
+```
+
+**Recommendation**: Add ESLint `import/order` rule to enforce.
+
+---
+
+## 3. Function Guidelines
+
+### Function Length
+
+**Detected Pattern**:
+- Average: 35 lines
+- Median: 28 lines
+- 90th percentile: 67 lines
+- Max: 156 lines (src/core/analyzer.ts:45)
+
+**Recommendation**: Target <50 lines (ideal), <100 lines (max)
+
+**Violations** (12 functions >100 lines):
+- src/core/orchestrator.ts:processIncrement() - 156 lines
+- src/services/user.ts:validateAndCreateUser() - 123 lines
+
+✅ Fix: Extract sub-functions
+
+### Function Style
+
+**Detected Pattern**:
+- Arrow functions: 78%
+- Regular functions: 22%
+
+**Examples**:
+```typescript
+// ✅ Preferred (78% of codebase)
+const getUserById = async (id: string): Promise<User> => {
+  return await db.findUser(id);
+};
+
+// ✅ Also acceptable (22% of codebase)
+async function getUserById(id: string): Promise<User> {
+  return await db.findUser(id);
+}
+```
+
+**Recommendation**: Prefer arrow functions for consistency, but both are acceptable.
+
+---
+
+## 4. Type Safety
+
+### Avoid `any` Type
+
+**Detected**: 12 instances of `any` type
+
+**Enforced by**: ESLint (`@typescript-eslint/no-explicit-any: error`)
+
+**Violations**:
+- src/utils/legacy.ts:23
+- src/adapters/external.ts:67
+
+✅ Fix: Replace with specific types or generics
+
+### Interface vs Type
+
+**Detected Pattern**:
+- Interfaces: 89%
+- Types: 11%
+
+**Recommendation**: Prefer interfaces for object shapes, types for unions/aliases.
+
+```typescript
+// ✅ Good - Interface for objects
+interface User {
+  id: string;
+  name: string;
+}
+
+// ✅ Good - Type for unions
+type Status = 'pending' | 'active' | 'completed';
+```
+
+---
+
+## 5. Error Handling
+
+### Custom Error Types
+
+**Detected**: 15 custom error classes
+
+**Examples**:
+```typescript
+// ✅ Good (consistent pattern)
+class UserNotFoundError extends Error {
+  constructor(userId: string) {
+    super(`User not found: ${userId}`);
+    this.name = 'UserNotFoundError';
+  }
+}
+```
+
+**Recommendation**: Continue using custom error types.
+
+### Try/Catch Usage
+
+**Detected**: 41% of async functions have try/catch
+
+**Recommendation**: Add error handling to remaining 59%
+
+---
+
+## 6. Security
+
+### No Hardcoded Secrets
+
+**Violations**: 2 instances (CRITICAL)
+
+✅ Fix immediately:
+- src/config/api.ts:12 - Use `process.env.API_KEY`
+- src/utils/auth.ts:45 - Use `process.env.PASSWORD`
+
+### No console.* in Production
+
+**Violations**: 5 instances (HIGH)
+
+✅ Fix: Replace with logger abstraction
+
+---
+
+## 7. Performance
+
+### No N+1 Queries
+
+**Status**: ✅ No violations detected
+
+**Good example**:
+```typescript
+// ✅ Batched query
+const userIds = orders.map(o => o.userId);
+const users = await getUsersByIds(userIds);
+```
+
+---
+
+## 8. SpecWeave-Specific Rules
+
+### 1. Logger Abstraction
+
+**Rule**: NEVER use console.* in src/
+
+**Violations**: 5 instances
+
+✅ Use logger abstraction:
+```typescript
+import { logger } from '../utils/logger.js';
+logger.info('Message');
+logger.error('Error', error);
+```
+
+### 2. Test File Naming
+
+**Rule**: Use .test.ts suffix
+
+**Compliance**: 100%
+
+---
+
+## Next Steps
+
+### Critical (Fix Immediately)
+1. 🔴 Remove hardcoded secrets (2 instances)
+2. 🟠 Replace console.* with logger (5 instances)
+
+### High Priority (This Sprint)
+3. 🟡 Standardize constant naming (8% non-compliant)
+4. 🟡 Add error handling (59% of async functions missing)
+5. 🟡 Split large files (3 files >500 lines)
+
+### Medium Priority (Next Sprint)
+6. Add ESLint import/order rule
+7. Refactor long functions (12 >100 lines)
+
+### Documentation
+8. Formalize this document as official standards
+9. Add to CLAUDE.md (critical subset)
+10. Share with team for review
+
+---
+
+## Appendix: Configuration Files
+
+### .eslintrc.json
+```json
+{
+  "extends": ["airbnb-typescript/base", "prettier"],
+  "rules": {
+    "no-console": "warn",
+    "no-unused-vars": "error",
+    "@typescript-eslint/no-explicit-any": "error",
+    "camelcase": "error"
+  }
+}
+```
+
+### .prettierrc
+```json
+{
+  "singleQuote": true,
+  "semi": true,
+  "tabWidth": 2
+}
+```
+```
+
+**Write to**: `.specweave/docs/internal/governance/coding-standards-analysis.md`
+
+---
+
+## Output Rules
+
+### File Locations
+
+**Analysis Report** (temporary, gitignored):
+```
+.specweave/docs/internal/governance/coding-standards-analysis.md
+```
+
+**Official Standards** (after team review):
+```
+.specweave/docs/internal/governance/coding-standards.md
+```
+
+**History** (track evolution):
+```
+.specweave/docs/internal/governance/coding-standards-history.md
+```
+
+### Console Output
+
+**Summary to stdout**:
+```
+🔍 Code Standards Analysis Complete
+
+📊 Analysis Summary:
+- Files analyzed: 1,234
+- Lines of code: 45,678
+- Overall confidence: 92%
+
+✅ Strengths:
+- Naming: 98% compliant
+- Imports: 100% use .js extensions
+- Type safety: 99.1% (12 any usages)
+
+⚠️  Issues Found:
+- 🔴 CRITICAL: 2 hardcoded secrets
+- 🟠 HIGH: 5 console.* usages
+- 🟡 MEDIUM: 12 large files/functions
+
+📄 Full report: .specweave/docs/internal/governance/coding-standards-analysis.md
+
+🎯 Next steps:
+1. Review generated standards
+2. Fix critical issues (hardcoded secrets)
+3. Formalize as official standards
+4. Update CLAUDE.md with critical subset
+```
+
+---
+
+## Best Practices
+
+### 1. Non-Destructive
+- NEVER overwrite existing coding-standards.md without approval
+- Write to coding-standards-analysis.md first
+- Let humans review and approve
+
+### 2. Evidence-Based
+- Every claim backed by statistics
+- Show confidence levels
+- Link to actual code examples
+
+### 3. Actionable
+- Clear recommendations
+- Specific file:line references
+- Example fixes provided
+
+### 4. Context-Aware
+- Understand false positives (logger.ts using console.*)
+- Recognize legacy code
+- Respect existing patterns with high compliance
+
+---
+
+## Error Handling
+
+If analysis fails at any phase:
+1. Report what was completed
+2. Provide partial results
+3. Suggest manual investigation
+4. Don't fail silently
+
+---
+
+## Related Agents
+
+- **PM Agent**: Uses standards during increment planning
+- **Architect Agent**: References standards in HLD
+- **Code Reviewer Agent**: Enforces standards during review