the-grid-cc 1.7.21 → 1.7.22

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "grid",
   "description": "Multi-agent orchestration for Claude Code. Master Control coordinates specialized Programs for complex development tasks.",
-  "version": "1.7.19",
+  "version": "1.7.22",
   "author": {
     "name": "James Weatherhead & Claude",
     "url": "https://github.com/JamesWeatherhead/grid"

package/.github/workflows/grid-review.yml

@@ -0,0 +1,73 @@
+# Example workflow showing Grid Review action usage
+# Copy this to your repository and customize as needed
+
+name: Grid Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+  security-events: write  # Required for SARIF upload
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Full history needed for diff
+
+      - name: Grid Review
+        id: review
+        uses: ./action
+        with:
+          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+          review-type: full
+          model-tier: balanced
+          output-format: markdown
+          fail-on: error
+
+      - name: Review Summary
+        if: always()
+        run: |
+          echo "============================================"
+          echo "           GRID REVIEW SUMMARY             "
+          echo "============================================"
+          echo ""
+          echo "Status:          ${{ steps.review.outputs.status }}"
+          echo "Issues Found:    ${{ steps.review.outputs.issues-count }}"
+          echo "Security Issues: ${{ steps.review.outputs.security-issues }}"
+          echo "Report Path:     ${{ steps.review.outputs.report-path }}"
+          echo ""
+          echo "============================================"
+
+      - name: Upload Review Artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: grid-review-report
+          path: .grid-review/
+          retention-days: 30
+
+  # Optional: Security-focused review job
+  security-review:
+    runs-on: ubuntu-latest
+    if: contains(github.event.pull_request.labels.*.name, 'security')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Security-Focused Grid Review
+        uses: ./action
+        with:
+          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+          review-type: security
+          model-tier: quality
+          output-format: sarif
+          fail-on: warning

package/action/README.md

@@ -0,0 +1,223 @@
+# Grid Review GitHub Action
+
+AI-powered code review using The Grid and Claude.
+
+## Overview
+
+Grid Review brings intelligent code analysis to your CI/CD pipeline. Powered by Claude and The Grid's Recognizer pattern, it automatically reviews pull requests for:
+
+- Security vulnerabilities
+- Code quality issues
+- Potential bugs
+- Test coverage gaps
+- Performance concerns
+
+## Quick Start
+
+```yaml
+name: Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Grid Review
+        uses: JamesWeatherhead/grid/action@main
+        with:
+          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+## Inputs
+
+| Input | Description | Required | Default |
+|-------|-------------|----------|---------|
+| `anthropic-api-key` | Anthropic API key for Claude | **Yes** | - |
+| `review-type` | Review type: `full`, `security`, `quality` | No | `full` |
+| `model-tier` | Model tier: `quality`, `balanced`, `budget` | No | `balanced` |
+| `fail-on` | Fail threshold: `error`, `warning`, `none` | No | `error` |
+| `output-format` | Output: `json`, `markdown`, `sarif` | No | `markdown` |
+| `files` | Files to review (glob pattern) | No | Changed files |
+
+### Review Types
+
+- **full**: Comprehensive review covering security, quality, bugs, tests, and performance
+- **security**: Focus exclusively on security vulnerabilities and risks
+- **quality**: Focus on code quality, maintainability, and best practices
+
+### Model Tiers
+
+- **quality**: Uses Claude Opus for most thorough analysis (higher cost)
+- **balanced**: Uses Claude Sonnet for good balance of quality and cost
+- **budget**: Uses Claude Haiku for fast, cost-effective reviews
+
+### Fail Thresholds
+
+- **error**: Fail only if critical errors are found
+- **warning**: Fail if warnings or errors are found
+- **none**: Never fail the check (informational only)
+
+## Outputs
+
+| Output | Description |
+|--------|-------------|
+| `status` | Review status: `pass`, `warn`, `fail` |
+| `issues-count` | Total number of issues found |
+| `security-issues` | Number of security-related issues |
+| `report-path` | Path to the generated report file |
+
+## Examples
+
+### Security-Only Review
+
+Focus on security vulnerabilities with stricter thresholds:
+
+```yaml
+- name: Security Review
+  uses: JamesWeatherhead/grid/action@main
+  with:
+    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+    review-type: security
+    fail-on: warning
+```
+
+### SARIF for GitHub Code Scanning
+
+Integrate with GitHub's code scanning feature:
+
+```yaml
+- name: Grid Review (SARIF)
+  uses: JamesWeatherhead/grid/action@main
+  with:
+    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+    output-format: sarif
+```
+
+Results appear in the Security tab of your repository.
+
+### Budget-Conscious Review
+
+For high-volume repositories:
+
+```yaml
+- name: Quick Review
+  uses: JamesWeatherhead/grid/action@main
+  with:
+    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+    model-tier: budget
+    fail-on: error
+```
+
+### Review Specific Files
+
+```yaml
+- name: Review API Changes
+  uses: JamesWeatherhead/grid/action@main
+  with:
+    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+    files: 'src/api/**/*.ts'
+```
+
+### Informational Review (Never Fail)
+
+```yaml
+- name: Informational Review
+  uses: JamesWeatherhead/grid/action@main
+  with:
+    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+    fail-on: none
+```
+
+### Use Review Outputs
+
+```yaml
+- name: Grid Review
+  id: review
+  uses: JamesWeatherhead/grid/action@main
+  with:
+    anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+    output-format: json
+
+- name: Check Results
+  run: |
+    echo "Review Status: ${{ steps.review.outputs.status }}"
+    echo "Issues Found: ${{ steps.review.outputs.issues-count }}"
+    echo "Security Issues: ${{ steps.review.outputs.security-issues }}"
+
+    if [ "${{ steps.review.outputs.security-issues }}" -gt "0" ]; then
+      echo "::warning::Security issues detected!"
+    fi
+```
+
+## Setting Up Your Repository
+
+1. **Add your Anthropic API key as a secret:**
+   - Go to Settings > Secrets and variables > Actions
+   - Click "New repository secret"
+   - Name: `ANTHROPIC_API_KEY`
+   - Value: Your Anthropic API key
+
+2. **Create the workflow file:**
+   - Create `.github/workflows/grid-review.yml`
+   - Copy one of the examples above
+
+3. **Open a pull request** to see Grid Review in action!
+
+## How It Works
+
+1. **File Detection**: Identifies changed files in the PR (or uses provided glob pattern)
+2. **Analysis**: Claude Code analyzes each file using The Grid's Recognizer pattern
+3. **Report Generation**: Creates structured report in your chosen format
+4. **PR Comment**: Posts review findings as a PR comment (markdown format)
+5. **Status Check**: Passes or fails based on your configured threshold
+
+## Cost Considerations
+
+Each review makes API calls to Claude. Approximate costs per PR:
+
+| Model Tier | Typical Cost | Best For |
+|------------|--------------|----------|
+| budget (Haiku) | $0.01-0.05 | High-volume repos, quick checks |
+| balanced (Sonnet) | $0.05-0.25 | Most repositories |
+| quality (Opus) | $0.25-1.00 | Critical code, security audits |
+
+Actual costs depend on PR size and complexity.
+
+## Troubleshooting
+
+### "ANTHROPIC_API_KEY not set"
+
+Ensure you've added the secret to your repository settings.
+
+### Review times out
+
+Large PRs may need more time. Consider:
+- Using `files` input to limit scope
+- Using `budget` model tier for faster reviews
+
+### No PR comment appears
+
+Check that:
+- `output-format` is set to `markdown` (default)
+- The workflow has `pull-requests: write` permission
+
+## License
+
+MIT
+
+## Links
+
+- [The Grid Repository](https://github.com/JamesWeatherhead/grid)
+- [The Grid on npm](https://www.npmjs.com/package/the-grid-cc)
+- [Claude Code Documentation](https://docs.anthropic.com/claude-code)
+
+---
+
+*Powered by The Grid - End of Line.*

package/action/action.yml

@@ -0,0 +1,229 @@
+name: 'Grid Review'
+description: 'AI-powered code review using The Grid'
+author: 'James Weatherhead'
+branding:
+  icon: 'grid'
+  color: 'blue'
+
+inputs:
+  anthropic-api-key:
+    description: 'Anthropic API key for Claude'
+    required: true
+  review-type:
+    description: 'Type of review: full, security, quality'
+    required: false
+    default: 'full'
+  model-tier:
+    description: 'Model tier: quality, balanced, budget'
+    required: false
+    default: 'balanced'
+  fail-on:
+    description: 'Fail threshold: error, warning, none'
+    required: false
+    default: 'error'
+  output-format:
+    description: 'Output format: json, markdown, sarif'
+    required: false
+    default: 'markdown'
+  files:
+    description: 'Files to review (glob pattern)'
+    required: false
+    default: ''
+
+outputs:
+  status:
+    description: 'Review status: pass, warn, fail'
+  issues-count:
+    description: 'Number of issues found'
+  security-issues:
+    description: 'Number of security issues'
+  report-path:
+    description: 'Path to the generated report'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20'
+
+    - name: Install Claude Code
+      shell: bash
+      run: |
+        npm install -g @anthropic-ai/claude-code
+
+    - name: Install The Grid
+      shell: bash
+      run: |
+        npm install -g the-grid-cc
+
+    - name: Get changed files
+      id: changed-files
+      shell: bash
+      run: |
+        if [ -n "${{ inputs.files }}" ]; then
+          echo "files=${{ inputs.files }}" >> $GITHUB_OUTPUT
+        elif [ "${{ github.event_name }}" == "pull_request" ]; then
+          FILES=$(gh pr diff ${{ github.event.pull_request.number }} --name-only | tr '\n' ' ')
+          echo "files=$FILES" >> $GITHUB_OUTPUT
+        else
+          FILES=$(git diff --name-only HEAD~1 | tr '\n' ' ')
+          echo "files=$FILES" >> $GITHUB_OUTPUT
+        fi
+      env:
+        GH_TOKEN: ${{ github.token }}
+
+    - name: Run Grid Review
+      id: review
+      shell: bash
+      run: |
+        export ANTHROPIC_API_KEY="${{ inputs.anthropic-api-key }}"
+        export GRID_MODEL_TIER="${{ inputs.model-tier }}"
+
+        # Create output directory
+        mkdir -p .grid-review
+
+        # Build review prompt based on review type
+        REVIEW_TYPE="${{ inputs.review-type }}"
+        case "$REVIEW_TYPE" in
+          security)
+            REVIEW_PROMPT="You are a Grid Security Recognizer. Review these files for security vulnerabilities, injection risks, authentication issues, and data exposure. Focus only on security concerns."
+            ;;
+          quality)
+            REVIEW_PROMPT="You are a Grid Quality Recognizer. Review these files for code quality, maintainability, best practices, and potential bugs. Focus on code quality and correctness."
+            ;;
+          *)
+            REVIEW_PROMPT="You are a Grid Recognizer. Perform a comprehensive code review covering: 1) Security vulnerabilities 2) Code quality issues 3) Potential bugs 4) Test coverage gaps 5) Performance concerns"
+            ;;
+        esac
+
+        # Run review with Claude Code headless mode
+        claude -p "$REVIEW_PROMPT
+
+Files to review: ${{ steps.changed-files.outputs.files }}
+
+Return your analysis in the following JSON format:
+{
+  \"status\": \"pass|warn|fail\",
+  \"summary\": \"Brief overall summary\",
+  \"issues\": [
+    {
+      \"severity\": \"error|warning|info\",
+      \"category\": \"security|quality|bug|performance|testing\",
+      \"file\": \"path/to/file\",
+      \"line\": 123,
+      \"message\": \"Description of the issue\",
+      \"suggestion\": \"How to fix it\"
+    }
+  ],
+  \"stats\": {
+    \"files_reviewed\": 0,
+    \"errors\": 0,
+    \"warnings\": 0,
+    \"info\": 0
+  }
+}" \
+          --allowedTools "Read,Grep,Glob" \
+          --output-format json \
+          > .grid-review/report.json 2>&1 || true
+
+        # Convert to requested output format
+        OUTPUT_FORMAT="${{ inputs.output-format }}"
+
+        if [ "$OUTPUT_FORMAT" == "markdown" ]; then
+          # Convert JSON to Markdown
+          cat .grid-review/report.json | jq -r '
+            "## Grid Code Review Results\n\n" +
+            "**Status:** " + (.result // . | fromjson? // . | .status // "unknown") + "\n\n" +
+            "### Summary\n" + (.result // . | fromjson? // . | .summary // "No summary available") + "\n\n" +
+            "### Issues Found\n\n" +
+            ((.result // . | fromjson? // . | .issues // []) | map(
+              "- **[" + .severity + "]** `" + .file + ":" + (.line | tostring) + "` - " + .message + "\n  > " + .suggestion
+            ) | join("\n\n")) +
+            "\n\n---\n*Powered by The Grid*"
+          ' > .grid-review/report.markdown 2>/dev/null || cp .grid-review/report.json .grid-review/report.markdown
+        elif [ "$OUTPUT_FORMAT" == "sarif" ]; then
+          # Convert JSON to SARIF format for GitHub Code Scanning
+          cat .grid-review/report.json | jq '
+            {
+              "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+              "version": "2.1.0",
+              "runs": [{
+                "tool": {
+                  "driver": {
+                    "name": "Grid Review",
+                    "version": "1.7.x",
+                    "informationUri": "https://github.com/JamesWeatherhead/grid",
+                    "rules": []
+                  }
+                },
+                "results": ((.result // . | fromjson? // . | .issues // []) | map({
+                  "ruleId": .category,
+                  "level": (if .severity == "error" then "error" elif .severity == "warning" then "warning" else "note" end),
+                  "message": { "text": .message },
+                  "locations": [{
+                    "physicalLocation": {
+                      "artifactLocation": { "uri": .file },
+                      "region": { "startLine": .line }
+                    }
+                  }]
+                }))
+              }]
+            }
+          ' > .grid-review/report.sarif 2>/dev/null || echo '{"version":"2.1.0","runs":[]}' > .grid-review/report.sarif
+        fi
+
+        # Parse results for outputs
+        if [ -f ".grid-review/report.json" ]; then
+          # Try to parse the JSON result
+          PARSED=$(cat .grid-review/report.json | jq -r '.result // .' 2>/dev/null || cat .grid-review/report.json)
+          STATUS=$(echo "$PARSED" | jq -r 'if type == "string" then fromjson else . end | .status // "unknown"' 2>/dev/null || echo "unknown")
+          ISSUES=$(echo "$PARSED" | jq -r 'if type == "string" then fromjson else . end | .issues | length // 0' 2>/dev/null || echo "0")
+          SECURITY=$(echo "$PARSED" | jq -r 'if type == "string" then fromjson else . end | [.issues[] | select(.category == "security")] | length // 0' 2>/dev/null || echo "0")
+        else
+          STATUS="unknown"
+          ISSUES="0"
+          SECURITY="0"
+        fi
+
+        echo "status=$STATUS" >> $GITHUB_OUTPUT
+        echo "issues-count=$ISSUES" >> $GITHUB_OUTPUT
+        echo "security-issues=$SECURITY" >> $GITHUB_OUTPUT
+        echo "report-path=.grid-review/report.${{ inputs.output-format }}" >> $GITHUB_OUTPUT
+
+    - name: Upload SARIF (if applicable)
+      if: inputs.output-format == 'sarif'
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: .grid-review/report.sarif
+
+    - name: Comment on PR
+      if: github.event_name == 'pull_request' && inputs.output-format == 'markdown'
+      shell: bash
+      run: |
+        if [ -f ".grid-review/report.markdown" ]; then
+          gh pr comment ${{ github.event.pull_request.number }} \
+            --body-file .grid-review/report.markdown
+        fi
+      env:
+        GH_TOKEN: ${{ github.token }}
+
+    - name: Check fail threshold
+      shell: bash
+      run: |
+        STATUS="${{ steps.review.outputs.status }}"
+        FAIL_ON="${{ inputs.fail-on }}"
+
+        if [ "$FAIL_ON" == "none" ]; then
+          echo "Fail threshold set to 'none' - always passing"
+          exit 0
+        elif [ "$FAIL_ON" == "warning" ] && [ "$STATUS" != "pass" ]; then
+          echo "::error::Review found warnings or errors (status: $STATUS)"
+          exit 1
+        elif [ "$FAIL_ON" == "error" ] && [ "$STATUS" == "fail" ]; then
+          echo "::error::Review found errors (status: $STATUS)"
+          exit 1
+        fi
+
+        echo "Review completed with status: $STATUS"

package/commands/grid/VERSION

@@ -1 +1 @@
-1.7.21
+1.7.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "the-grid-cc",
-  "version": "1.7.21",
+  "version": "1.7.22",
   "description": "Agent orchestration for Claude Code. You talk to Master Control. Master Control handles the rest.",
   "main": "index.js",
   "bin": {