claude-mpm 5.4.48__py3-none-any.whl → 5.6.34__py3-none-any.whl

claude_mpm/init.py

@@ -166,6 +166,12 @@ class ProjectInitializer:
             # Verify and deploy PM skills (non-blocking)
             self._verify_and_deploy_pm_skills(project_root, is_mcp_mode)
 
+            # Setup security hooks (auto-install pre-commit, detect-secrets)
+            self._setup_security_hooks(project_root, is_mcp_mode)
+
+            # Perform security checks (non-blocking)
+            self._check_security_risks(project_root, is_mcp_mode)
+
             return True
 
         except Exception as e:
@@ -210,14 +216,16 @@ class ProjectInitializer:
                         if deploy_result.deployed:
                             print(
                                 f"✓ Deployed {len(deploy_result.deployed)} PM skill(s) "
-                                f"to .claude-mpm/skills/pm/"
+                                f"to .claude/skills/"
                             )
                 else:
                     self.logger.warning(
                         f"PM skills deployment had errors: {len(deploy_result.errors)}"
                     )
                     if not is_mcp_mode and deploy_result.errors:
-                        print(f"⚠ PM skills deployment had {len(deploy_result.errors)} error(s)")
+                        print(
+                            f"⚠ PM skills deployment had {len(deploy_result.errors)} error(s)"
+                        )
             else:
                 # Skills verified successfully
                 registry = deployer._load_registry(project_root)
@@ -382,6 +390,211 @@ class ProjectInitializer:
                 if not dst_file.exists():
                     shutil.copy2(template_file, dst_file)
 
+    def _setup_security_hooks(
+        self, project_root: Path, is_mcp_mode: bool = False
+    ) -> None:
+        """Automatically install pre-commit hooks for secret scanning.
+
+        This method:
+        1. Installs pre-commit and detect-secrets if missing
+        2. Copies .pre-commit-config.yaml to project root
+        3. Runs pre-commit install to set up git hooks
+        4. Creates .secrets.baseline for detect-secrets
+
+        Args:
+            project_root: Project root directory
+            is_mcp_mode: Whether running in MCP mode (suppress console output)
+        """
+        try:
+            import subprocess
+
+            # Only set up hooks if this is a git repository
+            if not (project_root / ".git").exists():
+                self.logger.debug("Not a git repository, skipping security hooks setup")
+                return
+
+            # Check/install pre-commit
+            try:
+                subprocess.run(
+                    ["pre-commit", "--version"],
+                    capture_output=True,
+                    text=True,
+                    timeout=2,
+                    check=True,
+                )
+            except (
+                subprocess.CalledProcessError,
+                subprocess.TimeoutExpired,
+                FileNotFoundError,
+            ):
+                self.logger.info("Installing pre-commit...")
+                try:
+                    subprocess.run(
+                        [sys.executable, "-m", "pip", "install", "pre-commit"],
+                        capture_output=True,
+                        text=True,
+                        timeout=60,
+                        check=True,
+                    )
+                    self.logger.info("pre-commit installed successfully")
+                except subprocess.CalledProcessError as e:
+                    self.logger.warning(f"Failed to install pre-commit: {e}")
+                    return
+
+            # Check/install detect-secrets
+            try:
+                subprocess.run(
+                    ["detect-secrets", "--version"],
+                    capture_output=True,
+                    text=True,
+                    timeout=2,
+                    check=True,
+                )
+            except (
+                subprocess.CalledProcessError,
+                subprocess.TimeoutExpired,
+                FileNotFoundError,
+            ):
+                self.logger.info("Installing detect-secrets...")
+                try:
+                    subprocess.run(
+                        [sys.executable, "-m", "pip", "install", "detect-secrets"],
+                        capture_output=True,
+                        text=True,
+                        timeout=60,
+                        check=True,
+                    )
+                    self.logger.info("detect-secrets installed successfully")
+                except subprocess.CalledProcessError as e:
+                    self.logger.warning(f"Failed to install detect-secrets: {e}")
+                    return
+
+            # Copy .pre-commit-config.yaml to project root if it doesn't exist
+            precommit_config = project_root / ".pre-commit-config.yaml"
+            if not precommit_config.exists():
+                template_dir = Path(__file__).parent / "templates"
+                template_config = template_dir / ".pre-commit-config.yaml"
+
+                if template_config.exists():
+                    shutil.copy2(template_config, precommit_config)
+                    self.logger.info("Copied .pre-commit-config.yaml to project root")
+                else:
+                    self.logger.warning("Template .pre-commit-config.yaml not found")
+                    return
+
+            # Create .secrets.baseline if it doesn't exist
+            secrets_baseline = project_root / ".secrets.baseline"
+            if not secrets_baseline.exists():
+                try:
+                    subprocess.run(
+                        ["detect-secrets", "scan", "--baseline", ".secrets.baseline"],
+                        cwd=str(project_root),
+                        capture_output=True,
+                        text=True,
+                        timeout=30,
+                        check=True,
+                    )
+                    self.logger.info("Created .secrets.baseline")
+                except subprocess.CalledProcessError as e:
+                    self.logger.warning(f"Failed to create .secrets.baseline: {e}")
+
+            # Install git hooks
+            try:
+                subprocess.run(
+                    ["pre-commit", "install"],
+                    cwd=str(project_root),
+                    capture_output=True,
+                    text=True,
+                    timeout=30,
+                    check=True,
+                )
+                self.logger.info("Pre-commit hooks installed in git repository")
+
+                if not is_mcp_mode:
+                    print("✓ Security hooks installed (pre-commit + detect-secrets)")
+
+            except subprocess.CalledProcessError as e:
+                self.logger.warning(f"Failed to install pre-commit hooks: {e}")
+
+        except Exception as e:
+            self.logger.debug(f"Security hooks setup failed: {e}")
+            # Don't print to console - this is a non-critical failure
+
+    def _check_security_risks(
+        self, project_root: Path, is_mcp_mode: bool = False
+    ) -> None:
+        """Check for potential security risks like exposed config files.
+
+        Non-blocking operation that warns about security issues.
+
+        Args:
+            project_root: Project root directory
+            is_mcp_mode: Whether running in MCP mode (suppress console output)
+        """
+        try:
+            import subprocess
+
+            security_issues = []
+
+            # Common secret file patterns to check
+            secret_patterns = [
+                ".mcp-vector-search/config.json",
+                ".mcp/config.json",
+                "openrouter.json",
+                "anthropic-config.json",
+                "credentials.json",
+                "secrets.json",
+                "api-keys.json",
+            ]
+
+            for pattern in secret_patterns:
+                file_path = project_root / pattern
+                if file_path.exists():
+                    # Check if file is tracked by git
+                    try:
+                        result = subprocess.run(
+                            ["git", "ls-files", str(file_path)],
+                            check=False,
+                            cwd=str(project_root),
+                            capture_output=True,
+                            text=True,
+                            timeout=2,
+                        )
+                        if result.stdout.strip():
+                            security_issues.append(
+                                f"⚠️  SECURITY: {pattern} is tracked by git (may contain secrets)"
+                            )
+                    except (subprocess.TimeoutExpired, FileNotFoundError):
+                        pass
+
+                    # Check if file is ignored by .gitignore
+                    try:
+                        result = subprocess.run(
+                            ["git", "check-ignore", str(file_path)],
+                            check=False,
+                            cwd=str(project_root),
+                            capture_output=True,
+                            text=True,
+                            timeout=2,
+                        )
+                        if result.returncode != 0:  # File NOT ignored
+                            security_issues.append(
+                                f"⚠️  WARNING: {pattern} exists but not in .gitignore"
+                            )
+                    except (subprocess.TimeoutExpired, FileNotFoundError):
+                        pass
+
+            # Print security warnings if not in MCP mode
+            if security_issues and not is_mcp_mode:
+                print("\n🔒 Security Check:")
+                for issue in security_issues:
+                    print(f"   {issue}")
+                print()
+
+        except Exception as e:
+            self.logger.debug(f"Security check failed: {e}")
+            # Don't print to console - this is a non-critical failure
+
     def validate_dependencies(self) -> Dict[str, bool]:
         """Validate that all required dependencies are available."""
         dependencies = {}

claude_mpm/scripts/claude-hook-handler.sh

@@ -62,8 +62,13 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Determine the claude-mpm root based on installation type
+# Check if we're in a UV tools installation
+if [[ "$SCRIPT_DIR" == *"/.local/share/uv/tools/"* ]]; then
+    # UV tools installation - script is at lib/python*/site-packages/claude_mpm/scripts/
+    # The tool root is what we need for Python detection
+    CLAUDE_MPM_ROOT="$(echo "$SCRIPT_DIR" | sed 's|/lib/python.*/site-packages.*||')"
 # Check if we're in a pipx installation
-if [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
+elif [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
     # pipx installation - script is at lib/python*/site-packages/claude_mpm/scripts/
     # The venv root is what we need for Python detection
     CLAUDE_MPM_ROOT="$(echo "$SCRIPT_DIR" | sed 's|/lib/python.*/site-packages/.*||')"
@@ -89,11 +94,12 @@ fi
 # STRATEGY:
 # This function implements a fallback chain to find Python with claude-mpm dependencies:
 # 1. UV-managed projects (uv.lock detected) - uses "uv run python"
-# 2. pipx installations - uses pipx venv Python
-# 3. Project-specific virtual environments (venv, .venv)
-# 4. Currently active virtual environment ($VIRTUAL_ENV)
-# 5. System python3 (may lack dependencies)
-# 6. System python (last resort)
+# 2. UV tools installations (~/.local/share/uv/tools/) - uses tool's venv Python
+# 3. pipx installations - uses pipx venv Python
+# 4. Project-specific virtual environments (venv, .venv)
+# 5. Currently active virtual environment ($VIRTUAL_ENV)
+# 6. System python3 (may lack dependencies)
+# 7. System python (last resort)
 #
 # WHY THIS APPROACH:
 # - Claude MPM requires specific packages (socketio, eventlet) not in system Python
@@ -119,12 +125,26 @@ find_python_command() {
     # 1. Check for UV project first (uv.lock or pyproject.toml with uv)
     if [ -f "$CLAUDE_MPM_ROOT/uv.lock" ]; then
         if command -v uv &> /dev/null; then
-            echo "uv run python"
+            echo "uv run --directory \"$CLAUDE_MPM_ROOT\" python"
             return
         fi
     fi
 
-    # 2. Check if we're in a pipx installation
+    # 2. Check if we're in a UV tools installation
+    if [[ "$SCRIPT_DIR" == *"/.local/share/uv/tools/"* ]]; then
+        # UV tools installation - extract the tool root directory
+        CLAUDE_MPM_ROOT="$(echo "$SCRIPT_DIR" | sed 's|/lib/python.*/site-packages.*||')"
+        local uv_python="$CLAUDE_MPM_ROOT/bin/python"
+        if [ -x "$uv_python" ]; then
+            if [ "${CLAUDE_MPM_HOOK_DEBUG}" = "true" ]; then
+                echo "[$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)] UV tools Python found: $uv_python" >> /tmp/claude-mpm-hook.log
+            fi
+            echo "$uv_python"
+            return
+        fi
+    fi
+
+    # 3. Check if we're in a pipx installation
     if [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
         # pipx installation - use the pipx venv's Python directly
         if [ -f "$CLAUDE_MPM_ROOT/bin/python" ]; then
@@ -133,7 +153,7 @@ find_python_command() {
         fi
     fi
 
-    # 3. Check for project-local virtual environment (common in development)
+    # 4. Check for project-local virtual environment (common in development)
     if [ -f "$CLAUDE_MPM_ROOT/venv/bin/activate" ]; then
         source "$CLAUDE_MPM_ROOT/venv/bin/activate"
         echo "$CLAUDE_MPM_ROOT/venv/bin/python"
@@ -154,7 +174,13 @@ find_python_command() {
 PYTHON_CMD=$(find_python_command)
 
 # Check installation type and set PYTHONPATH accordingly
-if [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
+if [[ "$SCRIPT_DIR" == *"/.local/share/uv/tools/"* ]]; then
+    # UV tools installation - claude_mpm is already in the tool's site-packages
+    # No need to modify PYTHONPATH
+    if [ "${CLAUDE_MPM_HOOK_DEBUG}" = "true" ]; then
+        echo "[$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)] UV tools installation detected" >> /tmp/claude-mpm-hook.log
+    fi
+elif [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
     # pipx installation - claude_mpm is already in the venv's site-packages
     # No need to modify PYTHONPATH
     if [ "${CLAUDE_MPM_HOOK_DEBUG}" = "true" ]; then
@@ -193,16 +219,16 @@ log_debug() {
 
 # Test Python works and module exists
 # Handle UV's multi-word command specially
-if [[ "$PYTHON_CMD" == "uv run python" ]]; then
-    if ! uv run python -c "import claude_mpm" 2>/dev/null; then
+if [[ "$PYTHON_CMD" == "uv run"* ]]; then
+    if ! uv run --directory "$CLAUDE_MPM_ROOT" python -c "import claude_mpm" 2>/dev/null; then
         log_debug "claude_mpm module not available, continuing without hook"
-        echo '{"action": "continue"}'
+        echo '{"continue": true}'
         exit 0
     fi
 else
     if ! $PYTHON_CMD -c "import claude_mpm" 2>/dev/null; then
         log_debug "claude_mpm module not available, continuing without hook"
-        echo '{"action": "continue"}'
+        echo '{"continue": true}'
         exit 0
     fi
 fi
@@ -210,10 +236,11 @@ fi
 # Run the Python hook handler with all input
 # Use exec to replace the shell process with Python
 # Handle UV's multi-word command specially
-if [[ "$PYTHON_CMD" == "uv run python" ]]; then
-    exec uv run python -m claude_mpm.hooks.claude_hooks.hook_handler "$@" 2>/tmp/claude-mpm-hook-error.log
+# Suppress RuntimeWarning to prevent stderr output (which causes hook errors)
+if [[ "$PYTHON_CMD" == "uv run"* ]]; then
+    exec uv run --directory "$CLAUDE_MPM_ROOT" python -W ignore::RuntimeWarning -m claude_mpm.hooks.claude_hooks.hook_handler "$@" 2>/tmp/claude-mpm-hook-error.log
 else
-    exec "$PYTHON_CMD" -m claude_mpm.hooks.claude_hooks.hook_handler "$@" 2>/tmp/claude-mpm-hook-error.log
+    exec "$PYTHON_CMD" -W ignore::RuntimeWarning -m claude_mpm.hooks.claude_hooks.hook_handler "$@" 2>/tmp/claude-mpm-hook-error.log
 fi
 
 # Note: exec replaces the shell process, so code below only runs if exec fails
@@ -223,5 +250,5 @@ if [ "${CLAUDE_MPM_HOOK_DEBUG}" = "true" ]; then
     echo "[$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)] Error: $(cat /tmp/claude-mpm-hook-error.log 2>/dev/null | head -5)" >> /tmp/claude-mpm-hook.log
 fi
 # Return continue action to prevent blocking Claude Code
-echo '{"action": "continue"}'
-exit 0
+echo '{"continue": true}'
+exit 0

claude_mpm/services/agents/agent_recommendation_service.py

@@ -30,16 +30,16 @@ class AgentRecommendationService:
     Can be used by CLI, API, or future auto-configuration features.
     """
 
-    # Core agents always included - matches ToolchainDetector.CORE_AGENTS
+    # Core agents always included - Standard 6 core agents for essential PM workflow
+    # These agents are auto-deployed when no configuration exists
     # Uses exact agent IDs from repository for consistency
     CORE_AGENTS = {
-        "engineer",
-        "qa-agent",
-        "memory-manager-agent",
-        "local-ops-agent",
-        "research-agent",
-        "documentation-agent",
-        "security-agent",
+        "engineer",  # General-purpose implementation
+        "research",  # Codebase exploration and analysis
+        "qa",  # Testing and quality assurance
+        "documentation",  # Documentation generation
+        "ops",  # Basic deployment operations
+        "ticketing",  # Ticket tracking (essential for PM workflow)
     }
 
     # Map detected languages to recommended engineer agents

claude_mpm/services/agents/agent_selection_service.py

@@ -39,10 +39,10 @@ import logging
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Set, Tuple
 
-from src.claude_mpm.services.agents.single_tier_deployment_service import (
+from claude_mpm.services.agents.single_tier_deployment_service import (
     SingleTierDeploymentService,
 )
-from src.claude_mpm.services.agents.toolchain_detector import ToolchainDetector
+from claude_mpm.services.agents.toolchain_detector import ToolchainDetector
 
 logger = logging.getLogger(__name__)
 

claude_mpm/services/agents/cache_git_manager.py

@@ -88,7 +88,7 @@ class CacheGitManager:
         if self.repo_path:
             logger.debug(f"Initialized CacheGitManager for repo: {self.repo_path}")
         else:
-            logger.warning(f"Cache path is not a git repository: {cache_path}")
+            logger.debug(f"Cache path is not a git repository: {cache_path}")
 
     def _find_git_root(self) -> Optional[Path]:
         """

claude_mpm/services/agents/deployment/agent_discovery_service.py

@@ -248,7 +248,9 @@ class AgentDiscoveryService:
             return agent_info
 
         except yaml.YAMLError as e:
-            self.logger.warning(f"Invalid YAML frontmatter in {template_file.name}: {e}")
+            self.logger.warning(
+                f"Invalid YAML frontmatter in {template_file.name}: {e}"
+            )
             return None
         except Exception as e:
             self.logger.error(

claude_mpm/services/agents/deployment/agent_format_converter.py

@@ -184,12 +184,14 @@ assistant: "I'll use the {name} agent to provide specialized assistance."
         if mapped_model is not None:
             frontmatter_lines.append(f"model: {mapped_model}")
 
-        frontmatter_lines.extend([
-            f'version: "{version}"',
-            f'author: "{author}"',
-            "---",
-            "",
-        ])
+        frontmatter_lines.extend(
+            [
+                f'version: "{version}"',
+                f'author: "{author}"',
+                "---",
+                "",
+            ]
+        )
 
         new_frontmatter = "\n".join(frontmatter_lines)
 

claude_mpm/services/agents/deployment/agent_template_builder.py

@@ -586,6 +586,14 @@ class AgentTemplateBuilder:
             tags_str = ",".join(metadata["tags"])
             frontmatter_lines.append(f"tags: {tags_str}")
 
+        # CRITICAL: Preserve skills field from template for selective skill deployment
+        # Skills are used by startup.py to determine which skills to deploy
+        skills = template_data.get("skills", [])
+        if skills and isinstance(skills, list):
+            frontmatter_lines.append("skills:")
+            for skill in skills:
+                frontmatter_lines.append(f"- {skill}")
+
         frontmatter_lines.extend(
             [
                 "---",
@@ -737,10 +745,12 @@ Only include memories that are:
         if model is not None:
             yaml_lines.append(f"model: {model}")
 
-        yaml_lines.extend([
-            "tools:",
-            tools_yaml,
-        ])
+        yaml_lines.extend(
+            [
+                "tools:",
+                tools_yaml,
+            ]
+        )
 
         return "\n".join(yaml_lines) + "\n"