Commit Graph

222 Commits

  • Merge pull request #893 from up2itnow0822/feat/agent-payment-x402-skill
    feat: add agent-payment-x402 skill for autonomous agent payments
  • Merge pull request #926 from xingzihai/feature/pre-commit-quality-hook
    feat(hooks): add pre-commit quality check hook
  • Merge pull request #955 from drkeyurpatel-wq/feat/healthcare-patterns
    feat: Healthcare domain — 4 skills + 1 agent for health-tech applications
  • Merge pull request #959 from sreedhargs89/feat/skill-context-keeper
    feat(skill): ck — persistent per-project memory for Claude Code
  • Merge pull request #923 from danielpetrica/main
    feat(skills): add laravel-plugin-discovery skill with LaraPlugins MCP
  • Merge pull request #911 from haibindev/main
    feat(skills): add repo-scan skill
  • Merge pull request #960 from senoldogann/feat/codex-plugin-manifest
    feat(codex): add Codex native plugin manifest and fix Claude plugin.json
  • fix(skills): add missing YAML frontmatter to 7 skills
    Codex CLI requires YAML frontmatter (---) in SKILL.md files.
    6 skills were missing frontmatter entirely; laravel-verification had
    a bare colon in its description causing an invalid YAML parse error.
  • fix(observer): clean up prompt_file early and fix test for analysis_relpath
    - Remove prompt_file immediately after shell expansion into -p arg,
      avoiding stale temp files during long analysis windows (greptile feedback)
    - Update test assertion to check analysis_relpath instead of analysis_file,
      matching the cross-platform relative path change from earlier commits
    
    Signed-off-by: Lidang-Jiang <lidangjiang@gmail.com>
  • fix(observer): clean up temp files on cd failure early return
    The cd "$PROJECT_DIR" failure path returned without removing prompt_file
    and analysis_file, leaving stale temp files in .observer-tmp/.
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    Signed-off-by: Lidang-Jiang <lidangjiang@gmail.com>
  • fix(observer): guard cd failure with early return and log message
    Address reviewer feedback: under set +e, a failing cd would silently
    leave CWD unchanged, causing the relative analysis path to break.
    Add || return with a diagnostic log entry.
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    Signed-off-by: Lidang-Jiang <lidangjiang@gmail.com>
  • fix(observer): anchor CWD to PROJECT_DIR before Claude invocation
    Reviewers correctly identified that the relative analysis_relpath
    (.observer-tmp/<file>) only resolves when CWD equals PROJECT_DIR.
    Without an explicit cd, non-Windows users launching the observer from
    a different directory would fail to read the analysis file.
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    Signed-off-by: Lidang-Jiang <lidangjiang@gmail.com>
  • fix(observer): improve Windows compatibility for temp files and Haiku prompt
    Address remaining issues from #842 after PR #903 moved temp files to
    PROJECT_DIR/.observer-tmp:
    
    Bug A (path resolution): Use relative paths (.observer-tmp/filename)
    in the prompt instead of absolute paths from mktemp. On Windows
    Git Bash/MSYS2, absolute paths use MSYS-style prefixes (/c/Users/...)
    that the spawned Claude subprocess may fail to resolve.
    
    Bug B (asks for permission): Add explicit IMPORTANT instruction block
    at the prompt start telling the Haiku agent it is in non-interactive
    --print mode and must use the Write tool directly without asking for
    confirmation.
    
    Additional improvements:
    - Pass prompt via -p flag instead of stdin redirect for Windows compat
    - Add .observer-tmp/ to .gitignore to prevent accidental commits
    
    Fixes #842
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
    
    Signed-off-by: Lidang-Jiang <lidangjiang@gmail.com>
  • fix(ck): address Greptile + CodeRabbit review bugs
    - Fix read-after-write in session-start.mjs: read prevSession BEFORE
      overwriting current-session.json so unsaved-session detection fires
    - Fix shell injection in resume.mjs: replace execSync shell string with
      fs.existsSync for directory existence check
    - Fix shell injection in shared.mjs gitSummary: replace nested \$(git ...)
      subshell with a separate runGit() call to get rev count
    - Fix displayName never shown: render functions now use ctx.displayName
      ?? ctx.name so user-supplied names show instead of the slug
    - Fix renderListTable: uses context.displayName ?? entry.name
    - Fix init.mjs: use path.basename() instead of cwd.split('/').pop()
    - Fix save.mjs confirmation: show original name, not contextDir slug
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
  • feat(skill): ck — context-keeper v2, persistent per-project memory
    Adds the ck (Context Keeper) skill — deterministic Node.js scripts
    that give Claude Code persistent, per-project memory across sessions.
    
    Architecture:
    - commands/ — 8 Node.js scripts handle all command logic (init, save,
      resume, info, list, forget, migrate, shared). Claude calls scripts
      and displays output — no LLM interpretation of command logic.
    - hooks/session-start.mjs — injects ~100 token compact summary on
      session start (not kilobytes). Detects unsaved sessions, git
      activity since last save, goal mismatch vs CLAUDE.md.
    - context.json as source of truth — CONTEXT.md is generated from it.
      Full session history, session IDs, git activity per save.
    
    Commands: /ck:init /ck:save /ck:resume /ck:info /ck:list /ck:forget /ck:migrate
    Source: https://github.com/sreedhargs89/context-keeper
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
  • fix: address Greptile review — frontmatter, CI safety, null guards
    Greptile fixes:
    - Removed non-standard YAML frontmatter fields (observe, feedback, rollback) from all 4 skills — only name, description, origin, version per CONTRIBUTING.md
    - Added null guard to checkInteractions implementation (was missing despite test)
    - CI: replaced 2>/dev/null with 2>&1 (was silencing safety-critical errors)
    - CI: quoted $RESULT variable (was breaking jq on JSON with spaces)
    - CI: added division-by-zero guard when test suite is empty
    - CI: added note that Jest is reference implementation, thresholds are framework-agnostic
  • fix: address all CodeRabbit + Cubic review comments on PR #955
    CodeRabbit fixes (6 comments):
    - All 4 skills: renamed 'When to Activate' → 'When to Use', added 'How It Works' and 'Examples' sections
    - CDSS: DoseValidationResult.suggestedRange now typed as '| null'
    - PHI: hyphenated 'Non-patient-sensitive'
    
    Cubic fixes (7 issues):
    - P1: CDSS weight-based check now BLOCKS when weight missing (was false-negative pass)
    - P1: EMR medication safety clarified — critical = hard block, override requires documented reason
    - P1: PHI logging guidance clarified — use opaque UUIDs only, not medical record numbers
    - P2: CDSS validateDose now uses age and renal function params (ageAdjusted, renalAdjusted rules)
    - P2: Eval CI example now enforces 95% threshold with jq + bc calculation
    - P2: Eval CI example now includes --coverage --coverageThreshold on CDSS suite
    - P2: CDSS suggestedRange null type fixed (same as CodeRabbit)
  • feat: add healthcare domain skills and agent
    New skills:
    - healthcare-emr-patterns: EMR/EHR encounter workflows, smart templates, medication safety, clinical UI patterns
    - healthcare-phi-compliance: PHI/PII protection patterns, RLS templates, leak vector checklist, audit trail patterns
    - healthcare-cdss-patterns: Drug interaction checking, dose validation, clinical scoring (NEWS2/qSOFA), alert severity
    - healthcare-eval-harness: Patient safety CI/CD gate — CDSS accuracy, PHI exposure, data integrity, clinical workflows
    
    New agent:
    - healthcare-reviewer: Clinical safety reviewer for CDSS accuracy, PHI compliance, medical data integrity
    
    All patterns are generalized and framework-agnostic. Applicable to any health-tech stack.
    Origin: Health1 Super Speciality Hospitals, Ahmedabad, India.
  • feat(skills): add laravel-plugin-discovery skill with LaraPlugins MCP
    - Add laraplugins MCP server to mcp-configs/mcp-servers.json
    - Create laravel-plugin-discovery skill for Laravel package discovery
    - Supports searching by keyword, health score, Laravel/PHP version
    - No API key required - free for Laravel community
  • feat: Add git-workflow skill
    Add comprehensive Git workflow skill covering:
    - Branching strategies (GitHub Flow, Trunk-Based, GitFlow)
    - Conventional commits format and best practices
    - Merge vs rebase with clear guidance
    - Pull request workflow and templates
    - Conflict resolution strategies
    - Branch management and naming conventions
    - Release management with semantic versioning
    - Git configuration and useful aliases
    - Common workflows and anti-patterns
    
    This skill helps developers and teams establish consistent
    Git practices for collaborative development.
  • Apply suggestions from code review
    Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
  • Apply suggestions from code review
    Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
  • Update skills/agent-payment-x402/SKILL.md
    Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
  • fix: address all automated review feedback on code example
    Security model:
    - Remove set_policy from agent-callable tools table; document as
      orchestrator-only to prevent self-privilege escalation
    - Pin agentwallet-sdk@6.0.0 in MCP config with pre-install guidance
      (npx without -y hangs in non-interactive MCP startup)
    - Whitelist only required env vars (PATH, NODE_ENV, WALLET_PRIVATE_KEY)
      instead of forwarding entire process.env to subprocess
    
    Code example (complete rewrite):
    - Add StdioClientTransport import and client.connect() for runnable code
    - Wrap in async main() for CJS/ESM compatibility (top-level await)
    - Verify set_policy result via isError before delegating
    - Five distinct fail-closed error paths in preToolCheck:
      1. Invalid apiCost input (NaN/Infinity bypass prevention)
      2. Transport/connectivity failure
      3. Tool-level error (isError: true, e.g., auth failure)
      4. Unexpected response format (missing/non-finite remaining)
      5. Budget exceeded (clear amounts in message)
    - Use Number.isFinite() for both apiCost and remaining validation
    
    Documentation:
    - Rename headings per CONTRIBUTING.md format
    - Replace broken mcp-server-patterns cross-ref with security-review
    - Add 'Pin your dependencies' to Best Practices
    - Add security note about supply-chain risk
  • feat: add agent-payment-x402 skill for autonomous agent payments
    Adds a skill for x402 payment execution with MCP integration:
    - Per-task and per-session spending controls
    - Non-custodial wallet management (ERC-4337)
    - Pairs with mcp-server-patterns and cost-aware-llm-pipeline skills
    - Production reference: merged into NVIDIA NeMo Agent Toolkit (PR #17)
    - npm package: agentwallet-sdk
  • feat: add 6 gap-closing skills — browser QA, design system, product lens, canary watch, benchmark, safety guard
    Closes competitive gaps with gstack:
    - browser-qa: automated visual testing via browser MCP
    - design-system: generate, audit, and detect AI slop in UI
    - product-lens: product diagnostic, founder review, feature prioritization
    - canary-watch: post-deploy monitoring with alert thresholds
    - benchmark: performance baseline and regression detection
    - safety-guard: prevent destructive operations in autonomous sessions
  • feat(skills): add skill-comply — automated behavioral compliance measurement (#724)
    * feat(skills): add skill-comply — automated behavioral compliance measurement
    
    Automated compliance measurement for skills, rules, and agent definitions.
    Generates behavioral specs, runs scenarios at 3 strictness levels,
    classifies tool calls via LLM, and produces self-contained reports.
    
    Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
    
    * fix(skill-comply): address bot review feedback
    
    - AGENTS.md: fix stale skill count (115 → 117) in project structure
    - run.py: replace remaining print() with logger, add zero-division guard,
      create parent dirs for --output path
    - runner.py: add returncode check for claude subprocess, clarify
      relative_to path traversal validation
    - parser.py: use is_file() instead of exists(), catch KeyError for
      missing trace fields, add file check in parse_spec
    - classifier.py: log warnings on malformed classification output,
      guard against non-dict JSON responses
    - grader.py: filter negative indices from LLM classification
    
    Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
    
    ---------
    
    Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
  • feat(skills): add santa-method - multi-agent adversarial verification (#760)
    * feat(skills): add santa-method
    
    Multi-agent adversarial verification with convergence loop. Two independent review agents evaluate output against a shared rubric. Both must pass before shipping. Includes architecture diagram, implementation patterns (subagent, inline, batch sampling), domain-specific rubric extensions, failure mode mitigations, and integration guidance with existing ECC skills.
    
    * Enhance SKILL.md with detailed Santa Method documentation
    
    Expanded the SKILL.md documentation for the Santa Method, detailing architecture, phases, implementation patterns, failure modes, integration with other skills, metrics, and cost analysis.
  • feat: pending instinct TTL pruning and /prune command (#725)
    * feat: add pending instinct TTL pruning and /prune command
    
    Pending instincts generated by the observer accumulate indefinitely
    with no cleanup mechanism. This adds lifecycle management:
    
    - `instinct-cli.py prune` — delete pending instincts older than 30 days
      (configurable via --max-age). Supports --dry-run and --quiet flags.
    - Enhanced `status` command — shows pending count, warns at 5+,
      highlights instincts expiring within 7 days.
    - `observer-loop.sh` — runs prune before each analysis cycle.
    - `/prune` slash command — user-facing command for manual pruning.
    
    Design rationale: council consensus (4/4) rejected auto-promote in
    favor of TTL-based garbage collection. Frequency of observation does
    not establish correctness. Unreviewed pending instincts auto-delete
    after 30 days; if the pattern is real, the observer will regenerate it.
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    * fix: remove duplicate functions, broaden extension filter, fix prune output
    
    - Remove duplicate _collect_pending_dirs and _parse_created_date defs
    - Use ALLOWED_INSTINCT_EXTENSIONS (.md/.yaml/.yml) instead of .md-only
    - Track actually-deleted items separately from expired for accurate output
    - Update README.md and AGENTS.md command counts: 59 → 60
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    * fix: address Copilot and CodeRabbit review findings
    
    - Use is_dir() instead of exists() for pending path checks
    - Change > to >= for --max-age boundary (--max-age 0 now prunes all)
    - Use CLV2_PYTHON_CMD env var in observer-loop.sh prune call
    - Remove unused source_dupes variable
    - Remove extraneous f-string prefix on static string
    
    Generated with [Claude Code](https://claude.ai/code)
    via [Happy](https://happy.engineering)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    Co-Authored-By: Happy <yesreply@happy.engineering>
    
    * fix: update AGENTS.md project structure command count 59 → 60
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    
    * fix: address cubic and coderabbit review findings
    
    - Fix status early return skipping pending instinct warnings (cubic #1)
    - Exclude already-expired items from expiring-soon filter (cubic #2)
    - Warn on unparseable pending instinct age instead of silent skip (cubic #4)
    - Log prune failures to observer.log instead of silencing (cubic #5)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    
    * fix: YAML single-quote unescaping, f-string cleanup, add /prune to README
    
    - Fix single-quoted YAML unescaping: use '' doubling (YAML spec) not
      backslash escaping which only applies to double-quoted strings (greptile P1)
    - Remove extraneous f-string prefix on static string (coderabbit)
    - Add /prune to README command catalog and file tree (cubic)
    
    Co-Authored-By: Claude <noreply@anthropic.com>
    
    ---------
    
    Co-authored-by: Claude <noreply@anthropic.com>
    Co-authored-by: Happy <yesreply@happy.engineering>
  • feat: add click-path-audit skill — finds state interaction bugs (#729)
    New debugging skill that traces every button/touchpoint through its full
    state change sequence. Catches bugs where functions individually work but
    cancel each other out via shared state side effects.
    
    Covers 6 bug patterns:
    1. Sequential Undo — call B resets what call A just set
    2. Async Race — double-click bypasses state-based loading guards
    3. Stale Closure — useCallback captures old value
    4. Missing State Transition — handler doesn't do what label says
    5. Conditional Dead Path — condition always false, action unreachable
    6. useEffect Interference — effect undoes button action
    
    Battle-tested: found 48 bugs in a production React+Zustand app that
    systematic debugging (54 bugs found separately) completely missed.
  • feat(skills): add Kysely migration patterns to database-migrations (#731)
    * feat(skills): add Kysely migration patterns to database-migrations
    
    Add Kysely section covering kysely-ctl CLI workflow, migration file
    structure (up/down with Kysely<any>), and programmatic Migrator setup
    with FileMigrationProvider and allowUnorderedMigrations option.
    
    * fix(skills): address PR review feedback for Kysely migration patterns
    
    - Replace redundant email index with avatar_url index (unique already creates index)
    - Add ESM-compatible __dirname using import.meta.url
    - Comment out allowUnorderedMigrations with production safety warning
    - Add clarifying comment for db variable
    
    * fix(skills): fix migration filename mismatch and clarify ESM-only pattern
    
    - Rename migration file to create_user_profile to match actual content
    - Restructure ESM import pattern to be clearly ESM-only with CJS note
  • security: remove supply chain risks, external promotions, and unauthorized credits
    - Remove zenith.chat references and @DRodriguezFX shoutout from README
    - Remove Inspiration Credits section (already in CHANGELOG.md)
    - Remove awesome-agent-skills reference from Links
    - Remove Plankton H3 section by @alxfazio (skill stays in skills/)
    - Remove brand names (InsAIts, VideoDB, Evos) from v1.9.0 notes
    - Remove @ericcai0814 individual credit from README (kept in CHANGELOG)
    - Add Security Guide to Links section
    - Replace curl-pipe-to-bash in autonomous-loops with review warning
    - Replace git clone in plankton-code-quality with review warning
    - Replace pip install git+ in agent-eval with review warning
    - Replace npm install -g in dmux-workflows with review warning
    - Add commercial API notice to nutrient-document-processing
    - Remove VideoDB maintainer credit from videodb skill
    - Replace skill-creator.app link with ECC-Tools GitHub App reference
  • feat(agents): add flutter-reviewer agent and skill (#716)
    Library-agnostic Flutter/Dart code reviewer that adapts to the project's
    chosen state management solution (BLoC, Riverpod, Provider, GetX, MobX,
    Signals) and architecture pattern (Clean Architecture, MVVM, feature-first).
    
    Co-authored-by: Maciej Starosielec <maciej@code-snap.com>
    Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
  • feat(skills): add rules-distill skill (rebased #561) (#678)
    * feat(skills): add rules-distill — extract cross-cutting principles from skills into rules
    
    Applies the skill-stocktake pattern to rules maintenance:
    scan skills → extract shared principles → propose rule changes.
    
    Key design decisions:
    - Deterministic collection (scan scripts) + LLM judgment (cross-read & verdict)
    - 6 verdict types: Append, Revise, New Section, New File, Already Covered, Too Specific
    - Anti-abstraction safeguard: 2+ skills evidence, actionable behavior test, violation risk
    - Rules full text passed to LLM (no grep pre-filter) for accurate matching
    - Never modifies rules automatically — always requires user approval
    
    * fix(skills): address review feedback for rules-distill
    
    Fixes raised by CodeRabbit, Greptile, and cubic:
    
    - Add Prerequisites section documenting skill-stocktake dependency
    - Add fallback command when skill-stocktake is not installed
    - Fix shell quoting: add IFS= and -r to while-read loops
    - Replace hardcoded paths with env var placeholders ($CLAUDE_RULES_DIR, $SKILL_STOCKTAKE_DIR)
    - Add json language identifier to code blocks
    - Add "How It Works" parent heading for Phase 1/2/3
    - Add "Example" section with end-to-end run output
    - Add revision.reason/before/after fields to output schema for Revise verdict
    - Document timestamp format (date -u +%Y-%m-%dT%H:%M:%SZ)
    - Document candidate-id format (kebab-case from principle)
    - Use concrete examples in results.json schema
    
    * fix(skills): remove skill-stocktake dependency, add self-contained scripts
    
    Address P1 review feedback:
    - Add scan-skills.sh and scan-rules.sh directly in rules-distill/scripts/
      (no external dependency on skill-stocktake)
    - Remove Prerequisites section (no longer needed)
    - Add cross-batch merge step to prevent 2+ skills requirement
      from being silently broken across batch boundaries
    - Fix nested triple-backtick fences (use quadruple backticks)
    - Remove head -100 cap (silent truncation)
    - Rename "When to Activate" → "When to Use" (ECC standard)
    - Remove unnecessary env var placeholders (SKILL.md is a prompt, not a script)
    
    * fix: update skill/command counts in README.md and AGENTS.md
    
    rules-distill added 1 skill + 1 command:
    - skills: 108 → 109
    - commands: 57 → 58
    
    Updates all count references to pass CI catalog validation.
    
    * fix(skills): address Servitor review feedback for rules-distill
    
    1. Rename SKILL_STOCKTAKE_* env vars to RULES_DISTILL_* for consistency
    2. Remove unnecessary observation counting (use_7d/use_30d) from scan-skills.sh
    3. Fix header comment: scan.sh → scan-skills.sh
    4. Use jq for JSON construction in scan-rules.sh to properly escape
       headings containing special characters (", \)
    
    * fix(skills): address CodeRabbit review — portability and scan scope
    
    1. scan-rules.sh: use jq for error JSON output (proper escaping)
    2. scan-rules.sh: replace GNU-only sort -z with portable sort (BSD compat)
    3. scan-rules.sh: fix pipefail crash on files without H2 headings
    4. scan-skills.sh: scan only SKILL.md files (skip learned/*.md and
       auxiliary docs that lack frontmatter)
    5. scan-skills.sh: add portable get_mtime helper (GNU stat/date
       fallback to BSD stat/date)
    
    * fix: sync catalog counts with filesystem (27 agents, 114 skills, 59 commands)
    
    ---------
    
    Co-authored-by: Tatsuya Shimomoto <shimo4228@gmail.com>
  • fix: resolve Windows CI failures and markdown lint (#667)
    - Replace node -e with temp file execution in validator tests to avoid
      Windows shebang parsing failures (node -e cannot handle scripts that
      originally contained #!/usr/bin/env node shebangs)
    - Remove duplicate blank line in skills/rust-patterns/SKILL.md (MD012)