feat: Language-Agnostic Global CLAUDE.md with TypeScript Auditor by dean0x · Pull Request #2 · dean0x/devflow

dean0x · 2025-10-16T22:37:50Z

🎯 Overview

This PR implements a language-agnostic global CLAUDE.md and specialized TypeScript auditor agent to maintain DevFlow's universal design philosophy while preserving deep language-specific expertise where needed.

📦 What's Included

1. Language-Agnostic Global CLAUDE.md (`src/claude/CLAUDE.md`)

Problem: Previous global CLAUDE.md contained TypeScript-specific syntax, violating language-agnostic design.

Solution: Stripped TypeScript specifics, kept universal engineering concepts.

Contents:

✅ Role: Strict critic stance (no pleasing, challenge assumptions)
✅ Engineering Principles: Result types, DI, immutability (conceptually)
✅ Critical Anti-Patterns: NO FAKE SOLUTIONS, FAIL HONESTLY, LABEL EVERYTHING
✅ Code Quality Enforcement: Root cause analysis, not workarounds
✅ Type Safety: Language-agnostic best practices
✅ Architecture Documentation: Mandatory inline docs
✅ Security: Never commit secrets, validate at boundaries
✅ Pure Functions: Separate logic from I/O

Size: ~330 lines of precise, non-bloated instructions

2. TypeScript Auditor Agent (`src/claude/agents/devflow/audit-typescript.md`)

Problem: Need TypeScript-specific enforcement without polluting global config.

Solution: Specialized auditor with built-in detection logic.

Detection Strategy:

# Runs if:
- .ts/.tsx files changed OR
- tsconfig.json exists

# Skips if:
- No TS files changed AND
- No tsconfig.json

What It Audits:

Type safety configuration (strict mode, noImplicitAny)
any type usage (CRITICAL violations)
Unsafe type assertions without validation
@ts-ignore / @ts-expect-error abuse
Branded types for domain modeling
Discriminated unions with exhaustive checking
Immutability patterns (readonly, no mutations)
Result type pattern vs throwing
Naming conventions (PascalCase, camelCase, SCREAMING_SNAKE_CASE)
Dependency injection (no hard-coded deps)
Pure functions vs side effects

Output: CRITICAL/HIGH/MEDIUM/LOW severity with file:line references

3. Smart CLAUDE.md Mounting (`src/cli/commands/init.ts`)

Problem: Need to install global CLAUDE.md without overriding users' existing configs.

Solution: Smart mounting logic parallel to settings.json pattern.

Installation Scenarios

Scenario 1: Fresh Install (No Existing CLAUDE.md)

npx devflow-kit init

✅ Directly installs CLAUDE.md
✅ No prompts, no conflicts

Scenario 2: Existing CLAUDE.md (Safe Install)

npx devflow-kit init

✅ Preserves existing CLAUDE.md
✅ Installs as CLAUDE.devflow.md
✅ Shows merge instructions

Scenario 3: Force Override with Prompt

npx devflow-kit init --force

⚠️ Prompts for confirmation
✅ Backs up existing to .backup
✅ Can be cancelled (falls back to safe)

Scenario 4: Force Override with Auto-Approval

npx devflow-kit init --force -y

✅ No prompts (auto-approved)
✅ Backs up existing files
✅ Perfect for automation/CI/CD

New CLI Options

--force: Override existing settings.json and CLAUDE.md (prompts for confirmation)
-y, --yes: Auto-approve all prompts (use with --force)

4. Pre-commit/Pre-PR Integration

Updated Commands:

src/claude/commands/devflow/pre-commit.md
src/claude/commands/devflow/pre-pr.md

Changes:

Added audit-typescript to agent orchestration
Automatic conditional execution (no manual config)
Integrated into review document templates
Clear indicators when skipped (not applicable)

Pre-commit Audits (6 total):

audit-security
audit-typescript (conditional)
audit-performance
audit-architecture
audit-tests
audit-complexity

Pre-PR Audits (8-9 total):

All core audits
audit-typescript (conditional)
audit-database (conditional)

🧪 Testing

All scenarios tested locally:

✅ Scenario 1: Fresh Install

No existing files
Direct installation
No prompts or warnings

✅ Scenario 2: Existing Files

Preserved existing CLAUDE.md
Created CLAUDE.devflow.md
Showed merge instructions

✅ Scenario 3: Force with Prompt Decline

Showed warning message
Prompted for confirmation
Accepted cancellation ("n" input)
Fell back to safe install

✅ Scenario 4: Force with Auto-Approval

No prompts with -y flag
Backed up existing files
Installed DevFlow versions
Showed appropriate warnings

✅ Scenario 5: Custom Content Preservation

Created custom CLAUDE.md
Force installed
Verified backup contains custom content
Verified main file has DevFlow content

🎁 Benefits

Language-Agnostic Design

✅ Global CLAUDE.md works for TypeScript, Python, Go, Rust, Java, etc.
✅ Concepts, not syntax
✅ Maintains universal design philosophy

Specialized Expertise

✅ TypeScript rules enforced where applicable
✅ Deep language-specific knowledge preserved
✅ Automatic detection (no manual config)

Extensible Pattern

✅ Easy to add audit-python, audit-go, audit-rust
✅ Each auditor has built-in detection logic
✅ Graceful degradation (skips if not applicable)

Safe by Default

✅ Never overwrites without permission
✅ User control over global configuration
✅ Clear instructions for manual merge
✅ Reversible operations (backup files)

Automation-Friendly

✅ --force -y for scripts/CI/CD
✅ No interactive prompts when needed
✅ Exit codes for automation

📊 File Changes

New Files

src/claude/CLAUDE.md (332 lines) - Language-agnostic global instructions
src/claude/agents/devflow/audit-typescript.md (275 lines) - TypeScript auditor

Modified Files

src/cli/commands/init.ts (+120 lines) - Smart CLAUDE.md mounting
src/claude/commands/devflow/pre-commit.md (+9 lines) - TS auditor integration
src/claude/commands/devflow/pre-pr.md (+12 lines) - TS auditor integration

Total: 5 files changed, 801 insertions(+), 29 deletions(-)

🔄 Migration Path

For Existing Users

Option 1: Keep Existing Config

Run npx devflow-kit init
DevFlow CLAUDE.md saved to CLAUDE.devflow.md
Manually merge sections you want
Keep your existing CLAUDE.md

Option 2: Replace with DevFlow Config

Run npx devflow-kit init --force -y
Your original backed up to CLAUDE.md.backup
DevFlow version now active
Can restore anytime: cp ~/.claude/CLAUDE.md.backup ~/.claude/CLAUDE.md

Option 3: Start Fresh

Delete existing ~/.claude/CLAUDE.md
Run npx devflow-kit init
Clean DevFlow installation

🚀 Next Steps

Future Language-Specific Auditors

Following the same pattern:

audit-python - Python best practices

Black formatting, type hints (mypy)
PEP 8 compliance
Virtual environment management

audit-go - Go conventions

gofmt, golint compliance
Error handling patterns
Goroutine safety

audit-rust - Rust best practices

Clippy lints
Ownership patterns
Result/Option types

audit-sql - Database best practices

Query optimization
Injection prevention
Index usage

✅ Checklist

Language-agnostic CLAUDE.md created
TypeScript auditor agent implemented
Smart mounting logic with --force and -y flags
Pre-commit integration
Pre-PR integration
All scenarios tested locally
Build succeeds
Documentation updated in commit message
Follows DevFlow's design philosophy

🤖 AI-Generated

This PR was developed with AI assistance following DevFlow's own best practices.

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com

## Summary Implements a language-agnostic global CLAUDE.md and specialized TypeScript auditor to maintain universal design while preserving language-specific expertise. ## Changes ### 1. Language-Agnostic Global CLAUDE.md - Created `src/claude/CLAUDE.md` with language-neutral engineering principles - Stripped TypeScript-specific syntax, kept universal concepts - Covers Result types, DI, immutability, pure functions (conceptually) - Includes critical anti-patterns (NO FAKE SOLUTIONS, FAIL HONESTLY) - Code quality enforcement (root cause analysis, not workarounds) - ~330 lines of precise, non-bloated global instructions ### 2. TypeScript Auditor Agent - Created `src/claude/agents/devflow/audit-typescript.md` - Conditional execution: runs only if .ts/.tsx files changed OR tsconfig.json exists - Built-in detection logic (gracefully skips non-TS projects) - Audits: type safety config, any usage, type assertions, branded types, discriminated unions, immutability, Result types, naming conventions, dependency injection, pure functions - Outputs: CRITICAL/HIGH/MEDIUM/LOW severity with file:line references ### 3. Smart CLAUDE.md Mounting - Updated `src/cli/commands/init.ts` with intelligent mounting logic - **Fresh install**: Directly installs CLAUDE.md (no conflicts) - **Existing file**: Preserves user's CLAUDE.md, creates CLAUDE.devflow.md - **--force flag**: Prompts for confirmation, backs up existing files - **-y flag**: Auto-approves prompts (for automation) - Parallel implementation to settings.json (consistent UX) ### 4. Pre-commit/Pre-PR Integration - Updated `src/claude/commands/devflow/pre-commit.md` - Updated `src/claude/commands/devflow/pre-pr.md` - Added audit-typescript to agent orchestration - Automatic conditional execution (no manual config needed) - Integrated into review document templates ## Key Features ### Smart Mounting - No existing CLAUDE.md → direct install - Existing CLAUDE.md → install as .devflow.md with merge instructions - Force override → backup to .backup, install DevFlow version - Clear instructions for all scenarios ### TypeScript Detection ```bash # Runs if: - .ts/.tsx files changed OR - tsconfig.json exists # Skips if neither condition met ``` ### Safety - Never overwrites without permission - Always backs up before force override - Clear warnings about what --force does - Reversible operations (backup files) ## Testing All scenarios tested locally: - ✅ Fresh install (no existing files) - ✅ Safe install (existing files preserved) - ✅ Force with prompt decline (falls back to safe) - ✅ Force with -y (auto-approved, backed up) - ✅ Custom content preservation verified ## Benefits 1. **Language-Agnostic**: Global CLAUDE.md works for any language 2. **Specialized Expertise**: TypeScript rules enforced where applicable 3. **Extensible Pattern**: Easy to add audit-python, audit-go, etc. 4. **Safe by Default**: User control over global configuration 5. **Automation-Friendly**: --force -y for scripts/CI/CD 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

…ions, async operations Code Quality Improvements: - Extract shared utilities to src/cli/utils/ (eliminated 65 lines of duplication) - Created paths.ts with getInstallationPaths(), path validation, env var security - Created git.ts with async getGitRoot() using promisified exec - Both init.ts and uninstall.ts now use shared utilities Security & Reliability: - Fixed TOCTOU race conditions with atomic file operations ('wx' flag) - settings.json, CLAUDE.md, .claudeignore now use exclusive create - Added environment variable path validation (CLAUDE_CODE_DIR, DEVFLOW_DIR) - Validates absolute paths, warns if outside home directory Performance: - Replaced execSync with async exec (non-blocking git operations) - Eliminated redundant git root detection (was called twice) - All file operations now async throughout the codebase CI/CD Compatibility: - Added TTY detection for interactive prompts - Falls back to default scope in non-interactive environments - Clear messaging when non-TTY detected Documentation: - Added comprehensive CHANGELOG entry for v0.5.0 - Documented all fixes, improvements, and breaking changes - Migration notes for existing users Tested: - User scope installation: ✓ - Local scope installation: ✓ - TTY detection and fallback: ✓ - Auto-detection uninstall: ✓ - Atomic file operations: ✓ - All async operations: ✓ Closes code review issues #2, #4, #5, #6 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

…vements (#16) * feat: add installation scope support (global vs local) Adds --scope option to init command allowing users to choose between: - Global scope: install to ~/.claude/ (user-wide, all projects) - Local scope: install to git-root/.claude/ (project-only) Features: - Interactive prompt when --scope not provided (defaults to global) - New getInstallationPaths() function for scope-aware directory resolution - Git root detection with security validation - For local scope: creates .claude/ and .devflow/ in git repository root - For local scope: automatically adds directories to .gitignore - Updated output messages to indicate installation scope and paths - Comprehensive README documentation with examples Implementation: - getGitRoot(): Detects git repository root with validation - getInstallationPaths(scope): Returns paths based on scope - For global: uses existing ~/.claude/ and ~/.devflow/ - For local: uses <git-root>/.claude/ and <git-root>/.devflow/ - Skip Claude Code detection for local scope (create directory instead) Testing: - Global scope: Verified existing behavior maintained - Local scope: Successfully tested in devflow repository - Both scopes create all components correctly Use cases: - Global: Personal development across all projects - Local: Team projects where DevFlow should be project-specific - Local: CI/CD environments with project-scoped configuration 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: rename "global" scope to "user" for clarity Changes all references from "global" to "user": - TypeScript types: 'global' | 'local' → 'user' | 'local' - CLI option: --scope <global|local> → --scope <user|local> - Interactive prompt: "Choose scope (global/local)" → "Choose scope (user/local)" - Output messages: "global" → "user" - README documentation: "Global Scope" → "User Scope" Rationale: "user" is clearer and more precise than "global" - "user scope" = user-wide installation (~/.claude/) - "local scope" = project-specific installation (git-root/.claude/) All functionality remains the same, only naming improved. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * feat: add scope support to uninstall command Enhanced uninstall command to support both user and local scopes: Features: - Auto-detects installed scopes (user and/or local) if --scope not specified - --scope option: user, local, or both - Uninstalls from user scope (~/.claude/, ~/.devflow/) - Uninstalls from local scope (git-root/.claude/, git-root/.devflow/) - Clear output showing which scope is being uninstalled - Handles cases where DevFlow installed in multiple scopes Auto-detection logic: - Checks ~/.claude/commands/devflow/ for user scope - Checks git-root/.claude/commands/devflow/ for local scope - If both found, uninstalls from both with notification - If none found, exits with helpful message Usage examples: - devflow uninstall (auto-detects and uninstalls from all found scopes) - devflow uninstall --scope user (explicit user scope only) - devflow uninstall --scope local (explicit local scope only) - devflow uninstall --scope both (force uninstall from both) Testing: - Verified local scope uninstall removes git-root/.claude/commands/devflow/ - Verified directories properly cleaned up - Verified error handling for non-git repositories 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: remove "both" option from uninstall, auto-detect is default Simplified uninstall command: - Removed --scope both option (excessive) - Default behavior (no --scope): auto-detect and uninstall from all found scopes - --scope user: uninstall from user scope only - --scope local: uninstall from local scope only Rationale: Default should be smart and do the right thing automatically. Users who want specific scope can use --scope flag. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: simplify settings/CLAUDE.md installation - never override Simplified file installation behavior: - Never override or rename existing files - Always install adjacent files (settings.devflow.json, CLAUDE.devflow.md) - User manually merges desired changes into their existing files Changes: - Removed complex backup/rename logic (managed-settings.json) - Removed --force and -y options (no longer needed) - Removed forceOverride logic and prompts - Simplified to simple exists check: install as .devflow.* if exists Installation behavior now: - settings.json exists? → Install as settings.devflow.json - settings.json missing? → Install as settings.json - CLAUDE.md exists? → Install as CLAUDE.devflow.md - CLAUDE.md missing? → Install as CLAUDE.md Final message shows clear merge instructions: - Review settings.devflow.json and merge statusLine config - Review CLAUDE.devflow.md and adopt desired practices Benefits: - Much simpler code (~80 lines removed) - Never touches user's existing files - Clear instructions for manual merge - No complex state management - No backup/restore logic needed 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: address code review issues - extract utils, fix race conditions, async operations Code Quality Improvements: - Extract shared utilities to src/cli/utils/ (eliminated 65 lines of duplication) - Created paths.ts with getInstallationPaths(), path validation, env var security - Created git.ts with async getGitRoot() using promisified exec - Both init.ts and uninstall.ts now use shared utilities Security & Reliability: - Fixed TOCTOU race conditions with atomic file operations ('wx' flag) - settings.json, CLAUDE.md, .claudeignore now use exclusive create - Added environment variable path validation (CLAUDE_CODE_DIR, DEVFLOW_DIR) - Validates absolute paths, warns if outside home directory Performance: - Replaced execSync with async exec (non-blocking git operations) - Eliminated redundant git root detection (was called twice) - All file operations now async throughout the codebase CI/CD Compatibility: - Added TTY detection for interactive prompts - Falls back to default scope in non-interactive environments - Clear messaging when non-TTY detected Documentation: - Added comprehensive CHANGELOG entry for v0.5.0 - Documented all fixes, improvements, and breaking changes - Migration notes for existing users Tested: - User scope installation: ✓ - Local scope installation: ✓ - TTY detection and fallback: ✓ - Auto-detection uninstall: ✓ - Atomic file operations: ✓ - All async operations: ✓ Closes code review issues #2, #4, #5, #6 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * chore: bump version to 0.5.0 Release 0.5.0 with installation scope support and smart uninstall detection Major Features: - Two-tier installation strategy (user-wide vs project-specific) - Interactive scope selection with clear descriptions - Smart uninstall with automatic scope detection - Environment variable path validation for security - TTY detection for CI/CD compatibility 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Dean Sharon <deanshrn@gmain.com> Co-authored-by: Claude <noreply@anthropic.com>

- Replace per-line subprocess spawning in extract_batch_messages with single-pass jq/node processing (issue #1) - Decompose process_observations into validate_observation, calculate_confidence, and check_temporal_spread helpers (issue #2) - Fix duplicate temporal spread calculation by computing epoch once in check_temporal_spread (issue #3) - Escape double quotes in ART_DESC for YAML frontmatter safety (issue #4) - Strengthen ART_NAME sanitization with strict kebab-case allowlist (issue #5) - Replace per-line subprocess in apply_temporal_decay with single-pass jq operation and node fallback (issue #6) - Replace per-line subprocess in create_artifacts status update with single-pass jq/node operation (issue #7) - Remove dead increment_daily_counter function (issue #8) - Extract write_command_artifact and write_skill_artifact helpers from create_artifacts (issue #9) - Change flat 30k char truncation to per-session 8k char cap for proportional session contribution (issue #10) - Add section comment markers to build_sonnet_prompt heredoc for navigability (issue #11)

Addresses 9 issues found in the r1-init-migrations review batch: - #1: Move runMigrations block before installViaFileCopy so V1→V2 shadow renames complete before the installer looks for V2-named directories - #2: Extend Migration.run to return MigrationRunResult { infos, warnings }; both registry entries now surface migrated counts and conflict warnings to init.ts, which logs them via p.log.info / p.log.warn after the migration loop - #3 (ISP): Split MigrationContext into GlobalMigrationContext | PerProjectMigrationContext discriminated union; drop unused claudeDir field; empty-string sentinels removed - #4: Cap per-project Promise.allSettled concurrency at 16 via pooled() helper to avoid EMFILE on machines with 50-200 projects - #5: Accumulate newlyApplied in memory and write state once at end of runMigrations — eliminates O(N²) writeAppliedMigrations calls per run - #6: Use { flag: 'wx' } exclusive-create on .tmp file with unlink+retry on EEXIST to prevent TOCTOU symlink writes - #7: Add exhaustiveness assertion (never) on migration.scope dispatch so future union extensions cause a runtime throw instead of silent no-op - #8 (D37): Document vacuous-truth edge case in runMigrations comment block where discoveredProjects=[] marks per-project migration applied without sweeping any project - #9: Convert applied array to Set<string> before the migration loop for O(1) .has() lookups instead of O(N) .includes() per migration Co-Authored-By: Claude <noreply@anthropic.com>

#246) ## Context Real `/devflow:dynamic-*` runs in the sibling `skim` / `skim-search` projects underperformed: **~50% of workflow runs failed** and driver sessions sprawled across 1–5 days. Root-cause analysis (memory `dynamic-workflow-skim-postmortem`) found the time sinks were structural. This PR fixes the five highest-leverage causes plus one bundled core bug (stray nested `.devflow/`). Source of truth is `shared/recipes/*.mds` (→ `plugins/devflow-dynamic/commands/` at build) and `shared/agents/*.md`. Compiled recipes + distributed agents are gitignored. ## Fix 1 — Long-build stall guard (the dominant failure) ⚠️ load-bearing The Workflow runtime kills any sub-agent silent for 180s; cold `cargo build`/`cargo test` blew past it (`agent stalled on all 6 attempts`). **Spike first (load-bearing assumption).** Ran a minimal workflow whose agent runs a >200s background command + a `Monitor` heartbeat poll. **Result: `survived: true`, `elapsedSeconds: 253`, read final output, 8 heartbeats.** The doctrine (the plan's primary path) is settled — no fallback needed. - New `_engine.mds` `build_execution_doctrine()` (exported, rendered in `dynamic-build`): build/test that may run silent >~120s MUST run via `Bash(run_in_background)` + a `Monitor` emitting sub-watchdog heartbeats (~25s) with `timeout_ms` above the job; prefer crate/package-scoped commands, full-workspace regression left to the human. - `validator.md`, `tester.md`, `coder.md` gain a mechanical "Long-running commands" subsection (also fixes the plain-Bash 120s default-timeout that bites `/implement`). ## Fix 2 — Gate-1 cadence: full V-S-S exactly twice per ticket Gate 1 (Validator→Simplifier→Scrutinizer) previously fired after **every** mutation (≈6 passes/ticket). Now it runs **twice**: post-implementation (#1) and one final post-fix gate (#2). Between review cycles and Gate-2 fixes the Coder **self-verifies its own build**; nothing else runs. Verified via compiled-output grep: Simplifier/Scrutinizer appear exactly **2×** each. ## Fix 3 — Generated-script robustness `_preamble.mds` `authoring_preamble()` gains a **mandatory pre-flight self-check** targeting the two observed crash classes (`pipeline()` non-array first arg; `undefined is not an object (SEAL.num)`), plus a cheap `node --check` syntax gate (noted: catches syntax only, the checklist is the real lever) and a default-dry-run recommendation for large scripts. ## Fix 4 — Decisions: batch + auto-resolve transparency - `dynamic-plan` writes **Auto-Resolved Decisions** as `decision → resolution → source` (auditable/reversible) and surfaces them at the command boundary. - `dynamic-build` gains a command-boundary section: after the workflow returns, batch the wave report's escalations + any `DECISIONS-NEEDED` into **one** `AskUserQuestion`. - Preference-profile-absent note in the report. ## Fix 5 — Wave deadlock report clarity `_wave.mds`: each blocked/quarantined ticket now states **why** (the specific failed dependency / unresolved decision, never a bare "blocked") and cites the resume `runId`/journal. Pure reporting clarity — no control-flow change. ## Fix 6 — Stray nested `.devflow/` (anchor hooks to git root) Every shell hook computed `"$CWD/.devflow"` with no git-root anchoring; a worker spawned with a CWD inside `.devflow/docs/.../tickets/` scaffolded a stray nested `.devflow/`. - New `scripts/hooks/resolve-project-root` defining `df_resolve_root` (git top-level, with a `.devflow/`-strip fallback for non-git dirs), mirroring the TS CLI's `getGitRoot()`. - Anchored the `.devflow/` derivation in 8 hooks + `ensure-devflow-init` (session-cwd-dependent things like the transcript lookup deliberately stay on `$CWD`). - **Anchor-only** per the plan — no auto-clean / migration for existing strays. ## Verification - **Spike** ✓ (`survived: true`, 253s). - **`npm run build`** clean (CLI + agent distribution + recipes, 0 errors). - **`npm test`** → **1880 passed** (64 files). +10 new tests: `df_resolve_root` cases (a/b/c/c2), a nested-`.devflow/` integration test (Stop hook with CWD inside `.devflow/` writes the queue at the repo root, no stray), and compiled-`dynamic-build.md` assertions (build doctrine present, final Gate 1 present, per-cycle Gate-1 absent, Simplifier/Scrutinizer 2× each). ## Deferred (flagged, not blocked) - **`json-helper.cjs` git-root alignment** (plan's optional secondary): the 4 `process.cwd()` sites (`assign-anchor`/`retire-anchor`/`render`) would need a new `child_process`/git dependency in a pure-JSON utility, and those ops only ever run from the Dream agent at the repo root. Left as-is per "flag, don't block." ## Notes - During the Fix-1 spike, the spike agent flagged a **skim rewrite-hook artifact**: a cleanup command containing `wc` returned `wc 1\n 0` instead of `0` (a stray `wc 1` token prepended). Surfacing per the skim-reporting instruction. ## Out of scope No wave-size cap; no auto-deletion of existing strays; no change to the 180s watchdog itself (Fix 1 works *with* it); no Gate-2 placement change.

…resh retry context, drop schema residue ISS-06 (applies ADR-003): _engine.mds review-scope sentence now states the actual contract — diff against merge-base with the default branch, no SHA claim. Skeleton reviewScope instructs Review agents to compute merge-base from git rather than each guessing a base independently (avoids PF-024 phantom-variable pattern). ISS-21 (avoids PF-024): introduce FIX_CHUNK=5 so distinct-file Code agent groups are launched in staggered parallel() chunks of 5, matching the Review spawn pacing bar (explicit bound per reliability rule). Doctrine sentence in _engine.mds extended to match. ISS-27: Gate 1 #2 retry now threads fresh failure details — failureDetails var tracks latest recheck.details so attempt 2 sees what attempt 1 left, not the original validation.details. SUG-04 (applies ADR-003, avoids PF-024): drop filesChanged from engine_output_schema — the field has no producer since the maxCycles heuristic was deleted; grep confirms nothing in the command or partials reads it. ISS-24 (avoids PF-025): _preamble.mds IRON RULE drops "no cycle-counters," and "and cycle counts" — the only referents were the deleted review loop; wave rounds (MAX_ROUNDS) are unaffected. All compile: npm run build:mds — 13 compiled, 0 errors. Tests: npx vitest run tests/build-mds.test.ts tests/registry-integrity.test.ts — 71 pass.

Fixes six semantic drifts against current engine sources: - Review scope: no base SHA tracked; agents compute merge-base with default branch - Dead-reviewer handling: coverageGaps block PASS verdict, not early exit - Fix batching: DISTINCT-file sub-batches now staggered in FIX_CHUNK=5 groups - Evidence-gated disposition: FIXED requires status+commitShas+empty unresolved - Early exit: triggers on allFindings.length===0 alone; coverageGaps carry forward - Wave post-wave-report: documents tracking-issue resolution, TRACEABILITY: DEGRADED behavior, and WORKTREE_PATH threading - New gotcha: Gate 1 #2 retry updates failureDetails across attempts

…t markers - Wrap setup-task's remote-sourced issue fields (title, description, criteria) in <untrusted-issue-body> tags, keeping the locally-derived issue number outside, so Principle 8's claim that all remote bodies are wrapped is now true. - Expand fetch-issues-batch Output template to show issue #2 with its full wrapper (not an elision), and add an explicit per-issue wrapping sentence. - Add Principle 8 marker-neutralisation sub-rule: before wrapping, scan for the literal closing marker and insert a backslash before the slash so an attacker cannot close containment early. - Add one-line pointer to the neutralisation rule in each affected operation: fetch-issue, fetch-issues-batch, setup-task, and fetch-review-threads.

dean0x merged commit dd39766 into main Oct 16, 2025

dean0x deleted the feature/global-claude-md branch October 16, 2025 22:49

dean0x mentioned this pull request Oct 24, 2025

feat: Installation scope support (user/local) with code quality improvements #16

Merged

dean0x mentioned this pull request Mar 14, 2026

feat: Wave 2 — project knowledge system (decisions + pitfalls) #140

Closed

6 tasks

dean0x mentioned this pull request Apr 14, 2026

fix(v2): three project-knowledge ship-blockers #182

Merged

9 tasks

This was referenced May 2, 2026

refactor: knowledge system rename, agent decoupling, and feature alignment #199

Open

fix(decisions): update --review to deprecate in rendered markdown #206

Merged

dean0x mentioned this pull request May 12, 2026

feat: restore companion skill loading to orch skills and commands #218

Merged

dean0x mentioned this pull request Jun 3, 2026

refactor(dream): rename sidecar subsystem to Dream + convert processor skill to a real agent #237

Merged

5 tasks

dean0x mentioned this pull request Jun 21, 2026

feat(dynamic): streamline dynamic workflows + anchor hooks to git root #246

Merged

Navigation Menu

feat: Language-Agnostic Global CLAUDE.md with TypeScript Auditor - #2

feat: Language-Agnostic Global CLAUDE.md with TypeScript Auditor#2
dean0x merged 1 commit into
mainfrom
feature/global-claude-md

dean0x commented Oct 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dean0x commented Oct 16, 2025

🎯 Overview

📦 What's Included

1. Language-Agnostic Global CLAUDE.md (src/claude/CLAUDE.md)

2. TypeScript Auditor Agent (src/claude/agents/devflow/audit-typescript.md)

3. Smart CLAUDE.md Mounting (src/cli/commands/init.ts)

Installation Scenarios

New CLI Options

4. Pre-commit/Pre-PR Integration

🧪 Testing

✅ Scenario 1: Fresh Install

✅ Scenario 2: Existing Files

✅ Scenario 3: Force with Prompt Decline

✅ Scenario 4: Force with Auto-Approval

✅ Scenario 5: Custom Content Preservation

🎁 Benefits

Language-Agnostic Design

Specialized Expertise

Extensible Pattern

Safe by Default

Automation-Friendly

📊 File Changes

New Files

Modified Files

🔄 Migration Path

For Existing Users

🚀 Next Steps

Future Language-Specific Auditors

✅ Checklist

🤖 AI-Generated

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

1. Language-Agnostic Global CLAUDE.md (`src/claude/CLAUDE.md`)

2. TypeScript Auditor Agent (`src/claude/agents/devflow/audit-typescript.md`)

3. Smart CLAUDE.md Mounting (`src/cli/commands/init.ts`)