.claude/hooks/file_checker_python.py (1)

153-156: Ruff detection still misses 4+ letter prefixes.
The new regex limits prefixes to 1–3 letters, so codes like PERF/FURB won’t be detected and has_issues can be false. Consider widening the pattern or parsing Ruff JSON output.

🔧 Suggested minimal fix (broader regex)

-        error_pattern = re.compile(r":\d+:\d+: [A-Z]{1,3}\d+")
+        error_pattern = re.compile(r":\d+:\d+:\s+[A-Z]+\d+")

pyproject.toml (1)

108-111: Consider replacing blanket per-file ignores with targeted noqa comments.

The pattern "installer/steps/*" applies PLR0913 and PLR0915 ignores across all step modules. Blanket ignores can hide complexity regressions. For functions that legitimately exceed these limits, use inline # noqa: PLR0913, PLR0915 instead to keep linter signals active elsewhere in the codebase.

.claude/skills/standards-skill-creator/SKILL.md (1)

39-48: Add language identifiers to fenced blocks for lint compliance (Lines 39-48, 75-82).

markdownlint flags these fences. Use a neutral language like text to keep formatting consistent.

♻️ Suggested fix

-```
+```text
 skill-name/
 ├── SKILL.md (required)
 │   ├── YAML frontmatter (name, description)
 │   └── Markdown instructions
 └── Bundled Resources (optional)
     ├── scripts/      - Executable code
     ├── references/   - Documentation loaded as needed
     └── assets/       - Files used in output (templates, etc.)

-```
+```text
 bigquery-skill/
 ├── SKILL.md (overview + navigation)
 └── references/
     ├── finance.md
     ├── sales.md
     └── product.md

Also applies to: 75-82

.claude/hooks/tdd_enforcer.py (2)

93-123: Loosen test-name matching to reduce false warnings.
Exact matching only catches test_<module>.py / <module>_test.py; common test_<module>_* patterns will still warn.

♻️ Suggested adjustment

-            if test_name == f"test_{module_name}" or test_name == f"{module_name}_test":
-                return True
+            if (
+                test_name == f"test_{module_name}"
+                or test_name.startswith(f"test_{module_name}_")
+                or test_name == f"{module_name}_test"
+                or test_name.startswith(f"{module_name}_test_")
+            ):
+                return True

---

179-198: Skip __init__.py edits to avoid noisy warnings.
Package initializers rarely have 1:1 test modules; short-circuiting avoids repeated false positives.

♻️ Suggested adjustment

     if file_path.endswith(".py"):
+        if Path(file_path).name == "__init__.py":
+            return 0
         path = Path(file_path).parent
         found_failing = False

installer/platform_utils.py (1)

11-31: Resolve nvidia-smi via shutil.which or constrain subprocess PATH to mitigate S607 (PATH spoofing).

The current code passes a non-absolute executable path to subprocess.run(), which triggers S607 (CWE-426 untrusted search path). The suggested fix using shutil.which() makes the resolved path explicit, but note that it doesn't eliminate PATH spoofing if the environment's PATH variable is compromised. For stronger defense, either validate the resolved path against known directories (/usr/bin, /bin) or pass a constrained env dict with a minimal PATH to subprocess.run().

🔧 Suggested adjustment

-        proc = subprocess.run(
-            ["nvidia-smi"],
-            capture_output=True,
-            timeout=10,
-        )
-        if proc.returncode == 0:
-            return True
+        nvidia_smi = shutil.which("nvidia-smi")
+        if nvidia_smi:
+            proc = subprocess.run(
+                [nvidia_smi],
+                capture_output=True,
+                timeout=10,
+            )
+            if proc.returncode == 0:
+                return True

docs/site/vercel.json (1)

43-51: Consider escaping the dot in the woff2 pattern.

The pattern /(.*).woff2 treats . as "any character" in regex. While unlikely to cause issues in practice, escaping it as /(.*)\\.woff2 would be more precise.

Suggested fix

     {
-      "source": "/(.*).woff2",
+      "source": "/(.*)\.woff2",
       "headers": [

.claude/commands/plan.md (1)

478-490: Clarify the handoff mechanics to /spec.

The CRITICAL section describes what /spec MUST do next, but this is within the /plan command file. This could be confusing since the instructions target behavior of a different command (/spec). Consider either:

1. Moving this guidance to the /spec command file
2. Rephrasing to clarify this is documenting the expected contract from /spec's perspective

install.sh (2)

14-37: Consider quoting $INSTALLER_ARGS accumulation to handle spaces.

The current approach concatenates arguments with spaces, which can break if an argument contains spaces. Consider using an array instead:

♻️ Suggested improvement using arrays

-INSTALLER_ARGS=""
+INSTALLER_ARGS=()

 while [ $# -gt 0 ]; do
 	case "$1" in
 	--dev)
 		INSTALL_DEV=true
 		shift
 		;;
 	--version)
 		INSTALL_VERSION="$2"
 		shift 2
 		;;
 	--version=*)
 		INSTALL_VERSION="${1#*=}"
 		shift
 		;;
 	*)
-		if [ -z "$INSTALLER_ARGS" ]; then
-			INSTALLER_ARGS="$1"
-		else
-			INSTALLER_ARGS="$INSTALLER_ARGS $1"
-		fi
+		INSTALLER_ARGS+=("$1")
 		shift
 		;;
 	esac
 done

Then at line 478, use "${INSTALLER_ARGS[@]}" instead of $INSTALLER_ARGS.

---

39-58: Complex text processing for pre-release extraction may be fragile.

The pipeline using tr, grep, paste, sed, and sort to extract dev releases is clever but brittle. If GitHub changes their JSON structure or field ordering, this could silently fail.

Consider adding a fallback or using jq if available:

♻️ Suggested improvement with jq fallback

 get_latest_prerelease() {
 	local api_url="https://api.github.com/repos/${REPO}/releases"
 	local releases=""

 	if command -v curl >/dev/null 2>&1; then
 		releases=$(curl -fsSL "$api_url" 2>/dev/null) || true
 	elif command -v wget >/dev/null 2>&1; then
 		releases=$(wget -qO- "$api_url" 2>/dev/null) || true
 	fi

 	if [ -z "$releases" ]; then
 		return 1
 	fi

+	# Try jq first if available (more reliable)
+	if command -v jq >/dev/null 2>&1; then
+		echo "$releases" | jq -r '[.[] | select(.tag_name | startswith("dev-"))] | sort_by(.created_at) | reverse | .[0].tag_name // empty'
+		return
+	fi
+
 	# Extract dev-* releases with their created_at timestamp, sort by timestamp, get latest
-	# Format: created_at|tag_name, then sort by created_at descending
 	echo "$releases" | tr ',' '\n' | grep -E '"(tag_name|created_at)"' | paste - - | \
 		grep 'dev-' | sed 's/.*"created_at"[^"]*"\([^"]*\)".*"tag_name"[^"]*"\([^"]*\)".*/\1|\2/' | \
 		sort -t'|' -k1 -r | head -1 | cut -d'|' -f2
 }

installer/tests/unit/steps/test_dependencies.py (1)

239-258: Clean up unused variable original_info.

The variable original_info is assigned but never used. This was flagged by static analysis (F841).

♻️ Remove unused variable

         ui = Console(non_interactive=True)
         # Capture printed output by mocking ui.info
         info_calls = []
-        original_info = ui.info
         ui.info = lambda msg: info_calls.append(msg)

installer/steps/dependencies.py (4)

169-173: Silent exception handling is acceptable for cleanup but consider logging.

The static analyzer flags the try-except-pass pattern. For cleanup operations before installation, silently ignoring failures is reasonable since the goal is best-effort removal. However, logging at debug level could help troubleshoot installation issues.

♻️ Optional: Add debug logging for troubleshooting

     if native_bin.exists() or native_bin.is_symlink():
         try:
             native_bin.unlink()
-        except Exception:
-            pass
+        except OSError as e:
+            # Best-effort cleanup - log but continue
+            import logging
+            logging.debug(f"Could not remove {native_bin}: {e}")

---

279-293: Minor inconsistency in success detection.

Line 291 checks for "already" while line 266 checks for "already installed". Both work, but using consistent checks ("already installed") across marketplace functions would improve maintainability.

♻️ Optional: Use consistent success message check

         output = (result.stdout + result.stderr).lower()
-        return result.returncode == 0 or "already" in output
+        return result.returncode == 0 or "already installed" in output

---

437-456: Consider reducing code duplication.

The subprocess call is duplicated between the if ui and else branches. This can be consolidated.

♻️ Optional: Consolidate duplicated subprocess call

 def _setup_vexor_local_model(ui: Any = None) -> bool:
     """Download and setup the local embedding model for Vexor."""
+    def run_setup():
+        return subprocess.run(
+            ["vexor", "local", "--setup", "--model", "intfloat/multilingual-e5-small"],
+            capture_output=True,
+            text=True,
+        )
+
     try:
         if ui:
             with ui.spinner("Downloading local embedding model..."):
-                result = subprocess.run(
-                    ["vexor", "local", "--setup", "--model", "intfloat/multilingual-e5-small"],
-                    capture_output=True,
-                    text=True,
-                )
-            return result.returncode == 0
+                result = run_setup()
         else:
-            result = subprocess.run(
-                ["vexor", "local", "--setup", "--model", "intfloat/multilingual-e5-small"],
-                capture_output=True,
-                text=True,
-            )
-            return result.returncode == 0
+            result = run_setup()
+        return result.returncode == 0
     except Exception:
         return False

---

705-719: Same duplication pattern as _setup_vexor_local_model.

Consider applying the same consolidation refactor here for consistency.

LICENSE (1)

41-41: Clarify proprietary vs AGPL scope.

“Most” is still legally ambiguous. Please explicitly enumerate which components are proprietary vs AGPL (or state “All source code is AGPL-3.0”).

.github/workflows/claude-code-review.yml (1)

14-19: Guard forked PRs without secrets (same issue as earlier review).
Line 14–19: For forked PRs, secrets.CLAUDE_CODE_OAUTH_TOKEN is unavailable and this job will fail; consider gating to same-repo PRs.

🔒 Suggested guard

jobs:
  claude-review:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest

installer/steps/dependencies.py (1)

814-851: Missing trailing newline in JSON output (duplicate of past review).

Line 844 writes the config without a trailing newline, unlike _patch_claude_config (line 195) which adds + "\n". This inconsistency could cause issues with some tools and version control diffs.

🔧 Proposed fix

-        claude_config_path.write_text(json.dumps(config, indent=2))
+        claude_config_path.write_text(json.dumps(config, indent=2) + "\n")

.github/workflows/release-dev.yml (1)

193-200: Rerun safety for existing tags/releases

Re-running with the same VERSION will fail when the tag or release already exists. Add a defensive delete-and-wait step before tagging/creating the release.

.github/workflows/release-dev.yml (1)

63-69: Centralize VERSION generation to avoid cross‑job drift

Each job recomputes VERSION with the current date. If jobs span midnight UTC or queue delays occur, binaries can embed a different version than the release tag. Consider generating the version once and sharing it via job outputs.

Example refactor (conceptual)

+  prepare-version:
+    runs-on: ubuntu-latest
+    outputs:
+      VERSION: ${{ steps.version.outputs.VERSION }}
+      COMMIT_SHA: ${{ steps.version.outputs.COMMIT_SHA }}
+    steps:
+      - id: version
+        run: |
+          COMMIT_SHA="${{ github.event.pull_request.head.sha || github.sha }}"
+          VERSION="dev-$(echo $COMMIT_SHA | cut -c1-7)-$(date +%Y%m%d)"
+          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "COMMIT_SHA=$COMMIT_SHA" >> "$GITHUB_OUTPUT"
+
   build-ccp-arm64:
+    needs: prepare-version
+    env:
+      VERSION: ${{ needs.prepare-version.outputs.VERSION }}

Also applies to: 119-124, 152-159

.claude/hooks/context_monitor.py (1)

134-140: Align “active plan” grep statuses with the plan schema.

This repeats the previously raised concern: the grep pattern treats COMPLETE as active. Please align with the actual active status list and update the pattern accordingly.

installer/steps/dependencies.py (1)

814-851: Missing trailing newline in JSON output.

Line 844 writes the config without a trailing newline, unlike _patch_claude_config (line 195) which adds + "\n". This inconsistency could cause issues with some tools and version control diffs.

🔧 Proposed fix

-        claude_config_path.write_text(json.dumps(config, indent=2))
+        claude_config_path.write_text(json.dumps(config, indent=2) + "\n")

.github/workflows/release-dev.yml (3)

170-183: Avoid direct github.head_ref interpolation in the script.
This was flagged previously; still applies here.

---

192-199: Handle tag/release collisions on reruns before tagging/pushing.
Same concern as earlier review: add a defensive delete/retry pattern.

---

210-212: Paginate releases before filtering old dev prereleases.
Same issue as earlier: gh api only returns the first page.

.claude/hooks/tdd_enforcer.py (1)

93-124: Logic looks correct for module-scoped failing test detection.

The matching logic handles both test_{module_name}.py and {module_name}_test.py naming conventions correctly.

Regarding the static analysis hint (TRY300): moving return False on line 122 into an else block is a stylistic preference to separate the "success" path from exception handling. The current structure is clear enough, but you could refactor if preferred.

♻️ Optional: Move return to else block (TRY300)

         for test_path in lastfailed:
             test_file = test_path.split("::")[0]
             test_name = Path(test_file).stem

             if test_name == f"test_{module_name}" or test_name == f"{module_name}_test":
                 return True

-        return False
     except (json.JSONDecodeError, OSError):
         return False
+    else:
+        return False

installer/tests/unit/steps/test_dependencies.py (1)

235-258: Remove unused variable original_info.

Line 249 assigns original_info = ui.info but it's never used. This appears to be leftover from a previous implementation.

♻️ Proposed fix

         ui = Console(non_interactive=True)
         # Capture printed output by mocking ui.info
         info_calls = []
-        original_info = ui.info
         ui.info = lambda msg: info_calls.append(msg)

.github/workflows/release-dev.yml (3)

172-184: Shell injection risk via github.head_ref direct interpolation.

This issue was previously identified. github.head_ref is attacker-controlled and can contain shell metacharacters. Pass it through an environment variable instead.

---

213-215: Missing pagination will skip cleanup of older pre-releases.

This issue was previously identified. The gh api call returns only the first 30 releases by default. Add --paginate to ensure all dev pre-releases are considered for cleanup.

---

194-203: Workflow reruns will fail if tag already exists.

If this workflow is re-run for the same commit on the same day, git tag "$VERSION" and git push origin "$VERSION" will fail because the tag already exists. Add defensive cleanup before creating the tag.

🔧 Proposed fix for idempotent tag handling

+          # Clean up existing tag/release if re-running
+          gh release delete "$VERSION" --yes --cleanup-tag 2>/dev/null || true
+          git tag -d "$VERSION" 2>/dev/null || true
+          git push origin ":refs/tags/$VERSION" 2>/dev/null || true
+
           git tag "$VERSION"
           git push origin "$VERSION"
 
           gh release create "$VERSION" \

.github/workflows/release-dev.yml (3)

134-139: Darwin build missing ccp wrapper artifact — breaks installation on macOS.

The Linux ARM64 build uploads both ccp-linux-arm64.so and the ccp wrapper (lines 87-89), but Darwin only uploads the .so file. If install.sh expects both files for all platforms, macOS installations will fail.

Add the ccp wrapper to the Darwin artifact upload:

Proposed fix

       - name: Upload artifact
         uses: actions/upload-artifact@v4
         with:
           name: ccp-darwin-arm64
-          path: ccp/dist/ccp-darwin-arm64.so
+          path: |
+            ccp/dist/ccp-darwin-arm64.so
+            ccp/dist/ccp
           retention-days: 1

---

173-185: Avoid shell injection via direct github.head_ref interpolation.

github.head_ref is attacker-controlled input that may contain shell metacharacters. Pass it through an environment variable instead of direct interpolation.

Safer pattern

       - name: Create pre-release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_BRANCH: ${{ github.head_ref }}
         run: |
           VERSION="${{ steps.version.outputs.VERSION }}"
           PR_NUM="${{ github.event.pull_request.number }}"

           if [ -n "$PR_NUM" ]; then
             NOTES="Pre-release build from PR #${PR_NUM}

           **Commit:** ${{ steps.version.outputs.COMMIT_SHA }}
-          **Branch:** ${{ github.head_ref }}
+          **Branch:** ${PR_BRANCH}

---

214-216: Add pagination to fetch all dev releases for cleanup.

gh api repos/.../releases defaults to returning only 30 releases. If more than 30 dev prereleases exist, older ones won't be cleaned. Add --paginate and aggregate pages.

Suggested change

-          gh api repos/${{ github.repository }}/releases \
-            --jq '[.[] | select(.prerelease and (.tag_name | startswith("dev-")))] | sort_by(.created_at) | reverse | .[5:] | .[].tag_name' \
+          gh api repos/${{ github.repository }}/releases --paginate \
+            | jq -s '[.[][] | select(.prerelease and (.tag_name | startswith("dev-")))] | sort_by(.created_at) | reverse | .[5:] | .[].tag_name' \

.claude/hooks/file_checker_python.py (1)

147-156: Ruff detection still misses 4+ letter rule codes and ignores non‑zero exit

[A-Z]{1,3}\d+ skips prefixes like PERF, TRIO, ASYNC, FURB, so those violations won’t be detected. Also, a non‑zero ruff exit (config/runtime errors) can currently slip through if no lines match the regex.

🛠️ Suggested fix

-        error_pattern = re.compile(r":\d+:\d+: [A-Z]{1,3}\d+")
+        error_pattern = re.compile(r":\d+:\d+: [A-Z]+\d+")
         error_lines = [line for line in lines if error_pattern.search(line)]
-        has_issues = len(error_lines) > 0
+        has_issues = len(error_lines) > 0 or result.returncode != 0

-    error_pattern = re.compile(r":\d+:\d+: [A-Z]{1,3}\d+")
+    error_pattern = re.compile(r":\d+:\d+: [A-Z]+\d+")

Ruff --output-format=concise example and list of rule code prefixes (e.g., PERF, TRIO, ASYNC)

Also applies to: 191-193

installer/steps/dependencies.py (1)

803-839: Add trailing newline when writing ~/.claude.json.

Line 833 writes JSON without a trailing newline, unlike _patch_claude_config. This mismatch can cause diff noise.

🔧 Proposed fix

-        claude_config_path.write_text(json.dumps(config, indent=2))
+        claude_config_path.write_text(json.dumps(config, indent=2) + "\n")

installer/steps/claude_files.py (2)

24-41: Consider edge cases for path prefixes.

The path replacement logic only handles paths prefixed with space ( ) or double quote ("). If paths appear with single quotes, at the start of content, or with other delimiters, they won't be patched. This may be fine for the current JSON settings format, but could cause issues if the function is used more broadly.

♻️ Optional: Use regex for more robust path matching

+import re
+
 def patch_claude_paths(content: str, project_dir: Path) -> str:
     """Patch .claude paths to use absolute paths for the target project.

     Handles both relative paths (.claude/hooks/, .claude/bin/) and existing
     absolute paths from the source repo (/workspaces/claude-codepro/.claude/).
     """
     abs_hooks_path = str(project_dir / ".claude" / "hooks") + "/"
     abs_bin_path = str(project_dir / ".claude" / "bin") + "/"

     content = content.replace(SOURCE_REPO_HOOKS_PATH, abs_hooks_path)
     content = content.replace(SOURCE_REPO_BIN_PATH, abs_bin_path)

-    content = content.replace(" " + HOOKS_PATH_PATTERN, " " + abs_hooks_path)
-    content = content.replace('"' + HOOKS_PATH_PATTERN, '"' + abs_hooks_path)
-    content = content.replace(" " + BIN_PATH_PATTERN, " " + abs_bin_path)
-    content = content.replace('"' + BIN_PATH_PATTERN, '"' + abs_bin_path)
+    # Use word boundary-like matching for relative paths
+    content = re.sub(r'(?<=[" ])' + re.escape(HOOKS_PATH_PATTERN), abs_hooks_path, content)
+    content = re.sub(r'(?<=[" ])' + re.escape(BIN_PATH_PATTERN), abs_bin_path, content)

     return content

---

244-260: Consider clarifying "migration" message.

The message "Migrating skill to command: {name}..." could be misleading since this code only removes the old skill directory. The actual command files are installed separately later. Consider rewording to "Removing deprecated skill (now a command): {name}..." for clarity.

♻️ Optional: Clarify migration message

                         if name in migrated_to_commands or name.startswith("standards-"):
                             if ui:
                                 if name in migrated_to_commands:
-                                    ui.status(f"Migrating skill to command: {name}...")
+                                    ui.status(f"Removing deprecated skill (replaced by command): {name}...")
                                 else:
                                     ui.status(f"Clearing old skill: {name}...")

installer/steps/dependencies.py (1)

748-757: Avoid duplicate status messages for Claude Code install.

_install_claude_code_with_ui emits a status line and install_claude_code emits one too, so users may see duplicates (Line 751). Consider letting the inner function handle status output.

♻️ Suggested tweak

-    if ui:
-        ui.status("Installing Claude Code via npm...")
-        success, version = install_claude_code(project_dir, ui)
+    if ui:
+        success, version = install_claude_code(project_dir, ui)