diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index ab50587..be2aa36 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -21,14 +21,39 @@ "description": "Multi-agent workflow for analyzing, reporting, and optimizing Claude Code configuration across your entire machine" }, { - "name": "ultraplan-local", - "source": "./plugins/ultraplan-local", - "description": "Deep implementation planning with interview, specialized agent swarms, external research, adversarial review, session decomposition, and headless execution support" + "name": "voyage", + "source": "./plugins/voyage", + "description": "Voyage — brief, research, plan, execute, review, continue. Contract-driven Claude Code pipeline with specialized agent swarms, external research triangulation, adversarial review, post-hoc independent review with Handover 6 feedback loop, multi-session resumption, session decomposition, and headless execution. /trekbrief, /trekplan, and /trekreview each end by building a self-contained operator-annotation HTML (scripts/annotate.mjs, modelled on claude-code-100x): pencil-toggle annotation mode, select text or click any element, pick intent (Fiks/Endre/Spørsmål), comment, Copy Prompt, paste back, Claude revises the .md." }, { "name": "linkedin-thought-leadership", "source": "./plugins/linkedin-thought-leadership", "description": "Build LinkedIn thought leadership with algorithmic understanding, strategic consistency, and authentic engagement. Updated for the January 2026 360Brew algorithm change." + }, + { + "name": "graceful-handoff", + "source": "./plugins/graceful-handoff", + "description": "Produce session-handoff artifacts, commit and push pending work, and print a copy-paste prompt for the next session. Designed for context-constrained models like Opus 4.7." + }, + { + "name": "ai-psychosis", + "source": "./plugins/ai-psychosis", + "description": "Meta-awareness tools for healthy AI interaction patterns. Detects reinforcement loops, scope escalation, narrative crystallization, and other compulsive patterns." + }, + { + "name": "ms-ai-architect", + "source": "./plugins/ms-ai-architect", + "description": "Microsoft AI Solution Architect — structured architecture guidance for the full Microsoft AI stack." + }, + { + "name": "okr", + "source": "./plugins/okr", + "description": "Expert OKR guidance for Norwegian public sector. Write, review, cascade, track and govern OKR based on Google/Doerr methodology adapted for 4-month tertial cycles." + }, + { + "name": "human-friendly-style", + "source": "./plugins/human-friendly-style", + "description": "Shared Claude Code output style for the ktg-plugin-marketplace. Plain-language tone — explains what and why, hides paths/JSON/stack traces by default, matches the user's language." } ] } diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000..cca2a7f --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,14 @@ +title = "ktg-plugin-marketplace gitleaks config" + +# Extend default rules +[extend] +useDefault = true + +# Path-based allowlist: vendored design-system MANIFEST.json files +# contain SHA-256 hashes per file by design (drift detection). +# These are public file integrity hashes, not secrets. +[[allowlists]] +description = "Vendored design-system MANIFEST files (SHA-256 file hashes)" +paths = [ + '''playground/vendor/playground-design-system/MANIFEST\.json$''', +] diff --git a/.mailmap b/.mailmap new file mode 100644 index 0000000..b6a2a51 --- /dev/null +++ b/.mailmap @@ -0,0 +1,4 @@ +# Konsoliderer Git-identiteter for statistikk og shortlog. +# Se: https://git-scm.com/docs/gitmailmap + +Kjell Tore Guttormsen diff --git a/CLAUDE.md b/CLAUDE.md index 527f4ed..7542e0b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -8,15 +8,19 @@ Open-source Claude Code plugin marketplace. Solo project by Kjell Tore Guttormse plugins/ ai-psychosis/ v1.0.0 — Interaction awareness (sycophancy, reinforcement loops) config-audit/ v3.1.0 — Configuration intelligence (health, opportunities, auto-fix, whats-active) - graceful-handoff/ v1.0.0 — Session handoff in <60s (NEXT-SESSION artifact + commit+push + copy-paste prompt) + graceful-handoff/ v2.1.0 — Auto-trigger handoff via Stop hook (skill + JSON pipeline + 4-step model-aware context resolution) linkedin-thought-leadership/ v1.2.0 — LinkedIn content pipeline + analytics llm-security/ v6.0.0 — Security scanning, auditing, threat modeling - ms-ai-architect/ v1.8.0 — Microsoft AI architecture (Cosmo Skyberg persona) + ms-ai-architect/ v1.15.0 — Microsoft AI architecture (Cosmo Skyberg persona) + manual KB-refresh slash command + v3 project-view (sidebar med 17 artifacts + main + import-modal overlay, v2-surface fjernet i v1.15.0) okr/ v1.0.0 — OKR guidance for Norwegian public sector - ultraplan-local/ v2.3.2 — Brief, research, architect, plan, execute (five-command pipeline + skill-factory Fase 1) + voyage/ v5.0.3 — Brief, research, plan, execute, review, continue. Contract-driven Claude Code pipeline (six-command universal pipeline + multi-session resumption + --gates autonomy chain). /trekbrief, /trekplan, and /trekreview each end by running scripts/annotate.mjs against the just-written .md and printing the file:// link to a self-contained operator-annotation HTML modelled on claude-code-100x/build-site.js: pencil-toggle annotation mode, select text or click any element, choose intent (Fiks/Endre/Spørsmål), comment, sidebar groups by section with delete + Copy Prompt, localStorage persistence per artifact path. v5.0.0 removed the v4.2/v4.3 bespoke playground + /trekrevise + Handover 8; v5.0.1 pointed at /playground document-critique (wrong direction); v5.0.2 was operator-led but too thin; v5.0.3 matches the reference the operator pointed at from day one. + +shared/ + playground-design-system/ v0.6.0 — Aksel/Digdir-aligned CSS design system + JSON schemas + self-hosted Inter/JetBrains Mono/Source Serif 4 fonts. Tier 1 base + Tier 2 + Tier 3 wave 1+2 (20 components) + Tier 4 project-view-arketype (v0.6.0 — sidebar + main + import-modal overlay). Consumed by ms-ai-architect, okr, llm-security, voyage, config-audit. + playground-examples/ — Reference scenarios (ROS-Lier, OKR-Bærum, security-Direktorat) + showcase landing + 12 isolated Tier 3 wave 2 component demos under components/ ``` -Hvert plugin er selvstendig med egen CLAUDE.md, README, hooks, agents og commands. +Hvert plugin er selvstendig med egen CLAUDE.md, README, hooks, agents og commands. `shared/` inneholder marketplace-nivå infrastruktur som flere plugins bygger på. ## Konvensjoner @@ -25,12 +29,13 @@ Hvert plugin er selvstendig med egen CLAUDE.md, README, hooks, agents og command - **Git:** Forgejo (`git.fromaitochitta.com/open/ktg-plugin-marketplace`). Aldri GitHub. - **Hooks:** Alltid Node.js (.mjs), aldri bash. Cross-platform. - **Avhengigheter:** Null npm dependencies i hooks/scannere. `node:test` for tester. -- **PRs:** Aksepteres ikke. Issues velkommen. +- **Bidrag:** Issues velkommen som signaler. PRs ikke akseptert. Fork-and-own er anbefalt adopsjonsmodell — se `GOVERNANCE.md`. - **Lisens:** MIT, alle plugins - **Docs ved endring (OBLIGATORISK):** Enhver feature-endring som pusher til Forgejo MÅ oppdatere alle tre doc-nivåer i SAMME commit eller umiddelbart etter: 1. Plugin `README.md` — detaljert dokumentasjon av endringen 2. Plugin `CLAUDE.md` — arkitektur/oversikt 3. Rot-`README.md` — marketplace-landingssiden (`git.fromaitochitta.com/open/ktg-plugin-marketplace`) +- **Playground-oppdatering:** Ved endring av plugin playground HTML eller delt design-system, følg prosedyren i `shared/PLAYGROUND-MAINTENANCE.md` (4 spor: HTML-endring, DS-endring, screenshots, release). ## Sesjonsfiler (lokale, gitignored) @@ -48,3 +53,20 @@ Disse trackes IKKE i git. Oppdater ved sesjonsslutt. 3. Les REMEMBER.md og TODO.md for sesjonsstatus 4. Jobb innenfor scope 5. Oppdater REMEMBER.md ved avslutning + +## Communication patterns + +### Linking to local files + +When pointing to local files in responses, always use markdown link syntax with a descriptive name: + +- Use `[Human-friendly name](file:///absolute/path)` — never bare `file:///...` URLs or autolinks ``. +- Always use absolute paths. Never `~/` or relative paths. +- For multiple files, render as a bullet list of named markdown links. + +Why: bare `file://` URLs only render the first as clickable across multiple lines. Named markdown links make each entry independently clickable and look cleaner. + +Example: + +- [Brief](file:///Users/ktg/.../brief.html) +- [Research summary](file:///Users/ktg/.../research/summary.md) diff --git a/GOVERNANCE.md b/GOVERNANCE.md new file mode 100644 index 0000000..a1e9b52 --- /dev/null +++ b/GOVERNANCE.md @@ -0,0 +1,131 @@ +# Governance + +How this marketplace is maintained, what you can expect from upstream, and how it's meant to be used. + +## TL;DR + +- Solo-maintained, AI-assisted development, MIT licensed. +- **Fork-and-own is the default model.** Upstream is a starting point, not a vendor. +- Issues welcome as signals. Pull requests are not accepted — see [Why no PRs](#pull-requests--no). +- No SLA. Best-effort bug fixes and security advisories. Breaking changes happen and are noted in each plugin's CHANGELOG. + +--- + +## Can I trust this? + +Be honest with yourself about what you're adopting: + +- **One maintainer.** If I get hit by a bus, the bus wins. The repos stay up under MIT, but no one owes you a fix. +- **AI-generated code with human review.** Every plugin is built through dialog-driven development with Claude Code. I read, test, and judge the output before it ships, but I'm not auditing every line the way a security firm would. Treat it accordingly. +- **No commercial interests.** I'm not selling a SaaS, not steering you toward a paid tier, not collecting telemetry. The plugins run locally in your Claude Code installation. +- **MIT licensed.** Fork it, modify it, ship it under your own name. + +If you work somewhere that needs vendor accountability, support contracts, or signed assurances — **this isn't that.** Use it as a reference implementation, fork it into your own organization, and own the result. + +--- + +## How this is meant to be used + +### Fork-and-own + +The intended workflow: + +1. **Fork** the marketplace (or a single plugin) into your own organization or namespace. +2. **Tailor** it to your context — terminology, integrations, cycle lengths, regulatory framing, whatever doesn't fit out of the box. +3. **Maintain it yourself.** Treat your fork as the canonical version for your team. +4. **Watch upstream selectively.** Cherry-pick changes that help, ignore changes that don't. There's no obligation to stay in sync. + +This isn't a workaround for not accepting PRs. It's the actual recommended adoption pattern, especially for plugins like `okr` and `ms-ai-architect` where every Norwegian public sector organization will need its own tildelingsbrev mappings, terminology, and integrations. A central "one true plugin" would be wrong for everyone. + +### What to change first when you fork + +Each plugin differs, but the common edits are: + +- **Identity** — rename the plugin, replace authorship, update README. +- **External integrations** — issue trackers, knowledge bases, dashboards, observability backends. The plugins ship as starting points, not pre-wired. Every organization must configure its own integrations. +- **Norwegian-specific framing** — relevant for `okr` and `ms-ai-architect`. Other plugins are jurisdiction-neutral. Rewrite for your jurisdiction if you're outside Norway. +- **Reference docs** — the knowledge base in each plugin reflects my reading. Replace with your organization's authoritative sources. +- **Hooks and policies** — security thresholds, blocked commands, and audit gates are tuned to my taste. Tune them to yours. + +### Staying current with upstream + +If you want to pull in upstream changes later: + +- **Cherry-pick, don't merge.** Each plugin moves independently and breaking changes land without ceremony. +- **Read the CHANGELOG first.** Every plugin has one. +- **Keep your customizations in clearly-named files.** The harder upstream is to merge cleanly, the more painful staying current becomes. A `local/` directory or `*.local.md` convention helps. + +--- + +## What upstream provides + +| | What I do | What I don't | +|---|---|---| +| **Bug fixes** | Best-effort when I notice or get a clear report | No SLA, no triage commitment | +| **Security issues** | Investigate within reasonable time, document in CHANGELOG | No CVE process, no embargo coordination | +| **New features** | When they fit my own usage | Not on request | +| **Norwegian public sector context** | Kept current as long as the project lives | If I lose interest or change jobs, the framing freezes | +| **Breaking changes** | Documented in CHANGELOG | They happen — version pin if you need stability | +| **Compatibility** | Tracked against current Claude Code releases | No long-term support branches | + +If any of this is a dealbreaker — fork now, version-pin, and stop reading upstream. + +--- + +## How to contribute + +### Issues — yes, please + +Issues are the most valuable thing you can send me: + +- **Bug reports** with reproduction steps. Even a screenshot helps. +- **Use-case feedback.** "I tried to use this in my organization and X didn't fit" is genuinely useful, even if I can't fix it for you. +- **Pointers to better sources.** If you know a DFØ veileder, an NSM guideline, or an academic paper that contradicts what's in a knowledge base, tell me. +- **Security findings.** See each plugin's `SECURITY.md` for disclosure preference where one exists; otherwise email rather than open a public issue. + +### Pull requests — no + +This is deliberate, not laziness: + +- **Solo review is a bottleneck.** Honest PR review takes me longer than rewriting from scratch. The math doesn't work. +- **Forks are where the value is.** The fork-and-own model means upstream consolidation isn't the point. Your organization's adaptations belong in your fork, not mine. +- **AI-generated code complicates provenance.** Every line here is produced through dialog with Claude Code, with me as the judge. Mixing in PRs from contributors with different processes and licensing assumptions creates a mess I'd rather not untangle. + +If you've built something useful on top of a fork, **publish it under your own name and link back.** I'll happily list notable forks here once they exist. + +### Notable forks + +*(To be populated as forks emerge. If you've forked one of these plugins for production use, open an issue and I'll add a link.)* + +--- + +## Relationship between plugins + +These plugins are **independent**. Install one without the others, fork one without the others. They share conventions (slash command naming, hook patterns, AI-generated disclosure) but no runtime dependencies. + +The marketplace is a **catalog**, not a suite. Don't fork the whole repo unless you actually want to maintain everything. + +--- + +## Versioning and stability + +- **Semantic versioning per plugin.** Each plugin has its own `CHANGELOG.md` and version number. +- **Breaking changes happen.** I bump the major version when they do, but I don't run an LTS branch. +- **Pin your version.** If stability matters more than features, install a specific version and stay there until you choose to upgrade. + +--- + +## Public sector adoption notes + +For Norwegian etater specifically: + +- **DPIA-relevant data flows are documented in the relevant plugin README where applicable.** Read them before installation. +- **No data leaves your machine** beyond what Claude Code itself sends to Anthropic. The plugins themselves do not call external services unless you configure an integration. +- **Drøftingsplikt and ledelsesansvar** are not replaced by these tools. The `okr` plugin coaches; it does not decide. The `ms-ai-architect` plugin advises; it does not approve. +- **Choose your Claude deployment carefully.** claude.ai vs. API direct vs. Bedrock in EU region have different data residency profiles. The plugins don't choose for you. + +--- + +## License + +MIT for all plugins in this marketplace. See each plugin's `LICENSE` file. diff --git a/README.md b/README.md index 584716b..02f5eb2 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Open-source Claude Code plugins for AI-assisted development, security, and planning. -Built for my own Claude Code workflow and shared openly for anyone who finds them useful. Solo project — bug reports and feature requests are welcome, pull requests are not accepted. +Built for my own Claude Code workflow and shared openly for anyone who finds them useful. Solo-maintained, AI-assisted, fork-and-own. Issues are welcome as signals; pull requests are not accepted. See [GOVERNANCE.md](GOVERNANCE.md) for what upstream provides and how this is meant to be used. ## AI-generated code disclosure @@ -26,82 +26,111 @@ Then open Claude Code and type `/plugin` to browse and install plugins from the ## Plugins -### [LLM Security](plugins/llm-security/) `v7.0.0` +### [LLM Security](plugins/llm-security/) `v7.6.1` Security scanning, auditing, and threat modeling for agentic AI projects. Built on OWASP LLM Top 10 (2025), OWASP Agentic AI Top 10, and the AI Agent Traps taxonomy (Google DeepMind, 2025). Three layers of protection: - **Automated enforcement** — 9 hooks that block dangerous operations in real time (prompt injection, secrets in code, destructive commands, supply chain guardrails, transcript scanning before context compaction) -- **Deterministic scanning** — 22 Node.js scanners (10 orchestrated + 12 standalone) for byte-level analysis: Shannon entropy, Unicode codepoints, typosquatting detection, taint flow, DNS resolution, git forensics, AI-BOM, attack simulation, IDE extension prescan (VS Code + JetBrains — URL fetch from Marketplace / OpenVSX / direct VSIX / JetBrains Marketplace, hardened ZIP extractor for zip-slip / symlinks / bombs, plus OS sandbox via `sandbox-exec` / `bwrap` so the kernel enforces FS confinement). Bash-normalize T1-T6 for obfuscation-resistant denylists -- **Advisory analysis** — 19 commands that scan, audit, and model threats with structured reports, letter grades, and actionable remediation +- **Deterministic scanning** — 23 Node.js scanners (10 orchestrated + 13 standalone) for byte-level analysis: Shannon entropy, Unicode codepoints, typosquatting detection, taint flow, DNS resolution, git forensics, AI-BOM, attack simulation, IDE extension prescan (VS Code + JetBrains — URL fetch from Marketplace / OpenVSX / direct VSIX / JetBrains Marketplace, hardened ZIP extractor for zip-slip / symlinks / bombs, plus OS sandbox via `sandbox-exec` / `bwrap` so the kernel enforces FS confinement), MCP cumulative-drift baseline reset (E14 — sticky baseline catches slow-burn rug-pulls). Bash-normalize T1-T6 for obfuscation-resistant denylists +- **Advisory analysis** — 20 commands that scan, audit, and model threats with structured reports, letter grades, and actionable remediation - **Enterprise governance** — Compliance mapping (EU AI Act, NIST AI RMF, ISO 42001), SARIF 2.1.0 output, structured audit trail, policy-as-code, standalone CLI +- **v7.6.1 playground visuell-patch (2026-05-06)** — Seks bugs fanget av maintainer ved manuell verifisering i nettleser etter v7.6.0-release. Alle skyldtes mismatch mellom DS-klasser og hvordan playground-rendrere brukte dem (eller manglende DS-implementasjoner av klasser playground-rendrere antok eksisterte): `renderFindingsBlock` brukte `.findings` outer-class (DS' 2-kolonners list+detail-grid) → erstattet med `
` + korrekt `findings__list`-mønster; `.report-table` manglet helt i DS men brukes i 7+ rendrere → lokal CSS-implementasjon; `renderPreDeploy` traffic-lights brukte fast 28×28 px `.sm-card__grade` for "PASS"/"PASS-WITH-NOTES"/"FAIL" → bredde-tilpasset status-pill; threat-model matrix-bobler ikke klikkbare → `