Merge pull request 'development' (#36) from development into main

Reviewed-on: personal-projects/support-claude-mktplace#36

.claude-plugin/marketplace.json

@@ -6,12 +6,12 @@
   },
   "metadata": {
     "description": "Project management plugins with Gitea and NetBox integrations",
-    "version": "2.2.0"
+    "version": "2.3.0"
   },
   "plugins": [
     {
       "name": "projman",
-      "version": "2.2.0",
+      "version": "2.3.0",
       "description": "Sprint planning and project management with Gitea integration",
       "source": "./plugins/projman",
       "author": {
@@ -23,6 +23,36 @@
       "mcpServers": ["gitea"],
       "integrationFile": "claude-md-integration.md"
     },
+    {
+      "name": "doc-guardian",
+      "version": "1.0.0",
+      "description": "Automatic documentation drift detection and synchronization",
+      "source": "./plugins/doc-guardian",
+      "author": {
+        "name": "Leo Miranda",
+        "email": "leobmiranda@gmail.com"
+      },
+      "homepage": "https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace/src/branch/main/plugins/doc-guardian/README.md",
+      "repository": "https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace.git",
+      "mcpServers": [],
+      "integrationFile": "claude-md-integration.md",
+      "hooks": ["PostToolUse", "Stop"]
+    },
+    {
+      "name": "code-sentinel",
+      "version": "1.0.0",
+      "description": "Security scanning and code refactoring tools",
+      "source": "./plugins/code-sentinel",
+      "author": {
+        "name": "Leo Miranda",
+        "email": "leobmiranda@gmail.com"
+      },
+      "homepage": "https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace/src/branch/main/plugins/code-sentinel/README.md",
+      "repository": "https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace.git",
+      "mcpServers": [],
+      "integrationFile": "claude-md-integration.md",
+      "hooks": ["PreToolUse"]
+    },
     {
       "name": "project-hygiene",
       "version": "0.1.0",
@@ -73,7 +103,9 @@
       "netbox": "cmdb-assistant"
     },
     "hookMapping": {
-      "PostToolUse:Write|Edit": "project-hygiene"
+      "PostToolUse:Write|Edit": "project-hygiene",
+      "PostToolUse:Write|Edit|MultiEdit": "doc-guardian",
+      "PreToolUse:Write|Edit|MultiEdit": "code-sentinel"
     }
   }
 }

CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to support-claude-mktplace will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.3.0] - 2026-01-20
+
+### Added
+
+#### New Plugins
+- **doc-guardian** v1.0.0 - Documentation lifecycle management
+  - `/doc-audit` command for full project documentation drift analysis
+  - `/doc-sync` command to batch apply pending documentation updates
+  - PostToolUse hook for automatic drift detection
+  - Stop hook reminder for pending updates
+  - doc-analyzer agent for cross-reference analysis
+  - doc-patterns skill for documentation structure knowledge
+
+- **code-sentinel** v1.0.0 - Security scanning and refactoring
+  - `/security-scan` command for comprehensive security audit
+  - `/refactor` command to apply refactoring patterns
+  - `/refactor-dry` command to preview refactoring opportunities
+  - PreToolUse hook for real-time security scanning
+  - security-reviewer agent for vulnerability analysis
+  - refactor-advisor agent for code structure improvements
+  - security-patterns skill for vulnerability detection rules
+
+#### projman Enhancements
+- `/test-gen` command - Generate unit, integration, and e2e tests for specified code
+
+### Changed
+- Marketplace version bumped to 2.3.0
+- projman version bumped to 2.3.0
+
 ## [2.2.0] - 2026-01-20
 
 ### Added
@@ -15,18 +44,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `metadata` wrapper for description/version in marketplace.json
 - Keywords to all plugin manifests for better discoverability
 - `commands` and `agents` directory references to plugin manifests
+- Versioning rule: version displayed only in main README.md title
 
 ### Changed
 - Updated marketplace.json with required fields per Claude Code spec
 - Fixed installation documentation to use official Claude Code methods
 - Prioritized public HTTPS URL over Tailscale SSH URL in documentation
 - Updated all plugin manifests with author, homepage, repository, license fields
+- Consolidated version display to main README.md title only
+- Removed version numbers from plugin documentation titles
 
 ### Fixed
 - Plugin manifests now include all required fields per Claude Code spec
 - Installation section uses `extraKnownMarketplaces` instead of undocumented `pluginMarketplace`
 
-## [2.1.0] - Previous Release
+### Removed
+- `docs/references/` directory (obsolete planning documents)
+- Version numbers from individual plugin README titles
+- Version section from plugins/projman/README.md
+
+## [2.1.0] - 2026-01-15
 
 ### Added
 - `docs/CANONICAL-PATHS.md` - Single source of truth for all file paths
@@ -37,16 +74,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Update documentation (`docs/UPDATING.md`)
 - `/initial-setup` slash command
 - File creation governance rules in CLAUDE.md
-- Architecture diagram specifications in `docs/architecture/`
 - `.scratch/` directory for transient work
 - `scripts/` directory for setup automation
-- `docs/architecture/` for Draw.io diagrams
-- `docs/workflows/` for workflow documentation
 
 ### Changed
 - Replaced `docs/CORRECT-ARCHITECTURE.md` reference with `docs/CANONICAL-PATHS.md`
 - Added mandatory path verification section to CLAUDE.md
-- Reorganized documentation into `docs/references/`, `docs/architecture/`, `docs/workflows/`
 - Updated CLAUDE.md with file creation governance
 
 ### Fixed
@@ -54,21 +87,44 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ### Removed
 - Organization/workspace GID variable (no longer needed)
-- Deprecated `cmdb-assistant/` plugin
 - Development output files (test scripts, status reports)
 - IDE-specific workspace files
 - Stray files from project root
 
-## [0.1.0] - Initial Release
+## [2.0.0] - 2026-01-06
 
 ### Added
-- projman plugin for sprint management
+- Full Gitea integration with wiki, milestones, dependencies
+- Parallel execution batching via dependency graph
+- Wiki tools for lessons learned (`create_lesson`, `search_lessons`)
+- Milestone tools (`list_milestones`, `create_milestone`, `update_milestone`)
+- Dependency tools (`list_issue_dependencies`, `create_issue_dependency`, `get_execution_order`)
+- Validation tools (`validate_repo_org`, `get_branch_protection`)
+- MCP servers bundled inside plugins (not shared at root)
+
+### Changed
+- MCP server architecture: bundled in plugins instead of shared at root
+- Configuration uses `${CLAUDE_PLUGIN_ROOT}/mcp-servers/` paths
+
+## [1.0.0] - 2025-12-15
+
+### Added
+- projman plugin with basic sprint commands
+- `/sprint-plan`, `/sprint-start`, `/sprint-status`, `/sprint-close` commands
+- `/labels-sync` command for label taxonomy synchronization
+- Three-agent model (planner, orchestrator, executor)
+- Gitea MCP server with issue and label tools
+- 43-label taxonomy system
+- Hybrid configuration system (system + project level)
+- Branch-aware security model
+
+## [0.1.0] - 2025-12-01
+
+### Added
+- Initial repository structure
+- projman plugin structure (planned)
 - projman-pmo plugin structure (planned)
 - project-hygiene plugin for cleanup automation
-- Gitea MCP server
+- claude-config-maintainer plugin structure
-- Wiki.js MCP server
+- cmdb-assistant plugin structure
-- 43-label taxonomy system
+- Basic marketplace manifest
-- Lessons learned capture system
-- Hybrid configuration system (system + project level)
-- Three-agent model (planner, orchestrator, executor)
-- Branch-aware security model

CLAUDE.md

@@ -5,14 +5,16 @@ This file provides guidance to Claude Code when working with code in this reposi
 ## Project Overview
 
 **Repository:** support-claude-mktplace
-**Version:** 2.2.0
+**Version:** 2.3.0
 **Status:** Production Ready
 
 A Claude Code plugin marketplace containing:
 
 | Plugin | Description | Version |
 |--------|-------------|---------|
-| `projman` | Sprint planning and project management with Gitea integration | 2.2.0 |
+| `projman` | Sprint planning and project management with Gitea integration | 2.3.0 |
+| `doc-guardian` | Automatic documentation drift detection and synchronization | 1.0.0 |
+| `code-sentinel` | Security scanning and code refactoring tools | 1.0.0 |
 | `claude-config-maintainer` | CLAUDE.md optimization and maintenance | 1.0.0 |
 | `cmdb-assistant` | NetBox CMDB integration for infrastructure management | 1.0.0 |
 | `project-hygiene` | Post-task cleanup automation via hooks | 0.1.0 |
@@ -38,24 +40,36 @@ support-claude-mktplace/
 ├── .claude-plugin/
 │   └── marketplace.json          # Marketplace manifest
 ├── plugins/
-│   ├── projman/                  # Sprint management (v2.2.0)
+│   ├── projman/                  # Sprint management
 │   │   ├── .claude-plugin/plugin.json
 │   │   ├── .mcp.json
 │   │   ├── mcp-servers/gitea/    # Bundled MCP server
-│   │   ├── commands/             # 8 commands
+│   │   ├── commands/             # 9 commands
 │   │   │   ├── sprint-plan.md, sprint-start.md, sprint-status.md
 │   │   │   ├── sprint-close.md, labels-sync.md, initial-setup.md
-│   │   │   ├── review.md, test-check.md    # NEW in v2.2.0
+│   │   │   └── review.md, test-check.md, test-gen.md
 │   │   ├── agents/               # 4 agents
 │   │   │   ├── planner.md, orchestrator.md, executor.md
-│   │   │   └── code-reviewer.md            # NEW in v2.2.0
+│   │   │   └── code-reviewer.md
 │   │   └── skills/label-taxonomy/
+│   ├── doc-guardian/             # Documentation drift detection
+│   │   ├── .claude-plugin/plugin.json
+│   │   ├── hooks/hooks.json      # PostToolUse, Stop hooks
+│   │   ├── commands/             # doc-audit.md, doc-sync.md
+│   │   ├── agents/               # doc-analyzer.md
+│   │   └── skills/doc-patterns/
+│   ├── code-sentinel/            # Security scanning & refactoring
+│   │   ├── .claude-plugin/plugin.json
+│   │   ├── hooks/hooks.json      # PreToolUse hook
+│   │   ├── commands/             # security-scan.md, refactor.md, refactor-dry.md
+│   │   ├── agents/               # security-reviewer.md, refactor-advisor.md
+│   │   └── skills/security-patterns/
 │   ├── claude-config-maintainer/
 │   ├── cmdb-assistant/
 │   └── project-hygiene/
 ├── scripts/
 │   ├── setup.sh, post-update.sh
-│   └── validate-marketplace.sh   # NEW in v2.2.0
+│   └── validate-marketplace.sh   # Marketplace compliance validation
 └── docs/
     ├── CANONICAL-PATHS.md        # Single source of truth for paths
     └── references/
@@ -88,7 +102,7 @@ support-claude-mktplace/
 
 ## Architecture
 
-### Four-Agent Model (projman v2.2.0)
+### Four-Agent Model
 
 | Agent | Personality | Responsibilities |
 |-------|-------------|------------------|
@@ -181,15 +195,36 @@ Stored in Gitea Wiki under `lessons-learned/sprints/`.
 | `plugins/projman/CONFIGURATION.md` | Projman setup guide |
 | `plugins/projman/README.md` | Projman full documentation |
 
-## Version History
+## Versioning and Changelog Rules
 
-| Version | Date | Highlights |
+### Version Display
-|---------|------|------------|
+**The marketplace version is displayed ONLY in the main `README.md` title.**
-| 2.2.0 | 2026-01-20 | `/review`, `/test-check` commands, code-reviewer agent, validation script, marketplace compliance |
+
-| 2.1.0 | Previous | Canonical paths, initial-setup command, documentation improvements |
+- Format: `# Claude Code Marketplace - vX.Y.Z`
-| 2.0.0 | Previous | Full Gitea integration, wiki, milestones, dependencies, parallel execution |
+- Do NOT add version numbers to individual plugin documentation titles
-| 0.1.0 | Initial | Basic plugin structure |
+- Do NOT add version numbers to configuration guides
+- Do NOT add version numbers to CLAUDE.md or other docs
+
+### Changelog Maintenance (MANDATORY)
+**`CHANGELOG.md` is the authoritative source for version history.**
+
+When releasing a new version:
+1. Update main `README.md` title with new version
+2. Update `CHANGELOG.md` with:
+   - Version number and date: `## [X.Y.Z] - YYYY-MM-DD`
+   - **Added**: New features, commands, files
+   - **Changed**: Modifications to existing functionality
+   - **Fixed**: Bug fixes
+   - **Removed**: Deleted features, files, deprecated items
+3. Update `marketplace.json` metadata version
+4. Update plugin `plugin.json` versions if plugin-specific changes
+
+### Version Format
+- Follow [Semantic Versioning](https://semver.org/): MAJOR.MINOR.PATCH
+- MAJOR: Breaking changes
+- MINOR: New features, backward compatible
+- PATCH: Bug fixes, minor improvements
 
 ---
 
-**Last Updated:** 2026-01-20 | **Current Version:** 2.2.0
+**Last Updated:** 2026-01-20

README.md

@@ -1,10 +1,10 @@
-# Claude Code Marketplace
+# Claude Code Marketplace - v2.3.0
 
 A collection of Claude Code plugins for project management, infrastructure automation, and development workflows.
 
 ## Plugins
 
-### [projman](./plugins/projman/README.md) v2.2.0
+### [projman](./plugins/projman/README.md)
 **Sprint Planning and Project Management**
 
 AI-guided sprint planning with full Gitea integration. Transforms a proven 15-sprint workflow into a distributable plugin.
@@ -17,7 +17,7 @@ AI-guided sprint planning with full Gitea integration. Transforms a proven 15-sp
 - Branch-aware security (development/staging/production)
 - Pre-sprint-close code quality review and test verification
 
-**Commands:** `/sprint-plan`, `/sprint-start`, `/sprint-status`, `/sprint-close`, `/labels-sync`, `/initial-setup`, `/review`, `/test-check`
+**Commands:** `/sprint-plan`, `/sprint-start`, `/sprint-status`, `/sprint-close`, `/labels-sync`, `/initial-setup`, `/review`, `/test-check`, `/test-gen`
 
 ### [claude-config-maintainer](./plugins/claude-config-maintainer/README.md)
 **CLAUDE.md Optimization and Maintenance**
@@ -53,6 +53,28 @@ Hook-based cleanup that runs after Claude completes work.
 - Identifies orphaned supporting files
 - Configurable via `.hygiene.json`
 
+### [doc-guardian](./plugins/doc-guardian/README.md)
+**Documentation Lifecycle Management**
+
+Automatic documentation drift detection and synchronization. Eliminates manual doc update cycles.
+
+- PostToolUse hook detects when code changes affect documentation
+- Stop hook reminds of pending updates before session ends
+- Batched updates in single commit
+
+**Commands:** `/doc-audit`, `/doc-sync`
+
+### [code-sentinel](./plugins/code-sentinel/README.md)
+**Security Scanning & Refactoring**
+
+Security vulnerability detection and code refactoring tools.
+
+- PreToolUse hook catches security issues before code is written
+- Pattern library: SQL injection, XSS, command injection, hardcoded secrets
+- Refactoring patterns: extract method, simplify conditional, modernize syntax
+
+**Commands:** `/security-scan`, `/refactor`, `/refactor-dry`
+
 ## MCP Servers
 
 MCP servers are **bundled inside each plugin** that needs them. This ensures plugins work when cached by Claude Code.
@@ -204,7 +226,9 @@ support-claude-mktplace/
 │   │   ├── commands/
 │   │   └── agents/
 │   ├── projman-pmo/               # PMO coordination plugin (planned)
-│   └── project-hygiene/           # Cleanup automation plugin
+│   ├── project-hygiene/           # Cleanup automation plugin
+│   ├── doc-guardian/              # Documentation drift detection
+│   └── code-sentinel/             # Security scanning & refactoring
 ├── docs/                          # Reference documentation
 │   ├── CANONICAL-PATHS.md         # Single source of truth for paths
 │   └── references/
@@ -212,7 +236,7 @@ support-claude-mktplace/
     └── validate-marketplace.sh    # Marketplace compliance validation
 ```
 
-## Key Features (v2.2.0)
+## Key Features
 
 ### Parallel Execution
 Tasks are batched by dependency graph for optimal parallel execution:

docs/CANONICAL-PATHS.md

@@ -29,8 +29,21 @@ support-claude-mktplace/
 │   │   ├── agents/
 │   │   ├── skills/
 │   │   └── claude-md-integration.md  # CLAUDE.md integration snippet
+│   ├── doc-guardian/           # Documentation drift detection
+│   │   ├── .claude-plugin/
+│   │   ├── hooks/              # PostToolUse, Stop hooks
+│   │   ├── commands/
+│   │   ├── agents/
+│   │   ├── skills/
+│   │   └── claude-md-integration.md
+│   ├── code-sentinel/          # Security scanning & refactoring
+│   │   ├── .claude-plugin/
+│   │   ├── hooks/              # PreToolUse hook
+│   │   ├── commands/
+│   │   ├── agents/
+│   │   ├── skills/
+│   │   └── claude-md-integration.md
 │   ├── projman-pmo/
-│   ├── project-hygiene/
 │   ├── cmdb-assistant/
 │   │   ├── .claude-plugin/
 │   │   ├── mcp-servers/        # MCP servers bundled IN plugin

docs/architecture/agent-workflow.spec.md

@@ -2,7 +2,7 @@
 
 **Target File:** `docs/architecture/agent-workflow.drawio`
 
-**Purpose:** Shows when Planner, Orchestrator, and Executor agents trigger during sprint lifecycle.
+**Purpose:** Shows when Planner, Orchestrator, Executor, and Code Reviewer agents trigger during sprint lifecycle.
 
 **Diagram Type:** Swimlane / Sequence Diagram
 
@@ -16,8 +16,8 @@
 | planner-lane | Planner Agent | #4A90D9 | 2 |
 | orchestrator-lane | Orchestrator Agent | #7CB342 | 3 |
 | executor-lane | Executor Agent | #FF9800 | 4 |
-| gitea-lane | Gitea | #9E9E9E | 5 |
+| reviewer-lane | Code Reviewer Agent | #9C27B0 | 5 |
-| wikijs-lane | Wiki.js | #9E9E9E | 6 (rightmost) |
+| gitea-lane | Gitea (Issues + Wiki) | #9E9E9E | 6 (rightmost) |
 
 ---
 
@@ -30,7 +30,7 @@
 | p1-start | /sprint-plan | rounded-rect | user-lane | 1 |
 | p1-activate | Planner Activates | rectangle | planner-lane | 2 |
 | p1-search-lessons | Search Lessons Learned | rectangle | planner-lane | 3 |
-| p1-wikijs-query | Query Past Lessons | rectangle | wikijs-lane | 4 |
+| p1-gitea-wiki-query | Query Past Lessons (Wiki) | rectangle | gitea-lane | 4 |
 | p1-return-lessons | Return Relevant Lessons | rectangle | planner-lane | 5 |
 | p1-clarify | Ask Clarifying Questions | diamond | planner-lane | 6 |
 | p1-user-answers | Provide Answers | rectangle | user-lane | 7 |
@@ -44,8 +44,8 @@
 |------|----|-------|-------|
 | p1-start | p1-activate | invokes | solid |
 | p1-activate | p1-search-lessons | | solid |
-| p1-search-lessons | p1-wikijs-query | GraphQL search | solid |
+| p1-search-lessons | p1-gitea-wiki-query | REST API (search_lessons) | solid |
-| p1-wikijs-query | p1-return-lessons | lessons data | dashed |
+| p1-gitea-wiki-query | p1-return-lessons | lessons data | dashed |
 | p1-return-lessons | p1-clarify | | solid |
 | p1-clarify | p1-user-answers | questions | solid |
 | p1-user-answers | p1-clarify | answers | dashed |
@@ -65,7 +65,7 @@
 | p2-orch-activate | Orchestrator Activates | rectangle | orchestrator-lane | 12 |
 | p2-fetch-issues | Fetch Sprint Issues | rectangle | orchestrator-lane | 13 |
 | p2-gitea-list | List Open Issues | rectangle | gitea-lane | 14 |
-| p2-sequence | Sequence Work | rectangle | orchestrator-lane | 15 |
+| p2-sequence | Sequence Work (Dependencies) | rectangle | orchestrator-lane | 15 |
 | p2-dispatch | Dispatch Task | rectangle | orchestrator-lane | 16 |
 | p2-exec-activate | Executor Activates | rectangle | executor-lane | 17 |
 | p2-implement | Implement Task | rectangle | executor-lane | 18 |
@@ -83,7 +83,7 @@
 | p2-orch-activate | p2-fetch-issues | | solid |
 | p2-fetch-issues | p2-gitea-list | REST API | solid |
 | p2-gitea-list | p2-sequence | issues data | dashed |
-| p2-sequence | p2-dispatch | | solid |
+| p2-sequence | p2-dispatch | parallel batching | solid |
 | p2-dispatch | p2-exec-activate | execution prompt | solid |
 | p2-exec-activate | p2-implement | | solid |
 | p2-implement | p2-update-status | | solid |
@@ -95,23 +95,50 @@
 
 ---
 
+## PHASE 2.5: CODE REVIEW (Pre-Close)
+
+### Nodes
+
+| ID | Label | Type | Lane | Sequence |
+|----|-------|------|------|----------|
+| p25-start | /review | rounded-rect | user-lane | 24 |
+| p25-reviewer-activate | Code Reviewer Activates | rectangle | reviewer-lane | 25 |
+| p25-scan-changes | Scan Recent Changes | rectangle | reviewer-lane | 26 |
+| p25-check-quality | Check Code Quality | rectangle | reviewer-lane | 27 |
+| p25-security-scan | Security Scan | rectangle | reviewer-lane | 28 |
+| p25-report | Generate Review Report | rectangle | reviewer-lane | 29 |
+| p25-complete | Review Complete | rounded-rect | reviewer-lane | 30 |
+
+### Edges
+
+| From | To | Label | Style |
+|------|----|-------|-------|
+| p25-start | p25-reviewer-activate | invokes | solid |
+| p25-reviewer-activate | p25-scan-changes | | solid |
+| p25-scan-changes | p25-check-quality | | solid |
+| p25-check-quality | p25-security-scan | | solid |
+| p25-security-scan | p25-report | | solid |
+| p25-report | p25-complete | | solid |
+
+---
+
 ## PHASE 3: SPRINT CLOSE
 
 ### Nodes
 
 | ID | Label | Type | Lane | Sequence |
 |----|-------|------|------|----------|
-| p3-start | /sprint-close | rounded-rect | user-lane | 24 |
+| p3-start | /sprint-close | rounded-rect | user-lane | 31 |
-| p3-orch-activate | Orchestrator Activates | rectangle | orchestrator-lane | 25 |
+| p3-orch-activate | Orchestrator Activates | rectangle | orchestrator-lane | 32 |
-| p3-review | Review Sprint | rectangle | orchestrator-lane | 26 |
+| p3-review | Review Sprint | rectangle | orchestrator-lane | 33 |
-| p3-gitea-status | Get Final Status | rectangle | gitea-lane | 27 |
+| p3-gitea-status | Get Final Status | rectangle | gitea-lane | 34 |
-| p3-capture | Capture Lessons Learned | rectangle | orchestrator-lane | 28 |
+| p3-capture | Capture Lessons Learned | rectangle | orchestrator-lane | 35 |
-| p3-user-input | Confirm Lessons | diamond | user-lane | 29 |
+| p3-user-input | Confirm Lessons | diamond | user-lane | 36 |
-| p3-create-wiki | Create Wiki Pages | rectangle | orchestrator-lane | 30 |
+| p3-create-wiki | Create Wiki Pages | rectangle | orchestrator-lane | 37 |
-| p3-wikijs-create | Store Lessons | rectangle | wikijs-lane | 31 |
+| p3-gitea-wiki-create | Store Lessons (Wiki) | rectangle | gitea-lane | 38 |
-| p3-close-issues | Close Issues | rectangle | orchestrator-lane | 32 |
+| p3-close-issues | Close Issues | rectangle | orchestrator-lane | 39 |
-| p3-gitea-close | Mark Closed | rectangle | gitea-lane | 33 |
+| p3-gitea-close | Mark Closed | rectangle | gitea-lane | 40 |
-| p3-complete | Sprint Closed | rounded-rect | orchestrator-lane | 34 |
+| p3-complete | Sprint Closed | rounded-rect | orchestrator-lane | 41 |
 
 ### Edges
 
@@ -123,8 +150,8 @@
 | p3-gitea-status | p3-capture | status data | dashed |
 | p3-capture | p3-user-input | proposed lessons | solid |
 | p3-user-input | p3-create-wiki | confirmed | solid |
-| p3-create-wiki | p3-wikijs-create | GraphQL mutation | solid |
+| p3-create-wiki | p3-gitea-wiki-create | REST API (create_lesson) | solid |
-| p3-wikijs-create | p3-close-issues | confirm | dashed |
+| p3-gitea-wiki-create | p3-close-issues | confirm | dashed |
 | p3-close-issues | p3-gitea-close | REST API | solid |
 | p3-gitea-close | p3-complete | confirm | dashed |
 
@@ -133,59 +160,71 @@
 ## LAYOUT NOTES
 
 ```
-+--------+------------+---------------+------------+--------+----------+
++--------+------------+---------------+------------+----------+------------------+
-|  User  |  Planner   | Orchestrator  |  Executor  | Gitea  | Wiki.js  |
+|  User  |  Planner   | Orchestrator  |  Executor  | Reviewer | Gitea            |
-+--------+------------+---------------+------------+--------+----------+
+|        |            |               |            |          | (Issues + Wiki)  |
-|        |            |               |            |        |          |
++--------+------------+---------------+------------+----------+------------------+
-| PHASE 1: SPRINT PLANNING                                             |
+|        |            |               |            |          |                  |
-|---------------------------------------------------------------------+
+| PHASE 1: SPRINT PLANNING                                                       |
-|  O     |            |               |            |        |          |
+|-------------------------------------------------------------------------------|
-|  |     |            |               |            |        |          |
+|  O     |            |               |            |          |                  |
-|  +---->| O          |               |            |        |          |
+|  |     |            |               |            |          |                  |
-|        | |          |               |            |        |          |
+|  +---->| O          |               |            |          |                  |
-|        | +----------|---------------|------------|------->| O        |
+|        | |          |               |            |          |                  |
-|        | |<---------|---------------|------------|--------+ |        |
+|        | +----------|---------------|------------|--------->| O (Wiki Query)   |
-|        | |          |               |            |        |          |
+|        | |<---------|---------------|------------|----------+ |                |
-|        | O<>        |               |            |        |          |
+|        | |          |               |            |          |                  |
-|  O<--->+ |          |               |            |        |          |
+|        | O<>        |               |            |          |                  |
-|        | |          |               |            |        |          |
+|  O<--->+ |          |               |            |          |                  |
-|        | +----------|---------------|----------->| O      |          |
+|        | |          |               |            |          |                  |
-|        | O          |               |            |        |          |
+|        | +----------|---------------|------------|--------->| O (Issues)       |
-|        |            |               |            |        |          |
+|        | O          |               |            |          |                  |
-|---------------------------------------------------------------------+
+|        |            |               |            |          |                  |
-| PHASE 2: SPRINT EXECUTION                                            |
+|-------------------------------------------------------------------------------|
-|---------------------------------------------------------------------+
+| PHASE 2: SPRINT EXECUTION                                                      |
-|  O     |            |               |            |        |          |
+|-------------------------------------------------------------------------------|
-|  |     |            |               |            |        |          |
+|  O     |            |               |            |          |                  |
-|  +-----|----------->| O             |            |        |          |
+|  |     |            |               |            |          |                  |
-|        |            | |             |            |        |          |
+|  +-----|----------->| O             |            |          |                  |
-|        |            | +-------------|----------->| O      |          |
+|        |            | |             |            |          |                  |
-|        |            | |<------------|------------+ |      |          |
+|        |            | +-------------|------------|--------->| O (Issues)       |
-|        |            | |             |            |        |          |
+|        |            | |<------------|------------|----------+ |                |
-|        |            | +------------>| O          |        |          |
+|        |            | |             |            |          |                  |
-|        |            |               | |          |        |          |
+|        |            | +------------>| O          |          |                  |
-|        |            |               | +--------->| O      |          |
+|        |            |               | |          |          |                  |
-|        |            |               | |<---------+ |      |          |
+|        |            |               | +----------|--------->| O (Issues)       |
-|        |            | O<------------+ |          |        |          |
+|        |            |               | |<---------|----------+ |                |
-|        |            | |             |            |        |          |
+|        |            | O<------------+ |          |          |                  |
-|        |            | O (loop)      |            |        |          |
+|        |            | |             |            |          |                  |
-|        |            |               |            |        |          |
+|        |            | O (loop)      |            |          |                  |
-|---------------------------------------------------------------------+
+|        |            |               |            |          |                  |
-| PHASE 3: SPRINT CLOSE                                                |
+|-------------------------------------------------------------------------------|
-|---------------------------------------------------------------------+
+| PHASE 2.5: CODE REVIEW                                                         |
-|  O     |            |               |            |        |          |
+|-------------------------------------------------------------------------------|
-|  |     |            |               |            |        |          |
+|  O     |            |               |            |          |                  |
-|  +-----|----------->| O             |            |        |          |
+|  |     |            |               |            |          |                  |
-|        |            | +-------------|----------->| O      |          |
+|  +-----|------------|---------------|----------->| O        |                  |
-|        |            | |<------------|------------+ |      |          |
+|        |            |               |            | |        |                  |
-|        |            | |             |            |        |          |
+|        |            |               |            | O->O->O  |                  |
-|  O<----|-----------<+ |             |            |        |          |
+|        |            |               |            | |        |                  |
-|  +-----|----------->| |             |            |        |          |
+|        |            |               |            | O        |                  |
-|        |            | +-------------|------------|------->| O        |
+|        |            |               |            |          |                  |
-|        |            | |<------------|------------|--------+ |        |
+|-------------------------------------------------------------------------------|
-|        |            | +-------------|----------->| O      |          |
+| PHASE 3: SPRINT CLOSE                                                          |
-|        |            | O             |            |        |          |
+|-------------------------------------------------------------------------------|
-+--------+------------+---------------+------------+--------+----------+
+|  O     |            |               |            |          |                  |
+|  |     |            |               |            |          |                  |
+|  +-----|----------->| O             |            |          |                  |
+|        |            | +-------------|------------|--------->| O (Issues)       |
+|        |            | |<------------|------------|----------+ |                |
+|        |            | |             |            |          |                  |
+|  O<----|-----------<+ |             |            |          |                  |
+|  +-----|----------->| |             |            |          |                  |
+|        |            | +-------------|------------|--------->| O (Wiki Create)  |
+|        |            | |<------------|------------|----------+ |                |
+|        |            | +-------------|------------|--------->| O (Issues Close) |
+|        |            | O             |            |          |                  |
++--------+------------+---------------+------------+----------+------------------+
 ```
 
 ---
@@ -198,7 +237,8 @@
 | Blue | #4A90D9 | Planner Agent |
 | Green | #7CB342 | Orchestrator Agent |
 | Orange | #FF9800 | Executor Agent |
-| Gray | #9E9E9E | External Services |
+| Purple | #9C27B0 | Code Reviewer Agent |
+| Gray | #9E9E9E | External Services (Gitea) |
 
 ---
 
@@ -219,3 +259,13 @@
 |-------|---------|
 | Solid | Action/Request |
 | Dashed | Response/Data return |
+
+---
+
+## ARCHITECTURE NOTES
+
+- **Gitea provides BOTH issue tracking AND wiki** (no separate wiki service)
+- All wiki operations use Gitea REST API via MCP tools
+- Lessons learned stored in Gitea Wiki under `lessons-learned/sprints/`
+- MCP tools: `search_lessons`, `create_lesson`, `list_wiki_pages`, `get_wiki_page`
+- Four-agent model: Planner, Orchestrator, Executor, Code Reviewer

docs/architecture/component-map.spec.md

@@ -13,22 +13,26 @@
 | ID | Label | Type | Color | Position |
 |----|-------|------|-------|----------|
 | projman | projman | rectangle | #4A90D9 | top-center |
-| projman-pmo | projman-pmo | rectangle | #4A90D9 | top-right |
+| projman-pmo | projman-pmo (planned) | rectangle | #4A90D9 | top-right |
 | project-hygiene | project-hygiene | rectangle | #4A90D9 | top-left |
+| claude-config | claude-config-maintainer | rectangle | #4A90D9 | bottom-left |
+| cmdb-assistant | cmdb-assistant | rectangle | #4A90D9 | bottom-right |
 
 ### MCP Servers (Green - #7CB342)
 
-| ID | Label | Type | Color | Position |
+MCP servers are **bundled inside each plugin** that needs them.
-|----|-------|------|-------|----------|
+
-| gitea-mcp | Gitea MCP Server | rectangle | #7CB342 | middle-left |
+| ID | Label | Type | Color | Position | Bundled In |
-| wikijs-mcp | Wiki.js MCP Server | rectangle | #7CB342 | middle-right |
+|----|-------|------|-------|----------|------------|
+| gitea-mcp | Gitea MCP Server | rectangle | #7CB342 | middle-left | projman |
+| netbox-mcp | NetBox MCP Server | rectangle | #7CB342 | middle-right | cmdb-assistant |
 
 ### External Systems (Gray - #9E9E9E)
 
 | ID | Label | Type | Color | Position |
 |----|-------|------|-------|----------|
-| gitea-instance | Gitea\ngitea.hotserv.cloud | cylinder | #9E9E9E | bottom-left |
+| gitea-instance | Gitea\n(Issues + Wiki) | cylinder | #9E9E9E | bottom-left |
-| wikijs-instance | Wiki.js\nwikijs.hotserv.cloud | cylinder | #9E9E9E | bottom-right |
+| netbox-instance | NetBox | cylinder | #9E9E9E | bottom-right |
 
 ### Configuration (Orange - #FF9800)
 
@@ -45,10 +49,8 @@
 
 | From | To | Label | Style | Arrow |
 |------|----|-------|-------|-------|
-| projman | gitea-mcp | uses | solid | forward |
+| projman | gitea-mcp | bundled | solid | bidirectional |
-| projman | wikijs-mcp | uses | solid | forward |
+| cmdb-assistant | netbox-mcp | bundled | solid | bidirectional |
-| projman-pmo | gitea-mcp | uses (company-wide) | solid | forward |
-| projman-pmo | wikijs-mcp | uses (company-wide) | solid | forward |
 
 ### Plugin Dependencies
 
@@ -61,16 +63,16 @@
 | From | To | Label | Style | Arrow |
 |------|----|-------|-------|-------|
 | gitea-mcp | gitea-instance | REST API | solid | forward |
-| wikijs-mcp | wikijs-instance | GraphQL | solid | forward |
+| netbox-mcp | netbox-instance | REST API | solid | forward |
 
 ### Configuration Connections
 
 | From | To | Label | Style | Arrow |
 |------|----|-------|-------|-------|
 | system-config | gitea-mcp | credentials | dashed | forward |
-| system-config | wikijs-mcp | credentials | dashed | forward |
+| system-config | netbox-mcp | credentials | dashed | forward |
 | project-config | gitea-mcp | repo context | dashed | forward |
-| project-config | wikijs-mcp | project path | dashed | forward |
+| project-config | netbox-mcp | site context | dashed | forward |
 
 ---
 
@@ -78,9 +80,8 @@
 
 | ID | Label | Contains | Style |
 |----|-------|----------|-------|
-| plugins-group | Plugins | projman, projman-pmo, project-hygiene | light blue border |
+| plugins-group | Plugins | projman, projman-pmo, project-hygiene, claude-config, cmdb-assistant | light blue border |
-| mcp-group | Shared MCP Servers | gitea-mcp, wikijs-mcp | light green border |
+| external-group | External Services | gitea-instance, netbox-instance | light gray border |
-| external-group | External Services | gitea-instance, wikijs-instance | light gray border |
 | config-group | Configuration | system-config, project-config | light orange border |
 
 ---
@@ -92,25 +93,21 @@
 |                         PLUGINS GROUP                             |
 |  +----------------+  +----------------+  +-------------------+    |
 |  | project-       |  |    projman     |  |   projman-pmo    |    |
-|  | hygiene        |  |                |  |                   |    |
+|  | hygiene        |  |  [gitea-mcp]   |  |    (planned)      |    |
-|  +----------------+  +-------+--------+  +--------+----------+    |
+|  +----------------+  +-------+--------+  +-------------------+    |
-|                              |                    |               |
+|                              |                                    |
+|  +----------------+  +-------------------+                        |
+|  | claude-config  |  |  cmdb-assistant   |                        |
+|  | -maintainer    |  |   [netbox-mcp]    |                        |
+|  +----------------+  +--------+----------+                        |
 +------------------------------------------------------------------+
-                               |                    |
+                               |
-                               v                    v
+                               v
-+------------------------------------------------------------------+
-|                      MCP SERVERS GROUP                            |
-|  +-------------------+              +-------------------+         |
-|  |  Gitea MCP Server |              | Wiki.js MCP Server|         |
-|  +--------+----------+              +---------+---------+         |
-+------------------------------------------------------------------+
-           |                                     |
-           v                                     v
 +------------------------------------------------------------------+
 |                    EXTERNAL SERVICES GROUP                        |
 |  +-------------------+              +-------------------+         |
-|  |      Gitea        |              |     Wiki.js       |         |
+|  |      Gitea        |              |     NetBox        |         |
-|  | gitea.hotserv.cloud              | wikijs.hotserv.cloud        |
+|  |  (Issues + Wiki)  |              |                   |         |
 |  +-------------------+              +-------------------+         |
 +------------------------------------------------------------------+
 
@@ -128,6 +125,15 @@ CONFIG GROUP (left side):           CONFIG GROUP (right side):
 | Color | Hex | Meaning |
 |-------|-----|---------|
 | Blue | #4A90D9 | Plugins |
-| Green | #7CB342 | MCP Servers |
+| Green | #7CB342 | MCP Servers (bundled in plugins) |
 | Gray | #9E9E9E | External Systems |
 | Orange | #FF9800 | Configuration |
+
+---
+
+## ARCHITECTURE NOTES
+
+- MCP servers are **bundled inside plugins** (not shared at root)
+- Gitea provides both issue tracking AND wiki (lessons learned)
+- No separate Wiki.js - all wiki functionality uses Gitea Wiki
+- Each plugin is self-contained for Claude Code caching

plugins/code-sentinel/.claude-plugin/plugin.json

@@ -0,0 +1,13 @@
+{
+  "name": "code-sentinel",
+  "description": "Security scanning and code refactoring tools",
+  "version": "1.0.0",
+  "author": {
+    "name": "Leo Miranda",
+    "email": "leobmiranda@gmail.com"
+  },
+  "homepage": "https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace/src/branch/main/plugins/code-sentinel/README.md",
+  "repository": "https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace.git",
+  "license": "MIT",
+  "keywords": ["security", "refactoring", "code-quality", "static-analysis", "hooks"]
+}

plugins/code-sentinel/README.md

@@ -0,0 +1,47 @@
+# code-sentinel
+
+Security scanning and code refactoring tools for Claude Code projects.
+
+## Features
+
+### Security Scanning
+- **PreToolUse Hook**: Catches vulnerabilities BEFORE code is written
+- **Full Audit**: `/security-scan` for comprehensive project review
+- **Pattern Detection**: SQL injection, XSS, command injection, secrets, and more
+
+### Refactoring
+- **Pattern Library**: Extract method, simplify conditionals, modernize syntax
+- **Safe Transforms**: Preview changes before applying
+- **Reference Updates**: Automatically updates all call sites
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `/security-scan` | Full project security audit |
+| `/refactor <target>` | Apply refactoring with pattern |
+| `/refactor-dry <target>` | Preview opportunities without changes |
+
+## Hooks
+
+- **PreToolUse (Write\|Edit)**: Scans code for security patterns before writing
+
+## Security Patterns Detected
+
+| Category | Examples |
+|----------|----------|
+| Injection | SQL, Command, Code (eval), XSS |
+| Secrets | Hardcoded API keys, passwords |
+| Deserialization | Pickle, unsafe YAML |
+| Path Traversal | Unsanitized file paths |
+
+## Installation
+
+```bash
+/plugin marketplace add https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace.git
+/plugin install code-sentinel
+```
+
+## Integration
+
+See claude-md-integration.md for CLAUDE.md additions.

plugins/code-sentinel/agents/refactor-advisor.md

@@ -0,0 +1,48 @@
+---
+description: Code structure and refactoring specialist
+---
+
+# Refactor Advisor Agent
+
+You are a software architect specializing in code quality, design patterns, and refactoring.
+
+## Expertise
+
+- Martin Fowler's refactoring catalog
+- SOLID principles
+- Design patterns (GoF, enterprise, functional)
+- Code smells detection
+- Cyclomatic complexity analysis
+- Technical debt assessment
+
+## Analysis Approach
+
+When analyzing code:
+
+1. **Identify Code Smells**
+   - Long methods (>20 lines)
+   - Large classes (>200 lines)
+   - Long parameter lists (>3 params)
+   - Duplicate code
+   - Feature envy
+   - Data clumps
+
+2. **Assess Structure**
+   - Single responsibility adherence
+   - Coupling between modules
+   - Cohesion within modules
+   - Abstraction levels
+
+3. **Recommend Refactorings**
+   - Match smells to appropriate refactorings
+   - Consider dependencies and side effects
+   - Prioritize by impact and risk
+   - Provide step-by-step approach
+
+## Output Style
+
+Be practical:
+- Focus on high-impact improvements
+- Explain the "why" behind recommendations
+- Provide concrete before/after examples
+- Consider testing implications

plugins/code-sentinel/agents/security-reviewer.md

@@ -0,0 +1,50 @@
+---
+description: Security-focused code review agent
+---
+
+# Security Reviewer Agent
+
+You are a security engineer specializing in application security and secure coding practices.
+
+## Expertise
+
+- OWASP Top 10 vulnerabilities
+- Language-specific security pitfalls (Python, JavaScript, Go, etc.)
+- Authentication and authorization flaws
+- Cryptographic misuse
+- Input validation and output encoding
+- Secure configuration
+
+## Review Approach
+
+When reviewing code:
+
+1. **Identify Trust Boundaries**
+   - Where does user input enter?
+   - Where does data leave the system?
+   - What operations are privileged?
+
+2. **Trace Data Flow**
+   - Follow user input through the code
+   - Check for sanitization at each boundary
+   - Verify output encoding
+
+3. **Check Security Controls**
+   - Authentication present where needed?
+   - Authorization checked before actions?
+   - Secrets properly managed?
+   - Errors handled without leaking info?
+
+4. **Language-Specific Checks**
+   Python: eval, pickle, yaml.load, subprocess
+   JavaScript: innerHTML, eval, prototype pollution
+   SQL: parameterized queries, ORM usage
+   Shell: quoting, input validation
+
+## Output Style
+
+Be specific and actionable:
+- Quote the vulnerable line
+- Explain the attack vector
+- Provide the secure alternative
+- Rate severity (Critical/High/Medium/Low)

plugins/code-sentinel/claude-md-integration.md

@@ -0,0 +1,26 @@
+# Code Sentinel Integration
+
+Add to your project's CLAUDE.md:
+
+## Security & Code Quality
+
+This project uses code-sentinel for security scanning and refactoring.
+
+### Automatic Security Checks
+PreToolUse hooks scan all code changes for:
+- SQL/Command/Code injection
+- XSS vulnerabilities
+- Hardcoded secrets
+- Unsafe deserialization
+
+Critical issues are blocked. Warnings are noted but allowed.
+
+### Commands
+- `/security-scan` - Full project security audit
+- `/refactor <target>` - Apply refactoring pattern
+- `/refactor-dry <target>` - Preview refactoring opportunities
+
+### Severity Levels
+- 🔴 Critical: Must fix immediately
+- 🟠 High: Fix before release
+- 🟡 Medium: Improve when possible

plugins/code-sentinel/commands/refactor-dry.md

@@ -0,0 +1,57 @@
+---
+description: Preview refactoring changes without applying them
+---
+
+# Refactor Dry Run
+
+Analyze and preview refactoring opportunities without making changes.
+
+## Usage
+```
+/refactor-dry <target> [--all]
+```
+
+**Target:** File path, function name, or "." for current file
+**--all:** Show all opportunities, not just recommended
+
+## Process
+
+1. **Scan Target**
+   Analyze code for refactoring opportunities.
+
+2. **Score Opportunities**
+   Each opportunity rated by:
+   - Impact (how much it improves code)
+   - Risk (likelihood of breaking something)
+   - Effort (complexity of the refactoring)
+
+3. **Output**
+```
+## Refactoring Opportunities: src/handlers.py
+
+### Recommended (High Impact, Low Risk)
+
+1. **extract-method** at lines 45-67
+   - Extract order validation logic
+   - Impact: High (reduces complexity from 12 to 4)
+   - Risk: Low (pure function, no side effects)
+   - Run: `/refactor src/handlers.py:45 --pattern=extract-method`
+
+2. **use-dataclass** for OrderInput class
+   - Convert to dataclass with validation
+   - Impact: Medium (reduces boilerplate)
+   - Risk: Low
+   - Run: `/refactor src/models.py:OrderInput --pattern=use-dataclass`
+
+### Optional (Consider Later)
+
+3. **use-fstring** at 12 locations
+   - Modernize string formatting
+   - Impact: Low (readability only)
+   - Risk: None
+
+### Summary
+- 2 recommended refactorings
+- 1 optional improvement
+- Estimated complexity reduction: 35%
+```

plugins/code-sentinel/commands/refactor.md

@@ -0,0 +1,81 @@
+---
+description: Apply refactoring patterns to improve code structure and maintainability
+---
+
+# Refactor
+
+Apply refactoring transformations to specified code.
+
+## Usage
+```
+/refactor <target> [--pattern=<pattern>]
+```
+
+**Target:** File path, function name, or "." for current context
+**Pattern:** Specific refactoring pattern (optional)
+
+## Available Patterns
+
+### Structure
+| Pattern | Description |
+|---------|-------------|
+| `extract-method` | Extract code block into named function |
+| `extract-class` | Move related methods to new class |
+| `inline` | Inline trivial function/variable |
+| `rename` | Rename with all references updated |
+| `move` | Move function/class to different module |
+
+### Simplification
+| Pattern | Description |
+|---------|-------------|
+| `simplify-conditional` | Flatten nested if/else |
+| `remove-dead-code` | Delete unreachable code |
+| `consolidate-duplicate` | Merge duplicate code blocks |
+| `decompose-conditional` | Break complex conditions into named parts |
+
+### Modernization
+| Pattern | Description |
+|---------|-------------|
+| `use-comprehension` | Convert loops to list/dict comprehensions |
+| `use-pathlib` | Replace os.path with pathlib |
+| `use-fstring` | Convert .format() to f-strings |
+| `use-typing` | Add type hints |
+| `use-dataclass` | Convert class to dataclass |
+
+## Process
+
+1. **Analyze Target**
+   - Parse code structure
+   - Identify refactoring opportunities
+   - Check for side effects and dependencies
+
+2. **Propose Changes**
+   - Show before/after diff
+   - Explain the improvement
+   - List affected files/references
+
+3. **Apply (with confirmation)**
+   - Make changes
+   - Update all references
+   - Run existing tests if available
+
+4. **Output**
+```
+## Refactoring: extract-method
+
+### Target
+src/handlers.py:create_order (lines 45-89)
+
+### Changes
+- Extracted validation logic → validate_order_input()
+- Extracted pricing logic → calculate_order_total()
+- Original function now 15 lines (was 44)
+
+### Files Modified
+- src/handlers.py
+- tests/test_handlers.py (updated calls)
+
+### Metrics
+- Cyclomatic complexity: 12 → 4
+- Function length: 44 → 15 lines
+```

plugins/code-sentinel/commands/security-scan.md

@@ -0,0 +1,64 @@
+---
+description: Full security audit of codebase - scans all files for vulnerability patterns
+---
+
+# Security Scan
+
+Comprehensive security audit of the project.
+
+## Process
+
+1. **File Discovery**
+   Scan all code files: .py, .js, .ts, .jsx, .tsx, .go, .rs, .java, .rb, .php, .sh
+
+2. **Pattern Detection**
+
+   ### Critical Vulnerabilities
+   | Pattern | Risk | Detection |
+   |---------|------|-----------|
+   | SQL Injection | High | String concat in SQL queries |
+   | Command Injection | High | shell=True, os.system with vars |
+   | XSS | High | innerHTML with user input |
+   | Code Injection | Critical | eval/exec with external input |
+   | Deserialization | Critical | pickle.loads, yaml.load unsafe |
+   | Path Traversal | High | File ops without sanitization |
+   | Hardcoded Secrets | High | API keys, passwords in code |
+   | SSRF | Medium | URL from user input in requests |
+
+   ### Code Quality Issues
+   | Pattern | Risk | Detection |
+   |---------|------|-----------|
+   | Broad Exceptions | Low | `except:` or `except Exception:` |
+   | Debug Statements | Low | print/console.log with data |
+   | TODO/FIXME Security | Medium | Comments mentioning security |
+   | Deprecated Functions | Medium | Known insecure functions |
+
+3. **Output Format**
+```
+## Security Scan Report
+
+### Critical (Immediate Action Required)
+🔴 src/db.py:45 - SQL Injection
+   Code: `f"SELECT * FROM users WHERE id = {user_id}"`
+   Fix: Use parameterized query: `cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))`
+
+### High
+🟠 config.py:12 - Hardcoded Secret
+   Code: `API_KEY = "sk-1234..."`
+   Fix: Use environment variable: `API_KEY = os.environ.get("API_KEY")`
+
+### Medium
+🟡 utils.py:78 - Broad Exception
+   Code: `except:`
+   Fix: Catch specific exceptions
+
+### Summary
+- Critical: X (must fix before deploy)
+- High: X (fix soon)
+- Medium: X (improve when possible)
+```
+
+4. **Exit Code Guidance**
+   - Critical findings: Recommend blocking merge/deploy
+   - High findings: Recommend fixing before release
+   - Medium/Low: Informational

plugins/code-sentinel/hooks/hooks.json

@@ -0,0 +1,15 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "prompt",
+            "prompt": "SECURITY CHECK - Before writing this code, scan for these patterns:\n\n**Critical (BLOCK if found):**\n- eval(), exec() with user input\n- SQL string concatenation (SQL injection)\n- shell=True with user input (command injection)\n- Hardcoded secrets (API keys, passwords, tokens)\n- Pickle/marshal deserialization of untrusted data\n- innerHTML/dangerouslySetInnerHTML with user content (XSS)\n\n**Warning (WARN but allow):**\n- subprocess without input validation\n- File operations without path sanitization\n- HTTP requests without timeout\n- Broad exception catches (except:)\n- Debug/print statements with sensitive data\n\n**Response:**\n- If CRITICAL found: STOP, explain the issue, suggest safe alternative\n- If WARNING found: Note it briefly, proceed with suggestion\n- If clean: Proceed silently (say nothing)\n\nDo NOT announce clean scans. Only speak if issues found."
+          }
+        ]
+      }
+    ]
+  }
+}

plugins/code-sentinel/skills/security-patterns/SKILL.md

@@ -0,0 +1,111 @@
+---
+description: Security vulnerability patterns and detection rules
+---
+
+# Security Patterns Skill
+
+## Critical Patterns (Always Block)
+
+### SQL Injection
+```python
+# VULNERABLE
+query = f"SELECT * FROM users WHERE id = {user_id}"
+query = "SELECT * FROM users WHERE id = " + user_id
+
+# SAFE
+cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))
+User.objects.filter(id=user_id)
+```
+
+### Command Injection
+```python
+# VULNERABLE
+os.system(f"convert {filename} output.png")
+subprocess.run(cmd, shell=True)
+
+# SAFE
+subprocess.run(["convert", filename, "output.png"], shell=False)
+shlex.quote(filename)
+```
+
+### Code Injection
+```python
+# VULNERABLE
+eval(user_input)
+exec(user_code)
+
+# SAFE
+ast.literal_eval(user_input)  # Only for literals
+# Use sandboxed execution environment
+```
+
+### XSS
+```javascript
+// VULNERABLE
+element.innerHTML = userContent;
+dangerouslySetInnerHTML={{__html: userData}}
+
+// SAFE
+element.textContent = userContent;
+DOMPurify.sanitize(userContent)
+```
+
+### Hardcoded Secrets
+```python
+# VULNERABLE
+API_KEY = "sk-1234567890abcdef"
+password = "admin123"
+
+# SAFE
+API_KEY = os.environ.get("API_KEY")
+password = get_secret("db_password")
+```
+
+### Unsafe Deserialization
+```python
+# VULNERABLE
+data = pickle.loads(user_data)
+config = yaml.load(file)  # yaml.load without Loader
+
+# SAFE
+data = json.loads(user_data)
+config = yaml.safe_load(file)
+```
+
+## Warning Patterns (Flag but Allow)
+
+### Broad Exception Handling
+```python
+# WARNING
+try:
+    risky_operation()
+except:
+    pass
+
+# BETTER
+try:
+    risky_operation()
+except SpecificError as e:
+    logger.error(f"Operation failed: {e}")
+    raise
+```
+
+### Missing Timeout
+```python
+# WARNING
+response = requests.get(url)
+
+# BETTER
+response = requests.get(url, timeout=30)
+```
+
+### Path Traversal Risk
+```python
+# WARNING
+file_path = os.path.join(base_dir, user_filename)
+
+# BETTER
+file_path = os.path.join(base_dir, os.path.basename(user_filename))
+if not file_path.startswith(os.path.abspath(base_dir)):
+    raise ValueError("Invalid path")
+```

plugins/doc-guardian/.claude-plugin/plugin.json

@@ -0,0 +1,13 @@
+{
+  "name": "doc-guardian",
+  "description": "Automatic documentation drift detection and synchronization",
+  "version": "1.0.0",
+  "author": {
+    "name": "Leo Miranda",
+    "email": "leobmiranda@gmail.com"
+  },
+  "homepage": "https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace/src/branch/main/plugins/doc-guardian/README.md",
+  "repository": "https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace.git",
+  "license": "MIT",
+  "keywords": ["documentation", "sync", "drift-detection", "automation", "hooks"]
+}

plugins/doc-guardian/README.md

@@ -0,0 +1,49 @@
+# doc-guardian
+
+Automatic documentation drift detection and synchronization for Claude Code projects.
+
+## Problem Solved
+
+Documentation gets outdated. Functions get renamed, configs change, versions bump—but docs lag behind. This creates:
+- Multiple review cycles finding stale references
+- Unnecessary commits fixing docs piecemeal
+- User confusion from outdated instructions
+
+## Solution
+
+doc-guardian watches your code changes and automatically:
+1. Detects when changes affect documentation
+2. Queues updates silently (doesn't interrupt your flow)
+3. Syncs all doc changes in a single commit when ready
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `/doc-audit` | Full project scan - reports all drift without changing anything |
+| `/doc-sync` | Apply all pending documentation updates in one commit |
+
+## Hooks
+
+- **PostToolUse (Write\|Edit)**: Silently checks if code changes affect docs
+- **Stop**: Reminds you of pending doc updates before session ends
+
+## What It Detects
+
+- **Broken References**: Function/class renamed but docs still use old name
+- **Version Drift**: Python 3.9 in docs but 3.11 in pyproject.toml
+- **Missing Docs**: Public functions without docstrings
+- **Stale Examples**: CLI examples that no longer work
+
+## Installation
+
+This plugin is part of the claude-code-marketplace.
+
+```bash
+/plugin marketplace add https://gitea.hotserv.cloud/personal-projects/support-claude-mktplace.git
+/plugin install doc-guardian
+```
+
+## Integration
+
+See claude-md-integration.md for CLAUDE.md additions.

plugins/doc-guardian/agents/doc-analyzer.md

@@ -0,0 +1,41 @@
+---
+description: Specialized agent for documentation analysis and drift detection
+---
+
+# Documentation Analyzer Agent
+
+You are an expert technical writer and documentation analyst. Your role is to detect discrepancies between code and documentation.
+
+## Capabilities
+
+1. **Pattern Recognition**
+   - Identify documentation references to code elements
+   - Parse docstrings, markdown, and inline comments
+   - Understand common documentation structures (README, API docs, man pages)
+
+2. **Cross-Reference Analysis**
+   - Map documentation claims to actual code
+   - Detect renamed, moved, or deleted code still referenced in docs
+   - Identify undocumented public interfaces
+
+3. **Semantic Understanding**
+   - Recognize when documentation meaning is correct but wording is outdated
+   - Distinguish between cosmetic issues and functional inaccuracies
+   - Prioritize user-facing documentation over internal notes
+
+## Analysis Approach
+
+When analyzing drift:
+1. Parse the changed file to understand what was modified
+2. Search for documentation files that might reference the changed code
+3. Extract specific references (function names, class names, config keys)
+4. Verify each reference against current code state
+5. Categorize findings by severity (broken, stale, missing)
+
+## Output Style
+
+Be precise and actionable:
+- Quote the exact line in documentation
+- Show the exact discrepancy
+- Suggest the specific fix
+- Never report vague or uncertain findings

plugins/doc-guardian/claude-md-integration.md

@@ -0,0 +1,22 @@
+# Doc Guardian Integration
+
+Add to your project's CLAUDE.md:
+
+## Documentation Management
+
+This project uses doc-guardian for automatic documentation synchronization.
+
+### Behavior
+- Documentation drift is detected automatically when files change
+- Pending updates are queued silently during work
+- Run `/doc-sync` to apply all pending documentation updates
+- Run `/doc-audit` for a full project documentation review
+
+### Documentation Files Tracked
+- README.md (root and subdirectories)
+- CLAUDE.md
+- API documentation in docs/
+- Docstrings in Python/TypeScript files
+
+### Commit Convention
+Documentation sync commits use: `docs: sync documentation with code changes`

plugins/doc-guardian/commands/doc-audit.md

@@ -0,0 +1,50 @@
+---
+description: Full documentation audit - scans entire project for doc drift without making changes
+---
+
+# Documentation Audit
+
+Perform a comprehensive documentation drift analysis.
+
+## Process
+
+1. **Inventory Documentation Files**
+   - README.md (root and subdirectories)
+   - CLAUDE.md
+   - API documentation
+   - Docstrings in code files
+   - Configuration references
+
+2. **Cross-Reference Analysis**
+   For each documentation file:
+   - Extract referenced functions, classes, endpoints, configs
+   - Verify each reference exists in codebase
+   - Check signatures/types match documentation
+   - Flag deprecated or renamed items still in docs
+
+3. **Completeness Check**
+   - Public functions without docstrings
+   - Exported modules without README coverage
+   - Environment variables used but not documented
+   - CLI commands not in help text
+
+4. **Output Format**
+```
+## Documentation Drift Report
+
+### Critical (Broken References)
+- [ ] README.md:45 references `calculate_total()` - function renamed to `compute_total()`
+
+### Stale (Outdated Info)
+- [ ] CLAUDE.md:23 lists Python 3.9 - project uses 3.11
+
+### Missing (Undocumented)
+- [ ] api/handlers.py:`create_order()` - no docstring
+
+### Summary
+- Critical: X items
+- Stale: X items
+- Missing: X items
+```
+
+5. **Do NOT make changes** - audit only, report findings

plugins/doc-guardian/commands/doc-sync.md

@@ -0,0 +1,58 @@
+---
+description: Synchronize all pending documentation updates in a single commit
+---
+
+# Documentation Sync
+
+Apply all pending documentation updates detected by doc-guardian hooks.
+
+## Process
+
+1. **Review Pending Queue**
+   List all documentation drift detected during this session.
+
+2. **Batch Updates**
+   For each pending item:
+   - Show the specific change needed
+   - Apply the update
+   - Track in change list
+
+3. **Update Types**
+
+   **Reference Fixes:**
+   - Renamed function/class → update all doc references
+   - Changed signature → update parameter documentation
+   - Removed item → remove or mark deprecated in docs
+
+   **Content Sync:**
+   - Version numbers (Python, Node, dependencies)
+   - Configuration keys/values
+   - File paths and directory structures
+   - Command examples and outputs
+
+   **Structural:**
+   - Add missing sections for new features
+   - Remove sections for deleted features
+   - Reorder to match current code organization
+
+4. **Commit Strategy**
+   - Stage all doc changes together
+   - Single commit: `docs: sync documentation with code changes`
+   - Include summary of what was updated in commit body
+
+5. **Output**
+```
+## Documentation Sync Complete
+
+### Files Updated
+- README.md (3 changes)
+- CLAUDE.md (1 change)
+- src/api/README.md (2 changes)
+
+### Changes Applied
+- Updated function reference: calculate_total → compute_total
+- Updated Python version: 3.9 → 3.11
+- Added docstring to create_order()
+
+Committed: abc123f
+```

plugins/doc-guardian/hooks/hooks.json

@@ -0,0 +1,26 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "prompt",
+            "prompt": "A file was just modified. Silently check if this change affects any documentation:\n\n1. If a code file changed: check if README, CLAUDE.md, docstrings, or API docs reference the modified functions/classes/configs\n2. If drift detected: add to internal queue (do NOT interrupt user flow)\n3. At natural breakpoints or when user runs /doc-sync: report pending doc updates\n\nDo NOT announce this check unless drift is found. Work silently."
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": ".*",
+        "hooks": [
+          {
+            "type": "prompt",
+            "prompt": "Before ending, check if there are pending documentation updates queued by doc-guardian. If yes, ask user: 'I detected documentation drift in X files. Run /doc-sync to update, or skip for now?'"
+          }
+        ]
+      }
+    ]
+  }
+}

plugins/doc-guardian/skills/doc-patterns/SKILL.md

@@ -0,0 +1,39 @@
+---
+description: Knowledge of documentation patterns and structures for drift detection
+---
+
+# Documentation Patterns Skill
+
+## Common Documentation Structures
+
+### README.md Patterns
+- Installation section: version requirements, dependencies
+- Usage section: function calls, CLI commands
+- Configuration section: env vars, config files
+- API section: endpoint references
+
+### CLAUDE.md Patterns
+- Project context: tech stack versions
+- File structure: directory layout
+- Commands: available operations
+- Workflows: process descriptions
+
+### Code Documentation
+- Docstrings: function signatures, parameters, returns
+- Type hints: should match docstring types
+- Comments: inline references to other code
+
+## Drift Detection Rules
+
+1. **Version Mismatch**: Any hardcoded version in docs must match package.json, pyproject.toml, requirements.txt
+2. **Function References**: Function names in docs must exist in codebase with matching signatures
+3. **Path References**: File paths in docs must exist in current directory structure
+4. **Config Keys**: Environment variables and config keys in docs must be used in code
+5. **Command Examples**: CLI examples in docs should be valid commands
+
+## Priority Levels
+
+- **P0 (Critical)**: Broken references that would cause user errors
+- **P1 (High)**: Outdated information that misleads users
+- **P2 (Medium)**: Missing documentation for public interfaces
+- **P3 (Low)**: Style inconsistencies, minor wording issues

plugins/projman/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "projman",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Sprint planning and project management with Gitea integration",
   "author": {
     "name": "Leo Miranda",

plugins/projman/CONFIGURATION.md

@@ -1,4 +1,4 @@
-# Configuration Guide - Projman Plugin v2.0.0
+# Configuration Guide - Projman Plugin
 
 Complete setup and configuration instructions for the Projman project management plugin.
 

plugins/projman/README.md

@@ -1,4 +1,4 @@
-# Projman v2.2.0 - Project Management for Claude Code
+# Projman - Project Management for Claude Code
 
 Sprint planning and project management plugin with full Gitea integration.
 
@@ -207,6 +207,25 @@ Test verification before sprint close.
 
 **When to use:** Before closing a sprint to ensure tests pass
 
+### `/test-gen`
+Generate tests for specified code.
+
+**What it does:**
+- Analyzes target code (function, class, or module)
+- Auto-detects test framework (pytest, Jest, vitest, Go test, Cargo, etc.)
+- Generates comprehensive tests: happy path, edge cases, error cases
+- Supports unit, integration, e2e, and snapshot test types
+
+**Usage:**
+```
+/test-gen <target> [--type=<type>] [--framework=<framework>]
+```
+
+**Target:** File path, function name, class name, or module
+**Type:** unit (default), integration, e2e, snapshot
+
+**When to use:** When adding new code that needs test coverage
+
 ## Code Quality Commands
 
 The `/review` and `/test-check` commands complement the Executor agent by catching issues before work is marked complete. Run both commands before `/sprint-close` for a complete quality check.
@@ -423,7 +442,8 @@ projman/
 │   ├── labels-sync.md
 │   ├── initial-setup.md
 │   ├── review.md
-│   └── test-check.md
+│   ├── test-check.md
+│   └── test-gen.md
 ├── agents/                  # Agent prompts
 │   ├── planner.md
 │   ├── orchestrator.md
@@ -479,16 +499,6 @@ See [CONFIGURATION.md](./CONFIGURATION.md) for detailed configuration instructio
 
 MIT License - See repository root for details
 
-## Version
-
-**Current:** 2.2.0
-
-**Changelog:**
-- v2.2.0: Added `/review` and `/test-check` commands, code-reviewer agent, marketplace compliance updates
-- v2.1.0: Documentation improvements, canonical paths, initial-setup command
-- v2.0.0: Full Gitea integration with wiki, milestones, dependencies, parallel execution
-- v1.0.0: Initial release with basic commands
-
 ---
 
 **Status:** Production Ready

plugins/projman/commands/test-gen.md

@@ -0,0 +1,118 @@
+---
+description: Generate tests for specified code - creates unit, integration, or e2e tests
+---
+
+# Test Generation
+
+Generate comprehensive tests for specified code.
+
+## Usage
+```
+/test-gen <target> [--type=<type>] [--framework=<framework>]
+```
+
+**Target:** File path, function name, class name, or module
+**Type:** unit (default), integration, e2e, snapshot
+**Framework:** Auto-detected or specify (pytest, jest, vitest, go test, etc.)
+
+## Process
+
+1. **Analyze Target Code**
+   - Parse function/class signatures
+   - Identify dependencies and side effects
+   - Map input types and return types
+   - Find edge cases from logic branches
+
+2. **Determine Test Strategy**
+
+   | Code Pattern | Test Approach |
+   |--------------|---------------|
+   | Pure function | Unit tests with varied inputs |
+   | Class with state | Setup/teardown, state transitions |
+   | External calls | Mocks/stubs for dependencies |
+   | Database ops | Integration tests with fixtures |
+   | API endpoints | Request/response tests |
+   | UI components | Snapshot + interaction tests |
+
+3. **Generate Tests**
+
+   For each target function/method:
+   - Happy path test (expected inputs → expected output)
+   - Edge cases (empty, null, boundary values)
+   - Error cases (invalid inputs → expected errors)
+   - Type variations (if dynamic typing)
+
+4. **Test Structure**
+   ```python
+   # Example output for Python/pytest
+
+   import pytest
+   from module import target_function
+
+   class TestTargetFunction:
+       """Tests for target_function."""
+
+       def test_happy_path(self):
+           """Standard input produces expected output."""
+           result = target_function(valid_input)
+           assert result == expected_output
+
+       def test_empty_input(self):
+           """Empty input handled gracefully."""
+           result = target_function("")
+           assert result == default_value
+
+       def test_invalid_input_raises(self):
+           """Invalid input raises ValueError."""
+           with pytest.raises(ValueError):
+               target_function(invalid_input)
+
+       @pytest.mark.parametrize("input,expected", [
+           (case1_in, case1_out),
+           (case2_in, case2_out),
+       ])
+       def test_variations(self, input, expected):
+           """Multiple input variations."""
+           assert target_function(input) == expected
+   ```
+
+5. **Output**
+```
+## Tests Generated
+
+### Target: src/orders.py:calculate_total
+
+### File Created: tests/test_orders.py
+
+### Tests (6 total)
+- test_calculate_total_happy_path
+- test_calculate_total_empty_items
+- test_calculate_total_negative_price_raises
+- test_calculate_total_with_discount
+- test_calculate_total_with_tax
+- test_calculate_total_parametrized_cases
+
+### Coverage Estimate
+- Line coverage: ~85%
+- Branch coverage: ~70%
+
+### Run Tests
+pytest tests/test_orders.py -v
+```
+
+## Framework Detection
+
+| Files Present | Framework Used |
+|---------------|----------------|
+| pytest.ini, conftest.py | pytest |
+| jest.config.* | jest |
+| vitest.config.* | vitest |
+| *_test.go | go test |
+| Cargo.toml | cargo test |
+| mix.exs | ExUnit |
+
+## Integration with /test-check
+
+- `/test-gen` creates new tests
+- `/test-check` verifies tests pass
+- Typical flow: `/test-gen src/new_module.py` → `/test-check`