Devops Monk

{ "type": "command",  "command": ".claude/hooks/script.sh" }
{ "type": "http",     "url": "https://internal.api/hook", "method": "POST" }
{ "type": "prompt",   "prompt": "Summarise what just changed" }
{ "type": "agent",    "agent": "code-reviewer" }

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit",
        "hooks": [
          {
            "type": "command",
            "command": ".claude/hooks/on-edit.sh"
          }
        ]
      }
    ],
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": ".claude/hooks/pre-bash.sh"
          }
        ]
      }
    ]
  }
}

{
  "tool_name": "Edit",
  "tool_input": { "path": "src/api.ts", "old_string": "...", "new_string": "..." },
  "cwd": "/Users/dev/my-project",
  "session_id": "abc123",
  "duration_ms": 120
}

#!/bin/bash
# .claude/hooks/on-edit.sh
input=$(cat)
CWD=$(echo "$input" | jq -r '.cwd // "."')

cd "$CWD"

if [ -f "package.json" ]; then
  npm test --silent 2>&1 | tail -20
elif [ -f "go.mod" ]; then
  go test ./... 2>&1 | tail -20
elif [ -f "requirements.txt" ]; then
  python -m pytest --tb=short -q 2>&1 | tail -20
fi

exit 0

#!/bin/bash
# .claude/hooks/pre-bash.sh
input=$(cat)
cmd=$(echo "$input" | jq -r '.tool_input.command // ""')

DANGEROUS="rm -rf|kubectl delete|terraform destroy|DROP TABLE"

if echo "$cmd" | grep -qiE "$DANGEROUS"; then
  jq -n --arg cmd "$cmd" '{
    hookSpecificOutput: {
      hookEventName: "PreToolUse",
      permissionDecision: "deny",
      permissionDecisionReason: "Blocked: destructive command. Run manually after review."
    }
  }'
  exit 0
fi

exit 0

#!/bin/bash
# .claude/hooks/format.sh
input=$(cat)
file=$(echo "$input" | jq -r '.tool_input.path // ""')

[ -z "$file" ] && exit 0

case "$file" in
  *.ts|*.tsx|*.js|*.jsx) npx prettier --write "$file" 2>/dev/null ;;
  *.py) black "$file" 2>/dev/null ;;
  *.go) gofmt -w "$file" 2>/dev/null ;;
  *.tf) terraform fmt "$file" 2>/dev/null ;;
esac

exit 0

#!/bin/bash
# .claude/hooks/sanitise-output.sh
input=$(cat)
tool=$(echo "$input" | jq -r '.tool_name // ""')

if [ "$tool" = "Bash" ]; then
  raw_output=$(echo "$input" | jq -r '.tool_result // ""')
  cleaned=$(echo "$raw_output" | sed 's/[A-Za-z0-9_-]\{20,\}/[REDACTED]/g')

  jq -n --arg out "$cleaned" '{
    hookSpecificOutput: {
      updatedToolOutput: $out
    }
  }'
  exit 0
fi

exit 0

#!/bin/bash
# .claude/hooks/notify.sh
input=$(cat)
tool=$(echo "$input" | jq -r '.tool_name // ""')
duration=$(echo "$input" | jq -r '.duration_ms // 0')

if [ "$duration" -gt 10000 ]; then
  jq -n --arg tool "$tool" --arg ms "$duration" '{
    hookSpecificOutput: {
      terminalSequence: "",
      desktopNotification: {
        title: "Claude Code",
        body: ($tool + " completed in " + $ms + "ms")
      }
    }
  }'
fi

exit 0

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "http",
            "url": "https://audit.internal/claude-tool-log",
            "method": "POST",
            "headers": {
              "Authorization": "Bearer ${AUDIT_TOKEN}"
            }
          }
        ]
      }
    ]
  }
}

<!-- .claude/commands/security-audit.md -->
Review $ARGUMENTS for security vulnerabilities.

Trace data flows end-to-end across related files — not just the file provided.

Check for:
- Injection risks: SQL, command injection, path traversal
- Authentication and authorisation gaps
- Sensitive data exposure in logs or responses
- Business logic flaws specific to this application
- Insecure Direct Object References

Rate each finding: critical / high / medium / low
Include: file path, line number, description, and why it is exploitable.
Do not make any code changes — report only.

/project:security-audit src/api/payments/

<!-- .claude/commands/write-tests.md -->
Write comprehensive tests for $ARGUMENTS.

Cover:
- Happy path with realistic inputs
- Edge cases: empty input, boundary values, nulls
- Error cases: invalid input, missing dependencies

Use the same test framework as the existing tests in this project.
Do not modify the source file.

<!-- .claude/commands/pr-summary.md -->
Generate a pull request description for the current branch.

Run: git diff main...HEAD --stat
Then: git log main...HEAD --oneline

Write:
1. A one-line title (imperative, under 70 chars)
2. A 3-bullet summary of what changed and why
3. A testing checklist

Format as GitHub Markdown.

<!-- .claude/commands/explain.md -->
Explain $ARGUMENTS in plain English.

Assume the reader is a senior engineer unfamiliar with this specific codebase.
Cover: what it does, inputs, outputs, side effects, and any non-obvious behaviour.
Keep it under 200 words.

---
name: test-writer
description: Writes tests for TypeScript components using Vitest. Invoked when the user asks to write, add, or generate tests.
user-invocable: true
allowed-tools:
  - Read
  - Edit
  - Bash
---

When writing tests for this project:

1. Use Vitest as the test framework (`import { describe, it, expect } from 'vitest'`)
2. Co-locate test files next to source: `component.ts` → `component.test.ts`
3. Cover: happy path, edge cases (null, empty, boundary), error conditions
4. Mock external dependencies using `vi.mock()` — never make real network calls in tests
5. Run `bun test` to verify tests pass before finishing

For React components, use `@testing-library/react` for rendering. For API handlers, test the handler function directly without starting a server.

---
name: security-reviewer           # slug used for /skill-name invocation
description: >                    # shown at startup (~100 tokens) — be specific
  Reviews code for security vulnerabilities. Auto-invokes when
  the user asks to audit, review security, or check for vulnerabilities.
user-invocable: true              # can be called with /security-reviewer
disable-model-invocation: false   # true = skip LLM, run tools directly (for side-effecting skills)
allowed-tools:                    # restrict which tools this skill can use
  - Read
  - Bash
  - Grep
model: claude-opus-4-7            # override the model for this skill
agent: true                       # run as a subagent (own context window)
---

/security-reviewer src/api/checkout.ts

---
name: migration-generator
description: Generates database migrations using Drizzle ORM. Auto-invokes when the user asks to add a column, create a table, or write a migration.
user-invocable: true
allowed-tools:
  - Read
  - Write
  - Bash
---

When generating a migration for this project:

1. Read `src/db/schema.ts` first to understand the current schema structure
2. Create migration files in `src/db/migrations/` using Drizzle's format
3. Name files: `NNNN_description.ts` where NNNN is the next sequential number
4. Always include both `up()` and `down()` functions
5. For large tables (check row count with `SELECT COUNT(*) FROM table`), add a comment noting the table size and whether the migration will lock

Run `bun db:migrate --dry-run` to validate before finishing.

---
name: k8s-deploy
description: Helps with Kubernetes deployments and kubectl operations. Auto-invokes when the user mentions kubectl, deployments, pods, or Kubernetes.
user-invocable: true
allowed-tools:
  - Bash
  - Read
---

For Kubernetes operations in this project:

- Always use the `staging` namespace for tests: `kubectl -n staging`
- Production namespace is `prod` — require explicit confirmation before any prod changes
- Deployment manifests live in `k8s/` — read them before suggesting changes
- After deploying, verify with `kubectl rollout status deployment/<name>`
- If a rollout fails, run `kubectl rollout undo deployment/<name>` and report what happened

Never delete pods directly. Use `kubectl rollout restart` for restarts.

---
name: style-guide
description: Enforces this project's code style rules. Auto-invokes when writing or editing TypeScript files.
disable-model-invocation: false
allowed-tools:
  - Read
  - Edit
---

This project's TypeScript conventions:

- Use named exports only — no default exports
- Type everything explicitly — no implicit `any`
- Error handling: use `Result<T, E>` from `neverthrow` — no try/catch in business logic
- Async: always `async/await` — no raw Promise chains
- File names: `kebab-case.ts`
- Test files: co-located `component.test.ts`

When editing existing files, fix violations you encounter but do not refactor unrelated code.

---
name: security-reviewer
description: Reviews code for security vulnerabilities. Use when auditing auth, payment, or API code.
model: claude-opus-4-7
tools:
  - Read
  - Bash
  - Grep
  - Glob
isolation: worktree
---

You are a security-focused code reviewer. Your job is to read code and report vulnerabilities.

Rules:
- Read files thoroughly before drawing conclusions
- Trace data flows end-to-end across imports
- Report findings with: severity (critical/high/medium/low), file path, line number, description, and why it is exploitable in this specific codebase
- Do NOT make any code changes — report only
- If you find something critical, say so clearly at the top of your response

---
name: codebase-explorer          # slug used to invoke this agent
description: >                   # shown to Claude when it decides which agent to spawn
  Fast read-only exploration agent. Use for "find where X is defined"
  or "which files reference Y" tasks.
model: claude-haiku-4-5          # use a cheaper/faster model for simple tasks
tools:                           # restrict available tools
  - Read
  - Bash
  - Grep
  - Glob
isolation: worktree              # give this agent its own git worktree (required if it writes files)
hooks:                           # agent-specific hooks
  PostToolUse:
    - matcher: "*"
      hooks:
        - type: command
          command: ".claude/hooks/agent-log.sh"
---

claude --agent security-reviewer -p "Audit src/api/checkout.ts" --output-format json

---
name: refactor-agent
description: Refactors a module independently
model: claude-sonnet-4-6
tools:
  - Read
  - Edit
  - Bash
isolation: worktree
---

You are a refactoring agent. You receive a module path and a refactoring goal.
Apply the refactoring, run the tests, and report what you changed.

---
name: dep-auditor
description: Audits project dependencies for vulnerabilities and outdated packages.
model: claude-sonnet-4-6
tools:
  - Bash
  - Read
---

Run the following and report findings:
1. `npm audit --json` — parse and summarise CVEs by severity
2. `npm outdated` — list major-version outdated packages
3. Read `package.json` — flag any packages that are known to be deprecated

Return a structured report: critical issues first, then high, then informational.
Do not make any changes.

---
name: arch-explorer
description: Reads the codebase and produces an architecture summary. Use before starting large features.
model: claude-haiku-4-5
tools:
  - Read
  - Glob
  - Bash
---

You are a read-only codebase explorer. Your goal is to produce a concise architecture summary.

Read:
1. Top-level directory structure
2. Package.json / go.mod / requirements.txt — understand the tech stack
3. Main entry points
4. Key data models

Return: tech stack, main modules, data flow from request to response, anything non-obvious.
Keep the summary under 400 words. Do not make any changes.

# Analyse log output
docker logs myapp --tail 200 | claude -p "what errors are here and what is causing them?"

# Summarise git history
git log --oneline -20 | claude -p "summarise what changed this week in plain English"

# Review a diff before committing
git diff --staged | claude -p "review this diff for bugs or issues before I commit"

# Generate migration, then review it
claude -p "generate a SQL migration to add a soft-delete column to the users table" \
  > migration.sql

claude -p "review this migration for safety — will it lock the table? Is rollback safe?" \
  < migration.sql

# Post a natural-language summary of a deploy to Slack
deploy_output=$(./deploy.sh 2>&1)
summary=$(echo "$deploy_output" | claude -p "summarise this deploy output in 2 sentences for a Slack message")
curl -X POST "$SLACK_WEBHOOK" -d "{\"text\": \"$summary\"}"

#!/bin/bash
# scripts/slack-standup.sh
diff=$(git log --since="yesterday" --oneline --all)
update=$(echo "$diff" | claude -p "write a casual 3-bullet Slack standup update from these commits. First person, past tense, no jargon.")
echo "$update"