{
  "markdown": "# Code Guardian\n\nClaude Code plugins for the **INFYNON** suite — package security, API flow testing, and shared coding memory.\n\n## Plugins\n\n### infynon-pkg — Package Security Manager\nUniversal secure package installation, CVE scanning, auto-fix, dependency auditing, and vulnerability monitoring across **14 ecosystems** (npm, yarn, pnpm, bun, pip, uv, poetry, cargo, go, gem, composer, nuget, hex, pub).\n\n### infynon-weave — API Flow Testing\nAI-driven node-based API flow testing with security probes, TUI visualization, assertion engine, context threading, and automated flow building.\n\n### infynon-trace — Shared Coding Memory\nThree-layer memory operating system for codebases:\n- **Canonical memory** — architecture decisions, API contracts, security constraints (highest trust, promoted only)\n- **Team memory** — handoffs, PR notes, caveats, branch context (medium trust, agent-writable)\n- **User memory** — personal observations, task context, experiments (low trust, promotable)\n\nWith session hooks (auto-load on start, capture on end), Redis and SQL backends, TUI inspection, and promotion workflows.\n\n---\n\n## Installation\n\n### Step 1: Install INFYNON CLI\n\n> **INFYNON CLI**: [github.com/d4rkNinja/infynon-cli](https://github.com/d4rkNinja/infynon-cli)\n\n**Check if already installed:**\n```bash\ninfynon --version\n```\n\n#### npm (Recommended — all platforms, no Rust required)\n\n```bash\nnpm install -g infynon\n```\n\n#### Linux / macOS\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/d4rkNinja/infynon-cli/main/scripts/install.sh | bash\n```\n\n#### Windows (PowerShell)\n\n```powershell\nirm https://raw.githubusercontent.com/d4rkNinja/infynon-cli/main/scripts/install.ps1 | iex\n```\n\n#### Build from Source (requires Rust)\n\n```bash\ncargo install --git https://github.com/d4rkNinja/infynon-cli\n```\n\nPre-built binaries also available on the [Releases page](https://github.com/d4rkNinja/infynon-cli/releases) for Windows x64, Linux x64/ARM64 (musl), macOS x64/ARM64.\n\n**Verify:**\n```bash\ninfynon --version\ninfynon pkg --help\ninfynon trace --help\n```\n\n### Step 2: Install Claude Code Plugins\n\n```bash\n# Add the marketplace\n/plugin marketplace add d4rkNinja/code-guardian\n\n# Install plugins\n/plugin install infynon-pkg@d4rkNinja\n/plugin install infynon-weave@d4rkNinja\n/plugin install infynon-trace@d4rkNinja\n\n# Activate\n/reload-plugins\n```\n\nOr load locally for development:\n```bash\nclaude --plugin-dir ./infynon-pkg --plugin-dir ./infynon-weave --plugin-dir ./infynon-trace\n```\n\n---\n\n## How These Plugins Work\n\nThese are **contextual skills** — once installed, Claude Code automatically knows how to help users with INFYNON. Claude will:\n\n- Check if INFYNON is installed and guide through installation if not found\n- Recommend the right `infynon` commands based on what the user is trying to do\n- Detect lock files and suggest security scans\n- Help manage coding memory across canonical, team, and user layers\n- Run session hooks to load/save memory automatically\n- Guide users through TUI keyboard shortcuts\n- Explain vulnerability scan results and fix options\n- Recommend CI-friendly flags (`--strict`, `--no-input`, `--auto-fix`, `--skip-vulnerable`, `--json`)\n\n### Skills\n\n| Plugin | Skill | Auto-triggers When |\n|--------|-------|--------------------|\n| infynon-pkg | `package-security` | User asks about package vulnerabilities, CVE scanning, dependency auditing, or Claude detects lock files in the project |\n| infynon-pkg | `cve-triage` | User needs help interpreting CVE scan results or prioritizing fixes |\n| infynon-pkg | `eagle-eye-monitor` | User wants continuous vulnerability monitoring with email alerts |\n| infynon-weave | `weave` | User asks about API testing, flow building, security probes, or Claude detects `.infynon/api/` in the project |\n| infynon-trace | `memory-ops` | User asks about coding memory, notes, handoffs, or Claude detects `.infynon/trace/` in the project |\n| infynon-trace | `canonical-memory` | User asks about architecture decisions, truth memory, or validated knowledge |\n| infynon-trace | `session-hooks` | Session starts or ends, user asks about memory hooks |\n\n### Agents\n\n| Plugin | Agent | Purpose |\n|--------|-------|---------|\n| infynon-pkg | `pkg-guardian` | Deep package security analysis, CVE triage, migration guidance, CI setup |\n| infynon-weave | `weaver` | API flow design, node wiring, security probe interpretation, CI pipelines |\n| infynon-trace | `trace-guardian` | Memory layer management, promotion workflows, session hooks, backend setup |\n\n### Hooks (Opt-In)\n\nTrace hooks are installed **per-project** in `.claude/settings.json` when the user explicitly asks. They are never auto-installed or placed in system-level settings.\n\n| Hook | Trigger | Behavior |\n|------|---------|----------|\n| `SessionStart` | New conversation begins | Load canonical memory (always), ask about team memory, optionally load user memory, pull from remote |\n| `Stop` | Claude finishes responding | Remind to save observations, compact stale notes, push to remote. Never auto-writes canonical. |\n\n**Install hooks:**\n```bash\n# Run the install script in your project directory\nbash <path-to-code-guardian>/infynon-trace/hooks/install.sh .\n\n# Or ask Claude: \"Set up trace hooks for this project\"\n```\n\nHooks are written to `<your-project>/.claude/settings.json` — not `~/.claude/settings.json`.\n\n---\n\n## Package Security Manager — Quick Reference\n\n```bash\n# Scan for vulnerabilities\ninfynon pkg scan\ninfynon pkg scan --json\n\n# Explain one package and its remediation path\ninfynon pkg explain serde_json\n\n# Install packages securely (wraps any package manager)\ninfynon pkg npm install express\ninfynon pkg uv add fastapi\ninfynon pkg cargo add serde\n\n# CI / non-interactive flags (no prompts)\ninfynon pkg npm install express --strict high      # fail build on critical/high (exit 3)\ninfynon pkg npm install express --json --strict high # machine-readable install contract\ninfynon pkg npm install express --auto-fix         # auto-upgrade to safe versions\ninfynon pkg npm install express --skip-vulnerable  # skip bad packages silently\ninfynon pkg npm install express --yes              # install everything (audit-only CI)\n\n# Auto-fix all vulnerabilities\ninfynon pkg fix --auto\n\n# Deep audit\ninfynon pkg audit\n\n# Why is this package in my tree?\ninfynon pkg why lodash\n\n# Health check\ninfynon pkg doctor\n\n# Check for updates\ninfynon pkg outdated\n\n# Compare versions\ninfynon pkg diff express 4.18.0 4.19.0\n\n# Package size analysis\ninfynon pkg size express axios\n\n# Remove unused deps\ninfynon pkg clean\n\n# Migrate package managers\ninfynon pkg migrate pip uv\n\n# Continuous monitoring\ninfynon pkg eagle-eye setup\ninfynon pkg eagle-eye start\n```\n\n### CI / Agent Flag Reference\n\n| Flag | Behavior | Exit Code |\n|------|----------|-----------|\n| `--json` | Machine-readable JSON to stdout for scan/install automation | scan `0/1/2`, install `0/2/3/4` |\n| `--strict [LEVEL]` | Block if vulnerabilities at/above level are found during install | `3` on block |\n| `--no-input` | Disable prompts and fail if a decision would be required | `4` on install |\n| `--auto-fix` | Upgrade to safe versions silently; skip if no fix | `0` |\n| `--skip-vulnerable` | Skip vulnerable packages, install clean ones | `0` |\n| `--yes` | Install all packages including vulnerable ones | `0` |\n\n**Compatibility note:** `--agent` still works as a deprecated alias for `--json`, but new docs and new scripts should use `--json`.\n\n### Supported Ecosystems\n\nnpm, yarn, pnpm, bun, pip, uv, poetry, cargo, go, gem, composer, nuget, hex, pub\n\n---\n\n## Trace — Shared Coding Memory\n\n### Three-Layer Memory Model\n\n```\n┌─────────────────────────────────────────────┐\n│  Canonical Memory (Highest Trust)           │\n│  Architecture, API contracts, constraints   │\n│  Promoted only. Never auto-written.         │\n├─────────────────────────────────────────────┤\n│  Team Memory (Medium Trust)                 │\n│  Handoffs, caveats, PR notes, branch ctx    │\n│  Agent-writable. Compacted often.           │\n├─────────────────────────────────────────────┤\n│  User Memory (Low Trust)                    │\n│  Personal notes, observations, experiments  │\n│  Promotable to team. Never affects canon.   │\n└─────────────────────────────────────────────┘\n```\n\n### Quick Reference\n\n```bash\n# Initialize Trace with the default local SQLite backend\ninfynon trace init\n\n# Add an optional shared backend\ninfynon trace source add-sql team-db \\\n  --engine sqlite \\\n  --url sqlite://.infynon/trace/trace.db \\\n  --user alien --default\n\n# Create notes\ninfynon trace note add arch-decision \\\n  --title \"Auth uses middleware\" \\\n  --body \"All auth flows go through middleware\" \\\n  --layer canonical --scope repo\n\ninfynon trace note add handoff-payment \\\n  --title \"Payment webhook incomplete\" \\\n  --body \"Stripe webhook handler needs idempotency testing\" \\\n  --layer team --scope branch --target feature/payment\n\n# Retrieve memory\ninfynon trace retrieve --layer canonical\ninfynon trace retrieve --layer team --scope branch --target feature/payment\ninfynon trace retrieve --tag handoff\ninfynon trace retrieve --scope package --target chrono --format markdown\n\n# Sync\ninfynon trace sync --direction both\n\n# Compact stale notes\ninfynon trace compact\n\n# TUI\ninfynon trace tui\n```\n\n### Session Hooks\n\n**Session start:**\n1. Load canonical memory (always)\n2. Ask: \"Load team memory?\" → yes/no\n3. Optionally load user memory\n4. Pull from remote\n\n**Session end:**\n1. Ask: \"Any observations to save?\"\n2. Mark stale notes\n3. Flag promotion candidates\n4. Compact and sync\n5. Never auto-write canonical\n\n### Note Scopes\n\n| Scope | Example |\n|-------|---------|\n| `repo` | Repository-wide architectural facts |\n| `branch` | Branch-specific handoff context |\n| `pr` | PR-linked notes for reviewers |\n| `file` | File-specific caveats and warnings |\n| `user` | User-scoped personal notes |\n| `session` | Temporary session context (auto-compacted) |\n| `package` | Dependency provenance and risk tracking |\n\n### Promotion Path\n\n```\nUser Memory → Team Memory → Canonical Memory\n     │              │              │\n  Low trust    Medium trust    High trust\n  Personal     Shared          Validated\n  Auto-write   Agent-write     Promote only\n```\n\nPromotion requires: merge + validation + review + repeated reuse without contradiction.\n\n---\n\n## Troubleshooting\n\n### INFYNON CLI Not Found\n```bash\n# Check installation\ninfynon --version\n\n# Install via npm (recommended)\nnpm install -g infynon\n\n# Or via script\ncurl -fsSL https://raw.githubusercontent.com/d4rkNinja/infynon-cli/main/scripts/install.sh | bash\n\n# Windows\nirm https://raw.githubusercontent.com/d4rkNinja/infynon-cli/main/scripts/install.ps1 | iex\n\n# Verify\ninfynon --version\n```\n\n### Plugin Not Loading\n```bash\n/plugin                    # Check Errors tab\n/reload-plugins            # Reload all plugins\n```\n\n### Skills Not Appearing\n```bash\nrm -rf ~/.claude/plugins/cache     # Clear cache\n# Restart Claude Code, reinstall\n```\n\n---\n\n## Plugin References\n\n- [Claude Code Plugins](https://code.claude.com/docs/en/plugins)\n- [Skills Documentation](https://code.claude.com/docs/en/skills)\n- [Discover Plugins](https://code.claude.com/docs/en/discover-plugins)\n- [Plugin Marketplaces](https://code.claude.com/docs/en/plugin-marketplaces)\n- [Plugin Reference](https://code.claude.com/docs/en/plugins-reference)\n\n---\n\n## Project Structure\n\n```\ncode-guardian/\n├── .claude-plugin/\n│   └── marketplace.json              # Marketplace catalog\n├── infynon-pkg/                      # Package Security Manager plugin\n│   ├── .claude-plugin/plugin.json\n│   ├── agents/pkg-guardian.md        # Package security agent\n│   └── skills/\n│       ├── package-security/         # Core package security skill\n│       ├── cve-triage/               # CVE interpretation and prioritization\n│       └── eagle-eye-monitor/        # Continuous vulnerability monitoring\n├── infynon-weave/                    # API Flow Testing plugin\n│   ├── .claude-plugin/plugin.json\n│   ├── agents/api-weaver.md          # API testing agent\n│   └── skills/\n│       └── weave/                    # Flow building, probes, TUI\n├── infynon-trace/                     # Shared Coding Memory plugin\n│   ├── .claude-plugin/plugin.json\n│   ├── agents/trace-guardian.md       # Memory layer management agent\n│   ├── hooks/\n│   │   ├── session-start.md          # Load canonical + ask team memory\n│   │   ├── session-end.md            # Capture observations, compact, sync\n│   │   ├── settings-template.json    # Hook config template for .claude/settings.json\n│   │   └── install.sh                # Script to install hooks into a project\n│   └── skills/\n│       ├── memory-ops/               # Core memory operations\n│       │   └── examples/workflows.md\n│       ├── canonical-memory/         # Canonical layer management\n│       └── session-hooks/            # Session start/end workflows\n└── README.md\n```\n\n---\n\n## License\n\nMIT License\n\n---\n\n**Code Guardian** by [d4rkNinja](https://github.com/d4rkNinja) — Powered by [INFYNON](https://github.com/d4rkNinja/infynon-cli)\n\n",
  "bytes": 13026,
  "sha": "da8f492eebab17dc086319d1ed30f1e697251ff5ae2cb46666b5ef722c250f06",
  "repo_slug": "d4rkninja/code-guardian",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_d4rkninja_code_guardian_infynon_pkg_bb803118/readme"
}