feat: implement DevSync v2.0 AI-powered config distribution (#63) - #79
Conversation
Remove library system, template system, TUI, legacy install/list/update/delete, standalone MCP commands, and package_create CLI. Also remove 24 test files that reference deleted modules.
Update product vision to reflect AI-powered config distribution. Update CLAUDE.md with v2 module structure, commands, and workflow.
Add --upgrade flag to extract command that converts v1 ai-config-kit packages to v2 devsync-package format. Supports AI-powered conversion when LLM is configured, falls back to file-copy mode otherwise.
Rewrite README to focus on two-command flow (extract + install), AI-powered features, and v1 migration path.
Fix unused variables, incorrect method names (list_packages -> get_installed_packages), incorrect import (clone_repository -> GitOperations.clone_repository), and apply black formatting.
…#63) Fix _package_has_tool returning True unconditionally (tool filter was a no-op). Add path traversal checks for manifest ref.file paths and instruction_name values to prevent reading/writing outside intended directories.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📊 Code Quality ReportLinting Issues |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #79 +/- ##
==========================================
+ Coverage 76.19% 84.44% +8.24%
==========================================
Files 84 75 -9
Lines 8254 6202 -2052
==========================================
- Hits 6289 5237 -1052
+ Misses 1965 965 -1000 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
📊 Code Quality ReportLinting Issues |
Code ReviewBugs Found (5)Bug 1: Temp directory leaked on Git clone installs Bug 2: LLM JSON parsing doesn't strip markdown fences Bug 3: Bug 4: Bug 5: Security Warnings (2)
Test Gaps
Notes
Automated code review by Claude Code |
- Fix temp directory leak in Git clone installs (install_v2.py) - Strip markdown fences from LLM JSON responses (extractor.py) - Read practice_name from JSON in parse_adaptation_response (response_models.py) - Apply --conflict flag in fallback install path (install_v2.py) - Return exit code 1 when v1 upgrade finds no files (extract.py) - Mask credential input with password=True + validate non-empty (mcp_credential_prompter.py) - Use Path.relative_to() instead of str.startswith() for path traversal guard (install_v2.py, extract.py)
📊 Code Quality ReportLinting Issues |
📊 Code Quality ReportLinting Issues |
Summary
setup,tools,extract,install,list,uninstallChanges
New: LLM Provider Layer (
devsync/llm/)provider.py— AbstractLLMProviderABC,LLMResponse,resolve_provider()with env var auto-detectionanthropic.py,openai_provider.py,openrouter.py— HTTP-only implementations via httpxconfig.py— API key resolution from env vars,~/.devsync/config.yaml(never stores keys)prompts.py— Extraction, adaptation, and merge prompt templatesresponse_models.py—ExtractionResult,AdaptationPlan, structured response parsersNew: Core AI Engine (
devsync/core/)practice.py—PracticeDeclaration,MCPDeclaration,CredentialSpecdataclassesextractor.py—PracticeExtractorwith AI and no-AI fallback pathsadapter.py—PracticeAdapterwith LLM-powered semantic mergepackage_manifest_v2.py— v2 manifest parser with v1 backward compatibilitymcp_credential_prompter.py— Interactive credential prompting for MCP serversNew: CLI Commands (
devsync/cli/)setup.py— Interactive LLM provider configurationextract.py— Practice extraction with--upgradefor v1→v2 conversioninstall_v2.py— AI-powered installation with plan reviewlist_v2.py— Simplified package listingmain.py— Rewritten for v2 command surfaceRemoved (49 files)
download.py,update.py,delete.py,storage/library.pytemplate_*.pyCLI files,storage/template_*.py,core/template_manifest.pytui/installer.pyinstall.py,install_new.py,list.py,package.py,package_create.py,package_install.pymcp_configure.py,mcp_install.py,mcp_sync.pyDocumentation — ReadTheDocs (
docs/)cli/download.md,cli/update.md,cli/delete.md,cli/package.md, entiremcp-server/section (7 files),tutorials/ai-merge-workflow.md,tutorials/ci-cd-integration.mdcli/setup.md,cli/extract.mdindex.md,quickstart.md,concepts.md,cli/index.md,cli-reference.mdinstall.md,list.md,uninstall.mdindex.md,creating.md,components.md,installing.md,examples.mdmkdocs.ymlnav structuremkdocs build --strictpasses with no warningsOther Documentation
VISION.md— Updated for AI-powered config distribution directionCLAUDE.md— Updated architecture, module structure, and command referenceREADME.md— Rewritten for two-command flow (extract + install)Issue References
Closes #63, Closes #64, Closes #65, Closes #66, Closes #67, Closes #68
Closes #69, Closes #70, Closes #71, Closes #72, Closes #73, Closes #74
Closes #75, Closes #76, Closes #77, Closes #78
Test Plan
pytest tests/unit/)ruff check— all checks passedblack --check— all files formattedmypy— no issues in 86 source filesmkdocs build --strictpasses — no broken links or warningsdevsync toolsdetects AI tools without API keydevsync setupconfigures API key interactivelydevsync extractproducesdevsync-package.yamldevsync install ./packageadapts and installsdevsync install ./v1-packageworks via file-copy (backward compat)devsync extract --no-aiproduces v1-style packagedevsync extract --upgrade ./v1-pkgconverts to v2Security Considerations
resolve()+ prefix checks for manifestref.filepaths; rejected instruction names containing..,/, or\~/.devsync/config.yamlstores provider name and model preference, never key values.devsync/.env; never stored in manifests or installation recordsKnown Remaining Issues
_install_v2_fallbackdoes not use theconflictstrategy parameter_clone_sourcetemp directory not cleaned up after installationbuild_mcp_configresult is discarded (MCP config not persisted to tool configs)test_main_module_execution(Typer/Click version incompatibility with--help)password=True)install_v2.pyusesstr.startswithinstead ofis_relative_toVision Alignment
Supports: zero-friction distribution, IDE-agnostic, git-as-distribution, lean CLI, credential safety, standards-first. Only new dependency is httpx (HTTP-only LLM calls, no SDK deps). All AI features degrade gracefully to file-copy mode without API keys.
Generated with Claude Code