AIハーネスとは何か：Skills、Context、Hooks、PermissionsでAIを制御するオーケストレーションアーキテクチャ

You are Claude Code, Anthropic's official CLI for Claude.
Given the user's message, you should use the tools available
to complete the task.

Your strengths:
- Searching for code across large codebases
- Analyzing multiple files to understand architecture
- Investigating complex questions
- Performing multi-step research tasks

Guidelines:
- For file searches: search broadly when you don't know
  where something lives
- NEVER create files unless absolutely necessary
- ALWAYS prefer editing existing files

# 良いシステムプロンプトの構造

## 1. 役割宣言 (Who)
あなたはシニアバックエンドエンジニアです。
Java/Spring Boot専門で、10年以上の経験があります。

## 2. 行動ルール (How)
- コードレビュー時はセキュリティ脆弱性を最優先で確認してください
- パフォーマンスの問題がある場合はBig-O分析とともに指摘してください
- 改善提案は必ずコード例とともに提示してください

## 3. 制約事項 (Boundaries)
- コードを直接修正しないでください、提案のみしてください
- 外部ライブラリの追加を推奨しないでください
- 既存のアーキテクチャパターンに従ってください

## 4. 出力形式 (Format)
レビュー結果は以下の形式で作成してください：
- [深刻度]: 説明 + 提案

You are a senior code reviewer specializing in security
and performance. Review every PR with these priorities:
1. Security vulnerabilities (SQL injection, XSS, CSRF)
2. Performance bottlenecks (N+1 queries, memory leaks)
3. Code maintainability (naming, structure, SOLID)
Never approve code with critical security issues.

You are a data analyst with expertise in Python, SQL,
and statistical analysis. When analyzing data:
1. Always validate data quality first
2. Provide confidence intervals for estimates
3. Visualize results with appropriate charts
4. Explain findings in business-friendly language

{
  "name": "read_file",
  "description": "Reads a file from the local filesystem. Supports text files, images, and PDFs.",
  "input_schema": {
    "type": "object",
    "properties": {
      "file_path": {
        "type": "string",
        "description": "The absolute path to the file to read"
      },
      "offset": {
        "type": "number",
        "description": "The line number to start reading from"
      },
      "limit": {
        "type": "number",
        "description": "The number of lines to read"
      }
    },
    "required": ["file_path"]
  }
}

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_TOKEN": "ghp_xxxxxxxxxxxx"
      }
    },
    "postgres": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres"],
      "env": {
        "DATABASE_URL": "postgresql://user:pass@localhost/db"
      }
    }
  }
}

# Project Guidelines

## Build Commands

- npm run dev: 開発サーバー起動
- npm run build: プロダクションビルド
- npm test: テスト実行

## Code Conventions

- TypeScript strict mode使用
- 関数コンポーネントのみ使用（クラスコンポーネント禁止）
- CSS-in-JSの代わりにTailwind CSSを使用

## Architecture

- src/components: 再利用可能なUIコンポーネント
- src/hooks: カスタムフック
- src/lib: ユーティリティ関数
- src/app: Next.js App Routerページ

プロジェクト構造分析：
- package.json → 依存関係、スクリプト
- tsconfig.json → TypeScript設定
- .eslintrc → コードスタイルルール
- .gitignore → 除外ファイルパターン
- ディレクトリ構造 → アーキテクチャパターンの推論

.remember/
  core-memories.md   # プロジェクトの核心情報
  now.md             # 現在の作業状態
  today.md           # 今日の作業記録
  recent.md          # 最近の作業履歴
  archive.md         # 古い記録のアーカイブ

---
trigger: 'when user asks to review a PR'
description: 'Comprehensive code review workflow'
---

# Code Review Skill

## Step 1: Gather Information

- Read the PR description and diff
- Identify changed files and their purposes
- Check the PR against project conventions (CLAUDE.md)

## Step 2: Security Review

- Check for SQL injection, XSS, CSRF vulnerabilities
- Verify input validation on all user inputs
- Ensure secrets are not hardcoded

## Step 3: Performance Review

- Identify N+1 query patterns
- Check for unnecessary re-renders (React)
- Verify proper indexing for DB queries

## Step 4: Generate Review

- Use structured format: severity + description + suggestion
- Include code examples for each suggestion
- Summarize with overall assessment

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Write|Edit",
        "command": "echo 'File modification detected'"
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "command": "/bin/sh -c 'cd PROJECT_DIR && npx eslint --fix FILE_PATH 2>/dev/null || true'"
      },
      {
        "matcher": "Bash",
        "command": "/bin/sh -c 'if echo TOOL_INPUT | grep -q \"git commit\"; then cd PROJECT_DIR && npm test; fi'"
      }
    ],
    "Notification": [
      {
        "matcher": "",
        "command": "/bin/sh -c 'echo NOTIFICATION_CONTENT >> /tmp/ai-notifications.log'"
      }
    ]
  }
}

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write",
        "command": "/bin/sh -c 'npx prettier --write FILE_PATH'"
      }
    ]
  }
}

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "command": "/bin/sh -c 'if echo TOOL_INPUT | grep -q \"git commit\"; then npm test || exit 1; fi'"
      }
    ]
  }
}

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "command": "/bin/sh -c 'if echo TOOL_INPUT | grep -qE \"rm -rf|drop table|format\"; then echo \"BLOCKED: Dangerous command detected\" && exit 1; fi'"
      }
    ]
  }
}

{
  "permissions": {
    "allowedTools": [
      "Read",
      "Glob",
      "Grep",
      "Bash(git status)",
      "Bash(git diff)",
      "Bash(npm test)"
    ],
    "disallowedTools": [
      "Bash(rm *)",
      "Bash(sudo *)",
      "Bash(curl * | sh)",
      "Write(/etc/*)",
      "Write(/usr/*)"
    ]
  }
}

# core-memories.md

- このプロジェクトはNext.js 14 + TypeScript + Tailwind CSSを使用しています
- デプロイはVercelで行います
- DBはPostgreSQL（Supabase）です

# now.md

現在のタスク：ユーザー認証モジュールのリファクタリング中
進捗：NextAuth.jsからLucia Authへの移行進行中
ブロッカー：ソーシャルログインのコールバックURL設定の問題

# today.md

- 09:30 認証モジュル分析完了
- 10:15 Lucia Auth設定ファイル作成
- 11:00 セッション管理ロジック移行
- 14:00 ソーシャルログイン統合開始

エージェントループの流れ：

1. User Input（ユーザーリクエスト）
      |
2. System Prompt + Contextのロード
      |
3. LLM推論（どのアクションを取るか決定）
      |
4. Tool Call決定
      |
5. Hook（PreToolUse）実行
      |  （検証失敗時 → 3に戻る）
      |
6. Tool実行
      |
7. Hook（PostToolUse）実行
      |
8. 結果の観察（Observation）
      |
9. 追加アクションが必要？ → Yes → 3に戻る
      |                       No
      |
10. 最終応答の生成

Turn 1: git diff実行（Bashツール）
   → 変更されたファイルリストとdiffを取得

Turn 2: 変更されたファイルを読み取り（Readツール）
   → 全体コンテキストの把握

Turn 3: CLAUDE.mdを読み取り（Readツール）
   → プロジェクト規約の確認

Turn 4: 関連テストファイルの検索（Grepツール）
   → テストカバレッジの確認

Turn 5: npm test実行（Bashツール）
   → テスト合格の確認

Turn 6: レビュー結果の生成（最終応答）
   → セキュリティ、パフォーマンス、保守性の観点からレビュー

メインエージェント（Orchestrator）
    |
    +--- サブエージェントA：「src/ディレクトリの分析」
    |       （独立コンテキスト、ファイル読み取り/検索ツール）
    |
    +--- サブエージェントB：「tests/ディレクトリの分析」
    |       （独立コンテキスト、テスト実行ツール）
    |
    +--- サブエージェントC：「ドキュメント更新」
            （独立コンテキスト、ファイル書き込みツール）

メインエージェント：各サブエージェントの結果を統合して最終応答を生成

メインプロジェクト（mainブランチ）
    |
    +--- .claude/worktrees/feature-auth/
    |       （独立ブランチ、独立作業ディレクトリ）
    |
    +--- .claude/worktrees/fix-bug-123/
            （独立ブランチ、独立作業ディレクトリ）

設定場所（優先順位順）：
1. プロジェクト/.claude/settings.json（最優先）
2. ホームディレクトリ/.claude/settings.json（グローバル）
3. デフォルト値

{
  "permissions": {
    "allowedTools": ["Read", "Glob", "Grep"],
    "disallowedTools": ["Bash(rm *)"]
  },
  "hooks": {
    "PreToolUse": [],
    "PostToolUse": [],
    "Notification": [],
    "Stop": []
  },
  "env": {
    "NODE_ENV": "development",
    "DEBUG": "true"
  },
  "model": "claude-sonnet-4-20250514",
  "theme": "dark"
}

最も高い ← プロジェクト設定 ← グローバル設定 ← デフォルト値 → 最も低い

import anthropic
from typing import Any

# Anthropicクライアントの初期化
client = anthropic.Anthropic()

# ツール定義
tools = [
    {
        "name": "read_file",
        "description": "Read the contents of a file at the given path",
        "input_schema": {
            "type": "object",
            "properties": {
                "path": {
                    "type": "string",
                    "description": "Absolute file path to read"
                }
            },
            "required": ["path"]
        }
    },
    {
        "name": "list_directory",
        "description": "List files and directories at the given path",
        "input_schema": {
            "type": "object",
            "properties": {
                "path": {
                    "type": "string",
                    "description": "Directory path to list"
                }
            },
            "required": ["path"]
        }
    },
    {
        "name": "search_code",
        "description": "Search for a pattern in the codebase",
        "input_schema": {
            "type": "object",
            "properties": {
                "pattern": {
                    "type": "string",
                    "description": "Regex pattern to search for"
                },
                "file_type": {
                    "type": "string",
                    "description": "File extension filter (e.g., py, ts)"
                }
            },
            "required": ["pattern"]
        }
    }
]


def execute_tool(name: str, input_data: dict) -> str:
    """ツールを実行して結果を返します。"""
    import os
    import subprocess

    if name == "read_file":
        try:
            with open(input_data["path"], "r") as f:
                return f.read()
        except FileNotFoundError:
            return f"Error: File not found: {input_data['path']}"

    elif name == "list_directory":
        try:
            entries = os.listdir(input_data["path"])
            return "\n".join(entries)
        except FileNotFoundError:
            return f"Error: Directory not found: {input_data['path']}"

    elif name == "search_code":
        try:
            cmd = ["grep", "-rn", input_data["pattern"], "."]
            if "file_type" in input_data:
                cmd.extend(["--include", f"*.{input_data['file_type']}"])
            result = subprocess.run(cmd, capture_output=True, text=True)
            return result.stdout or "No matches found"
        except Exception as e:
            return f"Error: {str(e)}"

    return f"Unknown tool: {name}"


def run_agent(user_message: str, max_turns: int = 10) -> str:
    """エージェントループを実行します。"""
    system_prompt = """You are an expert code reviewer.
    Analyze code for security vulnerabilities, performance issues,
    and maintainability problems. Use the provided tools to
    explore the codebase before giving your review."""

    messages = [{"role": "user", "content": user_message}]

    for turn in range(max_turns):
        # LLM呼び出し
        response = client.messages.create(
            model="claude-sonnet-4-20250514",
            max_tokens=4096,
            system=system_prompt,
            tools=tools,
            messages=messages,
        )

        # 応答の処理
        if response.stop_reason == "end_turn":
            for block in response.content:
                if hasattr(block, "text"):
                    return block.text
            return "Agent completed without text response"

        # ツール呼び出しの処理
        if response.stop_reason == "tool_use":
            messages.append({
                "role": "assistant",
                "content": response.content,
            })

            tool_results = []
            for block in response.content:
                if block.type == "tool_use":
                    result = execute_tool(block.name, block.input)
                    tool_results.append({
                        "type": "tool_result",
                        "tool_use_id": block.id,
                        "content": result,
                    })

            messages.append({
                "role": "user",
                "content": tool_results,
            })

    return "Agent reached maximum turns without completing"


# 実行
if __name__ == "__main__":
    review = run_agent("Review the authentication module in src/auth/")
    print(review)

class PermissionModel:
    """AIエージェントの権限を管理します。"""

    def __init__(self):
        self.allowed_paths = ["/project/src/", "/project/tests/"]
        self.blocked_commands = ["rm", "sudo", "chmod"]
        self.max_file_size = 1_000_000  # 1MB

    def check_file_access(self, path: str) -> bool:
        """ファイルアクセス権限を確認します。"""
        return any(path.startswith(p) for p in self.allowed_paths)

    def check_command(self, command: str) -> bool:
        """コマンド実行権限を確認します。"""
        return not any(cmd in command for cmd in self.blocked_commands)

    def validate_tool_call(self, tool_name: str, input_data: dict) -> tuple:
        """ツール呼び出しの有効性を検証します。
        Returns (is_allowed, reason)"""
        if tool_name == "read_file":
            path = input_data.get("path", "")
            if not self.check_file_access(path):
                return False, f"Access denied: {path}"

        if tool_name == "execute_command":
            cmd = input_data.get("command", "")
            if not self.check_command(cmd):
                return False, f"Blocked command: {cmd}"

        return True, "Allowed"

import time
from dataclasses import dataclass, field
from typing import Optional


@dataclass
class AgentEvent:
    """エージェントの行動を記録するイベントです。"""
    event_type: str  # tool_call, tool_result, llm_response, error
    timestamp: float = field(default_factory=time.time)
    tool_name: Optional[str] = None
    input_data: Optional[dict] = None
    output_data: Optional[str] = None
    tokens_used: int = 0
    duration_ms: float = 0


class AgentMonitor:
    """エージェントの行動を監視します。"""

    def __init__(self):
        self.events: list[AgentEvent] = []
        self.total_tokens = 0
        self.total_cost = 0.0

    def log_event(self, event: AgentEvent):
        self.events.append(event)
        self.total_tokens += event.tokens_used

    def get_summary(self) -> dict:
        return {
            "total_events": len(self.events),
            "total_tokens": self.total_tokens,
            "tool_calls": sum(
                1 for e in self.events if e.event_type == "tool_call"
            ),
            "errors": sum(
                1 for e in self.events if e.event_type == "error"
            ),
            "total_duration_ms": sum(
                e.duration_ms for e in self.events
            ),
        }

import Anthropic from '@anthropic-ai/sdk'

// ツール定義
const tools: Anthropic.Tool[] = [
  {
    name: 'query_database',
    description: 'Execute a SQL query against the analytics database',
    input_schema: {
      type: 'object' as const,
      properties: {
        query: {
          type: 'string',
          description: 'SQL query to execute (SELECT only)',
        },
        database: {
          type: 'string',
          description: 'Database name',
          enum: ['analytics', 'users', 'products'],
        },
      },
      required: ['query', 'database'],
    },
  },
  {
    name: 'create_chart',
    description: 'Create a data visualization chart',
    input_schema: {
      type: 'object' as const,
      properties: {
        chart_type: {
          type: 'string',
          enum: ['bar', 'line', 'pie', 'scatter'],
        },
        data: {
          type: 'string',
          description: 'JSON string of chart data',
        },
        title: {
          type: 'string',
          description: 'Chart title',
        },
      },
      required: ['chart_type', 'data', 'title'],
    },
  },
]

// 権限モデル
class QueryPermissions {
  private readonly blockedPatterns = [
    /DROP\s/i,
    /DELETE\s/i,
    /UPDATE\s/i,
    /INSERT\s/i,
    /ALTER\s/i,
    /TRUNCATE\s/i,
  ]

  validateQuery(query: string): { allowed: boolean; reason: string } {
    for (const pattern of this.blockedPatterns) {
      if (pattern.test(query)) {
        return {
          allowed: false,
          reason: 'Blocked: destructive operation detected',
        }
      }
    }
    return { allowed: true, reason: 'Query is safe' }
  }
}

// ツール実行
async function executeTool(name: string, input: Record<string, unknown>): Promise<string> {
  const permissions = new QueryPermissions()

  if (name === 'query_database') {
    const query = input.query as string
    const validation = permissions.validateQuery(query)
    if (!validation.allowed) {
      return `Permission denied: ${validation.reason}`
    }
    // シミュレーションされたDBクエリ
    return JSON.stringify({
      columns: ['date', 'revenue', 'users'],
      rows: [
        ['2025-01', 150000, 12000],
        ['2025-02', 165000, 13500],
        ['2025-03', 180000, 15000],
      ],
    })
  }

  if (name === 'create_chart') {
    return `Chart created: ${input.title} (${input.chart_type})`
  }

  return `Unknown tool: ${name}`
}

// エージェントループ
async function runDataAnalysisAgent(question: string): Promise<string> {
  const client = new Anthropic()

  const systemPrompt = `You are a data analyst agent.
    Analyze data by querying databases and creating visualizations.
    Always validate data before making conclusions.
    Provide insights in clear, business-friendly language.`

  const messages: Anthropic.MessageParam[] = [{ role: 'user', content: question }]

  const maxTurns = 10

  for (let turn = 0; turn < maxTurns; turn++) {
    const response = await client.messages.create({
      model: 'claude-sonnet-4-20250514',
      max_tokens: 4096,
      system: systemPrompt,
      tools,
      messages,
    })

    if (response.stop_reason === 'end_turn') {
      for (const block of response.content) {
        if (block.type === 'text') {
          return block.text
        }
      }
      return 'Agent completed'
    }

    if (response.stop_reason === 'tool_use') {
      messages.push({
        role: 'assistant',
        content: response.content,
      })

      const toolResults: Anthropic.ToolResultBlockParam[] = []
      for (const block of response.content) {
        if (block.type === 'tool_use') {
          const result = await executeTool(block.name, block.input as Record<string, unknown>)
          toolResults.push({
            type: 'tool_result',
            tool_use_id: block.id,
            content: result,
          })
        }
      }

      messages.push({
        role: 'user',
        content: toolResults,
      })
    }
  }

  return 'Agent reached maximum turns'
}

// 実行
async function main() {
  const result = await runDataAnalysisAgent('What was the revenue trend in Q1 2025?')
  console.log(result)
}

main().catch(console.error)

from langgraph.graph import StateGraph, END
from typing import TypedDict


class ReviewState(TypedDict):
    code_diff: str
    security_issues: list
    performance_issues: list
    review_summary: str


def analyze_security(state: ReviewState) -> ReviewState:
    """セキュリティ脆弱性を分析します。"""
    state["security_issues"] = ["SQL injection in login.py:42"]
    return state


def analyze_performance(state: ReviewState) -> ReviewState:
    """パフォーマンスの問題を分析します。"""
    state["performance_issues"] = ["N+1 query in users.py:87"]
    return state


def generate_review(state: ReviewState) -> ReviewState:
    """最終レビューを生成します。"""
    issues = state["security_issues"] + state["performance_issues"]
    state["review_summary"] = f"Found {len(issues)} issues"
    return state


# グラフの構成
workflow = StateGraph(ReviewState)
workflow.add_node("security", analyze_security)
workflow.add_node("performance", analyze_performance)
workflow.add_node("review", generate_review)

workflow.set_entry_point("security")
workflow.add_edge("security", "performance")
workflow.add_edge("performance", "review")
workflow.add_edge("review", END)

app = workflow.compile()

from crewai import Agent, Task, Crew

security_reviewer = Agent(
    role="Security Reviewer",
    goal="Find all security vulnerabilities in the code",
    backstory="You are a senior security engineer with 15 years "
              "of experience in application security.",
    tools=[],
)

performance_reviewer = Agent(
    role="Performance Reviewer",
    goal="Identify performance bottlenecks and optimization opportunities",
    backstory="You are a performance engineering specialist "
              "who has optimized systems serving millions of users.",
    tools=[],
)

review_task = Task(
    description="Review the authentication module for security issues",
    agent=security_reviewer,
    expected_output="List of security vulnerabilities with severity ratings",
)

crew = Crew(
    agents=[security_reviewer, performance_reviewer],
    tasks=[review_task],
)

result = crew.kickoff()

ユーザー入力
    |
    v
[Router Agent] → 「コードレビュー依頼」 → Code Review Agent
               → 「データ分析依頼」     → Data Analysis Agent
               → 「ドキュメント作成依頼」 → Documentation Agent
               → 「一般的な質問」       → General Assistant

[Orchestrator]
    |
    +--- 「ファイルAをレビュー」 → [Worker 1] → 結果A
    |
    +--- 「ファイルBをレビュー」 → [Worker 2] → 結果B
    |
    +--- 「ファイルCをレビュー」 → [Worker 3] → 結果C
    |
    v
[Orchestrator] → 結果A + B + Cを統合 → 最終レビュー

[分析Agent] → コード分析結果
    |
    v
[計画Agent] → リファクタリング計画
    |
    v
[実行Agent] → コード修正
    |
    v
[検証Agent] → テスト実行 + 結果確認

[Generator Agent] → 初稿の生成
    |
    v
[Evaluator Agent] → 品質評価（1-10点）
    |
    +--- スコア >= 8 → 完了
    |
    +--- スコア < 8 → フィードバックとともにGeneratorに再依頼
                         |
                         v
                    [Generator Agent] → 修正版の生成
                         |
                         v
                    [Evaluator Agent] → 再評価
                         ...

ユーザー入力
    |
    v
[Input Guardrail] → 有害コンテンツのフィルタリング
    |                 プロンプトインジェクション検知
    |                 入力の正規化
    v
[AI Agent] → タスクの実行
    |
    v
[Output Guardrail] → PIIマスキング
    |                  幻覚（ハルシネーション）の検知
    |                  フォーマット検証
    v
最終応答

class InputGuardrail:
    """入力を検証して浄化します。"""

    def validate(self, user_input: str) -> tuple:
        # プロンプトインジェクションの検知
        injection_patterns = [
            "ignore previous instructions",
            "system prompt",
            "you are now",
            "disregard all",
        ]
        for pattern in injection_patterns:
            if pattern.lower() in user_input.lower():
                return False, "Potential prompt injection detected"

        # 入力長の制限
        if len(user_input) > 10000:
            return False, "Input too long"

        return True, "Valid input"


class OutputGuardrail:
    """出力を検証して浄化します。"""

    def validate(self, output: str) -> str:
        # PIIマスキング
        import re
        # メールアドレスのマスキング
        output = re.sub(
            r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}",
            "[EMAIL_REDACTED]",
            output,
        )
        # 電話番号のマスキング
        output = re.sub(
            r"\b\d{3}[-.]?\d{4}[-.]?\d{4}\b",
            "[PHONE_REDACTED]",
            output,
        )
        return output

code-review-harness/
  src/
    agent.py          # エージェントループ
    tools.py           # ツール定義と実行
    permissions.py     # 権限モデル
    guardrails.py      # 入出力検証
    memory.py          # 記憶管理
    monitor.py         # モニタリング
  skills/
    code-review.md     # コードレビュースキル
    security-audit.md  # セキュリティ監査スキル
  config/
    settings.json      # 設定ファイル
  tests/
    test_agent.py      # エージェントテスト
  README.md
  requirements.txt

You are an expert code reviewer specializing in Python
and TypeScript applications.

## Your Responsibilities
1. Security: Find vulnerabilities (injection, XSS, auth issues)
2. Performance: Identify bottlenecks (N+1 queries, memory leaks)
3. Maintainability: Check code quality (naming, structure, SOLID)
4. Testing: Verify test coverage and quality

## Rules
- NEVER modify code directly. Only suggest changes.
- Always explain WHY something is an issue, not just WHAT.
- Provide code examples for every suggestion.
- Rate issues by severity: Critical, High, Medium, Low.

## Output Format
For each issue found:
[SEVERITY] file:line - Description
Suggestion: How to fix it
Example: Code snippet showing the fix

# tools.py
import subprocess
import os


def git_diff(base_branch: str = "main") -> str:
    """現在のブランチとベースブランチのdiffを取得します。"""
    result = subprocess.run(
        ["git", "diff", f"{base_branch}...HEAD"],
        capture_output=True,
        text=True,
    )
    return result.stdout


def read_file(path: str) -> str:
    """ファイルの内容を行番号付きで読み取ります。"""
    try:
        with open(path, "r") as f:
            lines = f.readlines()
        numbered = [f"{i+1}: {line}" for i, line in enumerate(lines)]
        return "".join(numbered)
    except FileNotFoundError:
        return f"File not found: {path}"


def search_pattern(pattern: str, directory: str = ".") -> str:
    """コードベースでパターンを検索します。"""
    result = subprocess.run(
        ["grep", "-rn", pattern, directory,
         "--include=*.py", "--include=*.ts",
         "--include=*.tsx", "--include=*.js"],
        capture_output=True,
        text=True,
    )
    return result.stdout or "No matches found"


def run_tests(test_path: str = "") -> str:
    """テストスイートを実行します。"""
    cmd = ["python", "-m", "pytest", "-v"]
    if test_path:
        cmd.append(test_path)
    result = subprocess.run(cmd, capture_output=True, text=True)
    return f"STDOUT:\n{result.stdout}\nSTDERR:\n{result.stderr}"


def get_file_history(path: str, count: int = 5) -> str:
    """ファイルのgit履歴を取得します。"""
    result = subprocess.run(
        ["git", "log", f"-{count}", "--oneline", "--", path],
        capture_output=True,
        text=True,
    )
    return result.stdout

# skills/code-review.md

---

trigger: "when user asks to review code or a PR"
description: "Comprehensive code review workflow"

---

## Code Review Workflow

### Step 1: Gather Context

1. Run git diff to see all changes
2. Read the changed files completely
3. Check project conventions (CLAUDE.md, .eslintrc)
4. Identify the purpose of the changes

### Step 2: Security Analysis

Check for these common vulnerabilities:

- SQL injection (raw queries, string interpolation)
- XSS (unescaped user input in HTML)
- Authentication issues (weak tokens, missing checks)
- Authorization issues (missing role checks)
- Sensitive data exposure (API keys, passwords in code)

### Step 3: Performance Analysis

Check for these common issues:

- N+1 database queries
- Missing database indexes
- Unnecessary re-renders (React)
- Memory leaks (unclosed resources)
- Blocking operations in async code

### Step 4: Code Quality Analysis

Check for these issues:

- Unclear naming conventions
- Functions exceeding 50 lines
- Missing error handling
- Duplicated code
- SOLID principle violations

### Step 5: Generate Review Report

Format each issue as:
[SEVERITY] file:line - Description
Use severity levels: Critical, High, Medium, Low, Info

# permissions.py

class ReviewPermissions:
    """コードレビューエージェントの権限を定義します。"""

    # 読み取り専用 - コード修正不可
    ALLOWED_TOOLS = [
        "git_diff",
        "read_file",
        "search_pattern",
        "run_tests",
        "get_file_history",
    ]

    BLOCKED_TOOLS = [
        "write_file",
        "delete_file",
        "execute_command",
        "deploy",
    ]

    ALLOWED_PATHS = [
        "src/",
        "tests/",
        "lib/",
        "config/",
    ]

    BLOCKED_PATHS = [
        ".env",
        "secrets/",
        "credentials/",
        ".git/",
    ]

    def is_tool_allowed(self, tool_name: str) -> bool:
        if tool_name in self.BLOCKED_TOOLS:
            return False
        return tool_name in self.ALLOWED_TOOLS

    def is_path_allowed(self, path: str) -> bool:
        for blocked in self.BLOCKED_PATHS:
            if blocked in path:
                return False
        return any(path.startswith(p) for p in self.ALLOWED_PATHS)

def evaluate_review_quality(
    original_code: str,
    review_output: str,
    evaluator_model: str = "claude-sonnet-4-20250514"
) -> dict:
    """LLMを使用してコードレビュー品質を評価します。"""
    evaluation_prompt = f"""
    Evaluate this code review on a scale of 1-10 for each criterion:

    1. Accuracy: Are the identified issues real problems?
    2. Completeness: Were important issues missed?
    3. Actionability: Are suggestions specific and implementable?
    4. Communication: Is the review clear and constructive?

    Original Code:
    {original_code}

    Review Output:
    {review_output}

    Respond in JSON format:
    accuracy, completeness, actionability, communication, overall, feedback
    """

    # LLMを呼び出して評価を実行
    # ...（実際のAPI呼び出しコード）
    return evaluation_result

class CostTracker:
    """エージェントのAPI呼び出しコストを追跡します。"""

    PRICING = {
        "claude-sonnet-4-20250514": {
            "input": 0.003 / 1000,
            "output": 0.015 / 1000,
        },
        "claude-opus-4-20250514": {
            "input": 0.015 / 1000,
            "output": 0.075 / 1000,
        },
    }

    def __init__(self):
        self.total_input_tokens = 0
        self.total_output_tokens = 0
        self.model = "claude-sonnet-4-20250514"

    def add_usage(self, input_tokens: int, output_tokens: int):
        self.total_input_tokens += input_tokens
        self.total_output_tokens += output_tokens

    def get_total_cost(self) -> float:
        pricing = self.PRICING[self.model]
        return (
            self.total_input_tokens * pricing["input"]
            + self.total_output_tokens * pricing["output"]
        )

    def get_report(self) -> str:
        cost = self.get_total_cost()
        return (
            f"Input tokens: {self.total_input_tokens:,}\n"
            f"Output tokens: {self.total_output_tokens:,}\n"
            f"Total cost: ${cost:.4f}"
        )