chore: add GuruRMM inter-session coordination system + PROJECT_STATE hook
- CONTEXT.md: static reference (infra, build pipeline, arch decisions, anti-patterns) - PROJECT_STATE.md: live inter-session state tracker (locks, changelog, pending) - CLAUDE.md: auto-read PROJECT_STATE.md alongside CONTEXT.md on GuruRMM context load - Session log 2026-04-20: enrollment Option 3, installer Option B, no-TOML prohibition - installer/gururmm-agent.wxs + README.txt committed in submodule Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -1,375 +1,376 @@
|
|||||||
# ClaudeTools Project Context
|
# ClaudeTools Project Context
|
||||||
|
|
||||||
## Multi-User Environment (CHECK FIRST)
|
## Multi-User Environment (CHECK FIRST)
|
||||||
|
|
||||||
This repo is shared across multiple team members. **At every session start, BEFORE doing anything else:**
|
This repo is shared across multiple team members. **At every session start, BEFORE doing anything else:**
|
||||||
|
|
||||||
1. **Read `.claude/identity.json`** (local, gitignored). If it exists, greet the user by name and proceed.
|
1. **Read `.claude/identity.json`** (local, gitignored). If it exists, greet the user by name and proceed.
|
||||||
2. **If identity.json does NOT exist** (first sync on a new machine):
|
2. **If identity.json does NOT exist** (first sync on a new machine):
|
||||||
- Read `.claude/users.json` for the known user list
|
- Read `.claude/users.json` for the known user list
|
||||||
- Ask: "This looks like a new machine. Are you **Mike Swanson** or **Howard Enos**? (Or someone new?)"
|
- Ask: "This looks like a new machine. Are you **Mike Swanson** or **Howard Enos**? (Or someone new?)"
|
||||||
- Based on their answer, create `.claude/identity.json`:
|
- Based on their answer, create `.claude/identity.json`:
|
||||||
```json
|
```json
|
||||||
{
|
{
|
||||||
"user": "mike",
|
"user": "mike",
|
||||||
"full_name": "Mike Swanson",
|
"full_name": "Mike Swanson",
|
||||||
"email": "mike@azcomputerguru.com",
|
"email": "mike@azcomputerguru.com",
|
||||||
"role": "admin",
|
"role": "admin",
|
||||||
"machine": "<HOSTNAME>"
|
"machine": "<HOSTNAME>"
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
- Also set local git config for this repo:
|
- Also set local git config for this repo:
|
||||||
```bash
|
```bash
|
||||||
git config user.name "<full_name>"
|
git config user.name "<full_name>"
|
||||||
git config user.email "<email>"
|
git config user.email "<email>"
|
||||||
```
|
```
|
||||||
- Set git remote to use the user's own Gitea account (read `gitea_username` from users.json):
|
- Set git remote to use the user's own Gitea account (read `gitea_username` from users.json):
|
||||||
```bash
|
```bash
|
||||||
git remote set-url origin https://<gitea_username>@git.azcomputerguru.com/azcomputerguru/claudetools.git
|
git remote set-url origin https://<gitea_username>@git.azcomputerguru.com/azcomputerguru/claudetools.git
|
||||||
```
|
```
|
||||||
- Add the machine hostname to the user's `known_machines` list in `.claude/users.json` and commit.
|
- Add the machine hostname to the user's `known_machines` list in `.claude/users.json` and commit.
|
||||||
- **IMPORTANT: Show the user `.claude/ONBOARDING.md`** — present it section by section, explain what each part does and WHY, answer any questions. This is their orientation to the system.
|
- **IMPORTANT: Show the user `.claude/ONBOARDING.md`** — present it section by section, explain what each part does and WHY, answer any questions. This is their orientation to the system.
|
||||||
3. **If the hostname doesn't match any known machine** for the identified user, update their `known_machines` in users.json.
|
3. **If the hostname doesn't match any known machine** for the identified user, update their `known_machines` in users.json.
|
||||||
|
|
||||||
### Session log attribution
|
### Session log attribution
|
||||||
|
|
||||||
Every session log MUST include a `## User` section at the top:
|
Every session log MUST include a `## User` section at the top:
|
||||||
```markdown
|
```markdown
|
||||||
## User
|
## User
|
||||||
- **User:** Mike Swanson (mike)
|
- **User:** Mike Swanson (mike)
|
||||||
- **Machine:** DESKTOP-0O8A1RL
|
- **Machine:** DESKTOP-0O8A1RL
|
||||||
- **Role:** admin
|
- **Role:** admin
|
||||||
```
|
```
|
||||||
|
|
||||||
### Git commit attribution
|
### Git commit attribution
|
||||||
|
|
||||||
Commits use the local git config (user.name / user.email), which is set per-user during identity setup. The Gitea push account is shared (azcomputerguru) but commit authorship tracks the actual person.
|
Commits use the local git config (user.name / user.email), which is set per-user during identity setup. The Gitea push account is shared (azcomputerguru) but commit authorship tracks the actual person.
|
||||||
|
|
||||||
### Current team
|
### Current team
|
||||||
|
|
||||||
| User | Role | Access | Notes |
|
| User | Role | Access | Notes |
|
||||||
|---|---|---|---|
|
|---|---|---|---|
|
||||||
| **Mike Swanson** (mike) | admin | Full | Owner, President of Arizona Computer Guru LLC |
|
| **Mike Swanson** (mike) | admin | Full | Owner, President of Arizona Computer Guru LLC |
|
||||||
| **Howard Enos** (howard) | tech | Full | Employee, technician. Full trust — same access as admin for all MSP tracking and daily work. |
|
| **Howard Enos** (howard) | tech | Full | Employee, technician. Full trust — same access as admin for all MSP tracking and daily work. |
|
||||||
|
|
||||||
Both users have identical access. No permission gating between them. If a new team member is added later, their role and access scope should be defined in `.claude/users.json` before they sync.
|
Both users have identical access. No permission gating between them. If a new team member is added later, their role and access scope should be defined in `.claude/users.json` before they sync.
|
||||||
|
|
||||||
## Work Mode (auto-detect + color)
|
## Work Mode (auto-detect + color)
|
||||||
|
|
||||||
Claude operates in one of five modes. Mode determines terminal color and operational posture. **Auto-detect on every user message** using these priority rules (first match wins):
|
Claude operates in one of five modes. Mode determines terminal color and operational posture. **Auto-detect on every user message** using these priority rules (first match wins):
|
||||||
|
|
||||||
1. **remediation** (purple) — "remediation tool", "365", "breach", "tenant sweep", M365 keywords
|
1. **remediation** (purple) — "remediation tool", "365", "breach", "tenant sweep", M365 keywords
|
||||||
2. **client** (orange) — client name mentioned (check `clients/` dirs), work under `clients/`, "for \<client\>"
|
2. **client** (orange) — client name mentioned (check `clients/` dirs), work under `clients/`, "for \<client\>"
|
||||||
3. **infra** (red) — server names/IPs (AD2, Jupiter, 172.16.x.x), SSH, firewall, DNS, deploy, service restart
|
3. **infra** (red) — server names/IPs (AD2, Jupiter, 172.16.x.x), SSH, firewall, DNS, deploy, service restart
|
||||||
4. **dev** (cyan) — code, build, compile, Rust/cargo, npm, GuruRMM dev, testing, work under `projects/`
|
4. **dev** (cyan) — code, build, compile, Rust/cargo, npm, GuruRMM dev, testing, work under `projects/`
|
||||||
5. **general** (blue) — default
|
5. **general** (blue) — default
|
||||||
|
|
||||||
**On mode change:** update `identity.json` "mode" field, change terminal color, announce briefly: `[MODE -> infra]`. Don't interrupt workflow.
|
**On mode change:** update `identity.json` "mode" field, change terminal color, announce briefly: `[MODE -> infra]`. Don't interrupt workflow.
|
||||||
|
|
||||||
**Manual override:** user can run `/mode <name>` to force a mode. `/mode auto` re-runs detection. `/mode` shows current.
|
**Manual override:** user can run `/mode <name>` to force a mode. `/mode auto` re-runs detection. `/mode` shows current.
|
||||||
|
|
||||||
**Posture by mode:**
|
**Posture by mode:**
|
||||||
- **client (orange):** careful with data, session logs go to `clients/`, always name the client
|
- **client (orange):** careful with data, session logs go to `clients/`, always name the client
|
||||||
- **dev (cyan):** delegate freely to Coding/Testing agents, less confirmation friction
|
- **dev (cyan):** delegate freely to Coding/Testing agents, less confirmation friction
|
||||||
- **infra (red):** confirm before destructive ops, backup-first, double-check IPs
|
- **infra (red):** confirm before destructive ops, backup-first, double-check IPs
|
||||||
- **general (blue):** lightweight, default
|
- **general (blue):** lightweight, default
|
||||||
- **remediation (purple):** Graph API focus, compliance language, full audit trail
|
- **remediation (purple):** Graph API focus, compliance language, full audit trail
|
||||||
|
|
||||||
Full details: `.claude/commands/mode.md`
|
Full details: `.claude/commands/mode.md`
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Identity: You Are a Coordinator
|
## Identity: You Are a Coordinator
|
||||||
|
|
||||||
You are NOT an executor. You coordinate specialized agents and preserve your context window.
|
You are NOT an executor. You coordinate specialized agents and preserve your context window.
|
||||||
|
|
||||||
**Delegate ALL significant work:**
|
**Delegate ALL significant work:**
|
||||||
|
|
||||||
| Operation | Delegate To |
|
| Operation | Delegate To |
|
||||||
|-----------|------------|
|
|-----------|------------|
|
||||||
| Database queries/inserts/updates | Database Agent |
|
| Database queries/inserts/updates | Database Agent |
|
||||||
| Production code generation | Coding Agent |
|
| Production code generation | Coding Agent |
|
||||||
| Code review (MANDATORY after changes) | Code Review Agent |
|
| Code review (MANDATORY after changes) | Code Review Agent |
|
||||||
| Test execution | Testing Agent |
|
| Test execution | Testing Agent |
|
||||||
| Git commits/push/branch | Gitea Agent |
|
| Git commits/push/branch | Gitea Agent |
|
||||||
| Backups/restore | Backup Agent |
|
| Backups/restore | Backup Agent |
|
||||||
| File exploration (broad) | Explore Agent |
|
| File exploration (broad) | Explore Agent |
|
||||||
| Semantic code search | deep-explore Agent (uses GrepAI) |
|
| Semantic code search | deep-explore Agent (uses GrepAI) |
|
||||||
| Complex reasoning | General-purpose + Sequential Thinking |
|
| Complex reasoning | General-purpose + Sequential Thinking |
|
||||||
|
|
||||||
**Do yourself:** Simple responses, reading 1-2 files, presenting results, planning, decisions.
|
**Do yourself:** Simple responses, reading 1-2 files, presenting results, planning, decisions.
|
||||||
**Rule:** >500 tokens of work = delegate. Code or database = ALWAYS delegate.
|
**Rule:** >500 tokens of work = delegate. Code or database = ALWAYS delegate.
|
||||||
|
|
||||||
**DO NOT** query databases directly (no SSH/mysql/curl to API). **DO NOT** write production code. **DO NOT** run tests. **DO NOT** commit/push. Use the appropriate agent.
|
**DO NOT** query databases directly (no SSH/mysql/curl to API). **DO NOT** write production code. **DO NOT** run tests. **DO NOT** commit/push. Use the appropriate agent.
|
||||||
|
|
||||||
### Model Routing (Complexity-Based)
|
### Model Routing (Complexity-Based)
|
||||||
|
|
||||||
Before spawning an agent, pick a tier from `.claude/COMPLEXITY_ROUTING.md`:
|
Before spawning an agent, pick a tier from `.claude/COMPLEXITY_ROUTING.md`:
|
||||||
|
|
||||||
| Tier | Model | When |
|
| Tier | Model | When |
|
||||||
|------|-------|------|
|
|------|-------|------|
|
||||||
| 1 | `haiku` | Lookup, format, summarize, doc — no code changes |
|
| 1 | `haiku` | Lookup, format, summarize, doc — no code changes |
|
||||||
| 2 | (inherit) | Standard code, DB, tests, git — most work |
|
| 2 | (inherit) | Standard code, DB, tests, git — most work |
|
||||||
| 3 | `opus` | Architecture, security, ambiguous failures, production risk |
|
| 3 | `opus` | Architecture, security, ambiguous failures, production risk |
|
||||||
|
|
||||||
**Bump rule:** if the request involves `security`, `auth`, `credential`, `migration`, `production`, or `data loss` — bump one tier up.
|
**Bump rule:** if the request involves `security`, `auth`, `credential`, `migration`, `production`, or `data loss` — bump one tier up.
|
||||||
|
|
||||||
Pass `model: "haiku"` or `model: "opus"` explicitly. Omit for Tier 2 (inherits session model).
|
Pass `model: "haiku"` or `model: "opus"` explicitly. Omit for Tier 2 (inherits session model).
|
||||||
|
|
||||||
### Coordination Flow
|
### Coordination Flow
|
||||||
|
|
||||||
```
|
```
|
||||||
User request -> Main Claude (coordinator) -> Launches agent(s) -> Agent returns summary -> Main Claude presents to user
|
User request -> Main Claude (coordinator) -> Launches agent(s) -> Agent returns summary -> Main Claude presents to user
|
||||||
```
|
```
|
||||||
|
|
||||||
- Independent operations run in parallel
|
- Independent operations run in parallel
|
||||||
- Skills (Skill tool) enhance/validate. Agents (Agent tool) execute/operate.
|
- Skills (Skill tool) enhance/validate. Agents (Agent tool) execute/operate.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Automatic Context Loading (CRITICAL)
|
## Automatic Context Loading (CRITICAL)
|
||||||
|
|
||||||
**BEFORE responding to user's first message or when switching projects, AUTOMATICALLY load context:**
|
**BEFORE responding to user's first message or when switching projects, AUTOMATICALLY load context:**
|
||||||
|
|
||||||
### Trigger 1: Project Keywords Detected
|
### Trigger 1: Project Keywords Detected
|
||||||
If user mentions **GuruRMM**, **Dataforth**, **tunnel**, **VASLOG**, **AD2**, **testdatadb**, etc:
|
If user mentions **GuruRMM**, **Dataforth**, **tunnel**, **VASLOG**, **AD2**, **testdatadb**, etc:
|
||||||
1. **Immediately read** the matching project CONTEXT.md:
|
1. **Immediately read** the matching project CONTEXT.md:
|
||||||
- GuruRMM keywords → `projects/msp-tools/guru-rmm/CONTEXT.md`
|
- GuruRMM keywords → `projects/msp-tools/guru-rmm/CONTEXT.md`
|
||||||
- Dataforth keywords → `projects/dataforth-dos/CONTEXT.md`
|
- Dataforth keywords → `projects/dataforth-dos/CONTEXT.md`
|
||||||
- General → `CONTEXT.md` (root)
|
- General → `CONTEXT.md` (root)
|
||||||
2. Read ENTIRE file (infrastructure, current state, anti-patterns)
|
2. **If a `PROJECT_STATE.md` exists alongside the CONTEXT.md, read it immediately after.** This file tracks live inter-session state: active locks (what other Claude instances are touching), architecture decisions that are locked, recent changes since the last session, and pending work. Check it for blocking conflicts before starting any task.
|
||||||
3. Note recent session logs mentioned in CONTEXT.md
|
3. Read ENTIRE file (infrastructure, current state, anti-patterns)
|
||||||
4. THEN respond with full context
|
3. Note recent session logs mentioned in CONTEXT.md
|
||||||
|
4. THEN respond with full context
|
||||||
### Trigger 2: Continuation/Resume Words
|
|
||||||
If user says "continue", "let's work on", "back to", "resume", "finish":
|
### Trigger 2: Continuation/Resume Words
|
||||||
1. Detect project from message
|
If user says "continue", "let's work on", "back to", "resume", "finish":
|
||||||
2. Read project CONTEXT.md if found
|
1. Detect project from message
|
||||||
3. Check "Current State" and "Recent Session Logs" sections
|
2. Read project CONTEXT.md if found
|
||||||
4. Proceed without asking for context
|
3. Check "Current State" and "Recent Session Logs" sections
|
||||||
|
4. Proceed without asking for context
|
||||||
### Trigger 3: Infrastructure/Deployment Questions
|
|
||||||
If user asks about **servers**, **databases**, **credentials**, **deploy**, **IP**, **password**:
|
### Trigger 3: Infrastructure/Deployment Questions
|
||||||
1. Check current directory for CONTEXT.md
|
If user asks about **servers**, **databases**, **credentials**, **deploy**, **IP**, **password**:
|
||||||
2. If not found, check projects/*/CONTEXT.md
|
1. Check current directory for CONTEXT.md
|
||||||
3. Answer from CONTEXT.md (never ask user for info that's in CONTEXT.md)
|
2. If not found, check projects/*/CONTEXT.md
|
||||||
|
3. Answer from CONTEXT.md (never ask user for info that's in CONTEXT.md)
|
||||||
### Trigger 4: Uncertainty >5%
|
|
||||||
If you're <95% certain about infrastructure, recent work, or next steps:
|
### Trigger 4: Uncertainty >5%
|
||||||
1. Search for CONTEXT.md in working directory
|
If you're <95% certain about infrastructure, recent work, or next steps:
|
||||||
2. Search for CONTEXT.md in projects/*/
|
1. Search for CONTEXT.md in working directory
|
||||||
3. Read before asking user
|
2. Search for CONTEXT.md in projects/*/
|
||||||
|
3. Read before asking user
|
||||||
### ANTI-PATTERN Examples (NEVER DO THIS):
|
|
||||||
|
### ANTI-PATTERN Examples (NEVER DO THIS):
|
||||||
❌ **Wrong:**
|
|
||||||
```
|
❌ **Wrong:**
|
||||||
User: "Look at the Dataforth DFWDS folders"
|
```
|
||||||
You: "I don't recall what we've done with Dataforth. Let me search session logs..."
|
User: "Look at the Dataforth DFWDS folders"
|
||||||
```
|
You: "I don't recall what we've done with Dataforth. Let me search session logs..."
|
||||||
|
```
|
||||||
✅ **Correct:**
|
|
||||||
```
|
✅ **Correct:**
|
||||||
User: "Look at the Dataforth DFWDS folders"
|
```
|
||||||
You: [Detects "Dataforth" → reads projects/dataforth-dos/CONTEXT.md in <3 seconds]
|
User: "Look at the Dataforth DFWDS folders"
|
||||||
"I see from CONTEXT.md that DFWDS is at C:\Shares\testdatadb\ on AD2 (192.168.0.6).
|
You: [Detects "Dataforth" → reads projects/dataforth-dos/CONTEXT.md in <3 seconds]
|
||||||
Recent work (2026-04-12) extended SCMVAS/SCMHVAS pipeline. Service is testdatadb on port 3000.
|
"I see from CONTEXT.md that DFWDS is at C:\Shares\testdatadb\ on AD2 (192.168.0.6).
|
||||||
What would you like me to check?"
|
Recent work (2026-04-12) extended SCMVAS/SCMHVAS pipeline. Service is testdatadb on port 3000.
|
||||||
```
|
What would you like me to check?"
|
||||||
|
```
|
||||||
❌ **Wrong:**
|
|
||||||
```
|
❌ **Wrong:**
|
||||||
User: "Continue working on GuruRMM tunnel"
|
```
|
||||||
You: "What phase are we on? Which server is this deployed to?"
|
User: "Continue working on GuruRMM tunnel"
|
||||||
```
|
You: "What phase are we on? Which server is this deployed to?"
|
||||||
|
```
|
||||||
✅ **Correct:**
|
|
||||||
```
|
✅ **Correct:**
|
||||||
User: "Continue working on GuruRMM tunnel"
|
```
|
||||||
You: [Reads projects/msp-tools/guru-rmm/CONTEXT.md]
|
User: "Continue working on GuruRMM tunnel"
|
||||||
"Tunnel Phase 1 is complete (v0.6.0, deployed to 172.16.3.30:3001).
|
You: [Reads projects/msp-tools/guru-rmm/CONTEXT.md]
|
||||||
Phase 2 is channel implementation (Terminal, File, Registry, Service).
|
"Tunnel Phase 1 is complete (v0.6.0, deployed to 172.16.3.30:3001).
|
||||||
2/6 agents online. Ready to proceed."
|
Phase 2 is channel implementation (Terminal, File, Registry, Service).
|
||||||
```
|
2/6 agents online. Ready to proceed."
|
||||||
|
```
|
||||||
### Session Start Protocol
|
|
||||||
|
### Session Start Protocol
|
||||||
At session start:
|
|
||||||
1. Check for CONTEXT.md in current working directory
|
At session start:
|
||||||
2. If found, read it silently (don't announce to user)
|
1. Check for CONTEXT.md in current working directory
|
||||||
3. Be ready to answer questions about any project listed
|
2. If found, read it silently (don't announce to user)
|
||||||
4. When user specifies project, load that project's CONTEXT.md automatically
|
3. Be ready to answer questions about any project listed
|
||||||
|
4. When user specifies project, load that project's CONTEXT.md automatically
|
||||||
### Benefits
|
|
||||||
|
### Benefits
|
||||||
- ✅ Never ask "What's the server IP?" (it's in CONTEXT.md)
|
|
||||||
- ✅ Never ask "What did we do last time?" (recent logs in CONTEXT.md)
|
- ✅ Never ask "What's the server IP?" (it's in CONTEXT.md)
|
||||||
- ✅ Never ask "Where's the database?" (infrastructure table in CONTEXT.md)
|
- ✅ Never ask "What did we do last time?" (recent logs in CONTEXT.md)
|
||||||
- ✅ Start work immediately with full context
|
- ✅ Never ask "Where's the database?" (infrastructure table in CONTEXT.md)
|
||||||
- ✅ Follow anti-patterns automatically (CONTEXT.md lists common mistakes)
|
- ✅ Start work immediately with full context
|
||||||
|
- ✅ Follow anti-patterns automatically (CONTEXT.md lists common mistakes)
|
||||||
**See:** `.claude/AUTO_CONTEXT_SYSTEM.md` for full implementation details
|
|
||||||
|
**See:** `.claude/AUTO_CONTEXT_SYSTEM.md` for full implementation details
|
||||||
---
|
|
||||||
|
---
|
||||||
## Projects
|
|
||||||
|
## Projects
|
||||||
**ClaudeTools** -- MSP Work Tracking System (Production-Ready)
|
|
||||||
- Database: MariaDB 10.6.22 @ 172.16.3.30:3306 | API: http://172.16.3.30:8001
|
**ClaudeTools** -- MSP Work Tracking System (Production-Ready)
|
||||||
- 95+ endpoints, 38 tables, JWT auth, AES-256-GCM encryption
|
- Database: MariaDB 10.6.22 @ 172.16.3.30:3306 | API: http://172.16.3.30:8001
|
||||||
- DB creds in vault: `bash D:/vault/scripts/vault.sh get-field projects/claudetools/database.sops.yaml credentials.password`
|
- 95+ endpoints, 38 tables, JWT auth, AES-256-GCM encryption
|
||||||
|
- DB creds in vault: `bash D:/vault/scripts/vault.sh get-field projects/claudetools/database.sops.yaml credentials.password`
|
||||||
**GuruRMM** -- Remote Monitoring & Management (Active Development)
|
|
||||||
- Server: Rust/Axum @ 172.16.3.30:3001 | Dashboard: https://rmm.azcomputerguru.com
|
**GuruRMM** -- Remote Monitoring & Management (Active Development)
|
||||||
- Repo: `azcomputerguru/gururmm` on Gitea (active), `guru-rmm` is a stale copy
|
- Server: Rust/Axum @ 172.16.3.30:3001 | Dashboard: https://rmm.azcomputerguru.com
|
||||||
- Roadmap: `projects/msp-tools/guru-rmm/ROADMAP.md`
|
- Repo: `azcomputerguru/gururmm` on Gitea (active), `guru-rmm` is a stale copy
|
||||||
|
- Roadmap: `projects/msp-tools/guru-rmm/ROADMAP.md`
|
||||||
---
|
|
||||||
|
---
|
||||||
## Key Rules
|
|
||||||
|
## Key Rules
|
||||||
- **NO EMOJIS** - Use ASCII markers: `[OK]`, `[ERROR]`, `[WARNING]`, `[SUCCESS]`, `[INFO]`
|
|
||||||
- **No hardcoded credentials** - Use SOPS vault (`vault get-field <path> <field>`) or 1Password as fallback
|
- **NO EMOJIS** - Use ASCII markers: `[OK]`, `[ERROR]`, `[WARNING]`, `[SUCCESS]`, `[INFO]`
|
||||||
- **SSH:** Use system OpenSSH (on Windows: `C:\Windows\System32\OpenSSH\ssh.exe`, never Git for Windows SSH)
|
- **No hardcoded credentials** - Use SOPS vault (`vault get-field <path> <field>`) or 1Password as fallback
|
||||||
- **Data integrity:** Never use placeholder/fake data. Check SOPS vault, credentials.md, or ask user.
|
- **SSH:** Use system OpenSSH (on Windows: `C:\Windows\System32\OpenSSH\ssh.exe`, never Git for Windows SSH)
|
||||||
- **Coding standards:** `.claude/CODING_GUIDELINES.md` (agents read on-demand, not every session)
|
- **Data integrity:** Never use placeholder/fake data. Check SOPS vault, credentials.md, or ask user.
|
||||||
|
- **Coding standards:** `.claude/CODING_GUIDELINES.md` (agents read on-demand, not every session)
|
||||||
---
|
|
||||||
|
---
|
||||||
## Automatic Behaviors
|
|
||||||
|
## Automatic Behaviors
|
||||||
- **Frontend Design:** Auto-invoke `/frontend-design` skill after ANY UI change (HTML/CSS/JSX/styling)
|
|
||||||
- **Sequential Thinking:** Use for genuine complexity - rejection loops, 3+ critical issues, architectural decisions, multi-step debugging
|
- **Frontend Design:** Auto-invoke `/frontend-design` skill after ANY UI change (HTML/CSS/JSX/styling)
|
||||||
- **Task Management:** Complex work (>3 steps) -> TaskCreate. Persist to `.claude/active-tasks.json`.
|
- **Sequential Thinking:** Use for genuine complexity - rejection loops, 3+ critical issues, architectural decisions, multi-step debugging
|
||||||
|
- **Task Management:** Complex work (>3 steps) -> TaskCreate. Persist to `.claude/active-tasks.json`.
|
||||||
---
|
|
||||||
|
---
|
||||||
## Context Recovery
|
|
||||||
|
## Context Recovery
|
||||||
When user references previous work, use `/context` command. Never ask user for info in:
|
|
||||||
- `credentials.md` - Infrastructure reference (being migrated to SOPS vault at D:\vault)
|
When user references previous work, use `/context` command. Never ask user for info in:
|
||||||
- `session-logs/` - Daily work logs (also in `projects/*/session-logs/` and `clients/*/session-logs/`)
|
- `credentials.md` - Infrastructure reference (being migrated to SOPS vault at D:\vault)
|
||||||
- `SESSION_STATE.md` - Project history
|
- `session-logs/` - Daily work logs (also in `projects/*/session-logs/` and `clients/*/session-logs/`)
|
||||||
|
- `SESSION_STATE.md` - Project history
|
||||||
### Credential Access (SOPS Vault - Primary)
|
|
||||||
|
### Credential Access (SOPS Vault - Primary)
|
||||||
Credentials are stored in SOPS+age encrypted YAML files in a dedicated Gitea repo.
|
|
||||||
|
Credentials are stored in SOPS+age encrypted YAML files in a dedicated Gitea repo.
|
||||||
**Vault repo:** `D:\vault` (git.azcomputerguru.com/azcomputerguru/vault, private)
|
|
||||||
**Structure:** infrastructure/, clients/, services/, projects/, msp-tools/
|
**Vault repo:** `D:\vault` (git.azcomputerguru.com/azcomputerguru/vault, private)
|
||||||
|
**Structure:** infrastructure/, clients/, services/, projects/, msp-tools/
|
||||||
**To read credentials:**
|
|
||||||
```bash
|
**To read credentials:**
|
||||||
bash D:/vault/scripts/vault.sh search "keyword" # Search (no decryption needed)
|
```bash
|
||||||
bash D:/vault/scripts/vault.sh get-field <path> <field> # Get specific field
|
bash D:/vault/scripts/vault.sh search "keyword" # Search (no decryption needed)
|
||||||
bash D:/vault/scripts/vault.sh get <path> # Decrypt full entry
|
bash D:/vault/scripts/vault.sh get-field <path> <field> # Get specific field
|
||||||
bash D:/vault/scripts/vault.sh list # List all entries
|
bash D:/vault/scripts/vault.sh get <path> # Decrypt full entry
|
||||||
```
|
bash D:/vault/scripts/vault.sh list # List all entries
|
||||||
|
```
|
||||||
**Encryption:** AES-256 via age. Metadata stays plaintext for searchability.
|
|
||||||
|
**Encryption:** AES-256 via age. Metadata stays plaintext for searchability.
|
||||||
**age key location:** `%APPDATA%\sops\age\keys.txt` (Windows) / `~/.config/sops/age/keys.txt` (Linux/Mac)
|
|
||||||
|
**age key location:** `%APPDATA%\sops\age\keys.txt` (Windows) / `~/.config/sops/age/keys.txt` (Linux/Mac)
|
||||||
### 1Password (Fallback)
|
|
||||||
|
### 1Password (Fallback)
|
||||||
Service account token in vault: `infrastructure/1password-service-account.sops.yaml`
|
|
||||||
|
Service account token in vault: `infrastructure/1password-service-account.sops.yaml`
|
||||||
---
|
|
||||||
|
---
|
||||||
## Commands & Skills
|
|
||||||
|
## Commands & Skills
|
||||||
| Command | Purpose |
|
|
||||||
|---------|---------|
|
| Command | Purpose |
|
||||||
| `/checkpoint` | Dual checkpoint: git commit + database context |
|
|---------|---------|
|
||||||
| `/save` | Comprehensive session log (credentials, decisions, changes) |
|
| `/checkpoint` | Dual checkpoint: git commit + database context |
|
||||||
| `/context` | Search session logs, credentials.md, and 1Password |
|
| `/save` | Comprehensive session log (credentials, decisions, changes) |
|
||||||
| `/1password` | 1Password secrets management integration |
|
| `/context` | Search session logs, credentials.md, and 1Password |
|
||||||
| `/sync` | Sync config from Gitea repository |
|
| `/1password` | 1Password secrets management integration |
|
||||||
| `/create-spec` | Create app specification for AutoCoder |
|
| `/sync` | Sync config from Gitea repository |
|
||||||
| `/frontend-design` | Modern frontend design patterns (auto-invoke after UI changes) |
|
| `/create-spec` | Create app specification for AutoCoder |
|
||||||
| `/remediation-tool` | M365 breach checks, tenant sweeps, gated remediation via Claude-MSP-Access Graph API app |
|
| `/frontend-design` | Modern frontend design patterns (auto-invoke after UI changes) |
|
||||||
|
| `/remediation-tool` | M365 breach checks, tenant sweeps, gated remediation via Claude-MSP-Access Graph API app |
|
||||||
---
|
|
||||||
|
---
|
||||||
## File Placement (Quick Rules)
|
|
||||||
|
## File Placement (Quick Rules)
|
||||||
- **Dataforth DOS work** -> `projects/dataforth-dos/`
|
|
||||||
- **ClaudeTools API code** -> `api/`, `migrations/` (existing structure)
|
- **Dataforth DOS work** -> `projects/dataforth-dos/`
|
||||||
- **GuruRMM work** -> `projects/msp-tools/guru-rmm/`
|
- **ClaudeTools API code** -> `api/`, `migrations/` (existing structure)
|
||||||
- **Client work** -> `clients/[client-name]/`
|
- **GuruRMM work** -> `projects/msp-tools/guru-rmm/`
|
||||||
- **Session logs** -> project or client `session-logs/` subfolder; general -> root `session-logs/`
|
- **Client work** -> `clients/[client-name]/`
|
||||||
- **Full guide:** `.claude/FILE_PLACEMENT_GUIDE.md` (read when saving files, not every session)
|
- **Session logs** -> project or client `session-logs/` subfolder; general -> root `session-logs/`
|
||||||
|
- **Full guide:** `.claude/FILE_PLACEMENT_GUIDE.md` (read when saving files, not every session)
|
||||||
---
|
|
||||||
|
---
|
||||||
## Local AI (Ollama)
|
|
||||||
|
## Local AI (Ollama)
|
||||||
Ollama runs on Mike's workstation (DESKTOP-0O8A1RL) with GPU acceleration. Available to all team members via Tailscale.
|
|
||||||
|
Ollama runs on Mike's workstation (DESKTOP-0O8A1RL) with GPU acceleration. Available to all team members via Tailscale.
|
||||||
| Model | Size | Use For |
|
|
||||||
|-------|------|---------|
|
| Model | Size | Use For |
|
||||||
| `qwen3:14b` | 9.3 GB | Summarization, classification, data extraction, drafting |
|
|-------|------|---------|
|
||||||
| `codestral:22b` | 12 GB | Code generation, refactoring suggestions, docstrings |
|
| `qwen3:14b` | 9.3 GB | Summarization, classification, data extraction, drafting |
|
||||||
| `nomic-embed-text` | 274 MB | Embeddings only (used by GrepAI) |
|
| `codestral:22b` | 12 GB | Code generation, refactoring suggestions, docstrings |
|
||||||
|
| `nomic-embed-text` | 274 MB | Embeddings only (used by GrepAI) |
|
||||||
### How to connect
|
|
||||||
|
### How to connect
|
||||||
**On Mike's workstation (local):**
|
|
||||||
```bash
|
**On Mike's workstation (local):**
|
||||||
curl -s http://localhost:11434/api/generate -d '{"model":"qwen3:14b","prompt":"...","stream":false}' | jq -r '.response'
|
```bash
|
||||||
```
|
curl -s http://localhost:11434/api/generate -d '{"model":"qwen3:14b","prompt":"...","stream":false}' | jq -r '.response'
|
||||||
|
```
|
||||||
**On any other machine via Tailscale:**
|
|
||||||
```bash
|
**On any other machine via Tailscale:**
|
||||||
curl -s http://100.92.127.64:11434/api/generate -d '{"model":"qwen3:14b","prompt":"...","stream":false}' | jq -r '.response'
|
```bash
|
||||||
```
|
curl -s http://100.92.127.64:11434/api/generate -d '{"model":"qwen3:14b","prompt":"...","stream":false}' | jq -r '.response'
|
||||||
|
```
|
||||||
### Per-machine setup
|
|
||||||
|
### Per-machine setup
|
||||||
Read `.claude/identity.json` to determine which machine you're on:
|
|
||||||
- **DESKTOP-0O8A1RL** (Mike's workstation): Ollama runs locally. Use `localhost:11434`.
|
Read `.claude/identity.json` to determine which machine you're on:
|
||||||
- **Any other machine** (Howard's laptop, other workstations): Ollama is remote via Tailscale. Use `100.92.127.64:11434`. Requires Tailscale to be connected.
|
- **DESKTOP-0O8A1RL** (Mike's workstation): Ollama runs locally. Use `localhost:11434`.
|
||||||
|
- **Any other machine** (Howard's laptop, other workstations): Ollama is remote via Tailscale. Use `100.92.127.64:11434`. Requires Tailscale to be connected.
|
||||||
**To check if Ollama is reachable:**
|
|
||||||
```bash
|
**To check if Ollama is reachable:**
|
||||||
curl -s http://100.92.127.64:11434/api/tags | python -c "import sys,json; [print(m['name']) for m in json.load(sys.stdin).get('models',[])]"
|
```bash
|
||||||
```
|
curl -s http://100.92.127.64:11434/api/tags | python -c "import sys,json; [print(m['name']) for m in json.load(sys.stdin).get('models',[])]"
|
||||||
|
```
|
||||||
If it fails: verify Tailscale is connected (`tailscale status`), and that Mike's workstation is online.
|
|
||||||
|
If it fails: verify Tailscale is connected (`tailscale status`), and that Mike's workstation is online.
|
||||||
### Access control
|
|
||||||
|
### Access control
|
||||||
- Firewall rule on Mike's workstation allows port 11434 ONLY from Tailscale subnet (100.0.0.0/8)
|
|
||||||
- NOT exposed to LAN, VPN, or internet
|
- Firewall rule on Mike's workstation allows port 11434 ONLY from Tailscale subnet (100.0.0.0/8)
|
||||||
- Binding: `OLLAMA_HOST=0.0.0.0:11434` (all interfaces, firewall restricts)
|
- NOT exposed to LAN, VPN, or internet
|
||||||
|
- Binding: `OLLAMA_HOST=0.0.0.0:11434` (all interfaces, firewall restricts)
|
||||||
**Review policy:** Always review Critical/High impact Ollama outputs (auth, security, migrations, production). Trust Low impact (classification, formatting). Flag uncertainty to user.
|
|
||||||
|
**Review policy:** Always review Critical/High impact Ollama outputs (auth, security, migrations, production). Trust Low impact (classification, formatting). Flag uncertainty to user.
|
||||||
### GrepAI (Semantic Code Search)
|
|
||||||
|
### GrepAI (Semantic Code Search)
|
||||||
Use for intent-based search ("how does auth work"), exploring unfamiliar code, context recovery.
|
|
||||||
- **MCP tool:** `grepai` server tools
|
Use for intent-based search ("how does auth work"), exploring unfamiliar code, context recovery.
|
||||||
- **Agent:** `deep-explore` agent
|
- **MCP tool:** `grepai` server tools
|
||||||
- **CLI:** `grepai search "query" --json --compact`
|
- **Agent:** `deep-explore` agent
|
||||||
|
- **CLI:** `grepai search "query" --json --compact`
|
||||||
---
|
|
||||||
|
---
|
||||||
## Memory (Shared Across Machines)
|
|
||||||
|
## Memory (Shared Across Machines)
|
||||||
Stored in-repo at `.claude/memory/` -- syncs via Gitea to all workstations.
|
|
||||||
Index: `.claude/memory/MEMORY.md`
|
Stored in-repo at `.claude/memory/` -- syncs via Gitea to all workstations.
|
||||||
|
Index: `.claude/memory/MEMORY.md`
|
||||||
**IMPORTANT:** Always write to `.claude/memory/` (repo-relative), NOT `~/.claude/projects/*/memory/`.
|
|
||||||
|
**IMPORTANT:** Always write to `.claude/memory/` (repo-relative), NOT `~/.claude/projects/*/memory/`.
|
||||||
---
|
|
||||||
|
---
|
||||||
## Reference (read on-demand)
|
|
||||||
|
## Reference (read on-demand)
|
||||||
- **Project structure, endpoints, workflows:** `.claude/REFERENCE.md`
|
|
||||||
- **Agent definitions:** `.claude/agents/*.md`
|
- **Project structure, endpoints, workflows:** `.claude/REFERENCE.md`
|
||||||
- **MCP servers:** `MCP_SERVERS.md`
|
- **Agent definitions:** `.claude/agents/*.md`
|
||||||
- **Coding standards:** `.claude/CODING_GUIDELINES.md`
|
- **MCP servers:** `MCP_SERVERS.md`
|
||||||
|
- **Coding standards:** `.claude/CODING_GUIDELINES.md`
|
||||||
---
|
|
||||||
|
---
|
||||||
**Last Updated:** 2026-04-02
|
|
||||||
|
**Last Updated:** 2026-04-02
|
||||||
|
|||||||
Submodule projects/msp-tools/guru-rmm updated: f827ab4665...956759da69
Reference in New Issue
Block a user