bymaxone

by Bymax One

Meta-plugin reference for the complete bymax toolkit (workflow + quality + bootstrap + mobile + web-verify + pr + pm + qa + report). Note: Claude Code's plugin manifest does not auto-install dependencies — install bymax-workflow, bymax-quality, bymax-bootstrap, bymax-mobile, bymax-web-verify, bymax-pr, bymax-pm, bymax-qa, and bymax-report individually.

by Bymax One

Scaffold new projects with strict TypeScript, ESLint flat-config (security + import-order + suppression bans), Prettier, .vscode (format-on-save), Husky + commitlint + lint-staged, and CLAUDE.md / AGENTS.md / README.md templates. Detects the stack (Next.js, Expo/RN, Vite+React, Node) and uses the right ESLint preset. Includes /bymax-bootstrap:upgrade-standards for non-destructive upgrades on existing projects.

by Bymax One

Bymax workflows for Codex: evidence-based code review, planning, testing, PR management and capability-aware orchestration.

by Bymax One

Slash commands to boot the iOS Simulator (/bymax-mobile:sim-ios) and Android Emulator (/bymax-mobile:sim-android) for Expo / React Native projects. Auto-detects whether `expo start` (Metro reattach) or `expo run:ios|run:android` (full rebuild + install) is the right call. macOS-first; Android also works on Linux when the SDK is configured.

by Bymax One

Engineering Project Manager for multi-agent development. The /bymax-pm:pm command turns the current session into a PM/TPM that coordinates INDEPENDENT Claude Code peer sessions: discovers agents via ListAgents, delegates structured task contracts via SendMessage, tracks a deterministic task lifecycle (assignment → acknowledgement → evidence → independent review → PM verification), detects stuck agents through one-shot idle notices instead of polling, resolves blockers between agents before escalating, and keeps all project truth in a persistent, git-friendly .claude/pm/ workspace that survives session restarts. Evidence-driven: a worker saying done is never enough — DONE requires diffs, tests, CI and PM verification. The PM coordinates; it does not implement.

by Bymax One

The PR lifecycle, powered by the `gh` CLI. /bymax-pr:push ships work safely: branch (never the default branch) → stage → complete Conventional-Commits message → push, with an explicit `pr` opt-in that opens a fully-described PR (Summary / Changes / How to verify). /bymax-pr:babysit-pr autonomously shepherds an open PR to merge-readiness: resolves merge conflicts, polls CI at a cadence matched to the CI's real duration (270 s floor), classifies failures as real vs flaky (re-running flaky checks), fixes real failures locally before pushing, triages bot review comments (4-tier), and notifies you when the PR is green. Never merges, never pushes to the base branch, never force-pushes. A built-in preflight verifies the gh CLI is installed and authenticated. Depends on `gh` + `git` but never bundles them.

by Bymax One

Whole-system QA and security audit for any project, with evidence and hand-off. Point /bymax-qa:audit at a target: a Jira ticket key (it verifies Jira access, reads the acceptance criteria, and reports each PASS/FAIL/BLOCKED/NOT-VERIFIABLE with evidence), a branch or ref range or PR (it scopes the hunt to the change, like a code review), or nothing (the whole system via a signed scope). It maps the stack and its trust boundaries, hunts by domain (authentication, authorization and tenant isolation, injection and input, cache/Redis, database/Postgres, observability, transport and config, architecture, frontend, supply chain) with read-only finder agents, probes the running stack against the allow-listed hosts only, and admits a finding only after verification: a runnable reproduction, captured evidence and verified impact, with an independent verifier for every hunted candidate. Every finding carries ASVS 5.0, CWE and API Top 10 references, a CVSS vector, and a status that moves OPEN → HANDED-OFF → FIX-CLAIMED → VALIDATED or REOPENED. Fixes are never applied by the auditor: findings are handed to the owning peer session over cross-session messaging, filed as GitHub issues when no peer is live, or written back to the ticket as a comment, and re-tested before they close. A PreToolUse hook is a floor under the scope while an audit is active: a network tool in command position may only reach allow-listed hosts, and a Write/Edit tool call may only land in .claude/qa/ (arbitrary Bash writes and unlisted network binaries rest on the skill's never-edit-the-target discipline and its read-only finders). External scanners (semgrep, gitleaks, osv-scanner, trivy, zap, nuclei, axe, Lighthouse) are used when present and never bundled.

by Bymax One

Evidence-based quality gates: bounded Claude and Codex review with pinned candidates, verified findings, correction deltas and regression checks; TDD, stack-specific reviewers and security hooks.

by Bymax One

The weekly silent-standup report for one repository, written from evidence. /bymax-report:standup collects what shipped in a period (pull requests via gh, commits via git) and what was asked (what a person typed into Claude Code or Codex sessions on that repository, worktree sessions included, pasted third-party requests included), then writes the two sections the team reads: a PROGRESS list of the asks as outcome sentences, undelivered ones marked in progress, and UPDATES grouped by product area saying what changed and what it replaced. No hashes, PR numbers or file names reach the report; an evidence block under it maps every line back to its PR, commit and request for the author. Plain text printed to paste, no Markdown, no file left on disk, English by default; --author keeps one git author. Depends on git; gh is used when present and its absence is reported, never hidden.

by Bymax One

Real-browser verification and assisted UI testing for web apps. /bymax-web-verify:test brings the full stack up — reuses a running backend instance or starts one, opens the frontend in the Claude Desktop Browser pane (preview) — and walks a UI flow step by step while the user watches, verifying via page state, console, network (2xx gate), and server logs; falls back to the agent-browser CLI in a terminal. /bymax-web-verify:verify drives a real browser to confirm a single change works. /bymax-web-verify:setup installs the agent-browser CLI + Chrome for Testing in one shot. A SessionStart hook detects a missing CLI and offers to install it. Depends on `agent-browser` but never bundles it. /bymax-web-verify:record captures a UI flow as reviewable video evidence: the project's own Playwright with video forced on for one isolated run, human pacing (slowMo with a resized timeout), ffmpeg lead-in trim with a verified first frame, an ffprobe pacing gate, optional --mp4, and a plain-text walkthrough derived from the spec that ran.

by Bymax One

Phased planning + execution workflow for Claude Code. Spec → Roadmap → Phase-Tasks → Task, each step with explicit user-approval gates and JIRA-style dashboards. Includes /bymax-workflow:brainstorm, /bymax-workflow:plan, /bymax-workflow:verify, /bymax-workflow:checkpoint, the universal /bymax-workflow:standards reference (with the §0 reuse-first simplicity ladder), and /bymax-workflow:autopilot — the loop-engineering executor that drives an approved roadmap to done autonomously, one merge-gated PR per phase.