autodev-core

autodev-core turns a Claude Code session into a sprint runner: brainstorm proposes stories, auto implements them without stopping, ship deploys and re-scans. The sprint lives in a prd.json file in your project. A function hooks module pins its story counts under the prompt and redacts pasted secrets before the model sees them. Version 8.181.0 at the time of writing.

What it does

• Six workflow skills. brainstorm proposes improvements and brainstorm apply turns them into stories. auto implements every pending story and checks UI changes in the Browser pane. iterate loops brainstorm, fix and re-scan until the scan is clean. audit runs seven agents in parallel. review runs Claude Code’s own /code-review, then the project’s checks. ship builds, tests, reviews, deploys and scans the deployed site. A dozen narrower skills ship alongside, all reachable as /autodev-core:<name>.
• The sprint file. prd.json holds the stories and the sprint history; each story’s passes is null while pending, true when done or "deferred". Snapshots go to .claude/archives/, reports to .claude/reports/, screenshots to .claude/screenshots/.

Install

Needs Claude Code 2.1.287 or later for the hooks module, and Node 18 or later for the command hooks. The author does not state a minimum Claude Code version.

claude plugin marketplace add djnsty23/claude-auto-dev@stable
claude plugin install autodev-core@autodev

@stable pins the marketplace to the last release; without it the marketplace follows main, which carries unreleased commits under the last version number. An install made without it keeps working; the README says how to switch it. Run /reload-plugins if the install summary asks for it. Then /autodev-init, which writes your codebase’s conventions to .claude/project-rules.md for review and audit to follow, and say brainstorm. The same marketplace publishes two optional add-ons, autodev-memory (cross-session project memory, Node 22 or later) and autodev-stack (Supabase, Doppler, Stripe, Remotion). Coming from a 7.x install, read the repo’s MIGRATION.md first.

How it works

Two layers. The hooks module hooks/fn/autodev-fn.mjs loads where Claude Code loads mods; two dozen classic command hooks run either way.

The hooks module reads every prompt and every Bash call. On prompt.submit it replaces each credential-shaped string in your text with a [REDACTED:kind#n] placeholder before the model sees it, inline flag values included; the value stays in the hooks worker’s memory, never in the plugin store. On tool.call for Bash it reads the command, restores a secret where the command names its placeholder, and applies eight rules: three denies that fire only inside the plugin’s own repository (git commit -m, git commit --amend, git add -A), a deny anywhere for a credential passed on the command line, a deny for a git worktree add outside <repo>/.claude/worktrees/, two Windows-only denies under Git Bash (git show rev:.path, and a quoted heredoc whose body holds a double backslash), and one rewrite anywhere, adding --silent to doppler secrets writes so the CLI does not print the whole store. After the command runs it scrubs stdout and stderr of known values and credential patterns. On attribution.text for commits it returns an empty trailer, so commits Claude makes carry no co-author line. On session.start and turn.complete it reads prd.json, if present, and pins one status line under the prompt: the redaction tally and the sprint’s counts. The line costs no context; its absence means the module is not loaded.

The command hooks, by job:

• Sprint state. PreCompact copies prd.json to .claude/pre-compact-state.json; PostCompact tells Claude to re-read it. A Stop hook keeps auto going by refusing to end the turn while stories are pending, tracked by a .claude/auto-active flag; a turn that dies on an API error is logged under .claude/reports/. Past a context depth line, another Stop hook holds the turn open once per band so the session saves its state at a natural break before compaction lands.
• Typecheck. Each Write or Edit to a JS or TS file is noted in .claude/.typecheck-pending. At Stop the hook runs the project’s typecheck and lint scripts once and, on failure, blocks the turn with up to 80 lines of typecheck output and 30 of lint. One retry; a second failure is reported to you instead.
• Prompt hooks. An image scan tail-reads the transcript to see whether your latest message carries an image and, if so, asks Claude to list every issue it sees; [focus] in the prompt opts out. An inbox hook stats a drop folder, by default ~/Library/Mobile Documents/com~apple~CloudDocs/claude-inbox, and announces each new file once with its age, never opening it. AUTODEV_INBOX changes the folder, AUTODEV_INBOX_DISABLED=1 turns it off.
• Guards. A hook on AskUserQuestion blocks any panel with no option marked “(Recommended)”; AUTODEV_PANEL_CHECK=off disables it. A path filter runs before Read, Write and Edit, and a write guard before Bash. In a headless claude -p worker a backgrounded Bash command is refused, writes to a shared Artifact database are checked against a schema you keep, and a fourth message to the same peer session inside an hour is refused.
• Records. Telemetry writes per-tool timing reports under .claude/reports/. An instructions ledger appends one line per loaded CLAUDE.md or rule file to ~/.claude/logs/instructions-loaded.jsonl. A peer-send ledger records every message to another session and how the host said it was delivered, and a session register notes which account a session belongs to and whether its process is alive.

Eight of these are switches in the plugin’s user config, all on by default: typecheck, telemetry, context_nudge, inbox_notify, image_scan, instructions_ledger, workflow_wall_note and intent_record. The hooks module makes no network calls. The only hook that can is telemetry, and only if you set CLAUDE_OTEL_ENDPOINT: it then also posts each record as OTLP JSON there. Unset, everything stays on disk.

Tokens go to the skills, not the hooks. auto runs turn after turn until the sprint is done, iterate loops until a scan is clean and audit spawns seven agents; the README gives no figure. On a quiet turn the hooks add nothing to context.

Limitations

• Three of the eight Bash rules fire only inside the claude-auto-dev repository itself. What reaches your projects is the doppler rewrite, the credential-in-argv and worktree-placement denies, the two Git Bash denies on Windows, the redaction and the empty commit trailer.
• Several hooks encode the author’s multi-session setup and ship on: the “(Recommended)” panel rule, an AWAY branch that self-resolves panels while the operator is away, a budget on messages to other sessions and the Bash write guard.
• The inbox default is an iCloud path; elsewhere set AUTODEV_INBOX or turn it off.
• Hooks fail quietly: an error leaves no message. On a Claude Code that does not load mods the module is skipped and the command hooks run unchanged.