autodev-core

autodev-core turns a Claude Code session into a sprint runner: brainstorm proposes stories, auto implements them without stopping, ship deploys and re-scans. The sprint lives in a prd.json file in your project. A function hooks module pins its story counts under the prompt and redacts pasted secrets before the model sees them. Version 8.168.0 at the time of writing.

What it does

• Six workflow skills. brainstorm proposes improvements and brainstorm apply turns them into stories. auto implements every pending story and checks UI changes in the Browser pane. iterate loops brainstorm, fix and re-scan until the scan is clean. audit runs seven agents in parallel. review runs Claude Code’s own /code-review, then the project’s checks. ship builds, tests, reviews, deploys and scans the deployed site. A dozen narrower skills ship alongside, all reachable as /autodev-core:<name>.
• The sprint file. prd.json holds the stories and the sprint history; each story’s passes is null while pending, true when done or "deferred". Snapshots go to .claude/archives/, reports to .claude/reports/, screenshots to .claude/screenshots/.

Install

Needs Claude Code with function hooks enabled for the hooks module, and Node 18 or later for the command hooks. The author does not state a minimum Claude Code version.

claude plugin marketplace add djnsty23/claude-auto-dev
claude plugin install autodev-core@autodev

Run /reload-plugins if the install summary asks for it. Then /autodev-init, which writes your codebase’s conventions to .claude/project-rules.md for review and audit to follow, and say brainstorm. The same marketplace publishes two optional add-ons, autodev-memory (cross-session project memory, Node 22 or later) and autodev-stack (Supabase, Doppler, Stripe, Remotion). Coming from a 7.x install, read the repo’s MIGRATION.md first.

How it works

Two layers. The hooks module fn/autodev-fn.mjs loads only where function hooks are enabled; nineteen classic command hooks run either way.

The hooks module reads every prompt and every Bash call. On prompt.submit it replaces each credential-shaped string in your text with a [REDACTED:kind#n] placeholder before the model sees it; the value stays in the hooks worker’s memory, never in the plugin store. On tool.call for Bash it reads the command, restores a secret where the command names its placeholder, and applies five rules: three denies that fire only inside the plugin’s own repository (git commit -m, git commit --amend, git add -A), a Windows-only deny for git show rev:.path under Git Bash, and one rewrite anywhere, adding --silent to doppler secrets writes so the CLI does not print the whole store. After the command runs it scrubs stdout and stderr of known values and credential patterns. On attribution.text for commits it returns an empty trailer, so commits Claude makes carry no co-author line. On session.start and turn.complete it reads prd.json, if present, and pins one status line under the prompt: the redaction tally and the sprint’s counts. The line costs no context; its absence means the module is not loaded.

The command hooks, by job:

• Sprint state. PreCompact copies prd.json to .claude/pre-compact-state.json; PostCompact tells Claude to re-read it. A Stop hook keeps auto going by refusing to end the turn while stories are pending, tracked by a .claude/auto-active flag; a turn that dies on an API error is logged under .claude/reports/.
• Typecheck. Each Write or Edit to a JS or TS file is noted in .claude/.typecheck-pending. At Stop the hook runs the project’s typecheck and lint scripts once and, on failure, blocks the turn with up to 80 lines of typecheck output and 30 of lint. One retry; a second failure is reported to you instead.
• Prompt hooks. An image scan tail-reads the transcript to see whether your latest message carries an image and, if so, asks Claude to list every issue it sees; [focus] in the prompt opts out. An inbox hook stats a drop folder, by default ~/Library/Mobile Documents/com~apple~CloudDocs/claude-inbox, and announces each new file once with its age, never opening it. AUTODEV_INBOX changes the folder, AUTODEV_INBOX_DISABLED=1 turns it off.
• Guards. A hook on AskUserQuestion blocks any panel with no option marked “(Recommended)”; AUTODEV_PANEL_CHECK=off disables it. A path filter runs before Read, Write and Edit, and a write guard before Bash.
• Records. Telemetry writes per-tool timing reports under .claude/reports/. An instructions ledger appends one line per loaded CLAUDE.md or rule file to ~/.claude/logs/instructions-loaded.jsonl.

Seven of these are switches in the plugin’s user config, all on by default: typecheck, telemetry, context_nudge, inbox_notify, image_scan, instructions_ledger and workflow_wall_note. The hooks module makes no network calls. The only hook that can is telemetry, and only if you set CLAUDE_OTEL_ENDPOINT: it then also posts each record as OTLP JSON there. Unset, everything stays on disk.

Tokens go to the skills, not the hooks. auto runs turn after turn until the sprint is done, iterate loops until a scan is clean and audit spawns seven agents; the README gives no figure. On a quiet turn the hooks add nothing to context.

Limitations

• Three of the five Bash rules fire only inside the claude-auto-dev repository itself. What reaches your projects is the doppler rewrite, the Git Bash deny on Windows, the redaction and the empty commit trailer.
• Several hooks encode the author’s multi-session setup and ship on: the “(Recommended)” panel rule, an AWAY branch that self-resolves panels while the operator is away, a budget on messages to other sessions and the Bash write guard.
• The inbox default is an iCloud path; elsewhere set AUTODEV_INBOX or turn it off.
• Hooks fail quietly: an error leaves no message. Without function hooks the module is skipped and the command hooks run unchanged.