fix: Security vulnerabilities and race conditions from code review

.claude/templates/coding_prompt.template.md

@@ -8,31 +8,24 @@ This is a FRESH context window - you have no memory of previous sessions.
 Start by orienting yourself:
 
 ```bash
-# 1. See your working directory
-pwd
+# 1. See your working directory and project structure
+pwd && ls -la
 
-# 2. List files to understand project structure
-ls -la
+# 2. Read recent progress notes (last 100 lines)
+tail -100 claude-progress.txt
 
-# 3. Read the project specification to understand what you're building
-cat app_spec.txt
-
-# 4. Read progress notes from previous sessions (last 500 lines to avoid context overflow)
-tail -500 claude-progress.txt
-
-# 5. Check recent git history
-git log --oneline -20
+# 3. Check recent git history
+git log --oneline -10
 ```
 
-Then use MCP tools to check feature status:
+Then use MCP tools:
 
 ```
-# 6. Get progress statistics (passing/total counts)
+# 4. Get progress statistics
 Use the feature_get_stats tool
 ```
 
-Understanding the `app_spec.txt` is critical - it contains the full requirements
-for the application you're building.
+**NOTE:** Do NOT read `app_spec.txt` - you'll get all needed details from your assigned feature.
 
 ### STEP 2: START SERVERS (IF NOT RUNNING)
 
@@ -305,6 +298,17 @@ This allows you to fully test email-dependent flows without needing external ema
 
 ---
 
+## TOKEN EFFICIENCY
+
+To maximize context window usage:
+
+- **Don't read files unnecessarily** - Feature details from `feature_get_by_id` contain everything you need
+- **Be concise** - Short, focused responses save tokens for actual work
+- **Use `feature_get_summary`** for status checks (lighter than `feature_get_by_id`)
+- **Avoid re-reading large files** - Read once, remember the content
+
+---
+
 **Remember:** One feature per session. Zero console errors. All data from real database. Leave codebase clean before ending session.
 
 ---

.claude/templates/testing_prompt.template.md

@@ -9,23 +9,20 @@ Your job is to ensure that features marked as "passing" still work correctly. If
 Start by orienting yourself:
 
 ```bash
-# 1. See your working directory
-pwd
+# 1. See your working directory and project structure
+pwd && ls -la
 
-# 2. List files to understand project structure
-ls -la
+# 2. Read recent progress notes (last 100 lines)
+tail -100 claude-progress.txt
 
-# 3. Read progress notes from previous sessions (last 200 lines)
-tail -200 claude-progress.txt
-
-# 4. Check recent git history
+# 3. Check recent git history
 git log --oneline -10
 ```
 
-Then use MCP tools to check feature status:
+Then use MCP tools:
 
 ```
-# 5. Get progress statistics
+# 4. Get progress statistics
 Use the feature_get_stats tool
 ```
 
@@ -176,6 +173,17 @@ All interaction tools have **built-in auto-wait** - no manual timeouts needed.
 
 ---
 
+## TOKEN EFFICIENCY
+
+To maximize context window usage:
+
+- **Don't read files unnecessarily** - Feature details from `feature_get_by_id` contain everything you need
+- **Be concise** - Short, focused responses save tokens for actual work
+- **Use `feature_get_summary`** for status checks (lighter than `feature_get_by_id`)
+- **Avoid re-reading large files** - Read once, remember the content
+
+---
+
 ## IMPORTANT REMINDERS
 
 **Your Goal:** Verify that passing features still work, and fix any regressions found.

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Lint with ruff
         run: ruff check .
       - name: Run security tests
-        run: python test_security.py
+        run: python -m pytest tests/test_security.py tests/test_security_integration.py -v
 
   ui:
     runs-on: ubuntu-latest

agent.py

@@ -7,6 +7,7 @@
 
 import asyncio
 import io
+import logging
 import re
 import sys
 from datetime import datetime, timedelta
@@ -16,14 +17,17 @@
 
 from claude_agent_sdk import ClaudeSDKClient
 
+# Module logger for error tracking (user-facing messages use print())
+logger = logging.getLogger(__name__)
+
 # Fix Windows console encoding for Unicode characters (emoji, etc.)
 # Without this, print() crashes when Claude outputs emoji like ✅
 if sys.platform == "win32":
     sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding="utf-8", errors="replace", line_buffering=True)
     sys.stderr = io.TextIOWrapper(sys.stderr.buffer, encoding="utf-8", errors="replace", line_buffering=True)
 
 from client import create_client
-from progress import count_passing_tests, has_features, print_progress_summary, print_session_header
+from progress import count_passing_tests, has_features, print_progress_summary, print_session_header, send_session_event
 from prompts import (
     copy_spec_to_project,
     get_coding_prompt,
@@ -106,6 +110,7 @@ async def run_agent_session(
         return "continue", response_text
 
     except Exception as e:
+        logger.error(f"Agent session error: {e}", exc_info=True)
         print(f"Error during agent session: {e}")
         return "error", str(e)
 
@@ -163,6 +168,15 @@ async def run_autonomous_agent(
 
     is_initializer = agent_type == "initializer"
 
+    # Send session started webhook
+    send_session_event(
+        "session_started",
+        project_dir,
+        agent_type=agent_type,
+        feature_id=feature_id,
+        feature_name=f"Feature #{feature_id}" if feature_id else None,
+    )
+
     if is_initializer:
         print("Running as INITIALIZER agent")
         print()
@@ -236,6 +250,7 @@ async def run_autonomous_agent(
             async with client:
                 status, response = await run_agent_session(client, prompt, project_dir)
         except Exception as e:
+            logger.error(f"Client/MCP server error: {e}", exc_info=True)
             print(f"Client/MCP server error: {e}")
             # Don't crash - return error status so the loop can retry
             status, response = "error", str(e)
@@ -291,6 +306,7 @@ async def run_autonomous_agent(
                         target_time_str = target.strftime("%B %d, %Y at %I:%M %p %Z")
 
                     except Exception as e:
+                        logger.warning(f"Error parsing reset time: {e}, using default delay")
                         print(f"Error parsing reset time: {e}, using default delay")
 
             if target_time_str:
@@ -327,6 +343,7 @@ async def run_autonomous_agent(
             await asyncio.sleep(delay_seconds)
 
         elif status == "error":
+            logger.warning("Session encountered an error, will retry")
             print("\nSession encountered an error")
             print("Will retry with a fresh session...")
             await asyncio.sleep(AUTO_CONTINUE_DELAY_SECONDS)
@@ -354,4 +371,18 @@ async def run_autonomous_agent(
     print("\n  Then open http://localhost:3000 (or check init.sh for the URL)")
     print("-" * 70)
 
+    # Send session ended webhook
+    passing, in_progress, total = count_passing_tests(project_dir)
+    send_session_event(
+        "session_ended",
+        project_dir,
+        agent_type=agent_type,
+        feature_id=feature_id,
+        extra={
+            "passing": passing,
+            "total": total,
+            "percentage": round((passing / total) * 100, 1) if total > 0 else 0,
+        }
+    )
+
     print("\nDone!")

api/__init__.py

@@ -5,6 +5,23 @@
 Database models and utilities for feature management.
 """
 
-from api.database import Feature, create_database, get_database_path
+from api.agent_types import AgentType
+from api.config import AutocoderConfig, get_config, reload_config
+from api.database import Feature, FeatureAttempt, FeatureError, create_database, get_database_path
+from api.feature_repository import FeatureRepository
+from api.logging_config import get_logger, setup_logging
 
-__all__ = ["Feature", "create_database", "get_database_path"]
+__all__ = [
+    "AgentType",
+    "AutocoderConfig",
+    "Feature",
+    "FeatureAttempt",
+    "FeatureError",
+    "FeatureRepository",
+    "create_database",
+    "get_config",
+    "get_database_path",
+    "get_logger",
+    "reload_config",
+    "setup_logging",
+]

api/agent_types.py

@@ -0,0 +1,29 @@
+"""
+Agent Types Enum
+================
+
+Defines the different types of agents in the system.
+"""
+
+from enum import Enum
+
+
+class AgentType(str, Enum):
+    """Types of agents in the autonomous coding system.
+
+    Inherits from str to allow seamless JSON serialization
+    and string comparison.
+
+    Usage:
+        agent_type = AgentType.CODING
+        if agent_type == "coding":  # Works due to str inheritance
+            ...
+    """
+
+    INITIALIZER = "initializer"
+    CODING = "coding"
+    TESTING = "testing"
+
+    def __str__(self) -> str:
+        """Return the string value for string operations."""
+        return self.value