feat: Bug scanner tuning, VSCode cleanup, and PR review fix

## Bug Prediction Scanner
- Add smart false positive filtering for dangerous_eval detection
- Add context-aware broad exception analysis
- Wire scanner to empathy.config.yml for customization
- Reduce false positives from 110 to 79 patterns

## VSCode Extension (v1.3.1)
- Remove Refactor Advisor and Test Generator dropdown panels
- Keep Generate Tests button (runs workflow directly)
- Temporarily hide Workflow Wizard panel

## PR Review Workflow
- Fix "CodeReviewCrew unavailable" by mapping hybrid→anthropic
- All 9 agents now properly initialize

## Documentation
- Add bug prediction workflow to CLI Guide
- Add scanner-patterns.md rule file
- Add bug_predict section to empathy.config.yml

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: 2 people

.claude/CLAUDE.md

@@ -4,80 +4,3 @@
 - Follow PEP 8
 - Write docstrings
 - Target 90%+ test coverage
-
-## Cross-Platform Compatibility
-
-The Empathy Framework must work on Windows, macOS, and Linux. Follow these guidelines:
-
-### File Paths
-
-- **Always use `pathlib.Path`** instead of string concatenation for paths
-- **Never hardcode path separators** (`/` or `\`)
-- **Use `empathy_os.platform_utils`** for OS-specific directories:
-
-  ```python
-  from empathy_os.platform_utils import get_default_log_dir, get_default_data_dir
-
-  # Good: Platform-appropriate paths
-  log_dir = get_default_log_dir()  # ~/Library/Logs/empathy on macOS, %APPDATA%/empathy/logs on Windows
-
-  # Bad: Hardcoded Unix path
-  log_dir = Path("/var/log/empathy")
-  ```
-
-### File Encoding
-
-- **Always specify `encoding="utf-8"`** when opening text files:
-
-  ```python
-  # Good
-  with open(path, "r", encoding="utf-8") as f:
-      content = f.read()
-
-  # Bad (Windows defaults to cp1252)
-  with open(path, "r") as f:
-      content = f.read()
-  ```
-
-- Use `empathy_os.platform_utils.read_text_file()` and `write_text_file()` for convenience
-
-### Asyncio
-
-- **Call `setup_asyncio_policy()`** before any `asyncio.run()` in CLI entry points:
-
-  ```python
-  from empathy_os.platform_utils import setup_asyncio_policy
-
-  def main():
-      setup_asyncio_policy()  # Required for Windows compatibility
-      asyncio.run(async_main())
-  ```
-
-- Windows requires `WindowsSelectorEventLoopPolicy` for compatibility with many libraries
-
-### Line Endings
-
-- Git handles line endings via `.gitattributes`
-- When writing files programmatically, use `\n` (Git will convert on checkout)
-
-### Environment Variables
-
-- Use `os.environ.get()` with sensible defaults
-- Remember Windows uses different variable names (`%APPDATA%` vs `$HOME`)
-
-### Subprocess Calls
-
-- Use `subprocess.run()` with `shell=False` when possible
-- Avoid shell-specific syntax (pipes, redirects) in subprocess calls
-- Use `shlex.split()` on Unix, but note it doesn't work on Windows
-
-### Testing
-
-- Mock `platform.system()` to test all OS paths:
-
-  ```python
-  with patch("platform.system", return_value="Windows"):
-      assert is_windows() is True
-  ```
-
-- Run tests on all platforms via CI (see `.github/workflows/tests.yml` - runs on ubuntu, macos, windows)

.claude/python-standards.md

@@ -1,7 +1,7 @@
 # Debugging Patterns
 
 Auto-generated from Empathy Framework learned patterns.
-Total patterns: 11
+Total patterns: 40
 
 ---
 
@@ -63,3 +63,48 @@ When debugging similar issues, consider these historical fixes:
 - **Root cause**: feat: Release v3.0.1 - XML-Enhanced Prompts & Security Fixes
 - **Fix**: See commit 8edfb707
 - **Files**: .claude/CLAUDE.md, .gitignore, CHANGELOG.md
+
+### import_error
+- **Root cause**: fix: Resolve import conflict between workflows.py and workflows/ package
+- **Fix**: See commit 1b928aec
+- **Files**: src/empathy_os/workflows/__init__.py
+
+### unknown
+- **Root cause**: ci: Add workflow_dispatch to PyPI publish workflow
+- **Fix**: See commit 32d3adcf
+- **Files**: .github/workflows/publish-pypi.yml
+
+### type_mismatch
+- **Root cause**: fix: Convert MkDocs relative asset paths to absolute for CSS loading
+- **Fix**: See commit 2ae52706
+- **Files**: scripts/fix_mkdocs_paths.py, .../framework-docs/FOREWORD_BY_CLAUDE/index.html, .../framework-docs/about-the-author/index.html
+
+### unknown
+- **Root cause**: fix: Force trailing slashes at all levels for MkDocs CSS compatibility
+- **Fix**: See commit 4e9157ce
+- **Files**: website/middleware.ts, website/next.config.ts, website/vercel.json
+
+### unknown
+- **Root cause**: fix: Use skipTrailingSlashRedirect to stop Next.js from stripping trailing slashes
+- **Fix**: See commit 55265287
+- **Files**: website/next.config.ts, website/vercel.json
+
+### unknown
+- **Root cause**: fix: Add Next.js middleware to enforce trailing slash for framework-docs
+- **Fix**: See commit 47662816
+- **Files**: website/middleware.ts
+
+### unknown
+- **Root cause**: fix: Add Vercel trailingSlash config for framework-docs CSS
+- **Fix**: See commit 994d5ad5
+- **Files**: website/vercel.json
+
+### unknown
+- **Root cause**: fix: Add vercel.json redirect for framework-docs trailing slash
+- **Fix**: See commit 0c56cfb1
+- **Files**: website/vercel.json
+
+### unknown
+- **Root cause**: fix: Add redirect to ensure trailing slash for framework-docs CSS paths
+- **Fix**: See commit 3ba1de27
+- **Files**: website/next.config.ts

.claude/rules/empathy/debugging.md

@@ -0,0 +1,103 @@
+# Bug Prediction Scanner Patterns
+
+This document describes the patterns detected by `empathy workflow run bug-predict` and the smart filtering applied to reduce false positives.
+
+## Detected Patterns
+
+| Pattern | Severity | Description |
+|---------|----------|-------------|
+| `dangerous_eval` | HIGH | Use of `eval()` or `exec()` on untrusted input |
+| `broad_exception` | MEDIUM | Bare `except:` or `except Exception:` that may mask errors |
+| `incomplete_code` | LOW | TODO/FIXME comments indicating unfinished work |
+
+## Automatic False Positive Filtering
+
+### dangerous_eval Exclusions
+
+The scanner automatically excludes:
+
+1. **Scanner test files** - Files matching:
+   - `test_bug_predict*`
+   - `test_scanner*`
+   - `test_security_scan*`
+
+2. **Test fixtures** - Code inside `write_text()` calls (test data written to temp files)
+
+3. **Detection code** - String literals like `if "eval(" in content`
+
+4. **JavaScript regex.exec()** - Safe method calls like `pattern.exec(text)`
+
+### broad_exception Exclusions
+
+The scanner uses context analysis to allow acceptable patterns:
+
+1. **Version detection with fallback**
+   ```python
+   try:
+       return get_version("package")
+   except Exception:
+       return "dev"  # Acceptable: graceful fallback
+   ```
+
+2. **Config loading with defaults**
+   ```python
+   try:
+       config = yaml.safe_load(f)
+   except Exception:
+       pass  # Fall back to default config
+   ```
+
+3. **Optional feature detection**
+   ```python
+   try:
+       import optional_lib
+   except Exception:
+       optional_lib = None
+   ```
+
+4. **Cleanup/teardown code**
+   - `__del__`, `__exit__`, `cleanup()`, `close()`, `teardown()`
+
+5. **Logging with re-raise**
+   ```python
+   except Exception as e:
+       logger.error(f"Error: {e}")
+       raise  # Re-raises after logging
+   ```
+
+6. **Intentional comments**
+   - `# fallback`, `# optional`, `# best effort`, `# graceful`
+
+## When Reviewing Scanner Results
+
+1. **HIGH severity (dangerous_eval)**: Always investigate - these are security risks
+2. **MEDIUM severity (broad_exception)**: Review context - may be acceptable
+3. **LOW severity (incomplete_code)**: Track in backlog - not urgent
+
+## Customizing Scanner Behavior
+
+Add exclusions in `empathy.config.yml`:
+
+```yaml
+bug_predict:
+  exclude_files:
+    - "**/test_*.py"
+    - "**/fixtures/**"
+  acceptable_exception_contexts:
+    - version
+    - config
+    - cleanup
+```
+
+## Related Commands
+
+```bash
+# Run bug prediction
+empathy workflow run bug-predict
+
+# Scan specific directory
+empathy workflow run bug-predict --input '{"path":"./src"}'
+
+# JSON output for CI
+empathy workflow run bug-predict --json
+```