@activatus/code-standards 0.0.0-stage → 3.0.0

package/static/templates/skills/securityAudit.md

@@ -0,0 +1,28 @@
+---
+name: securityAudit
+description: Audit the code for common security problems
+argument-hint: "[path]"
+allowed-tools: Read, Glob, Grep, Bash(pnpm audit:*), Bash(git ls-files:*)
+---
+
+Audit the code for security problems and report them. Do NOT modify any files.
+
+1. Work out the scope: `$ARGUMENTS` if given, otherwise the whole repository.
+2. Run `pnpm audit` and note every high and critical vulnerability.
+3. Check the code for each of these:
+   - **Secrets** — API keys, tokens or passwords written in code or committed in `.env` files. Use `git ls-files` to check which files are tracked.
+   - **Access control** — API routes and server actions that do not check who the user is or what they are allowed to do
+   - **Input validation** — request data used without being validated
+   - **Injection** — database queries or shell commands built by joining strings
+   - **Cross-site scripting** — `dangerouslySetInnerHTML` or unescaped user content
+   - **Sensitive data** — personal data or secrets written to logs or returned in error messages
+   - **Client exposure** — secrets or server-only code reachable from a client component
+4. Report the findings in order of severity: **Critical**, **High**, **Medium**, **Low**. For each one give the file and line, what the risk is, and how to fix it.
+5. Finish by listing what you did NOT check, so a clean report is not mistaken for a full security review.
+
+If `pnpm audit` fails, say so and carry on with the code checks.
+
+Do NOT audit the source of packages in `node_modules/` or `vendor/` — `pnpm audit` covers dependencies.
+Do NOT print the value of any secret you find. Report the file and line only.
+Do NOT fix anything. Report only.
+Do NOT stage, commit or push.

package/static/templates/skills/test.md

@@ -0,0 +1,24 @@
+---
+name: test
+description: Run the tests and report failures and missing tests
+argument-hint: "[path]"
+allowed-tools: Read, Glob, Grep, Bash(pnpm test:*)
+---
+
+Run the test suite and report the result. Do NOT modify any files.
+
+1. Read `package.json` and confirm a `test` script exists.
+2. Run `pnpm test $ARGUMENTS`.
+3. Report the failures grouped by cause, not by file. Tests that fail for the same reason go under one heading. For each cause give the test names, the file and line, and what was expected against what happened.
+4. Report separately any test that **never ran** — a file that failed to load, or a skipped test. A test that did not run has not passed.
+5. Check for missing test files in scope. Every function and component needs a test file beside it:
+   - `formatCurrency.ts` needs `formatCurrency.test.ts`
+   - `Button.tsx` needs `Button.test.tsx`
+   List every function and component file that has no test file. Ignore `index.ts`, `types.ts`, config files and Next.js route files.
+6. Finish with a one-line total: passed, failed, never ran, and files missing a test.
+
+If `package.json` has no `test` script, stop and say so.
+
+Do NOT fix failing tests or the code they test. Report only.
+Do NOT report on files in `node_modules/` or `vendor/`.
+Do NOT stage, commit or push.

package/static/templates/skills/typescript.md

@@ -0,0 +1,28 @@
+---
+name: typescript
+description: Tighten loose types and remove unsafe assertions
+argument-hint: "[path]"
+allowed-tools: Read, Glob, Grep, Edit, Bash(pnpm typecheck:*), Bash(pnpm lint:*)
+---
+
+Replace loose types with precise ones in the given files.
+
+1. Work out the scope: `$ARGUMENTS` if given. If it is empty, stop and ask which file or folder to work on.
+2. Find every loose type in scope:
+   - `any`, written or implied
+   - Non-null assertions (`value!`)
+   - Type casts (`value as SomeType`), except `as const`
+3. Fix each one:
+   - Replace `any` with the real type, or with `unknown` narrowed by a check
+   - Replace `value!` with a check that the value exists
+   - Replace a cast with validation or a properly typed source
+4. Follow the naming rule for every type you add or rename: the name ends in `Props` (the object parameter of a component or function) or `Type` (everything else).
+5. Run `pnpm typecheck`, then `pnpm lint`. Fix any errors your changes caused.
+6. Report each change: the file, what the type was, and what it is now. List anything you could not tighten, and why.
+
+If `package.json` has no `typecheck` script, say so and skip that check. Do NOT run `tsc` directly.
+
+Do NOT silence an error with `any`, `!`, `as`, `@ts-ignore` or `@ts-expect-error`.
+Do NOT change what the code does. Change types only.
+Do NOT edit files in `node_modules/` or `vendor/`.
+Do NOT stage, commit or push. Leave every change uncommitted.

package/static/templates/skills/updateLayout.md

@@ -0,0 +1,20 @@
+---
+name: updateLayout
+description: Regenerate the repository layout in AGENTS.md
+allowed-tools: Read, Glob, Edit, Bash(tree:*), Bash(ls:*)
+---
+
+Update the "Repository layout" section of `AGENTS.md` so it matches the repository as it is now.
+
+1. Read `AGENTS.md` and find the "Repository layout" section.
+2. Build a directory tree two levels deep:
+   - Run `tree -L 2 -a -I 'node_modules|.git|.next|build|dist|coverage|.DS_Store'`
+   - If `tree` is not installed, build the same tree with `ls` and Glob, and say that you used the fallback.
+3. Replace the code block in the "Repository layout" section with the new tree.
+4. If `AGENTS.md` has a "Workspace packages" section, update its table from the workspace `package.json` files: package name, path and description.
+5. Report what changed: the folders that were added and removed.
+
+If `AGENTS.md` does not exist, or has no "Repository layout" section, stop and say so.
+
+Do NOT edit any other section of `AGENTS.md`, and do NOT edit any other file.
+Do NOT stage, commit or push. Leave the change uncommitted.

package/static/templates/stylelint/css/stylelint.config.mjs

@@ -0,0 +1,40 @@
+/** @type {import("stylelint").Config} */
+export default {
+	ignoreFiles: ["**/vendor/**"],
+	extends: [
+		"stylelint-config-standard",
+		"stylelint-config-recess-order",
+	],
+	rules: {
+		"selector-max-id": 0,
+		"property-no-vendor-prefix": true,
+		"color-function-notation": "modern",
+		"import-notation": "string",
+		"at-rule-no-unknown": [
+			true,
+			{
+				ignoreAtRules: [
+					"theme",
+					"utility",
+					"variant",
+					"custom-variant",
+					"source",
+					"plugin",
+				],
+			},
+		],
+	},
+	overrides: [
+		{
+			files: ["**/*.module.css"],
+			rules: {
+				"color-named": "never",
+				"color-no-hex": true,
+				"selector-class-pattern": [
+					"^[a-z][a-zA-Z0-9]*$",
+					{ message: "Expected class selector to be camelCase" },
+				],
+			},
+		},
+	],
+};

package/static/templates/stylelint/scss/stylelint.config.mjs

@@ -0,0 +1,13 @@
+/** @type {import("stylelint").Config} */
+export default {
+	ignoreFiles: ["**/vendor/**"],
+	extends: [
+		"stylelint-config-standard-scss",
+		"stylelint-config-recess-order",
+	],
+	rules: {
+		"selector-max-id": 0,
+		"property-no-vendor-prefix": true,
+		"color-function-notation": "modern",
+	},
+};