@amrhas82/agentic-kit 1.7.0 → 1.7.5

package/packages/droid/commands/optimize.md

@@ -0,0 +1,21 @@
+---
+id: optimize
+name: optimize
+description: Optimize performance [target]
+usage: /optimize <target-area>
+argument-hint: [file-or-function]
+---
+Analyze $ARGUMENTS for performance.
+
+## Examine
+- Time complexity (Big O)
+- Space complexity
+- I/O operations
+- Database queries (N+1?)
+- Unnecessary allocations
+
+## Output
+- Current bottlenecks
+- Specific optimizations
+- Expected improvement
+- Trade-offs involved

package/packages/droid/commands/refactor.md

@@ -0,0 +1,22 @@
+---
+id: refactor
+name: refactor
+description: Refactor [code]
+usage: /refactor <code-section>
+argument-hint: [file-or-function]
+---
+Refactor $ARGUMENTS.
+
+## Goals
+- Reduce complexity
+- Improve readability
+- Apply DRY
+- Better naming
+- Smaller functions (single responsibility)
+
+## Constraints
+- NO behavior changes
+- Keep public API intact
+- Existing tests must pass
+
+Explain each change.

package/packages/droid/commands/review.md

@@ -0,0 +1,19 @@
+---
+id: review
+name: review
+description: Review code [file]
+usage: /review
+argument-hint: [file or leave empty for staged changes]
+---
+Review $ARGUMENTS (or staged changes if not specified).
+
+## Check For
+- Security: OWASP Top 10, auth issues, data exposure
+- Performance: N+1 queries, memory leaks, blocking calls
+- Correctness: Edge cases, error handling, type safety
+- Maintainability: Complexity, naming, duplication
+
+## Output Format
+### 🚨 Critical (blocks merge)
+### ⚠️ Warnings (should fix)
+### 💡 Suggestions (nice to have)

package/packages/droid/commands/{root-cause-tracing/root-cause-tracing.md → root-cause-tracing.md}

@@ -1,20 +1,42 @@
 ---
-description: Systematically trace bugs backward through call stack to find original trigger, never just fix symptoms
-argument-hint: <error-or-bug-to-trace>
+id: root-cause-tracing
+name: root-cause-tracing
+description: Use when errors occur deep in execution and you need to trace back to find the original trigger - systematically traces bugs backward through call stack, adding instrumentation when needed, to identify source of invalid data or incorrect behavior
+usage: /root-cause-tracing <issue-description>
+auto_trigger: false
 ---
 
+# Root Cause Tracing
+
+## Overview
+
+Bugs often manifest deep in the call stack (git init in wrong directory, file created in wrong location, database opened with wrong path). Your instinct is to fix where the error appears, but that's treating a symptom.
+
 **Core principle:** Trace backward through the call chain until you find the original trigger, then fix at the source.
 
 ## When to Use
 
+```dot
+digraph when_to_use {
+    "Bug appears deep in stack?" [shape=diamond];
+    "Can trace backwards?" [shape=diamond];
+    "Fix at symptom point" [shape=box];
+    "Trace to original trigger" [shape=box];
+    "BETTER: Also add defense-in-depth" [shape=box];
+
+    "Bug appears deep in stack?" -> "Can trace backwards?" [label="yes"];
+    "Can trace backwards?" -> "Trace to original trigger" [label="yes"];
+    "Can trace backwards?" -> "Fix at symptom point" [label="no - dead end"];
+    "Trace to original trigger" -> "BETTER: Also add defense-in-depth";
+}
+```
+
 **Use when:**
 - Error happens deep in execution (not at entry point)
 - Stack trace shows long call chain
 - Unclear where invalid data originated
 - Need to find which test/code triggers the problem
 
-**Don't fix symptoms:** Find the root cause that created the conditions for the bug.
-
 ## The Tracing Process
 
 ### 1. Observe the Symptom
@@ -51,7 +73,7 @@ Project.create('name', context.tempDir); // Accessed before beforeEach!
 
 ## Adding Stack Traces
 
-When manual tracing isn't enough, add instrumentation:
+When you can't trace manually, add instrumentation:
 
 ```typescript
 // Before the problematic operation
@@ -75,39 +97,22 @@ async function gitInit(directory: string) {
 npm test 2>&1 | grep 'DEBUG git init'
 ```
 
+**Analyze stack traces:**
+- Look for test file names
+- Find the line number triggering the call
+- Identify the pattern (same test? same parameter?)
+
 ## Finding Which Test Causes Pollution
 
 If something appears during tests but you don't know which test:
 
-**Use bisection approach:**
-```bash
-# Run tests one by one until you find the polluter
-./find-polluter.sh '.git' 'src/**/*.test.ts'
-```
+Use the bisection script: @find-polluter.sh
 
-**Manual approach:**
 ```bash
-# Add logging to find the culprit
-echo "DEBUG: About to run operation" >&2
-npm test 2>&1 | grep -A5 -B5 "DEBUG:"
+./find-polluter.sh '.git' 'src/**/*.test.ts'
 ```
 
-## Key Principles
-
-### The Golden Rule
-```
-NEVER fix just where the error appears.
-Trace back to find the original trigger.
-```
-
-### Layered Defense
-```
-1. Find immediate cause
-2. Trace backward to source  
-3. Fix at source
-4. Add validation at each layer
-5. Bug becomes impossible
-```
+Runs tests one-by-one, stops at first polluter. See script for usage.
 
 ## Real Example: Empty projectDir
 
@@ -124,12 +129,38 @@ Trace back to find the original trigger.
 
 **Fix:** Made tempDir a getter that throws if accessed before beforeEach
 
-**Defense-in-depth added:**
+**Also added defense-in-depth:**
 - Layer 1: Project.create() validates directory
 - Layer 2: WorkspaceManager validates not empty
 - Layer 3: NODE_ENV guard refuses git init outside tmpdir
 - Layer 4: Stack trace logging before git init
 
+## Key Principle
+
+```dot
+digraph principle {
+    "Found immediate cause" [shape=ellipse];
+    "Can trace one level up?" [shape=diamond];
+    "Trace backwards" [shape=box];
+    "Is this the source?" [shape=diamond];
+    "Fix at source" [shape=box];
+    "Add validation at each layer" [shape=box];
+    "Bug impossible" [shape=doublecircle];
+    "NEVER fix just the symptom" [shape=octagon, style=filled, fillcolor=red, fontcolor=white];
+
+    "Found immediate cause" -> "Can trace one level up?";
+    "Can trace one level up?" -> "Trace backwards" [label="yes"];
+    "Can trace one level up?" -> "NEVER fix just the symptom" [label="no"];
+    "Trace backwards" -> "Is this the source?";
+    "Is this the source?" -> "Trace backwards" [label="no - keeps going"];
+    "Is this the source?" -> "Fix at source" [label="yes"];
+    "Fix at source" -> "Add validation at each layer";
+    "Add validation at each layer" -> "Bug impossible";
+}
+```
+
+**NEVER fix just where the error appears.** Trace back to find the original trigger.
+
 ## Stack Trace Tips
 
 **In tests:** Use `console.error()` not logger - logger may be suppressed
@@ -137,75 +168,10 @@ Trace back to find the original trigger.
 **Include context:** Directory, cwd, environment variables, timestamps
 **Capture stack:** `new Error().stack` shows complete call chain
 
-## Common Tracing Patterns
-
-### Long Call Chains
-```typescript
-// Entry point
-await performOperation(input);
-
-// Deep in stack
-async function performOperation(input) {
-  await validateInput(input);     // Layer 1
-  await processData(input);       // Layer 2  
-  await persistResults(input);    // Layer 3
-  await notifyCompletion(input);  // Layer 4 - ERROR HERE
-}
-
-// Trace backward:
-// notifyCompletion → persistResults → processData → validateInput → performOperation
-// Find where invalid input originated
-```
-
-### Data Flow Issues
-```typescript
-// Error: null pointer in deep function
-function deepFunction(obj) {
-  obj.property.method(); // obj is null
-}
-
-// Trace:
-// Where did obj come from?
-// What called deepFunction?
-// What should obj contain?
-// Where was it created/modified?
-```
-
-### Test Pollution
-```typescript
-// Side effect in one test affects others
-test('test A', () => {
-  createFile('test.txt'); // Leaves file behind
-});
-
-test('test B', () => {
-  readFile('test.txt'); // Fails because test A didn't clean up
-});
-
-// Use find-polluter.sh to identify test A
-```
-
-## Usage Examples
-
-**Complex error:**
-`/root-cause-tracing "database connection fails after API call"`
-
-**Test pollution:**
-`/root-cause-tracing "filesystem pollution during test suite"`
-
-**Deep stack error:**
-`/root-cause-tracing "TypeError in third-party library deep call chain"`
-
-**Data corruption:**
-`/root-cause-tracing "user data corrupted in final processing step"`
-
 ## Real-World Impact
 
-**Benefits:**
-- Fixed root cause through 5-level trace
-- Fixed at source (getter validation)  
+From debugging session (2025-10-03):
+- Found root cause through 5-level trace
+- Fixed at source (getter validation)
 - Added 4 layers of defense
 - 1847 tests passed, zero pollution
-- Prevented future occurrences through validation
-
-Remember: Symptoms are clues, not the problem. Always trace backward to find and fix the source.

package/packages/droid/commands/security.md

@@ -0,0 +1,22 @@
+---
+id: security
+name: security
+description: Scan security [target]
+usage: /security
+argument-hint: [file, directory, or leave empty for full scan]
+allowed-tools: Read, Grep, Glob
+---
+Audit $ARGUMENTS for security vulnerabilities.
+
+## Check For
+- Injection: SQL, command, XSS, template
+- Auth: Weak passwords, session issues, CSRF
+- Data: Exposure, logging secrets, insecure storage
+- Config: Debug mode, default creds, missing headers
+- Dependencies: Known CVEs
+
+## Output
+Severity-ranked findings with:
+- Location (file:line)
+- Risk explanation
+- Remediation steps

package/packages/droid/commands/ship.md

@@ -0,0 +1,19 @@
+---
+id: ship
+name: ship
+description: Check pre-deployment
+usage: /ship
+allowed-tools: Bash(npm *), Bash(git *)
+---
+Pre-deploy checklist:
+
+- [ ] Tests pass (`npm test`)
+- [ ] Lint clean (`npm run lint`)
+- [ ] Build succeeds (`npm run build`)
+- [ ] No console.log/debugger statements
+- [ ] Env vars documented
+- [ ] No hardcoded secrets
+- [ ] Error handling complete
+- [ ] Migrations ready
+
+Run checks and report: Ready 🚀 or Blocked 🛑 with issues.

package/packages/droid/commands/skill-creator.md

@@ -0,0 +1,212 @@
+---
+id: skill-creator
+name: skill-creator
+description: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.
+usage: /skill-creator <skill-type> <skill-description>
+auto_trigger: false
+license: Complete terms in LICENSE.txt
+---
+
+# Skill Creator
+
+This skill provides guidance for creating effective skills.
+
+## About Skills
+
+Skills are modular, self-contained packages that extend Claude's capabilities by providing
+specialized knowledge, workflows, and tools. Think of them as "onboarding guides" for specific
+domains or tasks—they transform Claude from a general-purpose agent into a specialized agent
+equipped with procedural knowledge that no model can fully possess.
+
+### What Skills Provide
+
+1. Specialized workflows - Multi-step procedures for specific domains
+2. Tool integrations - Instructions for working with specific file formats or APIs
+3. Domain expertise - Company-specific knowledge, schemas, business logic
+4. Bundled resources - Scripts, references, and assets for complex and repetitive tasks
+
+### Anatomy of a Skill
+
+Every skill consists of a required SKILL.md file and optional bundled resources:
+
+```
+skill-name/
+├── SKILL.md (required)
+│   ├── YAML frontmatter metadata (required)
+│   │   ├── name: (required)
+│   │   └── description: (required)
+│   └── Markdown instructions (required)
+└── Bundled Resources (optional)
+    ├── scripts/          - Executable code (Python/Bash/etc.)
+    ├── references/       - Documentation intended to be loaded into context as needed
+    └── assets/           - Files used in output (templates, icons, fonts, etc.)
+```
+
+#### SKILL.md (required)
+
+**Metadata Quality:** The `name` and `description` in YAML frontmatter determine when Claude will use the skill. Be specific about what the skill does and when to use it. Use the third-person (e.g. "This skill should be used when..." instead of "Use this skill when...").
+
+#### Bundled Resources (optional)
+
+##### Scripts (`scripts/`)
+
+Executable code (Python/Bash/etc.) for tasks that require deterministic reliability or are repeatedly rewritten.
+
+- **When to include**: When the same code is being rewritten repeatedly or deterministic reliability is needed
+- **Example**: `scripts/rotate_pdf.py` for PDF rotation tasks
+- **Benefits**: Token efficient, deterministic, may be executed without loading into context
+- **Note**: Scripts may still need to be read by Claude for patching or environment-specific adjustments
+
+##### References (`references/`)
+
+Documentation and reference material intended to be loaded as needed into context to inform Claude's process and thinking.
+
+- **When to include**: For documentation that Claude should reference while working
+- **Examples**: `references/finance.md` for financial schemas, `references/mnda.md` for company NDA template, `references/policies.md` for company policies, `references/api_docs.md` for API specifications
+- **Use cases**: Database schemas, API documentation, domain knowledge, company policies, detailed workflow guides
+- **Benefits**: Keeps SKILL.md lean, loaded only when Claude determines it's needed
+- **Best practice**: If files are large (>10k words), include grep search patterns in SKILL.md
+- **Avoid duplication**: Information should live in either SKILL.md or references files, not both. Prefer references files for detailed information unless it's truly core to the skill—this keeps SKILL.md lean while making information discoverable without hogging the context window. Keep only essential procedural instructions and workflow guidance in SKILL.md; move detailed reference material, schemas, and examples to references files.
+
+##### Assets (`assets/`)
+
+Files not intended to be loaded into context, but rather used within the output Claude produces.
+
+- **When to include**: When the skill needs files that will be used in the final output
+- **Examples**: `assets/logo.png` for brand assets, `assets/slides.pptx` for PowerPoint templates, `assets/frontend-template/` for HTML/React boilerplate, `assets/font.ttf` for typography
+- **Use cases**: Templates, images, icons, boilerplate code, fonts, sample documents that get copied or modified
+- **Benefits**: Separates output resources from documentation, enables Claude to use files without loading them into context
+
+### Progressive Disclosure Design Principle
+
+Skills use a three-level loading system to manage context efficiently:
+
+1. **Metadata (name + description)** - Always in context (~100 words)
+2. **SKILL.md body** - When skill triggers (<5k words)
+3. **Bundled resources** - As needed by Claude (Unlimited*)
+
+*Unlimited because scripts can be executed without reading into context window.
+
+## Skill Creation Process
+
+To create a skill, follow the "Skill Creation Process" in order, skipping steps only if there is a clear reason why they are not applicable.
+
+### Step 1: Understanding the Skill with Concrete Examples
+
+Skip this step only when the skill's usage patterns are already clearly understood. It remains valuable even when working with an existing skill.
+
+To create an effective skill, clearly understand concrete examples of how the skill will be used. This understanding can come from either direct user examples or generated examples that are validated with user feedback.
+
+For example, when building an image-editor skill, relevant questions include:
+
+- "What functionality should the image-editor skill support? Editing, rotating, anything else?"
+- "Can you give some examples of how this skill would be used?"
+- "I can imagine users asking for things like 'Remove the red-eye from this image' or 'Rotate this image'. Are there other ways you imagine this skill being used?"
+- "What would a user say that should trigger this skill?"
+
+To avoid overwhelming users, avoid asking too many questions in a single message. Start with the most important questions and follow up as needed for better effectiveness.
+
+Conclude this step when there is a clear sense of the functionality the skill should support.
+
+### Step 2: Planning the Reusable Skill Contents
+
+To turn concrete examples into an effective skill, analyze each example by:
+
+1. Considering how to execute on the example from scratch
+2. Identifying what scripts, references, and assets would be helpful when executing these workflows repeatedly
+
+Example: When building a `pdf-editor` skill to handle queries like "Help me rotate this PDF," the analysis shows:
+
+1. Rotating a PDF requires re-writing the same code each time
+2. A `scripts/rotate_pdf.py` script would be helpful to store in the skill
+
+Example: When designing a `frontend-webapp-builder` skill for queries like "Build me a todo app" or "Build me a dashboard to track my steps," the analysis shows:
+
+1. Writing a frontend webapp requires the same boilerplate HTML/React each time
+2. An `assets/hello-world/` template containing the boilerplate HTML/React project files would be helpful to store in the skill
+
+Example: When building a `big-query` skill to handle queries like "How many users have logged in today?" the analysis shows:
+
+1. Querying BigQuery requires re-discovering the table schemas and relationships each time
+2. A `references/schema.md` file documenting the table schemas would be helpful to store in the skill
+
+To establish the skill's contents, analyze each concrete example to create a list of the reusable resources to include: scripts, references, and assets.
+
+### Step 3: Initializing the Skill
+
+At this point, it is time to actually create the skill.
+
+Skip this step only if the skill being developed already exists, and iteration or packaging is needed. In this case, continue to the next step.
+
+When creating a new skill from scratch, always run the `init_skill.py` script. The script conveniently generates a new template skill directory that automatically includes everything a skill requires, making the skill creation process much more efficient and reliable.
+
+Usage:
+
+```bash
+scripts/init_skill.py <skill-name> --path <output-directory>
+```
+
+The script:
+
+- Creates the skill directory at the specified path
+- Generates a SKILL.md template with proper frontmatter and TODO placeholders
+- Creates example resource directories: `scripts/`, `references/`, and `assets/`
+- Adds example files in each directory that can be customized or deleted
+
+After initialization, customize or remove the generated SKILL.md and example files as needed.
+
+### Step 4: Edit the Skill
+
+When editing the (newly-generated or existing) skill, remember that the skill is being created for another instance of Claude to use. Focus on including information that would be beneficial and non-obvious to Claude. Consider what procedural knowledge, domain-specific details, or reusable assets would help another Claude instance execute these tasks more effectively.
+
+#### Start with Reusable Skill Contents
+
+To begin implementation, start with the reusable resources identified above: `scripts/`, `references/`, and `assets/` files. Note that this step may require user input. For example, when implementing a `brand-guidelines` skill, the user may need to provide brand assets or templates to store in `assets/`, or documentation to store in `references/`.
+
+Also, delete any example files and directories not needed for the skill. The initialization script creates example files in `scripts/`, `references/`, and `assets/` to demonstrate structure, but most skills won't need all of them.
+
+#### Update SKILL.md
+
+**Writing Style:** Write the entire skill using **imperative/infinitive form** (verb-first instructions), not second person. Use objective, instructional language (e.g., "To accomplish X, do Y" rather than "You should do X" or "If you need to do X"). This maintains consistency and clarity for AI consumption.
+
+To complete SKILL.md, answer the following questions:
+
+1. What is the purpose of the skill, in a few sentences?
+2. When should the skill be used?
+3. In practice, how should Claude use the skill? All reusable skill contents developed above should be referenced so that Claude knows how to use them.
+
+### Step 5: Packaging a Skill
+
+Once the skill is ready, it should be packaged into a distributable zip file that gets shared with the user. The packaging process automatically validates the skill first to ensure it meets all requirements:
+
+```bash
+scripts/package_skill.py <path/to/skill-folder>
+```
+
+Optional output directory specification:
+
+```bash
+scripts/package_skill.py <path/to/skill-folder> ./dist
+```
+
+The packaging script will:
+
+1. **Validate** the skill automatically, checking:
+   - YAML frontmatter format and required fields
+   - Skill naming conventions and directory structure
+   - Description completeness and quality
+   - File organization and resource references
+
+2. **Package** the skill if validation passes, creating a zip file named after the skill (e.g., `my-skill.zip`) that includes all files and maintains the proper directory structure for distribution.
+
+If validation fails, the script will report the errors and exit without creating a package. Fix any validation errors and run the packaging command again.
+
+### Step 6: Iterate
+
+After testing the skill, users may request improvements. Often this happens right after using the skill, with fresh context of how the skill performed.
+
+**Iteration workflow:**
+1. Use the skill on real tasks
+2. Notice struggles or inefficiencies
+3. Identify how SKILL.md or bundled resources should be updated
+4. Implement changes and test again

package/packages/droid/commands/subagent-spawning.md

@@ -0,0 +1,82 @@
+---
+id: subagent-spawning
+name: subagent-spawning
+description: Use when spawning fresh subagents for isolated task execution. Provides TDD-aware templates for 3-process-task-list and other agents.
+usage: Used by 3-process-task-list and other agents for clean subagent execution
+auto_trigger: true
+---
+
+## Auto-Trigger
+
+**APPLIES WHEN:**
+- 3-process-task-list spawning implementer for a task
+- Any agent delegating work to fresh subagent
+- Task isolation needed (prevent context pollution)
+
+**APPLIES TO:**
+- Task list processing
+- Parallel task execution
+- Complex multi-step implementations
+
+## Template A: With TDD (when tdd: yes)
+
+```
+You are implementing Task: {task_description}
+
+CONTEXT:
+{relevant_file_contents}
+
+ACCEPTANCE CRITERIA:
+{task_specific_criteria}
+
+TDD REQUIRED:
+Write test FIRST. Watch it FAIL. Then implement. Then watch it PASS.
+{tdd_note}
+
+VERIFY WITH: {verify_command}
+
+WORKFLOW:
+1. Write test for expected behavior
+2. Run test - MUST see it FAIL (red)
+3. Implement minimal code to pass
+4. Run test - verify it PASSES (green)
+5. Refactor if needed
+6. Report: test output (fail→pass) + changes + concerns
+
+CONSTRAINTS:
+- Do NOT implement before writing test
+- Do NOT skip red-green verification
+- Do NOT reference other tasks
+- Do NOT assume context not provided
+```
+
+## Template B: Without TDD (when tdd: no)
+
+```
+You are implementing Task: {task_description}
+
+CONTEXT:
+{relevant_file_contents}
+
+ACCEPTANCE CRITERIA:
+{task_specific_criteria}
+
+VERIFY WITH: {verify_command}
+
+WORKFLOW:
+1. Implement the task completely
+2. Run verify command BEFORE claiming done
+3. Report: changes + verify output + concerns
+
+CONSTRAINTS:
+- Do NOT reference other tasks
+- Do NOT assume context not provided
+- Do NOT claim done without verify output
+```
+
+## Why Fresh Subagents?
+
+- Task 1 confusion doesn't pollute task 5
+- Each task gets clean reasoning slate
+- Prevents "I already tried that" false memories
+- Forces explicit context = fewer assumptions