@bonesofspring/ai-rules 0.2.10 → 0.2.11

package/presets/claude/mcp-ts/hooks/guard-shell-command.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# Lightweight shell guard for Claude Code projects using this preset.
+# TypeScript MCP: allow npm/npx/node/tsc/vitest/jest; package-manager mismatch checks when lockfile exists.
+# Package-manager mismatch checks apply only when a JS lockfile/package.json exists.
+
+set -euo pipefail
+
+input=$(cat)
+
+INPUT="$input" node <<'NODE'
+const fs = require('fs');
+
+const raw = process.env.INPUT || '';
+let event;
+try {
+  event = JSON.parse(raw);
+} catch {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const command = String(event.command || event.input?.command || '');
+if (!command.trim()) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+function out(permission, userMessage, agentMessage) {
+  process.stdout.write(JSON.stringify({
+    permission,
+    user_message: userMessage,
+    agent_message: agentMessage || userMessage,
+  }));
+}
+
+const dangerousGit = /\bgit\s+(reset\s+--hard|clean\s+-[^\n]*f|push\s+--force|push\s+-f|checkout\s+--\s+)/;
+if (dangerousGit.test(command)) {
+  out(
+    'ask',
+    'This command looks destructive for git state. Review it before continuing.',
+    'A project hook flagged a destructive git command. Ask the user before running it.',
+  );
+  process.exit(0);
+}
+
+const managerByFile = [
+  ['yarn.lock', 'yarn'],
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['package-lock.json', 'npm'],
+].find(([file]) => fs.existsSync(file));
+
+let expected = managerByFile?.[1];
+if (!expected && fs.existsSync('package.json')) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+    const pm = typeof pkg.packageManager === 'string' ? pkg.packageManager : '';
+    expected = pm.split('@')[0] || undefined;
+  } catch {
+    // Ignore invalid package.json in the hook; the agent can diagnose it later.
+  }
+}
+
+if (!expected) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const used = command.match(/(^|[;&|]\s*)(npm|yarn|pnpm)\s+/)?.[2];
+if (used && used !== expected) {
+  out(
+    'ask',
+    `This repository appears to use ${expected}, but the command uses ${used}. Confirm before continuing.`,
+    `Use ${expected} for package scripts and installs unless the user explicitly approves ${used}.`,
+  );
+  process.exit(0);
+}
+
+process.stdout.write('{ "permission": "allow" }');
+NODE

package/presets/claude/mcp-ts/mcp.json

@@ -0,0 +1,11 @@
+{
+  "mcpServers": {
+    "context7": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@upstash/context7-mcp@3.2.5"
+      ]
+    }
+  }
+}

package/presets/claude/mcp-ts/rules/README.md

@@ -0,0 +1,52 @@
+# `.claude/rules` (preset mcp-ts)
+
+Claude topic `.md` files are **derived** from Cursor SoT `presets/cursor/mcp-ts/rules/*.mdc`.
+
+## SoT sync
+
+| Principle | Detail |
+|-----------|--------|
+| **SoT** | `presets/cursor/mcp-ts/rules/*.mdc` |
+| **Derive** | Claude topic `.md` + `paths:` (drop `alwaysApply`) |
+| **Checklist** | change Cursor → update Claude twin **same PR** (**FAIL** if missing — see `preset-twin-sync` / build-verifier) |
+
+## Loading budget
+
+- **Session-start (no `paths:`):** exactly **3** — `mcp-ts-app-core`, `mcp-server-boundaries`, `code-quality`
+- All others — with `paths:`
+- **Twin depth:** domain rules target ≥15 body lines; thin aliases: `agent-team-intake`, `technical-retro`
+
+## Cursor → Claude mapping
+
+| Cursor `.mdc` (SoT) | Claude topic |
+|---------------------|--------------|
+| `agent-team-intake.mdc` | `tooling-and-review/agent-team-intake.md` |
+| `agent-team-orchestrator.mdc` | `tooling-and-review/agent-team-orchestrator.md` |
+| `anti-sycophancy-discipline.mdc` | `tooling-and-review/anti-sycophancy-discipline.md` |
+| `code-quality-and-refactoring.mdc` | `tooling-and-review/code-quality.md` |
+| `code-review-mr.mdc` | `tooling-and-review/code-review.md` |
+| `design-guidance.mdc` | `tooling-and-review/design-guidance.md` |
+| `feature-delivery-workflow.mdc` | `architecture/feature-delivery.md` |
+| `mcp-auth-secrets.mdc` | `api-and-data/mcp-auth-secrets.md` |
+| `mcp-contract-testing.mdc` | `api-and-data/mcp-contract-testing.md` |
+| `mcp-server-boundaries.mdc` | `architecture/mcp-server-boundaries.md` |
+| `mcp-tool-design.mdc` | `api-and-data/mcp-tool-design.md` |
+| `mcp-transport-packaging.mdc` | `api-and-data/mcp-transport-packaging.md` |
+| `mcp-ts-app-core.mdc` | `stack/mcp-ts-app-core.md` |
+| `mcp-ts-conventions.mdc` | `stack/mcp-ts-conventions.md` |
+| `mcp-ts-tooling.mdc` | `tooling-and-review/mcp-ts-tooling.md` |
+| `post-change-test.mdc` | `tooling-and-review/post-change-test.md` |
+| `preset-layering.mdc` | `tooling-and-review/preset-layering.md` |
+| `preset-no-cross-stack-leakage.mdc` | `tooling-and-review/preset-no-cross-stack-leakage.md` |
+| `preset-pr-checklist.mdc` | `tooling-and-review/preset-pr-checklist.md` |
+| `preset-token-budget.mdc` | `tooling-and-review/preset-token-budget.md` |
+| `preset-twin-sync.mdc` | `tooling-and-review/preset-twin-sync.md` |
+| `reference-features.mdc` | `architecture/reference-features.md` |
+| `security-mcp.mdc` | `tooling-and-review/security-mcp.md` |
+| `technical-retro.mdc` | `tooling-and-review/technical-retro.md` |
+| `tests-unit.mdc` | `testing/unit.md` |
+
+## Topics
+
+`architecture/`, `stack/`, `api-and-data/`, `testing/`, `tooling-and-review/`.  
+`ui-and-accessibility/` — README stub only (N/A for MCP server authoring).

package/presets/claude/mcp-ts/rules/api-and-data/README.md

@@ -0,0 +1,3 @@
+# api-and-data
+
+MCP tool design, transport, auth, contract testing.

package/presets/claude/mcp-ts/rules/api-and-data/mcp-auth-secrets.md

@@ -0,0 +1,44 @@
+---
+description: MCP env config, remote auth, redaction, secret handling
+paths:
+  - **/auth/**/*
+  - **/config/**/*
+  - **/.env*
+  - **/secrets/**/*
+---
+
+# MCP auth and secrets
+
+## Local stdio
+
+- Prefer env-based configuration for API keys and tokens; never commit live secrets.
+- Redact secrets in logs, error strings, and tool results.
+- Handlers receive only the credentials they need via narrow capability adapters — not `process.env` wholesale.
+
+## Remote / HTTP servers
+
+When remote transport is enabled (see `mcp-transport-packaging`):
+
+- Choose an auth mode explicitly (none only for trusted local-only; bearer/OAuth when exposed).
+- Fail closed when required auth config is missing in non-dev environments.
+- **Per-request authorization (required for bearer/OAuth):** on every request, validate token **issuer**, **audience**, **expiry**, and **scopes/roles** before tool/resource/prompt dispatch. Reject with a safe error if any check fails.
+- Place the authenticated principal (subject + granted scopes) into a **trusted request context** owned by the transport/auth layer — handlers must not re-parse raw `Authorization` headers.
+- Authorize each tool/resource against that context (capability ≠ “any authenticated caller”).
+- Validate and canonicalize untrusted inputs at the boundary before handlers run.
+- **TLS required** for any non-localhost exposure (or a trusted TLS-terminating proxy with a documented trust boundary). Never send bearer/OAuth tokens in plaintext over the network. Bind `127.0.0.1` for local remote-dev; treat `0.0.0.0` as exposed.
+- Safe errors: no token, cookie, or raw header echo in HTTP or tool error bodies.
+- OAuth redirect URIs: allowlist exact redirect targets — reject open redirects.
+
+## Forbidden
+
+- Hardcoded API keys/tokens in source or example configs with live-looking values.
+- Returning raw Authorization headers, cookies, or private keys in tool output.
+- Broad filesystem or network tools that inherit ambient credentials without AC.
+- Trusting client-supplied identity claims without server-side token validation.
+- Putting live tokens into shipped client `mcp.json` / `.mcp.json`.
+
+## Tests
+
+- Negative fixtures: logs/results must not contain bearer tokens or secret env values.
+- Misconfigured auth refuses to start or rejects requests (fail closed).
+- Expired / wrong-audience / insufficient-scope tokens are rejected before handlers run.

package/presets/claude/mcp-ts/rules/api-and-data/mcp-contract-testing.md

@@ -0,0 +1,42 @@
+---
+description: MCP schema snapshots, contract fixtures, optional Inspector smoke
+paths:
+  - **/*.{test,spec}.{ts,tsx,js}
+  - **/fixtures/**/*
+  - src/tools/**/*
+  - src/resources/**/*
+  - src/prompts/**/*
+---
+
+# MCP contract testing
+
+Protect tool/resource/prompt **schemas and protocol behavior** — not browser E2E and not Go/Java adapter integration suites.
+
+## What to cover
+
+1. **Schema snapshots / fixtures** — registered input/output JSON Schema (or SDK registration result) matches the intended contract.
+2. **Handler unit tests** — validated inputs → expected results/errors (table-driven).
+3. **Compatibility** — additive changes OK; breaking field renames/removals need versioning or new tool names.
+4. **Inspector smoke (optional)** — MCP Inspector CLI may be used as evidence; it is **not** a required Phase 1 gate.
+
+## Workflow (Phase 1)
+
+- `feature-developer` owns contract verification inline (no `contract-test-*` agents yet).
+- Prefer repository test runner discovered via `mcp-ts-tooling`.
+- Store fixtures next to tools/tests (`*.fixture.json`, schema snapshots) per repo convention.
+
+## Security negatives (when capability touches FS / net / auth)
+
+Require at least one deny fixture per exposed capability:
+
+- FS: path traversal / outside-root rejected; secret paths not readable without AC.
+- Net: blocked host / metadata IP rejected; allowlisted host OK.
+- Auth: expired / wrong-audience / insufficient-scope rejected before handler; results must not echo tokens (`mcp-auth-secrets`).
+
+Align shapes with `tests-unit` and `security-mcp`.
+
+## Anti-patterns
+
+- Claiming "works in Inspector" without schema/unit coverage for the change.
+- Testing only TypeScript types without runtime validation of invalid inputs.
+- Requiring Playwright, XCUITest, or Next e2e paths.

package/presets/claude/mcp-ts/rules/api-and-data/mcp-tool-design.md

@@ -0,0 +1,37 @@
+---
+description: MCP tool/resource/prompt design: names, schemas, errors, least surprise
+paths:
+  - src/tools/**/*
+  - src/resources/**/*
+  - src/prompts/**/*
+---
+
+# MCP tool design
+
+Model-facing tools, resources, and prompts are **public contracts**. Optimize for least surprise for the calling model.
+
+## Names and descriptions
+
+- Use stable, verb-oriented tool names (`read_file`, `list_tickets`) — not internal codenames.
+- Descriptions must state **what** the tool does, **when** to use it, and key constraints (side effects, required scopes).
+- Prefer enums / closed sets over free-form strings when the domain is finite.
+- Document idempotency and destructive effects explicitly in the description.
+
+## Schemas (Zod-first authoring)
+
+- Author validation with **Zod** (or the repo's schema library) for TypeScript types + runtime checks.
+- MCP-facing input/output schemas are **JSON Schema-compatible protocol contracts**.
+- Convert with an **SDK-supported** path — never pass a Zod object as the wire schema without verifying the installed `@modelcontextprotocol/sdk` API.
+- When unsure: `// VERIFY: @modelcontextprotocol/sdk @ <version>` and look up docs (Context7).
+
+## Errors and results
+
+- Map failures to clear, actionable error messages; do not leak stack traces, secrets, or absolute internal paths.
+- Keep success payloads structured and stable; avoid dumping entire process env or large blobs by default.
+- Version breaking schema changes (new tool name or documented major) rather than silently reshaping fields.
+
+## Anti-patterns
+
+- Generic "execute_anything" / "run_shell" tools without AC and capability scoping.
+- Duplicated ad-hoc schemas in registration and handler.
+- Side effects inside registration helpers.

package/presets/claude/mcp-ts/rules/api-and-data/mcp-transport-packaging.md

@@ -0,0 +1,43 @@
+---
+description: MCP stdio lifecycle, optional remote transport, bin/npx packaging
+paths:
+  - src/index.ts
+  - package.json
+  - **/Dockerfile
+  - **/docker-compose*.yml
+---
+
+# MCP transport and packaging
+
+## Default: stdio
+
+- Local Cursor/Claude use → **stdio** transport from the server entry (`src/index.ts` or equivalent).
+- Entry owns connect/listen lifecycle and graceful shutdown; tools must not open competing transports.
+- Fail closed on missing required startup configuration.
+
+## Packaging
+
+- Expose a `bin` / `npx`-friendly entry in `package.json` that runs the compiled or `tsx` entry as appropriate for the repo.
+- Keep `files` / publish contents minimal; do not ship secrets, `.env`, or local credentials.
+- Document install and run commands in the consumer README — not by registering a half-built server into shipped client MCP JSON.
+
+## Optional remote transport
+
+- Streamable HTTP / SSE / remote hosting is **opt-in** — load this rule + `mcp-auth-secrets` + `security-mcp`.
+- Require explicit AC for auth mode, network exposure, and rate limits.
+- Before exposing remotely: implement **per-request** token validation (issuer/audience/expiry/scopes) and trusted request context per `mcp-auth-secrets`; treat retrieved content as untrusted per `security-mcp`.
+- Do not mandate Docker/OAuth/Inspector for every stdio-only server.
+
+## Threat model by transport
+
+| Mode | Trust boundary | Who can invoke tools | Required controls |
+|------|----------------|----------------------|-------------------|
+| **stdio** (default) | Same machine / IDE process | Host user + IDE agent session | Least-privilege tools; no network AuthN assumed; secrets via env; fail closed on missing config |
+| **HTTP / SSE** (opt-in) | Network-reachable process | Any client that can reach bind address | **TLS required** for non-localhost (or trusted TLS-terminating proxy with documented boundary); localhost-only bind OK without TLS; auth fail-closed; per-request issuer/audience/expiry/scopes; rate limits; safe errors (no token echo) |
+
+- Prefer bind `127.0.0.1` for local remote-dev; treat `0.0.0.0` as production exposure needing AC + TLS (or documented TLS-terminating proxy). Never expose bearer/OAuth over plaintext off-localhost.
+- Stdio inherits host privileges — do not compensate by adding “execute anything” tools.
+
+## VERIFY
+
+- Transport constructor and `Server` / `McpServer` APIs drift across SDK versions — verify against the installed package before inventing calls.

package/presets/claude/mcp-ts/rules/architecture/README.md

@@ -0,0 +1,3 @@
+# architecture
+
+Boundaries, feature delivery, reference features.

package/presets/claude/mcp-ts/rules/architecture/feature-delivery.md

@@ -0,0 +1,45 @@
+---
+description: End-to-end delivery checklist for TypeScript MCP features
+paths:
+  - src/**/*
+  - package.json
+---
+
+<!-- shared-core: architecture/feature-delivery-workflow.md -->
+
+# Feature delivery (TypeScript MCP)
+
+Order of work:
+
+1. **Contract** — tool/resource/prompt name, description, input/output shape (`mcp-tool-design`).
+2. **Schema** — Zod authoring + JSON Schema-compatible registration (`mcp-ts-conventions`).
+3. **Handler** — validated inputs → scoped capability → safe result/error mapping.
+4. **Registration** — wire into server modules; keep entry (`src/index.ts`) free of tool business logic.
+5. **Tests** — unit + contract fixtures (`tests-unit`, `mcp-contract-testing`).
+6. **Package validation** — typecheck/test; optional Inspector smoke; `bin`/entry OK (`mcp-transport-packaging`).
+7. **Gate** — `post-change-test` (+ `mcp-ts-tooling`).
+
+```mermaid
+flowchart LR
+  C[Contract] --> S[Schema]
+  S --> H[Handler]
+  H --> R[Register]
+  R --> T[Unit/contract tests]
+  T --> P[Package validate]
+```
+
+## Matrix
+
+| Path | Rules |
+|------|-------|
+| `src/tools/**`, `src/resources/**`, `src/prompts/**` | `mcp-tool-design`, `mcp-server-boundaries` |
+| schemas / validation | `mcp-ts-conventions`, `mcp-contract-testing` |
+| `src/index.ts`, package `bin` | `mcp-transport-packaging` |
+| auth/config | `mcp-auth-secrets`, `security-mcp` |
+| After `*.ts` edits | `post-change-test` |
+
+## Anti-patterns
+
+- Monolithic `index.ts`; unscoped shell/FS tools; inventing SDK APIs; skipping schema tests "for speed".
+- Prescribing Go hexagonal folders or Next `app/src/**`.
+- Load `design-guidance` when assessing structure, smells, or pattern fit.

package/presets/claude/mcp-ts/rules/architecture/mcp-server-boundaries.md

@@ -0,0 +1,28 @@
+---
+description: MCP server module boundaries: registration, handler, capability, lifecycle
+---
+
+# Границы MCP-сервера
+
+Dependency direction:
+
+```text
+MCP client → transport/entry → registration → schema + handler → scoped capability
+```
+
+- **Registration** (`src/tools|resources|prompts`): owns protocol names, descriptions, schemas, result mapping. No unrelated side effects; no hidden validation skips.
+- **Handlers**: receive **validated** inputs; depend on **narrow** capability adapters (FS paths, APIs). No process-wide secrets, arbitrary filesystem, or ambient client state.
+- **Contracts**: tool/resource/prompt schemas are **versioned public interfaces**. Do not prescribe UI, DB controllers, or Go-style `domain/application/adapters` layouts.
+- **Startup / transport** (`src/index.ts`): owns transport selection, lifecycle, fail-closed config. Do not duplicate startup inside tools.
+
+# Edit bundles (load on matching paths)
+
+- `src/tools|resources|prompts/**` → `mcp-tool-design` (+ `mcp-contract-testing` when changing schemas)
+- `src/index.ts`, package/`bin` → `mcp-transport-packaging`
+- auth/config/env → `mcp-auth-secrets` + `security-mcp`
+- After `*.ts` edits → `post-change-test` (+ `mcp-ts-tooling`)
+
+# Требование к агенту
+
+- Keep registration, validation, and handlers separable — avoid a monolithic `index.ts`.
+- Prefer least privilege for every tool capability.

package/presets/claude/mcp-ts/rules/architecture/reference-features.md

@@ -0,0 +1,33 @@
+---
+description: Reference paths for MCP server layout (dogfood-aligned Phase 1)
+paths:
+  - src/**/*
+---
+
+<!-- shared-core: architecture/reference-features.template.md -->
+
+# Reference features (mcp-ts) — Phase 1
+
+Canonical layout matches `dogfood/mcp-ts-sample/` (consumer repos may rename; prefer the same shapes).
+
+| Area | Example path | Glob hint |
+|------|--------------|-----------|
+| Entry / transport | `src/index.ts` | `src/index.ts` |
+| Tools | `src/tools/echo.ts` | `src/tools/**` |
+| Tool tests | `src/tools/echo.spec.ts` | `src/tools/**/*.{test,spec}.ts` |
+| Resources | `src/resources/` (optional) | `src/resources/**` |
+| Prompts | `src/prompts/` (optional) | `src/prompts/**` |
+| Schemas | colocated next to tool (or `schemas.ts`) | `**/schemas.ts`, `src/tools/**` |
+| Build output | `dist/index.js` | `dist/**` |
+
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.cursor/team/conventions.md`** (and Claude twin path if both tools installed).
+
+## Dogfood scenarios (Phase 1)
+
+1. `/task` add tool — contract → schema → handler → register → tests → package (`dogfood/mcp-ts-sample`).
+2. Schema validation bug — unit + contract fixtures on `src/tools/*.spec.ts`.
+3. Capability / secrets review — security-reviewer + `security-mcp` (e.g. FS allowlist tool when added).
+
+Init (maintainer): `node packages/ai-rules/bin/cli.js init cursor --preset mcp-ts --cwd dogfood/mcp-ts-sample` — do not commit generated `.cursor/` into the sample unless the team decides otherwise.

package/presets/claude/mcp-ts/rules/stack/README.md

@@ -0,0 +1,3 @@
+# stack
+
+Stack always-on / conventions (`mcp-ts-app-core`, `mcp-ts-conventions`).

package/presets/claude/mcp-ts/rules/stack/mcp-ts-app-core.md

@@ -0,0 +1,27 @@
+---
+description: TypeScript MCP stack, layout, stdio-first entry (mcp-ts preset)
+---
+
+# Стек и окружение
+
+Версии Node, TypeScript и `@modelcontextprotocol/sdk` — **из `package.json` / lockfile целевого репозитория**. Рамка preset:
+
+- **Язык / платформа:** TypeScript (Node); package manager — discover from lockfile / `packageManager`.
+- **SDK:** official `@modelcontextprotocol/sdk` — verify APIs before use (`VERIFY:` markers when unsure).
+- **Транспорт по умолчанию:** **stdio-first**; remote HTTP/auth — requestable rules only.
+- **Точка входа:** `src/index.ts` (or repo equivalent) owns transport + lifecycle — not individual tools.
+- **Тесты:** repository runner (Vitest/Jest/node:test); contract fixtures for schemas — see `mcp-contract-testing`.
+- **Наблюдаемость:** only if already in repo — never log secrets or full tool payloads with credentials.
+
+# Структура (suggested)
+
+```text
+src/index.ts                 # transport + server lifecycle
+src/tools/                   # tool registration + handlers
+src/resources/               # resource registration (if used)
+src/prompts/                 # prompt registration (if used)
+src/**/schemas.ts            # Zod authoring schemas
+package.json                 # bin / main for stdio packaging
+```
+
+Границы — **`mcp-server-boundaries`**. Tooling — requestable **`mcp-ts-tooling`**. После правок TS — **`post-change-test`**.

package/presets/claude/mcp-ts/rules/stack/mcp-ts-conventions.md

@@ -0,0 +1,29 @@
+---
+description: Strict TypeScript, Zod validation, safe errors, SDK verification for MCP
+paths:
+  - src/**/*.ts
+  - src/**/*.tsx
+---
+
+# TypeScript conventions (MCP servers)
+
+- Prefer **strict** TypeScript (`strict` true when adding a new tsconfig; do not weaken existing strictness without AC).
+- Validate tool inputs with Zod (or repo schema lib) **before** side effects.
+- Export narrow types for handler inputs inferred from schemas (`z.infer<typeof schema>`).
+- Errors returned to clients: safe messages; log details server-side with redaction.
+- Avoid `any`; prefer `unknown` + narrowing at boundaries.
+- SDK calls: confirm symbols against installed `@modelcontextprotocol/sdk` — use `// VERIFY: @modelcontextprotocol/sdk @ <version>` when unsure.
+- Do not invent hexagonal `internal/domain|application|adapters` layouts unless the target repo already uses them.
+
+## Registration flow
+
+1. Define Zod (or equivalent) input schema next to the tool.
+2. Map schema → JSON Schema / SDK registration shape the repo uses.
+3. Implement a pure handler that accepts validated args + narrow capability ports (FS/net/secrets).
+4. Register the tool once from the server entry (`src/index.ts` or a dedicated register module) — handlers must not open a second transport.
+5. Cover invalid inputs and happy path in colocated `*.spec.ts` / `*.test.ts` before packaging.
+
+## Errors and types
+
+- Prefer typed result/error unions over throwing across the MCP boundary when the SDK pattern allows.
+- Never put stack traces, env dumps, or tokens in tool results.

package/presets/claude/mcp-ts/rules/testing/README.md

@@ -0,0 +1,3 @@
+# testing
+
+Unit testing conventions.

package/presets/claude/mcp-ts/rules/testing/unit.md

@@ -0,0 +1,30 @@
+---
+description: Unit testing conventions for MCP handlers and schemas
+paths:
+  - **/*.{test,spec}.{ts,tsx,js}
+  - **/__tests__/**/*
+---
+
+# Unit tests (MCP)
+
+- Table-driven tests for schema parse failures and handler outcomes.
+- Test **pure** handler logic with fakes for FS/network capabilities — no live MCP client required.
+- Cover invalid inputs that schemas should reject **before** side effects.
+- Prefer repository runner (Vitest/Jest/node:test) discovered via tooling rules.
+
+## Required shapes (when capability applies)
+
+- `schema.parse` / Zod: valid input; missing field; wrong type; empty string where non-empty required.
+- Path tools: reject `../` escape and symlink-outside-root (fake FS); accept in-root relative paths.
+- URL/fetch tools: deny blocked hosts (metadata IP, link-local) when allowlist is in play.
+- Auth-sensitive handlers: assert secrets never appear in returned content or thrown messages.
+
+## Forbidden smells
+
+- Hitting real external APIs in unit tests without an explicit integration harness and AC.
+- Asserting on unstable SDK private fields.
+- Browser e2e frameworks (Playwright) as the unit gate.
+
+## Naming
+
+- `toolName.validInput`, `toolName.rejectsPathTraversal`, `schema.parse.*` — follow repo style.

package/presets/claude/mcp-ts/rules/tooling-and-review/README.md

@@ -0,0 +1,3 @@
+# tooling-and-review
+
+Quality, tooling, security, agent-team, preset meta.

package/presets/claude/mcp-ts/rules/tooling-and-review/agent-team-intake.md

@@ -0,0 +1,23 @@
+---
+description: Suggest /task for work requests without a slash command (mcp-ts)
+paths:
+  - .cursor/team/**/*
+  - .claude/team/**/*
+---
+
+<!-- shared-core: agent-team/agent-team-intake.md -->
+
+# Agent team intake
+
+When the user message looks like a **work request** (implement, add, fix, refactor, review MR, write tests, spike) — not a question about how code works:
+
+1. Prefer **`/task <their request>`** or invoke **task-router** first.
+2. Do not jump straight to coding without router + pipeline when scope is non-trivial.
+3. Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
+
+Exceptions: user explicitly says «без pipeline», «просто сделай», or continues an active slug.
+
+## Stack notes
+
+- Scope: TypeScript MCP server modules (`src/tools|resources|prompts`, `src/index.ts`) — not Next `app/src`, iOS `Features/`, Go `cmd/`/`internal/**`, or Playwright/XCUITest UI flows.
+- **Phase 1 override:** no `codebase-analyzer` agent. For explain-as-is («как работает X»), answer inline or load requestable MCP rules (`mcp-server-boundaries`, `mcp-tool-design`) — do **not** invoke a missing subagent.