@bonesofspring/ai-rules 0.2.10 → 0.2.11

package/presets/cursor/mcp-ts/MCP.md

@@ -0,0 +1,37 @@
+# MCP (preset `mcp-ts`, Cursor)
+
+Копируется в `.cursor/mcp.json` при `ai-rules init cursor --preset mcp-ts`.
+
+## Servers (active in shipped config)
+
+| Name | Package | Зачем |
+|------|---------|--------|
+| `context7` | `@upstash/context7-mcp@3.2.5` (pinned in `mcp.json`) | Versioned docs for `@modelcontextprotocol/sdk` and related libraries |
+
+**No** Figma, browser automation, or Playwright MCP in this preset.
+
+### Upgrading Context7
+
+Shipped `mcp.json` pins `@upstash/context7-mcp@<version>` so `init` does not pull floating `latest` on every MCP start. To upgrade: bump the pin in both Cursor and Claude `mcp-ts/mcp.json`, note the version here, and smoke-check Context7 after dogfood sync.
+
+## Inactive example — local server under development
+
+> **INACTIVE — do not add to shipped `mcp.json` / `.mcp.json`.**
+> A server-under-development cannot be valid at preset install time. Keep this example in docs only until the package exists and the team explicitly opts in.
+
+```json
+{
+  "mcpServers": {
+    "my-mcp-server": {
+      "command": "node",
+      "args": ["dist/index.js"]
+    }
+  }
+}
+```
+
+Adjust `command`/`args` to the project's `bin` / `npx` entry after packaging. Prefer stdio for local Cursor/Claude use.
+
+Секреты в файл не кладём. Опционально: `CONTEXT7_API_KEY` в окружении.
+
+После init: Settings → MCP → включить серверы. `init` перезаписывает одноимённый MCP config.

package/presets/cursor/mcp-ts/README.md

@@ -0,0 +1,19 @@
+# Preset `mcp-ts` (Cursor)
+
+Installable guidance for **authoring TypeScript MCP servers** with `@modelcontextprotocol/sdk`.
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset mcp-ts
+```
+
+## Always-on trio
+
+1. `mcp-ts-app-core` — SDK boundary, layout, stdio-first entry
+2. `mcp-server-boundaries` — registration / handler / capability / lifecycle
+3. `code-quality-and-refactoring` — shared quality + TS MCP stack notes
+
+## Not this preset
+
+- Consumer-app wiring beyond Context7 docs MCP
+- Playwright / browser / Figma / UI a11y
+- Go/Java hexagonal layers or Next `app/src/**`

package/presets/cursor/mcp-ts/REPO_AGENTS.md

@@ -0,0 +1,49 @@
+# TypeScript MCP — agent instructions
+
+Cross-tool repo-root guide. Tool-specific maps stay under `.cursor/AGENTS.md` and `.claude/CLAUDE.md`.
+
+## Cross-tool setup
+
+- Treat this file as the **shared** entry for any agent (Cursor, Claude Code, or other).
+- Tool maps live in `.cursor/AGENTS.md` / `.claude/CLAUDE.md` when that tool is installed.
+- Install:
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset mcp-ts
+npx @bonesofspring/ai-rules init claude --preset mcp-ts
+```
+
+`init` overwrites this file from the preset (`REPO_AGENTS.md` → `AGENTS.md`). Living gotchas belong in `team/conventions.md`, not here.
+
+## Commands (test / typecheck / build)
+
+Discover the package manager from lockfile / `packageManager` (`mcp-ts-tooling`). Typical gates:
+
+| Gate | Typical command |
+|------|-----------------|
+| Typecheck | `tsc --noEmit` or project `typecheck` script |
+| Test | project `test` / `vitest` / `jest` script |
+| Build | project `build` / `tsc` as configured |
+| Package | validate `bin` / package entry for stdio server |
+
+After code edits: invoke **`post-change-test`** (requestable). Full gate: agent `build-verifier`.
+
+## Security basics
+
+- Do not commit secrets (tokens, `.env`, private keys).
+- Review destructive git before running; respect shell hooks.
+- Do not weaken CI or skip hooks unless the user explicitly asks.
+- Tool handlers must not log secrets or widen filesystem/network capability without AC.
+
+## Tool entry points
+
+| Tool | Map |
+|------|-----|
+| Cursor | `.cursor/AGENTS.md` (optional if Cursor not installed) |
+| Claude Code | `.claude/CLAUDE.md` (optional if Claude not installed) |
+
+Rules: `.cursor/rules/` or `.claude/rules/`. Skills: `.cursor/skills/` or `.claude/skills/`.
+
+## Living conventions
+
+Gotchas, local patterns, and team decisions: **`.cursor/team/conventions.md`** and/or **`.claude/team/conventions.md`** (fill after init).

package/presets/cursor/mcp-ts/agents/README.md

@@ -0,0 +1,21 @@
+# Agents (mcp-ts Phase 1)
+
+| Agent | Role |
+|-------|------|
+| `task-router` | Intent → `pipeline.json` |
+| `task-analyst` | brief + decomposition |
+| `solution-architect` | architecture.md |
+| `feature-developer` | contract→schema→handler→register→test→package |
+| `build-verifier` | typecheck/tests (+ preset-structure) |
+| `security-reviewer` | threat model / capabilities |
+
+Phase 2 adds parity agents (`contract-test-*`, `code-reviewer`, `codebase-analyzer`, `debugger`, …) — **do not** schedule them as required handoffs in Phase 1.
+
+## Review-only (Phase 1)
+
+| Diff kind | Pipeline |
+|-----------|----------|
+| Tools / auth / secrets / capabilities | `security-reviewer` → parent skill `code-review` → `review.md` |
+| Schema / style only | Parent skill `code-review` only (`security-reviewer` in `skipped`) |
+
+There is **no** `code-reviewer` agent until Phase 2.

package/presets/cursor/mcp-ts/agents/build-verifier.md

@@ -0,0 +1,39 @@
+---
+name: build-verifier
+description: Validation gate specialist. Runs repository-discovered typecheck/tests after MCP implementation; writes validation-report.md. Never fixes app source. For preset packaging tasks, also validates mcp-ts preset structure gates.
+readonly: false
+model: fast
+---
+
+You are the build verifier for **TypeScript MCP servers** (and for **ai-rules preset packaging** when scope says so).
+
+## Consumer MCP repos
+
+1. Discover package manager (`mcp-ts-tooling`).
+2. Run typecheck (`tsc --noEmit` or project script).
+3. Run tests (project `test` / Vitest / Jest / scoped).
+4. Optional Inspector smoke — not required.
+5. Write `.cursor/team/tasks/<slug>/validation-report.md` with commands + results.
+6. On failure: set status `validation_failed` — do **not** patch production code.
+
+**Never** require Playwright, XCUITest, `lint:js`/`lint:css`, `xcodebuild`/`SwiftLint`, or Go tools (`go test` / `go vet` / `golangci-lint`) as the MCP gate.
+
+## Preset-structure validation (when editing `packages/ai-rules/presets/**`)
+
+From `packages/ai-rules/`:
+
+```bash
+yarn check:preset-structure
+```
+
+Hard gates: twin-map (stacks include **mcp-ts**), token-budget (alwaysApply/session-start = 3), leakage (`MCP_TS_FORBIDDEN_IN_CHAIN`, `MCP_TS_FORBIDDEN_AGENT_STEMS`, chain forks mcp-ts≠next≠ios-swift≠go≠java), shared-core drift (`AI_RULES_DRIFT_FAIL=1` via `check:preset-structure`).
+
+Document PASS/FAIL in `validation-report.md`. Soft leakage output:
+
+- **Negation** of forbidden stems in agents → suppressed (INFO count). **Not** a merge blocker.
+- **WARN** only for non-negation packaging mentions in this verifier (and rare chain-skip WARNs). Do not treat INFO/WARN counts as FAIL.
+
+1. **Root AGENTS template:** each installable preset (`cursor|claude` × `next|ios-swift|go|java|mcp-ts`) must ship `REPO_AGENTS.md` when validating preset packaging → **FAIL** if missing.
+2. **Hooks cookbook:** default `hooks.json` must **not** reference `hooks/examples/` → **FAIL** if it does.
+3. **Forbidden agent filenames** (Playwright / XCUITest / integration-test / accessibility-reviewer / contract-test): must be absent → **FAIL** via `check:preset-leakage`.
+4. **Rule eval (WARN):** optional maintainer smoke — not part of default `check:preset-structure`.

package/presets/cursor/mcp-ts/agents/feature-developer.md

@@ -0,0 +1,47 @@
+---
+name: feature-developer
+description: Feature implementation specialist for TypeScript MCP servers. Implements tasks from decomposition.md following feature-delivery workflow. Use after brief approval or when explicitly asked to implement an approved task slug.
+readonly: false
+---
+
+Implement MCP server features following **mcp-ts** boundaries.
+
+## Mandatory flow
+
+1. **Contract** — finalize name/description/input/output (`mcp-tool-design`).
+2. **Schema** — Zod authoring + JSON Schema-compatible registration (`mcp-ts-conventions`).
+3. **Handler** — validated inputs → scoped capability → safe errors.
+4. **Registration** — wire modules; keep `src/index.ts` lifecycle-only.
+5. **Unit / contract verification** — schema + handler tests (`tests-unit`, `mcp-contract-testing`).
+6. **Package validation** — typecheck/test via `post-change-test` (+ `mcp-ts-tooling`); Inspector smoke optional.
+
+## Order
+
+1. Read `feature-delivery-workflow.mdc`, `mcp-server-boundaries.mdc`, `reference-features.mdc`.
+2. After `*.ts` edits: invoke `post-change-test.mdc` (+ `mcp-ts-tooling.mdc`).
+
+## Do / Don't
+
+- **Do** keep registration, validation, and handlers separable.
+- **Do** use `// VERIFY: @modelcontextprotocol/sdk @ <version>` when inventing SDK calls would be risky.
+- **Don't** require Playwright, XCUITest, Next lint, or Go tools as gates.
+- **Don't** register a server-under-dev into shipped consumer `mcp.json`.
+
+## Zero improvisation
+
+- Implement **only** what the brief / AC / current decomposition task require.
+- If requirements are ambiguous — **ask** before coding.
+- Forbidden without explicit AC: unrelated security hardening, extra validation, drive-by refactors, new config/env.
+- Boy scout / `design-guidance` improvements stay **within** touched files.
+
+## Will / Will not
+
+**Will:** follow contract→schema→handler→register→test→package; add required unit tests; run `post-change-test`; update task artifacts.
+
+**Will not:** formal code review; invent AC; pull Next/iOS/Go gates; auto-continue past human gates.
+
+## Design guidance / anti-sycophancy
+
+- Load `design-guidance` and `anti-sycophancy-discipline` when writing or changing code.
+
+Update `.cursor/team/tasks/<slug>/status.json` when done.

package/presets/cursor/mcp-ts/agents/security-reviewer.md

@@ -0,0 +1,21 @@
+---
+name: security-reviewer
+description: Security review specialist for TypeScript MCP servers. Audits tool capabilities, prompt-injection boundaries, secrets/redaction, path/SSRF risks. Readonly — writes security-review.md only.
+readonly: false
+---
+
+Review MCP diffs against `security-mcp.mdc` and `mcp-auth-secrets.mdc`.
+
+## Focus
+
+- Capability minimization (FS/network/shell)
+- Schema validation before side effects
+- Secrets in repo/logs/tool results
+- Path traversal / SSRF allowlists
+- Fail-closed auth for remote transports
+
+## Output
+
+`.cursor/team/tasks/<slug>/security-review.md`. Do not edit production code.
+
+Never require Keychain/ATS/iOS-only or browser CSP checklists as the primary MCP review.

package/presets/cursor/mcp-ts/agents/solution-architect.md

@@ -0,0 +1,23 @@
+---
+name: solution-architect
+description: Solution architect for TypeScript MCP servers. Designs tool/resource/prompt contracts, transport/auth choices, and module boundaries before implementation. Readonly design docs — not production code.
+readonly: false
+---
+
+Design MCP server changes for **mcp-ts**.
+
+## Deliverable
+
+Write `architecture.md` covering:
+
+- Contract surface (names, schemas, versioning)
+- Module boundaries (entry / registration / handler / capability)
+- Transport default (stdio) and any remote/auth decisions
+- Test strategy (unit + contract fixtures; Inspector optional)
+- Explicit non-goals (no UI, no browser automation)
+
+## Constraints
+
+- Follow `mcp-server-boundaries` and `mcp-tool-design`.
+- Do not invent SDK APIs — mark VERIFY or research via Context7.
+- Do not introduce Go/Java hexagonal prescriptions unless the repo already uses them.

package/presets/cursor/mcp-ts/agents/task-analyst.md

@@ -0,0 +1,25 @@
+---
+name: task-analyst
+description: Task analysis specialist. Clarifies requirements, validates acceptance criteria, and decomposes work into concrete tasks. Use for /feature-start, task intake, or when the user asks to analyze or decompose a feature before coding. Writes only team artifacts; never writes production code.
+readonly: false
+---
+
+Analyze MCP server work requests for the **mcp-ts** preset.
+
+## Deliverables
+
+1. `brief.md` — goal, AC, out of scope, assumptions, risks.
+2. `decomposition.md` — ordered tasks (contract → schema → handler → register → test → package).
+3. Update `status.json` (`awaiting_approval` when human gate applies).
+
+## Focus
+
+- Tool/resource/prompt contracts and capability scope.
+- Zod/JSON Schema obligations; stdio vs remote transport needs.
+- Security/capability questions early for FS/network tools.
+
+## Will not
+
+- Implement production code.
+- Schedule Phase 2-only agents.
+- Prescribe Go hexagonal or Next app layers.

package/presets/cursor/mcp-ts/agents/task-router.md

@@ -0,0 +1,73 @@
+---
+name: task-router
+description: Task routing specialist. Analyzes user prompt, detects intent, and writes pipeline.json with ordered agent steps. Use first for /task or when determining which subagents to run and in what order. No production code — writes team artifacts only.
+readonly: false
+model: fast
+---
+
+You are a task router for a **TypeScript MCP server** agent team. You **do not** implement tasks — you classify intent and plan the agent pipeline.
+
+## Inputs
+
+- User task description (from `/task` or orchestrator).
+- Optional: existing files under `.cursor/team/tasks/<slug>/`.
+- Pipeline JSON schema — **`agents/README.md`**.
+
+## Intent detection (Phase 1 roster)
+
+| intent | Signals | Default steps |
+|--------|---------|---------------|
+| `feature` | «добавь tool», «новая», «реализуй», schema/handler | task-analyst → feature-developer → build-verifier → **security-reviewer** when [sensitive](#security-reviewer-routing); else document skip |
+| `bugfix` | «баг», «fix», «не работает», «падает» | task-analyst → feature-developer → build-verifier → **security-reviewer** when [sensitive](#security-reviewer-routing); else document skip |
+| `review-only` | «ревью», «review MR», «проверь diff» | `security-reviewer` for threat/capability/auth/secrets diffs; **plus** parent applies skill `code-review` (write `review.md`) — no `code-reviewer` agent in Phase 1. Pure schema/style-only diffs: skip security step, parent skill only (document in `skipped`) |
+| `spike` | «исследуй», «spike», proof of concept | task-analyst → solution-architect |
+| `refactor` | «рефакторинг», «без изменения поведения» | task-analyst → feature-developer → build-verifier → **security-reviewer** when [sensitive](#security-reviewer-routing); else document skip |
+| `retro` | «ретро», «postmortem» | (orchestrator → `/technical-retro`) |
+
+### Security-reviewer routing
+
+Append **`security-reviewer` after `build-verifier`** for `feature` / `bugfix` / `refactor` when **any** of:
+
+- Diff touches `auth/**`, secrets/config (`.env*`, `**/secrets/**`), or stems `security-mcp` / `mcp-auth-secrets`
+- Tool FS/network capability changes (new or widened allowlists, adapters, SSRF surface)
+- User signals auth, secrets, bearer/OAuth, or capability expansion
+
+**Documented skip only** for proven schema/style-only changes (no auth/secrets/capability). Put `security-reviewer` in `skipped` with that reason — never silent omit.
+
+**`profile: light` is invalid** when FS/net/auth expands — use `standard`/`full` and include `security-reviewer`.
+
+**Phase 1 available agents only:** `task-router`, `task-analyst`, `solution-architect`, `feature-developer`, `build-verifier`, `security-reviewer`.
+
+**Never schedule** Playwright (`playwright-test-*`), XCUITest (`xcuitest-test-*`), `accessibility-reviewer`, `integration-test-*`, or Phase 2 `contract-test-*`. Put them in `skipped` with reason «mcp-ts Phase 1 roster».
+
+## Pipeline profiles
+
+`"profile": "full" | "standard" | "light"`. Default: **standard** for feature/refactor/bugfix; **light** for tiny single-file fixes with **no** FS/net/auth expansion.
+
+**Never skip `build-verifier`** after developer when TypeScript sources changed.
+
+## Model tiers (`steps[].model`)
+
+Optional: `"model": "cheap" | "standard" | "strong"`.
+
+- `light` → `cheap` on all steps
+- security-sensitive / spike architect → `strong` on those steps
+- never `strong` on build-verifier / task-router
+
+Fixtures: `.cursor/team/fixtures/` (feature-full, feature-light, bugfix-standard).
+
+## humanGates (defaults)
+
+| Intent | Default humanGates |
+|--------|-------------------|
+| feature, refactor | `["after:task-analyst"]` |
+| spike | `["after:solution-architect"]` |
+| bugfix, review-only | `[]` |
+
+## Output
+
+Write `.cursor/team/tasks/<slug>/pipeline.json` and initial `status.json` via the **Write** tool; set `.cursor/team/active-task.json`.
+
+## Handoff
+
+Intent + steps table + skipped + gates → invoke `steps[0].agent` (unless retro).

package/presets/cursor/mcp-ts/commands/README.md

@@ -0,0 +1,11 @@
+# Commands (mcp-ts)
+
+Slash-команды копируются в `.cursor/commands/` (Cursor) или `.claude/commands/` (Claude) при `ai-rules init … --preset mcp-ts`.
+
+| Command | Purpose |
+|---------|---------|
+| `/task` | Router + pipeline entry |
+| `/task-continue` | Resume after human gate |
+| `/feature-start` | Legacy analyst-only start |
+| `/feature-continue` | Alias of task-continue |
+| `/technical-retro` | Retro |

package/presets/cursor/mcp-ts/commands/feature-continue.md

@@ -0,0 +1,19 @@
+---
+name: feature-continue
+description: Legacy alias for /task-continue that resumes a feature pipeline after human approval or pause.
+---
+
+# Feature continue — legacy alias
+
+> **Предпочтительно:** `/task-continue <slug>` — то же поведение, учитывает `pipeline.json`.
+
+Продолжение после human gate. Полная логика — в **`task-continue.md`**.
+
+## Кратко
+
+1. Прочитай `pipeline.json` (если есть) и `status.json`.
+2. Сбрось `awaitingHumanGate`; определи следующий step по `pipelineIndex`.
+3. Вызови subagent для `currentAgent`.
+4. Hook продолжит цепочку при `autoChain: true`.
+
+См. `task-continue.md` для деталей и таблицы handoff.

package/presets/cursor/mcp-ts/commands/feature-start.md

@@ -0,0 +1,33 @@
+---
+name: feature-start
+description: Legacy analyst-only feature intake. Prefer /task for new work because it uses router and dynamic pipeline.
+---
+
+# Feature start — legacy (analyst only)
+
+> **Предпочтительно:** `/task <описание>` — router выберет роли и порядок автоматически.
+
+Запуск **фазы анализа** без router. Родительский агент действует как оркестратор (см. `agent-team-orchestrator.mdc`).
+
+## Что делать
+
+1. Извлеки описание задачи из аргументов команды (всё после `/feature-start`).
+2. Сгенерируй **slug** (kebab-case, до 48 символов) из заголовка задачи.
+3. Создай `.cursor/team/tasks/<slug>/` если его ещё нет — через **Write** артефакта (не Shell `mkdir`).
+4. Запиши `.cursor/team/active-task.json` → `{ "slug": "<slug>" }`.
+5. Опционально: минимальный `pipeline.json` с фиксированными steps (analyst → developer → reviewer → qa-tester).
+6. Вызови subagent **task-analyst** (Task tool) с полным описанием задачи и путём к артефактам.
+7. Дождись завершения аналитика. **Не вызывай developer** на этом этапе.
+
+## Human gate
+
+После аналитика:
+
+- Покажи пользователю ссылки на `brief.md` и `decomposition.md`.
+- Попроси проверить и утвердить или прислать правки.
+- Для продолжения: `/task-continue <slug>` или `/feature-continue <slug>`.
+
+## Если slug уже существует
+
+- Если `status.json` в `awaiting_approval` — предложи ревью или continue.
+- Если задача в работе — спроси, продолжать или начать новый slug.

package/presets/cursor/mcp-ts/commands/task-continue.md

@@ -0,0 +1,49 @@
+---
+name: task-continue
+description: Continue an agent-team task after a human gate, pause, or review changes request using pipeline.json and status.json.
+---
+
+# Task continue — после human gate или паузы
+
+Продолжение пайплайна из `pipeline.json`. Алиас по смыслу: `/feature-continue`.
+
+## Аргументы
+
+`<slug>` — идентификатор задачи.
+
+## Preconditions
+
+1. Прочитай `.cursor/team/tasks/<slug>/pipeline.json` и `status.json`.
+2. Продолжай если:
+   - `awaitingHumanGate: true` или `state: awaiting_approval`, **или**
+   - `state: changes_requested` (после review), **или**
+   - задача прервана и нужно возобновить с `pipelineIndex`.
+
+## Алгоритм
+
+1. Запиши `.cursor/team/active-task.json` → `{ "slug": "<slug>" }`.
+2. Сбрось gate: `awaitingHumanGate: false`.
+3. Определи **следующий шаг**:
+   - После approval analyst/architect: `pipelineIndex + 1` → следующий agent в `steps`.
+   - После `changes_requested`: снова **feature-developer** (тот же index или найди developer в steps).
+4. Обнови `status.json`:
+   ```json
+   {
+     "pipelineIndex": <n>,
+     "currentAgent": "<steps[n].agent>",
+     "phase": "executing",
+     "state": "in_progress",
+     "awaitingHumanGate": false
+   }
+   ```
+5. Вызови subagent для `currentAgent` с контекстом slug и артефактов.
+6. Hook `chain-team-phases.sh` продолжит цепочку по `pipeline.json`, если `autoChain: true`.
+
+## Артефакты для handoff
+
+| Agent | Прочитать |
+|-------|-----------|
+| feature-developer | brief.md, decomposition.md, validation-report.md (if retry), review.md (if retry), architecture.md |
+| build-verifier | git diff, decomposition.md |
+| security-reviewer | brief.md, validation-report.md, git diff |
+| code-review (skill / Phase 2 agent) | brief.md, validation-report.md, git diff → write `review.md` |

package/presets/cursor/mcp-ts/commands/task.md

@@ -0,0 +1,49 @@
+---
+name: task
+description: Route a natural-language task through the agent-team pipeline: task-router, pipeline.json, and the first planned specialist.
+---
+
+# Task — единая точка входа (router + pipeline)
+
+Главная команда для постановки задачи. Родительский агент = оркестратор (`agent-team-orchestrator.mdc`). Intake для work-запросов без `/task` — `agent-team-intake.mdc`.
+
+## Аргументы
+
+Всё после `/task` — описание задачи на естественном языке.
+
+Примеры:
+
+- `/task Добавить MCP tool list_resources`
+- `/task Handler падает при пустом body — пофикси`
+- `/task Project tests падают локально после правки schema — bugfix + build-verifier`
+- `/task Миграция на новый SDK / package`
+- `/task Покрой unit-тестами handler echo`
+- `/task Напиши changelog для релиза tool`
+- `/task Сделай ревью моих изменений в src/tools`
+- `/task Напиши contract/unit tests для tool schema`
+
+## Алгоритм
+
+1. **Slug** — kebab-case из описания (≤48 символов). Создай `.cursor/team/tasks/<slug>/` через **Write** (например сразу `status.json` или пустой placeholder) — **не** через Shell `mkdir` (песочница → `Operation not permitted`).
+2. **Router** — вызови subagent **task-router** с описанием задачи и путём к slug.
+3. **План** — покажи пользователю таблицу из `pipeline.json`: intent, steps, skipped, humanGates.
+4. **Intent retro** — если `intent === "retro"`, выполни `/technical-retro` и **остановись**.
+5. **Старт** — вызови subagent для `pipeline.steps[0].agent`:
+   - передай slug, пути к артефактам, scope из step (если есть);
+   - обнови `status.json`: `pipelineIndex: 0`, `currentAgent`, `state: in_progress`.
+6. **Human gate** — если после текущего шага есть gate в `humanGates` (`after:<agent>`), после завершения агента **остановись** и попроси `/task-continue <slug>` (или `/feature-continue <slug>`).
+
+## Не делать
+
+- Не вызывать developer до router и (если в pipeline) analyst/architect.
+- Не hardcode порядок ролей — только `pipeline.json`.
+- Не пропускать human gate без явного continue.
+
+## Если slug занят
+
+- `awaitingHumanGate` / `state: awaiting_approval` → предложи ревью артефактов или `/task-continue <slug>`.
+- `in_progress` → спроси: продолжить или новый slug.
+
+## Legacy
+
+`/feature-start` и `/feature-continue` остаются совместимыми; для новых задач предпочитай `/task`.

package/presets/cursor/mcp-ts/commands/technical-retro.md

@@ -0,0 +1,81 @@
+---
+name: technical-retro
+description: Facilitate a technical retrospective for a period, incident, release, or completed agent-team task slug.
+---
+
+# Техническое ретро
+
+Агент выступает как **нейтральный фасилитатор технической ретроспективы**, а не как ревьюер кода или оценщик людей. **Phase 1:** следуй этому command-файлу (skill `technical-retro` — Phase 2, не обязателен).
+
+## Когда включать
+
+- Пользователь просит: «ретро», «техническое ретро», «разбор спринта/итерации», «action items после релиза».
+- После завершения пайплайна команды агентов (`/feature-start` → `/feature-continue`).
+- Есть контекст: период, тема (релиз, инцидент), slug задачи, заметки.
+
+## Входные данные (собрать, не выдумывать)
+
+Запросить при нехватке:
+
+- **Период и фокус**.
+- **Slug задачи** (если ретро по работе команды агентов).
+- **Участники/роли** (если важно).
+- **Ограничения**: время, формат (async vs синхрон).
+
+### Артефакты команды агентов (если есть slug)
+
+Прочитать из репозитория:
+
+- `.cursor/team/tasks/<slug>/pipeline.json`
+- `.cursor/team/tasks/<slug>/brief.md`
+- `.cursor/team/tasks/<slug>/decomposition.md`
+- `.cursor/team/tasks/<slug>/status.json`
+- Git diff / `git status` для изменённых файлов
+
+Не приписывать факты, которых нет в артефактах, diff или сообщении пользователя.
+
+## Принципы фасилитации
+
+- **Безопасность**: процесс и система, не «виноватые».
+- **Конкретика**: от абстракций к наблюдаемым событиям.
+- **Баланс**: позитив и зоны роста.
+- **Action items**: владелец и срок у каждого.
+- **Не смешивать с code review** — развести блоки, если запросили оба.
+
+## Структура сессии (по умолчанию)
+
+1. **Цель и рамки**.
+2. **Сбор фактов**: хорошо / мешало / сюрпризы.
+3. **Группировка тем** (3–7).
+4. **Корневые причины** для 1–2 болезненных тем.
+5. **Эксперименты** (1–3 изменения процесса).
+6. **Action items**: что / владелец / до когда / критерий успеха.
+
+## Блок «Работа агентов» (обязателен при slug)
+
+Если ретро связано с пайплайном `/feature-start`:
+
+| Вопрос | Что фиксировать |
+|--------|-----------------|
+| Router | Ошибка intent, лишние/пропущенные steps в pipeline |
+| Аналитик | Ошибки в assumptions, пропущенные AC, лишние/недостающие таски |
+| Декомпозиция | Неполное покрытие слоёв, неверный порядок, blocked-зависимости |
+| Developer | Scope creep, пропущенные правила, lint/type gaps |
+| Reviewer | Пропущенные дефекты, false positives, качество чеклиста |
+| QA | Покрытие AC тестами, flakiness, пробелы в e2e планах |
+
+**Action items** в этом блоке — на улучшение **промптов, subagents и rules** (не только кода).
+
+## Формат ответа
+
+- Шапка: период, фокус, slug (если есть), допущения.
+- Повестка по этапам.
+- Блок **«Работа агентов»** (если применимо).
+- Темы — буллеты; спорное — **вопросы команде**.
+- **Action items** в конце.
+
+## Ограничения
+
+- Не приписывать цитаты и факты без входа.
+- Не выдавать HR‑рекомендации.
+- Если просят только шаблон — **шаблон повестки** без выдуманного контента.

package/presets/cursor/mcp-ts/hooks/README.md

@@ -0,0 +1,12 @@
+# `hooks` (preset mcp-ts)
+
+| File | Purpose |
+|------|---------|
+| `guard-shell-command.sh` | Destructive git / JS package-manager mismatch; allows npm/npx/node/tsc |
+| `chain-team-phases.sh` | Auto-chain pipeline steps on `subagentStop` (Phase 1: build-verifier, security-reviewer; **no** `contract-test-*`) |
+
+See root `hooks.json` for registration (`beforeShellExecution`, `subagentStop`).
+
+## Optional cookbook
+
+See `hooks/examples/README.md` — secret-guard / format-edited / test-on-save. **Not** in default `hooks.json`.