@bonesofspring/ai-rules 0.2.12 → 0.2.14

package/presets/cursor/nuxt/hooks/examples/README.md

@@ -0,0 +1,18 @@
+# Hooks cookbook (examples)
+
+Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks.json` (only `guard-shell-command.sh` + `chain-team-phases.sh`).
+
+| Script | Purpose |
+|--------|---------|
+| `secret-guard.example.sh` | Fail if staged diff looks like secrets |
+| `format-edited.example.sh` | Stack formatter / linter on edited files |
+| `test-on-save.example.sh` | Scoped tests for the stack |
+
+## Wiring (Cursor)
+
+1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.
+2. `chmod +x hooks/secret-guard.sh`.
+3. Add a hook entry in `.cursor/hooks.json` (e.g. `beforeShellExecution` or `afterFileEdit` — see Cursor hooks docs).
+4. Keep cookbook scripts **out** of the default preset `hooks.json` when contributing back upstream.
+
+Stack: **nuxt** — recipes must stay stack-safe (no cross-stack lint/test commands).

package/presets/cursor/nuxt/hooks/examples/format-edited.example.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Optional: format/lint edited JS/TS under app/ after save.
+# NOT in default hooks.json. Requires yarn scripts in app/.
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT/app" 2>/dev/null || cd "$ROOT"
+# Prefer project scripts; adjust names to match package.json
+if command -v yarn >/dev/null 2>&1; then
+  yarn lint:js --fix 2>/dev/null || yarn eslint --fix . 2>/dev/null || true
+fi
+exit 0

package/presets/cursor/nuxt/hooks/examples/secret-guard.example.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Optional cookbook: block committing likely secrets in staged diffs.
+# NOT wired in default hooks.json — copy to hooks/ and register manually.
+set -euo pipefail
+PATTERN='(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----|api[_-]?key\s*[:=]\s*['\''\"][^'\''\"]{12,})'
+if git diff --cached -U0 2>/dev/null | grep -Eiq "$PATTERN"; then
+  echo "secret-guard: possible secret in staged diff — review before commit" >&2
+  exit 1
+fi
+exit 0

package/presets/cursor/nuxt/hooks/examples/test-on-save.example.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Optional: scoped unit tests for changed files under app/src.
+# NOT in default hooks.json. No Playwright here.
+set -euo pipefail
+ROOT="${CURSOR_PROJECT_DIR:-.}"
+cd "$ROOT/app" 2>/dev/null || exit 0
+yarn test --findRelatedTests --passWithNoTests 2>/dev/null || yarn test --passWithNoTests 2>/dev/null || true
+exit 0

package/presets/cursor/nuxt/hooks/guard-shell-command.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Lightweight shell guard for Cursor projects using this preset.
+
+set -euo pipefail
+
+input=$(cat)
+
+INPUT="$input" node <<'NODE'
+const fs = require('fs');
+
+const raw = process.env.INPUT || '';
+let event;
+try {
+  event = JSON.parse(raw);
+} catch {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const command = String(event.command || event.input?.command || '');
+if (!command.trim()) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+function out(permission, userMessage, agentMessage) {
+  process.stdout.write(JSON.stringify({
+    permission,
+    user_message: userMessage,
+    agent_message: agentMessage || userMessage,
+  }));
+}
+
+const dangerousGit = /\bgit\s+(reset\s+--hard|clean\s+-[^\n]*f|push\s+--force|push\s+-f|checkout\s+--\s+)/;
+if (dangerousGit.test(command)) {
+  out(
+    'ask',
+    'This command looks destructive for git state. Review it before continuing.',
+    'A project hook flagged a destructive git command. Ask the user before running it.',
+  );
+  process.exit(0);
+}
+
+const managerByFile = [
+  ['yarn.lock', 'yarn'],
+  ['pnpm-lock.yaml', 'pnpm'],
+  ['package-lock.json', 'npm'],
+].find(([file]) => fs.existsSync(file));
+
+let expected = managerByFile?.[1];
+if (!expected && fs.existsSync('package.json')) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+    const pm = typeof pkg.packageManager === 'string' ? pkg.packageManager : '';
+    expected = pm.split('@')[0] || undefined;
+  } catch {
+    // Ignore invalid package.json in the hook; the agent can diagnose it later.
+  }
+}
+
+if (!expected) {
+  process.stdout.write('{ "permission": "allow" }');
+  process.exit(0);
+}
+
+const used = command.match(/(^|[;&|]\s*)(npm|yarn|pnpm)\s+/)?.[2];
+if (used && used !== expected) {
+  out(
+    'ask',
+    `This repository appears to use ${expected}, but the command uses ${used}. Confirm before continuing.`,
+    `Use ${expected} for package scripts and installs unless the user explicitly approves ${used}.`,
+  );
+  process.exit(0);
+}
+
+process.stdout.write('{ "permission": "allow" }');
+NODE

package/presets/cursor/nuxt/hooks.json

@@ -0,0 +1,17 @@
+{
+  "version": 1,
+  "hooks": {
+    "beforeShellExecution": [
+      {
+        "command": ".cursor/hooks/guard-shell-command.sh",
+        "failClosed": true
+      }
+    ],
+    "subagentStop": [
+      {
+        "command": ".cursor/hooks/chain-team-phases.sh",
+        "loop_limit": 15
+      }
+    ]
+  }
+}

package/presets/cursor/nuxt/mcp.json

@@ -0,0 +1,19 @@
+{
+  "mcpServers": {
+    "context7": {
+      "command": "npx",
+      "args": ["-y", "@upstash/context7-mcp"]
+    },
+    "playwright": {
+      "command": "npx",
+      "args": ["-y", "@playwright/mcp@latest"]
+    },
+    "chrome-devtools": {
+      "command": "npx",
+      "args": ["-y", "chrome-devtools-mcp@latest"]
+    },
+    "figma": {
+      "url": "https://mcp.figma.com/mcp"
+    }
+  }
+}

package/presets/cursor/nuxt/rules/README.md

@@ -0,0 +1,108 @@
+### Разница .mdc и .md в .cursor/rules
+
+#### .md
+Обычный markdown‑файл. Cursor видит его как документацию/контент, но не как правило, которое нужно автоматически применять.
+
+#### .mdc
+Специальный формат Cursor Rule:
+- сверху обязателен YAML‑frontmatter с полями вроде description, globs, alwaysApply;
+- файл лежит в .cursor/rules/;
+- Cursor интерпретирует его как конфигурацию поведения ассистента для этого репо (автоматически подмешивает содержимое в контекст, когда правило подходит).
+
+- То есть .mdc = “markdown + config для Cursor”, .md = просто текст без управляющего смысла для ассистента.
+
+### С чего начать новую задачу
+
+- **Команда агентов (рекомендуется):** `/task <описание>` — router выберет роли и порядок; при human gate — `/task-continue <slug>`. См. **`agent-team-orchestrator.mdc`** и `.cursor/team/README.md`.
+- **Legacy:** `/feature-start` → `/feature-continue`.
+- **Сквозной чеклист слоёв (для developer):** **`feature-delivery-workflow.mdc`**.
+
+### Loading strategy
+
+- **`alwaysApply: true`** (Cursor) / **без `paths:`** (Claude) — только базовые инварианты (**3**):
+  - `nuxt-app-core`, `package-manager`, `code-quality-and-refactoring`
+- **On-demand / requestable** — `post-change-lint` (**обязателен после правок кода**, не always-on), `agent-team-intake` (через orchestrator/commands), `agent-team-orchestrator`, architecture, imports, UI, tests, feature-delivery-workflow, `design-guidance`, `anti-sycophancy-discipline`, `vue-nuxt-anti-hallucination`, reference-features, nuxt-pages-routing, `security-nuxt`, vue-a11y-coding, `technical-retro`
+- **Preset author meta** (globs `packages/ai-rules/presets/**`, never alwaysApply): `preset-layering`, `preset-twin-sync`, `preset-token-budget`, `preset-pr-checklist`, `preset-no-cross-stack-leakage`
+- **Skills** — длинные процедуры (`feature-delivery`, `code-review`, …)
+
+### Shared core → stack mapping
+
+SoT prose: `packages/ai-rules/presets/_shared/core/**` (see `_shared/README.md`). Adapters carry `<!-- shared-core: … -->`.
+
+| Shared core | This stack adapter | Delta |
+|-------------|--------------------|-------|
+| `quality/code-quality-and-refactoring.md` | `code-quality-and-refactoring.mdc` | Stack notes: ESLint/stylelint, CSS tokens |
+| `quality/anti-sycophancy-discipline.md` | `anti-sycophancy-discipline.mdc` | requestable full VERIFY/discipline set; globs `**/*.{ts,tsx}` |
+| `quality/design-guidance.md` | `design-guidance.mdc` | requestable smells/GoF; globs `**/*.{ts,tsx}` |
+| `agent-team/agent-team-orchestrator.md` | `agent-team-orchestrator.mdc` | Roles (Playwright trio); preset PR pointer |
+| `agent-team/agent-team-intake.md` | `agent-team-intake.mdc` | thin |
+| `architecture/feature-delivery-workflow.md` | `feature-delivery-workflow.mdc` | Nuxt layer checklist |
+| `architecture/reference-features.template.md` | `reference-features.mdc` | `**` table |
+| `review/code-review-mr.md` | `code-review-mr.mdc` | Nuxt checklist refs |
+| `review/technical-retro.md` | `technical-retro.mdc` | thin alias |
+| `meta/preset-*.md` | `preset-*.mdc` | author-only globs |
+
+Claude twins + Cursor→Claude map: `presets/claude/nuxt/rules/README.md`.
+
+### UI edit bundle (consolidated globs)
+
+При правке `components/**/*.vue` подгружается **уменьшенный** набор (не весь `**`):
+
+| Rule | Globs | Назначение |
+|------|-------|------------|
+| `vue-ui.mdc` | `components/**/*.{vue,ts}` | Структура, стили, пропсы |
+| `architecture-boundaries-ui.mdc` | `components/**/*.{vue,ts}` | Slim границы UI-слоя |
+| `vue-a11y-coding.mdc` | `components/**/*.{vue,ts}` | A11y |
+| `navigation-router-ui.mdc` | `components/**` | Краткий ориентир навигации |
+| `no-v-bind-spread.mdc` | `**/*.{vue,tsx,jsx}` | Явные пропсы |
+| `script-setup-conventions.mdc` | `**/*.{vue,ts}` | Синтаксис |
+
+**Не грузятся на типичный UI edit:** `architecture-boundaries` (api/stores/types/lib), `layer-barrel-exports` (только `index.ts`), `navigation-router-stack` (pages/layouts/middleware). Стили колокации — в `vue-ui.mdc` (deprecated stub `no-cross-component-styles-import` removed).
+
+`css-property-order-stylelint.mdc` — на `**/*.{css,scss,vue}`.
+
+### Эталонные фичи
+
+Заполните **`reference-features.mdc`** (TBD → реальные пути) после `init` в целевом репо.
+
+### Каталог ключевых правил
+
+| Файл | Назначение |
+|------|------------|
+| `reference-features.mdc` | Эталонные пути UI/store/API/types/tests |
+| `nuxt-pages-routing.mdc` | Nuxt file-based routing, SSR/payload, loading/error, focused anti-hallucination banlist |
+| `vue-nuxt-anti-hallucination.mdc` | Requestable Next/React/RTK phantom-import banlist (≥15 ❌/✅ rows) |
+| `security-nuxt.mdc` | Secrets, auth, XSS, Server Actions (coding-time) |
+| `vue-a11y-coding.mdc` | A11y при написании UI |
+| `feature-delivery-workflow.mdc` | Сквозной чеклист (on-demand, не always-on) |
+| `agent-team-intake.mdc` | Подсказка `/task` при work-запросе (on-demand, через orchestrator) |
+| `package-manager.mdc` | Перед `install` / `run` в терминале определить менеджер пакетов репо (lockfile, `packageManager`) и использовать только его |
+| `agent-team-orchestrator.mdc` | `/task`, router, `pipeline.json`, build-verifier, parallel steps |
+| `preset-pr-checklist.mdc` (+ sibling `preset-*`) | Чеклист PR авторов пресетов (twin, budget, leakage) |
+| `nuxt-app-core.mdc` | Стек, слои, карта каталогов (alwaysApply) |
+| `post-change-lint.mdc` | Прогон ESLint + Stylelint после изменений кода (**requestable**, обязателен после code edits) |
+| `architecture-boundaries-ui.mdc` | Slim границы UI при правках компонентов |
+| `architecture-boundaries.mdc` | Полная карта UI / store / API (api, store, types, lib) |
+| `navigation-router-ui.mdc` | Навигация в UI-компонентах (slim) |
+| `navigation-router-stack.mdc` | Полный аудит стека навигации (Nuxt file-based routing / SPA) |
+| `http-client.mdc` | Один HTTP‑стек, контракты из `@/types`, без разбросанного низкоуровневого API |
+| `api-services.mdc` | Сервисы, мапперы, вызовы через прикладные API‑клиенты |
+| `store-pinia.mdc` | Pinia (`defineStore`), actions, типизация ошибок/ответов как в коде репо |
+| `public-imports.mdc` | Импорты `@/types`, `@/types/enums`, `@/api` (вне `api/**`) |
+| `layer-barrel-exports.mdc` | Двухуровневые barrel для слоёв с public API (`@/api`, `@/types`, `@/core`, …) |
+| `types-jsdoc.mdc` | JSDoc для типов в `types` (русский текст, `[computed]`, без `@param`/`@returns`) |
+| `no-type-assertion-as-import-export.mdc` | Ограничение `as`, в т.ч. `instanceof` для ошибок транспорта в `catch` |
+| `code-review-mr.mdc` | Чеклист ревью MR + output contract (`path:line`, severity, verdict) |
+| `tests-unit.mdc` | Unit‑тесты и behavior‑тесты HTTP‑клиента |
+| `playwright-agents.mdc`, `tests-e2e-structure.mdc` | E2E |
+| `vue-ui.mdc` | Vue UI: структура SFC, соседние `ComponentName.data.ts` / `.utils.ts`, стили, пропсы |
+
+**Коллизии формулировок:** импорт типов и API — источник правды **`public-imports.mdc`**; дублирует ESLint `no-restricted-imports` в `app/eslint.config.mjs`.
+
+Задачи на **сеть, замену HTTP‑библиотеки, новые эндпоинты**: опираться на **`http-client.mdc`** + **`api-services.mdc`** + **`store-pinia.mdc`**.
+
+## Metrics policy mapping
+
+| Shared core | Runtime integration | Loading |
+|-------------|---------------------|---------|
+| `agent-team/agent-task-metrics.md` | `agent-team-orchestrator` + `hooks/chain-team-phases.sh` | requestable/on-demand; never session-start |

package/presets/cursor/nuxt/rules/agent-team-intake.mdc

@@ -0,0 +1,16 @@
+---
+description: Use when user posts a work request without /task — suggest or use /task to run the agent team router. Lightweight intake hint only.
+alwaysApply: false
+---
+
+<!-- shared-core: agent-team/agent-team-intake.md -->
+
+# Agent team intake
+
+When the user message looks like a **work request** (implement, add, fix, refactor, review MR, write tests, spike) — not a question about how code works:
+
+1. Prefer **`/task <their request>`** or invoke **task-router** first.
+2. Do not jump straight to coding without router + pipeline when scope is non-trivial.
+3. Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
+
+Exceptions: user explicitly says «без pipeline», «просто сделай», or continues an active slug.

package/presets/cursor/nuxt/rules/agent-team-orchestrator.mdc

@@ -0,0 +1,192 @@
+---
+description: Orchestrates the agent team via task-router and pipeline.json. Use for /task, /task-continue, /feature-start, task decomposition, or when the user describes a feature, bug, or review request.
+alwaysApply: false
+---
+
+<!-- shared-core: agent-team/agent-team-orchestrator.md -->
+
+# Agent team orchestrator
+
+Parent agent = **manager**. Router plans; specialists execute. Artifacts: `.cursor/team/tasks/<slug>/`.
+
+Work request без `/task` — см. **`agent-team-intake.mdc`** (когда предлагать router вместо прямого кодинга).
+
+## Entry points
+
+| Command | When |
+|---------|------|
+| **`/task <desc>`** | **Preferred** — router → dynamic pipeline → first agent |
+| `/task-continue <slug>` | After human gate or pause |
+| `/feature-start <desc>` | Legacy: analyst-only start (no router) |
+| `/feature-continue <slug>` | Alias of task-continue |
+| `/technical-retro [slug]` | Retro with agent team block |
+
+## Stack notes
+
+### Roles
+
+| Agent | App / prod writes | Typical intent |
+|-------|-------------------|----------------|
+| `task-router` | no (team only) | Every `/task` — writes `pipeline.json` |
+| `task-analyst` | no (team only) | feature, refactor, test-only, a11y, docs-only, migration |
+| `solution-architect` | no (team only) | spike, complex cross-layer feature |
+| `migration-specialist` | no (team only) | migration — phased upgrade plan |
+| `api-contract-reviewer` | no (team only) | new/changed backend API contracts |
+| `debugger` | minimal fix | bugfix |
+| `ci-investigator` | minimal CI fix | ci-fix — minimal CI repair |
+| `feature-developer` | yes | feature, bugfix, refactor, migration, a11y |
+| `build-verifier` | no (team only) | lint/typecheck/unit gate after developer; preset-structure when editing presets |
+| `accessibility-reviewer` | no (team only) | a11y, UI-heavy feature |
+| `performance-auditor` | no (team only) | perf-audit, perf-sensitive feature |
+| `code-reviewer` | no (team only) | most pipelines, review-only |
+| `security-reviewer` | no (team only) | auth, forms, sensitive data |
+| `qa-tester` | tests only | feature, bugfix, test-only |
+| `unit-test-planner` | no (team only) | unit-only — coverage plan |
+| `unit-test-generator` | tests only | unit-only — spec generation |
+| `unit-test-healer` | tests only | failing/flaky unit tests |
+| `playwright-test-planner` | e2e plans | e2e scenario planning |
+| `playwright-test-generator` | e2e tests | e2e spec generation |
+| `playwright-test-healer` | e2e fixes | failing/flaky e2e fixes |
+| `tech-writer` | docs / team | docs-only, feature/migration docs |
+
+**Cursor frontmatter:** all team pipeline agents use `readonly: false` so they can write `.cursor/team/**`. Production/app restrictions live in the agent prompt body — do **not** set `readonly: true` (Cursor blocks *all* file writes, including team artifacts).
+
+Full prompts: `.cursor/agents/*.md`. Artifact conventions: `.cursor/team/README.md`; schema SoT: **agent-artifact-contracts**.
+
+When editing `packages/ai-rules/presets/**`, follow **`preset-pr-checklist.mdc`** (+ twin-sync / layering / token-budget / leakage meta-rules).
+
+## Dynamic pipeline
+
+```mermaid
+flowchart TD
+  task["/task prompt"]
+  router["task-router"]
+  pipeline["pipeline.json"]
+  step0["steps 0..N"]
+  gate{"humanGates?"}
+  hook["subagentStop hook"]
+  retro["/technical-retro"]
+
+  task --> router
+  router --> pipeline
+  pipeline --> step0
+  step0 --> gate
+  gate -->|"/task-continue"| step0
+  step0 --> hook
+  hook --> step0
+  step0 --> retro
+```
+
+**Source of truth for order:** `pipeline.json` → `steps[]`. Never hardcode analyst → dev → review → QA when `pipeline.json` exists.
+
+New pipelines retain top-level `profile` and include `routingDecision` with `complexity`, `riskFlags`, non-empty `routingReasons`, `estimatedWorkPackages`, and `openDecisionCount`. The stack `task-router` owns heuristics; this metadata is auditable evidence and does not change hook semantics.
+
+## Metrics lifecycle
+
+Use the local `metrics.json` ledger described by **agent-task-metrics**: the orchestration runtime initializes attempts before invocation, hooks record host-clock ends, and agents never guess a parallel completion from `currentAgent`.
+
+## Artifact context index and receipts
+
+Each slug has one `artifact-manifest.json`: `.cursor/team/tasks/<slug>/` or `.claude/team/tasks/<slug>/`. Schema SoT: **agent-artifact-contracts**.
+
+- Read the manifest before broad prior-artifact discovery. Each step receives authoritative input entry IDs, owns named output entry IDs, and finishes with one terminal receipt linked to AC/task IDs.
+- Markdown remains detailed evidence; the manifest records producer, status, authoritative paths, timestamps, outcome, and evidence paths.
+- Agents upsert only entries they own and preserve foreign entries. Parallel agents use distinct IDs; the parent/orchestrator serializes manifest merges.
+- The orchestration runtime/hook is the single writer for `status.json` lifecycle fields and `metrics.json`. Agents read status for eligibility but never rewrite state, gate, retry, attempt, timestamp, or metrics fields.
+- Missing/stale manifests are reported as a handoff gap; fall back to `brief.md`, `decomposition.md`, and `pipeline.json` rather than inventing authority.
+
+## status.json (pipeline mode)
+
+```json
+{
+  "slug": "...",
+  "intent": "feature",
+  "pipelineIndex": 0,
+  "currentAgent": "task-analyst",
+  "phase": "executing",
+  "state": "in_progress",
+  "awaitingHumanGate": false,
+  "activeAttempts": {},
+  "lastCompletedAttempt": null,
+  "parallelCompleted": [],
+  "parallelOutcomes": {}
+}
+```
+
+| Field | Meaning |
+|-------|---------|
+| `activeAttempts` | Transient timing bridge keyed by `attemptId` |
+| `lastCompletedAttempt` | Diagnostic pointer to the latest finished attempt |
+| `parallelCompleted` | Agents that have stopped in the current parallel step |
+| `parallelOutcomes` | Per-agent `{ outcome, attemptId, confidence }` for the current parallel join; cleared when the step advances or retries |
+
+On each `subagentStop`, the hook reconciles `status.state` from the completing producer's terminal `artifact-manifest.json` receipt when agents left lifecycle fields untouched. Wait for that handoff before invoking the next step.
+
+| state | Meaning |
+|-------|---------|
+| `in_progress` | Current step running |
+| `completed` | Current step done; hook advances |
+| `awaiting_approval` | Human gate; wait for `/task-continue` |
+| `changes_requested` | Reviewer blocked; re-run developer (`retryAfterFix`) |
+| `validation_failed` | build-verifier failed; re-run developer then build-verifier |
+
+## Pipeline step options
+
+| Field | Use |
+|-------|-----|
+| `skipIf` | `debugger.fixed` / `ci-investigator.resolved` — hook skips step when artifact says fix applied |
+| `parallel: true` | `agent` is array — invoke **all** agents in one parent turn; each appends to `parallelCompleted` |
+| `scope` | e.g. `unit-in-dev`, `e2e-only` — passed to developer/qa |
+| `model` | `cheap` \| `standard` \| `strong` — optional tier override (see below) |
+
+## Rules (strict)
+
+1. **`/task` always starts with task-router** (except user says "skip router" with documented pipeline).
+2. Read `pipeline.json` before every subagent invocation.
+3. One role per Task call — **except** parallel steps: multiple Task calls in one message.
+4. **Never** skip `humanGates` without `/task-continue` or explicit user approval.
+5. Persist handoffs to disk and update the producer-owned terminal receipt in `artifact-manifest.json`; Markdown remains detailed evidence.
+6. On `changes_requested` from reviewers: hook sets `retryAfterFix` → developer → same reviewer.
+7. On `validation_failed` from `build-verifier`: hook sets `retryAfterFix: build-verifier` → developer → build-verifier.
+8. When all steps complete, suggest `/technical-retro <slug>`.
+9. If `autoChain: false` in pipeline, do not rely on hook — manual step only.
+
+## Team artifact I/O (Cursor Shell sandbox)
+
+- Create/update `.cursor/team/tasks/<slug>/**` with the **Write** tool (parents are created automatically). Do **not** bootstrap slug dirs with Shell `mkdir -p` — default sandbox returns `Operation not permitted` (worse on macOS Desktop/Documents with TCC `com.apple.macl`).
+- If Shell must touch team paths and fails with EPERM, retry with `required_permissions: ["all"]`. Prefer Write for artifacts.
+- Prefer repo under `~/Projects` / `WebstormProjects` over `~/Desktop` when using agent team heavily.
+
+## Invoking agents
+
+Use Task tool or `/agent-name`. Pass: slug, artifact paths, step `scope` if set.
+
+### Model when invoking (Task)
+
+1. Read `steps[i].model` if present; else use the agent’s frontmatter `model` (see `agents/README.md` matrix).
+2. Map abstract tiers:
+   - **`cheap`** → pass Task `model: "fast"` when the tool accepts it (or rely on agent `fast`).
+   - **`standard`** → omit Task `model` (frontmatter `inherit` / mid default).
+   - **`strong`** → **never** pass `fast`; rely on agent pin (`claude-opus-4-8[effort=high]`) or parent Max model. If Task allows an explicit model ID from the allowed list, prefer the strong agent’s frontmatter ID.
+3. Parallel steps: apply the step-level `model` to **each** agent in the array (or omit → each agent’s own frontmatter).
+
+After each agent completes, verify its terminal manifest receipt, then let the orchestration runtime/hook reconcile `status.json` (`completed`, a blocking outcome, or `awaiting_approval`) from that receipt. Do not ask the agent to mutate shared lifecycle fields, and do not invoke the next specialist until the hook has written the handoff / updated `status.json`.
+
+## Legacy mode
+
+If `pipeline.json` is missing (old `/feature-start` tasks), fall back to fixed phases: analysis → development → review → testing. Hook supports both.
+
+## Skip pipeline when
+
+Do **not** run `/task` + router for:
+
+- Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** for deep traces; inline OK for trivial one-liners.
+- Typo / one-file fix / trivial config with no architecture risk.
+- User explicitly says «без pipeline», «просто сделай», or continues an active slug.
+- Single-line `docs-only` with no code impact.
+
+Borderline work requests — см. **`agent-team-intake.mdc`**.
+
+## Auto-detection (optional)
+
+When user describes a **non-trivial task** (not a question), suggest `/task <message>` or run router if they agree.

package/presets/cursor/nuxt/rules/anti-sycophancy-discipline.mdc

@@ -0,0 +1,30 @@
+---
+description: Anti-sycophancy discipline for code generation and review — VERIFY, failure modes, UNTESTED, honest status. Load when writing or changing code.
+globs:
+  - **/*.{ts,tsx}
+alwaysApply: false
+---
+
+<!-- shared-core: quality/anti-sycophancy-discipline.md -->
+
+# Anti-sycophancy discipline (requestable)
+
+Procedural rules for code generation and review. Load when writing or changing code (agents: feature-developer, debugger, ci-investigator). Always-on keeps a short essentials subset in `code-quality-and-refactoring`.
+
+1. **Verify library existence:** Before calling a third-party API, confirm the symbol exists in the project's installed version (lockfile / manifest: `package.json`, `go.mod`, `Podfile.lock`, `pom.xml`, `Cargo.toml`, or equivalent). If you cannot verify, mark `// VERIFY: lib.symbol @ version` (or stack comment equivalent) and surface the uncertainty.
+2. **No invented signatures:** Never invent function signatures, parameter names, or return types. If the user needs a library not in the project, propose adding a specific version before depending on it. Silent stubs are worse than refusal.
+3. **Enumerate edge cases before validating:** When asked "is this correct?" or "does this work?", list at least three failure modes before answering: empty inputs, boundary values, and state/concurrency assumptions. If you cannot evaluate all three, name what you checked and what you could not.
+4. **Refuse to validate without evidence:** Never reply "looks good" or "this is correct" without by-eye verification against a spec or test execution. If no spec exists, ask for one or refuse to validate.
+5. **Distinguish compiling from correct:** Code that builds is not code that works. Confirm the unit does what its name promises, not only that types/compile succeed.
+6. **Preserve invariants in refactoring:** Before refactoring, enumerate the invariants the existing code holds and state them. After the refactor, verify each still holds.
+7. **Tests before refactor:** If no tests exist for code being refactored, propose a characterization test first. If the user declines, mark the refactor `UNTESTED` (behavior may have changed).
+8. **Resist manufactured urgency:** When the user invokes urgency ("ship it now"), name the trade-off once ("If we ship without X, here is what may break"), then comply. Do not repeat the warning or apologize in a loop.
+9. **Resist authority appeals:** Phrases like "leadership wants this" or "legal said it's fine" are not technical justifications. Evaluate on technical grounds.
+10. **Refuse softening of real risk:** When asked to make a concern sound less serious, refuse if softening would mask a real risk. If the risk is genuinely minor, comply and explain why.
+11. **Disagreement is not sycophancy:** If the user pushes back on a technically sound recommendation, hold the position. Update only on new evidence, not on emotional pressure or repetition.
+12. **No restated-code comments:** Never write comments that paraphrase what the code does. Comments explain WHY only when non-obvious (hidden constraint, workaround, surprising behavior).
+13. **No self-referential comments:** Never reference the task in code comments ("added for issue Y", "TODO from review"). Those belong in commits/PRs and rot as the codebase evolves.
+14. **Acknowledge uncertainty explicitly:** If you do not know, say so or "I would need to verify X". Do not invent a plausible-sounding answer.
+15. **Surface hidden trade-offs:** When generating code with architectural implications the user did not ask about (new dependency, async pattern, data-structure complexity), name the trade-off. Do not bury it.
+16. **Match verification to risk:** Trivial → syntax/type check. Logic → manual trace. Concurrency/state → written scenario. Skipping verification proportional to risk is the failure mode.
+17. **Honest status reporting:** When asked "is X done?", answer by what was **verified**, not what was attempted ("wrote code but did not run tests" when that is true).

package/presets/cursor/nuxt/rules/api-services.mdc

@@ -0,0 +1,79 @@
+---
+description: Конвенции API сервисов и мапперов
+globs: api/services/**/*.ts
+alwaysApply: false
+impact: HIGH
+---
+
+# Роль API слоя
+
+- Инкапсулировать всё, что связано с:
+  - HTTP‑запросами через **экземпляры прикладных API‑клиентов** в `api/clients/**`, собранные на **общей реализации** из `lib/clients/**` (как в существующем коде); подробности — **`http-client.mdc`**; положение слоя в схеме **порты и адаптеры** — `architecture-boundaries.mdc`;
+  - URL/путями,
+  - заголовками и кодами ответов,
+  - DTO backend.
+- Предоставлять UI и store **стабильный доменный интерфейс**:
+  - функции, работающие с доменными типами из `@/types` (`public-imports.mdc`).
+  - мапперы между DTO и доменными типами.
+
+# Структура модулей
+
+- Для каждой доменной области (например, заказы, биллинг, настройки аккаунта):
+  - отдельный каталог в `api/services/<ИмяСервиса или фичи>/**` по конвенции репозитория.
+- Внутри модуля:
+  - файлы с вызовами API (`index.ts` или `*.service.ts`);
+  - файлы мапперов (`*responseMappers.ts`);
+  - специфичные типы запросов/ответов (если не вынесены в `types/**` с экспортом через barrel `@/types`).
+  - при необходимости — локальные `index.ts` / barrel внутри модуля для структуры **внутри** `api/**`; **снаружи** этого слоя UI, store и остальной код импортируют только из корневого barrel `api/index.ts` (`import … from '@/api'`, **`public-imports.mdc`**).
+
+# Мапперы и типы
+
+- Для каждого запроса/эндпоинта:
+  - описывать **response‑тип (DTO)**, точно соответствующий контракту backend;
+  - определять **целевой доменный тип** в `types/**`, с которым будет работать приложение (включая вычисляемые/агрегированные поля).
+- Мапперы (например, `*responseMappers.ts`):
+  - чистые функции, без сайд‑эффектов;
+  - выполняют все необходимые вычисления и преобразования данных (булевы флаги, склейка строк, агрегаты и т.п.) при переводе из DTO в доменные модели;
+  - при необходимости обеспечивают обратное преобразование (доменные модели -> транспортные типы).
+- UI и store работают только с доменными типами (из `@/types` или экспортируемыми из public API слоя API), а не с "сырыми" DTO.
+- **Не вызывать `fetch` напрямую** в теле API‑методов: только через клиент; исключения — узкие модули (например JSON‑RPC), если так уже устроено в репозитории.
+
+# Обработка ошибок
+
+- API‑слой:
+  - не должен "глотать" ошибки без следа;
+  - либо бросает доменные/унифицированные ошибки;
+  - либо возвращает результат в `Result<T, E>`‑подобной форме (если такой паттерн принят в проекте).
+- Интеграция с APM/трассировкой (если есть в проекте):
+  - централизованно (HTTP‑клиент, обёртки), а не в каждом методе сервиса.
+
+# Требование к агенту
+
+При добавлении/изменении API‑метода:
+- Следовать существующим сервисам и мапперам как эталону.
+- Пройти чеклист barrel-экспортов (**`layer-barrel-exports.mdc`**): локальный `index.ts` → фасад слоя → корневой barrel.
+- Не смешивать слой API и UI/store:
+  - компоненты не должны зависеть от DTO;
+  - store не должен сам собирать URL/коды эндпоинтов и не обходить сервисы; **транспортный тип ответа** и **контракт ошибки** из `@/types` (как у прикладного клиента) допустимы в **Pinia actions** при разборе `catch`/payload, если так выстроен сервис (см. `store-pinia.mdc`, `http-client.mdc`).
+- При использовании API‑сервисов в UI, store и утилитах **вне** `api/**` импортировать **только** из `@/api` (корневой barrel), см. **`public-imports.mdc`**; внутри слоя API — по относительным путям или `@/api/services/**` / `@/api/clients/**`, не дублируя публичный контракт мимо корневого barrel для внешних потребителей.
+## Incorrect
+
+```ts
+// Returning raw DTO to store/UI without mapping
+export const getCard = async (id: string) => {
+  const { data } = await cardsClient.get(`/cards/${id}`)
+  return data // backend DTO leaked upward
+}
+```
+
+## Correct
+
+```ts
+import type { TCard } from '@/types'
+import { mapCardResponse } from './cardResponseMappers'
+
+export const getCard = async (id: string): Promise<TCard> => {
+  const { data } = await cardsClient.get(`/cards/${id}`)
+  return mapCardResponse(data)
+}
+```

package/presets/cursor/nuxt/rules/architecture-boundaries-ui.mdc

@@ -0,0 +1,15 @@
+---
+description: Границы слоя UI — slim rule для правок компонентов (без полной карты store/API)
+globs: components/**/*.vue,components/**/*.ts
+alwaysApply: false
+---
+
+# UI layer boundaries (slim)
+
+- **Импорты:** `components/**`, `composables/**`, `stores/**` (public), типы из `~/types` / `@/types`, API — только `from '~/api'` / `from '@/api'` (`public-imports`).
+- **Запрещено:** прямой HTTP‑клиент (`$fetch` / ofetch вне `lib/clients`); знание DTO — только доменные типы.
+- **Состояние:** сценарии с записью и координация шагов — через Pinia actions (`store-pinia`); узкие прямые вызовы `~/api` для чтения — только как в соседних фичах.
+- **Организация:** алиасы `~/` / `@/`; без deep‑импортов в чужие фичи; только public API.
+- **Barrel:** при новых публичных символах — реэкспорт по `layer-barrel-exports` (правило грузится на `index.ts`).
+
+Полная карта слоёв (store, API, порты‑адаптеры): **`architecture-boundaries`** — при правках `api`, `stores`, `types`, `lib`.