@bonesofspring/ai-rules 0.2.6 → 0.2.7

package/presets/cursor/ios-swift/agents/feature-developer.md

@@ -20,6 +20,19 @@ You are a senior iOS developer (SwiftUI-first, SPM as in repo) with strict layer
 - Mark completed WPs in `decomposition.md`.
 - After Swift edits: **invoke** `post-change-build.mdc` (+ `xcode-tooling.mdc` for commands). If next step is `build-verifier`, scoped build/lint on changed targets is enough.
 
+## Zero improvisation
+
+- Implement **only** what the brief / AC / current decomposition task require.
+- If requirements are ambiguous, conflicting, or multi-way — **ask** before coding; do not guess extras as "best practices".
+- Forbidden without explicit AC/task: unrelated Keychain/security hardening, extra validation, UI polish, logging, drive-by refactors, new config/env.
+- Boy scout / `design-guidance` improvements stay **within** touched files and must not expand task scope.
+
+## Will / Will not
+
+**Will:** follow Feature layer order and reference Features; add required unit tests; run the post-change build gate; update task artifacts.
+
+**Will not:** formal code review; invent AC; pull Next/Playwright gates; auto-continue the next WP when the pipeline expects a human gate or handoff.
+
 ## Preset / cross-stack fork (when editing agents, skills, hooks)
 
 When copying from `next` into `ios-swift` (or another stack):

package/presets/cursor/ios-swift/commands/README.md

@@ -42,7 +42,7 @@ Slash-команды копируются в `.cursor/commands/` при `ai-rule
 
 ## Связанные файлы
 
-- Subagents: `../agents/` (21 ролей, включая `task-router.md` и `xcuitest-test-{planner,generator,healer}`)
+- Subagents: `../agents/` (22 ролей, включая `task-router.md`, `codebase-analyzer.md`, и `xcuitest-test-{planner,generator,healer}`)
 - Оркестратор: `../rules/agent-team-orchestrator.mdc`
 - Skills: `../skills/` (`feature-delivery`, `code-review`, `debug-investigation`, `ci-investigation`, `unit-testing`, `xcuitest-e2e`, `technical-retro`)
 - Артефакты: `../team/README.md` (`pipeline.json`, `status.json`)

package/presets/cursor/ios-swift/hooks/README.md

@@ -6,3 +6,7 @@
 | `chain-team-phases.sh` | Auto-chain pipeline steps on `subagentStop` |
 
 See root `hooks.json` for registration (`beforeShellExecution`, `subagentStop`).
+
+## Optional cookbook
+
+See `hooks/examples/README.md` — secret-guard / format-edited / test-on-save. **Not** in default `hooks.json`.

package/presets/cursor/ios-swift/hooks/examples/README.md

@@ -0,0 +1,18 @@
+# Hooks cookbook (examples)
+
+Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks.json` (only `guard-shell-command.sh` + `chain-team-phases.sh`).
+
+| Script | Purpose |
+|--------|---------|
+| `secret-guard.example.sh` | Fail if staged diff looks like secrets |
+| `format-edited.example.sh` | Stack formatter / linter on edited files |
+| `test-on-save.example.sh` | Scoped tests for the stack |
+
+## Wiring (Cursor)
+
+1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.
+2. `chmod +x hooks/secret-guard.sh`.
+3. Add a hook entry in `.cursor/hooks.json` (e.g. `beforeShellExecution` or `afterFileEdit` — see Cursor hooks docs).
+4. Keep cookbook scripts **out** of the default preset `hooks.json` when contributing back upstream.
+
+Stack: **ios-swift** — recipes must stay stack-safe (no cross-stack lint/test commands).

package/presets/cursor/ios-swift/hooks/examples/format-edited.example.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Optional: SwiftFormat / SwiftLint on edited .swift files.
+# NOT in default hooks.json.
+set -euo pipefail
+if command -v swiftformat >/dev/null 2>&1; then
+  git diff --name-only --diff-filter=ACMR HEAD 2>/dev/null | grep '\.swift$' | while read -r f; do
+    [[ -f "$f" ]] && swiftformat "$f" || true
+  done
+fi
+if command -v swiftlint >/dev/null 2>&1; then
+  swiftlint lint --quiet 2>/dev/null || true
+fi
+exit 0

package/presets/cursor/ios-swift/hooks/examples/secret-guard.example.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# Optional cookbook: block committing likely secrets in staged diffs.
+# NOT wired in default hooks.json — copy to hooks/ and register manually.
+set -euo pipefail
+PATTERN='(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----|api[_-]?key\s*[:=]\s*['\''\"][^'\''\"]{12,})'
+if git diff --cached -U0 2>/dev/null | grep -Eiq "$PATTERN"; then
+  echo "secret-guard: possible secret in staged diff — review before commit" >&2
+  exit 1
+fi
+exit 0

package/presets/cursor/ios-swift/hooks/examples/test-on-save.example.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Optional: xcodebuild test slice for the active scheme (adjust SCHEME/DEST).
+# NOT in default hooks.json. No Playwright / yarn lint.
+set -euo pipefail
+SCHEME="${XCODE_SCHEME:-App}"
+DEST="${XCODE_DESTINATION:-platform=iOS Simulator,name=iPhone 16}"
+xcodebuild test -scheme "$SCHEME" -destination "$DEST" -quiet 2>/dev/null || true
+exit 0

package/presets/cursor/ios-swift/rules/agent-team-intake.mdc

@@ -11,6 +11,6 @@ When the user message looks like a **work request** (implement, add, fix, refact
 
 1. Prefer **`/task <their request>`** or invoke **task-router** first.
 2. Do not jump straight to coding without router + pipeline when scope is non-trivial.
-3. Pure questions («как работает X», «объясни») — answer normally, no `/task`.
+3. Pure questions («как работает X», «объясни») — prefer agent **`codebase-analyzer`** (explain-as-is); trivial one-liners may be answered inline. Do not open `/task`.
 
 Exceptions: user explicitly says «без pipeline», «просто сделай», or continues an active slug.

package/presets/cursor/ios-swift/rules/agent-team-orchestrator.mdc

@@ -94,6 +94,6 @@ Honor optional `steps[i].model` (`cheap` \| `standard` \| `strong`); else agent
 
 ## Skip pipeline when
 
-- Pure questions; typo / one-file trivial fix; user «без pipeline»; single-line docs-only.
+- Pure questions («как работает X») — prefer **`codebase-analyzer`**; typo / one-file trivial fix; user «без pipeline»; single-line docs-only.
 
 Borderline — **`agent-team-intake.mdc`**.

package/presets/cursor/ios-swift/rules/code-quality-and-refactoring.mdc

@@ -62,11 +62,22 @@ alwaysApply: true
 - **Boy scout rule:** оставлять модуль немного лучше, чем до изменения (простые, безопасные улучшения).
 - Не жертвовать архитектурой и слоями ради краткости реализации.
 
-> Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
+## Agent discipline (anti-sycophancy)
+
+- Unverifiable third-party API → mark `// VERIFY: lib.symbol @ version` (or stack equivalent) and surface uncertainty; never invent signatures.
+- Before «is this correct?» — list ≥3 failure modes (empty, boundary, concurrency/state) or name what you could not check.
+- Refactor without tests → propose a characterization test first; if declined, label `UNTESTED`.
+- Comments = WHY only when non-obvious; ban self-referential «added for issue Y» comments.
+- Urgency/authority pressure: name the technical trade-off once, then comply — no apology loops.
+- Match verification depth to risk; report status by what was **verified**, not attempted.
 
+Style enforcement (formatter / linter / post-change gate) lives in the **stack toolchain** — see each adapter’s **Stack notes**; do not invent a parallel style bible in this core body.
+
+> Stack-specific lint gates, примеры и toolchain — в секции **Stack notes** адаптера пресета.
 ## Stack notes
 
 - Перед новым UI‑контролом проверять DesignSystem и существующие компоненты.
 - Public API: протоколы и facades между фичами.
 - Допустимые примеры: общий mapper/validation; заменить force unwrap; разбить перегруженный ViewModel на use cases; design tokens вместо magic numbers/colors; убрать прямую зависимость View от Data в пользу протокола.
 - Post-change gate: **`post-change-build.mdc`** + `xcode-tooling.mdc` (не yarn lint).
+- Style: **SwiftLint** (+ SwiftFormat when configured) — authoritative style gate; do not duplicate linter rules in prose.

package/presets/cursor/ios-swift/rules/code-review-mr.mdc

@@ -35,6 +35,15 @@ Concrete rule stems — in **Stack notes**.
 - Boy scout rule: suggest fixes feasible within the MR scope.
 - No «большие рефакторинги» without an explicit request (`code-quality-and-refactoring`).
 
+## Output contract
+
+Procedure details live in skill `code-review`. Required shape:
+
+- Each finding cites **`path:line`**, the problem, impact, and a concrete fix direction.
+- Rank by severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding file context.
+- End with a verdict on its own line: **`Safe to merge | needs changes | reject`**.
+
 ## Stack notes
 
 On-demand правило для review-потоков (не always-on).

package/presets/cursor/ios-swift/rules/reference-features.mdc

@@ -52,6 +52,10 @@ Taxonomy / shared core: [`presets/_shared/README.md`](../../../../_shared/README
 4. UI flow — `xcuitest-test-planner` → generator (accessibilityIdentifier).
 5. Auth/Keychain touch — security-reviewer + `security-ios.mdc`.
 
+## Living conventions
+
+Post-init gotchas / patterns / decisions: **`.cursor/team/conventions.md`** (and the twin tool path if both Cursor and Claude are installed). Consumer-owned; not always-on. See root `AGENTS.md` § Living conventions.
+
 ## Связанные правила
 
 - `code-quality-and-refactoring.mdc` — повторять паттерны.

package/presets/cursor/ios-swift/rules/swift-conventions.mdc

@@ -27,9 +27,19 @@ guard let name = user?.name else { return }
 
 - UI types — `@MainActor`.
 - Shared mutable state — `actor` или isolation через queue; document thread expectations.
-- `Task { }` в ViewModel: учитывать cancellation; `[weak self]` в escaping closures при retain cycles.
+- `Task { }` в ViewModel: учитывать cancellation; `[weak self]` в escaping closures при retain cycles (default when capturing `self` in escaping work).
 - Prefer `async/await` over completion handlers для нового кода.
 
+## Anti-hallucination (Swift / concurrency)
+
+| ❌ Avoid | ✅ Prefer |
+|---------|----------|
+| Force unwrap (`!`) for normal control flow | `guard let` / `if let` / typed throws |
+| Invented Combine/Rx APIs when the feature uses Swift Concurrency | Match neighboring ViewModels (`async/await`, `@MainActor`) |
+| Unstructured `Task {}` without cancellation awareness | Cooperative cancel; prefer `.task` in Views (`swiftui-ui.mdc`) |
+| Global mutable singletons for request state | DI / actors / existing composition root |
+| APIs not available for the project’s Swift / iOS deployment target | Check package / Xcode settings; mark `VERIFY` if unsure |
+
 # Access control
 
 - Минимально необходимый уровень: `private` / `fileprivate` по умолчанию для implementation details.
@@ -47,5 +57,5 @@ guard let name = user?.name else { return }
 
 # Требование к агенту
 
-- Не добавлять `// swiftlint:disable` без явной причины.
+- Style gate: **SwiftLint** (and SwiftFormat when configured) — prefer fixing lint over prose style essays; `// swiftlint:disable` only with an explicit reason.
 - Новый код — Swift Concurrency-ready (`Sendable` где требует компилятор/линтер проекта).

package/presets/cursor/ios-swift/rules/swiftui-ui.mdc

@@ -20,6 +20,14 @@ alwaysApply: false
 - View читает state и вызывает **явные методы** ViewModel (`submit()`, `load()`), а не мутирует внутреннее состояние напрямую.
 - Для навигации — coordinator/router или enum route в ViewModel, не размазанные `NavigationLink` с бизнес-условиями в View.
 
+# Lifecycle, ownership, hit testing
+
+- Prefer **`.task(id:)`** (auto-cancel) over `.onAppear { Task { … } }` for async loads tied to the view lifetime.
+- `@StateObject` / owned observable — **only where the view owns** the instance; prefer DI / parent-injected ViewModels over `@EnvironmentObject` sprawl.
+- Shared mutable services — `actor` (or existing isolation); default `[weak self]` in escaping closures that capture ViewModel/`self`.
+- Transparent stacks that should receive taps: `.contentShape(Rectangle())`.
+- High-frequency visual updates — prefer `TimelineView` (or repo pattern) over ad-hoc `Timer` in Views.
+
 # Структура файлов
 
 Для экрана фичи:

package/presets/cursor/ios-swift/skills/README.md

@@ -9,5 +9,6 @@
 | `debug-investigation` | Runtime evidence before fix |
 | `ci-investigation` | iOS CI red |
 | `technical-retro` | Retro facilitation |
+| `write-adr` | Architecture Decision Record (context / decision / consequences) |
 
 Копируется в `.cursor/skills/` при init.

package/presets/cursor/ios-swift/skills/code-review/SKILL.md

@@ -18,11 +18,19 @@ Use the local repository as the source of truth: `git status`, `git diff`, task
 5. Review Swift concurrency and conventions (`swift-conventions.mdc`): `@MainActor`, typed errors, force unwrap.
 6. Review SwiftUI thinness, Design System usage, accessibility identifiers (`swiftui-ui.mdc`).
 7. Check tests: unit for mapper/domain/VM (`tests-unit.mdc`); XCUITest for user flows (`tests-ui.mdc`).
-8. Report validation gaps: `xcodebuild`, SwiftLint, or relevant tests not run (`xcode-tooling.mdc`, `post-change-build.mdc`).
+8. **Reuse lens:** flag new helpers that duplicate existing Feature/shared utilities; prefer public module APIs over copy-paste.
+9. **Efficiency lens:** unnecessary work on main thread, redundant network/persistence, hot-path bloat, missing cancellation/cleanup.
+10. Report validation gaps: `xcodebuild`, SwiftLint, or relevant tests not run (`xcode-tooling.mdc`, `post-change-build.mdc`).
 
 ## Output
 
-Lead with findings ordered by severity. Each finding should include the file, the problem, impact, and a concrete fix direction. If there are no findings, say so and call out remaining test or validation risk.
+Lead with findings ordered by severity. Required shape (also in `code-review-mr`):
+
+- Each finding: **`path:line`** — problem — impact — concrete fix direction.
+- Severity: **`blocker` | `important` | `nit`** (list blocker → nit).
+- Vague («looks risky») is not a finding — cite evidence or ask for surrounding context.
+- End with a verdict line: **`Safe to merge | needs changes | reject`**.
+- If there are no findings, say so and call out remaining test or validation risk.
 
 For agent team tasks, write `.cursor/team/tasks/<slug>/review.md` and set `status.json` to `completed` or `changes_requested`.
 

package/presets/cursor/ios-swift/skills/feature-delivery/SKILL.md

@@ -18,6 +18,10 @@ description: Delivers iOS Swift/SwiftUI features end-to-end across Domain, Data,
 - **Don't** introduce TCA/SwiftData/etc. unless the repo already uses them.
 - **Don't** use yarn, Playwright, or `app/src` paths — wrong stack.
 
+## Scope discipline
+
+Implement only the current AC / decomposition task. Clarify ambiguity before coding; do not add unrelated hardening, polish, or drive-by refactors. See `feature-developer` → **Zero improvisation**.
+
 ## Preset packaging note
 
 When editing **ai-rules ios-swift preset** sources (agents, hooks, rules) rather than an app Feature: keep Cursor and Claude trees in sync where applicable, and **fork / verify hook handoffs** (`hooks/chain-team-phases.sh`, guard scripts, team path conventions) so Cursor (`.cursor/team`) and Claude (`.claude/team`) do not regress against each other or against the next preset templates.

package/presets/cursor/ios-swift/skills/technical-retro/SKILL.md

@@ -5,6 +5,50 @@ description: Facilitates technical retrospectives for tasks, sprints, incidents,
 
 # Technical Retro
 
-Same structure as next technical-retro skill. For `/task` pipelines include router, analyst, developer, **build-verifier** (xcodebuild), reviewer, QA/XCUITest, hooks, rules.
+## Inputs
 
-Preset feedback: propose updates to `.cursor/rules|agents|skills` — do not apply without approval.
+Ask for missing period, focus, task slug, participants, or format constraints. If a slug is provided, read `.cursor/team/tasks/<slug>/` artifacts and local git status/diff. Do not invent facts not present in artifacts or the user's message.
+
+## Facilitation Principles
+
+- Focus on process and system behavior, not blame.
+- Separate facts, interpretations, and proposed actions.
+- Balance what worked with what slowed delivery.
+- Keep action items concrete, owned, and measurable.
+
+## Default Structure
+
+1. Goal and scope.
+2. Timeline or factual observations.
+3. What worked.
+4. What hurt quality, speed, or confidence.
+5. Root causes for the top one or two issues.
+6. Experiments and action items.
+
+## Agent Team Block
+
+For `/task` pipelines, include router, analyst, developer, **build-verifier** (xcodebuild), reviewer, QA/XCUITest, hooks, and rules.
+
+## Wrong-turn taxonomy (optional)
+
+When artifacts or the user mention agent mistakes, tag incidents:
+
+| Kind | Signal |
+|------|--------|
+| `correction` | User pushback («no», «don't», «actually») |
+| `retry` | Same tool/approach 2+ times before success |
+| `waste` | Many searches before the right file |
+| `reversal` | Edit then revert / delete |
+| `dead-end` | Env/tool failure (missing binary, wrong path) |
+
+Severity: **high** (explicit correction / large waste) · **med** · **low**. Confidence 0–100 — be honest; low-confidence items are optional.
+
+## Preset feedback loop
+
+If the same issue appeared in **2+** tasks (or **3+** for packaging a new rule/skill — Rule of Three), add section **Preset updates**:
+
+- Proposed change to `.cursor/rules/`, `.cursor/agents/`, `.cursor/skills/`, or **`.cursor/team/conventions.md`** (prefer conventions for project gotchas)
+- One concrete snippet or file path
+- Whether it belongs in always-on vs globs vs skill vs conventions (see `PRESET-CONTRIBUTION` → Building blocks)
+
+Do not apply preset or conventions changes without user approval.

package/presets/cursor/ios-swift/skills/write-adr/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: write-adr
+description: Author an Architecture Decision Record (ADR) with Context, Decision, Consequences, and Links. Use when capturing a durable technical choice for the team.
+---
+
+# Write ADR
+
+On-demand skill for durable architecture decisions. Stack-agnostic sections — fill with project-specific paths and links.
+
+## When to use
+
+- Choosing between non-trivial alternatives (storage, layering, library, API shape).
+- Recording a decision that future agents/humans should not silently reverse.
+- User asks for an ADR, decision log, or “why did we pick X”.
+
+## Template
+
+Create (or append) a short markdown ADR in the repo’s agreed location (e.g. `docs/adr/`, `.cursor/team/`, wiki). Suggested filename: `NNNN-short-title.md`.
+
+```markdown
+# ADR NNNN: <Title>
+
+## Context
+What problem / constraint / force requires a decision?
+
+## Decision
+What we chose (one clear option). Include rejected alternatives briefly if useful.
+
+## Consequences
+Positive and negative outcomes; follow-up work; what becomes harder.
+
+## Links
+Related PRs, issues, rules, prior ADRs, diagrams.
+```
+
+## Guidelines
+
+- Prefer one decision per ADR.
+- Keep Context factual; Decision imperative and short.
+- Link living gotchas to `team/conventions.md` when the decision becomes a recurring local pattern.
+- Do not put ADR bodies only in root `AGENTS.md` (overwrite on init).

package/presets/cursor/ios-swift/team/conventions.md

@@ -0,0 +1,21 @@
+# Living conventions (team)
+
+Consumer-owned store for post-init gotchas, patterns, and decisions. **Not** always-on. Fill after `ai-rules init`. Root `AGENTS.md` only points here.
+
+## Gotchas
+
+<!-- e.g. fragile flows, “never do X in this repo” -->
+
+-
+
+## Patterns
+
+<!-- local patterns beyond reference-features table -->
+
+-
+
+## Decisions
+
+<!-- short pointers to ADRs / product choices that affect code -->
+
+-

package/presets/cursor/next/AGENTS.md

@@ -2,6 +2,8 @@
 
 Краткая точка входа для Cursor. Подробные правила — `.cursor/rules/*.mdc`; сценарии — `.cursor/skills/**`.
 
+**Repo-root agents:** see [`AGENTS.md`](../../AGENTS.md) at the project root (cross-tool setup, commands, security, living conventions pointers).
+
 See `.cursor/rules/README.md` for the full catalog and loading strategy.
 
 ## Quick start
@@ -14,6 +16,7 @@ See `.cursor/rules/README.md` for the full catalog and loading strategy.
 | Эталонные фичи | `reference-features.mdc` (заполнить пути в репо) |
 | После правок кода | `post-change-lint.mdc` (**requestable**, но обязателен после edits; полный gate — `build-verifier`) |
 | Code review MR | skill `code-review` + `code-review-mr.mdc` |
+| Security (auth/forms/env) | `security-next.mdc` + agent `security-reviewer` |
 | Валидация перед review | agent `build-verifier` |
 | Техническое ретро | `/technical-retro` + skill `technical-retro` |
 
@@ -21,7 +24,7 @@ See `.cursor/rules/README.md` for the full catalog and loading strategy.
 
 - Реализация, багфикс, миграция, тесты, ревью MR, CI-fix — **предпочтительно через `/task`**.
 - Простой one-liner без архитектурного риска — можно без pipeline, если пользователь явно просит.
-- Вопросы «как работает X» — ответ без `/task`.
+- Вопросы «как работает X» — agent `codebase-analyzer` (explain-as-is) или ответ без `/task`.
 
 ## Pipeline routing
 
@@ -33,4 +36,4 @@ Intent detection, profiles (`full` / `standard` / `light`), and default steps
 npx @bonesofspring/ai-rules init cursor --preset next
 ```
 
-Копирует rules, commands, agents, hooks, skills, team, `hooks.json`, `BUGBOT.md`, `AGENTS.md`, `MCP.md`, `mcp.json` → `.cursor/mcp.json`.
+Копирует rules, commands, agents, hooks, skills, team, `hooks.json`, `BUGBOT.md`, `AGENTS.md` → `.cursor/AGENTS.md`, `MCP.md`, `mcp.json` → `.cursor/mcp.json`, плюс `REPO_AGENTS.md` → корневой `AGENTS.md`. Skills: `write-adr`, `react-performance` (on-demand).

package/presets/cursor/next/README.md

@@ -12,14 +12,15 @@ npx @bonesofspring/ai-rules init cursor --preset next
 
 | Path | Содержание |
 |------|------------|
-| `AGENTS.md` | Quick-start |
+| `REPO_AGENTS.md` | → repo-root `AGENTS.md` (cross-tool) |
+| `AGENTS.md` | → `.cursor/AGENTS.md` quick-start |
 | `BUGBOT.md` | Cursor Bugbot review priorities (Next) |
-| `rules/**` | `.mdc` + README (alwaysApply ≤3) |
-| `agents/**` | **21** ролей (+ README) |
-| `skills/**` | 7 skills (в т.ч. `playwright-e2e`) |
+| `rules/**` | `.mdc` + README (alwaysApply ≤3); golden rules with Incorrect/Correct + `impact:` |
+| `agents/**` | **22** ролей (+ README; includes on-demand `codebase-analyzer`) |
+| `skills/**` | 9 skills (incl. `playwright-e2e`, `write-adr`, `react-performance`) |
 | `commands/**` | task, task-continue, feature-start/continue, technical-retro |
-| `hooks.json` + `hooks/**` | guard-shell + chain-team-phases |
-| `team/**` | fixtures + README |
+| `hooks.json` + `hooks/**` | guard-shell + chain-team-phases; optional `hooks/examples/` cookbook |
+| `team/**` | fixtures + `conventions.md` + README |
 | `mcp.json` + `MCP.md` | Context7 + Figma MCP → `.cursor/mcp.json` |
 
 ## alwaysApply (≤3)

package/presets/cursor/next/REPO_AGENTS.md

@@ -0,0 +1,48 @@
+# Next.js — agent instructions
+
+Cross-tool repo-root guide. Tool-specific maps stay under `.cursor/AGENTS.md` and `.claude/CLAUDE.md`.
+
+## Cross-tool setup
+
+- Treat this file as the **shared** entry for any agent (Cursor, Claude Code, or other).
+- Tool maps (agent-team tables, slash commands) live in `.cursor/AGENTS.md` / `.claude/CLAUDE.md` — use them when that tool is installed.
+- Install:
+
+```bash
+npx @bonesofspring/ai-rules init cursor --preset next
+npx @bonesofspring/ai-rules init claude --preset next
+```
+
+`init` overwrites this file from the preset (`REPO_AGENTS.md` → `AGENTS.md`). Living gotchas belong in `team/conventions.md`, not here.
+
+## Commands (test / lint / build)
+
+Working directory for app scripts: **`app/`**. Detect the package manager from lockfile / `packageManager` (`package-manager` rule).
+
+| Gate | Typical command |
+|------|-----------------|
+| Lint JS | `yarn lint:js` (or project equivalent) from `app/` |
+| Lint CSS | `yarn lint:css` from `app/` |
+| Unit tests | project unit script under `app/` |
+| Build | project `build` under `app/` |
+
+After code edits: invoke **`post-change-lint`** (requestable). Full gate: agent `build-verifier`.
+
+## Security basics
+
+- Do not commit secrets (`.env`, tokens, credentials).
+- Review destructive git (`reset --hard`, force-push) before running; respect shell hooks.
+- Do not weaken CI or skip hooks unless the user explicitly asks.
+
+## Tool entry points
+
+| Tool | Map |
+|------|-----|
+| Cursor | `.cursor/AGENTS.md` (optional if Cursor not installed) |
+| Claude Code | `.claude/CLAUDE.md` (optional if Claude not installed) |
+
+Rules: `.cursor/rules/` or `.claude/rules/`. Skills: `.cursor/skills/` or `.claude/skills/`.
+
+## Living conventions
+
+Gotchas, local patterns, and team decisions: **`.cursor/team/conventions.md`** and/or **`.claude/team/conventions.md`** (fill after init; not overwritten on every dogfood sync when already present).

package/presets/cursor/next/agents/README.md

@@ -12,6 +12,12 @@
 | Migration planner | `migration-specialist.md` | no |
 | API contract reviewer | `api-contract-reviewer.md` | no |
 
+## Analysis (on-demand)
+
+| Agent | Файл | Production-код |
+|-------|------|----------------|
+| Codebase analyzer | `codebase-analyzer.md` | no (explain-as-is only) |
+
 ## Implementation and CI
 
 | Agent | Файл | Production-код |
@@ -62,7 +68,7 @@ SoT по умолчанию — YAML `model` в каждом agent-файле.
 
 | Tier | Default frontmatter | Agents |
 |------|---------------------|--------|
-| **cheap** | `fast` | `task-router`, `task-analyst`, `build-verifier`, `code-reviewer`, `tech-writer` |
+| **cheap** | `fast` | `task-router`, `task-analyst`, `build-verifier`, `code-reviewer`, `tech-writer`, `codebase-analyzer` |
 | **standard** | `inherit` | `feature-developer`, `debugger`, `ci-investigator`, `api-contract-reviewer`, `accessibility-reviewer`, `qa-tester`, `unit-test-*`, `playwright-test-*` |
 | **strong** | `claude-opus-4-8[effort=high]` | `solution-architect`, `migration-specialist`, `security-reviewer`, `performance-auditor` |
 

package/presets/cursor/next/agents/build-verifier.md

@@ -41,6 +41,11 @@ When validating **preset packaging** changes (paths under `packages/ai-rules/pre
 7. **Embed drift (soft by default):** run `packages/ai-rules/scripts/check-shared-core-drift.sh`. Document DRIFT; set `AI_RULES_DRIFT_FAIL=1` only when enforcing. Lineage stems are excluded from body equality.
 8. **Dogfood (monorepo soft):** if root `.cursor/` is in the PR, prefer sync via `packages/ai-rules/scripts/sync-dogfood-cursor.sh`; mass deletion of tracked dogfood without migration doc → note as risk / FAIL for maintainers.
 
+9. **Root AGENTS template:** each installable preset (`cursor|claude` × `next|ios-swift|go`) must ship `REPO_AGENTS.md` when validating preset packaging → **FAIL** if missing.
+10. **Hooks cookbook:** default `hooks.json` must **not** reference `hooks/examples/` → **FAIL** if it does.
+11. **No react-performance on ios/go:** skill directory / required handoff must be absent under ios-swift and go → **FAIL** (leakage). Prefer `check:preset-leakage`.
+12. **Rule eval (WARN):** `scripts/check-rule-eval.mjs` / `yarn check:rule-eval` should exist for maintainers; smoke optional. Hard fail only when the opt-in eval job runs — not part of default `check:preset-structure`.
+
 ### Soft notes
 
 - Thin aliases may be <15 body lines.

package/presets/cursor/next/agents/codebase-analyzer.md

@@ -0,0 +1,28 @@
+---
+name: codebase-analyzer
+description: Explains HOW existing code works as-is. Use when the user asks how something works, to trace data flow, or document architecture — without suggesting changes. Prefer over /task for pure questions.
+readonly: false
+model: fast
+---
+
+You are a specialist at understanding HOW this Next.js codebase works. Document implementation details with precise `path:line` references.
+
+## CRITICAL — explain as-is only
+
+- DO NOT suggest improvements, refactors, or "better approaches" unless the user explicitly asks.
+- DO NOT perform root-cause analysis or bug hunts unless asked.
+- DO NOT critique quality, performance, or security unless asked.
+- ONLY describe what exists, how it works, and how components interact.
+
+## Workflow
+
+1. Start from entry points the user named (routes, public barrels `@/api` / `@/types`, feature folders).
+2. Trace calls and data flow across UI → store → API → HTTP as applicable; read each file involved.
+3. Summarize: purpose, flow, contracts between modules, layer placement, conventions observed.
+4. End with open questions only if facts are missing — not with a wishlist of changes.
+
+## Will / Will not
+
+**Will:** map files, call chains, types/mappers, layer boundaries as they exist today.
+
+**Will not:** edit production code; open `/task` pipelines; propose PRs or refactors unprompted.

package/presets/cursor/next/agents/feature-developer.md

@@ -21,6 +21,19 @@ You are a senior frontend developer working in a Next.js monorepo with strict la
 - Mark completed tasks in `decomposition.md`.
 - Validation: **`post-change-lint.mdc`**. If pipeline next step is **`build-verifier`**, scoped lint/type-check on **changed files** is enough; full project lint is build-verifier's job.
 
+## Zero improvisation
+
+- Implement **only** what the brief / AC / current decomposition task require.
+- If requirements are ambiguous, conflicting, or multi-way — **ask** before coding; do not guess extras as "best practices".
+- Forbidden without explicit AC/task: unrelated security hardening, extra validation, UI polish, logging/monitoring, drive-by refactors, new config/env.
+- Boy scout / `design-guidance` improvements stay **within** touched files and must not expand task scope.
+
+## Will / Will not
+
+**Will:** follow layer order and reference features; add required unit tests; run the post-change gate; update task artifacts.
+
+**Will not:** formal code review; start blocked/dependent tasks; invent AC; auto-continue the next WP when the pipeline expects a human gate or handoff.
+
 ## On completion
 
 Update `status.json` (`currentAgent`: `feature-developer`, `state`: `completed`). Handoff: tasks done, files by layer, unit specs, validation result, gaps for build-verifier/reviewer.

package/presets/cursor/next/agents/security-reviewer.md

@@ -15,9 +15,11 @@ You are a frontend security reviewer for a Next.js TypeScript application.
 
 ## Review scope
 
-- Secrets, tokens, API keys in source or committed env files.
+Load `security-next.mdc` for coding-time invariants. Focus on:
+
+- Secrets, tokens, API keys in source or committed env files; never in `NEXT_PUBLIC_*`.
 - `dangerouslySetInnerHTML`, unsanitized HTML, URL injection.
-- Auth token storage (cookies vs localStorage), refresh flows, 401 handling.
+- Auth token storage (cookies vs localStorage), server-side session verify, refresh flows, 401 handling.
 - CSRF considerations for state-changing requests (as applicable to frontend).
 - Open redirects in navigation/router usage.
 - Sensitive data in client-side logs or error messages.

package/presets/cursor/next/commands/README.md

@@ -42,7 +42,7 @@ Slash-команды копируются в `.cursor/commands/` при `ai-rule
 
 ## Связанные файлы
 
-- Subagents: `../agents/` (**21** ролей, включая `task-router.md`)
+- Subagents: `../agents/` (**22** ролей, включая `task-router.md`, `codebase-analyzer.md`)
 - Оркестратор: `../rules/agent-team-orchestrator.mdc`
 - Skills: `../skills/` (`feature-delivery`, `code-review`, `debug-investigation`, `ci-investigation`, `unit-testing`, `playwright-e2e`, `technical-retro`)
 - Артефакты: `../team/README.md` (`pipeline.json`, `status.json`)

package/presets/cursor/next/hooks/README.md

@@ -6,3 +6,7 @@
 | `guard-shell-command.sh` | Blocks/asks on destructive git commands and package-manager mismatches (`failClosed: true`) |
 
 `hooks.json`: `loop_limit: 15` for long pipelines (build-verifier + parallel reviewers + e2e).
+
+## Optional cookbook
+
+See `hooks/examples/README.md` — secret-guard / format-edited / test-on-save. **Not** in default `hooks.json`.

package/presets/cursor/next/hooks/examples/README.md

@@ -0,0 +1,18 @@
+# Hooks cookbook (examples)
+
+Optional scripts under `hooks/examples/`. **Not** referenced from default `hooks.json` (only `guard-shell-command.sh` + `chain-team-phases.sh`).
+
+| Script | Purpose |
+|--------|---------|
+| `secret-guard.example.sh` | Fail if staged diff looks like secrets |
+| `format-edited.example.sh` | Stack formatter / linter on edited files |
+| `test-on-save.example.sh` | Scoped tests for the stack |
+
+## Wiring (Cursor)
+
+1. Copy an example into `hooks/` (drop `.example` suffix), e.g. `cp hooks/examples/secret-guard.example.sh hooks/secret-guard.sh`.
+2. `chmod +x hooks/secret-guard.sh`.
+3. Add a hook entry in `.cursor/hooks.json` (e.g. `beforeShellExecution` or `afterFileEdit` — see Cursor hooks docs).
+4. Keep cookbook scripts **out** of the default preset `hooks.json` when contributing back upstream.
+
+Stack: **next** — recipes must stay stack-safe (no cross-stack lint/test commands).