@brunosps00/dev-workflow 0.15.0 → 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +99 -119
- package/lib/constants.js +16 -36
- package/lib/migrate-skills.js +11 -4
- package/lib/removed-commands.js +30 -0
- package/package.json +1 -1
- package/scaffold/en/agent-instructions.md +31 -16
- package/scaffold/en/commands/dw-adr.md +2 -2
- package/scaffold/en/commands/dw-analyze-project.md +7 -7
- package/scaffold/en/commands/dw-autopilot.md +20 -20
- package/scaffold/en/commands/dw-brainstorm.md +315 -21
- package/scaffold/en/commands/dw-bugfix.md +5 -5
- package/scaffold/en/commands/dw-commit.md +1 -1
- package/scaffold/en/commands/dw-dockerize.md +9 -9
- package/scaffold/en/commands/dw-find-skills.md +4 -4
- package/scaffold/en/commands/dw-functional-doc.md +1 -1
- package/scaffold/en/commands/dw-generate-pr.md +4 -4
- package/scaffold/en/commands/dw-help.md +95 -351
- package/scaffold/en/commands/dw-intel.md +76 -12
- package/scaffold/en/commands/dw-new-project.md +9 -9
- package/scaffold/en/commands/dw-plan.md +175 -0
- package/scaffold/en/commands/dw-qa.md +166 -0
- package/scaffold/en/commands/dw-redesign-ui.md +6 -6
- package/scaffold/en/commands/dw-review.md +198 -0
- package/scaffold/en/commands/dw-run.md +176 -0
- package/scaffold/en/commands/dw-secure-audit.md +222 -0
- package/scaffold/en/commands/dw-update.md +1 -1
- package/scaffold/en/references/playwright-patterns.md +1 -1
- package/scaffold/en/references/refactoring-catalog.md +1 -1
- package/scaffold/en/templates/brainstorm-matrix.md +1 -1
- package/scaffold/en/templates/idea-onepager.md +3 -3
- package/scaffold/en/templates/project-onepager.md +5 -5
- package/scaffold/pt-br/agent-instructions.md +31 -16
- package/scaffold/pt-br/commands/dw-adr.md +2 -2
- package/scaffold/pt-br/commands/dw-analyze-project.md +7 -7
- package/scaffold/pt-br/commands/dw-autopilot.md +20 -20
- package/scaffold/pt-br/commands/dw-brainstorm.md +315 -21
- package/scaffold/pt-br/commands/dw-bugfix.md +8 -8
- package/scaffold/pt-br/commands/dw-commit.md +1 -1
- package/scaffold/pt-br/commands/dw-dockerize.md +9 -9
- package/scaffold/pt-br/commands/dw-find-skills.md +4 -4
- package/scaffold/pt-br/commands/dw-functional-doc.md +1 -1
- package/scaffold/pt-br/commands/dw-generate-pr.md +4 -4
- package/scaffold/pt-br/commands/dw-help.md +97 -300
- package/scaffold/pt-br/commands/dw-intel.md +77 -13
- package/scaffold/pt-br/commands/dw-new-project.md +9 -9
- package/scaffold/pt-br/commands/dw-plan.md +175 -0
- package/scaffold/pt-br/commands/dw-qa.md +166 -0
- package/scaffold/pt-br/commands/dw-redesign-ui.md +6 -6
- package/scaffold/pt-br/commands/dw-review.md +198 -0
- package/scaffold/pt-br/commands/dw-run.md +176 -0
- package/scaffold/pt-br/commands/dw-secure-audit.md +222 -0
- package/scaffold/pt-br/commands/dw-update.md +1 -1
- package/scaffold/pt-br/references/playwright-patterns.md +1 -1
- package/scaffold/pt-br/references/refactoring-catalog.md +1 -1
- package/scaffold/pt-br/templates/brainstorm-matrix.md +1 -1
- package/scaffold/pt-br/templates/idea-onepager.md +3 -3
- package/scaffold/pt-br/templates/project-onepager.md +5 -5
- package/scaffold/pt-br/templates/tasks-template.md +1 -1
- package/scaffold/skills/api-testing-recipes/SKILL.md +6 -6
- package/scaffold/skills/api-testing-recipes/references/auth-patterns.md +1 -1
- package/scaffold/skills/api-testing-recipes/references/matrix-conventions.md +1 -1
- package/scaffold/skills/api-testing-recipes/references/openapi-driven.md +3 -3
- package/scaffold/skills/docker-compose-recipes/SKILL.md +1 -1
- package/scaffold/skills/dw-codebase-intel/SKILL.md +9 -9
- package/scaffold/skills/dw-codebase-intel/agents/intel-updater.md +4 -4
- package/scaffold/skills/dw-codebase-intel/references/api-design-discipline.md +1 -1
- package/scaffold/skills/dw-codebase-intel/references/incremental-update.md +5 -5
- package/scaffold/skills/dw-codebase-intel/references/intel-format.md +1 -1
- package/scaffold/skills/dw-codebase-intel/references/query-patterns.md +3 -3
- package/scaffold/skills/dw-council/SKILL.md +2 -2
- package/scaffold/skills/dw-debug-protocol/SKILL.md +5 -3
- package/scaffold/skills/dw-execute-phase/SKILL.md +16 -16
- package/scaffold/skills/dw-execute-phase/agents/executor.md +5 -5
- package/scaffold/skills/dw-execute-phase/agents/plan-checker.md +4 -4
- package/scaffold/skills/dw-execute-phase/references/atomic-commits.md +1 -1
- package/scaffold/skills/dw-execute-phase/references/plan-verification.md +2 -2
- package/scaffold/skills/dw-execute-phase/references/wave-coordination.md +1 -1
- package/scaffold/skills/dw-git-discipline/SKILL.md +5 -2
- package/scaffold/skills/dw-incident-response/SKILL.md +5 -1
- package/scaffold/skills/dw-llm-eval/SKILL.md +10 -8
- package/scaffold/skills/dw-memory/SKILL.md +2 -2
- package/scaffold/skills/dw-review-rigor/SKILL.md +5 -5
- package/scaffold/skills/dw-simplification/SKILL.md +12 -7
- package/scaffold/skills/dw-simplification/references/deep-modules.md +105 -0
- package/scaffold/skills/dw-source-grounding/SKILL.md +1 -1
- package/scaffold/skills/dw-testing-discipline/SKILL.md +8 -6
- package/scaffold/skills/dw-testing-discipline/references/agent-guardrails.md +3 -3
- package/scaffold/skills/dw-testing-discipline/references/anti-patterns.md +2 -2
- package/scaffold/skills/dw-testing-discipline/references/core-rules.md +1 -1
- package/scaffold/skills/dw-testing-discipline/references/flaky-discipline.md +3 -3
- package/scaffold/skills/dw-testing-discipline/references/patterns.md +1 -1
- package/scaffold/skills/dw-testing-discipline/references/playwright-recipes.md +1 -1
- package/scaffold/skills/dw-ui-discipline/SKILL.md +8 -6
- package/scaffold/skills/dw-ui-discipline/references/accessibility-floor.md +2 -2
- package/scaffold/skills/dw-ui-discipline/references/hard-gate.md +1 -1
- package/scaffold/skills/dw-ui-discipline/references/state-matrix.md +1 -1
- package/scaffold/skills/dw-ui-discipline/references/visual-slop.md +2 -2
- package/scaffold/skills/dw-verify/SKILL.md +4 -4
- package/scaffold/skills/humanizer/SKILL.md +1 -7
- package/scaffold/skills/remotion-best-practices/SKILL.md +3 -1
- package/scaffold/skills/security-review/SKILL.md +1 -1
- package/scaffold/skills/security-review/languages/csharp.md +1 -1
- package/scaffold/skills/security-review/languages/rust.md +1 -1
- package/scaffold/skills/security-review/languages/typescript.md +1 -1
- package/scaffold/skills/vercel-react-best-practices/SKILL.md +3 -1
- package/scaffold/templates-overrides-readme.md +3 -3
- package/scaffold/en/commands/dw-code-review.md +0 -386
- package/scaffold/en/commands/dw-create-prd.md +0 -148
- package/scaffold/en/commands/dw-create-tasks.md +0 -201
- package/scaffold/en/commands/dw-create-techspec.md +0 -210
- package/scaffold/en/commands/dw-deep-research.md +0 -418
- package/scaffold/en/commands/dw-deps-audit.md +0 -327
- package/scaffold/en/commands/dw-fix-qa.md +0 -152
- package/scaffold/en/commands/dw-map-codebase.md +0 -125
- package/scaffold/en/commands/dw-refactoring-analysis.md +0 -340
- package/scaffold/en/commands/dw-revert-task.md +0 -114
- package/scaffold/en/commands/dw-review-implementation.md +0 -349
- package/scaffold/en/commands/dw-run-plan.md +0 -300
- package/scaffold/en/commands/dw-run-qa.md +0 -497
- package/scaffold/en/commands/dw-run-task.md +0 -209
- package/scaffold/en/commands/dw-security-check.md +0 -271
- package/scaffold/pt-br/commands/dw-code-review.md +0 -366
- package/scaffold/pt-br/commands/dw-create-prd.md +0 -148
- package/scaffold/pt-br/commands/dw-create-tasks.md +0 -201
- package/scaffold/pt-br/commands/dw-create-techspec.md +0 -208
- package/scaffold/pt-br/commands/dw-deep-research.md +0 -172
- package/scaffold/pt-br/commands/dw-deps-audit.md +0 -327
- package/scaffold/pt-br/commands/dw-fix-qa.md +0 -152
- package/scaffold/pt-br/commands/dw-map-codebase.md +0 -125
- package/scaffold/pt-br/commands/dw-refactoring-analysis.md +0 -340
- package/scaffold/pt-br/commands/dw-revert-task.md +0 -114
- package/scaffold/pt-br/commands/dw-review-implementation.md +0 -337
- package/scaffold/pt-br/commands/dw-run-plan.md +0 -296
- package/scaffold/pt-br/commands/dw-run-qa.md +0 -495
- package/scaffold/pt-br/commands/dw-run-task.md +0 -208
- package/scaffold/pt-br/commands/dw-security-check.md +0 -271
|
@@ -0,0 +1,105 @@
|
|
|
1
|
+
# Deep modules — high leverage at small interface
|
|
2
|
+
|
|
3
|
+
A **deep module** absorbs complexity behind a narrow public surface. Its callers see a small, stable API and get a lot of work done per call. A **shallow module** is the opposite — small interface AND small implementation, so it adds an indirection without absorbing any complexity. Or worse: a god-module, deep implementation BUT huge interface, where the surface itself is the complexity.
|
|
4
|
+
|
|
5
|
+
The refactor-audit mode of `/dw-brainstorm` checks every candidate module against this framing alongside the Fowler smell taxonomy. A "code smell" can mislead if the construct is actually a deep wrapper doing its job correctly.
|
|
6
|
+
|
|
7
|
+
## The premise
|
|
8
|
+
|
|
9
|
+
Good abstractions hide complexity. The metric isn't "how short is the code?" — it's "how much complexity does the interface eliminate per unit of public surface area?"
|
|
10
|
+
|
|
11
|
+
- **Deep module**: 1000 lines of implementation, 3 public functions. Caller does NOT need to know the 1000 lines.
|
|
12
|
+
- **Shallow module**: 50 lines of implementation, 8 public functions. Caller has to learn all 8 to use the 50 productively.
|
|
13
|
+
- **God-module**: 5000 lines of implementation, 60 public functions. Surface area is itself unmanageable.
|
|
14
|
+
|
|
15
|
+
The deep version wins not because it's shorter overall (it's longer), but because the cost of using it is concentrated in the implementation, not spread to every caller.
|
|
16
|
+
|
|
17
|
+
## Diagnostic checklist
|
|
18
|
+
|
|
19
|
+
When the refactor-audit mode evaluates a module, ask these in order:
|
|
20
|
+
|
|
21
|
+
### 1. Deletion test
|
|
22
|
+
|
|
23
|
+
> If this module were deleted, how many call sites would break?
|
|
24
|
+
|
|
25
|
+
- **0–1 callers**: the module isn't pulling its weight. Inline it; the abstraction is shallower than the call sites' real shape. Mark this as `low` priority candidate for removal.
|
|
26
|
+
- **2–3 callers**: borderline. Look at what each caller does with the result — if they immediately wrap/unwrap, the module is shallow. If they consume the result directly, leave it alone.
|
|
27
|
+
- **4+ callers**: the module is at least somewhat load-bearing. Move to next checks.
|
|
28
|
+
|
|
29
|
+
### 2. Locality test
|
|
30
|
+
|
|
31
|
+
> Does the caller pass everything the module needs, OR does the module reach into globals / shared state to fill gaps?
|
|
32
|
+
|
|
33
|
+
A deep module is **self-contained**: callers pass in arguments, get back results. A module that reads from `process.env`, a shared singleton, or implicit thread-local state has a deeper coupling than its interface admits — the caller has to know about the hidden inputs too.
|
|
34
|
+
|
|
35
|
+
If the module reaches into shared state, its **effective interface** is bigger than what the function signature shows. That's a hidden shallowness — the public surface lies about its real cost.
|
|
36
|
+
|
|
37
|
+
### 3. Leverage test
|
|
38
|
+
|
|
39
|
+
> LOC saved per caller × number of callers — what's the multiplicative payoff?
|
|
40
|
+
|
|
41
|
+
Crude formula: if each caller would otherwise write ~N lines of inline code to replace this module's call, and there are M callers, the module's leverage is N × M. A module whose leverage is < 2× its own LOC is shallow — it's not absorbing enough complexity to justify itself.
|
|
42
|
+
|
|
43
|
+
### 4. Seam test
|
|
44
|
+
|
|
45
|
+
> How often does the public interface change relative to the implementation?
|
|
46
|
+
|
|
47
|
+
A stable public interface with frequently-changing implementation is the **ideal seam** — callers stay put while internals evolve. An interface that changes every few months means callers track it; the abstraction is leaking.
|
|
48
|
+
|
|
49
|
+
Check `git log --oneline -- <module>` against `git log --oneline -- <module-public-surface-file>`. If they move together, the seam is weak.
|
|
50
|
+
|
|
51
|
+
### 5. Adapter test
|
|
52
|
+
|
|
53
|
+
> Does this module mediate between two foreign vocabularies?
|
|
54
|
+
|
|
55
|
+
The best deep modules are **adapters** — they translate between two domains that have different naming conventions, error semantics, or state models. A module that doesn't mediate between domains is harder to justify as deep; it's probably either a passthrough (shallow) or just a piece of the same domain stretched across files (cohesion issue).
|
|
56
|
+
|
|
57
|
+
## Anti-patterns
|
|
58
|
+
|
|
59
|
+
### Shallow wrapper
|
|
60
|
+
|
|
61
|
+
```ts
|
|
62
|
+
// shallow — passthrough with one line of "work"
|
|
63
|
+
export function getUserName(id: string) {
|
|
64
|
+
return db.users.findById(id).name;
|
|
65
|
+
}
|
|
66
|
+
```
|
|
67
|
+
|
|
68
|
+
The wrapper saves the caller 8 characters (`.name`) and forces them to learn a new function name. The leverage is < 1. Inline it.
|
|
69
|
+
|
|
70
|
+
When to keep a one-liner: it's an **adapter** that locks down ONE meaning of a query. If `getUserName` exists specifically because there are 4 candidate fields (`name`, `displayName`, `username`, `fullName`) and the team's canonical answer is "use `name`", the function IS pulling its weight by serving as the project's vocabulary anchor. Document the WHY in the function body.
|
|
71
|
+
|
|
72
|
+
### God-module
|
|
73
|
+
|
|
74
|
+
A class with 60 public methods is shallow even if each method is 100 lines, because the caller has to learn 60 concepts. Split by **role**: what is the smallest subset of methods a caller typically uses together? Each subset becomes a deep module of its own.
|
|
75
|
+
|
|
76
|
+
### Implementation-leak abstraction
|
|
77
|
+
|
|
78
|
+
A module that returns its internal representation directly (`return this.cache;`) makes callers depend on the internals. The first time the cache shape changes, every caller breaks. Wrap or copy on egress.
|
|
79
|
+
|
|
80
|
+
## When refactor-audit raises a smell, also check deep-modules
|
|
81
|
+
|
|
82
|
+
The combined verdict:
|
|
83
|
+
|
|
84
|
+
| Fowler smell | Deep-modules check | Action |
|
|
85
|
+
|--------------|--------------------|--------|
|
|
86
|
+
| Long Method | Is the method INSIDE a deep module that callers don't see? | If yes, leave it — internal complexity is OK in deep modules. If no, extract. |
|
|
87
|
+
| Large Class | Is the public surface narrow despite the line count? | If yes, leave it — that's deep. If no, split by role. |
|
|
88
|
+
| Long Parameter List | Does each parameter represent a real choice the caller makes? | If yes, the deep module is forcing necessary configuration; introduce a config object. If parameters are derivable from each other, reduce. |
|
|
89
|
+
| Feature Envy | Is the module a deep adapter between domains? | If yes, the "envy" is the mediation — keep it. If no, move the logic closer to its data. |
|
|
90
|
+
| Middle Man | Does the middle man absorb any complexity? | If no, delete the middle man. If yes, document the why (it's a deep wrapper). |
|
|
91
|
+
|
|
92
|
+
A flat "this is too long, extract method" recommendation is shallow analysis. Combining Fowler + deep-modules surfaces when the smell is actually a feature.
|
|
93
|
+
|
|
94
|
+
## Output for refactor-audit findings
|
|
95
|
+
|
|
96
|
+
When the audit flags a module as a shallow-wrapper or god-module candidate, the finding entry adds a `Deep-modules: <verdict>` line:
|
|
97
|
+
|
|
98
|
+
```markdown
|
|
99
|
+
### P1 — Shallow Wrapper
|
|
100
|
+
**Files:** src/lib/getUserName.ts
|
|
101
|
+
**Symptom:** 1-line passthrough wrapper around `db.users.findById(id).name`; 2 callers.
|
|
102
|
+
**Deep-modules:** SHALLOW — fails deletion test (only 2 callers) AND leverage test (0 LOC saved per call).
|
|
103
|
+
**Refactor:** Inline at both call sites. If the wrapper exists for vocabulary reasons, document and keep — otherwise remove.
|
|
104
|
+
**Risk:** Low.
|
|
105
|
+
```
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: dw-source-grounding
|
|
3
|
-
description:
|
|
3
|
+
description: "Use when citing frameworks or libraries. Detect → Fetch → Implement → Cite with [source: url, version, retrieved]. Triggers on every framework decision in techspec, deps audit, research."
|
|
4
4
|
allowed-tools:
|
|
5
5
|
- Read
|
|
6
6
|
- Bash
|
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: dw-testing-discipline
|
|
3
|
-
description: Use when authoring, reviewing, or debugging tests
|
|
3
|
+
description: Use when authoring, reviewing, or debugging tests. Six core rules, 25 anti-patterns, 6 agent guardrails, flaky discipline. Triggers on every test diff, /dw-qa, or test-writing session.
|
|
4
|
+
allowed-tools:
|
|
5
|
+
- Read
|
|
4
6
|
---
|
|
5
7
|
|
|
6
8
|
# Testing Discipline
|
|
@@ -160,11 +162,11 @@ Any of these in a PR is enough to REJECT a verdict:
|
|
|
160
162
|
|
|
161
163
|
## Integration with dev-workflow commands
|
|
162
164
|
|
|
163
|
-
- `/dw-
|
|
164
|
-
- `/dw-run
|
|
165
|
-
- `/dw-code-
|
|
166
|
-
- `/dw-fix
|
|
167
|
-
- `/dw-
|
|
165
|
+
- `/dw-plan tasks` applies the placement doctrine — each test-adding task names the invariant.
|
|
166
|
+
- `/dw-run` runs the 6 agent guardrails when generating tests during implementation.
|
|
167
|
+
- `/dw-review --code-only` runs the anti-pattern checks on diff hunks under test paths.
|
|
168
|
+
- `/dw-qa --fix` applies the flaky-discipline taxonomy in retest cycles.
|
|
169
|
+
- `/dw-qa` (UI mode) references `playwright-recipes.md` for concrete recipes.
|
|
168
170
|
|
|
169
171
|
## Bottom line
|
|
170
172
|
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
LLMs have characteristic failure modes when authoring tests. Six guardrails are forcing functions for the most common ones.
|
|
4
4
|
|
|
5
|
-
Every test produced by an agent (via `/dw-run
|
|
5
|
+
Every test produced by an agent (via `/dw-run`, `/dw-bugfix`, `/dw-autopilot`, or any code-generating flow) must clear all six BEFORE the diff goes to review.
|
|
6
6
|
|
|
7
7
|
## Guardrail 1 — State the invariant, layer, and host suite first
|
|
8
8
|
|
|
@@ -25,7 +25,7 @@ If the agent can't fill any line, it stops and asks the user — it does NOT inv
|
|
|
25
25
|
- "Owning layer" forces Rule 2 (lowest detectable layer).
|
|
26
26
|
- "Existing suite" forces extending coverage rather than spawning orphan files.
|
|
27
27
|
|
|
28
|
-
**Verification:** `/dw-code-
|
|
28
|
+
**Verification:** `/dw-review --code-only` looks for this 3-line preamble in the PR description or commit body. Missing = REJECTED.
|
|
29
29
|
|
|
30
30
|
## Guardrail 2 — Real execution somewhere
|
|
31
31
|
|
|
@@ -161,7 +161,7 @@ Tests violating guardrails without explicit SKIP-GUARDRAIL-N comments
|
|
|
161
161
|
will be REJECTED at review.
|
|
162
162
|
```
|
|
163
163
|
|
|
164
|
-
`/dw-run
|
|
164
|
+
`/dw-run` and `/dw-bugfix` inject this prompt block before generating test code.
|
|
165
165
|
|
|
166
166
|
## Why six and not more
|
|
167
167
|
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Anti-patterns — 25 smells across 4 families
|
|
2
2
|
|
|
3
|
-
Each anti-pattern names the smell, shows the violation in pseudo-code, gives the fix, and notes how `/dw-code-
|
|
3
|
+
Each anti-pattern names the smell, shows the violation in pseudo-code, gives the fix, and notes how `/dw-review --code-only` detects it. Agent-specific failure modes are covered separately in `agent-guardrails.md`.
|
|
4
4
|
|
|
5
5
|
---
|
|
6
6
|
|
|
@@ -324,7 +324,7 @@ You wrote `hello` in the mock. You asserted `hello`. You proved nothing.
|
|
|
324
324
|
|
|
325
325
|
---
|
|
326
326
|
|
|
327
|
-
## How `/dw-code-
|
|
327
|
+
## How `/dw-review --code-only` uses this catalog
|
|
328
328
|
|
|
329
329
|
For each diff hunk under a test path:
|
|
330
330
|
1. Run regex scans for the patterns flagged "Detection" above.
|
|
@@ -125,4 +125,4 @@ A healthy test:
|
|
|
125
125
|
5. Survives a mutation in the code it claims to cover (Rule 5).
|
|
126
126
|
6. Has zero footprint in production code (Rule 6).
|
|
127
127
|
|
|
128
|
-
Any test failing ≥2 of these is technical debt accumulating. `/dw-code-
|
|
128
|
+
Any test failing ≥2 of these is technical debt accumulating. `/dw-review --code-only` flags them.
|
|
@@ -158,6 +158,6 @@ When CI is wired this way, a flake at unit usually = race or order-dependency (f
|
|
|
158
158
|
|
|
159
159
|
## Integration with dev-workflow
|
|
160
160
|
|
|
161
|
-
- `/dw-fix
|
|
162
|
-
- `/dw-code-
|
|
163
|
-
- `/dw-
|
|
161
|
+
- `/dw-qa --fix` uses this taxonomy when retest cycles produce inconsistent results: classify the flake, apply the right fix, document.
|
|
162
|
+
- `/dw-review --code-only` flags tests being modified that have a `FLAKY-*` marker — review must verify the flake is now actually fixed, not just made less likely.
|
|
163
|
+
- `/dw-qa` weekly summary includes the `flaky_rate` metric.
|
|
@@ -238,4 +238,4 @@ The page object hides the selector mess; tests read like specs. But for a 5-test
|
|
|
238
238
|
|
|
239
239
|
## Applying these patterns
|
|
240
240
|
|
|
241
|
-
When `/dw-run
|
|
241
|
+
When `/dw-run` generates a new test, it must comply with these 12. `/dw-review --code-only` checks each diff hunk under test paths against these patterns and the anti-patterns in the sibling reference. Violations become findings.
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Playwright recipes — concrete tactical patterns
|
|
2
2
|
|
|
3
|
-
Practical Playwright code for the common scenarios. Use this when `/dw-
|
|
3
|
+
Practical Playwright code for the common scenarios. Use this when `/dw-qa` runs in UI mode or when `/dw-functional-doc` needs E2E coverage.
|
|
4
4
|
|
|
5
5
|
> These recipes ASSUME the doctrine in this skill (core rules, positive patterns) has already been applied. Recipes are the HOW once the WHY is settled.
|
|
6
6
|
|
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: dw-ui-discipline
|
|
3
|
-
description: Use BEFORE any UI work
|
|
3
|
+
description: Use BEFORE any UI work. 4 grounding questions (design source, surface job, state matrix, scene), 14 anti-slop patterns, WCAG 2.2 AA floor. Triggers on UI design, /dw-redesign-ui, UI diffs.
|
|
4
|
+
allowed-tools:
|
|
5
|
+
- Read
|
|
4
6
|
---
|
|
5
7
|
|
|
6
8
|
# UI Discipline
|
|
@@ -12,9 +14,9 @@ This skill blocks that autopilot at four grounding questions before any visual d
|
|
|
12
14
|
## When to use
|
|
13
15
|
|
|
14
16
|
- Inside `/dw-redesign-ui` — both proposal and validation steps.
|
|
15
|
-
- Inside `/dw-
|
|
17
|
+
- Inside `/dw-plan techspec` when the spec has UI sections.
|
|
16
18
|
- Inside `/dw-functional-doc` when documenting screen-level patterns.
|
|
17
|
-
- Inside `/dw-code-
|
|
19
|
+
- Inside `/dw-review --code-only` when the diff touches UI files (CSS, JSX, templates).
|
|
18
20
|
- Inside `/dw-brainstorm` when the conversation drifts into visual direction.
|
|
19
21
|
|
|
20
22
|
If you're tempted to skip this "because it's just a small tweak" — that's the trigger. Run the grounding.
|
|
@@ -126,7 +128,7 @@ Before any interactive widget ships:
|
|
|
126
128
|
- [ ] Heading hierarchy is semantic (no skipped levels).
|
|
127
129
|
- [ ] `prefers-reduced-motion` honored.
|
|
128
130
|
|
|
129
|
-
Full verification recipes in `references/accessibility-floor.md`. `/dw-code-
|
|
131
|
+
Full verification recipes in `references/accessibility-floor.md`. `/dw-review --code-only` rejects the verdict if any interactive widget ships without these.
|
|
130
132
|
|
|
131
133
|
## When the grounding bends
|
|
132
134
|
|
|
@@ -139,8 +141,8 @@ In all bend cases, document the bend in the PR (one line). "I skipped the state
|
|
|
139
141
|
## Integration with dev-workflow commands
|
|
140
142
|
|
|
141
143
|
- `/dw-redesign-ui` runs the grounding end-to-end. Steps 4 (propose) and 7 (validate) consult this skill explicitly.
|
|
142
|
-
- `/dw-
|
|
143
|
-
- `/dw-code-
|
|
144
|
+
- `/dw-plan techspec` UI sections must answer the 4 grounding questions and reference the state matrix.
|
|
145
|
+
- `/dw-review --code-only` checks UI diffs against the 14 visual-slop patterns and the accessibility floor.
|
|
144
146
|
- `/dw-functional-doc` records the surface-job and scene sentences in the overview for each screen.
|
|
145
147
|
|
|
146
148
|
## Why this approach
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Accessibility floor — WCAG 2.2 AA is the minimum, not the goal
|
|
2
2
|
|
|
3
|
-
This reference is read in full before any interactive widget ships. Skipping any item below is a hard-block in `/dw-code-
|
|
3
|
+
This reference is read in full before any interactive widget ships. Skipping any item below is a hard-block in `/dw-review --code-only`.
|
|
4
4
|
|
|
5
5
|
## The non-negotiables
|
|
6
6
|
|
|
@@ -222,4 +222,4 @@ LLM-produced UI commonly fails on:
|
|
|
222
222
|
- Modals that trap focus only on success path, not on error.
|
|
223
223
|
- Auto-playing carousels with no pause control.
|
|
224
224
|
|
|
225
|
-
`/dw-code-
|
|
225
|
+
`/dw-review --code-only` runs axe-style checks on the diff for these.
|
|
@@ -159,4 +159,4 @@ This is the minimum disclosure. Anything less and the grounding didn't pass.
|
|
|
159
159
|
|
|
160
160
|
The downstream references (`visual-slop.md`, `state-matrix.md`, `accessibility-floor.md`) assume the grounding passed. They won't re-verify; if you skipped a question, the output will reflect it.
|
|
161
161
|
|
|
162
|
-
`/dw-code-
|
|
162
|
+
`/dw-review --code-only` fails verdict on UI PRs where this disclosure is missing.
|
|
@@ -86,7 +86,7 @@ Before declaring the design "done":
|
|
|
86
86
|
- [ ] `focus-visible` is distinct from `hover` (keyboard users need their own affordance).
|
|
87
87
|
- [ ] Color is never the SOLE differentiator (a11y); pair with shape/text/position.
|
|
88
88
|
|
|
89
|
-
## Integration with `/dw-code-
|
|
89
|
+
## Integration with `/dw-review --code-only`
|
|
90
90
|
|
|
91
91
|
Review fails verdict (REJECTED) on a UI PR when:
|
|
92
92
|
- A new component handles async data but renders only the default state.
|
|
@@ -4,7 +4,7 @@ Two parts:
|
|
|
4
4
|
1. **Fourteen patterns** an ungrounded UI agent produces.
|
|
5
5
|
2. **Seventeen specific values** that signal "no thought went into this."
|
|
6
6
|
|
|
7
|
-
Used by `/dw-code-
|
|
7
|
+
Used by `/dw-review --code-only` against UI diffs and by `/dw-redesign-ui` as a self-check during proposal.
|
|
8
8
|
|
|
9
9
|
## The 14 patterns
|
|
10
10
|
|
|
@@ -140,7 +140,7 @@ Specific values that signal "no thought went into this." Avoid unless you can ar
|
|
|
140
140
|
|
|
141
141
|
In `/dw-redesign-ui` step 4 (propose) — before presenting design directions, self-check against this list. If you're using a pattern, say why explicitly ("gradient crutch — intentional for marketing hero"). Sometimes the pattern IS the right call; the discipline is awareness, not absolutism.
|
|
142
142
|
|
|
143
|
-
In `/dw-code-
|
|
143
|
+
In `/dw-review --code-only` UI section — grep the diff for the anti-default values and the patterns. Each hit becomes a finding under `dw-review-rigor`:
|
|
144
144
|
- Pattern on a NEW surface → `medium` severity.
|
|
145
145
|
- Pattern propagating EXISTING slop further → `low` severity (consistency wins).
|
|
146
146
|
- Pattern on a redesign that was supposed to fix slop → `high` severity (regression).
|
|
@@ -171,11 +171,11 @@ If no verification command exists for the project, state that explicitly in the
|
|
|
171
171
|
|
|
172
172
|
This skill is invoked transparently from:
|
|
173
173
|
|
|
174
|
-
- `/dw-run
|
|
175
|
-
- `/dw-run
|
|
176
|
-
- `/dw-fix
|
|
174
|
+
- `/dw-run` — before committing the task's changes
|
|
175
|
+
- `/dw-run` — before Level 2 review and before declaring the plan complete
|
|
176
|
+
- `/dw-qa --fix` — before marking a bug as resolved in `QA/bugs.md`
|
|
177
177
|
- `/dw-bugfix` — before claiming the bug is fixed (original symptom no longer reproduces)
|
|
178
|
-
- `/dw-code-
|
|
178
|
+
- `/dw-review --code-only` — before emitting an APPROVED verdict
|
|
179
179
|
- `/dw-generate-pr` — blocks PR creation if the session has no passing VERIFICATION REPORT post-last-edit
|
|
180
180
|
|
|
181
181
|
Callers should mention this skill in their "Skills Complementares" section so the user sees the dependency.
|
|
@@ -1,13 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: humanizer
|
|
3
3
|
version: 2.2.0
|
|
4
|
-
description:
|
|
5
|
-
Remove signs of AI-generated writing from text. Use when editing or reviewing
|
|
6
|
-
text to make it sound more natural and human-written. Based on Wikipedia's
|
|
7
|
-
comprehensive "Signs of AI writing" guide. Detects and fixes patterns including:
|
|
8
|
-
inflated symbolism, promotional language, superficial -ing analyses, vague
|
|
9
|
-
attributions, em dash overuse, rule of three, AI vocabulary words, negative
|
|
10
|
-
parallelisms, and excessive conjunctive phrases.
|
|
4
|
+
description: Use when editing AI-generated text. Detects 24 'signs of AI writing' (em-dashes, rule-of-three, AI vocab, vague attributions). Triggers on docs, READMEs, blog posts, captions, marketing copy.
|
|
11
5
|
allowed-tools:
|
|
12
6
|
- Read
|
|
13
7
|
- Write
|
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: remotion-best-practices
|
|
3
|
-
description:
|
|
3
|
+
description: Use for video composition with Remotion + React. 25+ rules for composition, transitions, FFmpeg, performance. Triggers on .tsx Remotion files, video rendering, motion design, captions.
|
|
4
|
+
allowed-tools:
|
|
5
|
+
- Read
|
|
4
6
|
metadata:
|
|
5
7
|
tags: remotion, video, react, animation, composition
|
|
6
8
|
---
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: security-review
|
|
3
|
-
description:
|
|
3
|
+
description: Use for security code review. OWASP patterns (injection, XSS, auth, authz, crypto, SSRF, secrets). Confidence-based reporting. Triggers on 'security review', auth/payment code, or /dw-secure-audit.
|
|
4
4
|
allowed-tools: Read, Grep, Glob, Bash, Task
|
|
5
5
|
license: LICENSE
|
|
6
6
|
---
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# C# / .NET Security Patterns
|
|
2
2
|
|
|
3
|
-
Covers **ASP.NET Core, ASP.NET (Framework), Blazor, Razor Pages, Minimal APIs, Entity Framework Core, ADO.NET, Dapper, Identity, NuGet**. Used by `/dw-
|
|
3
|
+
Covers **ASP.NET Core, ASP.NET (Framework), Blazor, Razor Pages, Minimal APIs, Entity Framework Core, ADO.NET, Dapper, Identity, NuGet**. Used by `/dw-secure-audit` as the primary reference when C# is detected in scope.
|
|
4
4
|
|
|
5
5
|
---
|
|
6
6
|
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# Rust Security Patterns
|
|
2
2
|
|
|
3
|
-
Covers **Actix Web, Axum, Rocket, Warp, Tonic (gRPC), Tower, Tokio, sqlx, Diesel, SeaORM, serde, reqwest, hyper, std::process, std::fs, unsafe blocks, FFI, and cargo supply chain**. Used by `/dw-
|
|
3
|
+
Covers **Actix Web, Axum, Rocket, Warp, Tonic (gRPC), Tower, Tokio, sqlx, Diesel, SeaORM, serde, reqwest, hyper, std::process, std::fs, unsafe blocks, FFI, and cargo supply chain**. Used by `/dw-secure-audit` as the primary reference when Rust is detected in scope.
|
|
4
4
|
|
|
5
5
|
> Rust's ownership and borrow checker eliminate **memory-safety** classes of bugs (use-after-free, data races, buffer overflows) — but **logic bugs, misuse of `unsafe`, DoS via panic, injection into string-APIs, and supply-chain compromise are still present**. Do not assume "Rust = secure".
|
|
6
6
|
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
This file complements `javascript.md` (which already covers React/Vue/Express/Next/Angular/Node XSS, injection, DOM sinks, prototype pollution). Here we focus on **TypeScript-specific** vulnerability classes: type-system abuses, runtime vs compile-time gap, TS-native ORMs, TS-native validators, and framework-specific patterns unique to TS ecosystems.
|
|
4
4
|
|
|
5
|
-
> Used by `/dw-
|
|
5
|
+
> Used by `/dw-secure-audit` as the primary reference when TS is detected in scope.
|
|
6
6
|
|
|
7
7
|
---
|
|
8
8
|
|
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: vercel-react-best-practices
|
|
3
|
-
description:
|
|
3
|
+
description: Use for React/Next.js performance optimization. 67 rules across async, bundle, client, render, JS micro-perf. Triggers on React components, Next.js pages, data fetching, perf review, hydration issues.
|
|
4
|
+
allowed-tools:
|
|
5
|
+
- Read
|
|
4
6
|
license: MIT
|
|
5
7
|
metadata:
|
|
6
8
|
author: vercel
|
|
@@ -23,7 +23,7 @@ git add .dw/templates/overrides/prd-template.md
|
|
|
23
23
|
git commit -m "chore(templates): customize PRD template for our team"
|
|
24
24
|
```
|
|
25
25
|
|
|
26
|
-
The override takes effect immediately. Commands that consume the template (`/dw-
|
|
26
|
+
The override takes effect immediately. Commands that consume the template (`/dw-plan prd`, etc.) will read from `.dw/templates/<name>.md`, which is preserved as your edited copy.
|
|
27
27
|
|
|
28
28
|
## How to revert an override
|
|
29
29
|
|
|
@@ -46,9 +46,9 @@ npx @brunosps00/dev-workflow update
|
|
|
46
46
|
|
|
47
47
|
- Removing critical-path sections like FR numbering or test plans — downstream commands rely on these.
|
|
48
48
|
- Adding fields that conflict with the YAML frontmatter schema.
|
|
49
|
-
- Anything that breaks `/dw-
|
|
49
|
+
- Anything that breaks `/dw-plan techspec` or `/dw-plan tasks` cross-references.
|
|
50
50
|
|
|
51
|
-
If in doubt, run the workflow end-to-end after editing — the consistency check at the end of `/dw-
|
|
51
|
+
If in doubt, run the workflow end-to-end after editing — the consistency check at the end of `/dw-plan tasks` will surface most structural breakages.
|
|
52
52
|
|
|
53
53
|
## Versioning your overrides
|
|
54
54
|
|