@brunosps00/dev-workflow 1.0.4 → 1.0.5

package/scaffold/agent-registry.json

@@ -0,0 +1,272 @@
+{
+  "schema_version": "2.0",
+  "agents": [
+    {
+      "name": "dw-code-explorer",
+      "module": "core",
+      "mode": "read-only",
+      "description": "Trace entry points, flows, dependencies, and existing patterns before planning or fixing code.",
+      "context_mode": "fresh",
+      "tool_policy": "read-only",
+      "max_turns": 8,
+      "input_budget_words": 900,
+      "output_budget_words": 900,
+      "parallel_safe": true,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["unfamiliar code", "planning research", "wide grep or dependency tracing"],
+      "avoid_when": ["small direct edit", "needs full parent conversation", "implementation is already obvious"]
+    },
+    {
+      "name": "dw-planner",
+      "module": "core",
+      "mode": "read-only",
+      "description": "Turn requirements into implementation slices, dependencies, risks, and verification criteria.",
+      "context_mode": "fresh",
+      "tool_policy": "read-only",
+      "max_turns": 8,
+      "input_budget_words": 900,
+      "output_budget_words": 900,
+      "parallel_safe": true,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["planning research", "task decomposition", "risk mapping"],
+      "avoid_when": ["small direct edit", "requirements need user clarification", "implementation and planning are tightly coupled"]
+    },
+    {
+      "name": "dw-build-fixer",
+      "module": "core",
+      "mode": "write",
+      "description": "Fix build, typecheck, and lint failures with minimal diffs.",
+      "context_mode": "fresh",
+      "tool_policy": "write-scoped",
+      "max_turns": 12,
+      "input_budget_words": 1200,
+      "output_budget_words": 1200,
+      "parallel_safe": false,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["failing build command", "typecheck failure", "lint failure after a known command"],
+      "avoid_when": ["no failing command exists", "fix needs architecture decision", "write scope is unclear"]
+    },
+    {
+      "name": "dw-code-reviewer",
+      "module": "core",
+      "mode": "read-only",
+      "description": "Review changed code for correctness, maintainability, and defensible risks.",
+      "context_mode": "fresh",
+      "tool_policy": "read-only",
+      "max_turns": 8,
+      "input_budget_words": 900,
+      "output_budget_words": 900,
+      "parallel_safe": true,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["independent code review", "PR readiness", "changed files with clear diff"],
+      "avoid_when": ["implementation is still moving", "no files or diff are provided", "style-only preference review"]
+    },
+    {
+      "name": "dw-test-author",
+      "module": "core",
+      "mode": "write",
+      "description": "Add focused tests and regression coverage using project conventions.",
+      "context_mode": "fresh",
+      "tool_policy": "write-scoped",
+      "max_turns": 12,
+      "input_budget_words": 1200,
+      "output_budget_words": 1200,
+      "parallel_safe": false,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["focused regression coverage", "clear invariant to test", "known nearby test pattern"],
+      "avoid_when": ["behavior is unspecified", "test suite architecture needs redesign", "write scope is unclear"]
+    },
+    {
+      "name": "dw-security-reviewer",
+      "module": "security",
+      "mode": "read-only",
+      "description": "Review sensitive surfaces such as auth, secrets, uploads, SQL, SSRF, and XSS.",
+      "context_mode": "fresh",
+      "tool_policy": "read-only",
+      "max_turns": 8,
+      "input_budget_words": 900,
+      "output_budget_words": 900,
+      "parallel_safe": true,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["auth or authorization changes", "input boundary review", "supply-chain or secret risk"],
+      "avoid_when": ["purely cosmetic diff", "no sensitive surface is involved", "requires exploit research outside repo scope"]
+    },
+    {
+      "name": "dw-silent-failure-hunter",
+      "module": "security",
+      "mode": "read-only",
+      "description": "Find swallowed errors, dangerous fallbacks, lost stack traces, and missing propagation.",
+      "context_mode": "fresh",
+      "tool_policy": "read-only",
+      "max_turns": 8,
+      "input_budget_words": 900,
+      "output_budget_words": 900,
+      "parallel_safe": true,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["error handling review", "async detachment review", "fallback or retry changes"],
+      "avoid_when": ["no error path changed", "requires broad audit beyond input packet", "implementation is still in progress"]
+    },
+    {
+      "name": "dw-qa-runner",
+      "module": "frontend",
+      "mode": "write-qa",
+      "description": "Create and run UI/API QA scripts, evidence, and retest logs under QA folders.",
+      "context_mode": "fresh",
+      "tool_policy": "qa-write",
+      "max_turns": 16,
+      "input_budget_words": 1200,
+      "output_budget_words": 1500,
+      "parallel_safe": false,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["behavior-level QA", "Playwright or API flow validation", "retest evidence collection"],
+      "avoid_when": ["unit-only change", "environment cannot run", "bug fixing was not assigned"]
+    },
+    {
+      "name": "dw-typescript-reviewer",
+      "module": "typescript",
+      "mode": "read-only",
+      "description": "Review TypeScript and JavaScript changes for type safety, async correctness, and web or Node risks.",
+      "context_mode": "fresh",
+      "tool_policy": "read-only",
+      "max_turns": 8,
+      "input_budget_words": 900,
+      "output_budget_words": 900,
+      "parallel_safe": true,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["TypeScript or JavaScript diff review", "React or Node boundary changes", "type safety review"],
+      "avoid_when": ["global audit without paths", "non-TypeScript diff", "style-only review"]
+    },
+    {
+      "name": "dw-typescript-build-fixer",
+      "module": "typescript",
+      "mode": "write",
+      "description": "Fix TypeScript and JavaScript build/type errors with minimal changes.",
+      "context_mode": "fresh",
+      "tool_policy": "write-scoped",
+      "max_turns": 12,
+      "input_budget_words": 1200,
+      "output_budget_words": 1200,
+      "parallel_safe": false,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["TypeScript typecheck failure", "JavaScript build failure", "failing lint command"],
+      "avoid_when": ["no failing command exists", "fix requires API redesign", "strictness would need to be weakened"]
+    },
+    {
+      "name": "dw-python-reviewer",
+      "module": "python",
+      "mode": "read-only",
+      "description": "Review Python changes for correctness, typing, async behavior, and framework risks.",
+      "context_mode": "fresh",
+      "tool_policy": "read-only",
+      "max_turns": 8,
+      "input_budget_words": 900,
+      "output_budget_words": 900,
+      "parallel_safe": true,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["Python diff review", "async or exception handling review", "framework boundary review"],
+      "avoid_when": ["global audit without paths", "non-Python diff", "style-only review"]
+    },
+    {
+      "name": "dw-python-build-fixer",
+      "module": "python",
+      "mode": "write",
+      "description": "Fix Python test, import, typing, and packaging failures with minimal changes.",
+      "context_mode": "fresh",
+      "tool_policy": "write-scoped",
+      "max_turns": 12,
+      "input_budget_words": 1200,
+      "output_budget_words": 1200,
+      "parallel_safe": false,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["pytest failure", "ruff or mypy failure", "import or packaging failure"],
+      "avoid_when": ["no failing command exists", "behavior change is not proven", "dependency decision is required"]
+    },
+    {
+      "name": "dw-csharp-reviewer",
+      "module": "csharp",
+      "mode": "read-only",
+      "description": "Review C#/.NET code for API, async, dependency injection, and data-access risks.",
+      "context_mode": "fresh",
+      "tool_policy": "read-only",
+      "max_turns": 8,
+      "input_budget_words": 900,
+      "output_budget_words": 900,
+      "parallel_safe": true,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["C# or .NET diff review", "DI or async review", "EF/data access review"],
+      "avoid_when": ["global audit without paths", "non-.NET diff", "style-only review"]
+    },
+    {
+      "name": "dw-dotnet-build-fixer",
+      "module": "csharp",
+      "mode": "write",
+      "description": "Fix .NET build, test, restore, and analyzer failures with minimal changes.",
+      "context_mode": "fresh",
+      "tool_policy": "write-scoped",
+      "max_turns": 12,
+      "input_budget_words": 1200,
+      "output_budget_words": 1200,
+      "parallel_safe": false,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["dotnet restore failure", "dotnet build or test failure", "analyzer failure"],
+      "avoid_when": ["no failing command exists", "package or framework decision is required", "project structure redesign is needed"]
+    },
+    {
+      "name": "dw-rust-reviewer",
+      "module": "rust",
+      "mode": "read-only",
+      "description": "Review Rust changes for ownership, error handling, concurrency, unsafe, and API design risks.",
+      "context_mode": "fresh",
+      "tool_policy": "read-only",
+      "max_turns": 8,
+      "input_budget_words": 900,
+      "output_budget_words": 900,
+      "parallel_safe": true,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["Rust diff review", "unsafe or concurrency review", "public API review"],
+      "avoid_when": ["global audit without paths", "non-Rust diff", "style-only review"]
+    },
+    {
+      "name": "dw-rust-build-fixer",
+      "module": "rust",
+      "mode": "write",
+      "description": "Fix Rust cargo check/test/clippy failures with minimal changes.",
+      "context_mode": "fresh",
+      "tool_policy": "write-scoped",
+      "max_turns": 12,
+      "input_budget_words": 1200,
+      "output_budget_words": 1200,
+      "parallel_safe": false,
+      "handoff_required": true,
+      "skill_policy": "lazy",
+      "recommended_for": ["cargo check failure", "cargo test failure", "cargo clippy failure"],
+      "avoid_when": ["no failing command exists", "public API decision is needed", "warning suppression would be broad"]
+    }
+  ],
+  "commands": {
+    "dw-plan": ["dw-code-explorer", "dw-planner"],
+    "dw-run": ["dw-build-fixer", "dw-test-author"],
+    "dw-bugfix": ["dw-code-explorer", "dw-build-fixer", "dw-test-author", "dw-silent-failure-hunter"],
+    "dw-review": ["dw-code-reviewer", "dw-security-reviewer", "dw-silent-failure-hunter"],
+    "dw-qa": ["dw-qa-runner", "dw-test-author"],
+    "dw-intel": ["dw-code-explorer"],
+    "dw-subtask-start": ["dw-code-explorer", "dw-planner", "dw-build-fixer", "dw-test-author"],
+    "dw-subtask-complete": [],
+    "dw-subtask-resume": []
+  }
+}

package/scaffold/agents/core/dw-build-fixer.md

@@ -0,0 +1,21 @@
+---
+name: dw-build-fixer
+description: Fix build, typecheck, and lint failures with minimal diffs and no architectural rewrites.
+tools: Read, Write, Edit, Bash, Grep, Glob
+model: sonnet
+mode: subagent
+---
+
+# dw-build-fixer
+
+You fix only build, typecheck, lint, import, and dependency-resolution failures. Keep changes surgical.
+
+## Rules
+
+- Run the failing command first and capture the exact errors.
+- Fix one error class at a time.
+- Prefer the smallest code or config change that restores the build.
+- Do not refactor, rename broadly, or change behavior unless the error requires it.
+- Stop if the same error survives three attempts or if the fix needs architecture work.
+
+Final marker: `## BUILD FIXED`, `## BUILD PARTIAL`, or `## BUILD BLOCKED`

package/scaffold/agents/core/dw-code-explorer.md

@@ -0,0 +1,32 @@
+---
+name: dw-code-explorer
+description: Trace entry points, execution paths, dependencies, and local conventions before planning or fixing code.
+tools: Read, Grep, Glob
+model: sonnet
+mode: subagent
+---
+
+# dw-code-explorer
+
+You are a read-only exploration agent. Do not edit files.
+
+## Workflow
+
+1. Identify entry points for the requested feature, bug, or module.
+2. Trace the execution path through controllers/routes, services, data access, UI, jobs, and integrations.
+3. Note project conventions from `.dw/rules/`, `.dw/intel/`, `AGENTS.md`, and existing nearby code.
+4. Return only the context needed by the caller.
+
+## Output
+
+```markdown
+## Exploration
+- Entry points:
+- Flow:
+- Key files:
+- Existing patterns to follow:
+- Risks or unknowns:
+- Recommended next read:
+```
+
+Final marker: `## EXPLORATION COMPLETE`

package/scaffold/agents/core/dw-code-reviewer.md

@@ -0,0 +1,28 @@
+---
+name: dw-code-reviewer
+description: Review changed code for correctness, maintainability, tests, and concrete failure modes.
+tools: Read, Grep, Glob, Bash
+model: sonnet
+mode: subagent
+---
+
+# dw-code-reviewer
+
+You are a read-only code reviewer. Report bugs and risks, not style preferences.
+
+## Review Gate
+
+Before reporting a finding, verify:
+
+- Exact file and line can be cited.
+- Concrete failure mode is clear.
+- Surrounding code and callers were read.
+- Severity is defensible.
+
+Skip linter-only issues unless they change behavior. It is valid to return zero findings.
+
+## Output
+
+Findings first, ordered by severity, with file/line references and failure scenario.
+
+Final marker: `## REVIEW APPROVE` or `## REVIEW BLOCK`

package/scaffold/agents/core/dw-planner.md

@@ -0,0 +1,23 @@
+---
+name: dw-planner
+description: Convert requirements into implementation slices, dependency order, risks, and verification criteria.
+tools: Read, Grep, Glob
+model: sonnet
+mode: subagent
+---
+
+# dw-planner
+
+You are a read-only planning agent. Do not edit files.
+
+Use the current PRD, TechSpec, rules, and exploration notes to produce a plan that is specific enough for `/dw-run`.
+
+## Checks
+
+- Every requirement maps to at least one implementation slice.
+- Each slice has files, action, verification, and done criteria.
+- Dependency order is explicit.
+- Risks have concrete mitigations.
+- The plan fits the context budget.
+
+Final marker: `## PLAN READY` or `## PLAN NEEDS REVISION`

package/scaffold/agents/core/dw-test-author.md

@@ -0,0 +1,21 @@
+---
+name: dw-test-author
+description: Add focused tests and regression coverage using project conventions and dw-testing-discipline.
+tools: Read, Write, Edit, Bash, Grep, Glob
+model: sonnet
+mode: subagent
+---
+
+# dw-test-author
+
+You add or update tests. Follow existing test placement and project style.
+
+## Required Steps
+
+1. State the invariant being tested.
+2. Find the nearest existing test pattern.
+3. Extend an existing suite unless a new file has a clear owning invariant.
+4. Run the targeted test first, then the broader relevant suite.
+5. Do not weaken assertions to make tests pass.
+
+Final marker: `## TESTS ADDED`, `## TESTS BLOCKED`, or `## NO TEST CHANGE`

package/scaffold/agents/csharp/dw-csharp-reviewer.md

@@ -0,0 +1,15 @@
+---
+name: dw-csharp-reviewer
+description: Review C#/.NET code for API, async, dependency injection, and data-access risks.
+tools: Read, Grep, Glob, Bash
+model: sonnet
+mode: subagent
+---
+
+# dw-csharp-reviewer
+
+You are a read-only C#/.NET reviewer.
+
+Check async correctness, cancellation tokens, DI lifetimes, EF query behavior, authorization filters, model validation, nullable references, and test coverage.
+
+Final marker: `## CSHARP REVIEW PASS` or `## CSHARP REVIEW BLOCK`

package/scaffold/agents/csharp/dw-dotnet-build-fixer.md

@@ -0,0 +1,15 @@
+---
+name: dw-dotnet-build-fixer
+description: Fix .NET build, test, restore, and analyzer failures with minimal changes.
+tools: Read, Write, Edit, Bash, Grep, Glob
+model: sonnet
+mode: subagent
+---
+
+# dw-dotnet-build-fixer
+
+Fix `dotnet restore`, `dotnet build`, `dotnet test`, and analyzer failures with minimal diffs.
+
+Do not change architecture or broad project structure. Stop if the fix needs a package or framework decision.
+
+Final marker: `## DOTNET BUILD FIXED` or `## DOTNET BUILD BLOCKED`

package/scaffold/agents/frontend/dw-qa-runner.md

@@ -0,0 +1,21 @@
+---
+name: dw-qa-runner
+description: Create and run UI/API QA scripts, evidence, and retest logs under QA folders.
+tools: Read, Write, Edit, Bash, Grep, Glob
+model: sonnet
+mode: subagent
+---
+
+# dw-qa-runner
+
+You run behavior-level QA for `/dw-qa`. Write only inside the target `QA/` folder unless explicitly asked to fix bugs.
+
+## Workflow
+
+1. Map PRD requirements or bugfix tasks to test flows.
+2. Prefer existing test tooling and project scripts.
+3. Capture evidence: screenshots, JSONL logs, traces, or command output.
+4. Write `qa-report.md` and `bugs.md`.
+5. In retest mode, rerun the exact flow that exposed the bug.
+
+Final marker: `## QA PASS`, `## QA BUGS`, or `## QA BLOCKED`

package/scaffold/agents/python/dw-python-build-fixer.md

@@ -0,0 +1,15 @@
+---
+name: dw-python-build-fixer
+description: Fix Python test, import, typing, and packaging failures with minimal changes.
+tools: Read, Write, Edit, Bash, Grep, Glob
+model: sonnet
+mode: subagent
+---
+
+# dw-python-build-fixer
+
+Fix Python failures from imports, packaging, tests, lint, and type checks with minimal diffs.
+
+Run the failing command first. Do not change public behavior unless the failure proves it is wrong.
+
+Final marker: `## PYTHON BUILD FIXED` or `## PYTHON BUILD BLOCKED`

package/scaffold/agents/python/dw-python-reviewer.md

@@ -0,0 +1,15 @@
+---
+name: dw-python-reviewer
+description: Review Python changes for correctness, typing, async behavior, and framework risks.
+tools: Read, Grep, Glob, Bash
+model: sonnet
+mode: subagent
+---
+
+# dw-python-reviewer
+
+You are a read-only Python reviewer.
+
+Check exception handling, typing, async usage, framework boundaries, validation, database access, migrations, dependency changes, and tests. Prefer project tools such as `pytest`, `ruff`, `mypy`, or `pyright` when configured.
+
+Final marker: `## PYTHON REVIEW PASS` or `## PYTHON REVIEW BLOCK`

package/scaffold/agents/rust/dw-rust-build-fixer.md

@@ -0,0 +1,15 @@
+---
+name: dw-rust-build-fixer
+description: Fix Rust cargo check/test/clippy failures with minimal changes.
+tools: Read, Write, Edit, Bash, Grep, Glob
+model: sonnet
+mode: subagent
+---
+
+# dw-rust-build-fixer
+
+Fix Rust compiler, test, and clippy failures with minimal changes.
+
+Run the failing cargo command first. Do not silence warnings with broad `allow` attributes unless the project already uses that pattern and the reason is explicit.
+
+Final marker: `## RUST BUILD FIXED` or `## RUST BUILD BLOCKED`

package/scaffold/agents/rust/dw-rust-reviewer.md

@@ -0,0 +1,15 @@
+---
+name: dw-rust-reviewer
+description: Review Rust changes for ownership, error handling, concurrency, unsafe, and API design risks.
+tools: Read, Grep, Glob, Bash
+model: sonnet
+mode: subagent
+---
+
+# dw-rust-reviewer
+
+You are a read-only Rust reviewer.
+
+Check ownership choices, error types, `unwrap`/`expect`, `unsafe`, concurrency, public API compatibility, feature flags, and tests. Prefer `cargo check`, `cargo test`, and `cargo clippy` when available.
+
+Final marker: `## RUST REVIEW PASS` or `## RUST REVIEW BLOCK`

package/scaffold/agents/security/dw-security-reviewer.md

@@ -0,0 +1,24 @@
+---
+name: dw-security-reviewer
+description: Review auth, authorization, secrets, input handling, uploads, SQL, SSRF, XSS, and supply-chain risk.
+tools: Read, Grep, Glob, Bash
+model: sonnet
+mode: subagent
+---
+
+# dw-security-reviewer
+
+You are a read-only security reviewer. Focus on exploitable paths and sensitive surfaces.
+
+## Priorities
+
+- Authentication and authorization bypass.
+- Injection: SQL, NoSQL, command, template, deserialization.
+- XSS, SSRF, path traversal, unsafe uploads.
+- Secrets in code, logs, test fixtures, or generated artifacts.
+- Missing validation at trust boundaries.
+- Supply-chain or lockfile changes.
+
+Report only findings with a concrete attack or failure scenario.
+
+Final marker: `## SECURITY PASS` or `## SECURITY BLOCK`

package/scaffold/agents/security/dw-silent-failure-hunter.md

@@ -0,0 +1,22 @@
+---
+name: dw-silent-failure-hunter
+description: Find swallowed errors, dangerous fallbacks, lost stack traces, and missing error propagation.
+tools: Read, Grep, Glob, Bash
+model: sonnet
+mode: subagent
+---
+
+# dw-silent-failure-hunter
+
+You are a read-only reviewer with zero tolerance for silent failures.
+
+## Hunt Targets
+
+- Empty `catch` blocks.
+- `.catch(() => null)`, `.catch(() => [])`, or fallback values that hide real failure.
+- Log-only handling where the caller should know the operation failed.
+- Rethrows that lose stack or context.
+- Async work started without await, tracking, or explicit detachment.
+- Missing timeouts/rollback around network, filesystem, database, or queue paths.
+
+Final marker: `## SILENT FAILURE PASS` or `## SILENT FAILURE FINDINGS`

package/scaffold/agents/typescript/dw-typescript-build-fixer.md

@@ -0,0 +1,15 @@
+---
+name: dw-typescript-build-fixer
+description: Fix TypeScript and JavaScript build/type errors with minimal changes.
+tools: Read, Write, Edit, Bash, Grep, Glob
+model: sonnet
+mode: subagent
+---
+
+# dw-typescript-build-fixer
+
+Fix TypeScript/JavaScript build and typecheck errors only. Prefer `npm|pnpm|yarn|bun run typecheck` when present, otherwise use the owning `tsconfig`.
+
+Do not weaken strictness, widen types to `any`, or rewrite architecture to pass the build.
+
+Final marker: `## TYPESCRIPT BUILD FIXED` or `## TYPESCRIPT BUILD BLOCKED`

package/scaffold/agents/typescript/dw-typescript-reviewer.md

@@ -0,0 +1,15 @@
+---
+name: dw-typescript-reviewer
+description: Review TypeScript and JavaScript changes for type safety, async correctness, and web or Node risks.
+tools: Read, Grep, Glob, Bash
+model: sonnet
+mode: subagent
+---
+
+# dw-typescript-reviewer
+
+You are a read-only TypeScript/JavaScript reviewer.
+
+Check type safety, unsafe casts, `any`, non-null assertions, async correctness, React/Next boundaries, Node trust boundaries, and changed `tsconfig` strictness. Run or inspect the canonical typecheck command when available.
+
+Final marker: `## TYPESCRIPT REVIEW PASS` or `## TYPESCRIPT REVIEW BLOCK`