@brunosps00/dev-workflow 1.1.2 → 1.2.0

package/README.md

@@ -26,7 +26,7 @@ npx @brunosps00/dev-workflow install-deps
 
 ## Commands
 
-dev-workflow v1.1.2 ships **31 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
+dev-workflow v1.1.4 ships **33 commands** organized into four tiers. Most users only invoke Tier 1 + Tier 2.
 
 ### Tier 1 — Gateway (3)
 
@@ -36,13 +36,14 @@ dev-workflow v1.1.2 ships **31 commands** organized into four tiers. Most users
 | **`/dw-bugfix "description"`** | A bug report or pasted error. Triages bug-vs-feature-vs-scope, surgical fix or routes to a PRD. |
 | **`/dw-help [keyword]`** | Discover commands. Pass a keyword for shortcuts; `--advanced` reveals internal commands. |
 
-### Tier 2 — Pipeline granular (9)
+### Tier 2 — Pipeline granular (10)
 
 Use these when you want step-by-step control instead of `/dw-autopilot`.
 
 | Command | What |
 |---------|------|
-| **`/dw-brainstorm "idea"`** | Refine an idea before PRD. Flags: `--onepager` (durable artifact), `--council` (multi-advisor debate), `--research` (multi-source cited research), `--refactor` (Fowler code-smell catalog). |
+| **`/dw-opportunities [focus]`** | Scan the installed project, especially `/dw-analyze-project` outputs (`.dw/rules/`, `.dw/intel/`, concerns, constitution, `DESIGN.md`), for product, UX, automation, refactor, and security opportunities. `--research` adds cited external context when needed. |
+| **`/dw-brainstorm "idea"`** | Refine a concrete idea before PRD. Flags: `--onepager` (durable artifact), `--council` (multi-advisor debate), `--research` (multi-source cited research). |
 | **`/dw-plan "feature"`** | PRD → TechSpec → Tasks sequentially with checkpoints. Stages: `prd`, `techspec`, `tasks`. Mandatory clarification questions, source-grounding, constitution gate, final consistency check. |
 | **`/dw-run [task-id]`** | Execute tasks. Default: all pending in dependency order with wave-based parallel dispatch. Single-task: pass an ID. `--resume` continues an interrupted plan. |
 | **`/dw-review`** | Level 2 (PRD coverage mapping) + Level 3 (code quality). Hard gates on dw-verify PASS, secure-audit, constitution violations. Flags: `--coverage-only`, `--code-only`, `--bugfix <slug>` (review a bugfix at `.dw/bugfixes/<slug>/`). |
@@ -52,12 +53,13 @@ Use these when you want step-by-step control instead of `/dw-autopilot`.
 | **`/dw-commit`** | Atomic Conventional Commits for pending changes. Applies `dw-git-discipline` (one intent per commit, lint+tests+build green before). |
 | **`/dw-generate-pr [target]`** | Push the branch, draft a PR body with summary + test plan, open the browser. Hard gates: dw-verify PASS + secure-audit. |
 
-### Tier 3 — Specialty (10)
+### Tier 3 — Specialty (11)
 
 | Command | What |
 |---------|------|
 | **`/dw-analyze-project`** | Scans the repo, writes `.dw/rules/` (per-module conventions, anti-patterns, naming). Step 8 offers `.dw/constitution.md`; Step 9 writes `.dw/rules/concerns.md`; Step 10 can synthesize a frontend `DESIGN.md` from existing tokens. Run once per project; refresh after major refactors. |
 | **`/dw-redesign-ui "target"`** | Audits a frontend page, runs the `dw-ui-discipline` 4-question grounding, proposes 2-3 design directions, ships the redesign. WCAG 2.2 AA accessibility floor is non-negotiable; UI diffs can also run the deterministic impeccable slop detector. |
+| **`/dw-refactor "target"`** | Audits a target for refactor opportunities using Fowler smells, `dw-simplification`, deep-modules analysis, and behavior-preserving test gates. This is the explicit route for code-health and tech-debt work. |
 | **`/dw-functional-doc`** | Maps screens + user flows into a functional doc, validated end-to-end with Playwright. Uses the WSL-resilient browser resolver and can capture guided functional video evidence. |
 | **`/dw-context-budget`** | Audits context overhead from commands, skills, agents, instruction files, and MCPs. |
 | **`/dw-harness-audit`** | Deterministic health scorecard for the dev-workflow install, agents, wrappers, MCPs, and gates. |
@@ -90,7 +92,7 @@ These are auto-invoked by Tier 1-3 commands. Available standalone via `/dw-help
 /dw-autopilot          ------>  Second invocation: /dw-goal → Security Gate → Commit → PR
     --- OR step-by-step ---
 
-/dw-brainstorm  -->  /dw-plan           -->  .dw/spec/prd-{name}/{prd,techspec,tasks}.md
+/dw-opportunities --> /dw-brainstorm --> /dw-plan --> .dw/spec/prd-{name}/{prd,techspec,tasks}.md
                           |
                     /dw-goal             -->  /dw-run → /dw-review → /dw-qa → /dw-review → /dw-secure-audit
                           |
@@ -101,7 +103,9 @@ Manual alternative after /dw-plan:
 
 Shortcuts:
   /dw-intel "question"         Query codebase intelligence
+  /dw-opportunities [focus]    Suggest next product, UX, automation, refactor, and security opportunities
   /dw-redesign-ui "target"     Visual redesign of a page or component
+  /dw-refactor "target"        Refactor opportunity audit for a module or code area
 ```
 
 ## Constitution
@@ -261,12 +265,12 @@ These are not slash commands — they are primitives other commands call to enfo
 |-------|-------------|------------|-------------|
 | **dw-verify** | Enforces fresh verification evidence before any completion, commit, or PR claim — with Iron Law, gate function, and Verification Report template | `/dw-run`, `/dw-goal`, `/dw-qa --fix`, `/dw-bugfix`, `/dw-review`, `/dw-generate-pr` | [Compozy](https://github.com/compozy/compozy) `cy-final-verify` |
 | **dw-memory** | Two-tier workflow memory (shared `MEMORY.md` + per-task `<N>_memory.md`) with promotion test and compaction rules, so cross-task context persists cleanly | `/dw-run`, `/dw-goal`, `/dw-autopilot`, `/dw-pause`, `/dw-resume` | [Compozy](https://github.com/compozy/compozy) `cy-workflow-memory` |
-| **dw-review-rigor** | Review discipline: de-duplication, severity ordering, verify-intent-before-flagging, skip-linter-issues, signal-over-volume | `/dw-review`, `/dw-brainstorm --refactor` | [Compozy](https://github.com/compozy/compozy) `cy-review-round` |
+| **dw-review-rigor** | Review discipline: de-duplication, severity ordering, verify-intent-before-flagging, skip-linter-issues, signal-over-volume | `/dw-review`, `/dw-refactor`, `/dw-brainstorm --mode=refactor-audit` | [Compozy](https://github.com/compozy/compozy) `cy-review-round` |
 | **dw-council** | Multi-advisor debate (3-5 archetypes) with steel-manning, concession tracking, and dissent-preserving synthesis. Opt-in only. | `/dw-brainstorm --council`, `/dw-plan techspec --council` | [Compozy](https://github.com/compozy/compozy) `cy-idea-factory` |
 | **dw-codebase-intel** | Codebase intelligence (`stack.json`, `files.json`, `apis.json`, `deps.json`, `arch.md`) with incremental updates and query patterns. Cross-cutting reference: `api-design-discipline` (Hyrum's Law, contract-first, error semantics) used when techspecs design API endpoints. | `/dw-intel`, `/dw-intel --build`, `/dw-plan techspec` | [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) (MIT) + [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
 | **dw-execute-phase** | Goal-backward 6-dimension plan verification (`plan-checker`) and wave-based parallel task execution (`executor`) with atomic commit, deviation handling, and checkpoint recovery | `/dw-run`, `/dw-goal`, `/dw-autopilot` | [`get-shit-done-cc`](https://github.com/gsd-build/get-shit-done) (MIT) |
-| **dw-source-grounding** | Detect → Fetch → Implement → Cite protocol with `[source: <url>, version: X.Y, retrieved: YYYY-MM-DD]` citations. Strict source-priority hierarchy (Tier 1 official docs > Tier 2 maintainer blogs > Tier 3 Stack Overflow as discovery only). | `/dw-plan techspec`, `/dw-secure-audit --plan`, `/dw-brainstorm --research` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
-| **dw-simplification** | Chesterton's Fence (understand WHY before changing), behavior-preserving refactor protocol (test gate before/after), complexity metrics (cyclomatic, cognitive, depth, fan-out), Rule of 500 for large refactors | `/dw-review`, `/dw-brainstorm --refactor` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
+| **dw-source-grounding** | Detect → Fetch → Implement → Cite protocol with `[source: <url>, version: X.Y, retrieved: YYYY-MM-DD]` citations. Strict source-priority hierarchy (Tier 1 official docs > Tier 2 maintainer blogs > Tier 3 Stack Overflow as discovery only). | `/dw-plan techspec`, `/dw-secure-audit --plan`, `/dw-opportunities --research`, `/dw-brainstorm --research` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
+| **dw-simplification** | Chesterton's Fence (understand WHY before changing), behavior-preserving refactor protocol (test gate before/after), complexity metrics (cyclomatic, cognitive, depth, fan-out), Rule of 500 for large refactors | `/dw-review`, `/dw-refactor`, `/dw-brainstorm --mode=refactor-audit` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
 | **dw-debug-protocol** | Stop-the-line discipline plus six-step triage (Reproduce → Localize → Reduce → Fix Root Cause → Guard → Verify End-to-End). Error categorization matrix; instrument-first non-reproducible-bug strategy. | `/dw-bugfix`, `/dw-qa --fix` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
 | **dw-git-discipline** | Trunk-based pattern (1-3 day branches, daily rebase, feature flags), atomic commit discipline (one intent per commit; refactor separate from feature), Conventional Commits, branch hygiene | `dw-commit`, `dw-generate-pr` | [`addyosmani/agent-skills`](https://github.com/addyosmani/agent-skills) (MIT) |
 
@@ -310,7 +314,7 @@ npx @brunosps00/dev-workflow list-installed                # Show managed instal
 npx @brunosps00/dev-workflow doctor                        # Check wrappers, agents, skills, MCPs, gates
 npx @brunosps00/dev-workflow repair                        # Reconcile managed files from recorded install state
 npx @brunosps00/dev-workflow install-deps                  # Install Playwright, react-doctor; check security scanners + Docker
-npx @brunosps00/dev-workflow setup-wsl-browser             # WSL NAT: install prebuilt CDP relay + add Hyper-V firewall rule
+npx @brunosps00/dev-workflow setup-wsl-browser             # WSL NAT: install optional user-level CDP fallback relay (no admin)
 npx @brunosps00/dev-workflow install-azure-skills          # Opt-in: Azure skills + Microsoft Learn MCP
 npx @brunosps00/dev-workflow install-azure-skills --products=azure-aks,azure-openai  # Subset override
 npx @brunosps00/dev-workflow install-aws-skills            # Opt-in: AWS skills + AWS MCP Server (needs uv + aws cli + creds)
@@ -324,10 +328,11 @@ npx @brunosps00/dev-workflow help                          # Show help
 After running `npx @brunosps00/dev-workflow init`:
 
 1. **Run `/dw-analyze-project`** in your AI assistant to generate project rules
-2. **Run `/dw-brainstorm`** to start planning a new feature
-3. **Run `/dw-help`** to see all available commands and workflows
-4. **(Optional) Run `npx @brunosps00/dev-workflow install-deps`** to install Playwright + react-doctor and check Trivy/Semgrep/gitleaks/syft + Docker
-5. **Run `/dw-intel --build`** once your project has source files to build the queryable index in `.dw/intel/`
+2. **Run `/dw-opportunities`** when you want the project to suggest what to improve next
+3. **Run `/dw-brainstorm`** when you already have an idea and want to refine it
+4. **Run `/dw-help`** to see all available commands and workflows
+5. **(Optional) Run `npx @brunosps00/dev-workflow install-deps`** to install Playwright + react-doctor and check Trivy/Semgrep/gitleaks/syft + Docker
+6. **Run `/dw-intel --build`** once your project has source files to build the queryable index in `.dw/intel/`
 
 ## Acknowledgements
 
@@ -351,6 +356,8 @@ Session continuity and adaptive routing patterns adapted from [`tech-leads-club/
 
 Four patterns from [`mattpocock/skills`](https://github.com/mattpocock/skills) by Matt Pocock (MIT) were integrated **without adding new commands or skills** — instead they fold into the existing surface as internal modes and inline guidance: (1) **grill-with-docs** → `/dw-brainstorm` `grill` mode (interview discipline that stress-tests plan vocabulary against `.dw/rules/`); (2) **prototype** → `/dw-brainstorm` `prototype` mode (LOGIC terminal app or UI variant dispatch); (3) **improve-codebase-architecture** → `dw-simplification/references/deep-modules.md` (deletion test, locality, leverage, seam, adapter diagnostic invoked by the `refactor-audit` mode); (4) **zoom-out** → one-paragraph guidance in `agent-instructions.md`. The same release also collapses `/dw-brainstorm`'s six legacy flags into a single full-flow entry point that auto-dispatches modes based on project signals.
 
+Opportunity discovery and the explicit `/dw-refactor` surface were inspired by patterns observed in [`pedronauck/skills`](https://github.com/pedronauck/skills), especially `game-changing-features` (10x opportunity framing) and `refactoring-analysis` (Fowler-smell prioritization). dev-workflow does not install or depend on that repository at runtime, and the command text here is a clean-room adaptation of the workflow shape rather than copied skill content.
+
 ## Migration from v0.x (1.0.0 is a consolidation release)
 
 v1.0.0 consolidated the legacy command surface into the current `dw-*` pipeline. **The `dev-workflow init`, `update`, and `repair` flows auto-remove obsolete wrappers and known removed command sources**; no manual action required.
@@ -372,7 +379,7 @@ v1.0.0 consolidated the legacy command surface into the current `dw-*` pipeline.
 | `/dw-deps-audit` | `/dw-secure-audit --plan` |
 | `/dw-map-codebase` | `/dw-intel --build` |
 | `/dw-deep-research` | `/dw-brainstorm --research` |
-| `/dw-refactoring-analysis` | `/dw-brainstorm --refactor` |
+| `/dw-refactoring-analysis` | `/dw-refactor` |
 
 ### Removed (1)
 
@@ -394,7 +401,7 @@ On the next `npx @brunosps00/dev-workflow update`, the following happens automat
 
 ### Backwards compatibility
 
-**There is none** — v1.0.0 is a clean cut per design. There are no aliases. Calling `/dw-create-prd` will not work; use `/dw-plan prd`. Update your team's runbooks and AI-agent instructions (CLAUDE.md / AGENTS.md) accordingly; the auto-trigger map in `agent-instructions.md` is already updated.
+**There is none for the v0.x removed command names** — v1.0.0 was a clean cut per design. Calling `/dw-create-prd` will not work; use `/dw-plan prd`. `/dw-refactor` is a new explicit command surface for the current refactor-audit protocol; it does not restore the old `/dw-refactoring-analysis` name. Update your team's runbooks and AI-agent instructions (CLAUDE.md / AGENTS.md) accordingly; the auto-trigger map in `agent-instructions.md` is already updated.
 
 ### CLAUDE.md / AGENTS.md updates
 

package/bin/dev-workflow.js

@@ -47,7 +47,7 @@ const HELP_TEXT = `
     repair                 Reconcile managed files using the recorded install state
     subtask                Create, complete, consume, and list local subagent handoffs
     install-deps           Install system dependencies (Playwright browsers, MCP servers)
-    setup-wsl-browser      (WSL) Install the prebuilt CDP relay + add the Hyper-V firewall rule so flows can drive the real Windows browser
+    setup-wsl-browser      (WSL) Install the optional user-level CDP fallback relay for the real Windows browser without admin
     install-azure-skills   Opt-in: clone curated Azure skills from MicrosoftDocs/Agent-Skills
                            into .agents/skills/azure/ and register the Microsoft Learn MCP
                            server (HTTP, no-auth). Interactive category selection.

package/lib/constants.js

@@ -3,7 +3,7 @@ const COMMANDS = {
     { name: 'dw-adr', description: 'Records an architectural decision and the trade-offs accepted, before they get lost.' },
     { name: 'dw-analyze-project', description: 'Scans the repo to learn its stack and conventions, then writes the rules other commands rely on.' },
     { name: 'dw-autopilot', description: 'Trigger when user asks to implement, build, create, or add a feature non-trivially. First invocation plans and stops; second invocation resumes via dw-goal, then commit and PR.' },
-    { name: 'dw-brainstorm', description: 'Refine an idea against the product\'s existing features. Modes: default ideation, --research (multi-source cited research), --refactor (Fowler code-smell catalog), --onepager, --council.' },
+    { name: 'dw-brainstorm', description: 'Refine a concrete idea against the product\'s existing features. Modes: ideation, --research, --onepager, --council. Use dw-opportunities before you have an idea and dw-refactor for code-health audits.' },
     { name: 'dw-bugfix', description: 'Trigger when user reports a bug, pastes an error, or describes broken behavior. Triages with three questions, then fixes or routes to PRD.' },
     { name: 'dw-commit', description: 'Trigger when implementation is complete and pending changes need to be committed. Atomic commits with Conventional Commits messages.' },
     { name: 'dw-dockerize', description: 'Reads a project, detects the stack and runtime deps, then proposes Dockerfile and docker-compose for dev and prod with explicit trade-offs.' },
@@ -18,10 +18,12 @@ const COMMANDS = {
     { name: 'dw-install-azure-skills', description: 'Trigger when user asks to install Azure expertise, setup Microsoft docs MCP, or add Azure agent skills. Opt-in: clones curated skills from MicrosoftDocs/Agent-Skills into .agents/skills/azure/ and registers the Microsoft Learn MCP server.' },
     { name: 'dw-intel', description: 'Codebase intelligence: query mode (default) answers questions citing .dw/intel/ + .dw/rules/; --build mode (re)builds the index.' },
     { name: 'dw-new-project', description: 'Interviews you about stack and infra, then scaffolds a working monorepo with docker-compose for dev, .env, scripts, CI, and seeded rules.' },
+    { name: 'dw-opportunities', description: 'Scans the installed project for product, UX, automation, refactor, and security opportunities, then routes each idea to the right next dw-* command.' },
     { name: 'dw-pause', description: 'Trigger when user says "pause work", "end session", or "save where we are". Consolidates open loops, decisions, blockers, and todos into .dw/STATE.md so the next session can resume.' },
     { name: 'dw-plan', description: 'Trigger when user has a feature idea and needs spec + architecture + tasks. Runs PRD → TechSpec → Tasks sequentially. Stages: prd / techspec / tasks; --from techspec; --council.' },
     { name: 'dw-qa', description: 'Trigger when user wants to validate behavior beyond unit tests. Mode-aware (UI / API / --ai / --uat). --fix enters the iterative QA + fix-retest loop. --bugfix <slug> targets a .dw/bugfixes/ entry.' },
     { name: 'dw-redesign-ui', description: 'Audits a frontend page, proposes design directions you choose from, then ships the redesign.' },
+    { name: 'dw-refactor', description: 'Audits a target for refactor opportunities using the refactor-audit protocol, Fowler smells, deep-modules analysis, and behavior-preserving test gates.' },
     { name: 'dw-resume', description: 'Trigger when user says "resume work", "where did we stop?", or starts a session in a project with an existing .dw/STATE.md. Reads STATE.md, presents a TLDR, and suggests the next dw-* command.' },
     { name: 'dw-review', description: 'Trigger when user asks to review code, check quality, or verify PR readiness. Default runs L2 (PRD coverage) + L3 (code quality). Flags --coverage-only / --code-only / --bugfix <slug>.' },
     { name: 'dw-run', description: 'Trigger when user wants to execute tasks. Default runs all pending in dependency order; \'run <task-id>\' runs one; \'run --resume\' continues an interrupted plan.' },
@@ -36,7 +38,7 @@ const COMMANDS = {
     { name: 'dw-adr', description: 'Registra uma decisao arquitetural e os trade-offs aceitos, antes que se percam.' },
     { name: 'dw-analyze-project', description: 'Escaneia o repo para aprender stack e convencoes, e escreve as regras que os outros commands usam.' },
     { name: 'dw-autopilot', description: 'Trigger quando usuario pede pra implementar, criar ou adicionar uma feature nao-trivial. Primeira invocacao planeja e para; segunda retoma via dw-goal, depois commit e PR.' },
-    { name: 'dw-brainstorm', description: 'Refina uma ideia contra features existentes do produto. Modos: ideacao default, --research (research multi-fonte citada), --refactor (catalogo de code smells Fowler), --onepager, --council.' },
+    { name: 'dw-brainstorm', description: 'Refina uma ideia concreta contra features existentes do produto. Modos: ideacao, --research, --onepager, --council. Use dw-opportunities antes de ter uma ideia e dw-refactor para auditoria de code health.' },
     { name: 'dw-bugfix', description: 'Trigger quando usuario reporta bug, cola erro ou descreve comportamento quebrado. Tria com tres perguntas, depois corrige ou roteia pra PRD.' },
     { name: 'dw-commit', description: 'Trigger quando implementacao esta completa e ha mudancas pendentes pra commit. Commits atomicos com mensagens Conventional Commits.' },
     { name: 'dw-dockerize', description: 'Le um projeto, detecta stack e deps de runtime, e propoe Dockerfile e docker-compose para dev e prod com trade-offs explicitos.' },
@@ -51,10 +53,12 @@ const COMMANDS = {
     { name: 'dw-install-azure-skills', description: 'Trigger quando usuario pede pra instalar expertise Azure, configurar MCP do Microsoft docs, ou adicionar agent skills Azure. Opt-in: clona skills curadas de MicrosoftDocs/Agent-Skills para .agents/skills/azure/ e registra o Microsoft Learn MCP server.' },
     { name: 'dw-intel', description: 'Inteligencia do codebase: modo query (default) responde citando .dw/intel/ + .dw/rules/; modo --build (re)constroi indice.' },
     { name: 'dw-new-project', description: 'Entrevista voce sobre stack e infra, depois faz scaffold de um monorepo com docker-compose para dev, .env, scripts, CI e rules seed.' },
+    { name: 'dw-opportunities', description: 'Escaneia o projeto instalado por oportunidades de produto, UX, automacao, refactor e seguranca, e roteia cada ideia para o proximo comando dw-* correto.' },
     { name: 'dw-pause', description: 'Trigger quando usuario diz "pausa o trabalho", "encerra a sessao" ou "salva onde paramos". Consolida pontas soltas, decisoes, bloqueios e todos em .dw/STATE.md para a proxima sessao retomar.' },
     { name: 'dw-plan', description: 'Trigger quando usuario tem ideia de feature e precisa spec + arquitetura + tasks. Roda PRD → TechSpec → Tasks sequencial. Stages: prd / techspec / tasks; --from techspec; --council.' },
     { name: 'dw-qa', description: 'Trigger quando usuario quer validar comportamento alem de unit tests. Mode-aware (UI / API / --ai / --uat). --fix entra no loop iterativo QA + fix-retest. --bugfix <slug> aponta para uma entrada em .dw/bugfixes/.' },
     { name: 'dw-redesign-ui', description: 'Audita uma pagina frontend, propoe direcoes de design que voce escolhe, e entrega o redesign.' },
+    { name: 'dw-refactor', description: 'Audita um target por oportunidades de refactor usando o protocolo refactor-audit, smells Fowler, deep-modules e gates de teste preservando comportamento.' },
     { name: 'dw-resume', description: 'Trigger quando usuario diz "retoma", "onde paramos?" ou comeca sessao num projeto com .dw/STATE.md existente. Le STATE.md, apresenta TLDR e sugere proximo comando dw-*.' },
     { name: 'dw-review', description: 'Trigger quando usuario pede pra revisar codigo, checar qualidade ou validar prontidao pra PR. Default roda L2 (cobertura PRD) + L3 (qualidade). Flags --coverage-only / --code-only / --bugfix <slug>.' },
     { name: 'dw-run', description: 'Trigger quando usuario quer executar tasks. Default roda todas pendentes em ordem de dependencia; \'run <task-id>\' roda uma; \'run --resume\' continua plan interrompido.' },

package/lib/doctor.js

@@ -9,7 +9,7 @@ const {
   AGENT_TARGETS,
 } = require('./agents');
 const { readInstallState, STATE_RELATIVE_PATH } = require('./install-state');
-const { validateSkillRegistry, readSkillRegistry } = require('./skill-registry');
+const { validateSkillRegistry, readSkillRegistry, validateSkillStructuredReturn } = require('./skill-registry');
 const removedCommands = require('./removed-commands');
 
 function run() {
@@ -178,6 +178,8 @@ function checkSkillRegistry(projectRoot, issues, warnings) {
     const skillPath = path.join(projectRoot, '.agents', 'skills', entry.name, 'SKILL.md');
     if (!fs.existsSync(skillPath)) {
       issues.push(`Missing bundled skill: ${path.relative(projectRoot, skillPath)}`);
+    } else {
+      validateSkillStructuredReturn(entry.name, skillPath, issues, `Installed bundled skill ${entry.name}`);
     }
   }
 }

package/lib/install-deps.js

@@ -167,14 +167,14 @@ function printBrowserGuidance() {
   const mirrored = require('fs').existsSync('/sys/class/net/loopback0');
   console.log('  Browser automation on WSL (dw-qa / dw-functional-doc / dw-redesign-ui):');
   console.log('    Default: full headless Chromium (desktop-faithful, no WSLg) — works out of the box.');
-  console.log('    To drive the real Windows browser, set BROWSER_TEST to its exe path, e.g.');
+  console.log('    Optional CDP fallback: set BROWSER_TEST to a Windows browser exe path, e.g.');
   console.log('    BROWSER_TEST="/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe".');
   if (mirrored) {
     console.log('    Mirrored networking detected — connects to the Windows browser on 127.0.0.1 directly.');
   } else {
     console.log('    NAT networking — run `npx @brunosps00/dev-workflow setup-wsl-browser` once to install the');
-    console.log('    bundled cdp-relay.exe and add the Hyper-V firewall rule. Otherwise flows');
-    console.log('    fall back to the local headless Chromium (faithful video, no Windows browser).');
+    console.log('    bundled user-level cdp-relay.exe. No admin prompt or firewall rule is required. Playwright');
+    console.log('    Chromium remains the primary browser; CDP is only used if that launch fails.');
   }
   console.log('    Details: .dw/skills/dw-testing-discipline/references/playwright-recipes.md ("Browser on WSL").');
   console.log();

package/lib/setup-wsl-browser.js

@@ -2,17 +2,13 @@ const { execSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 
-// Installs the prebuilt CDP relay (cdp-relay.exe) on Windows and adds the one-time
-// Hyper-V firewall rule so WSL (NAT networking) can drive the real Windows browser over CDP.
-// Idempotent.
+// Installs the prebuilt CDP relay (cdp-relay.exe) in the Windows user profile. Idempotent.
 //
-// Why: Chromium binds its debug port to Windows loopback only, and the WSL Hyper-V firewall
-// defaults inbound to Block. A fixed-port relay + one Hyper-V allow rule bridges WSL -> browser.
+// Why: Chromium binds its debug port to Windows loopback only. On WSL NAT, dev-workflow uses
+// a reverse relay where the Windows-side .exe connects outbound to a WSL broker, so no admin
+// prompt, firewall rule, Rust, Node, or Python runtime is required on the Windows target.
 // The relay is a tiny prebuilt .exe — no Rust/Node/Python runtime dependency on the Windows target.
 
-const RELAY_PORT = 39222;
-const WSL_VM_CREATOR_ID = '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}'; // standard WSL VM creator id
-const RULE_NAME = 'dw-cdp-relay';
 const RELAY_EXE_SRC = path.join(__dirname, '..', 'scaffold', 'scripts', 'cdp-relay', 'bin', 'cdp-relay.exe');
 
 function isWsl() {
@@ -50,7 +46,7 @@ function run() {
   const destWin = `${localAppData}\\dev-workflow`;
   const destWsl = execSync(`wslpath -u "${destWin}"`, { stdio: 'pipe' }).toString().trim();
 
-  // 1) Install the prebuilt Windows relay bundled in the npm package.
+  // Install the prebuilt Windows relay bundled in the npm package.
   if (!fs.existsSync(RELAY_EXE_SRC)) {
     console.log(`  \x1b[31m✗\x1b[0m Prebuilt relay not found at ${RELAY_EXE_SRC}`);
     console.log('    The dev-workflow package is incomplete. Reinstall or update @brunosps00/dev-workflow.');
@@ -69,48 +65,12 @@ function run() {
     return;
   }
 
-  // 2) Add the Hyper-V firewall inbound rule (one-time, elevated -> UAC prompt).
-  console.log(`\n  Adding Hyper-V firewall rule for TCP ${RELAY_PORT} (a UAC prompt will appear — accept it)...`);
-  const inner = [
-    `Remove-NetFirewallHyperVRule -Name '${RULE_NAME}' -ErrorAction SilentlyContinue;`,
-    `New-NetFirewallHyperVRule -Name '${RULE_NAME}' -DisplayName 'dev-workflow cdp-relay'`,
-    `-Direction Inbound -Action Allow -VMCreatorId '${WSL_VM_CREATOR_ID}' -Protocol TCP -LocalPorts ${RELAY_PORT}`,
-  ].join(' ');
-  try {
-    execSync(
-      `powershell.exe -NoProfile -Command "Start-Process powershell -Verb RunAs -WindowStyle Hidden -ArgumentList '-NoProfile','-Command',\\"${inner}\\""`,
-      { stdio: 'pipe', timeout: 60000 },
-    );
-  } catch {
-    // Start-Process returns before the elevated process finishes; verify below regardless.
-  }
-
-  // 3) Verify.
-  let ok = false;
-  for (let i = 0; i < 10 && !ok; i += 1) {
-    try {
-      const out = execSync(
-        `powershell.exe -NoProfile -c "Get-NetFirewallHyperVRule -Name '${RULE_NAME}' -ErrorAction SilentlyContinue | Select-Object -Expand Action"`,
-        { stdio: 'pipe', timeout: 15000 },
-      ).toString();
-      ok = /Allow/i.test(out);
-    } catch {
-      ok = false;
-    }
-    if (!ok) execSync('sleep 1');
-  }
-
   console.log(`  ${'='.repeat(40)}`);
-  if (ok) {
-    console.log('  \x1b[32m✓ Done.\x1b[0m The Windows browser is reachable from WSL over CDP.');
-    console.log(`    Set BROWSER_TEST to a Windows browser exe to use it, e.g.`);
-    console.log('    BROWSER_TEST="/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"');
-  } else {
-    console.log('  \x1b[33m⚠ Hyper-V firewall rule not confirmed.\x1b[0m UAC may have been declined, or this Windows lacks');
-    console.log('    Hyper-V firewall cmdlets. Flows will fall back to the local headless Chromium (faithful video, no');
-    console.log('    Windows browser). You can also enable mirrored networking instead. Re-run to retry.');
-  }
+  console.log('  \x1b[32m✓ Done.\x1b[0m The optional CDP fallback relay is installed in the Windows user profile.');
+  console.log('    No admin prompt, firewall rule, or Windows Rust toolchain is required.');
+  console.log(`    Set BROWSER_TEST to a Windows browser exe to make it available as fallback, e.g.`);
+  console.log('    BROWSER_TEST="/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"');
   console.log();
 }
 
-module.exports = { run, RELAY_PORT };
+module.exports = { run };

package/lib/skill-registry.js

@@ -8,6 +8,16 @@ const SKILLS_DIR = path.join(SCAFFOLD_DIR, 'skills');
 
 const VALID_KINDS = new Set(['protocol', 'domain-pack', 'recipe-pack', 'asset-pack']);
 const VALID_LOAD_POLICIES = new Set(['always-small', 'lazy-references', 'opt-in-runtime']);
+const REQUIRED_STRUCTURED_RETURN_FIELDS = [
+  '**Status:**',
+  '**Scope:**',
+  '**Evidence:**',
+  '**Artifacts:**',
+  '**Decisions:**',
+  '**Risks:**',
+  '**Next Step:**',
+];
+const REQUIRED_STRUCTURED_RETURN_STATUSES = ['`PASS`', '`FINDINGS`', '`BLOCKED`', '`NOT_APPLICABLE`'];
 
 function readSkillRegistry() {
   const registry = readJson(REGISTRY_PATH, null);
@@ -56,6 +66,8 @@ function validateSkillRegistry() {
       warnings.push(`Skill ${entry.name} SKILL.md is ${size} bytes; registry limit is ${entry.context_limit}`);
     }
 
+    validateSkillStructuredReturn(entry.name, skillPath, issues, `Scaffold skill ${entry.name}`);
+
     if (entry.load_policy === 'always-small' && size > 8000) {
       warnings.push(`Skill ${entry.name} is marked always-small but SKILL.md is ${size} bytes`);
     }
@@ -90,6 +102,34 @@ function validateEntry(entry, issues) {
   }
 }
 
+function validateSkillStructuredReturn(skillName, skillPath, issues, label = `Skill ${skillName}`) {
+  let content;
+  try {
+    content = fs.readFileSync(skillPath, 'utf-8');
+  } catch {
+    issues.push(`${label} cannot be read: ${path.relative(process.cwd(), skillPath)}`);
+    return;
+  }
+
+  if (!content.includes('## Structured Return')) {
+    issues.push(`${label} missing Structured Return contract: ${path.relative(process.cwd(), skillPath)}`);
+    return;
+  }
+
+  for (const field of REQUIRED_STRUCTURED_RETURN_FIELDS) {
+    if (!content.includes(field)) {
+      issues.push(`${label} Structured Return missing ${field}`);
+    }
+  }
+
+  const statusLine = content.split(/\r?\n/).find((line) => line.includes('**Status:**')) || '';
+  for (const status of REQUIRED_STRUCTURED_RETURN_STATUSES) {
+    if (!statusLine.includes(status)) {
+      issues.push(`${label} Structured Return status vocabulary missing ${status}`);
+    }
+  }
+}
+
 function listInstalledSkillNames(projectRoot) {
   const installedDir = path.join(projectRoot, '.agents', 'skills');
   if (!fs.existsSync(installedDir)) return [];
@@ -104,6 +144,7 @@ module.exports = {
   REGISTRY_PATH,
   readSkillRegistry,
   validateSkillRegistry,
+  validateSkillStructuredReturn,
   listScaffoldSkillNames,
   listInstalledSkillNames,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brunosps00/dev-workflow",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.",
   "bin": {
     "dev-workflow": "./bin/dev-workflow.js"

package/scaffold/en/agent-instructions.md

@@ -14,7 +14,7 @@ Before picking a command from the Trigger Map, gauge the change's actual scope.
 | **Small** | ≤3 files, no migration, no new endpoint, can be summarized in one sentence. Examples: typo, log message, single-line config, dependency bump, version pin. | Just do it inline. No `dw-*` command. |
 | **Medium** | Clear feature or bug, <10 numbered tasks expected, single component or single service, no architectural decisions. Examples: add a form field with validation, fix a regression in a known module, wire a new API endpoint into an existing handler. | `/dw-bugfix` (for bugs) or `/dw-plan` (for features) — straight, not via `/dw-autopilot`. |
 | **Large** | Multi-component feature, ≥10 tasks expected, touches multiple modules, has user-visible UX surface AND backend. Examples: add a new entity end-to-end (model + migration + API + UI), introduce a third-party integration, redesign a flow. | `/dw-autopilot "<wish>"` — first invocation plans and stops; second invocation resumes via `/dw-goal` for Run → Review → QA/Fix → Review, then Commit → PR. |
-| **Complex** | New domain, ambiguous requirements, architectural decision required, regulatory or compliance surface, or scope that spans multiple PRDs. Examples: introduce event sourcing, rebuild auth, multi-tenancy, a new product line. | `/dw-brainstorm "<idea>"` first (auto-dispatches research/council modes), then `/dw-plan --council` so the techspec stage runs the multi-advisor debate. |
+| **Complex** | New domain, ambiguous requirements, architectural decision required, regulatory or compliance surface, or scope that spans multiple PRDs. Examples: introduce event sourcing, rebuild auth, multi-tenancy, a new product line. | `/dw-opportunities` first if the idea is not yet known; otherwise `/dw-brainstorm "<idea>"` (auto-dispatches research/council modes), then `/dw-plan --council` so the techspec stage runs the multi-advisor debate. |
 
 **Safety valve:** if you start in Small or Medium but the work reveals it's actually Large (the inline listing exceeds 5 steps, or `/dw-bugfix` triggers its `Step 5.0` valve), STOP and escalate. There is no flag to bypass. Escalation is the correct outcome.
 
@@ -49,7 +49,10 @@ Before picking a command from the Trigger Map, gauge the change's actual scope.
 | "Just the code quality review" | `/dw-review --code-only` |
 | "Time to commit" / changes are validated and ready | `/dw-commit` |
 | "Open a PR" / "Ship this" | `/dw-generate-pr` |
-| "Brainstorm X" / "Explore ideas" / "Research X" / "Code-health audit" / "Find tech debt" | `/dw-brainstorm "X"` (auto-dispatches grill / prototype / council / research / refactor-audit / onepager based on signals) |
+| "Suggest new ideas" / "What should we build next?" / "Find opportunities" / "Roadmap ideas" | `/dw-opportunities` |
+| "What security improvements should we consider?" / "Find security opportunities" | `/dw-opportunities "security"` |
+| "Brainstorm X" / "Explore this idea" / "Research X" | `/dw-brainstorm "X"` (auto-dispatches grill / prototype / council / research / onepager based on signals) |
+| "Code-health audit" / "Find tech debt" / "Refactor opportunities" / "Smells in X" | `/dw-refactor "X"` |
 | "Where is X?" / "What uses Y?" / "How is Z structured?" | `/dw-intel "<question>"` |
 | "Rebuild the codebase index" / "Refresh intel" | `/dw-intel --build` |
 | "Context is heavy" / "Audit token usage" / "Why is the agent slow?" | `/dw-context-budget` |

package/scaffold/en/commands/dw-analyze-project.md

@@ -26,7 +26,7 @@ You are a project analysis specialist. Your task is to scan the current reposito
 The rules generated by this command are consumed by:
 - `/dw-run` -- reads rules for implementation patterns
 - `/dw-review --code-only` -- reads rules for conformance checks
-- `/dw-brainstorm --refactor` -- reads rules for project context
+- `/dw-refactor` -- reads rules for project context
 - `/dw-plan techspec` -- reads rules for architecture decisions
 
 <critical>This command ONLY generates documentation. Do NOT modify any project source code.</critical>

package/scaffold/en/commands/dw-brainstorm.md

@@ -7,6 +7,7 @@ You are a brainstorming facilitator for the current workspace. This command exis
 ## When to Use
 - Use when exploring ideas before committing to a PRD, comparing architectural directions, or unblocking vague requirements
 - Do NOT use when you already have clear requirements ready for a PRD, or when you need to implement code
+- For standalone code-health or tech-debt audits, prefer `/dw-refactor`; this command only reaches `refactor-audit` when refactor signals appear during broader ideation.
 
 ## Pipeline Position
 **Predecessor:** (user idea) | **Successor:** `/dw-plan prd`
@@ -38,7 +39,7 @@ Power users who already know what they want can pass `--mode=`. Everyone else ge
 
 ### Migration note (transitional)
 
-Old flag invocations (`--onepager`, `--council`, `--research`, `--refactor`, `--grill`, `--prototype`) remain accepted for one minor cycle and map to the equivalent `--mode=` value. New code should use `--mode=` or rely on auto-dispatch.
+Old flag invocations (`--onepager`, `--council`, `--research`, `--refactor`, `--grill`, `--prototype`) remain accepted for one minor cycle and map to the equivalent `--mode=` value. New code should use `/dw-refactor` for standalone refactor audits, `--mode=refactor-audit` only for explicit compatibility, or rely on auto-dispatch.
 
 ## Decision Flowchart: Brainstorm vs Direct PRD
 
@@ -149,6 +150,8 @@ Before producing any output, **read the situation**:
   - `/dw-plan techspec`
   - `/dw-plan tasks`
   - `/dw-bugfix`
+  - `/dw-refactor` (if the useful next move is a dedicated code-health audit)
+  - `/dw-secure-audit` (if the useful next move is security hardening or dependency remediation)
 
 ## Heuristics
 

package/scaffold/en/commands/dw-functional-doc.md

@@ -294,11 +294,11 @@ Use the workspace utilities when appropriate:
 - `node .dw/scripts/functional-doc/generate-dossier.mjs --target <URL> [--lang en|pt-br] [--project <name>] [--base-url <url>]`
 - `node .dw/scripts/functional-doc/run-playwright-flow.mjs --flow-dir <path> [--video-resolution fullhd|1920x1080] [--list-only]`
 
-The runner drives Playwright via the Node API and records video with `page.screencast` (the only
-mechanism that works over CDP). It generates `scripts/<slug>.flow.mjs` — a plain ESM module exporting
+The runner drives Playwright via the Node API and records video with `page.screencast` (works with
+the primary launched Chromium and the CDP fallback). It generates `scripts/<slug>.flow.mjs` — a plain ESM module exporting
 `async function flow({ page, context, expect, baseURL, step, shot })` — not a `@playwright/test` spec,
 so it needs no project `playwright.config.*`. The browser is chosen by `.dw/scripts/lib/resolve-browser.mjs`
-(WSL-resilient: full headless Chromium by default; set `BROWSER_TEST` to a Windows browser exe to drive it over CDP — in NAT run `npx @brunosps00/dev-workflow setup-wsl-browser` once to install the prebuilt cdp-relay.exe + Hyper-V rule, mirrored networking works directly);
+(WSL-resilient: full headless Chromium by default; set `BROWSER_TEST` to a Windows browser exe only as CDP fallback — in NAT run `npx @brunosps00/dev-workflow setup-wsl-browser` once to install the optional user-level reverse cdp-relay.exe, mirrored networking works directly);
 see the "Browser on WSL" section of `dw-testing-discipline/references/playwright-recipes.md`. Chromium
 only — `screencast`/CDP do not support Firefox/WebKit.
 

package/scaffold/en/commands/dw-harness-audit.md

@@ -15,14 +15,16 @@ You are the dev-workflow harness auditor.
    - Agent registry
    - Provider compatibility
    - Handoff discipline
+   - Structured skill returns
    - Tool permissions
    - Parallel-safety coverage
    - MCP configuration
    - Verification gates
    - Security gates
    - Context discipline
-3. Cite missing paths and broken references.
-4. Recommend the top 3 fixes.
+3. For structured skill returns, inspect bundled skill `SKILL.md` files and require a `## Structured Return` contract with `Status`, `Evidence`, `Artifacts`, and `Next Step`.
+4. Cite missing paths, broken references, stale managed files, and skills without a structured return.
+5. Recommend the top 3 fixes.
 
 ## Output
 Return a scorecard and do not mutate files. Tell the user to run `dev-workflow repair` for managed-file drift.

package/scaffold/en/commands/dw-help.md

@@ -23,11 +23,12 @@ Use `/dw-autopilot "wish"` as the gateway for most feature work. The granular co
 | `/dw-bugfix "description"` | A bug or error report. Surgical fix or PRD route. |
 | `/dw-help [keyword]` | This screen. Pass a keyword for shortcuts. `--advanced` reveals internal commands. |
 
-## Tier 2 — Pipeline granular (9)
+## Tier 2 — Pipeline granular (10)
 
 | Command | What |
 |---------|------|
-| `/dw-brainstorm "idea"` | Refine an idea before PRD. Flags: `--onepager`, `--council`, `--research`, `--refactor`. |
+| `/dw-opportunities [focus]` | Suggest project-specific product, UX, automation, refactor, and security opportunities before you have a concrete idea. Flag: `--research`. |
+| `/dw-brainstorm "idea"` | Refine a concrete idea before PRD. Flags: `--onepager`, `--council`, `--research`. |
 | `/dw-plan "feature"` | PRD → TechSpec → Tasks sequentially with checkpoints. Stages: `prd`, `techspec`, `tasks`. |
 | `/dw-run [task-id]` | Execute all pending tasks or a single one. Flag `--resume`. |
 | `/dw-review` | Level 2 (PRD coverage) + Level 3 (code quality/security). Flags: `--coverage-only`, `--code-only`, `--bugfix <slug>`. |
@@ -37,12 +38,13 @@ Use `/dw-autopilot "wish"` as the gateway for most feature work. The granular co
 | `/dw-commit` | Atomic Conventional Commits for pending work. |
 | `/dw-generate-pr [target]` | Push branch, draft PR body, open browser. |
 
-## Tier 3 — Specialty (10)
+## Tier 3 — Specialty (11)
 
 | Command | What |
 |---------|------|
 | `/dw-analyze-project` | Scan the repo, write `.dw/rules/`, offer `.dw/constitution.md`, generate `.dw/rules/concerns.md`, and synthesize frontend `DESIGN.md` when tokens exist. |
 | `/dw-redesign-ui "target"` | Audit, propose 2-3 design directions, ship. Enforces UI grounding + WCAG; can run the deterministic impeccable slop detector. |
+| `/dw-refactor "target"` | Audit code-health and tech debt with Fowler smells, deep-modules analysis, and behavior-preserving test gates. |
 | `/dw-functional-doc` | Map screens + flows into a functional doc validated with Playwright; uses WSL-resilient browser resolution. |
 | `/dw-context-budget` | Audit context overhead from commands, skills, agents, instructions, and MCPs. |
 | `/dw-harness-audit` | Score dev-workflow install health: wrappers, agents, MCPs, gates. |
@@ -57,7 +59,7 @@ Use `/dw-autopilot "wish"` as the gateway for most feature work. The granular co
 `/dw-autopilot "wish"` runs planning first and stops. Reinvoke it to resume through `/dw-goal`, Security Gate, commit, and PR. Step-by-step:
 
 ```
-/dw-brainstorm → /dw-plan → /dw-goal → /dw-secure-audit → /dw-commit → /dw-generate-pr
+/dw-opportunities → /dw-brainstorm → /dw-plan → /dw-goal → /dw-secure-audit → /dw-commit → /dw-generate-pr
 ```
 
 ## Advanced / internal commands
@@ -106,8 +108,9 @@ Match the keyword and suggest:
 | `commit`, `git` | `/dw-commit` |
 | `pr`, `pull request`, `merge` | `/dw-generate-pr` |
 | `idea`, `brainstorm`, `explore` | `/dw-brainstorm` |
+| `opportunities`, `what next`, `roadmap`, `new ideas`, `features` | `/dw-opportunities` |
 | `research`, `compare`, `state of the art` | `/dw-brainstorm --research` |
-| `refactor`, `smell`, `code health` | `/dw-brainstorm --refactor` |
+| `refactor`, `smell`, `code health`, `tech debt` | `/dw-refactor` |
 | `ui`, `design`, `redesign` | `/dw-redesign-ui` |
 | `intel`, `where is`, `what uses` | `/dw-intel` (or `--build` to (re)create the index) |
 | `context`, `tokens`, `slow agent` | `/dw-context-budget` |
@@ -118,13 +121,14 @@ Match the keyword and suggest:
 | `skills`, `skill health`, `bloat` | `/dw-skill-health` |
 | `analyze`, `rules`, `conventions` | `/dw-analyze-project` |
 | `constitution`, `principles` | `/dw-analyze-project` (Step 8 generates the constitution) |
+| `security opportunities`, `hardening ideas`, `improve security` | `/dw-opportunities "security"` |
 | `security`, `vulnerabilities`, `cve`, `deps`, `audit deps` | `/dw-secure-audit` |
 | `secret`, `sast`, `semgrep`, `gitleaks`, `trivy` | `/dw-secure-audit` |
 | `adr`, `decision` | `/dw-adr` (also auto-invoked from `/dw-plan --council`) |
 | `docker`, `compose`, `container` | `/dw-dockerize` |
 | `new project`, `bootstrap`, `scaffold` | `/dw-new-project` |
 | `functional doc`, `screen map`, `e2e doc` | `/dw-functional-doc` |
-| `wsl`, `browser`, `playwright browser`, `cdp` | `npx @brunosps00/dev-workflow setup-wsl-browser` installs the prebuilt relay when WSL NAT must drive the real Windows browser |
+| `wsl`, `browser`, `playwright browser`, `cdp` | `npx @brunosps00/dev-workflow setup-wsl-browser` installs the optional user-level reverse relay for CDP fallback on WSL NAT |
 | `azure`, `microsoft learn`, `azure skills` | `/dw-install-azure-skills` |
 | `aws`, `aws mcp`, `aws skills` | `/dw-install-aws-skills` |
 | `incident`, `outage`, `postmortem`, `sev-1`, `sev-2` | (Skill `dw-incident-response` auto-invoked from `/dw-bugfix` for prod-critical) |
@@ -150,6 +154,7 @@ If no keyword matches, show the default surface and a note: "Keyword `<word>` no
 - `/dw-review` auto-invokes `/dw-secure-audit` for supported stacks; `/dw-autopilot` treats it as the named gate before commit/PR; `/dw-generate-pr` enforces the latest approved summary.
 
 **Q: How do I get more flow recommendations during ideation?**
+- `/dw-opportunities` scans the installed project and suggests product, UX, automation, refactor, and security opportunities.
 - `/dw-brainstorm "idea" --council` adds a multi-advisor stress-test debate.
 - `/dw-brainstorm "topic" --research` runs a deep multi-source citation pipeline.
 
@@ -157,6 +162,6 @@ If no keyword matches, show the default surface and a note: "Keyword `<word>` no
 - The `dw-llm-eval` skill is auto-invoked from `/dw-plan tasks` (eval-plan subtask), `/dw-review` (AI feature gate), and `/dw-qa --ai` (run reference dataset).
 
 **Q: What happened to all the other commands?**
-- v1.0.0 consolidated the old command surface. Mergers: create-prd/techspec/tasks → `/dw-plan`; run-task/run-plan → `/dw-run`; code-review/review-implementation → `/dw-review`; run-qa/fix-qa → `/dw-qa`; security-check/deps-audit → `/dw-secure-audit`; map-codebase → `/dw-intel --build`; deep-research and refactoring-analysis → `/dw-brainstorm --research/--refactor`. Removed: revert-task (use `git revert` directly).
+- v1.0.0 consolidated the old command surface. Mergers: create-prd/techspec/tasks → `/dw-plan`; run-task/run-plan → `/dw-run`; code-review/review-implementation → `/dw-review`; run-qa/fix-qa → `/dw-qa`; security-check/deps-audit → `/dw-secure-audit`; map-codebase → `/dw-intel --build`; deep-research → `/dw-brainstorm --research`; refactoring-analysis now routes to `/dw-refactor`. Removed: revert-task (use `git revert` directly).
 
 </system_instructions>