@colin4k1024/tsp 2.4.0

package/commands/aside.md

@@ -0,0 +1,164 @@
+---
+description: Answer a quick side question without interrupting or losing context from the current task. Resume work automatically after answering.
+---
+
+# Aside Command
+
+Ask a question mid-task and get an immediate, focused answer — then continue right where you left off. The current task, files, and context are never modified.
+
+## When to Use
+
+- You're curious about something while Claude is working and don't want to lose momentum
+- You need a quick explanation of code Claude is currently editing
+- You want a second opinion or clarification on a decision without derailing the task
+- You need to understand an error, concept, or pattern before Claude proceeds
+- You want to ask something unrelated to the current task without starting a new session
+
+## Usage
+
+```
+/aside <your question>
+/aside what does this function actually return?
+/aside is this pattern thread-safe?
+/aside why are we using X instead of Y here?
+/aside what's the difference between foo() and bar()?
+/aside should we be worried about the N+1 query we just added?
+```
+
+## Process
+
+### Step 1: Freeze the current task state
+
+Before answering anything, mentally note:
+- What is the active task? (what file, feature, or problem was being worked on)
+- What step was in progress at the moment `/aside` was invoked?
+- What was about to happen next?
+
+Do NOT touch, edit, create, or delete any files during the aside.
+
+### Step 2: Answer the question directly
+
+Answer the question in the most concise form that is still complete and useful.
+
+- Lead with the answer, not the reasoning
+- Keep it short — if a full explanation is needed, offer to go deeper after the task
+- If the question is about the current file or code being worked on, reference it precisely (file path and line number if relevant)
+- If answering requires reading a file, read it — but read only, never write
+
+Format the response as:
+
+```
+ASIDE: [restate the question briefly]
+
+[Your answer here]
+
+— Back to task: [one-line description of what was being done]
+```
+
+### Step 3: Resume the main task
+
+After delivering the answer, immediately continue the active task from the exact point it was paused. Do not ask for permission to resume unless the aside answer revealed a blocker or a reason to reconsider the current approach (see Edge Cases).
+
+---
+
+## Edge Cases
+
+**No question provided (`/aside` with nothing after it):**
+Respond:
+```
+ASIDE: no question provided
+
+What would you like to know? (ask your question and I'll answer without losing the current task context)
+
+— Back to task: [one-line description of what was being done]
+```
+
+**Question reveals a potential problem with the current task:**
+Flag it clearly before resuming:
+```
+ASIDE: [answer]
+
+WARNING: Note: This answer suggests [issue] with the current approach. Want to address this before continuing, or proceed as planned?
+```
+Wait for the user's decision before resuming.
+
+**Question is actually a task redirect (not a side question):**
+If the question implies changing what is being built (e.g., `/aside actually, let's use Redis instead`), clarify:
+```
+ASIDE: That sounds like a direction change, not just a side question.
+Do you want to:
+  (a) Answer this as information only and keep the current plan
+  (b) Pause the current task and change approach
+```
+Wait for the user's answer — do not make assumptions.
+
+**Question is about the currently open file or code:**
+Answer from the live context. If the file was read earlier in the session, reference it directly. If not, read it now (read-only) and answer with a file:line reference.
+
+**No active task (nothing in progress when `/aside` is invoked):**
+Still use the standard wrapper so the response shape stays consistent:
+```
+ASIDE: [restate the question briefly]
+
+[Your answer here]
+
+— Back to task: no active task to resume
+```
+
+**Question requires a long answer:**
+Give the essential answer concisely, then offer:
+```
+That's the short version. Want a deeper explanation after we finish [current task]?
+```
+
+**Multiple `/aside` questions in a row:**
+Answer each one in sequence. After the last answer, resume the main task. Do not lose task state across a chain of asides.
+
+**Aside answer implies a code change is needed:**
+Note the change needed but do not make it during the aside:
+```
+ASIDE: [answer]
+
+ Worth fixing: [what should be changed]. I'll flag this after the current task unless you want to address it now.
+```
+
+**Question is ambiguous or too vague:**
+Ask one clarifying question — the shortest question that gets the information needed to answer. Do not ask multiple questions.
+
+---
+
+## Example Output
+
+```
+User: /aside what does fetchWithRetry() actually do?
+
+ASIDE: what does fetchWithRetry() do?
+
+fetchWithRetry() (src/api/retry.ts:12) attempts the request up to 3 times with
+exponential backoff (250ms → 500ms → 1s). It only retries on 5xx responses and
+network errors — 4xx errors are treated as final and not retried.
+
+— Back to task: refactoring the auth middleware in src/middleware/auth.ts
+```
+
+```
+User: /aside is the approach we're taking thread-safe?
+
+ASIDE: is the current approach thread-safe?
+
+No — the shared cache object in src/cache/store.ts:34 is mutated without locking.
+Under concurrent requests this is a race condition. It's low risk in a single-process
+Node.js server but would be a real problem with worker threads or clustering.
+
+WARNING: Note: This could affect the feature we're building. Want to address this now or continue and fix it in a follow-up?
+```
+
+---
+
+## Notes
+
+- Never modify files during an aside — read-only access only
+- The aside is a conversation pause, not a new task — the original task must always resume
+- Keep answers focused: the goal is to unblock the user quickly, not to deliver a lecture
+- If an aside sparks a larger discussion, finish the current task first unless the aside reveals a blocker
+- Asides are not saved to session files unless explicitly relevant to the task outcome

package/commands/build-fix.md

@@ -0,0 +1,31 @@
+# /build-fix
+
+> 本文件由 `scripts/build-platform-artifacts.js` 生成，请勿手改。
+
+## 用途
+
+使用 build-error specialists 分析并修复构建、编译或测试失败。
+
+## 主责角色
+
+- `build-error-resolver`
+
+## 期望输入
+
+- 错误日志
+- 构建命令
+- 相关模块上下文
+
+## 标准输出
+
+- 失败归因
+- 修复建议
+- 建议的验证命令
+
+输出字段定义与交付结构见 [team-command-output-contracts.md](../docs/runbooks/team-command-output-contracts.md)。
+
+## 默认流程
+
+1. 先归因失败类型，再决定是否切到语言专项 resolver。
+2. 优先给出最小修复路径和验证命令。
+3. 完成后把结果回交给实现角色或 `tech-lead`。

package/commands/checkpoint.md

@@ -0,0 +1,74 @@
+# Checkpoint Command
+
+Create or verify a checkpoint in your workflow.
+
+## Usage
+
+`/checkpoint [create|verify|list] [name]`
+
+## Create Checkpoint
+
+When creating a checkpoint:
+
+1. Run `/verify quick` to ensure current state is clean
+2. Create a git stash or commit with checkpoint name
+3. Log checkpoint to `.claude/checkpoints.log`:
+
+```bash
+echo "$(date +%Y-%m-%d-%H:%M) | $CHECKPOINT_NAME | $(git rev-parse --short HEAD)" >> .claude/checkpoints.log
+```
+
+4. Report checkpoint created
+
+## Verify Checkpoint
+
+When verifying against a checkpoint:
+
+1. Read checkpoint from log
+2. Compare current state to checkpoint:
+   - Files added since checkpoint
+   - Files modified since checkpoint
+   - Test pass rate now vs then
+   - Coverage now vs then
+
+3. Report:
+```
+CHECKPOINT COMPARISON: $NAME
+============================
+Files changed: X
+Tests: +Y passed / -Z failed
+Coverage: +X% / -Y%
+Build: [PASS/FAIL]
+```
+
+## List Checkpoints
+
+Show all checkpoints with:
+- Name
+- Timestamp
+- Git SHA
+- Status (current, behind, ahead)
+
+## Workflow
+
+Typical checkpoint flow:
+
+```
+[Start] --> /checkpoint create "feature-start"
+   |
+[Implement] --> /checkpoint create "core-done"
+   |
+[Test] --> /checkpoint verify "core-done"
+   |
+[Refactor] --> /checkpoint create "refactor-done"
+   |
+[PR] --> /checkpoint verify "feature-start"
+```
+
+## Arguments
+
+$ARGUMENTS:
+- `create <name>` - Create named checkpoint
+- `verify <name>` - Verify against named checkpoint
+- `list` - Show all checkpoints
+- `clear` - Remove old checkpoints (keeps last 5)

package/commands/claw.md

@@ -0,0 +1,23 @@
+---
+description: Legacy slash-entry shim for the nanoclaw-repl skill. Prefer the skill directly.
+---
+
+# Claw Command (Legacy Shim)
+
+Use this only if you still reach for `/claw` from muscle memory. The maintained implementation lives in `skills/nanoclaw-repl/SKILL.md`.
+
+## Canonical Surface
+
+- Prefer the `nanoclaw-repl` skill directly.
+- Keep this file only as a compatibility entry point while command-first usage is retired.
+
+## Arguments
+
+`$ARGUMENTS`
+
+## Delegation
+
+Apply the `nanoclaw-repl` skill and keep the response focused on operating or extending `scripts/claw.js`.
+- If the user wants to run it, use `node scripts/claw.js` or `npm run claw`.
+- If the user wants to extend it, preserve the zero-dependency and markdown-backed session model.
+- If the request is really about long-running orchestration rather than NanoClaw itself, redirect to `dmux-workflows` or `autonomous-agent-harness`.

package/commands/code-review.md

@@ -0,0 +1,49 @@
+# /code-review
+
+> 本文件由 `scripts/build-platform-artifacts.js` 生成，请勿手改。
+
+## 用途
+
+触发通用或语言专项 reviewer，对代码质量、设计风险和回归风险做结构化评审。
+
+## 主责角色
+
+- `code-reviewer`
+
+## 期望输入
+
+- 变更说明
+- diff 或实现摘要
+- 测试与风险信息
+
+## 标准输出
+
+- 评审结论
+- 阻塞问题
+- 语言或安全专项建议
+
+输出字段定义与交付结构见 [team-command-output-contracts.md](../docs/runbooks/team-command-output-contracts.md)。
+
+## 默认流程
+
+1. 优先检查行为回归、设计问题、缺测和安全风险。
+2. 若仓库启用了 AI PR review 试点，可参考 `docs/runbooks/ai-pr-review-automation.md` 把 AI 摘要和风险提示作为辅助输入，但不能替代人工结论。
+3. 若 diff 涉及依赖清单、lockfile 或构建插件版本，参考 `docs/runbooks/dependency-review-gates.md` 检查新增依赖、漏洞和许可证变化。
+4. 若当前 PR 主要是依赖升级批次或自动化更新结果，参考 `docs/runbooks/dependency-update-automation.md` 判断分组是否合理、验证范围是否足够以及是否适合自动合并。
+5. 若仓库启用了 GitHub CodeQL / code scanning，参考 `docs/runbooks/codeql-pr-security-gates.md` 读取语义安全扫描结果与 triage 结论。
+6. 若 diff 涉及配置文件、示例、脚本、测试数据、文档或疑似凭据暴露，参考 `docs/runbooks/secret-scanning-gates.md` 检查新增命中、baseline 变化和泄漏处置要求。
+7. 若 diff 涉及 `.github/workflows/`、reusable workflow、composite action 或 workflow 表达式 / shell 片段，参考 `docs/runbooks/actionlint-workflow-gates.md` 检查 workflow 语法、结构、上下文引用和 shell 误用。
+8. 若 diff 涉及 GitHub Actions workflow 的 `permissions`、默认 workflow 权限或 `GITHUB_TOKEN` scope 收敛，参考 `docs/runbooks/github-token-permissions-baseline.md` 检查最小权限建议、例外和最终 YAML 配置是否一致。
+9. 若 diff 涉及 GitHub Actions workflow 的权限、第三方 action、secret 暴露、危险表达式或 release automation 安全面，参考 `docs/runbooks/zizmor-workflow-audits.md` 读取 workflow 安全审计结果与 triage 结论。
+10. 若 diff 涉及 Terraform、CloudFormation、Bicep、ARM、OpenTofu、Helm、Kubernetes 或其他 IaC / 模板基线检查，且仓库启用了 Checkov，参考 `docs/runbooks/checkov-iac-gates.md` 读取 IaC 安全与合规预检结果、例外和 triage 结论。
+11. 若 diff 涉及 Kubernetes manifests、Helm 渲染结果、kustomize 输出或 CRD schema 覆盖，且仓库启用了 schema 校验，参考 `docs/runbooks/kubeconform-schema-gates.md` 读取 schema 校验结果、覆盖缺口和版本边界。
+12. 若 diff 涉及 Helm chart 模板、values 组合、subchart 或 snapshot 断言，参考 `docs/runbooks/helm-unittest-playbook.md` 检查 chart 层单测、snapshot 更新和覆盖范围是否合理。
+13. 若 diff 涉及 `kubectl apply --server-side`、`--dry-run=server`、field manager 或 manifests 的 API server 接受性预检，参考 `docs/runbooks/kubectl-server-dry-run-gates.md` 读取 server-side validation、field conflict 和 RBAC 结论。
+14. 若 diff 涉及 Dockerfile、容器镜像、Helm、Kubernetes、Terraform 或仓库文件系统扫描，且仓库启用了 Trivy，参考 `docs/runbooks/trivy-security-gates.md` 读取镜像 / 文件系统 / IaC 扫描结果与 triage 结论。
+15. 若 diff 涉及 Helm、Kubernetes、Terraform、YAML、JSON 或其他结构化配置策略，且仓库启用了 policy-as-code 预检，参考 `docs/runbooks/conftest-policy-gates.md` 读取 policy 命中、例外和阻塞边界。
+16. 若 diff 涉及 Kyverno policy、background scan、policy reports、image verification 或 Kubernetes 原生策略治理，参考 `docs/runbooks/kyverno-policy-gates.md` 读取策略范围、`Audit/Enforce` 状态和例外处理结论。
+17. 若 diff 涉及 GitHub Actions workflow、token 权限、第三方 action pinning、分支保护或 release automation，且仓库启用了 OSSF Scorecard，参考 `docs/runbooks/scorecard-supply-chain-gates.md` 读取仓库级供应链基线结果与 triage 结论。
+18. 若 diff 涉及 GitHub Actions runner 的外部访问面、网络放行列表或 workflow 运行时收敛策略，参考 `docs/runbooks/runner-egress-hardening.md` 核对 egress allowlist、异常连接和例外处理边界。
+19. 若 diff 涉及 attestation predicate、schema、evidence model 或供应链 policy 规则，参考 `docs/runbooks/in-toto-attestation-framework.md` 与 `docs/runbooks/witness-policy-gates.md` 核对证据结构与策略边界。
+20. 必要时联动 language reviewer 或 security reviewer。
+21. 将结论回交给 `/team-review` 或对应实现角色。

package/commands/context-budget.md

@@ -0,0 +1,23 @@
+---
+description: Legacy slash-entry shim for the context-budget skill. Prefer the skill directly.
+---
+
+# Context Budget Optimizer (Legacy Shim)
+
+Use this only if you still invoke `/context-budget`. The maintained workflow lives in `skills/context-budget/SKILL.md`.
+
+## Canonical Surface
+
+- Prefer the `context-budget` skill directly.
+- Keep this file only as a compatibility entry point.
+
+## Arguments
+
+$ARGUMENTS
+
+## Delegation
+
+Apply the `context-budget` skill.
+- Pass through `--verbose` if the user supplied it.
+- Assume a 200K context window unless the user specified otherwise.
+- Return the skill's inventory, issue detection, and prioritized savings report without re-implementing the scan here.

package/commands/cpp-build.md

@@ -0,0 +1,173 @@
+---
+description: Fix C++ build errors, CMake issues, and linker problems incrementally. Invokes the cpp-build-resolver agent for minimal, surgical fixes.
+---
+
+# C++ Build and Fix
+
+This command invokes the **cpp-build-resolver** agent to incrementally fix C++ build errors with minimal changes.
+
+## What This Command Does
+
+1. **Run Diagnostics**: Execute `cmake --build`, `clang-tidy`, `cppcheck`
+2. **Parse Errors**: Group by file and sort by severity
+3. **Fix Incrementally**: One error at a time
+4. **Verify Each Fix**: Re-run build after each change
+5. **Report Summary**: Show what was fixed and what remains
+
+## When to Use
+
+Use `/cpp-build` when:
+- `cmake --build build` fails with errors
+- Linker errors (undefined references, multiple definitions)
+- Template instantiation failures
+- Include/dependency issues
+- After pulling changes that break the build
+
+## Diagnostic Commands Run
+
+```bash
+# CMake configure
+cmake -B build -S .
+
+# Build
+cmake --build build 2>&1 | head -100
+
+# Static analysis (if available)
+clang-tidy src/*.cpp -- -std=c++17
+cppcheck --enable=all src/
+```
+
+## Example Session
+
+```text
+User: /cpp-build
+
+Agent:
+# C++ Build Resolution
+
+## Initial Diagnostics
+
+```bash
+$ cmake --build build
+src/service/user.cpp:25:15: error: use of undeclared identifier 'UserRepository'
+src/handler/api.cpp:42:9: error: no matching function for call to 'process'
+src/handler/api.cpp:58:1: error: non-void function does not return a value
+```
+
+Errors found: 3
+
+## Fix 1: Undeclared Identifier
+
+File: src/service/user.cpp:25
+Error: use of undeclared identifier 'UserRepository'
+Cause: Missing include
+
+```cpp
+// Added include
+#include "repository/user_repository.hpp"
+```
+
+```bash
+$ cmake --build build
+# 2 errors remaining
+```
+
+## Fix 2: No Matching Function
+
+File: src/handler/api.cpp:42
+Error: no matching function for call to 'process'
+
+```cpp
+// Changed
+process(params.get("count"));
+// To
+process(std::stoi(params.get("count")));
+```
+
+```bash
+$ cmake --build build
+# 1 error remaining
+```
+
+## Fix 3: Missing Return
+
+File: src/handler/api.cpp:58
+Error: non-void function does not return a value
+
+```cpp
+std::optional<User> getUser(const std::string& id) {
+    if (id.empty()) {
+        return std::nullopt;
+    }
+    auto user = findUser(id);
+    // Added missing return
+    return user;
+}
+```
+
+```bash
+$ cmake --build build
+# Build successful!
+```
+
+## Final Verification
+
+```bash
+$ ctest --test-dir build --output-on-failure
+Test project build
+    1/5 Test #1: unit_tests ........   Passed    0.02 sec
+    2/5 Test #2: integration_tests    Passed    0.15 sec
+All tests passed.
+```
+
+## Summary
+
+| Metric | Count |
+|--------|-------|
+| Build errors fixed | 3 |
+| Linker errors fixed | 0 |
+| Files modified | 2 |
+| Remaining issues | 0 |
+
+Build Status: PASS: SUCCESS
+```
+
+## Common Errors Fixed
+
+| Error | Typical Fix |
+|-------|-------------|
+| `undeclared identifier` | Add `#include` or fix typo |
+| `no matching function` | Fix argument types or add overload |
+| `undefined reference` | Link library or add implementation |
+| `multiple definition` | Use `inline` or move to .cpp |
+| `incomplete type` | Replace forward decl with `#include` |
+| `no member named X` | Fix member name or include |
+| `cannot convert X to Y` | Add appropriate cast |
+| `CMake Error` | Fix CMakeLists.txt configuration |
+
+## Fix Strategy
+
+1. **Compilation errors first** - Code must compile
+2. **Linker errors second** - Resolve undefined references
+3. **Warnings third** - Fix with `-Wall -Wextra`
+4. **One fix at a time** - Verify each change
+5. **Minimal changes** - Don't refactor, just fix
+
+## Stop Conditions
+
+The agent will stop and report if:
+- Same error persists after 3 attempts
+- Fix introduces more errors
+- Requires architectural changes
+- Missing external dependencies
+
+## Related Commands
+
+- `/cpp-test` - Run tests after build succeeds
+- `/cpp-review` - Review code quality
+- `/verify` - Full verification loop
+
+## Related
+
+- Agent: `agents/cpp-build-resolver.md`
+- Skill: `skills/cpp-coding-standards/`

package/commands/cpp-review.md

@@ -0,0 +1,132 @@
+---
+description: Comprehensive C++ code review for memory safety, modern C++ idioms, concurrency, and security. Invokes the cpp-reviewer agent.
+---
+
+# C++ Code Review
+
+This command invokes the **cpp-reviewer** agent for comprehensive C++-specific code review.
+
+## What This Command Does
+
+1. **Identify C++ Changes**: Find modified `.cpp`, `.hpp`, `.cc`, `.h` files via `git diff`
+2. **Run Static Analysis**: Execute `clang-tidy` and `cppcheck`
+3. **Memory Safety Scan**: Check for raw new/delete, buffer overflows, use-after-free
+4. **Concurrency Review**: Analyze thread safety, mutex usage, data races
+5. **Modern C++ Check**: Verify code follows C++17/20 conventions and best practices
+6. **Generate Report**: Categorize issues by severity
+
+## When to Use
+
+Use `/cpp-review` when:
+- After writing or modifying C++ code
+- Before committing C++ changes
+- Reviewing pull requests with C++ code
+- Onboarding to a new C++ codebase
+- Checking for memory safety issues
+
+## Review Categories
+
+### CRITICAL (Must Fix)
+- Raw `new`/`delete` without RAII
+- Buffer overflows and use-after-free
+- Data races without synchronization
+- Command injection via `system()`
+- Uninitialized variable reads
+- Null pointer dereferences
+
+### HIGH (Should Fix)
+- Rule of Five violations
+- Missing `std::lock_guard` / `std::scoped_lock`
+- Detached threads without proper lifetime management
+- C-style casts instead of `static_cast`/`dynamic_cast`
+- Missing `const` correctness
+
+### MEDIUM (Consider)
+- Unnecessary copies (pass by value instead of `const&`)
+- Missing `reserve()` on known-size containers
+- `using namespace std;` in headers
+- Missing `[[nodiscard]]` on important return values
+- Overly complex template metaprogramming
+
+## Automated Checks Run
+
+```bash
+# Static analysis
+clang-tidy --checks='*,-llvmlibc-*' src/*.cpp -- -std=c++17
+
+# Additional analysis
+cppcheck --enable=all --suppress=missingIncludeSystem src/
+
+# Build with warnings
+cmake --build build -- -Wall -Wextra -Wpedantic
+```
+
+## Example Usage
+
+```text
+User: /cpp-review
+
+Agent:
+# C++ Code Review Report
+
+## Files Reviewed
+- src/handler/user.cpp (modified)
+- src/service/auth.cpp (modified)
+
+## Static Analysis Results
+✓ clang-tidy: 2 warnings
+✓ cppcheck: No issues
+
+## Issues Found
+
+[CRITICAL] Memory Leak
+File: src/service/auth.cpp:45
+Issue: Raw `new` without matching `delete`
+```cpp
+auto* session = new Session(userId);  // Memory leak!
+cache[userId] = session;
+```
+Fix: Use `std::unique_ptr`
+```cpp
+auto session = std::make_unique<Session>(userId);
+cache[userId] = std::move(session);
+```
+
+[HIGH] Missing const Reference
+File: src/handler/user.cpp:28
+Issue: Large object passed by value
+```cpp
+void processUser(User user) {  // Unnecessary copy
+```
+Fix: Pass by const reference
+```cpp
+void processUser(const User& user) {
+```
+
+## Summary
+- CRITICAL: 1
+- HIGH: 1
+- MEDIUM: 0
+
+Recommendation: FAIL: Block merge until CRITICAL issue is fixed
+```
+
+## Approval Criteria
+
+| Status | Condition |
+|--------|-----------|
+| PASS: Approve | No CRITICAL or HIGH issues |
+| WARNING: Warning | Only MEDIUM issues (merge with caution) |
+| FAIL: Block | CRITICAL or HIGH issues found |
+
+## Integration with Other Commands
+
+- Use `/cpp-test` first to ensure tests pass
+- Use `/cpp-build` if build errors occur
+- Use `/cpp-review` before committing
+- Use `/code-review` for non-C++ specific concerns
+
+## Related
+
+- Agent: `agents/cpp-reviewer.md`
+- Skills: `skills/cpp-coding-standards/`, `skills/cpp-testing/`