@cometchat/skills 4.0.0 → 4.2.0

package/skills/cometchat-calls/references/use-case-marketplace.md

@@ -0,0 +1,158 @@
+# Use case — Marketplace (buyer ↔ seller)
+
+A peer-to-peer marketplace where buyers and sellers communicate before/during a transaction. The shape: time-bounded chat between matched users, optional 1:1 video for product walkthroughs, communications archived for dispute resolution, identity controls so neither party can recontact post-transaction without going through the platform.
+
+**Examples:** OfferUp, Airbnb host/guest messaging, eBay seller-buyer chat with video, Etsy custom-order discussions.
+
+---
+
+## End-to-end flow
+
+```
+1. Buyer expresses interest in a listing
+   → Server creates a CometChat group with both buyer + seller
+   → Group lives only for the duration of the deal (auto-archive after N days)
+   ↓
+2. Either party can initiate text chat in the group
+   ↓
+3. (Optional) Either party can initiate a video call to walk through the product
+   → Identity is hidden — call shows "Buyer" or "Seller", not real names
+   ↓
+4. Transaction closes (purchase confirmed / canceled)
+   → Group is locked: read-only for both parties, archived for dispute resolution
+   ↓
+5. After dispute window (90 days typical), group is hard-deleted
+```
+
+---
+
+## Identity protection
+
+Don't expose real names/emails through the SDK. Use **opaque UIDs** that resolve to display strings only via your auth-gated lookup:
+
+```ts
+// On the server, when creating the deal group:
+await cometchatApi.createGroup({
+  guid: `deal-${dealId}`,
+  members: [
+    { uid: `buyer-${buyerId}`, scope: "participant" },
+    { uid: `seller-${sellerId}`, scope: "participant" },
+  ],
+  metadata: {
+    dealId,
+    expiresAt: Date.now() + 90 * 86400_000,
+  },
+});
+
+// Client-side: when CometChat returns a UID, resolve display name via your API
+function resolveDisplayName(uid: string, viewerRole: "buyer" | "seller"): string {
+  // Only show "Seller" / "Buyer" — not real name
+  if (uid.startsWith("seller-")) return viewerRole === "buyer" ? "Seller" : "You";
+  if (uid.startsWith("buyer-")) return viewerRole === "seller" ? "Buyer" : "You";
+  return "Unknown";
+}
+```
+
+---
+
+## Recommended call settings
+
+```ts
+const settings = {
+  layout: "SPOTLIGHT",                   // 1:1 focus
+  hideChangeLayoutButton: true,
+
+  hideRecordingButton: true,              // No platform-side recording — privacy + dispute via chat archive
+  hideShareInviteButton: true,            // Buyer ↔ seller only — don't allow inviting
+  hideScreenShareButton: false,           // Useful for "show me the actual condition"
+  hideVirtualBackgroundButton: false,     // Privacy — most people are in their home
+  hideChatButton: false,                  // For sharing photos/details mid-call
+
+  hideRaiseHandButton: true,
+  callIdleTime: 600,                      // 10min idle = end (sometimes deals die)
+};
+```
+
+---
+
+## Time-bounded access
+
+After the deal closes (or expires), revoke access without deleting history:
+
+```ts
+// Server-side, when transaction closes:
+await cometchatApi.updateGroup({
+  guid: `deal-${dealId}`,
+  metadata: {
+    status: "closed",
+    closedAt: Date.now(),
+  },
+});
+// Lock by switching group to "private" with no joinable handle
+await cometchatApi.kickMembers({ guid, uids: [/* all participants */] });
+```
+
+Or — if your dispute window allows — keep them in the group as **read-only** by checking `metadata.status` client-side and disabling composer:
+
+```tsx
+function DealMessageComposer({ group }: Props) {
+  const isClosed = group.metadata?.status === "closed";
+  return (
+    <CometChatMessageComposer group={group} disabled={isClosed} />
+    // (Disable shows the input greyed out with explanation)
+  );
+}
+```
+
+---
+
+## Anti-patterns
+
+1. **Using real user UIDs in CometChat.** Real names leak via SDK events. Always use opaque IDs.
+2. **Allowing share-invite.** Bypasses identity controls — a savvy user shares the call link to a third party (their lawyer, advocate, etc.). Lock down to invitees only.
+3. **No expiration.** Old deals' groups pile up. Use `metadata.expiresAt` + nightly cron to delete.
+4. **Recording calls.** Liability risk — neither party gave consent + you may not be the legal data controller for their home interiors.
+5. **Cross-platform message routing without checks.** Customer says "find me on WhatsApp" → links pasted in chat → bypass your platform's protection. Run profanity-filter + URL-detection extensions; flag attempts.
+
+---
+
+## Anti-fraud heuristics
+
+```ts
+// Hook into message-sent events
+CometChat.addMessageListener("antifraud", new CometChat.MessageListener({
+  onTextMessageReceived: (msg) => {
+    const text = msg.getText();
+    // Off-platform routing attempts
+    const offPlatform = /\b(whatsapp|telegram|signal|wechat|email|@gmail|@yahoo)\b/i;
+    // Wire-fraud red flags
+    const wireFraud = /\b(western union|moneygram|gift card|crypto|bitcoin|wire transfer)\b/i;
+    if (offPlatform.test(text) || wireFraud.test(text)) {
+      // Quietly flag for review — don't tip the user that you're watching
+      api.flagMessage({ messageId: msg.getId(), reasons: { offPlatform: offPlatform.test(text), wireFraud: wireFraud.test(text) }});
+    }
+  },
+}));
+```
+
+---
+
+## Verification checklist
+
+- [ ] Opaque UIDs used (no real names in CometChat)
+- [ ] Display names resolved via auth-gated API
+- [ ] `hideShareInviteButton: true`
+- [ ] No platform-side recording
+- [ ] Group `metadata.expiresAt` set + nightly archive job
+- [ ] Anti-fraud message listener wired
+- [ ] Profanity filter + URL detection extensions enabled
+- [ ] Call settings: SPOTLIGHT layout, idle 10min
+
+---
+
+## Pointers
+
+- `cometchat-react-calls/references/screen-sharing.md` — for product walkthrough
+- `cometchat-react-extensions` — profanity-filter + URL-detection
+- `cometchat-production` — server-minted auth tokens (don't leak the auth key in client)
+- `cometchat-react/SKILL.md` — group + message UX

package/skills/cometchat-calls/references/use-case-support.md

@@ -0,0 +1,190 @@
+# Use case — Customer support / Help desk
+
+A customer initiates contact with a support agent. The shape: customer arrives via "Talk to us" button, lands in a queue, gets matched to next available agent, voice-first (video optional), screen-share for troubleshooting, recording for QA + agent training, post-call CSAT survey.
+
+**Examples:** Intercom voice/video upgrade, Zendesk Talk, custom help-desk integrations.
+
+---
+
+## End-to-end flow
+
+```
+1. Customer clicks "Get help" in your app
+   → Server checks queue depth → routes to next agent OR shows wait estimate
+   ↓
+2. Server creates a support group (CometChat group keyed to ticket ID)
+   Both customer + agent are members
+   ↓
+3. Agent gets push notification "New support call"
+   ↓
+4. Agent accepts → call starts; customer auto-joins
+   ↓
+5. Mid-call: agent can request screen-share to see the customer's screen
+   → Customer must explicitly allow (OS-level permission)
+   ↓
+6. Agent ends call → recording auto-uploaded to your QA pipeline
+   ↓
+7. Customer gets CSAT survey (1-5 rating + comment)
+   → Stored against the ticket for agent performance reviews
+```
+
+---
+
+## Agent-side identity
+
+Display the agent's first name + photo, NOT internal handle:
+
+```ts
+// Agent's CometChat user metadata (set when agent logs into the support tool):
+await CometChat.updateUser(new CometChat.User({
+  uid: `agent-${employeeId}`,
+  name: "Sarah",                       // First name only — privacy + warmth
+  metadata: {
+    displayPhoto: "/agent-photos/sarah.png",
+    role: "Support Specialist",
+    department: "Billing",
+  },
+}));
+```
+
+---
+
+## Recommended call settings
+
+```ts
+const settings = {
+  layout: "SPOTLIGHT",                   // Speaker focus
+  hideChangeLayoutButton: false,          // Agent may want grid for note-taking workflows
+
+  hideRecordingButton: true,              // Don't let agent toggle — server-side auto-record
+  startRecordingOnCallStart: true,        // QA recording is the policy
+                                          // (consent text in the in-app "By starting the call,
+                                          //  you agree to recording for quality" notice)
+  hideScreenShareButton: false,           // Critical for troubleshooting
+
+  hideVirtualBackgroundButton: false,     // Agent uses brand background
+
+  hideChatButton: false,                  // For pasting links/error messages
+  hideShareInviteButton: true,            // Customer ↔ agent only
+
+  hideRaiseHandButton: true,
+  callIdleTime: 300,                      // 5min — short, agents are busy
+};
+```
+
+---
+
+## Recording consent (one-party + platform notice)
+
+For most customer-support flows, a "By starting this call, you agree to recording" notice in your app's pre-call screen is sufficient (one-party consent jurisdictions). For two-party-consent jurisdictions (CA, IL, FL), add an explicit consent dialog before connecting:
+
+```tsx
+function PreCallScreen({ onAccept, onCancel }: Props) {
+  return (
+    <dialog open className="precall">
+      <h2>Connect to support</h2>
+      <p>Estimated wait: 2 minutes</p>
+      <div role="note" aria-label="Recording notice">
+        <p><strong>This call will be recorded for quality assurance.</strong></p>
+        <p>By starting the call, you consent to recording. Recordings are
+           retained for 90 days, accessible to you on request, and never sold.</p>
+      </div>
+      <button onClick={onAccept}>Start call</button>
+      <button onClick={onCancel}>Cancel</button>
+    </dialog>
+  );
+}
+```
+
+---
+
+## Queue display + ETA
+
+```tsx
+function QueueWaiting({ ticketId }: Props) {
+  const [position, setPosition] = useState<number>(0);
+  const [eta, setEta] = useState<number>(0);
+
+  useEffect(() => {
+    // Server-side queue manager publishes updates via CometChat custom messages
+    const listener = CometChat.addMessageListener("queue-updates", new CometChat.MessageListener({
+      onCustomMessageReceived: (msg) => {
+        const data = msg.getCustomData();
+        if (data.ticketId === ticketId) {
+          setPosition(data.position);
+          setEta(data.etaSeconds);
+        }
+      },
+    }));
+    return () => CometChat.removeMessageListener("queue-updates");
+  }, [ticketId]);
+
+  return (
+    <div role="status" aria-live="polite">
+      <p>You're number {position} in line</p>
+      <p>Estimated wait: {Math.round(eta / 60)} minutes</p>
+    </div>
+  );
+}
+```
+
+---
+
+## Post-call CSAT
+
+Fire immediately after call end; before they navigate away:
+
+```tsx
+function PostCallSurvey({ ticketId }: Props) {
+  const [rating, setRating] = useState<number | null>(null);
+  return (
+    <dialog open>
+      <h2>How was your call?</h2>
+      <fieldset>
+        <legend>Rate from 1 (poor) to 5 (excellent)</legend>
+        {[1, 2, 3, 4, 5].map((n) => (
+          <button key={n} onClick={() => setRating(n)} aria-pressed={rating === n}>
+            {n} ⭐
+          </button>
+        ))}
+      </fieldset>
+      <textarea name="comment" placeholder="Anything else?" />
+      <button onClick={() => api.submitCsat({ ticketId, rating, comment })}>Submit</button>
+    </dialog>
+  );
+}
+```
+
+---
+
+## Anti-patterns
+
+1. **No recording notice.** Two-party-consent law: lawsuit risk.
+2. **Letting agent disable recording mid-call.** QA pipeline breaks. Hide the recording button server-side; only ops can disable for specific tickets via admin tool.
+3. **Sharing internal employee handles.** Customer doesn't need agent's full name or company username — just first name.
+4. **Recording forever.** Set 90-day retention; auto-delete via storage lifecycle.
+5. **No queue UX.** Customer waits 5 minutes thinking it's broken → bounces. Show position + ETA.
+6. **Agent transfers without context.** When transferring to another agent, pass the ticket history (custom messages with summary). Customer hates re-explaining.
+
+---
+
+## Verification checklist
+
+- [ ] Recording is server-side auto-on; agent can't disable
+- [ ] Pre-call screen shows recording notice + estimated wait
+- [ ] Queue position + ETA visible during wait
+- [ ] Customer ↔ agent only — share-invite hidden
+- [ ] Idle timeout 5min (short on purpose)
+- [ ] Post-call CSAT fires immediately
+- [ ] Recording retention enforced via storage lifecycle (90d default)
+- [ ] Agent transfer carries ticket context
+
+---
+
+## Pointers
+
+- `cometchat-react-calls/references/recording.md` — recording config
+- `cometchat-react-calls/references/screen-sharing.md` — for troubleshooting
+- `cometchat-react/SKILL.md` — group + custom message patterns
+- `cometchat-production` — credential hygiene
+- `cometchat-react-extensions` — analytics for agent QA

package/skills/cometchat-calls/references/use-case-team.md

@@ -0,0 +1,169 @@
+# Use case — Team / Standup / Collaboration
+
+Internal team meetings — standup, sprint review, retro, ad-hoc collaboration. The shape: 2–15 participants, all with mic + video on, TILE layout for equal visibility, screen-share for shared docs, in-call chat for links, optional recording for absent teammates.
+
+**Examples:** Slack huddles, Microsoft Teams meetings, internal company calls.
+
+---
+
+## End-to-end flow
+
+```
+1. A user creates or joins a team channel (CometChat group already exists for the team)
+   ↓
+2. Anyone in the group can start a call → all members get a "huddle started" notification
+   ↓
+3. Members join voluntarily (no incoming-call ring — opt-in)
+   ↓
+4. Mic + camera ON by default (it's a team meeting, not a webinar)
+   ↓
+5. (Optional) Anyone can record; absent members get the link in the channel
+   ↓
+6. Screen-share + in-call chat for collaboration
+   ↓
+7. Last person leaves → call ends → optional recording posted to channel
+```
+
+---
+
+## Recommended call settings
+
+```ts
+const settings = {
+  layout: "TILE",                        // Equal visibility — team meetings
+  hideChangeLayoutButton: false,          // Let users pick (some prefer SPOTLIGHT)
+
+  hideRecordingButton: false,             // Anyone can record; team norms decide
+  startRecordingOnCallStart: false,
+
+  hideScreenShareButton: false,           // Critical
+  hideVirtualBackgroundButton: false,
+
+  hideChatButton: false,                  // Side-chat for links
+  hideShareInviteButton: false,           // Pull others in mid-call
+
+  hideRaiseHandButton: false,             // For larger team meetings (10+)
+
+  callIdleTime: 1800,                     // 30min — meetings can have lulls
+};
+```
+
+---
+
+## "Huddle started" notification
+
+```ts
+// When someone starts a call in a team group, fire a custom message
+// so other members see "🟢 Huddle started by Sarah" in the channel.
+async function startHuddle(group: CometChat.Group) {
+  // 1. Initiate the call
+  const session = await CometChatCalls.startSession({
+    sessionId: `huddle-${group.guid}-${Date.now()}`,
+    participants: [...group.memberUids],
+  });
+
+  // 2. Post a custom message in the chat group
+  const customMessage = new CometChat.CustomMessage(
+    group.guid,
+    CometChat.RECEIVER_TYPE.GROUP,
+    "huddle_started",
+    {
+      sessionId: session.sessionId,
+      startedBy: currentUserUid,
+      startedAt: Date.now(),
+    },
+  );
+  await CometChat.sendCustomMessage(customMessage);
+}
+```
+
+Render in the chat list:
+
+```tsx
+function HuddleStartedBubble({ message }: Props) {
+  const data = message.getCustomData();
+  return (
+    <div role="alert" className="huddle-bubble">
+      <p>🟢 Huddle started by {resolveUserName(data.startedBy)}</p>
+      <button onClick={() => joinHuddle(data.sessionId)}>Join</button>
+    </div>
+  );
+}
+```
+
+---
+
+## Recording → channel post
+
+When the call ends and a recording was made, auto-post a link to the channel:
+
+```ts
+// Server-side: triggered by CometChat call-ended webhook
+app.post("/webhooks/call", async (req, res) => {
+  if (req.body.trigger === "call_ended" && req.body.data.recordingUrl) {
+    const { sessionId, recordingUrl } = req.body.data;
+    const groupGuid = sessionId.split("-").slice(0, 2).join("-").replace("huddle-", "");
+
+    // Post a custom message in the team's chat group
+    await cometchatApi.sendCustomMessage({
+      receiver: groupGuid,
+      receiverType: "group",
+      type: "huddle_recording",
+      data: {
+        recordingUrl,
+        durationSeconds: req.body.data.durationSeconds,
+      },
+    });
+  }
+  res.status(200).end();
+});
+```
+
+---
+
+## Anti-patterns
+
+1. **Force-ringing all team members.** Annoying — they might be focused. Use channel notification + opt-in join.
+2. **No screen-share quality config.** Default screen-share is 720p; for code review, bump to 1080p (`screenShareQuality: 'high'`).
+3. **Idle timeout too short.** Standup runs 35min, idle of 600s ends it during a debate. Use 1800s (30min).
+4. **Recording auto-on without team norms.** Some teams hate being recorded; surprise recording = trust hit. Default off; let team decide.
+5. **No way to invite outside team mid-call.** Sometimes you need to pull in a designer or PM. Don't hide share-invite for team calls.
+6. **Persistent sessions.** A "huddle" session that lasts forever bills forever. Auto-end when last person leaves.
+
+---
+
+## Auto-end on empty
+
+```ts
+// Subscribe to participant-left events; when count hits 0, end session
+let participantCount = 0;
+CometChatCalls.addEventListener("onParticipantJoined", () => participantCount++);
+CometChatCalls.addEventListener("onParticipantLeft", () => {
+  participantCount--;
+  if (participantCount === 0) {
+    CometChatCalls.endSession();
+  }
+});
+```
+
+---
+
+## Verification checklist
+
+- [ ] Mic + camera ON by default for joiners
+- [ ] Layout TILE, but switchable
+- [ ] Idle timeout 30min
+- [ ] "Huddle started" custom message + Join button in channel
+- [ ] Recording optional (not auto-on)
+- [ ] Recording auto-posted to channel as link if made
+- [ ] Auto-end when last participant leaves
+- [ ] Share-invite available for pulling in non-team members
+
+---
+
+## Pointers
+
+- `cometchat-react-calls/references/call-layouts.md` — TILE layout
+- `cometchat-react-calls/references/in-call-chat.md` — side chat
+- `cometchat-react-calls/references/screen-sharing.md` — for shared docs
+- `cometchat-react/SKILL.md` — group + custom message patterns

package/skills/cometchat-calls/references/use-case-telehealth.md

@@ -0,0 +1,154 @@
+# Use case — Telehealth (provider ↔ patient)
+
+A virtual visit between a healthcare provider and a patient. The shape: pre-call waiting room, provider initiates the call, video-first, screen-share for sharing labs/imaging, in-call chat for sending links, optional recording with explicit consent, post-call note-taking workflow.
+
+**Compliance:** HIPAA (US) + PIPEDA (CA) + GDPR (EU) — patient data in any form (incl. recording, screen-share content) is regulated. Telehealth integrations carry compliance risk that's outside CometChat's scope. Always:
+- Run a Business Associate Agreement (BAA) with CometChat
+- Run a separate BAA with your storage provider (S3, GCS) for recordings
+- Surface explicit consent UI before recording starts
+- Implement HIPAA-compliant audit logging
+
+**The architecture below is a reference shape — pair it with your legal/compliance review before shipping.**
+
+---
+
+## End-to-end flow
+
+```
+1. Patient books appointment in your scheduling system
+   ↓
+2. At appointment time, both join a "virtual waiting room"
+   (CometChat group keyed to appointment ID)
+   ↓
+3. Provider sees patient is waiting, clicks "Start visit"
+   → CometChat.initiateCall(patientUid, sessionId=appointmentId, type="video")
+   ↓
+4. Patient gets incoming call → accepts → in-call
+   ↓
+5. (Optional) Provider taps "Start recording" → consent prompt to patient
+   → only on patient accept does setRecordingOnCallStart fire
+   ↓
+6. (Optional) Provider screen-shares lab results
+   ↓
+7. (Optional) Provider opens in-call chat to send PDF/links
+   ↓
+8. Provider ends call → recording uploaded to your secure storage
+   → patient redirected to feedback form
+```
+
+---
+
+## Recommended call settings (web/RN)
+
+```ts
+import { CometChatCalls } from "@cometchat/calls-sdk-javascript";
+const settings = {
+  layout: "SPOTLIGHT",                   // Focus on the person speaking
+  hideChangeLayoutButton: true,           // Don't let user switch — calmer UX
+
+  hideRecordingButton: false,             // Provider needs it
+  startRecordingOnCallStart: false,       // NEVER auto-record without consent
+
+  hideScreenShareButton: false,           // Sharing labs is core
+  hideVirtualBackgroundButton: false,     // Patient often wants privacy
+
+  hideChatButton: false,                  // For sending links/PDFs
+  hideShareInviteButton: true,            // Patient ↔ provider only — no inviting
+  hideRaiseHandButton: true,              // 1:1 — no need
+
+  callIdleTime: 600,                      // 10min — long enough for thinking pauses
+};
+```
+
+---
+
+## Two-party consent recording
+
+Two-party-consent jurisdictions (CA, IL, FL, MD, MA, MT, NH, PA, WA + Canada + EU) require explicit consent from BOTH parties before recording starts. Implement a banner, not just a small "REC" indicator:
+
+```tsx
+function RecordingConsentBanner({ onAccept, onReject }: Props) {
+  return (
+    <div role="alertdialog" aria-labelledby="rec-title" className="rec-banner">
+      <h2 id="rec-title">Recording requested</h2>
+      <p>
+        Your provider would like to record this visit for medical records.
+        The recording will be stored securely and accessible to you in your
+        patient portal.
+      </p>
+      <button onClick={onAccept}>I consent to recording</button>
+      <button onClick={onReject}>I do not consent</button>
+    </div>
+  );
+}
+
+// Provider's "Start recording" button:
+async function requestRecording() {
+  // 1. Send a CometChat custom message asking for consent
+  await CometChat.sendCustomMessage(/* type: 'recording_request', target: patientUid */);
+  // 2. Wait for patient response (custom message back: 'recording_consent_granted')
+  // 3. ONLY THEN call CometChatCalls.startRecording()
+}
+```
+
+---
+
+## Waiting room pattern
+
+```tsx
+function WaitingRoom({ appointmentId }: Props) {
+  const [providerOnline, setProviderOnline] = useState(false);
+
+  useEffect(() => {
+    // Subscribe to the appointment group; provider's presence triggers visit start
+    const groupGuid = `appt-${appointmentId}`;
+    const listener = CometChat.addGroupMemberListener(/* fires when provider joins */);
+    return () => CometChat.removeGroupMemberListener(listener);
+  }, [appointmentId]);
+
+  return (
+    <div role="status" aria-live="polite">
+      {providerOnline ? <p>Your provider is ready. The visit will start shortly.</p>
+        : <p>Please wait. Your provider will be with you soon.</p>}
+      <button onClick={cancelVisit}>Leave waiting room</button>
+    </div>
+  );
+}
+```
+
+`role="status"` + `aria-live="polite"` so a screen reader announces the state change without interrupting (vs `assertive` which interrupts).
+
+---
+
+## Anti-patterns
+
+1. **Recording without explicit consent UI.** Two-party-consent law violation = lawsuit risk + HIPAA non-compliance.
+2. **Storing recordings in default S3.** Use a HIPAA-compliant tier with BAA + KMS encryption + audit logging.
+3. **No idle timeout.** Patient or provider walks away → call runs forever → bills + privacy concern (if recording).
+4. **Sharing PHI in call settings.** Don't put `patientName` in `callerName` — use opaque IDs in the SDK config; resolve display names client-side from your auth-gated user store.
+5. **Sending custom-message PII without encryption.** CometChat E2E encryption is opt-in (Extensions) — turn it on for telehealth.
+
+---
+
+## Verification checklist
+
+- [ ] BAA executed with CometChat
+- [ ] BAA executed with recording storage provider
+- [ ] Recording UX includes explicit consent prompt + audit log
+- [ ] Waiting room → call transition is automatic on provider initiate
+- [ ] Idle timeout 10min
+- [ ] Layout locked to SPOTLIGHT
+- [ ] Share-invite hidden (1:1 only)
+- [ ] No PII in SDK config or push payloads — only opaque IDs
+- [ ] HIPAA audit log captures: visit start/end, recording start/stop, screen-share start/stop, file send
+
+---
+
+## Pointers
+
+- `cometchat-react-calls/references/recording.md` — recording reference
+- `cometchat-react-calls/references/screen-sharing.md` — screen share
+- `cometchat-react-calls/references/in-call-chat.md` — link/file sending
+- `cometchat-react-calls/references/idle-timeout.md` — idle timeout config
+- `cometchat-production` skill — credential hygiene for sensitive integrations
+- `cometchat-react-extensions` — message encryption setup

package/skills/cometchat-components/SKILL.md

@@ -3,7 +3,7 @@ name: cometchat-components
 description: "Complete catalog of CometChat React UI Kit v6 components. Reference before writing integration code -- never invent component names."
 license: "MIT"
 compatibility: "@cometchat/chat-uikit-react ^6; @cometchat/chat-sdk-javascript ^4"
-allowed-tools: "executeBash, readFile, fileSearch, listDirectory"
+allowed-tools: "shell, file-read, file-search, file-list"
 metadata:
   author: "CometChat"
   version: "3.0.0"

package/skills/cometchat-core/SKILL.md

@@ -3,7 +3,7 @@ name: cometchat-core
 description: "Shared rules for CometChat React UI Kit v6. Always loaded alongside framework + placement skills. Read this first."
 license: "MIT"
 compatibility: "Node.js >=18; React >=18; @cometchat/chat-uikit-react ^6; @cometchat/chat-sdk-javascript ^4"
-allowed-tools: "executeBash, readFile, fileSearch, listDirectory"
+allowed-tools: "shell, file-read, file-search, file-list"
 metadata:
   author: "CometChat"
   version: "3.0.0"