@humanbased/crosscheck 1.2.0-beta.80 → 1.2.0

package/assets/skills/code-review-skill/SKILL.md

@@ -1,231 +0,0 @@
----
-name: code-review-skill
-description: |
-  Provides comprehensive code review guidance for React 19, Vue 3, Angular 17+, Svelte 5,
-  Rust, TypeScript, Java, Java 8, PHP, Ruby, Rails, Python, Django, FastAPI, Go, C#/.NET, Kotlin, Swift,
-  NestJS, C/C++, Zig, CSS/Less/Sass, Qt, and more.
-  Covers architecture review, performance review, security audit, code quality anti-patterns,
-  and common bugs across all ecosystems.
-  Use when: reviewing pull requests, conducting PR reviews, code review, reviewing code changes,
-  establishing review standards, mentoring developers, architecture reviews, security audits,
-  performance reviews, checking code quality, finding bugs, giving feedback on code.
-allowed-tools:
-  - Read
-  - Grep
-  - Glob
-  - Bash      # 运行 lint/test/build 命令验证代码质量
-  - WebFetch  # 查阅最新文档和最佳实践
----
-
-# Code Review Skill
-
-Transform code reviews from gatekeeping to knowledge sharing through constructive feedback, systematic analysis, and collaborative improvement.
-
-## When to Use This Skill
-
-- Reviewing pull requests and code changes
-- Establishing code review standards for teams
-- Mentoring junior developers through reviews
-- Conducting architecture reviews
-- Creating review checklists and guidelines
-- Improving team collaboration
-- Reducing code review cycle time
-- Maintaining code quality standards
-
-## Core Principles
-
-### 1. The Review Mindset
-
-**Goals of Code Review:**
-- Catch bugs and edge cases
-- Ensure code maintainability
-- Share knowledge across team
-- Enforce coding standards
-- Improve design and architecture
-- Build team culture
-
-**Not the Goals:**
-- Show off knowledge
-- Nitpick formatting (use linters)
-- Block progress unnecessarily
-- Rewrite to your preference
-
-### 2. Effective Feedback
-
-**Good Feedback is:**
-- Specific and actionable
-- Educational, not judgmental
-- Focused on the code, not the person
-- Balanced (praise good work too)
-- Prioritized (critical vs nice-to-have)
-
-```markdown
-❌ Bad: "This is wrong."
-✅ Good: "This could cause a race condition when multiple users
-         access simultaneously. Consider using a mutex here."
-
-❌ Bad: "Why didn't you use X pattern?"
-✅ Good: "Have you considered the Repository pattern? It would
-         make this easier to test. Here's an example: [link]"
-
-❌ Bad: "Rename this variable."
-✅ Good: "[nit] Consider `userCount` instead of `uc` for
-         clarity. Not blocking if you prefer to keep it."
-```
-
-### 3. Review Scope
-
-**What to Review:**
-- Logic correctness and edge cases
-- Security vulnerabilities
-- Performance implications
-- Test coverage and quality
-- Error handling
-- Documentation and comments
-- API design and naming
-- Architectural fit
-
-**What Not to Review Manually:**
-- Code formatting (use Prettier, Black, etc.)
-- Import organization
-- Linting violations
-- Simple typos
-
-## Review Process
-
-### Phase 1: Context Gathering (2-3 minutes)
-
-Before diving into code, understand:
-1. Read PR description and linked issue
-2. Check PR size (>400 lines? Ask to split)
-3. Review CI/CD status (tests passing?)
-4. Understand the business requirement
-5. Note any relevant architectural decisions
-
-> For large diffs, pipe the diff through [`scripts/pr-analyzer.py`](scripts/pr-analyzer.py) (`git diff main...HEAD | python scripts/pr-analyzer.py`) to triage complexity and get a suggested review approach before reading.
-
-### Phase 2: High-Level Review (5-10 minutes)
-
-1. **Architecture & Design** - Does the solution fit the problem?
-   - For significant changes, consult [Architecture Review Guide](reference/architecture-review-guide.md)
-   - Check: SOLID principles, coupling/cohesion, anti-patterns
-2. **Performance Assessment** - Are there performance concerns?
-   - For performance-critical code, consult [Performance Review Guide](reference/performance-review-guide.md)
-   - Check: Algorithm complexity, N+1 queries, memory usage
-3. **File Organization** - Are new files in the right places?
-4. **Testing Strategy** - Are there tests covering edge cases?
-
-### Phase 3: Line-by-Line Review (10-20 minutes)
-
-For each file, check:
-- **Logic & Correctness** - Edge cases, off-by-one, null checks, race conditions
-- **Security** - Input validation, injection risks, XSS, sensitive data
-- **Performance** - N+1 queries, unnecessary loops, memory leaks
-- **Maintainability** - Clear names, single responsibility, comments
-- **Reuse** - Before accepting new code, search for existing utilities/helpers that could replace it. Check adjacent files and shared modules for similar patterns. See [Universal Quality Guide](reference/code-quality-universal.md) for anti-patterns like parameter sprawl, leaky abstractions, nested conditionals, stringly-typed code, TOCTOU, and no-op updates.
-
-### Phase 4: Summary & Decision (2-3 minutes)
-
-1. Summarize key concerns
-2. Highlight what you liked
-3. Make clear decision:
-   - ✅ Approve
-   - 💬 Comment (minor suggestions)
-   - 🔄 Request Changes (must address)
-4. Offer to pair if complex
-
-## Review Techniques
-
-### Technique 1: The Checklist Method
-
-Use checklists for consistent reviews. See [Security Review Guide](reference/security-review-guide.md) for comprehensive security checklist.
-
-### Technique 2: The Question Approach
-
-Instead of stating problems, ask questions:
-
-```markdown
-❌ "This will fail if the list is empty."
-✅ "What happens if `items` is an empty array?"
-
-❌ "You need error handling here."
-✅ "How should this behave if the API call fails?"
-```
-
-### Technique 3: Suggest, Don't Command
-
-Use collaborative language:
-
-```markdown
-❌ "You must change this to use async/await"
-✅ "Suggestion: async/await might make this more readable. What do you think?"
-
-❌ "Extract this into a function"
-✅ "This logic appears in 3 places. Would it make sense to extract it?"
-```
-
-### Technique 4: Differentiate Severity
-
-Use labels to indicate priority:
-
-- 🔴 `[blocking]` - Must fix before merge
-- 🟡 `[important]` - Should fix, discuss if disagree
-- 🟢 `[nit]` - Nice to have, not blocking
-- 💡 `[suggestion]` - Alternative approach to consider
-- 📚 `[learning]` - Educational comment, no action needed
-- 🎉 `[praise]` - Good work, keep it up!
-
-**Severity levels:** 🔴 / 🟡 / 🟢 are the three severity tiers used as the standard across all guides in this skill — 🔴 blocks the merge, 🟡 should be addressed, 🟢 is optional. The remaining markers (💡 / 📚 / 🎉) are non-blocking annotations.
-
-## Language-Specific Guides
-
-根据审查的代码语言，查阅对应的详细指南：
-
-| Language/Framework | Reference File | Key Topics |
-|-------------------|----------------|------------|
-| **React** | [React Guide](reference/react.md) | Hooks, useEffect, React 19 Actions, RSC, Suspense, TanStack Query v5 |
-| **Vue 3** | [Vue Guide](reference/vue.md) | Composition API, 响应性系统, Props/Emits, Watchers, Composables |
-| **Angular 17+** | [Angular Guide](reference/angular.md) | Signals, Standalone, RxJS, Zoneless, 模板优化, 测试, 路由守卫, HttpInterceptor |
-| **Rust** | [Rust Guide](reference/rust.md) | 所有权/借用, Unsafe 审查, 异步代码, 取消安全性, 错误处理 |
-| **TypeScript** | [TypeScript Guide](reference/typescript.md) | 类型安全, async/await, 不可变性, 测试, 模块解析, TS 5.x |
-| **Python** | [Python Guide](reference/python.md) | 可变默认参数, 异常处理, 类属性 |
-| **Django / DRF** | [Django Guide](reference/django.md) | 安全审查, N+1 查询, Serializer 反模式, ViewSet, 异步视图 |
-| **FastAPI** | [FastAPI Guide](reference/fastapi.md) | Depends, Pydantic v2 validation, async correctness, sessions/N+1, auth vs authorization, test-driven verification |
-| **Java** | [Java Guide](reference/java.md) | Java 17/21 新特性, Spring Boot 3, 虚拟线程, Stream/Optional |
-| **Java 8 / Legacy** | [Java 8 Guide](reference/java8.md) | Java 8, Spring Boot 2, javax.*, Stream/Optional, java.time, CompletableFuture |
-| **PHP** | [PHP Guide](reference/php.md) | PHP 8.x type system, PDO, security review, Composer, PHPUnit/PHPStan |
-| **Ruby / Rails** | [Ruby Guide](reference/ruby.md) | Ruby semantics, Rails 8, Active Record, Active Job, security, testing |
-| **C# / .NET** | [C# Guide](reference/csharp.md) | C# 12 特性, 异步编程, EF Core 性能, ASP.NET Core, LINQ |
-| **Go** | [Go Guide](reference/go.md) | 错误处理, goroutine/channel, context, 接口设计 |
-| **Kotlin / Android** | [Kotlin Guide](reference/kotlin.md) | 协程, Flow, Jetpack Compose, 空安全, 内存泄漏, 架构模式 |
-| **Swift / SwiftUI** | [Swift Guide](reference/swift.md) | Optionals, Swift Concurrency, Sendable/actors, SwiftUI property wrappers, value vs reference types, API design |
-| **NestJS** | [NestJS Guide](reference/nestjs.md) | 依赖注入, 分层架构, DTO 验证, Guard/Interceptor, 循环依赖 |
-| **Svelte / SvelteKit** | [Svelte Guide](reference/svelte.md) | Runes, Load 函数, Form Actions, Store 迁移, SSR/CSR 边界 |
-| **C** | [C Guide](reference/c.md) | 指针/缓冲区, 内存安全, UB, 安全编码, 可移植性, 测试 |
-| **C++** | [C++ Guide](reference/cpp.md) | RAII, 智能指针, C++20/23, constexpr, 测试 |
-| **Zig** | [Zig Guide](reference/zig.md) | Allocators, error unions, defer/errdefer, comptime, C interop |
-| **CSS/Less/Sass** | [CSS Guide](reference/css-less-sass.md) | 变量规范, !important, 性能优化, 响应式, 兼容性 |
-| **Qt** | [Qt Guide](reference/qt.md) | 对象模型, 信号/槽, Model/View, QML, Qt6 迁移, 测试 |
-
-## Cross-Cutting Guides
-
-Language-agnostic patterns applicable to all code reviews:
-
-| Topic | Reference File | Key Topics |
-|-------|----------------|------------|
-| **Architecture Review** | [Architecture Review Guide](reference/architecture-review-guide.md) | SOLID, anti-patterns, coupling/cohesion, dependency direction |
-| **Performance Review** | [Performance Review Guide](reference/performance-review-guide.md) | Web Vitals, N+1, algorithm complexity, memory leaks, caching |
-| **Security Review** | [Security Review Guide](reference/security-review-guide.md) | SQLi, XSS, CSRF, SSRF, IDOR, 命令注入, 跨语言示例 |
-| **Universal Quality** | [Universal Quality Guide](reference/code-quality-universal.md) | Reuse audit, parameter sprawl, leaky abstractions, nested conditionals, stringly-typed code, TOCTOU, no-op updates, redundant state |
-| **Common Bugs** | [Common Bugs Checklist](reference/common-bugs-checklist.md) | Language-specific bug patterns, common pitfalls |
-| **SQL Injection Prevention** | [SQL Injection Guide](reference/cross-cutting/sql-injection-prevention.md) | Parameterized queries, ORM safety, 6 languages, dynamic identifiers, detection |
-| **XSS Prevention** | [XSS Prevention Guide](reference/cross-cutting/xss-prevention.md) | Output encoding, CSP, 5 frameworks, input validation vs encoding, detection |
-| **N+1 Queries** | [N+1 Queries Guide](reference/cross-cutting/n-plus-one-queries.md) | Eager loading, batch fetching, DataLoader, 5 languages, detection |
-| **Error Handling** | [Error Handling Guide](reference/cross-cutting/error-handling-principles.md) | Fail fast, error hierarchy, 7 languages, anti-patterns, logging |
-| **Async & Concurrency** | [Concurrency Guide](reference/cross-cutting/async-concurrency-patterns.md) | Goroutines, async/await, actors, structured concurrency, 7 languages |
-| **Review Best Practices** | [Code Review Best Practices](reference/code-review-best-practices.md) | Communication, reviewer mindset, giving feedback, severity labels |
-
-## Additional Resources
-
-- [PR Review Template](assets/pr-review-template.md) - PR 审查评论模板
-- [Review Checklist](assets/review-checklist.md) - 快速参考清单

package/assets/skills/code-review-skill/assets/pr-review-template.md

@@ -1,137 +0,0 @@
-# PR Review Template
-
-Copy and use this template for your code reviews.
-
----
-
-## Summary
-
-[Brief overview of what was reviewed - 1-2 sentences]
-
-**PR Size:** [Small/Medium/Large] (~X lines)
-**Review Time:** [X minutes]
-
-## Strengths
-
-- [What was done well]
-- [Good patterns or approaches used]
-- [Improvements from previous code]
-
-## Architecture & Performance
-
-**Architecture Assessment**
-- [ ] Separation of concerns — are responsibilities clearly divided?
-- [ ] Module responsibilities — does each module have a single purpose?
-- [ ] Dependency direction — do dependencies flow toward stability?
-- [ ] Consistent with existing patterns and conventions
-
-> See [Architecture Review Guide](../reference/architecture-review-guide.md) for detailed SOLID, anti-pattern, and coupling analysis.
-
-**Performance Assessment**
-- [ ] Algorithm complexity — any O(n²) or worse on large inputs?
-- [ ] Memory impact — large allocations, leaks, unbounded growth?
-- [ ] I/O impact — excessive API calls, unbatched writes, missing caching?
-- [ ] Database queries — N+1 risks, missing indexes, unoptimized joins?
-
-> See [Performance Review Guide](../reference/performance-review-guide.md) for comprehensive Web Vitals, N+1, and caching guidance.
-
-## Required Changes
-
-🔴 **[blocking]** [Issue description]
-> [Code location or example]
-> [Suggested fix or explanation]
-
-🔴 **[blocking]** [Issue description]
-> [Details]
-
-## Important Suggestions
-
-🟡 **[important]** [Issue description]
-> [Why this matters]
-> [Suggested approach]
-
-## Minor Suggestions
-
-🟢 **[nit]** [Minor improvement suggestion]
-
-💡 **[suggestion]** [Alternative approach to consider]
-
-## Learning Notes
-
-📚 [Educational context worth sharing about X]
-
-📚 [Background behind design decision Y]
-
-## Security Considerations
-
-- [ ] No hardcoded secrets
-- [ ] Input validation present
-- [ ] Authorization checks in place
-- [ ] No SQL/XSS injection risks
-- [ ] CSRF protection for state-changing operations
-- [ ] Sensitive data not leaked in logs/errors
-- [ ] Dependency vulnerabilities checked (npm audit / pip audit / cargo audit)
-
-> See [Security Review Guide](../reference/security-review-guide.md) for comprehensive injection, XSS, CSRF, secrets, and auth checklist.
-
-## Test Coverage
-
-- [ ] Unit tests added/updated
-- [ ] Edge cases covered
-- [ ] Error cases tested
-
-## Verdict
-
-**[ ] ✅ Approve** - Ready to merge
-**[ ] 💬 Comment** - Minor suggestions, can merge
-**[ ] 🔄 Request Changes** - Must address blocking issues
-
----
-
-## Quick Copy Templates
-
-### Blocking Issue
-```
-🔴 **[blocking]** [Title]
-
-[Description of the issue]
-
-**Location:** `file.ts:123`
-
-**Suggested fix:**
-\`\`\`typescript
-// Your suggested code
-\`\`\`
-```
-
-### Important Suggestion
-```
-🟡 **[important]** [Title]
-
-[Why this is important]
-
-**Consider:**
-- Option A: [description]
-- Option B: [description]
-```
-
-### Minor Suggestion
-```
-🟢 **[nit]** [Suggestion]
-
-Not blocking, but consider [improvement].
-```
-
-### Praise
-```
-🎉 **[praise]** Great work on [specific thing]!
-
-[Why this is good]
-```
-
-### Learning
-```
-📚 **[learning]** [Educational note]
-
-For context, [X] works this way because [Y]. No action needed — just sharing.
-```

package/assets/skills/code-review-skill/assets/review-checklist.md

@@ -1,123 +0,0 @@
-# Code Review Quick Checklist
-
-Quick reference checklist for code reviews.
-
-## Pre-Review (2 min)
-
-- [ ] Read PR description and linked issue
-- [ ] Check PR size (<400 lines ideal)
-- [ ] Verify CI/CD status (tests passing?)
-- [ ] Understand the business requirement
-
-## Architecture & Design (5 min)
-
-- [ ] Solution fits the problem
-- [ ] Consistent with existing patterns
-- [ ] No simpler approach exists
-- [ ] Will it scale?
-- [ ] Changes in right location
-
-## Logic & Correctness (10 min)
-
-- [ ] Edge cases handled
-- [ ] Null/undefined checks present
-- [ ] Off-by-one errors checked
-- [ ] Race conditions considered
-- [ ] Error handling complete
-- [ ] Correct data types used
-
-## Security (5 min)
-
-- [ ] No hardcoded secrets
-- [ ] Input validated/sanitized
-- [ ] SQL injection prevented
-- [ ] XSS prevented
-- [ ] Authorization checks present
-- [ ] Sensitive data protected
-
-## Performance (3 min)
-
-- [ ] No N+1 queries
-- [ ] Expensive operations optimized
-- [ ] Large lists paginated
-- [ ] No memory leaks
-- [ ] Caching considered where appropriate
-
-## Testing (5 min)
-
-- [ ] Tests exist for new code
-- [ ] Edge cases tested
-- [ ] Error cases tested
-- [ ] Tests are readable
-- [ ] Tests are deterministic
-
-## Code Quality (3 min)
-
-- [ ] Clear variable/function names
-- [ ] No code duplication
-- [ ] Functions do one thing
-- [ ] Complex code commented
-- [ ] No magic numbers
-
-## Documentation (2 min)
-
-- [ ] Public APIs documented
-- [ ] README updated if needed
-- [ ] Breaking changes noted
-- [ ] Complex logic explained
-
----
-
-## Severity Labels
-
-| Label | Meaning | Action |
-|-------|---------|--------|
-| 🔴 `[blocking]` | Must fix | Block merge |
-| 🟡 `[important]` | Should fix | Discuss if disagree |
-| 🟢 `[nit]` | Nice to have | Non-blocking |
-| 💡 `[suggestion]` | Alternative | Consider |
-| 📚 `[learning]` | Educational comment | No action needed |
-| 🎉 `[praise]` | Good work | Celebrate! |
-
----
-
-## Decision Matrix
-
-| Situation | Decision |
-|-----------|----------|
-| Critical security issue | 🔴 Block, fix immediately |
-| Breaking change without migration | 🔴 Block |
-| Missing error handling | 🟡 Should fix |
-| No tests for new code | 🟡 Should fix |
-| Style preference | 🟢 Non-blocking |
-| Minor naming improvement | 🟢 Non-blocking |
-| Clever but working code | 💡 Suggest simpler |
-
----
-
-## Time Budget
-
-This checklist is designed for a **lightweight quick review**. For comprehensive reviews covering architecture and performance analysis, use the full four-phase process in [SKILL.md](../SKILL.md) (19–36 minutes). Smaller PRs trend toward the lower end of each phase; larger PRs toward the upper end.
-
-| PR Size | Quick Review | Full Review (4-phase) |
-|---------|-------------|----------------------|
-| < 100 lines | 10–15 min | ~19–28 min |
-| 100–400 lines | 20–40 min | ~28–36 min |
-| > 400 lines | Ask to split | Ask to split |
-
----
-
-## Red Flags
-
-Watch for these patterns:
-
-- `// TODO` in production code
-- `console.log` left in code
-- Commented out code
-- `any` type in TypeScript
-- Empty catch blocks
-- `unwrap()` in Rust production code
-- Magic numbers/strings
-- Copy-pasted code blocks
-- Missing null checks
-- Hardcoded URLs/credentials