@longph2102/v-flow 1.5.0

package/skills/prototype/scripts/check-prototype-cleanup.sh

@@ -0,0 +1,109 @@
+#!/bin/bash
+# check-prototype-cleanup.sh — Kiểm tra prototype code đã được cleanup chưa
+# Usage: ./check-prototype-cleanup.sh <feature-number>
+#        ./check-prototype-cleanup.sh 005
+#
+# Rule: Sau khi có verdict, thư mục prototype/ nên được xóa.
+#       Chỉ prototype-notes.md là được phép còn lại.
+
+FEATURE_NUM="${1}"
+
+if [ -z "$FEATURE_NUM" ]; then
+  # Auto-detect: tìm feature có prototype-notes.md
+  ALL_FEATURES=$(ls -d .v-flow/features/*/ 2>/dev/null)
+  if [ -z "$ALL_FEATURES" ]; then
+    echo "❌ No feature directories found under .v-flow/features/"
+    exit 1
+  fi
+  # Scan tất cả features
+  FOUND_ANY=0
+  TOTAL_ERRORS=0
+
+  for FEATURE_DIR in $ALL_FEATURES; do
+    PROTOTYPE_DIR="${FEATURE_DIR}prototype/"
+    NOTES_FILE="${FEATURE_DIR}prototype-notes.md"
+
+    if [ -f "$NOTES_FILE" ] && [ -d "$PROTOTYPE_DIR" ]; then
+      FOUND_ANY=1
+      echo "⚠️  STALE PROTOTYPE DETECTED: $FEATURE_DIR"
+      echo "   prototype-notes.md exists (verdict captured) BUT prototype/ folder still present"
+      echo "   Files in prototype/:"
+      ls "$PROTOTYPE_DIR" | sed 's/^/     - /'
+      echo "   → Run: rm -rf ${PROTOTYPE_DIR}"
+      TOTAL_ERRORS=$((TOTAL_ERRORS+1))
+    elif [ -d "$PROTOTYPE_DIR" ] && [ ! -f "$NOTES_FILE" ]; then
+      FOUND_ANY=1
+      echo "⚠️  PROTOTYPE WITHOUT NOTES: $FEATURE_DIR"
+      echo "   prototype/ folder exists but prototype-notes.md is missing"
+      echo "   → Capture verdict first, then cleanup"
+      TOTAL_ERRORS=$((TOTAL_ERRORS+1))
+    fi
+  done
+
+  if [ "$FOUND_ANY" -eq 0 ]; then
+    echo "✅ No active prototype directories found — all clean"
+    exit 0
+  fi
+
+  echo ""
+  echo "📊 Total issues: $TOTAL_ERRORS"
+  [ "$TOTAL_ERRORS" -gt 0 ] && exit 1 || exit 0
+fi
+
+# Single feature mode
+PADDED=$(printf "%03d" "$FEATURE_NUM" 2>/dev/null || echo "$FEATURE_NUM")
+FEATURE_DIR=$(ls -d .v-flow/features/${PADDED}-*/ 2>/dev/null | head -1)
+if [ -z "$FEATURE_DIR" ]; then
+  FEATURE_DIR=".v-flow/features/${FEATURE_NUM}/"
+fi
+
+PROTOTYPE_DIR="${FEATURE_DIR}prototype/"
+NOTES_FILE="${FEATURE_DIR}prototype-notes.md"
+
+echo "📋 Prototype Cleanup Check: $FEATURE_DIR"
+echo "══════════════════════════════════════════"
+ERRORS=0
+
+# Check 1: prototype/ còn tồn tại không
+echo ""
+echo "### 1. Prototype Directory"
+if [ ! -d "$PROTOTYPE_DIR" ]; then
+  echo "   ✅ prototype/ directory not found — already cleaned up"
+else
+  if [ -f "$NOTES_FILE" ]; then
+    echo "   ❌ prototype/ still exists after verdict was captured"
+    echo "   Files:"
+    ls "$PROTOTYPE_DIR" | sed 's/^/     - /'
+    echo ""
+    echo "   → To cleanup:"
+    echo "     rm -rf ${PROTOTYPE_DIR}"
+    ERRORS=$((ERRORS+1))
+  else
+    echo "   ⚠️  prototype/ exists but no prototype-notes.md yet"
+    echo "      → Capture verdict first before cleanup"
+    ERRORS=$((ERRORS+1))
+  fi
+fi
+
+# Check 2: prototype-notes.md tồn tại
+echo ""
+echo "### 2. Prototype Notes (the one thing to keep)"
+if [ -f "$NOTES_FILE" ]; then
+  echo "   ✅ prototype-notes.md present"
+  SIZE=$(wc -c < "$NOTES_FILE" | tr -d ' ')
+  [ "$SIZE" -lt 200 ] && echo "   ⚠️  File is very small (${SIZE} bytes) — may be incomplete" && ERRORS=$((ERRORS+1))
+else
+  echo "   ⚠️  prototype-notes.md not found"
+  echo "      → If prototype is done, create notes before deleting prototype/"
+fi
+
+echo ""
+echo "══════════════════════════════════════════"
+echo "📊 Errors: $ERRORS"
+if [ "$ERRORS" -eq 0 ]; then
+  echo "✅ PASS — prototype cleanup complete"
+  exit 0
+else
+  echo "❌ FAIL — cleanup needed"
+  exit 1
+fi

package/skills/prototype/scripts/check-prototype-notes.ps1

@@ -0,0 +1,107 @@
+# check-prototype-notes.ps1 — Validate prototype-notes.md có đủ required fields
+# Usage: .\check-prototype-notes.ps1 [<prototype-notes.md path>]
+#
+# Checks: required fields, verdict value, REQ refs, spec impact, routing
+
+param(
+    [string]$Notes = ""
+)
+
+# Resolve path
+if (-not $Notes) {
+    $found = Get-Item ".v-flow/features/*/prototype-notes.md" -ErrorAction SilentlyContinue | Select-Object -First 1
+    if ($found) { $Notes = $found.FullName }
+}
+
+if (-not $Notes -or -not (Test-Path $Notes)) {
+    Write-Host "❌ File not found: $Notes" -ForegroundColor Red
+    Write-Host "   Usage: .\check-prototype-notes.ps1 <path/to/prototype-notes.md>"
+    exit 1
+}
+
+$content = Get-Content $Notes -Raw
+Write-Host "📋 Prototype Notes Compliance Check: $Notes"
+Write-Host "════════════════════════════════════════════"
+$errors   = 0
+$warnings = 0
+
+# 1. Required fields
+Write-Host ""
+Write-Host "### 1. Required Fields"
+$requiredFields = @("Branch", "Question", "Verdict", "REQ refs", "Spec impact", "Routing")
+foreach ($field in $requiredFields) {
+    if ($content -match "(?i)$field") {
+        Write-Host "   ✅ '$field' present" -ForegroundColor Green
+    } else {
+        Write-Host "   ❌ '$field' MISSING" -ForegroundColor Red
+        $errors++
+    }
+}
+
+# 2. Verdict value phải hợp lệ
+Write-Host ""
+Write-Host "### 2. Verdict Value"
+if ($content -match "(?i)(VALIDATED|REJECTED|INCONCLUSIVE)") {
+    $verdict = $Matches[1].ToUpper()
+    Write-Host "   ✅ Verdict: $verdict" -ForegroundColor Green
+} else {
+    Write-Host "   ❌ No valid verdict found (must be VALIDATED | REJECTED | INCONCLUSIVE)" -ForegroundColor Red
+    $errors++
+}
+
+# 3. REQ refs có format đúng không
+Write-Host ""
+Write-Host "### 3. REQ References"
+$reqMatches = [regex]::Matches($content, "REQ-[UESO]\d+")
+if ($reqMatches.Count -eq 0) {
+    Write-Host "   ⚠️  No REQ-xxx references found (should link to spec requirements)" -ForegroundColor Yellow
+    $warnings++
+} else {
+    $unique = $reqMatches | ForEach-Object { $_.Value } | Sort-Object -Unique
+    Write-Host "   ✅ REQ refs found: $($reqMatches.Count) ($($unique -join ', '))" -ForegroundColor Green
+}
+
+# 4. Run command documented
+Write-Host ""
+Write-Host "### 4. Run Command"
+if ($content -match "(?i)(run command|cách chạy|npm run|pnpm|tsx|python|bun)") {
+    Write-Host "   ✅ Run command documented" -ForegroundColor Green
+} else {
+    Write-Host "   ⚠️  No run command found (user needs to know how to start the prototype)" -ForegroundColor Yellow
+    $warnings++
+}
+
+# 5. Kết quả interact (evidence for verdict)
+Write-Host ""
+Write-Host "### 5. Interact Evidence"
+if ($content -match "(?i)(\[x\]|\[✓\]|✅|✔|case|test|interact|kết quả|result|finding)") {
+    Write-Host "   ✅ Interact results present" -ForegroundColor Green
+} else {
+    Write-Host "   ⚠️  No evidence of user interaction (verdict without evidence is unreliable)" -ForegroundColor Yellow
+    $warnings++
+}
+
+# 6. Cleanup checklist
+Write-Host ""
+Write-Host "### 6. Cleanup Checklist"
+if ($content -match "(?i)(cleanup|flow-state|_session|prototype/)") {
+    Write-Host "   ✅ Cleanup references present" -ForegroundColor Green
+} else {
+    Write-Host "   ⚠️  No cleanup checklist (flow-state.yaml, _session.md may not be updated)" -ForegroundColor Yellow
+    $warnings++
+}
+
+Write-Host ""
+Write-Host "════════════════════════════════════════════"
+Write-Host "📊 Errors: $errors | Warnings: $warnings"
+
+if ($errors -eq 0 -and $warnings -eq 0) {
+    Write-Host "✅ PASS — prototype-notes.md is complete" -ForegroundColor Green
+    exit 0
+} elseif ($errors -eq 0) {
+    Write-Host "⚠️  PASS WITH WARNINGS — review warnings before routing to next phase" -ForegroundColor Yellow
+    exit 0
+} else {
+    Write-Host "❌ FAIL — fix $errors error(s) before continuing pipeline" -ForegroundColor Red
+    exit 1
+}

package/skills/prototype/scripts/check-prototype-notes.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# check-prototype-notes.sh — Validate prototype-notes.md có đủ required fields
+# Usage: ./check-prototype-notes.sh <prototype-notes.md path>
+#
+# Checks: required fields, verdict value, REQ refs, spec impact, routing
+
+NOTES="${1:-.v-flow/features/*/prototype-notes.md}"
+
+# Nếu dùng glob, lấy file đầu tiên tìm được
+if [[ "$NOTES" == *"*"* ]]; then
+  NOTES=$(ls .v-flow/features/*/prototype-notes.md 2>/dev/null | head -1)
+fi
+
+if [ ! -f "$NOTES" ]; then
+  echo "❌ File not found: $NOTES"
+  echo "   Usage: $0 <path/to/prototype-notes.md>"
+  exit 1
+fi
+
+echo "📋 Prototype Notes Compliance Check: $NOTES"
+echo "════════════════════════════════════════════"
+ERRORS=0
+WARNINGS=0
+
+# 1. Required fields
+echo ""
+echo "### 1. Required Fields"
+REQUIRED_FIELDS=("Branch" "Question" "Verdict" "REQ refs" "Spec impact" "Routing")
+for field in "${REQUIRED_FIELDS[@]}"; do
+  if grep -qi "$field" "$NOTES"; then
+    echo "   ✅ '$field' present"
+  else
+    echo "   ❌ '$field' MISSING"
+    ERRORS=$((ERRORS+1))
+  fi
+done
+
+# 2. Verdict value phải hợp lệ
+echo ""
+echo "### 2. Verdict Value"
+VERDICT=$(grep -i "verdict" "$NOTES" | grep -oiE "VALIDATED|REJECTED|INCONCLUSIVE" | head -1)
+if [ -z "$VERDICT" ]; then
+  echo "   ❌ No valid verdict found (must be VALIDATED | REJECTED | INCONCLUSIVE)"
+  ERRORS=$((ERRORS+1))
+else
+  echo "   ✅ Verdict: $VERDICT"
+fi
+
+# 3. REQ refs có format đúng không
+echo ""
+echo "### 3. REQ References"
+REQ_COUNT=$(grep -oE "REQ-[UESO][0-9]+" "$NOTES" | wc -l | tr -d ' ')
+if [ "$REQ_COUNT" -eq 0 ]; then
+  echo "   ⚠️  No REQ-xxx references found (should link to spec requirements)"
+  WARNINGS=$((WARNINGS+1))
+else
+  echo "   ✅ REQ refs found: $REQ_COUNT ($(grep -oE 'REQ-[UESO][0-9]+' "$NOTES" | sort -u | tr '\n' ' '))"
+fi
+
+# 4. Run command documented
+echo ""
+echo "### 4. Run Command"
+if grep -qiE "(run command|cách chạy|npm run|pnpm|tsx|python|bun)" "$NOTES"; then
+  echo "   ✅ Run command documented"
+else
+  echo "   ⚠️  No run command found (user needs to know how to start the prototype)"
+  WARNINGS=$((WARNINGS+1))
+fi
+
+# 5. Kết quả interact (evidence for verdict)
+echo ""
+echo "### 5. Interact Evidence"
+if grep -qiE "(\[x\]|\[✓\]|✅|✔|case|test|interact|kết quả|result|finding)" "$NOTES"; then
+  echo "   ✅ Interact results present"
+else
+  echo "   ⚠️  No evidence of user interaction (verdict without evidence is unreliable)"
+  WARNINGS=$((WARNINGS+1))
+fi
+
+# 6. Cleanup checklist
+echo ""
+echo "### 6. Cleanup Checklist"
+if grep -qiE "(cleanup|flow-state|_session|prototype/)" "$NOTES"; then
+  echo "   ✅ Cleanup references present"
+else
+  echo "   ⚠️  No cleanup checklist (flow-state.yaml, _session.md may not be updated)"
+  WARNINGS=$((WARNINGS+1))
+fi
+
+echo ""
+echo "════════════════════════════════════════════"
+echo "📊 Errors: $ERRORS | Warnings: $WARNINGS"
+if [ "$ERRORS" -eq 0 ] && [ "$WARNINGS" -eq 0 ]; then
+  echo "✅ PASS — prototype-notes.md is complete"
+  exit 0
+elif [ "$ERRORS" -eq 0 ]; then
+  echo "⚠️  PASS WITH WARNINGS — review warnings before routing to next phase"
+  exit 0
+else
+  echo "❌ FAIL — fix $ERRORS error(s) before continuing pipeline"
+  exit 1
+fi

package/skills/review/adversarial-reviewer/SKILL.md

@@ -0,0 +1,137 @@
+---
+name: adversarial-reviewer
+description: "Hướng dẫn Review Agent tìm issues trong code. Agent PHẢI đọc skill này khi /v.review được gọi. Review đủ 5 chiều có bằng chứng — không ép số lượng issue, KHÔNG LGTM trống."
+trigger: "Khi /v.review được gọi"
+phase: "R.1"
+used_by:
+  - /v.review
+---
+
+# Adversarial Reviewer — Review Không Nhân Nhượng
+
+> ⚠️ Đây là **Skill bắt buộc** cho Review Agent.
+> QUAN TRỌNG: Bắt buộc **review đủ 5 chiều có bằng chứng** — KHÔNG ép số lượng issue. "LGTM"/"Looks good" trống (không bằng chứng) BỊ CẤM; "no material findings" hợp lệ nếu kèm residual risk + test gap.
+>
+> → Xem `gotchas.md` cho issues hay gặp nhất (historical data).
+> → Xem `examples/good/` cho mẫu review report chuẩn.
+> → Xem `config.json` để customize (min_issues, review_depth).
+> → Chạy `.v-flow/skills/review/adversarial-reviewer/scripts/quick-security-scan.sh <dir>` để pre-scan trước review.
+
+---
+
+## Khi nào review KHÁC
+
+- **Quick Fix** (`/v.quickfix`): Vẫn review đủ chiều nhưng scope nhỏ hơn.
+- **Hotfix** (`/v.hotfix`): Focus correctness + security only. Có thể ≤3 nếu scope rất nhỏ.
+
+---
+
+## 5 Chiều Review — Pattern Detection
+
+> 💡 Phần này cung cấp **signals để tìm issues**, không phải step-by-step.
+> Agent tự quyết thứ tự và depth dựa trên feature.
+
+### 1. 🎯 Correctness — Code vs Spec alignment
+
+**Signals cần tìm:**
+- Function behavior khớp REQ-xxx description? → So sánh spec → code
+- Edge cases trong test-cases.md có test code tương ứng?  
+- Return types/error codes match expected?
+- Off-by-one errors (>, >=, <, <=)
+- Null/undefined không được handle
+
+### 2. 🏗️ Architecture — Constitution compliance
+
+**Signals cần tìm:**
+- Import direction vi phạm layer rules? (presentation → domain OK, domain → presentation ❌)
+- Pattern mismatch? (constitution nói Repository, code dùng direct DB query)
+- No-Go Zone violated?
+- Naming convention bị mix? (camelCase + snake_case trong cùng module)
+
+### 3. 🔒 Security — Attack surface check
+
+**Grep patterns trong code review:**
+```
+String concatenation SQL:  `+ variable`, `${variable}` trong SQL strings
+Hardcoded secrets:         `password`, `apiKey`, `secret`, `token` = literal value
+Missing validation:        req.body dùng trực tiếp không qua validation
+Sensitive logging:         console.log(password), console.log(token)
+Missing auth check:        Route handler không có auth middleware
+XSS vectors:               innerHTML =, dangerouslySetInnerHTML, v-html
+```
+
+### 4. 📊 Quality — Test & maintainability
+
+**Signals cần tìm:**
+- Test coverage gaps → file có logic nhưng không có test file tương ứng
+- Error handling → try-catch thiếu hoặc swallow (`catch(e) {}`)
+- Magic numbers → `if (count > 5)` thay vì `if (count > MAX_RETRIES)`
+- Dead code → functions/variables defined but never used
+- TODO/FIXME/HACK comments → tech debt indicators
+
+### 5. ⚡ Performance — Resource efficiency
+
+**Grep patterns:**
+```
+N+1 queries:    `for ... await db.query()`
+Missing index:  WHERE clause on non-indexed column
+Memory leak:    addEventListener without removeEventListener
+Large payload:  SELECT * thay vì specific columns
+Missing pagination: findAll() without limit
+```
+
+---
+
+## Issue Severity Reference
+
+| Severity | Criteria | Action Required |
+|:--------:|---------|----------------|
+| 🔴 **Critical** | Bug, security vuln, data loss, crash | **MUST fix** — block merge |
+| 🟡 **Major** | Architecture violation, missing test, bad pattern | **SHOULD fix** — discuss if needed |
+| 🟢 **Minor** | Style, naming, improvement, optimization | **CAN fix** — optional |
+
+**Rule**: review đủ 5 chiều; mỗi finding có severity + `file:line` + bằng chứng. **Không ép số lượng** — nếu không có material finding, ghi rõ scope/assumptions/residual risk + test gap còn lại.
+
+---
+
+## Concern Verification
+
+> 💡 Phần này KHÔNG ĐƯỢC BỎ QUA.
+
+Review Agent PHẢI verify W-xxx concerns từ R.0 (validation-report.md):
+
+```
+1. Đọc validation-report.md → §4 Concerns
+2. Với mỗi W-xxx:
+   - Tìm code implementation giải quyết concern
+   - Verify implementation đúng và đủ
+   - Ghi kết quả vào review report
+```
+
+---
+
+## Output Format
+
+→ Xem `examples/good/review-report-template.md` cho format chuẩn.
+
+Minimum required sections:
+- **Summary**: Files reviewed, issues count, verdict
+- **Issues**: Mỗi issue có CR-xxx ID, severity, file:line, description, suggestion
+- **Concerns Verification**: Ma trận W-xxx → resolved?
+
+---
+
+## Reviewer Biases Cần Tránh
+
+| Bias | Mô tả | Cách tránh |
+|------|-------|----------|
+| **Familiarity** | Ít critical với code style mình suggest | Review như người ngoài |
+| **Nitpicking overload** | 20 minor issues che mất 1 critical | Sort by severity first |
+| **Style wars** | Tranh cãi formatting khi không có convention | Skip nếu constitution không nói |
+| **Recency** | Focus file cuối cùng, quên file đầu | Systematic — file by file |
+
+---
+
+## Gotchas
+
+→ Xem `gotchas.md` cho issues historical data — cập nhật sau MỖI review cycle.

package/skills/review/adversarial-reviewer/config.json

@@ -0,0 +1,32 @@
+{
+  "setup_questions": [
+    {
+      "id": "min_issues",
+      "question": "Số issues tối thiểu phải tìm?",
+      "type": "number",
+      "default": 3
+    },
+    {
+      "id": "review_depth",
+      "question": "Review depth?",
+      "options": ["quick", "standard", "deep"],
+      "default": "standard",
+      "description": "quick = correctness + security only. standard = 5 chiều. deep = + performance profiling."
+    },
+    {
+      "id": "auto_grep_security",
+      "question": "Tự động grep security patterns?",
+      "type": "boolean",
+      "default": true
+    }
+  ],
+  "hooks": {
+    "pre_review": "Load spec.md + validation-report.md concerns (W-xxx) trước khi review",
+    "post_review": "Verify concern resolution count matches expected"
+  },
+  "memory": {
+    "file": "review-history.log",
+    "format": "[date] | [feature] | [issues_found] | [critical] | [major] | [minor] | [concerns_resolved]",
+    "purpose": "Track review quality over time — dùng cho /v.metrics"
+  }
+}

package/skills/review/adversarial-reviewer/examples/good/review-report-template.md

@@ -0,0 +1,56 @@
+# Good Example — Code Review Report
+
+## Summary
+- **Feature**: 002-legacy-crud (Refactor CRUD Products)
+- **Files reviewed**: 7 files
+- **Issues found**: 5 (1 critical, 2 major, 2 minor)
+- **Verdict**: CHANGES REQUESTED
+- **Concerns**: W-001 ✅ Resolved, W-002 ✅ Resolved
+
+---
+
+## Issues
+
+### 🔴 CR-001: SQL injection risk in search query — Critical
+**File**: `repositories/product.repo.js:45`
+**Category**: Security
+**Description**: `findByCategory()` uses template literal for category filter instead of parameterized query. This contradicts REQ-U01.
+```javascript
+// Current (vulnerable)
+`SELECT * FROM products WHERE category = '${category}'`
+// Fixed 
+'SELECT * FROM products WHERE category = $1', [category]
+```
+**REQ**: REQ-U01
+
+### 🟡 CR-002: Missing error class for 503 — Major
+**File**: `errors/app-error.js`
+**Category**: Architecture
+**Description**: Plan specified `ServiceUnavailableError` for REQ-S01 (DB connection fail → 503), but only `AppError`, `NotFoundError`, `ValidationError` exist.
+**Suggestion**: Add `ServiceUnavailableError extends AppError` with status 503.
+**REQ**: REQ-S01
+
+### 🟡 CR-003: Validation schema allows negative page — Major
+**File**: `validation/product.js:12`
+**Category**: Correctness
+**Description**: QuerySchema has `page: Joi.number().default(1)` but missing `.min(1)`. Negative page values accepted.
+**REQ**: REQ-E03
+
+### 🟢 CR-004: Magic number in pagination — Minor
+**File**: `services/product.service.js:28`
+**Category**: Quality
+**Description**: `if (limit > 100) limit = 100` — hardcoded 100. Use constant `MAX_PAGE_SIZE`.
+
+### 🟢 CR-005: Missing JSDoc on public methods — Minor
+**File**: `repositories/product.repo.js`
+**Category**: Standards
+**Description**: Public methods `findAll`, `findById`, `create`, `update`, `softDelete` missing JSDoc.
+
+---
+
+## Concerns Verification
+
+| Concern | From R.0 | Resolution | Code Location | Verified? |
+|---------|----------|-----------|---------------|:---------:|
+| W-001 | Migration rollback missing | Added `rollback-deleted-at.sql` | `db/migrations/` | ✅ |
+| W-002 | GET response format change | Tech Lead approved Option C (header-based) | `routes/products.js:15` | ✅ |

package/skills/review/adversarial-reviewer/gotchas.md

@@ -0,0 +1,46 @@
+# Gotchas — Adversarial Reviewer
+
+> Cập nhật liên tục sau MỖI review cycle.
+> Đây là "institutional memory" — issues **THỰC SỰ** hay gặp nhất.
+
+---
+
+## Top 10 Issues Phổ Biến (Historical)
+
+1. ❌ **Missing error handling async** — `await doSomething()` không có try-catch.
+   - **Severity**: 🔴 Critical — unhandled promise rejection → crash.
+
+2. ❌ **Hardcoded values** — Magic numbers, URLs, timeouts trong code.
+   - **VD**: `if (retries > 3)` → `MAX_RETRIES`, `setTimeout(5000)` → `TIMEOUT_MS`.
+
+3. ❌ **Missing null/empty checks** — `.length` trên array có thể null.
+   - **VD**: `users.length` → crash nếu users = null. Check trước.
+
+4. ❌ **N+1 queries** — `for (user of users) { await db.getOrders(user.id) }`.
+   - **Fix**: Batch query `WHERE user_id IN (...)`.
+
+5. ❌ **Sensitive data logged** — `console.log('Login:', { email, password })`.
+   - **Fix**: Mask hoặc exclude sensitive fields.
+
+6. ❌ **Missing input validation** — API chấp nhận mọi input, pass thẳng DB.
+   - **Check**: Trace req.body → db.query — có validation layer giữa?
+
+7. ❌ **Race condition** — 2 concurrent requests modify same record.
+   - **Signal**: UPDATE without version check hoặc lock.
+
+8. ❌ **Memory leak** — EventListener added nhưng không removeEventListener.
+   - **Check**: Trong React: useEffect return cleanup? Trong Node: .on() có .off()?
+
+9. ❌ **Breaking backward compat** — Response format change không versioned.
+   - **Signal**: API response structure khác format cũ → consumer break.
+
+10. ❌ **Test chỉ happy path** — Tests chỉ cover success, not error/edge.
+    - **Check**: Có test cho 400, 404, 500? Có test cho empty input?
+
+---
+
+## False Positives Cần Tránh
+
+- ✅ Console.log trong dev environment → OK nếu có log level control
+- ✅ `any` type trong TypeScript → OK nếu có JSDoc comment giải thích
+- ✅ Large function → OK nếu linear flow (không complex branching)

package/skills/review/adversarial-reviewer/scripts/quick-security-scan.sh

@@ -0,0 +1,52 @@
+#!/bin/bash
+# quick-security-scan.sh — Quét code cho security issues phổ biến
+# Usage: ./quick-security-scan.sh <directory>
+#
+# Output: Danh sách potential issues cho Review Agent xem xét
+
+DIR="${1:-.}"
+
+echo "🔒 Security Scan: $DIR"
+echo "════════════════════════════════════════"
+echo ""
+
+# 1. SQL Injection — SQL keyword + nối chuỗi trên cùng dòng (BẤT KỂ thứ tự).
+# Bug cũ: regex yêu cầu concat ĐỨNG TRƯỚC keyword nên bỏ sót `"SELECT...id=" + id`
+# (keyword đứng trước). Nay tách 2 grep: lọc dòng có SQL keyword, rồi lọc dòng có concat.
+echo "### 1. Potential SQL Injection"
+SQLI=$(grep -rnI --include="*.js" --include="*.ts" --include="*.py" -iE "(select|insert|update|delete)" "$DIR" 2>/dev/null \
+  | grep -E "(\\\$\{|['\"][[:space:]]*\+|\+[[:space:]]*['\"])")
+if [ -n "$SQLI" ]; then echo "$SQLI"; else echo "   ✅ None found"; fi
+echo ""
+
+# 2. Hardcoded secrets
+echo "### 2. Hardcoded Secrets"
+grep -rnI --include="*.js" --include="*.ts" --include="*.py" --include="*.json" \
+  -E "(password|api_?key|secret|token)\s*[=:]\s*['\"][^'\"]{8,}" \
+  "$DIR" 2>/dev/null | grep -v "node_modules\|\.env\.example\|test\|spec\|mock" || echo "   ✅ None found"
+echo ""
+
+# 3. Sensitive data in logs
+echo "### 3. Sensitive Data in Logs"
+grep -rnI --include="*.js" --include="*.ts" --include="*.py" \
+  -E "console\.(log|info|debug|warn)\(.*([Pp]assword|[Tt]oken|[Ss]ecret|[Cc]redential)" \
+  "$DIR" 2>/dev/null || echo "   ✅ None found"
+echo ""
+
+# 4. Missing input validation
+echo "### 4. Direct req.body Usage (potential missing validation)"
+# Bug cũ: `grep | head || echo` — head luôn exit 0 (kể cả input rỗng) nên "None found"
+# không bao giờ in. Nay bắt vào biến rồi mới quyết định.
+REQBODY=$(grep -rnI --include="*.js" --include="*.ts" -E "req\.body\.[a-zA-Z]+" "$DIR" 2>/dev/null | head -20)
+if [ -n "$REQBODY" ]; then echo "$REQBODY"; else echo "   ✅ None found"; fi
+echo ""
+
+# 5. Dangerous functions
+echo "### 5. Dangerous Functions"
+grep -rnI --include="*.js" --include="*.ts" \
+  -E "(eval\(|innerHTML\s*=|dangerouslySetInnerHTML|exec\(|child_process)" \
+  "$DIR" 2>/dev/null || echo "   ✅ None found"
+echo ""
+
+echo "════════════════════════════════════════"
+echo "📊 Scan complete. Review findings above."