@massa-ai/cursor-plugin 1.21.0 → 1.23.0

package/skills/massa-ai/workflows/requirements/requirements-fix.md

@@ -72,7 +72,7 @@ Do not use this workflow for findings-only requirements review; route that to `w
    - Main agent owns report parsing, traceability matrix, memory writes, final synthesis, and Evidence Gate.
 11. Verify each completed finding:
    - If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
-     `python3 skills/massa-ai/scripts/lessons.py --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`
+     `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`
    - Apply the Mandatory Verification Fix Gate from `references/verification-ladder.md`: run the report's Verification Suggestion or an equivalent deterministic command/artifact check for each selected finding or coherent group.
    - A finding cannot be marked `fixed` when a target-relevant command or artifact check exists but was not attempted; if verification cannot run, mark it `blocked`, `deferred`, or `skipped` with an allowed skipped-check reason.
    - Run the report's verification suggestion when available.

package/skills/massa-ai/workflows/security/security-fix.md

@@ -76,7 +76,7 @@ Do not use this workflow for findings-only security review; route that to `workf
    - Main agent owns report parsing, prioritization, memory writes, final synthesis, and Evidence Gate.
 11. Verify each completed finding:
    - If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
-     `python3 skills/massa-ai/scripts/lessons.py --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`
+     `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`
    - Apply the Mandatory Verification Fix Gate from `references/verification-ladder.md`: run the report's Verification Suggestion or an equivalent deterministic command/artifact check for each selected finding or coherent group.
    - A finding cannot be marked `fixed` when a target-relevant command or artifact check exists but was not attempted; if verification cannot run, mark it `blocked`, `deferred`, or `skipped` with an allowed skipped-check reason.
    - Run the report's verification suggestion when available.

package/skills/massa-ai/workflows/spec-driven.md

@@ -40,7 +40,7 @@ Complexity determines depth, not a fixed pipeline. Assess scope first, apply onl
 | Large | >10 tasks OR multi-component feature | Full spec + requirement IDs | Architecture + components | Full breakdown + deps | Implement + verify per task |
 | Complex | Ambiguity or new domain (unfamiliar vocabulary, no prior pattern) | Full spec + discuss gray areas | Research + architecture | Breakdown + phase plan | Implement + interactive UAT |
 
-A "phase" is a group of tasks sharing a dependency boundary or a checkpoint commit — it is distinct from a single task or atomic step. The sub-agent offer fires when a formal `tasks.md` has more than 3 tasks — packing itself still uses ~7-task batches; a 4–8-task feature is offered as a single batch worker.
+A "Phase" is an ordered group of Tasks sharing a dependency boundary or a checkpoint commit — it is distinct from a single Task or atomic step. Report sizing in the uniform vocabulary: `1 Phase = X Tasks`; the whole plan is `Y Phases = Z Tasks`. The sub-agent offer fires when a formal `tasks.md` has more than 3 Tasks — packing itself still uses ~7-Task Phase groups; a 4–8-Task feature is offered as a single Phase-group worker.
 
 - Specify and Execute are always required.
 - Design is skipped when straightforward (no architectural decisions, no new patterns).
@@ -81,11 +81,11 @@ Quick artifacts live under `.specs/quick/NNN-slug/` with a `TASK.md` (one-line i
    - Load current canonical artifacts from `.specs/` files: `.specs/project/FEATURES.json`, `.specs/project/STATE.md`, `.specs/HANDOFF.md`, existing `.specs/features/<slug>/` phase artifacts, lessons, and project source. Current repository source and approved `.specs/` artifacts override stale memory, old handoff notes, external summaries, debug exports, or unapproved generated plans.
    - `search` only counts as codebase evidence when it is fresh for the current repository path and commit/worktree state, or when the result is confirmed against source files read in this session.
    - Load confirmed project lessons through `references/lessons.md` when `.specs/lessons.json` exists:
-     `python3 skills/massa-ai/scripts/lessons.py --root . list --status confirmed`
+     `bun skills/massa-ai/scripts/lessons.ts --root . list --status confirmed`
 3. Run `Specify` with `references/spec-driven/specify.md`.
    - Capture stable requirement IDs, testable acceptance criteria, edge cases, and explicit out-of-scope items.
    - Run `references/spec-driven/discuss.md` inside Specify when gray areas, implicit requirements, persistence/state, external calls, auth, payments, concurrency, or state transitions affect behavior.
-   - For Android, iOS, or KMP Compose Multiplatform UI work, load `references/mobile-context.md` and run the optional design-source gate: ask for one or more Figma links, node IDs, a readable desktop selection, supplied screenshots, or explicit `none`; record `Figma Source: none by user choice` when declined. Screenshots are context-only unless paired with structured Figma evidence. For unsupported targets, record the source as outside mobile Figma scope and do not run mobile Figma.
+   - For Android, iOS, or KMP Compose Multiplatform UI work, load `references/mobile-context.md` and run the optional design-source gate: ask for one or more Figma links, node IDs, a readable desktop selection, supplied screenshots, or explicit `none`; record `Figma Source: none by user choice` when declined. When Figma links or node IDs are supplied, load `references/figma-pre-analysis.md` and run its two-stage sequential retrieval protocol before consuming the design evidence. Screenshots are context-only unless paired with structured Figma evidence. For unsupported targets, record the source as outside mobile Figma scope and do not run mobile Figma.
    - Apply the Requirement Closure Gate: every open requirement question is resolved with the user or recorded as an accepted assumption before execution begins.
 4. Decide whether `Design` is required. If yes, run `references/spec-driven/design.md`; if no, record why the skip is valid. When Design is skipped and a design concern appears later, stop and create `design.md` before continuing.
 5. Decide whether `Tasks` is required. If yes, run `references/spec-driven/tasks.md`; if no, list the inline atomic execution steps before editing. If the inline list reveals more than 5 steps or complex dependencies, stop and create `tasks.md` — the Tasks phase was wrongly skipped (safety valve).
@@ -94,7 +94,7 @@ Quick artifacts live under `.specs/quick/NNN-slug/` with a `TASK.md` (one-line i
    - Run repo-rules discovery from `references/repo-rules-discovery.md` before the first repository mutation: record the harness sources loaded (or `repo-rules: none present`), and implement so every new or changed file conforms to the target repo's module layout, unit-test location, and testing-area conventions. A repo rule wins over a skill default for placement and gate commands; record any deviation with an explicit reason. Never fabricate rules or create `.claude/`/`.cursor/` directories the repo lacks.
    - Use the Test Coverage Matrix and Gate Check Commands from `tasks.md`, or state their inline equivalents when Tasks was skipped.
    - Ask the MCP and skill question in Tasks or inline Execute when tool choice can change correctness or verification.
-   - If a formal `tasks.md` has more than 3 tasks, present the sub-agent offer from `references/spec-driven/sub-agents.md` before starting Execute — even when packing yields a single batch (a 4–8-task feature is offered as one batch worker). Offer-then-confirm — never auto-spawn; the user must accept before any sub-agent is dispatched. One worker per batch (~7 tasks, whole phases): each batch worker executes all its tasks in order (implement → gate → atomic commit), then reports a compact summary (tasks done, commit hashes, test counts, deviations). Workers never spawn further sub-agents.
+   - If a formal `tasks.md` has more than 3 Tasks, present the sub-agent offer from `references/spec-driven/sub-agents.md` before starting Execute — even when packing yields a single Phase group (a 4–8-Task feature is offered as one Phase-group worker). Offer-then-confirm — never auto-spawn; the user must accept before any sub-agent is dispatched. One worker per Phase group (~7 Tasks, whole Phases): each worker executes all its Tasks in order (implement → gate → atomic commit), then reports a compact summary (Tasks done, commit hashes, test counts, deviations). Workers never spawn further sub-agents.
    - Implement one atomic step or approved task at a time.
    - For long-running task sequences, create a checkpoint via `create_checkpoint` at task boundaries with `taskId`, `description`, `progressPercent`, `currentStep`, `nextAction`, `fileChanges`, and `checkpointType: "manual"` so progress is resumable after interruption.
    - If resuming after interruption, call `list_checkpoints` with the `taskId` and `restore_checkpoint` to recover task state before continuing. If `create_checkpoint` is unavailable (e.g. `task_checkpoints` table missing), continue with `.specs/` artifact state as the fallback.
@@ -117,7 +117,7 @@ Quick artifacts live under `.specs/quick/NNN-slug/` with a `TASK.md` (one-line i
     - The verification-agent re-derives coverage independently using evidence-or-zero and does not inherit the author's mental model.
    - The fix → re-verify loop is capped at 3 iterations before escalating to `Blocked`.
    - Distill lesson signals through `references/lessons.md` when validation produces grounded reusable failures.
-7. Before the delivery chain's Propose stage (PR creation), write and commit `.specs/project/STATE.md`, `.specs/HANDOFF.md`, and `.specs/project/FEATURES.json` on the branch — not merely "after meaningful progress" during Execute, but committed before `gh pr create`. **Deterministic backing (run it, do not eyeball it):** `python3 skills/massa-ai/scripts/check_specs_delivered.py <feature> [--root .]` — a non-zero exit blocks Propose (see `references/implementation-delivery.md` stage 3.5 and GATE-02). If no code-execution tool is available, run the same checks by reading the artifact (graceful degradation preserved). Record `references/spec-driven/memory.md` decisions, blockers, handoff, and completion evidence per that reference's write triggers.
+7. Before the delivery chain's Propose stage (PR creation), write and commit `.specs/project/STATE.md`, `.specs/HANDOFF.md`, and `.specs/project/FEATURES.json` on the branch — not merely "after meaningful progress" during Execute, but committed before `gh pr create`. **Deterministic backing (run it, do not eyeball it):** `bun skills/massa-ai/scripts/check_specs_delivered.ts <feature> [--root .]` — a non-zero exit blocks Propose (see `references/implementation-delivery.md` stage 3.5 and GATE-02). If no code-execution tool is available, run the same checks by reading the artifact (graceful degradation preserved). Record `references/spec-driven/memory.md` decisions, blockers, handoff, and completion evidence per that reference's write triggers.
 8. When the user splits planning and implementation across clean chats, resume from the canonical `.specs/` artifacts — `.specs/project/STATE.md`, `.specs/project/FEATURES.json`, `.specs/HANDOFF.md`, and the feature's phase files. This workflow owns the spec phase contracts on both sides of the split; there is no separate save/load procedure.
 9. Complete the configured Plan Challenge Gate for non-trivial plans and complete `references/evidence-gate.md` before claiming completion.
 
@@ -128,7 +128,7 @@ Quick artifacts live under `.specs/quick/NNN-slug/` with a `TASK.md` (one-line i
 - Feature registry is `.specs/project/FEATURES.json`.
 - Handoff is `.specs/HANDOFF.md`.
 - `.specs/` files are canonical and git-tracked; there is no secondary store.
-- `.specs/lessons.json` is the machine-owned canonical lessons state; `.specs/LESSONS.md` is its rendered view, regenerated by `scripts/lessons.py` on every write — do not hand-edit.
+- `.specs/lessons.json` is the machine-owned canonical lessons state, the single lessons store — do not hand-edit; `lessons list` is the on-demand view.
 - Optional `.specs-exports/` projections are untracked debug aids only.
 - `remember` remains canonical for durable cross-session decisions, rejected approaches, reusable patterns, and verification recipes.
 

package/skills/massa-ai/workflows/tests/tests-fix.md

@@ -52,7 +52,7 @@ Do not use this workflow for findings-only test coverage, assertion quality, fix
 10. Use strict harness sensors:
    - Never rely on AI subjective evaluation.
    - If verification found a reusable signal (`ac_gap`, `surviving_mutant`, `spec_precision_gap`, `spec_deviation`, `gate_fail`), record it via `references/lessons.md`:
-     `python3 skills/massa-ai/scripts/lessons.py --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`
+     `bun skills/massa-ai/scripts/lessons.ts --root . add --feature "<slug>" --signal "<signal>" --source "<ref>" --text "<one terse lesson>"`
    - Apply the Mandatory Verification Fix Gate from `references/verification-ladder.md`: run the report's Verification Suggestion or an equivalent deterministic command/artifact check for each selected finding or coherent group.
    - Run the actual focused test command first, then broader relevant suites when feasible, such as `rtk yarn test`, `rtk npm test`, `rtk pytest`, or `rtk cargo test`.
    - Continue only when the execution harness returns a clean exit code, or report the exact skipped-check reason.

package/skills/massa-ai/scripts/check_commit.py

@@ -1,128 +0,0 @@
-#!/usr/bin/env python3
-"""
-check_commit.py - deterministic Conventional Commits validation.
-
-The per-task atomic-commit rule mandates Conventional Commits 1.0.0. This makes
-that rule checkable instead of trusting the model to remember the format. Pure
-standard library, zero dependencies, agent-agnostic.
-
-It reads the message from (in priority order): a positional file path, --message,
-or stdin. The file-path form matches how git passes the message file to a
-`commit-msg` hook, so this doubles as an optional git-level guard WITHOUT
-coupling the skill to any AI agent:
-
-    ln -s skills/massa-ai/scripts/check_commit.py .git/hooks/commit-msg && chmod +x .git/hooks/commit-msg
-
-What it checks:
-  ERROR  - header does not match  type(scope)!: description
-           (an optional leading `[KEY] ` Jira-style prefix is stripped first -
-           see massa-ai's `workflows/commit.md` §8, e.g. `[SA-142] feat(x): y`)
-  ERROR  - type is not one of the allowed Conventional Commits types
-  ERROR  - description is empty, starts uppercase, or ends with a period
-  ERROR  - `!` breaking marker present but no `BREAKING CHANGE:` footer
-  WARN   - header longer than 72 characters
-
-Usage:
-  python3 skills/massa-ai/scripts/check_commit.py [msgfile]
-  python3 skills/massa-ai/scripts/check_commit.py --message "feat(auth): add email validation"
-  python3 skills/massa-ai/scripts/check_commit.py --message "[SA-142] feat(auth): reject expired tokens"
-  echo "fix(cart): prevent negative quantity" | python3 skills/massa-ai/scripts/check_commit.py
-
-Exit codes: 0 pass, 1 violation, 2 usage error.
-"""
-
-import argparse
-import re
-import sys
-
-TYPES = ["feat", "fix", "refactor", "docs", "test", "style", "perf", "build", "ci", "chore"]
-
-# massa-ai patch (D1c): an optional leading Jira-style key prefix, e.g.
-# "[SA-142] feat(auth): reject expired tokens" (workflows/commit.md §8). The
-# key shape mirrors the branch-key regex there: [A-Z][A-Z0-9]{1,9}-\d+.
-PREFIX_RE = re.compile(r"^\[(?P<key>[A-Z][A-Z0-9]{1,9}-\d+)\]\s+(?P<rest>.+)$")
-HEADER_RE = re.compile(r"^(?P<type>\w+)(?:\((?P<scope>[^)]+)\))?(?P<bang>!)?: (?P<desc>.+)$")
-
-
-def read_message(args):
-    if args.message is not None:
-        return args.message
-    if args.msgfile:
-        with open(args.msgfile, "r", encoding="utf-8") as f:
-            return f.read()
-    if not sys.stdin.isatty():
-        return sys.stdin.read()
-    return ""
-
-
-def check(message):
-    errors, warnings = [], []
-    # Ignore comment lines (git puts '#' comments in the message file).
-    lines = [ln for ln in message.splitlines() if not ln.lstrip().startswith("#")]
-    # Trim leading blank lines.
-    while lines and not lines[0].strip():
-        lines.pop(0)
-    if not lines:
-        return (["empty commit message"], warnings)
-
-    header = lines[0].rstrip()
-    if len(header) > 72:
-        warnings.append(f"header is {len(header)} chars (>72): {header[:60]}...")
-
-    # Strip an optional massa-ai Jira-style `[KEY] ` prefix before matching the
-    # Conventional Commits header shape.
-    prefixed = PREFIX_RE.match(header)
-    header_body = prefixed.group("rest") if prefixed else header
-
-    m = HEADER_RE.match(header_body)
-    if not m:
-        errors.append(f"header does not match 'type(scope): description': {header!r}")
-        return (errors, warnings)
-
-    ctype = m.group("type")
-    desc = m.group("desc")
-    bang = m.group("bang")
-
-    if ctype not in TYPES:
-        errors.append(f"type '{ctype}' is not one of: {', '.join(TYPES)}")
-    if not desc.strip():
-        errors.append("description is empty")
-    else:
-        if desc[:1].isupper():
-            errors.append(f"description should start lowercase: '{desc[:30]}'")
-        if desc.rstrip().endswith("."):
-            errors.append("description should not end with a period")
-
-    body = "\n".join(lines[1:])
-    breaking_footer = bool(re.search(r"^BREAKING CHANGE:", body, re.MULTILINE))
-    if bang and not breaking_footer:
-        errors.append("'!' breaking marker present but no 'BREAKING CHANGE:' footer")
-
-    return (errors, warnings)
-
-
-def main(argv=None):
-    p = argparse.ArgumentParser(prog="check_commit.py", description="Validate a Conventional Commits message.")
-    p.add_argument("msgfile", nargs="?", default=None, help="path to a commit message file (as git passes to commit-msg)")
-    p.add_argument("--message", default=None, help="the commit message as a string")
-    args = p.parse_args(argv)
-
-    message = read_message(args)
-    if not message.strip():
-        print("check_commit: no message provided (pass a file, --message, or pipe via stdin).", file=sys.stderr)
-        return 2
-
-    errors, warnings = check(message)
-    for w in warnings:
-        print(f"  WARN  {w}")
-    for e in errors:
-        print(f"  ERROR {e}")
-    if errors:
-        print("\ncheck_commit: FAIL - see https://www.conventionalcommits.org/en/v1.0.0/")
-        return 1
-    print("check_commit: OK")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

package/skills/massa-ai/scripts/check_specs_delivered.py

@@ -1,137 +0,0 @@
-#!/usr/bin/env python3
-"""
-check_specs_delivered.py - deterministic gate: .specs/ artifacts are
-committed on the branch before a PR is opened (GATE-02).
-
-New script, not a TLC port - massa-ai's `implementation-delivery.md` chain has
-no gate requiring `.specs/` (spec/context/design/tasks/validation, project
-state, handoff, features registry) to be committed before `gh pr create`. This
-turns that gap into two conjunctive, deterministic checks:
-
-  1. `git status --porcelain -- .specs/` is empty - nothing under .specs/ is
-     modified-but-uncommitted or untracked.
-  2. The feature's `spec.md` (always required) plus any of
-     `{context,design,tasks,validation}.md` that exist on disk, plus
-     `.specs/project/STATE.md`, `.specs/HANDOFF.md`, and
-     `.specs/project/FEATURES.json`, are tracked on HEAD
-     (`git ls-tree -r --name-only HEAD`).
-
-Check 2 exists because check 1 alone is not sufficient: a feature whose
-`.specs/` artifacts were simply never written is porcelain-clean (nothing to
-be dirty about) while still failing the actual requirement. Absence must fail,
-not pass.
-
-Pure `git` + standard library. No dependencies. Run from the project root (the
-dir that contains .specs/), or pass --root.
-
-Usage:
-  python3 skills/massa-ai/scripts/check_specs_delivered.py <feature> [--root DIR]
-
-Exit codes: 0 all required paths clean + tracked, 1 a required path is dirty,
-            untracked, or not tracked on HEAD (paths named), 2 usage/git error.
-"""
-
-import argparse
-import os
-import subprocess
-import sys
-
-# Always required for the named feature.
-FEATURE_REQUIRED = ["spec.md"]
-# Required only when present on disk (not every feature reaches every phase).
-FEATURE_OPTIONAL = ["context.md", "design.md", "tasks.md", "validation.md"]
-
-STATE_FILES = [
-    os.path.join(".specs", "project", "STATE.md"),
-    os.path.join(".specs", "HANDOFF.md"),
-    os.path.join(".specs", "project", "FEATURES.json"),
-]
-
-
-def _run_git(args, root):
-    try:
-        proc = subprocess.run(
-            ["git"] + args, cwd=root, capture_output=True, text=True, check=False
-        )
-    except FileNotFoundError:
-        print("check_specs_delivered: git not found on PATH", file=sys.stderr)
-        raise SystemExit(2)
-    if proc.returncode != 0:
-        print(
-            f"check_specs_delivered: git {' '.join(args)} failed: {proc.stderr.strip()}",
-            file=sys.stderr,
-        )
-        raise SystemExit(2)
-    return proc.stdout
-
-
-def _porcelain_dirty_paths(root):
-    """Lines from `git status --porcelain -- .specs/` (empty = clean)."""
-    out = _run_git(["status", "--porcelain", "--", ".specs/"], root)
-    return [ln for ln in out.splitlines() if ln.strip()]
-
-
-def _tracked_on_head(root):
-    """Set of every path tracked on HEAD, repo-root-relative, '/'-separated."""
-    out = _run_git(["ls-tree", "-r", "--name-only", "HEAD"], root)
-    return set(out.splitlines())
-
-
-def _resolve_feature_dir(root, feature):
-    if os.path.isabs(feature) or os.sep in feature:
-        return os.path.normpath(feature)
-    return os.path.join(root, ".specs", "features", feature)
-
-
-def required_paths(root, feature):
-    """Repo-root-relative, '/'-separated paths this feature must have tracked."""
-    fdir = _resolve_feature_dir(root, feature)
-    fdir_rel = os.path.relpath(fdir, root)
-    paths = [os.path.join(fdir_rel, name) for name in FEATURE_REQUIRED]
-    if os.path.isdir(fdir):
-        for name in FEATURE_OPTIONAL:
-            if os.path.isfile(os.path.join(fdir, name)):
-                paths.append(os.path.join(fdir_rel, name))
-    paths.extend(STATE_FILES)
-    return [p.replace(os.sep, "/") for p in paths]
-
-
-def check(root, feature):
-    """Return (errors, checked_paths). errors empty = pass."""
-    errors = []
-
-    for ln in _porcelain_dirty_paths(root):
-        errors.append(f"uncommitted/untracked under .specs/: {ln.strip()}")
-
-    paths = required_paths(root, feature)
-    tracked = _tracked_on_head(root)
-    for p in paths:
-        if p not in tracked:
-            errors.append(f"not tracked on HEAD: {p}")
-
-    return errors, paths
-
-
-def main(argv=None):
-    p = argparse.ArgumentParser(
-        prog="check_specs_delivered.py",
-        description="Gate: .specs/ artifacts committed on the branch before PR (GATE-02).",
-    )
-    p.add_argument("feature", help="Feature slug under <root>/.specs/features/, or a direct path")
-    p.add_argument("--root", default=".", help="Project root containing .specs/ (default: current dir)")
-    args = p.parse_args(argv)
-    root = os.path.abspath(args.root)
-
-    errors, checked = check(root, args.feature)
-
-    for e in errors:
-        print(f"  ERROR {e}")
-    print(f"\ncheck_specs_delivered: checked {len(checked)} path(s):")
-    for c in checked:
-        print(f"  - {c}")
-    print(f"check_specs_delivered: {len(errors)} error(s)")
-    return 1 if errors else 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())