@minhduydev/mdpi 0.3.0

package/dist/template/.pi/skills/observability-and-instrumentation/SKILL.md

@@ -0,0 +1,202 @@
+---
+name: observability-and-instrumentation
+description: Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting. Use when shipping any feature that runs in production and you need evidence it works. Use when production issues are reported but you can't tell what happened from the available data.
+---
+
+# Observability and Instrumentation
+
+## Overview
+
+Code you can't observe is code you can't operate. Observability is the ability to answer "what is the system doing and why?" from the outside, using the telemetry the code emits. Instrumentation is not a post-launch add-on — it's written alongside the feature, the same way tests are. If a feature ships without telemetry, the first user-reported bug becomes archaeology instead of a query.
+
+## When to Use
+
+- Building any feature that will run in production
+- Adding a new service, endpoint, background job, or external integration
+- A production incident took too long to diagnose ("we couldn't tell what happened")
+- Setting up or reviewing alerting rules
+- Reviewing a PR that adds I/O, retries, queues, or cross-service calls
+
+## When NOT to Use
+
+- Diagnosing a failure happening right now — use the `debugging-and-error-recovery` skill (observability is what makes that skill fast next time)
+- Profiling and optimizing measured slowness — use the `performance-optimization` skill
+- Launch-day monitoring checklists and rollback triggers — see the `shipping-and-launch` skill; this skill covers the instrumentation that feeds them
+
+## Process
+
+### 1. Define "working" before instrumenting
+
+Telemetry without a question is noise. Before adding any instrumentation, write down 2–4 questions an on-call engineer will ask about this feature:
+
+```
+FEATURE: checkout payment retry
+QUESTIONS ON-CALL WILL ASK:
+1. What fraction of payments succeed on first attempt vs after retry?
+2. When a payment fails permanently, why? (provider error? timeout? validation?)
+3. Is the payment provider slower than usual?
+→ Every signal below must help answer one of these.
+```
+
+If you can't name the questions, you're not ready to instrument — you'll log everything and learn nothing.
+
+### 2. Pick the right signal for each question
+
+| Signal | Answers | Cost profile | Example |
+|---|---|---|---|
+| **Structured log** | "What happened in this specific case?" | Per-event; grows with traffic | `payment_failed` with provider error code |
+| **Metric** | "How often / how fast, in aggregate?" | Fixed per series; cheap to query | p99 latency of provider calls |
+| **Trace** | "Where did time go across services?" | Per-request; usually sampled | One slow checkout, broken down by hop |
+
+Rule of thumb: metrics tell you **that** something is wrong, traces tell you **where**, logs tell you **why**.
+
+### 3. Structured logging
+
+Log events, not prose. Every log line is a JSON object with a stable event name and machine-readable fields:
+
+```typescript
+// BAD: string interpolation — unqueryable, inconsistent
+logger.info(`Payment ${id} failed for user ${userId} after ${n} retries`);
+
+// GOOD: stable event name + structured fields
+logger.warn({
+  event: 'payment_failed',
+  paymentId: id,
+  provider: 'stripe',
+  errorCode: err.code,
+  attempt: n,
+}, 'payment failed');
+```
+
+**Log levels — use them consistently:**
+
+| Level | Meaning | On-call action |
+|---|---|---|
+| `error` | Invariant broken; someone may need to act | Investigate |
+| `warn` | Degraded but handled (retry succeeded, fallback used) | Watch for trends |
+| `info` | Significant business event (order placed, job finished) | None |
+| `debug` | Diagnostic detail | Off in production by default |
+
+**Correlation IDs are mandatory.** Generate (or accept) a request ID at the system boundary and attach it to every log line, span, and outbound call. Without it, you cannot reconstruct a single request from interleaved logs:
+
+```typescript
+// Express: child logger per request, ID propagated downstream
+app.use((req, res, next) => {
+  req.id = req.headers['x-request-id'] ?? crypto.randomUUID();
+  req.log = logger.child({ requestId: req.id });
+  res.setHeader('x-request-id', req.id);
+  next();
+});
+```
+
+**Never log secrets, tokens, passwords, or full PII.** This is a hard rule — telemetry pipelines are a classic data-leak path. Allowlist fields; don't log whole request bodies.
+
+### 4. Metrics
+
+For request-driven services, instrument **RED** on every endpoint and every external dependency: **R**ate (requests/sec), **E**rrors (failure rate), **D**uration (latency histogram, not average). For resources (queues, pools, hosts), use **USE**: **U**tilization, **S**aturation, **E**rrors.
+
+The vendor-neutral path is the OpenTelemetry metrics API. The example below uses Prometheus' `prom-client`:
+
+```typescript
+import { Histogram } from 'prom-client';
+
+const httpDuration = new Histogram({
+  name: 'http_request_duration_seconds',
+  help: 'HTTP request duration',
+  labelNames: ['method', 'route', 'status_class'],  // '2xx', not '200'
+  buckets: [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5],
+});
+```
+
+**Cardinality is the failure mode.** Every unique label combination is a separate time series. Labels must come from small, fixed sets (route template, status class, provider name). Never use user IDs, raw URLs, error messages, or other unbounded values as labels — that belongs in logs and traces.
+
+```
+OK as label:    route="/api/tasks/:id"   status_class="5xx"   provider="stripe"
+NEVER a label:  user_id, email, request_id, full URL, error message text
+```
+
+Track averages never, percentiles always: an average hides the 1% of users having a terrible time. Use histograms and read p50/p95/p99.
+
+### 5. Distributed tracing
+
+Use OpenTelemetry — it's the vendor-neutral standard, and auto-instrumentation covers HTTP, gRPC, and common DB clients with near-zero code:
+
+```typescript
+// tracing.ts — must be imported before anything else
+import { NodeSDK } from '@opentelemetry/sdk-node';
+import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node';
+
+const sdk = new NodeSDK({
+  serviceName: 'checkout-service',
+  instrumentations: [getNodeAutoInstrumentations()],
+});
+sdk.start();
+```
+
+Add manual spans only around meaningful internal units of work (e.g., `applyDiscounts`, `chargeProvider`) and attach the attributes on-call will filter by. Propagate context across every async boundary — HTTP headers, queue message metadata — or the trace dies at the gap. Sample head-based at a low rate by default; keep 100% of errors if your backend supports tail sampling.
+
+### 6. Alerting
+
+Alert on **symptoms users feel**, not on causes:
+
+```
+SYMPTOM (page-worthy):           CAUSE (dashboard, not a page):
+error rate > 1% for 5 min        CPU at 85%
+p99 latency > 2s                 one pod restarted
+queue age > 10 min               disk at 70%
+```
+
+Cause-based alerts fire when nothing is wrong and miss failures you didn't predict. Symptom-based alerts fire exactly when users are hurt, regardless of the cause.
+
+Rules for every alert you create:
+
+1. **It must be actionable.** If the response is "ignore it, it self-heals", delete the alert.
+2. **It links to a runbook** — even three lines: what it means, first query to run, escalation path.
+3. **It has a threshold and duration** justified by the SLO or by historical data, not by a guess.
+4. Use two severities only: **page** (user-facing, act now) and **ticket** (degradation, act this week). A third tier becomes noise that trains people to ignore everything.
+
+### 7. Verify the telemetry itself
+
+Instrumentation is code; it can be wrong. Before calling the work done, trigger the paths and look at the actual output:
+
+- Force an error in staging → find it in the logs by `requestId`, confirm fields are structured (not `[object Object]`)
+- Send test traffic → confirm metric series appear with the expected labels and sane values
+- Follow one request across services in the tracing UI → no broken spans
+- Fire each new alert once (lower the threshold temporarily) → confirm it reaches the right channel and the runbook link works
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+|---|---|
+| "I'll add logging after it works" | "After" becomes "after the first incident", which is the most expensive moment to discover you're blind. Instrument as you build. |
+| "More logs = more observability" | Unstructured noise makes incidents slower, not faster. Three queryable events beat three hundred prose lines. |
+| "console.log is fine for now" | Unstructured output can't be filtered, correlated, or alerted on. The structured logger costs five extra minutes once. |
+| "We can just look at the dashboards when something breaks" | Dashboards built without defined questions show you everything except the answer. Start from on-call questions. |
+| "Alert on everything important, we'll tune later" | A noisy pager trains people to ignore it. The tuning never happens; the missed real page does. |
+| "User ID as a metric label makes debugging easier" | It also makes your metrics backend fall over. High-cardinality lookups belong in logs and traces. |
+| "Tracing is overkill for our two services" | Two services already means cross-service latency questions logs can't answer. Auto-instrumentation makes the cost trivial. |
+
+## Red Flags
+
+- A feature PR with retries, queues, or external calls and zero new telemetry
+- Log lines built by string interpolation instead of structured fields
+- No correlation/request ID — each log line is an orphan
+- Metrics labeled with user IDs, raw URLs, or error message text (cardinality bomb)
+- Latency tracked as an average with no percentiles
+- Alerts that fire daily and get acknowledged without action
+- Alerts on causes (CPU, memory) paging humans while user-facing error rate is unmonitored
+- Secrets, tokens, or full request bodies appearing in logs
+- "It works on my machine" as the only evidence a production feature is healthy
+
+## Verification
+
+After instrumenting a feature, confirm:
+
+- [ ] The on-call questions for this feature are written down, and each signal maps to one
+- [ ] All log output is structured (JSON), with stable event names and a correlation ID on every line
+- [ ] No secrets, tokens, or unredacted PII in any log line (spot-check actual output)
+- [ ] RED metrics exist for every new endpoint and every external dependency, with bounded label sets
+- [ ] Latency is a histogram; p95/p99 are queryable
+- [ ] A single request can be followed end-to-end in the tracing UI without broken spans
+- [ ] Every new alert is symptom-based, has a runbook link, and was test-fired once
+- [ ] An induced failure in staging was located via telemetry alone, without reading the source

package/dist/template/.pi/skills/opensrc/SKILL.md

@@ -0,0 +1,297 @@
+---
+name: opensrc
+description: Use when you need to understand how a library works internally, debug dependency issues, or inspect package source code beyond types and docs. Fetches source for npm, PyPI, crates.io packages and GitHub repos. Includes structured research workflow for deep investigation.
+---
+
+# opensrc
+
+Fetch and inspect dependency source code, then run a structured research workflow to answer implementation-level questions with evidence.
+
+## When to Use
+
+- Need to understand how a library/package works internally (not just its interface)
+- Debugging issues where types or docs are insufficient
+- Exploring implementation patterns in dependencies
+- Investigating edge cases and behavior not documented officially
+- Evaluating dependency quality before adoption
+
+## When NOT to Use
+
+- Official docs already answer the question (check Context7 first)
+- You only need public API syntax or quick examples
+- The target is your own codebase (use project search/LSP tools)
+
+## Quick Start
+
+```bash
+# Install globally or use npx
+npm install -g opensrc
+
+# Fetch npm package (auto-detects installed version from lockfile)
+npx opensrc zod
+
+# Fetch from other registries
+npx opensrc pypi:requests       # Python/PyPI
+npx opensrc crates:serde        # Rust/crates.io
+
+# Fetch GitHub repo directly
+npx opensrc vercel/ai           # owner/repo shorthand
+npx opensrc github:owner/repo   # explicit prefix
+npx opensrc https://github.com/colinhacks/zod  # full URL
+
+# Fetch specific version/ref
+npx opensrc zod@3.22.0
+npx opensrc owner/repo@v1.0.0
+```
+
+## Commands
+
+| Command                 | Description                     |
+| ----------------------- | ------------------------------- |
+| `opensrc <packages...>` | Fetch source for packages/repos |
+| `opensrc list`          | List all fetched sources        |
+| `opensrc remove <name>` | Remove specific source          |
+| `opensrc clean`         | Remove all sources              |
+
+## Output Structure
+
+After fetching, sources are stored in `opensrc/`:
+
+```
+opensrc/
+├── settings.json           # User preferences
+├── sources.json            # Index of fetched packages/repos
+└── repos/
+    └── github.com/
+        └── owner/
+            └── repo/       # Cloned source code
+```
+
+## File Modifications
+
+On first run, opensrc may prompt to modify:
+
+- `.gitignore` - adds `opensrc/` to ignore list
+- `tsconfig.json` - excludes `opensrc/` from compilation
+- `AGENTS.md` - adds section pointing agents to source code
+
+Use `--modify` or `--modify=false` to control this behavior.
+
+## Key Behaviors
+
+1. **Version Detection** - For npm, auto-detects installed version from `node_modules`, `package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock`
+2. **Repository Resolution** - Resolves package to its git repo via registry API, clones at matching tag
+3. **Monorepo Support** - Handles packages in monorepos via `repository.directory`
+4. **Shallow Clone** - Uses `--depth 1` for efficient cloning, removes `.git` after clone
+5. **Tag Fallback** - Tries `v{version}`, `{version}`, then default branch if tag not found
+
+## Research Workflow (Structured)
+
+Use this 5-step workflow for deep investigations.
+
+### Step 1: Identify
+
+Define the smallest useful target and scope:
+
+- Package/repo name and version
+- Specific question (e.g., retry behavior, parsing path, cache invalidation)
+- Candidate symbols/files to inspect first
+
+```bash
+# Good: scoped target with version
+npx opensrc zod@3.22.0
+
+# Also valid
+npx opensrc pypi:requests
+npx opensrc crates:serde
+npx opensrc vercel/ai@v3.0.0
+```
+
+### Step 2: Fetch
+
+Fetch source with opensrc and confirm location:
+
+```bash
+npx opensrc <target>
+npx opensrc list
+```
+
+Expected result:
+
+- Source cloned into `opensrc/repos/<host>/<owner>/<repo>/`
+- Metadata recorded in `opensrc/sources.json`
+
+### Step 3: Locate
+
+Find relevant files/symbols before deep reading:
+
+- Search by exported symbol names, error classes, feature flags, config keys
+- Prefer implementation files over declaration/type-only files
+- Include tests/examples to infer intended behavior
+
+Suggested search sequence:
+
+1. Entry points (`index`, `main`, package exports)
+2. Core implementation modules
+3. Tests and fixtures
+4. Changelog/release notes for behavioral changes
+
+### Step 4: Analyze
+
+Read code paths end-to-end and collect evidence:
+
+- Trace function call flow from public API to internal logic
+- Note edge-case guards, fallbacks, and error paths
+- Distinguish public API from private/internal contracts
+- Record exact file:line evidence for each claim
+
+Evidence standard:
+
+- Prefer direct source snippets + `file:line`
+- Mark uncertain conclusions explicitly
+- Avoid claims based only on docs/types when source contradicts them
+
+### Step 5: Document
+
+Write findings in a reusable format:
+
+```markdown
+# Research: <library>
+
+- Package/Version: <name@version>
+- Source Path: opensrc/repos/<host>/<owner>/<repo>
+- Research Question: <question>
+
+## Findings
+1. <claim>
+   - Evidence: `path/to/file.ts:42-68`
+   - Confidence: High | Medium | Low
+
+## Answer
+- <direct answer to original question>
+
+## Caveats
+- Version-specific behavior and limits
+```
+
+## Integration with Other Research Methods
+
+Use source inspection as part of a layered approach:
+
+| Method         | Best For                   | Source Code Adds               |
+| -------------- | -------------------------- | ------------------------------ |
+| **Context7**   | API docs, official guides  | Implementation details         |
+| **codesearch** | Usage patterns in the wild | Canonical implementation       |
+| **grepsearch** | Real-world examples        | How library itself works       |
+| **Web search** | Tutorials, blog posts      | Ground truth from source       |
+| **Codebase**   | Project-specific patterns  | How dependencies actually work |
+
+Recommended order:
+
+1. Context7 (official docs)
+2. Local codebase usage
+3. **opensrc source inspection**
+4. codesearch/grepsearch external usage patterns
+5. Web search for supplementary context
+
+## Limitations
+
+### When Source Code May Not Fully Explain Runtime Behavior
+
+- **Build-time transforms**: transpilation/macros/plugins can alter runtime shape
+- **Native modules**: C/C++/Rust bindings require native-level inspection
+- **Generated/minified artifacts**: published package may omit readable source
+- **Monorepo indirection**: behavior may span multiple internal packages
+- **Environment-specific paths**: Node/browser/edge branches can diverge
+
+### Practical Alternatives
+
+If opensrc is incomplete or blocked:
+
+1. Browse repository directly on GitHub
+2. Use `npm pack <package>` and inspect tarball contents
+3. Inspect installed `node_modules/<package>/` output
+4. Use source maps during runtime debugging when available
+
+## Common Workflows
+
+### Fetching a Package
+
+```bash
+# Understand zod implementation
+npx opensrc zod
+# → detects version from lockfile
+# → resolves registry metadata
+# → clones matching tag/revision
+```
+
+### Updating Sources
+
+```bash
+# Re-run to refresh against current installed version
+npx opensrc zod
+```
+
+### Multiple Sources
+
+```bash
+npx opensrc react react-dom next
+npx opensrc zod pypi:pydantic vercel/ai
+```
+
+### Cleanup
+
+```bash
+# Remove one source
+npx opensrc remove <package>
+
+# Remove all sources
+npx opensrc clean
+
+# Remove by ecosystem
+npx opensrc clean --npm --pypi --crates
+```
+
+## Success Criteria
+
+You are done when all are true:
+
+- [ ] Fetched the correct package/repo and version
+- [ ] Located the exact implementation path relevant to the question
+- [ ] Verified behavior by reading source (not only types/docs)
+- [ ] Captured file:line evidence for major claims
+- [ ] Answered the original question with explicit confidence
+- [ ] Documented caveats (version bounds, private API risks)
+
+## References
+
+Core opensrc references:
+
+- [CLI Usage & Options](references/cli-usage.md) - Full command reference
+- [Architecture](references/architecture.md) - Code structure and extension
+- [Registry Support](references/registry-support.md) - npm, PyPI, crates.io details
+
+Research workflow references (merged from source-code-research):
+
+- [Common Patterns](references/common-patterns.md) - Error handling, tracing behavior, quality evaluation patterns
+- [Source Structure](references/source-structure.md) - npm/PyPI/Rust source layouts
+- [Analysis Tips](references/analysis-tips.md) - Tests, examples, changelog, types, blame
+- [Example Workflow](references/example-workflow.md) - End-to-end library investigation example
+- [Anti-Patterns](references/anti-patterns.md) - What not to do when researching
+- [Further Reading](references/further-reading.md) - External links and complementary resources
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+|---|---|
+| "The docs are enough" | Docs describe intended behavior. Source code shows actual behavior. Read both. |
+| "I'll upgrade the dependency later" | Version-pinned dependencies accumulate known vulnerabilities. Audit and upgrade proactively. |
+| "The package is popular, it must be well-maintained" | Popularity ≠ maintenance. Check issue velocity, PR merge rate, and release cadence. |
+
+## Red Flags
+
+- Dependency version chosen based on blog post, not changelog
+- Breaking changes in dependency not detected before upgrade
+- Package.json updated without lockfile regeneration
+- Source inspection skipped for critical security dependencies
+- Deprecated APIs used because "the old version worked"

package/dist/template/.pi/skills/opensrc/references/architecture.md

@@ -0,0 +1,176 @@
+# opensrc Architecture
+
+## Contents
+- Directory structure
+- Core flow
+- Key modules
+- Type definitions
+- Extension points
+
+## Directory Structure
+
+```
+src/
+├── index.ts              # CLI entry, Commander setup
+├── types.ts              # Shared type definitions
+├── commands/
+│   ├── fetch.ts          # Main fetch logic
+│   ├── list.ts           # List sources
+│   ├── remove.ts         # Remove sources
+│   └── clean.ts          # Clean all sources
+└── lib/
+    ├── git.ts            # Clone, path management
+    ├── repo.ts           # Parse/resolve repo specs
+    ├── version.ts        # Detect installed versions
+    ├── agents.ts         # AGENTS.md/sources.json updates
+    ├── gitignore.ts      # .gitignore management
+    ├── tsconfig.ts       # tsconfig.json exclude
+    ├── settings.ts       # User preferences
+    ├── prompt.ts         # Interactive prompts
+    └── registries/
+        ├── index.ts      # Registry detection/routing
+        ├── npm.ts        # npm registry API
+        ├── pypi.ts       # PyPI API
+        └── crates.ts     # crates.io API
+```
+
+## Core Flow
+
+### Fetch Package
+
+1. **Parse input** - Detect registry prefix or repo format
+2. **Version detection** (npm only) - Check lockfiles/node_modules
+3. **Registry lookup** - Query API for repo URL
+4. **Clone** - Shallow clone at matching git tag
+5. **Update index** - Write to sources.json, optionally AGENTS.md
+
+### Input Type Detection
+
+```
+detectInputType(spec) → "package" | "repo"
+```
+
+- Registry prefix (`npm:`, `pypi:`, `crates:`) → package
+- Repo pattern (`owner/repo`, URL, `github:`) → repo
+- Default → package (npm)
+
+## Key Modules
+
+### registries/index.ts
+
+Routes to correct registry handler:
+
+```typescript
+parsePackageSpec(spec): PackageSpec
+resolvePackage(spec): ResolvedPackage
+detectRegistry(spec): { registry, cleanSpec }
+detectInputType(spec): "package" | "repo"
+```
+
+### git.ts
+
+Manages cloning and source storage:
+
+```typescript
+fetchSource(resolved, cwd): FetchResult
+fetchRepoSource(resolved, cwd): FetchResult
+listSources(cwd): { packages, repos }
+removePackageSource(name, cwd, registry): { removed, repoRemoved }
+```
+
+Storage structure: `opensrc/repos/{host}/{owner}/{repo}/`
+
+### version.ts
+
+Detects installed npm versions (priority order):
+1. `node_modules/{pkg}/package.json`
+2. `package-lock.json`
+3. `pnpm-lock.yaml`
+4. `yarn.lock`
+5. `package.json` (strips range prefixes)
+
+### repo.ts
+
+Parses repo specs, resolves via GitHub/GitLab API:
+
+```typescript
+parseRepoSpec(spec): RepoSpec | null
+resolveRepo(spec): ResolvedRepo
+isRepoSpec(spec): boolean
+```
+
+Supports: GitHub, GitLab, Bitbucket (GitHub/GitLab via API).
+
+## Type Definitions
+
+```typescript
+type Registry = "npm" | "pypi" | "crates"
+
+interface PackageSpec {
+  registry: Registry
+  name: string
+  version?: string
+}
+
+interface ResolvedPackage {
+  registry: Registry
+  name: string
+  version: string
+  repoUrl: string
+  repoDirectory?: string  // For monorepos
+  gitTag: string
+}
+
+interface RepoSpec {
+  host: string      // github.com, gitlab.com
+  owner: string
+  repo: string
+  ref?: string      // Branch, tag, commit
+}
+
+interface FetchResult {
+  package: string
+  version: string
+  path: string
+  success: boolean
+  error?: string
+  registry?: Registry
+}
+```
+
+## Extension Points
+
+### Adding a Registry
+
+1. Create `registries/{name}.ts`:
+   - `parse{Name}Spec(spec)` - Parse name@version
+   - `resolve{Name}Package(name, version)` - Query API, return ResolvedPackage
+
+2. Update `registries/index.ts`:
+   - Add prefix to `REGISTRY_PREFIXES`
+   - Add case to `parsePackageSpec` and `resolvePackage`
+
+3. Add to `Registry` type in `types.ts`
+
+### Registry Implementation Pattern
+
+```typescript
+// Parse spec into name/version
+export function parseSpec(spec: string): { name: string; version?: string }
+
+// Query registry API, extract repo URL
+async function fetchInfo(name: string): Promise<RegistryResponse>
+
+// Normalize git URLs (remove git+, .git suffix)
+function extractRepoUrl(info): string | null
+
+// Main resolver
+export async function resolve(name: string, version?: string): Promise<ResolvedPackage>
+```
+
+### Git Tag Resolution
+
+Clone tries tags in order:
+1. `v{version}` (most common)
+2. `{version}` (no prefix)
+3. Default branch (fallback with warning)