@nockdev/awf 6.2.0

package/.agent/workflows/perf.md

@@ -0,0 +1,106 @@
+---
+description: "⚡ Performance profiling: CPU, memory, benchmarks, and optimization recommendations"
+skills: { required: [], contextual: [auto] }
+---
+
+# ⚡ /perf — Perf Pro
+
+> 4-Pillar Performance: CPU, Memory, Benchmarks, Load Testing
+> 📚 Multi-language • Flamegraphs • Web Vitals
+
+---
+
+## PERF FLOW
+
+1. **BASELINE** — Detect stack via HSA (`hsa_detect_stack`), load perf context (`hsa_get_context`), collect current metrics
+2. **PROFILE** — CPU/memory profiling, flamegraphs
+3. **ANALYZE** — Identify hotspots, bottlenecks
+4. **OPTIMIZE** — Apply fixes, verify improvement
+5. **REPORT** — Before/after comparison
+
+---
+
+## COMMANDS
+
+| Command        | Description      | Focus       |
+| -------------- | ---------------- | ----------- |
+| `/perf`        | Quick analysis   | Overview    |
+| `/perf cpu`    | CPU profiling    | Hotspots    |
+| `/perf memory` | Memory profiling | Leaks       |
+| `/perf bench`  | Benchmarking     | Throughput  |
+| `/perf load`   | Load testing     | Scalability |
+| `/perf web`    | Web performance  | Core Vitals |
+
+---
+
+## 🔥 CPU PROFILING TOOLS
+
+| Language   | Tool                    | Profile Command                            | Visualize                            |
+| ---------- | ----------------------- | ------------------------------------------ | ------------------------------------ |
+| Go         | pprof (stdlib)          | `go test -cpuprofile=cpu.prof -bench=.`    | `go tool pprof -http=:8080 cpu.prof` |
+| TypeScript | Chrome DevTools         | `node --prof app.js`                       | DevTools → Performance               |
+| Python     | cProfile                | `python -m cProfile -o cpu.prof script.py` | `snakeviz cpu.prof`                  |
+| Rust       | perf/flamegraph         | `cargo flamegraph`                         | SVG output                           |
+| Java       | async-profiler          | `profiler.sh -d 30 -f cpu.html PID`        | HTML flamegraph                      |
+| C#         | dotTrace / dotnet-trace | `dotnet-trace collect -p PID`              | `speedscope`                         |
+| Ruby       | rbspy                   | `rbspy record -- ruby script.rb`           | SVG flamegraph                       |
+| PHP        | Xdebug / Blackfire      | `php -dxdebug.mode=profile script.php`     | Blackfire UI                         |
+
+---
+
+## 🧠 MEMORY PROFILING TOOLS
+
+| Language   | Tool        | Heap Command                                  | Leak Detection                        |
+| ---------- | ----------- | --------------------------------------------- | ------------------------------------- |
+| Go         | pprof       | `go test -memprofile=mem.prof -bench=.`       | `go tool pprof -alloc_space mem.prof` |
+| TypeScript | heapdump    | `node --inspect` → Chrome DevTools            | Heap snapshots comparison             |
+| Python     | tracemalloc | `tracemalloc.start()` in code                 | `tracemalloc.get_traced_memory()`     |
+| Rust       | valgrind    | `valgrind --tool=massif ./target/release/app` | `ms_print massif.out`                 |
+| Java       | VisualVM    | `jmap -heap PID`                              | MAT analyzer                          |
+| C#         | dotMemory   | `dotnet-dump collect -p PID`                  | `dotnet-dump analyze`                 |
+
+---
+
+## 📊 BENCHMARKING TOOLS
+
+| Language   | Tool             | Run Command                                  | Compare                     |
+| ---------- | ---------------- | -------------------------------------------- | --------------------------- |
+| Go         | go test -bench   | `go test -bench=. -benchmem ./...`           | `benchstat old.txt new.txt` |
+| TypeScript | Vitest bench     | `vitest bench` or Benchmark.js               | Manual comparison           |
+| Python     | pytest-benchmark | `pytest --benchmark-only`                    | `pytest-benchmark compare`  |
+| Rust       | criterion        | `cargo bench`                                | Built-in comparison         |
+| Java       | JMH              | `mvn exec:java -Dexec.mainClass="benchmark"` | JMH output                  |
+
+---
+
+## 🏋️ LOAD TESTING
+
+| Tool          | Type             | Quick Start                |
+| ------------- | ---------------- | -------------------------- |
+| **k6**        | Modern, scripted | `k6 run script.js`         |
+| **wrk**       | HTTP benchmark   | `wrk -t12 -c400 -d30s URL` |
+| **Artillery** | YAML config      | `artillery run config.yml` |
+| **Locust**    | Python-based     | `locust -f locustfile.py`  |
+
+---
+
+## 🌐 WEB PERFORMANCE (Core Web Vitals 2025)
+
+| Metric                              | Target  | Tools                   |
+| ----------------------------------- | ------- | ----------------------- |
+| **LCP** (Largest Contentful Paint)  | < 2.5s  | Lighthouse, WebPageTest |
+| **INP** (Interaction to Next Paint) | < 200ms | Chrome DevTools         |
+| **CLS** (Cumulative Layout Shift)   | < 0.1   | Lighthouse              |
+| **TTFB** (Time to First Byte)       | < 800ms | WebPageTest             |
+| **FCP** (First Contentful Paint)    | < 1.8s  | Lighthouse              |
+
+### Optimization Checklist
+
+| Category | Technique                           |
+| -------- | ----------------------------------- |
+| Images   | WebP/AVIF, responsive, lazy load    |
+| JS       | Code splitting, tree shaking, defer |
+| CSS      | Critical CSS inline, purge unused   |
+| Fonts    | `font-display: swap`, preload       |
+| Caching  | CDN, `Cache-Control`, ETags         |
+| Network  | HTTP/3, preconnect, resource hints  |

package/.agent/workflows/plan.md

@@ -0,0 +1,106 @@
+---
+description: "📋 Feature planning with impact analysis, task breakdown, and effort estimation"
+skills: { required: [], contextual: [auto] }
+---
+
+# 📋 /plan — Plan Pro
+
+> Outcome-Focused Feature Planning
+> 📚 Impact Analysis • Task Breakdown • RICE Scoring
+
+---
+
+## PLAN FLOW
+
+1. **PHASE 0: DEEP INTERVIEW** — Thu thập context (skip if clear) → ⛔ STOP if info missing
+2. **PHASE 1: UNDERSTAND** — Parse request, detect stack via HSA (`hsa_detect_stack`), load context (`hsa_get_context`), clarify scope
+3. **PHASE 2: ANALYZE** — Impact assessment, risk analysis, dependencies
+4. **PHASE 3: DESIGN** — Technical design, architecture, API contracts
+5. **PHASE 4: BREAKDOWN** — Task decomposition, effort estimation → ⛔ STOP for user approval
+6. **PHASE 5: VALIDATE** — Review with user, finalize plan
+
+---
+
+## COMMANDS
+
+| Command                    | Description                |
+| -------------------------- | -------------------------- |
+| `/plan [feature]`          | Full planning flow         |
+| `/plan quick [feature]`    | Rapid plan (skip Phase 0)  |
+| `/plan estimate [feature]` | Effort estimation only     |
+| `/plan flow [sprint]`      | Flow metrics for sprint    |
+| `/plan forecast [n]`       | Forecast n items           |
+| `/plan specify [feature]`  | Spec-driven (DoR + INVEST) |
+| `/plan sprint`             | Sprint planning (DoD/DoR)  |
+| `/plan uat [feature]`      | UAT scenario planning      |
+
+---
+
+## PHASE 0: DEEP INTERVIEW ⭐
+
+> Skip if user already provided enough context
+
+### 3 Golden Questions
+
+| #   | Question                                     | Purpose          | Skip If                |
+| --- | -------------------------------------------- | ---------------- | ---------------------- |
+| 1   | Feature xử lý/quản lý cái gì?                | Domain & scope   | Request đã rõ ràng     |
+| 2   | Ai dùng? Bao nhiêu user?                     | Scale & UX needs | Obvious from context   |
+| 3   | Có constraints nào? (deadline, budget, tech) | Boundaries       | No special constraints |
+
+### Follow-up Categories
+
+| Category  | Key Questions                                     |
+| --------- | ------------------------------------------------- |
+| Technical | Existing endpoints? DB changes? Performance reqs? |
+| Business  | Priority? Hard deadline? Success metrics?         |
+
+---
+
+## IMPACT ANALYSIS
+
+| Factor           | Assessment   | Notes    |
+| ---------------- | ------------ | -------- |
+| Code complexity  | S/M/L/XL     | {detail} |
+| Files affected   | {count}      | {list}   |
+| Dependencies     | {count}      | {list}   |
+| Breaking changes | Yes/No       | {detail} |
+| Security impact  | Low/Med/High | {detail} |
+
+### Risk Matrix
+
+|                 | Low Likelihood | Medium | High |
+| --------------- | -------------- | ------ | ---- |
+| **High Impact** | 🟡             | 🔴     | 🔴   |
+| **Med Impact**  | 🟢             | 🟡     | 🔴   |
+| **Low Impact**  | 🟢             | 🟢     | 🟡   |
+
+---
+
+## TASK BREAKDOWN & ESTIMATION
+
+### Effort Scale
+
+| Size    | Time  | Examples                  |
+| ------- | ----- | ------------------------- |
+| **XS**  | < 1h  | Config change, copy fix   |
+| **S**   | 1-4h  | Simple endpoint, UI tweak |
+| **M**   | 4h-2d | Feature with tests        |
+| **L**   | 2-5d  | Multi-component feature   |
+| **XL**  | 1-2w  | Cross-cutting feature     |
+| **XXL** | 2w+   | **Needs breakdown**       |
+
+> Estimation rules: Include testing (20-30%), buffer (10-20%), code review time
+
+---
+
+## RICE SCORING
+
+| Factor         | Scale         | Description                                        |
+| -------------- | ------------- | -------------------------------------------------- |
+| **R**each      | Number        | Users affected per quarter                         |
+| **I**mpact     | 0.25-3        | 0.25=minimal, 0.5=low, 1=medium, 2=high, 3=massive |
+| **C**onfidence | 0-100%        | How sure about estimates                           |
+| **E**ffort     | Person-months | Dev time required                                  |
+
+> Formula: `(R × I × C) / E` → Higher = prioritize

package/.agent/workflows/recap.md

@@ -0,0 +1,101 @@
+---
+description: "📖 Session summary: completed tasks, changed files, decisions, and next steps"
+skills: { required: [], contextual: [] }
+---
+
+# 📖 /recap — Recap Pro
+
+> Intelligent Session Summary
+> 📚 Auto-detect • Memory Integration • Handoff • Context Compression
+
+---
+
+## RECAP FLOW
+
+1. **COLLECT** — Git changes (`git log --oneline -20`), task list, decisions from memory, file system changes
+2. **ANALYZE** — Categorize changes (features, fixes, refactors, docs), calculate metrics (files changed, lines added/removed)
+3. **SUMMARIZE** — Group by category, generate structured report. Show: `Session: 2h 15m | 8 tasks | 23 files changed`
+4. **PERSIST** — Save key decisions and context to `memory/state.json` for next session continuity
+5. **SUGGEST** — Next steps with priority, suggest `/workflow chain` for follow-up
+
+---
+
+## COMMANDS
+
+| Command          | Description                      |
+| ---------------- | -------------------------------- |
+| `/recap`         | Full session summary with memory |
+| `/recap short`   | Brief summary (state only)       |
+| `/recap git`     | Git-focused summary              |
+| `/recap memory`  | Show memory status only          |
+| `/recap save`    | Save recap to file               |
+| `/recap handoff` | Generate handoff document        |
+| `/recap next`    | Prepare for next session         |
+
+---
+
+## 📄 RECAP FORMAT
+
+```markdown
+# Session Recap — [date] [duration]
+
+## ✅ Completed (N tasks)
+
+- [task 1] — [files changed]
+- [task 2] — [files changed]
+
+## 📊 Metrics
+
+- Files changed: N | Lines +M / -K
+- Tests: X passed, Y failed | Coverage: Z%
+- Commits: N
+
+## 🔑 Key Decisions
+
+- [decision 1] — Rationale: [why]
+- [decision 2] — Rationale: [why]
+
+## 🚧 In Progress
+
+- [WIP item] — [status, blocker]
+
+## ➡️ Next Steps (Priority)
+
+1. [P0] [next task]
+2. [P1] [follow-up]
+3. [P2] [improvement]
+```
+
+---
+
+## 📄 HANDOFF DOCUMENT
+
+Generate with `/recap handoff` for session continuity:
+
+| Section         | Content                |
+| --------------- | ---------------------- |
+| Project Context | State, stack, key deps |
+| Work Completed  | Tasks, commits, code   |
+| Decisions Made  | With rationale         |
+| Open Issues     | Blockers, TODO         |
+| Next Steps      | Prioritized list       |
+
+---
+
+## 🔍 AUTO-DETECTION SOURCES
+
+| Source       | What It Captures                   |
+| ------------ | ---------------------------------- |
+| Git log      | Commits, diffs, branch changes     |
+| Memory files | Session state, decisions, patterns |
+| Chat history | Task completions, discussions      |
+| File system  | Modified files, new files, deleted |
+| HSA index    | Changed context, invalidated cache |
+
+---
+
+## 📦 CONTEXT COMPRESSION
+
+Triggers: Context window > 80%, Session > 2 hours, Major phase complete
+
+Strategy: Keep key decisions + critical code changes, compress repetitive details, save to memory for next session

package/.agent/workflows/refactor.md

@@ -0,0 +1,161 @@
+---
+description: "🔧 Code refactoring & cleanup: identify smells, clean dead code, organize imports, restructure — verify tests pass"
+skills: { required: [], contextual: [auto] }
+---
+
+# 🔧 /refactor — Refactor Pro
+
+> Safe Code Transformation with Test Verification
+> 📚 Code Smells • Analysis Tools • Characterization Tests
+
+---
+
+## REFACTOR FLOW
+
+1. **DETECT** — Identify stack via HSA (`hsa_detect_stack`), load context (`hsa_get_context`), locate tests
+2. **BASELINE** — Run tests, record passing state
+3. **PLAN** — Define changes, confirm scope → `hsa_prefetch` target files
+4. **EXECUTE** — Apply refactoring (one commit per change) → ⛔ STOP if tests fail at any point
+5. **VERIFY** — Re-run tests, validate behavior unchanged
+6. **SYNC** — `hsa_check_changes` to update index after edits
+
+---
+
+## COMMANDS
+
+| Command                   | Description             |
+| ------------------------- | ----------------------- |
+| `/refactor [file]`        | Refactor specific file  |
+| `/refactor [dir]`         | Refactor directory      |
+| `/refactor extract`       | Extract method/function |
+| `/refactor rename`        | Rename with references  |
+| `/refactor simplify`      | Reduce complexity       |
+| `/refactor clean imports` | Organize imports        |
+| `/refactor clean dead`    | Remove dead code        |
+| `/refactor clean all`     | Apply all cleanup       |
+| `/refactor clean --dry`   | Preview without changes |
+
+### Cleanup Safety Rules
+
+- Never delete without preview
+- Show exact lines before removal
+- Offer backup (`git stash`)
+- Run build after changes
+- Never auto-remove: deprecated functions, TODO files, test files, configs, migrations
+
+---
+
+## 🎨 UI REFACTOR SUB-COMMANDS
+
+| Command                    | Description               | What It Does                                        |
+| -------------------------- | ------------------------- | --------------------------------------------------- |
+| `/refactor ui [component]` | Refactor UI component     | Break down, clean props, extract sub-components     |
+| `/refactor layout [page]`  | Restructure page layout   | Reorganize grid/flex structure, simplify nesting    |
+| `/refactor styles`         | Clean/organize CSS        | Remove dead CSS, merge duplicates, organize imports |
+| `/refactor design-system`  | Migrate to design tokens  | Extract hardcoded values → CSS custom properties    |
+| `/refactor responsive`     | Fix/add responsive design | Add container queries, fix breakpoints, fluid typo  |
+| `/refactor a11y`           | Fix accessibility issues  | Add ARIA labels, fix contrast, keyboard navigation  |
+
+### UI Refactor Flow (with VRT Baseline)
+
+> Extends standard 6-step flow with screenshot comparison
+
+1. **DETECT** — Stack + scan UI component structure
+2. **BASELINE** — Run tests + capture current screenshot (Playwright `toHaveScreenshot()`)
+3. **PLAN** — Define UI changes → ⛔ **STOP — confirm before executing**
+4. **EXECUTE** — Apply refactoring (one commit per change)
+5. **COMPARE** — Screenshot after → pixelmatch diff → show visual delta
+6. **VERIFY** — Tests pass + a11y check (axe-core) + responsive check
+7. **SYNC** — `hsa_check_changes` to update index
+
+---
+
+## CODE SMELLS CATALOG
+
+### Bloaters (Size Issues)
+
+| Smell               | Detect                | Fix              |
+| ------------------- | --------------------- | ---------------- |
+| Long Method         | > 20 lines            | Extract Method   |
+| Large Class         | > 200 lines           | Extract Class    |
+| Long Parameter List | > 3 params            | Parameter Object |
+| Data Clumps         | Repeated field groups | Extract Class    |
+| Primitive Obsession | Raw types everywhere  | Value Objects    |
+
+### Change Preventers
+
+| Smell                | Detect                        | Fix                       |
+| -------------------- | ----------------------------- | ------------------------- |
+| Divergent Change     | One class, many reasons       | SRP, Extract Class        |
+| Shotgun Surgery      | One change → many files       | Move Method, Inline Class |
+| Parallel Inheritance | Subclass in A → subclass in B | Merge hierarchies         |
+
+### Dispensables
+
+| Smell                  | Detect              | Fix                  |
+| ---------------------- | ------------------- | -------------------- |
+| Duplicate Code         | Copy-paste          | Extract Method/Class |
+| Dead Code              | Unreachable         | Remove               |
+| Speculative Generality | Unused abstractions | Collapse Hierarchy   |
+
+### Couplers
+
+| Smell                  | Detect                           | Fix                          |
+| ---------------------- | -------------------------------- | ---------------------------- |
+| Feature Envy           | Method uses another class's data | Move Method                  |
+| Inappropriate Intimacy | Classes access internals         | Extract Class, Hide Delegate |
+
+---
+
+## REFACTORING PATTERNS
+
+| Pattern                    | When                        | Example                                     |
+| -------------------------- | --------------------------- | ------------------------------------------- |
+| Extract Method             | Mixed logic in one function | Split into validateInput(), transformData() |
+| Replace Magic Numbers      | Hardcoded values            | `STATUS_ACTIVE = 1`, `TIMEOUT_MS = 30000`   |
+| Replace Conditional        | Complex if/else chains      | Strategy pattern, polymorphism              |
+| Introduce Parameter Object | Many params                 | `CreateUserInput { name, email, role }`     |
+| Replace Temp with Query    | Temp var used once          | Inline as method call                       |
+
+---
+
+## ANALYSIS TOOLS
+
+| Language   | Complexity        | Duplication | Lint             |
+| ---------- | ----------------- | ----------- | ---------------- |
+| Go         | gocyclo           | dupl        | golangci-lint    |
+| TypeScript | eslint complexity | jscpd       | eslint           |
+| Python     | radon cc          | pylint      | ruff             |
+| Rust       | cargo clippy      | —           | clippy           |
+| Java       | PMD               | CPD         | Checkstyle       |
+| C#         | —                 | —           | Roslyn analyzers |
+
+---
+
+## COMPLEXITY THRESHOLDS
+
+| Metric          | Good | Warning | Critical |
+| --------------- | ---- | ------- | -------- |
+| Cyclomatic      | < 10 | 10-20   | > 20     |
+| Cognitive       | < 15 | 15-25   | > 25     |
+| Lines/function  | < 30 | 30-50   | > 50     |
+| Params/function | ≤ 3  | 4-5     | > 5      |
+| Nesting depth   | ≤ 3  | 4       | > 4      |
+| Duplication     | < 3% | 3-10%   | > 10%    |
+
+---
+
+## CHARACTERIZATION TESTS
+
+> For legacy code without tests — document existing behavior before refactoring
+
+1. Run code with known inputs
+2. Record actual outputs (even if "wrong")
+3. Write tests capturing current behavior
+4. Now refactor safely — tests catch regressions
+
+### Mikado Method (Large Refactors)
+
+1. Make one refactoring
+2. Run tests → Pass? Commit. Fail? Revert.
+3. Repeat

package/.agent/workflows/revert.md

@@ -0,0 +1,99 @@
+---
+description: "⏪ Revert changes: git rollback, deployment rollback, database rollback"
+skills: { required: [], contextual: [] }
+---
+
+# ⏪ /revert — Revert Pro
+
+> Safe Reversal of Changes
+> 📚 Git • Deploy • Database • Feature Flags
+
+---
+
+## REVERT FLOW
+
+1. **DETECT** — What to revert, how far back
+2. **PLAN** — Impact assessment (files, deps, data), create backup of current state
+3. **EXECUTE** — Execute reversal → ⛔ STOP after PLAN for user confirmation
+4. **VERIFY** — Confirm reversal applied correctly, run tests
+5. **SYNC** — `hsa_check_changes` to update index after reversal
+
+---
+
+## COMMANDS
+
+| Command          | Description         |
+| ---------------- | ------------------- |
+| `/revert`        | Interactive revert  |
+| `/revert git`    | Git rollback        |
+| `/revert deploy` | Deployment rollback |
+| `/revert db`     | Database rollback   |
+| `/revert last`   | Revert last change  |
+
+---
+
+## 🔧 GIT ROLLBACK
+
+| Scenario                        | Command                                          |
+| ------------------------------- | ------------------------------------------------ |
+| Undo last commit (keep changes) | `git reset --soft HEAD~1`                        |
+| Undo last commit (discard)      | `git reset --hard HEAD~1`                        |
+| Revert specific commit          | `git revert {hash}`                              |
+| Unstage file                    | `git reset HEAD {file}`                          |
+| Discard file changes            | `git checkout -- {file}`                         |
+| Recover deleted branch          | `git reflog` → `git checkout -b {branch} {hash}` |
+
+---
+
+## 🚀 DEPLOYMENT ROLLBACK
+
+| Platform   | List                        | Rollback                                        |
+| ---------- | --------------------------- | ----------------------------------------------- |
+| Vercel     | `vercel ls`                 | `vercel rollback {url}`                         |
+| Docker     | `docker images`             | `docker-compose up -d {prev_tag}`               |
+| Kubernetes | `kubectl rollout history`   | `kubectl rollout undo deployment/{name}`        |
+| AWS ECS    | `aws ecs describe-services` | `aws ecs update-service --force-new-deployment` |
+| Heroku     | `heroku releases`           | `heroku rollback v{n}`                          |
+
+---
+
+## 🗄️ DATABASE ROLLBACK
+
+| Tool      | Rollback Command                                  |
+| --------- | ------------------------------------------------- |
+| Prisma    | `npx prisma migrate resolve --rolled-back {name}` |
+| TypeORM   | `npx typeorm migration:revert`                    |
+| Knex      | `npx knex migrate:rollback`                       |
+| Alembic   | `alembic downgrade -1`                            |
+| Django    | `python manage.py migrate {app} {previous}`       |
+| goose     | `goose -dir migrations down`                      |
+| Flyway    | `flyway undo`                                     |
+| Liquibase | `liquibase rollback-count 1`                      |
+
+### Safety Rules
+
+- Backup before reverting
+- Forward-only migrations preferred (add new, don't drop)
+- Never: drop column, rename column, change type without backup
+
+---
+
+## 🏴 FEATURE FLAGS (Prefer Over Code Revert)
+
+| Strategy     | Description                   | Rollback Time |
+| ------------ | ----------------------------- | ------------- |
+| Feature flag | Toggle feature off            | < 1 minute    |
+| Canary       | Gradual rollout, quick revert | < 5 minutes   |
+| Code revert  | Git revert + redeploy         | 10+ minutes   |
+
+> **Best practice**: Feature flags first → code revert last resort
+
+---
+
+## 🏷️ IMMUTABLE VERSIONING
+
+| ❌ Avoid     | ✅ Use                          |
+| ------------ | ------------------------------- |
+| `:latest`    | `v1.2.3` (semver)               |
+| `:stable`    | `2026-02-01-abc123` (date+hash) |
+| Mutable tags | `sha-abc123def` (git SHA)       |

package/.agent/workflows/review.md

@@ -0,0 +1,106 @@
+---
+description: "👀 Code review for PRs: logic, quality, security, and tests verification"
+skills: { required: [security], contextual: [auto] }
+---
+
+# 👀 /review — Review Pro
+
+> 5-Category AI-Powered Code Review
+> 📚 Logic • Quality • Security • Performance • Tests • Auto-Diff
+
+---
+
+## REVIEW FLOW
+
+1. **CONTEXT** — Detect stack via HSA (`hsa_detect_stack`), load review context (`hsa_get_context`), read changed files. Auto-detect review scope: staged changes, uncommitted, or PR
+2. **DIFF ANALYSIS** — Parse `git diff --staged` or PR diff, classify change types, identify high-risk areas (auth, payments, data). Show: `[Analyzing] 12 files changed, 3 high-risk`
+3. **REVIEW** — Apply 5-category checklist on changed code, inline comments with severity
+4. **SELF-REVIEW** — Agent re-reads own findings, removes false positives, verifies evidence accuracy
+5. **REPORT** — Structured feedback with severity, approve/comment/request changes decision
+6. **SYNC** — `hsa_check_changes` to update index
+
+---
+
+## COMMANDS
+
+| Command            | Description                       |
+| ------------------ | --------------------------------- |
+| `/review`          | Review staged/uncommitted changes |
+| `/review [file]`   | Review specific file              |
+| `/review pr #123`  | Review GitHub PR                  |
+| `/review security` | Security-focused review           |
+| `/review quick`    | Quick sanity check                |
+| `/review --diff`   | Review only changed lines         |
+
+---
+
+## 5-CATEGORY CHECKLIST
+
+### 1️⃣ Logic & Correctness
+
+- Edge cases handled? Off-by-one errors? Null/nil safety? Race conditions? Error propagation?
+
+### 2️⃣ Code Quality
+
+- DRY (no duplication)? Single responsibility? Clear naming? Appropriate comments? Consistent style?
+
+### 3️⃣ Security
+
+- Input validation? SQL injection safe? XSS prevention? Auth/authz checked? Secrets in code? OWASP Top 10?
+
+### 4️⃣ Performance
+
+- N+1 queries? Unnecessary computation? Large datasets handled? Caching considered? Memory leaks?
+
+### 5️⃣ Tests
+
+- Tests for new code? Edge cases covered? Meaningful (not just coverage)? All tests pass? Mocking appropriate?
+
+---
+
+## FEEDBACK TYPES
+
+| Type          | Severity     | Action Required       |
+| ------------- | ------------ | --------------------- |
+| 🔴 Blocker    | Critical     | Must fix before merge |
+| 🟠 Issue      | Important    | Should fix            |
+| 🟡 Suggestion | Nice to have | Consider              |
+| 🔵 Nitpick    | Style        | Optional              |
+| 💡 Praise     | Positive     | None                  |
+
+### Feedback Format
+
+```
+🟠 **Issue** `file.ts:42` (Confidence: 8/10)
+**Finding:** Missing null check before accessing `user.id`
+**Risk:** NullPointerException in production
+**Fix:** `if (!user) return res.status(404).json({ error: 'User not found' })`
+```
+
+---
+
+## GITHUB CLI
+
+| Operation       | Command                                   |
+| --------------- | ----------------------------------------- |
+| List PRs        | `gh pr list`                              |
+| View PR         | `gh pr view #123`                         |
+| PR diff         | `gh pr diff #123`                         |
+| Checkout        | `gh pr checkout #123`                     |
+| Approve         | `gh pr review --approve`                  |
+| Comment         | `gh pr review --comment -b "msg"`         |
+| Request changes | `gh pr review --request-changes -b "msg"` |
+
+---
+
+## SAST TOOL INTEGRATION
+
+> If available, run BEFORE AI review for higher accuracy:
+
+```yaml
+pre_review_tools:
+  javascript: "npx eslint --format json {files}; npm audit --json"
+  python: "ruff check {files} --output-format json; bandit -r {files} -f json"
+  go: "go vet {files}; govulncheck ./..."
+  general: "semgrep --config auto --json {files}"
+```