@phuc1403/musketeer 0.7.0 → 0.9.0

package/template/.claude/skills/code-review/references/checklists/web-app.md

@@ -1,54 +1,54 @@
-# Web App Review Checklist (Overlay)
-
-Additive to `base.md`. Apply when project has frontend framework (React, Vue, Svelte, Next.js, etc.).
-
-## Detection
-
-Apply this overlay when any of these are true:
-- `package.json` has `react`, `vue`, `svelte`, `next`, `nuxt`, `angular` dependency
-- Project has `src/pages/`, `src/app/`, `src/components/`, `src/views/` directories
-- HTML/JSX/TSX/Vue files in the diff
-
----
-
-## Pass 1 — CRITICAL (additions to base)
-
-### XSS
-- `innerHTML` assignment from any non-static source
-- Template literals interpolated into DOM without escaping
-- URL parameters rendered without sanitization
-- `<a href={userInput}>` without protocol validation (javascript: protocol)
-- Server-rendered user content without HTML entity encoding
-
-### CSRF
-- State-changing endpoints (POST/PUT/DELETE) without CSRF token verification
-- Cookie-based auth without SameSite attribute
-- Form submissions to external URLs
-
-### N+1 Queries (server-rendered views)
-- Database queries inside loops rendering lists
-- Missing eager loading for associations rendered in views/pages
-- Sequential API calls that could be batched
-
----
-
-## Pass 2 — INFORMATIONAL (additions to base)
-
-### Frontend Performance
-- Inline `<style>` blocks in components re-parsed every render
-- Missing `key` prop on list items
-- Large bundle imports that could be lazy-loaded (e.g., full lodash instead of lodash/get)
-- Images without width/height causing layout shift
-- Missing `loading="lazy"` on below-fold images
-
-### Accessibility
-- Interactive elements without keyboard support (onClick without onKeyDown)
-- Missing `alt` text on images
-- Form inputs without associated labels
-- Color-only indicators (no text/icon fallback)
-- Missing ARIA attributes on custom interactive components
-
-### Responsive / Layout
-- Fixed pixel widths that break on mobile
-- Missing viewport meta tag
-- Overflow hidden cutting off content on small screens
+# Web App Review Checklist (Overlay)
+
+Additive to `base.md`. Apply when project has frontend framework (React, Vue, Svelte, Next.js, etc.).
+
+## Detection
+
+Apply this overlay when any of these are true:
+- `package.json` has `react`, `vue`, `svelte`, `next`, `nuxt`, `angular` dependency
+- Project has `src/pages/`, `src/app/`, `src/components/`, `src/views/` directories
+- HTML/JSX/TSX/Vue files in the diff
+
+---
+
+## Pass 1 — CRITICAL (additions to base)
+
+### XSS
+- `innerHTML` assignment from any non-static source
+- Template literals interpolated into DOM without escaping
+- URL parameters rendered without sanitization
+- `<a href={userInput}>` without protocol validation (javascript: protocol)
+- Server-rendered user content without HTML entity encoding
+
+### CSRF
+- State-changing endpoints (POST/PUT/DELETE) without CSRF token verification
+- Cookie-based auth without SameSite attribute
+- Form submissions to external URLs
+
+### N+1 Queries (server-rendered views)
+- Database queries inside loops rendering lists
+- Missing eager loading for associations rendered in views/pages
+- Sequential API calls that could be batched
+
+---
+
+## Pass 2 — INFORMATIONAL (additions to base)
+
+### Frontend Performance
+- Inline `<style>` blocks in components re-parsed every render
+- Missing `key` prop on list items
+- Large bundle imports that could be lazy-loaded (e.g., full lodash instead of lodash/get)
+- Images without width/height causing layout shift
+- Missing `loading="lazy"` on below-fold images
+
+### Accessibility
+- Interactive elements without keyboard support (onClick without onKeyDown)
+- Missing `alt` text on images
+- Form inputs without associated labels
+- Color-only indicators (no text/icon fallback)
+- Missing ARIA attributes on custom interactive components
+
+### Responsive / Layout
+- Fixed pixel widths that break on mobile
+- Missing viewport meta tag
+- Overflow hidden cutting off content on small screens

package/template/.claude/skills/code-review/references/code-review-reception.md

@@ -0,0 +1,113 @@
+---
+name: receiving-code-review
+description: Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement
+---
+
+# Code Review Reception
+
+**Core principle:** Verify before implementing. Ask before assuming. Technical correctness over social comfort.
+
+## Response Pattern
+
+```
+1. READ: Complete feedback without reacting
+2. UNDERSTAND: Restate requirement (or ask)
+3. VERIFY: Check against codebase reality
+4. EVALUATE: Technically sound for THIS codebase?
+5. RESPOND: Technical acknowledgment or reasoned pushback
+6. IMPLEMENT: One at a time, test each
+```
+
+## Forbidden Responses
+
+❌ "You're absolutely right!" / "Great point!" / "Thanks for [anything]"
+❌ "Let me implement that now" (before verification)
+
+✅ Restate technical requirement
+✅ Ask clarifying questions
+✅ Push back with technical reasoning
+✅ Just start working (actions > words)
+
+## Handling Unclear Feedback
+
+```
+IF any item unclear:
+  STOP - don't implement anything
+  ASK for clarification on ALL unclear items
+
+WHY: Items may be related. Partial understanding = wrong implementation.
+```
+
+## Source-Specific Handling
+
+**Human partner:** Trusted - implement after understanding, no performative agreement
+
+**External reviewers:**
+```
+BEFORE implementing:
+  1. Technically correct for THIS codebase?
+  2. Breaks existing functionality?
+  3. Reason for current implementation?
+  4. Works all platforms/versions?
+
+IF wrong: Push back with technical reasoning
+IF can't verify: State limitation, ask direction
+IF conflicts with partner's decisions: Stop, discuss first
+```
+
+## YAGNI Check
+
+```
+IF reviewer suggests "implementing properly":
+  grep codebase for actual usage
+  IF unused: "This isn't called. Remove it (YAGNI)?"
+  IF used: Implement properly
+```
+
+## Implementation Order
+
+```
+1. Clarify unclear items FIRST
+2. Implement: blocking → simple → complex
+3. Test each individually
+4. Verify no regressions
+```
+
+## When To Push Back
+
+- Breaks existing functionality
+- Reviewer lacks full context
+- Violates YAGNI (unused feature)
+- Technically incorrect for stack
+- Legacy/compatibility reasons
+- Conflicts with architectural decisions
+
+**How:** Technical reasoning, specific questions, reference working tests
+
+## Acknowledging Correct Feedback
+
+✅ "Fixed. [Brief description]"
+✅ "Good catch - [issue]. Fixed in [location]."
+✅ Just fix it (actions > words)
+
+❌ ANY gratitude or performative expression
+
+## Correcting Wrong Pushback
+
+✅ "You were right - checked [X], it does [Y]. Implementing."
+❌ Long apology, defending, over-explaining
+
+## Quick Reference
+
+| Mistake | Fix |
+|---------|-----|
+| Performative agreement | State requirement or act |
+| Blind implementation | Verify against codebase |
+| Batch without testing | One at a time |
+| Assuming reviewer right | Check if breaks things |
+| Avoiding pushback | Technical correctness > comfort |
+
+## Bottom Line
+
+External feedback = suggestions to evaluate, not orders.
+Verify. Question. Then implement.

package/template/.claude/skills/code-review/references/codebase-scan-workflow.md

@@ -0,0 +1,30 @@
+# Codebase Scan Workflow
+
+Think harder to scan the codebase and analyze it follow the Orchestration Protocol, Core Responsibilities, Subagents Team and Development Rules:
+<tasks>$ARGUMENTS</tasks>
+
+## Role Responsibilities
+- You are an elite software engineering expert who specializes in system architecture design and technical decision-making.
+- You operate by: **YAGNI**, **KISS**, and **DRY**.
+- Sacrifice grammar for concision. List unresolved questions at end.
+
+## Workflow
+
+### Research
+* Use 2 `researcher` subagents in parallel to search up to 5 sources
+* Keep every research report concise (≤150 lines)
+* Dispatch `Explore` subagents to search the codebase
+
+### Code Review
+* Use multiple `code-reviewer` subagents in parallel to review code
+* If issues found, ask main agent to improve and repeat until tests pass
+* When complete, run verification for accepted findings before reporting completion
+* Report combined quality findings and verification evidence to user
+
+### Plan
+* Analyze the reports and write the improvement plan directly
+* Save overview at `plan.md`, phase files as `phase-XX-phase-name.md`
+
+### Final Report
+* Summary of changes, guide user to get started, suggest next steps
+* Ask user if they want to commit and push

package/template/.claude/skills/code-review/references/edge-case-scouting.md

@@ -0,0 +1,119 @@
+---
+name: edge-case-scouting
+description: Use after implementation, before code review to proactively find edge cases, side effects, and potential issues via scout skill - catches problems code-reviewer might miss
+---
+
+# Edge Case Scouting
+
+Proactive detection of edge cases, side effects, and potential issues before code review.
+
+## Purpose
+
+Code reviews catch obvious issues but miss subtle side effects. Scout detects:
+- Files affected by changes reviewer might not check
+- Data flow paths that could break
+- Boundary conditions and error paths
+- Integration issues across modules
+
+## When to Use
+
+**Mandatory:** Multi-file features, shared utility refactors, complex bug fixes
+**Optional:** Single-file changes, docs, config
+
+## Process
+
+### 1. Identify Changed Files
+```bash
+git diff --name-only HEAD~1
+```
+
+### 2. Dispatch an Explore Subagent
+```
+Scout edge cases for the changes under review.
+
+Changed: {files from git diff}
+
+Find:
+1. Files importing/depending on changed modules
+2. Data flow paths through modified functions
+3. Error handling paths not tested
+4. Boundary conditions (null, empty, max)
+5. Race conditions in async code
+6. State management side effects
+```
+
+### 3. Analyze & Act
+
+| Finding | Action |
+|---------|--------|
+| Affected file not in scope | Add to review |
+| Data flow risk | Verify or add test |
+| Edge case | Add test or verify |
+| Missing test | Add before review |
+
+### 4. Document for Review
+```
+Scout findings:
+- {issues found}
+- Verified: {what checked}
+- Addressed: {what fixed}
+- Needs review: {remaining}
+```
+
+## Scout Prompts
+
+**Feature:**
+```
+Scout edge cases for {feature}.
+Changed: {files}
+Find: consumers, error states, untested inputs, performance, compatibility
+```
+
+**Bug fix:**
+```
+Scout side effects of fix in {file}.
+Bug: {description}, Fix: {approach}
+Find: other paths using logic, dependent features, similar bugs
+```
+
+**Refactor:**
+```
+Scout breaking changes in {module}.
+Before: {old}, After: {new}
+Find: importers, behavior diffs, removed functionality
+```
+
+## What Scout Catches
+
+| Issue | Why Missed | Scout Detects |
+|-------|------------|---------------|
+| Indirect deps | Not in diff | Traces imports |
+| Race conditions | Hard static review | Analyzes flow |
+| State mutations | Hidden side effects | Tracks data |
+| Missing null checks | Assumed safe | Boundary analysis |
+| Integration breaks | Out of scope | Cross-module search |
+
+## Red Flags
+
+- Shared utility changed but only one caller tested
+- Error path leads to unhandled rejection
+- State modified in place without notification
+- Breaking change without migration
+
+## Example
+
+```
+1. Done: Add cache to UserService.getUser()
+2. Diff: src/services/user-service.ts
+3. Scout: "edge cases for caching in getUser()"
+4. Report:
+   - ProfileComponent expects fresh data on edit
+   - AdminPanel loops getUser() (memory risk)
+   - No cache clear on updateUser()
+5. Fix: Add invalidation, maxSize
+6. Document for code-reviewer
+```
+
+## Bottom Line
+
+Scout before review. Don't trust "simple changes" - scout them anyway.

package/template/.claude/skills/code-review/references/input-mode-resolution.md

@@ -0,0 +1,135 @@
+---
+name: input-mode-resolution
+description: How to parse code-review arguments and resolve PR number, commit hash, pending changes, or default context into a reviewable diff
+---
+
+# Input Mode Resolution
+
+Resolve `/code-review` arguments into a diff for the review pipeline.
+
+## Auto-Detection Rules
+
+Parse arguments left-to-right. First match wins.
+
+| Pattern | Mode | Example |
+|---------|------|---------|
+| `#\d+` | PR | `#123`, `#45` |
+| GitHub PR URL | PR | `https://github.com/org/repo/pull/123` |
+| `[0-9a-f]{7,40}` | Commit | `abc1234`, full SHA |
+| `--pending` | Pending | explicit flag |
+| `codebase` | Codebase | existing mode |
+| *(none + context)* | Default | recent changes |
+| *(none + no context)* | Prompt | ask user via `AskUserQuestion` |
+
+## Resolution Commands
+
+### PR Mode
+
+```bash
+# Extract PR number from argument
+PR_NUM=$(echo "$ARG" | grep -oE '[0-9]+$')
+
+# Fetch PR metadata
+gh pr view "$PR_NUM" --json title,body,files,additions,deletions,baseRefName,headRefName
+
+# Get the diff
+gh pr diff "$PR_NUM"
+
+# Get changed file list
+gh pr diff "$PR_NUM" --name-only
+```
+
+**Context passed to reviewers:**
+- PR title and description (intent)
+- Base branch (what it merges into)
+- Full diff
+- Changed file list for scout
+
+### Commit Mode
+
+```bash
+# Validate commit exists
+git cat-file -t "$COMMIT_HASH"
+
+# Get commit metadata
+git log -1 --format="%H%n%s%n%b" "$COMMIT_HASH"
+
+# Get the diff
+git show "$COMMIT_HASH" --stat
+git show "$COMMIT_HASH" -- # full diff
+
+# Changed files
+git show "$COMMIT_HASH" --name-only --format=""
+```
+
+**Context passed to reviewers:**
+- Commit message (intent)
+- Parent commit (what it changed from)
+- Full diff
+- Changed file list for scout
+
+### Pending Mode
+
+```bash
+# Staged changes
+git diff --cached
+
+# Unstaged changes
+git diff
+
+# Combined (staged + unstaged vs HEAD)
+git diff HEAD
+
+# Changed files
+git diff HEAD --name-only
+
+# Status overview
+git status --short
+```
+
+**Context passed to reviewers:**
+- No commit message yet — ask user for brief intent description
+- Combined diff (staged + unstaged)
+- Changed file list for scout
+
+### Default Mode
+
+Use recent changes already in conversation context. If no changes apparent, fall back to Prompt mode.
+
+### Prompt Mode
+
+When no arguments and no recent context, use `AskUserQuestion`:
+- Header: "Review Target"
+- Question: "What would you like to review?"
+- Options: Pending changes, Enter PR number, Enter commit hash, Full codebase scan, Parallel codebase audit
+
+For PR/commit options, follow up with second `AskUserQuestion` to get the number/hash.
+
+### Codebase Mode
+
+Codebase modes bypass diff resolution — they scan the full codebase instead.
+- `codebase` → hand off to `references/codebase-scan-workflow.md`
+- `codebase parallel` → hand off to `references/parallel-review-workflow.md`
+
+Both workflows include code quality review and final verification.
+
+## Pipeline Handoff
+
+After resolving the diff, pass to the review pipeline:
+
+```
+Resolved diff
+  ├─ Changed files → Edge case scout
+  ├─ Full diff → Stage 1 (Spec compliance, if plan exists)
+  ├─ Full diff → Stage 2 (Code quality review)
+  └─ Findings → Fix accepted issues and verify
+```
+
+## Error Handling
+
+| Error | Action |
+|-------|--------|
+| PR not found | `gh pr view` fails → report "PR #N not found in this repo" |
+| Commit not found | `git cat-file` fails → report "Commit not found — is it pushed?" |
+| No pending changes | `git diff HEAD` empty → report "No pending changes to review" |
+| Ambiguous input | Could be PR or commit → prefer PR (more common), note assumption |

package/template/.claude/skills/code-review/references/parallel-review-workflow.md

@@ -0,0 +1,76 @@
+# Parallel Review Workflow
+
+**Ultrathink** to exhaustively list ALL potential edge cases, then dispatch parallel `code-reviewer` agents to verify: <scope>$ARGUMENTS</scope>
+
+**IMPORTANT:** Activate needed skills. Ensure token efficiency. Sacrifice grammar for concision.
+
+## Workflow
+
+### 1. Ultrathink Edge Cases
+
+Main agent deeply analyzes the scope to LIST all potential edge cases FIRST:
+- Read any project overview docs the repo has, for context
+- Dispatch an `Explore` subagent to find relevant files
+- **Think exhaustively** about what could go wrong:
+  - Null/undefined scenarios
+  - Boundary conditions (off-by-one, empty, max values)
+  - Error handling gaps
+  - Race conditions, async edge cases
+  - Input validation holes
+  - Trust-boundary defects
+  - Resource leaks
+  - Untested code paths
+
+**Output format:**
+```markdown
+## Edge Cases Identified
+
+### Category: [scope-area]
+1. [edge case description] → files: [file1, file2]
+```
+
+### 2. Categorize & Assign
+
+Group edge cases by similar scope for parallel verification:
+- Each category → one `code-reviewer` agent
+- Max 6 categories (merge small ones)
+- Each reviewer gets specific edge cases to VERIFY, not discover
+
+### 3. Parallel Verification
+
+Launch N `code-reviewer` subagents simultaneously:
+- Pass: category name, list of edge cases, relevant files
+- Task: **VERIFY** if each edge case is properly handled in code
+- Report: which edge cases are handled vs unhandled
+
+### 4. Aggregate Results
+
+```markdown
+## Edge Case Verification Report
+
+### Summary
+- Total edge cases: X
+- Handled: Y
+- Unhandled: Z
+- Partial: W
+
+### Unhandled Edge Cases (Need Fix)
+| # | Edge Case | File | Status |
+|---|-----------|------|--------|
+```
+
+### 5. Verification Review
+
+After aggregation, verify accepted findings against the full scope:
+- Re-check aggregated findings and unhandled edge cases
+- Confirm each blocking issue has a concrete file/line and reproduction path
+- Classify findings as Accept / Reject / Defer
+
+### 6. Auto-Fix Pipeline
+
+**IF** unhandled/partial edge cases found:
+- Ask: "Found N unhandled edge cases. Fix them now? [Y/n]" — on yes, fix by category, re-verify each
+
+### 7. Final Report
+- Summary of verification
+- Ask: "Commit? [Y/n]" → use `git-manager`

package/template/.claude/skills/code-review/references/requesting-code-review.md

@@ -0,0 +1,116 @@
+---
+name: requesting-code-review
+description: Use when completing tasks, implementing major features, or before merging to verify work meets requirements - dispatches code-reviewer subagent to review implementation against plan or requirements before proceeding
+---
+
+# Requesting Code Review
+
+Dispatch code-reviewer subagent to catch issues before they cascade.
+
+**Core principle:** Scout first, review often.
+
+## When to Request Review
+
+**Mandatory:**
+- After each task in subagent-driven development
+- After completing major feature
+- Before merge to main
+
+**Optional but valuable:**
+- When stuck (fresh perspective)
+- Before refactoring (baseline check)
+- After fixing complex bug
+
+## How to Request
+
+**0. Scout edge cases first (NEW):**
+```
+Before dispatching code-reviewer, dispatch an `Explore` subagent to find:
+- Files affected by changes (not just modified files)
+- Data flow paths that could break
+- Edge cases and boundary conditions
+- Potential side effects
+
+See: references/edge-case-scouting.md
+```
+
+**1. Get git SHAs:**
+```bash
+BASE_SHA=$(git rev-parse HEAD~1)  # or origin/main
+HEAD_SHA=$(git rev-parse HEAD)
+```
+
+**2. Dispatch code-reviewer subagent:**
+
+Use Task tool with `code-reviewer` type, fill template at `code-reviewer.md`
+
+**Placeholders:**
+- `{WHAT_WAS_IMPLEMENTED}` - What you just built
+- `{PLAN_OR_REQUIREMENTS}` - What it should do
+- `{BASE_SHA}` - Starting commit
+- `{HEAD_SHA}` - Ending commit
+- `{DESCRIPTION}` - Brief summary
+
+**3. Act on feedback:**
+- Fix Critical issues immediately
+- Fix Important issues before proceeding
+- Note Minor issues for later
+- Push back if reviewer is wrong (with reasoning)
+
+## Example
+
+```
+[Just completed Task 2: Add verification function]
+
+You: Let me request code review before proceeding.
+
+BASE_SHA=$(git log --oneline | grep "Task 1" | head -1 | awk '{print $1}')
+HEAD_SHA=$(git rev-parse HEAD)
+
+[Dispatch code-reviewer subagent]
+  WHAT_WAS_IMPLEMENTED: Verification and repair functions for conversation index
+  PLAN_OR_REQUIREMENTS: Task 2 from <path/to/plan.md>
+  BASE_SHA: a7981ec
+  HEAD_SHA: 3df7661
+  DESCRIPTION: Added verifyIndex() and repairIndex() with 4 issue types
+
+[Subagent returns]:
+  Strengths: Clean architecture, real tests
+  Issues:
+    Important: Missing progress indicators
+    Minor: Magic number (100) for reporting interval
+  Assessment: Ready to proceed
+
+You: [Fix progress indicators]
+[Continue to Task 3]
+```
+
+## Integration with Workflows
+
+**Subagent-Driven Development:**
+- Review after EACH task
+- Catch issues before they compound
+- Fix before moving to next task
+
+**Executing Plans:**
+- Review after each batch (3 tasks)
+- Get feedback, apply, continue
+
+**Ad-Hoc Development:**
+- Review before merge
+- Review when stuck
+
+## Red Flags
+
+**Never:**
+- Skip review because "it's simple"
+- Ignore Critical issues
+- Proceed with unfixed Important issues
+- Argue with valid technical feedback
+
+**If reviewer wrong:**
+- Push back with technical reasoning
+- Show code/tests that prove it works
+- Request clarification
+
+See template at: requesting-code-review/code-reviewer.md