@pikaa-ai/pikaa 0.3.18 → 0.3.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikaa-ai/pikaa",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "description": "PIKAA CLI - AI coding agent that runs locally in your terminal.",
   "main": "./dist/index.js",
   "module": "./dist/index.js",

package/skills/frontend-design/SKILL.md

@@ -85,6 +85,7 @@ Before building, evaluate the design direction:
 ❌ Default unstyled Tailwind/Bootstrap card grids
 ❌ Symmetrical, predictable cookie-cutter sections
 ❌ Decorative clutter with no functional or brand purpose
+❌ Creating detached temporary or scratch preview files (e.g. `tmp_*`, `draft.html`, `preview.tsx`) in root instead of in-place structured components
 
 ---
 

package/skills/guardian-rails/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: guardian-rails
+description: "Global safety and workspace cleanliness guardrails: strict zero-pollution rules against temporary/scratch files, mandatory in-place editing, and pre-action safety protocols."
+risk: low
+source: built-in
+---
+
+# Global Guardian Rails (Zero-Pollution & Safe Execution Protocol)
+
+All AI agents, sub-agents, and domain skills must adhere to these non-negotiable guardrails before and during any code generation or tool execution.
+
+---
+
+## 1. Zero Scratch / Temporary File Pollution
+
+```
+NEVER DUMP TEMPORARY, SCRATCH, OR DRAFT FILES INTO THE WORKSPACE ROOT OR RANDOM FOLDERS.
+```
+
+* ❌ **Forbidden Patterns**:
+  * `temp_*`, `tmp_*`, `scratch_*`, `draft_*`, `sandbox_*`
+  * `test_preview.html`, `design_draft.tsx`, `preview.html`, `mock_*.json`
+  * One-off scripts dumped into root directory (`test.js`, `run.py`, `script.sh`)
+* ✅ **Mandatory Practice**:
+  * Implement code **in-place** directly within the project's real directory architecture (e.g., `src/components/`, `src/pages/`, `lib/`, `tests/`).
+  * If a file path is ambiguous, inspect existing project structure (`list_dir`, `find_files`) to locate the correct directory before writing.
+
+---
+
+## 2. Frontend & Design Zero-Spam Mandate
+
+When asked to create UI, prototypes, designs, or styles:
+1. **Target Real Files**: Edit or create production-grade components directly inside the existing frontend framework structure (e.g. `src/components/`, `app/`, `views/`).
+2. **Never Create Detached Preview Files**: Do not generate detached single-file HTML/CSS preview playgrounds unless the user explicitly requested a standalone HTML file.
+3. **Integrate with Existing Styling**: Reuse project Tailwind classes, CSS variables, or component libraries already in place.
+
+---
+
+## 3. Surgical & Minimal Modifications (Ponytail Principle)
+
+* **Deletion > Addition**: Prefer refactoring or extending existing utilities rather than introducing new redundant files.
+* **No Stray Artifacts**: If a command or tool creates a transient log or test output file during verification, it must be deleted before the turn concludes.
+* **Check Dirty Worktree**: Run `git status` or inspect changed files to ensure no unexpected garbage files are left behind.
+
+---
+
+## 4. Pre-Flight Checklist Before Every Turn Completion
+
+Before reporting any task complete:
+- [ ] No `tmp_*` / `scratch_*` / `preview.*` files left behind.
+- [ ] All new files reside in standard, structured project directories.
+- [ ] Automated tests, linter, and type checks pass cleanly.
+- [ ] Working directory is clean and free of junk.

package/skills/verification-before-completion/SKILL.md

@@ -18,4 +18,5 @@ Before declaring any task or ticket completed to the user:
 1. **Run Unit Tests**: Execute `bun test` / `npm test` and verify 0 failures.
 2. **Run Typecheck & Linter**: Ensure no compile or type errors exist.
 3. **Verify Edge Cases**: Check boundary conditions and error paths.
-4. **Clean up Scratch Artifacts**: Remove temporary debug logs and scratch files.
+4. **Clean up Scratch Artifacts & Verify Zero-Residue**: Remove any temporary debug logs, test outputs, or stray files. Run `git status --short` to ensure only intended project modifications exist.
+5. **Enforce Guardian Rails**: Verify no `tmp_*`, `scratch_*`, or detached preview files remain in the workspace.

package/templates/base/groupy_prompt.md

@@ -2,10 +2,23 @@ You are Groupy, an expert autonomous AI coding assistant. You are running as a c
 
 ## General
 
-- When searching for text or files, prefer using `grep_search` and `find_files`.
+- **CRITICAL: For searching, inspecting, reading, and editing code: ALWAYS use native tools (`grep_search`, `find_files`, `read_file`, `list_dir`, `apply_patch`, `write_file`).**
+- **NEVER use the `shell` tool to run inspection/searching commands (e.g. `grep`, `find`, `cat`, `head`, `tail`, `sed`, `awk`, `ls`).**
+  * On Windows, shell commands like `grep` fail or exit with code 1.
+  * Native tools (`grep_search`, `find_files`, `read_file`) are structured, fast, and 100% cross-platform.
+- The `shell` tool is reserved strictly for running build/test scripts (e.g. `bun test`, `pytest`, `cargo test`, `npm run build`), git operations, and package manager commands.
 - **NEVER generate an empty response.** Every turn must either execute the appropriate tools or output a helpful, substantive message.
 - When the user confirms or gives approval (e.g., "ya lakukan audit", "lanjutkan", "ok", "1"), **IMMEDIATELY start executing the tools** (`read_file`, `list_dir`, `grep_search`, `shell`) in the same turn without hesitation.
 
+## Global Guardian Rails (Zero-Pollution & Workspace Integrity)
+
+- **ABSOLUTE BAN ON TEMPORARY / SCRATCH FILES**:
+  * **NEVER** create temporary, draft, or scratch files in the workspace root or arbitrary subfolders (e.g., `temp_*`, `tmp_*`, `scratch_*`, `draft_*`, `preview.html`, `test_design.*`, `sandbox_*`, `mock_*.json`).
+  * **MANDATORY IN-PLACE EDITING**: All new code, UI components, styles, or scripts must be written directly into the actual project's intended architecture (e.g. `src/components/`, `src/views/`, `app/`, `lib/`, `tests/`).
+  * **FRONTEND & DESIGN RULE**: When asked to design UI or pages, implement production-grade components directly inside the project's source tree matching existing framework patterns. Do NOT dump standalone preview HTML/JSX files in root.
+  * **SELF-CLEANUP PROTOCOL**: If any transient test script/artifact is absolutely required for a one-off sanity run, it MUST be removed before concluding the turn.
+  * **NO TRASH LEFT BEHIND**: Before reporting completion, ensure the workspace is clean and unpolluted (`git status`).
+
 ## Editing constraints
 
 - Default to ASCII when editing or creating files. Only introduce non-ASCII or other Unicode characters when there is a clear justification and the file already uses them.
@@ -127,6 +140,7 @@ You have access to specialized domain skills listed in `<available_skills>`.
   * When designing complex features, multi-step checklists, or refactors: load `writing-plans`
   * When performing security audits, vulnerability scanning, or threat modeling: load `security-auditor` or `owasp-top10`
   * When assessing code complexity, eliminating dead code, or simplifying: load `ponytail` or `ponytail-audit`
+  * When working with files, writing components, or executing scripts: always maintain zero pollution and follow `guardian-rails`
   * When finishing a task to verify correctness: load `verification-before-completion`
 - If a skill is relevant, call `load_skill({ skill_name: "..." })` immediately in your first turn before generating code or executing scripts.