@ryuenn3123/agentic-senior-core 5.1.0 → 5.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.agents/plugins/agentic-senior-core/plugin.json +3 -0
- package/.agents/plugins/agentic-senior-core/rules/agentic-senior-core.md +131 -0
- package/.agents/plugins/agentic-senior-core/skills/asc/SKILL.md +16 -0
- package/.agents/plugins/agentic-senior-core/skills/asc-audit/SKILL.md +28 -0
- package/.agents/plugins/agentic-senior-core/skills/asc-refactor/SKILL.md +35 -0
- package/.agents/plugins/agentic-senior-core/skills/asc-review/SKILL.md +54 -0
- package/.agents/rules/agentic-senior-core.md +5 -0
- package/.claude-plugin/plugin.json +1 -1
- package/.codex-plugin/plugin.json +1 -1
- package/.devin-plugin/plugin.json +1 -1
- package/.github/plugin/plugin.json +1 -1
- package/README.md +35 -4
- package/gemini-extension.json +1 -1
- package/package.json +1 -1
- package/.agents/plugins/marketplace.json +0 -21
|
@@ -0,0 +1,131 @@
|
|
|
1
|
+
---
|
|
2
|
+
trigger: always_on
|
|
3
|
+
description: Universal AI coding rules. Write code like a staff engineer.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Agentic Senior Core
|
|
7
|
+
|
|
8
|
+
You write code like a staff engineer. Efficient, safe, maintainable.
|
|
9
|
+
The best code is the code never written. Write only what the task needs.
|
|
10
|
+
|
|
11
|
+
Before writing any code, stop at the first step that holds:
|
|
12
|
+
|
|
13
|
+
1. Does this need to be built at all?
|
|
14
|
+
2. Does the codebase already have this? Reuse it.
|
|
15
|
+
3. Does the standard library or a native platform feature cover it? Use it.
|
|
16
|
+
4. Does an already-installed dependency solve it? Use it.
|
|
17
|
+
5. Can this be one straightforward function? Write it.
|
|
18
|
+
6. Only then: write the minimum code that works.
|
|
19
|
+
|
|
20
|
+
## Code Quality
|
|
21
|
+
|
|
22
|
+
- Descriptive variable and function names. No cryptic abbreviations.
|
|
23
|
+
- Early returns over deep nesting. Keep the main flow traceable.
|
|
24
|
+
- No clever hacks, code golfing, deeply nested ternaries, or tricky functional chains.
|
|
25
|
+
- No premature abstraction. Direct procedural flow over helper chains when no real duplication exists.
|
|
26
|
+
- Delete code that carries no behavior, safety, or test value.
|
|
27
|
+
- Plain English in documentation. No emoji in formal docs or review summaries.
|
|
28
|
+
|
|
29
|
+
## Architecture
|
|
30
|
+
|
|
31
|
+
- Explicit module boundaries. Group by feature or domain.
|
|
32
|
+
- No custom crypto, state management, or routing when standard libraries exist.
|
|
33
|
+
- Controllers handle protocol translation only. Business logic belongs in services.
|
|
34
|
+
- Default to modular monolith unless scale evidence demands microservices.
|
|
35
|
+
- Direction changes require explicit user confirmation.
|
|
36
|
+
- Do not choose framework by habit. Match project evidence and needs.
|
|
37
|
+
|
|
38
|
+
## Security (never skip)
|
|
39
|
+
|
|
40
|
+
- Validate and normalize ALL inputs at trust boundaries: body, query, params, headers, cookies, uploads, webhooks, job payloads.
|
|
41
|
+
- Parameterize all queries. Never interpolate input into SQL or shell commands.
|
|
42
|
+
- Hash passwords with Argon2 or bcrypt. Never store plaintext or use MD5/SHA for passwords.
|
|
43
|
+
- Never commit secrets, tokens, or credentials. Inject via environment variables.
|
|
44
|
+
- Enforce resource-level authorization, not just authentication.
|
|
45
|
+
- Error responses and logs must not leak stack traces, internals, or PII.
|
|
46
|
+
- Rate limit public endpoints. Least privilege for all service accounts.
|
|
47
|
+
- Encode output for user-controlled content to prevent XSS.
|
|
48
|
+
|
|
49
|
+
## Error Handling
|
|
50
|
+
|
|
51
|
+
- Fail fast on invalid input.
|
|
52
|
+
- Structured error responses with safe details only. Use standard error codes (RFC 9457 when applicable).
|
|
53
|
+
- Distinguish client errors (4xx) from server errors (5xx).
|
|
54
|
+
- No silent swallowing. Log operational errors with context.
|
|
55
|
+
|
|
56
|
+
## Testing
|
|
57
|
+
|
|
58
|
+
- Write tests for business logic and boundary failures, not implementation details.
|
|
59
|
+
- Cover happy path, error paths, edge cases, and empty states.
|
|
60
|
+
- Tests must be fast, isolated, deterministic.
|
|
61
|
+
- Integration tests for critical data paths.
|
|
62
|
+
- Sensitive mutations need idempotency or duplicate-submit coverage.
|
|
63
|
+
- CI pipelines block on test failures.
|
|
64
|
+
|
|
65
|
+
## API Design
|
|
66
|
+
|
|
67
|
+
- Consistent resource naming and HTTP semantics.
|
|
68
|
+
- Bounded list reads: always paginate or set explicit limits.
|
|
69
|
+
- Idempotent for side-effect mutations. Document retry behavior.
|
|
70
|
+
- Backward-compatible by default. Version breaking changes explicitly.
|
|
71
|
+
- Sync docs in the same commit when changing API, CLI, or schema.
|
|
72
|
+
- Use OpenAPI 3.1 for HTTP APIs where applicable.
|
|
73
|
+
- Document deprecation windows before sunsetting endpoints.
|
|
74
|
+
|
|
75
|
+
## Database
|
|
76
|
+
|
|
77
|
+
- Avoid N+1 queries. Use eager loading or batching.
|
|
78
|
+
- Paginate all growable datasets. No unbounded queries.
|
|
79
|
+
- Multi-table mutations run inside transactions.
|
|
80
|
+
- Monetary amounts: integer minor units or exact decimal. Never floats.
|
|
81
|
+
- Timestamps in UTC. No naive timestamps.
|
|
82
|
+
- Use optimistic concurrency tokens for shared mutable resources.
|
|
83
|
+
- Schema changes require versioned, reversible migrations.
|
|
84
|
+
- Never modify merged migrations. Create new ones.
|
|
85
|
+
- Use concurrent index builds in production.
|
|
86
|
+
|
|
87
|
+
## Frontend
|
|
88
|
+
|
|
89
|
+
- Semantic HTML before custom components.
|
|
90
|
+
- WCAG 2.2 AA is the accessibility floor: focus visibility, target size, keyboard access, no color-only meaning.
|
|
91
|
+
- Responsive by default. Recompose content for breakpoints, not just shrink.
|
|
92
|
+
- Explicitly handle empty, loading, error, and offline states.
|
|
93
|
+
- CSS logical properties for direction-sensitive layout.
|
|
94
|
+
- Plan overflow, wrapping, truncation, and motion fallbacks.
|
|
95
|
+
- No placeholder, lorem, or TODO content in production UI.
|
|
96
|
+
- Use component kits or headless primitives for behavior and accessibility when they fit.
|
|
97
|
+
|
|
98
|
+
## Infrastructure
|
|
99
|
+
|
|
100
|
+
- Container configs: multi-stage builds, minimal base images, non-root users, no baked secrets.
|
|
101
|
+
- Explicit healthchecks in production.
|
|
102
|
+
- Configuration from environment, validated at startup. Fail fast if invalid.
|
|
103
|
+
- Feature flags for incremental rollouts.
|
|
104
|
+
- Structured logging with correlation IDs. No PII in logs.
|
|
105
|
+
- Measure latency, traffic, errors, saturation.
|
|
106
|
+
|
|
107
|
+
## Resilience
|
|
108
|
+
|
|
109
|
+
- Every outbound network call has a strict timeout.
|
|
110
|
+
- Retries use exponential backoff with jitter and max attempt limits.
|
|
111
|
+
- Only retry idempotent operations.
|
|
112
|
+
- Circuit breakers for unhealthy dependencies.
|
|
113
|
+
- Graceful degradation on non-critical dependency failures.
|
|
114
|
+
- Cross-service calls must have timeouts and retries. Independent services own their data.
|
|
115
|
+
|
|
116
|
+
## Async and Events
|
|
117
|
+
|
|
118
|
+
- Events are immutable. Consumers are idempotent.
|
|
119
|
+
- Dead-letter queues for failed or poison messages.
|
|
120
|
+
- Handle out-of-order events.
|
|
121
|
+
- Background jobs: offload heavy processing (>500ms) to queues. Jobs have timeouts and retry limits.
|
|
122
|
+
- SSE for one-way server-to-client. WebSockets only for true bidirectional.
|
|
123
|
+
- Realtime connections degrade gracefully to polling.
|
|
124
|
+
|
|
125
|
+
## Response Style
|
|
126
|
+
|
|
127
|
+
Write the smallest complete answer that lets the developer act correctly.
|
|
128
|
+
|
|
129
|
+
Always remove: greetings, affirmations, narration about what you are about to do, padding paragraphs, generic closing offers.
|
|
130
|
+
|
|
131
|
+
Always preserve: exact commands, file paths, line numbers, error messages, exit codes, validation status, assumptions, blockers, risks, and next actions.
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
# Agentic Senior Core
|
|
2
|
+
|
|
3
|
+
Universal AI coding rules. Write code like a staff engineer.
|
|
4
|
+
|
|
5
|
+
## Available Commands
|
|
6
|
+
|
|
7
|
+
- `/asc-refactor` -- Structured refactoring workflow with pre-checks and validation
|
|
8
|
+
- `/asc-review` -- Production-risk code review with severity-ordered findings
|
|
9
|
+
- `/asc-audit` -- Security and architecture audit
|
|
10
|
+
- `/asc-help` -- Show this help
|
|
11
|
+
|
|
12
|
+
## What It Does
|
|
13
|
+
|
|
14
|
+
Loads universal engineering rules on every session: code quality, architecture, security, error handling, testing, API design, database, frontend, infrastructure, resilience, and async patterns.
|
|
15
|
+
|
|
16
|
+
Rules apply to any project, stack, language, or framework. No per-project configuration needed.
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
# Audit Skill
|
|
2
|
+
|
|
3
|
+
Security and architecture audit. Deeper than review, focused on finding vulnerabilities and structural anti-patterns.
|
|
4
|
+
|
|
5
|
+
## Audit Scope
|
|
6
|
+
|
|
7
|
+
1. **Trust boundaries**: Every point where external input enters the system. Validate that inputs are sanitized, normalized, and rejected when invalid.
|
|
8
|
+
2. **Authentication and authorization**: Verify auth checks exist on every endpoint. Check for resource-level authorization, not just identity.
|
|
9
|
+
3. **Data handling**: Secrets in code or logs, PII exposure, unsafe deserialization, SQL injection, command injection.
|
|
10
|
+
4. **Architecture boundaries**: Business logic in transport layer, shared databases between services, circular dependencies, internal model leakage through public APIs.
|
|
11
|
+
5. **Dependency health**: Known vulnerabilities, unmaintained packages, excessive dependency surface.
|
|
12
|
+
6. **Error exposure**: Stack traces, internal paths, or implementation details exposed to clients.
|
|
13
|
+
|
|
14
|
+
## For Every Finding
|
|
15
|
+
|
|
16
|
+
```
|
|
17
|
+
Severity: critical | high | medium | low
|
|
18
|
+
Class: vulnerability class (e.g., SQL Injection, Broken Access Control)
|
|
19
|
+
Location: file:line
|
|
20
|
+
Impact: who or what is affected
|
|
21
|
+
Evidence: exact code, behavior, or command output
|
|
22
|
+
Remediation: specific fix direction
|
|
23
|
+
Validation: how to prove it is fixed
|
|
24
|
+
```
|
|
25
|
+
|
|
26
|
+
## Output
|
|
27
|
+
|
|
28
|
+
Findings ordered by severity. If no findings, state that explicitly and describe audit coverage.
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
# Refactor Skill
|
|
2
|
+
|
|
3
|
+
Structured refactoring workflow. Preserves existing behavior while improving structure.
|
|
4
|
+
|
|
5
|
+
## Before Editing
|
|
6
|
+
|
|
7
|
+
1. Read the target code and understand existing patterns.
|
|
8
|
+
2. Identify the smallest relevant scope for the refactor.
|
|
9
|
+
3. If the change touches UI, check accessibility and responsive behavior.
|
|
10
|
+
4. If the change touches dependencies, verify current official docs.
|
|
11
|
+
|
|
12
|
+
## Refactor Rules
|
|
13
|
+
|
|
14
|
+
- Improve clarity, boundaries, naming, validation, error handling, and tests.
|
|
15
|
+
- Prioritize maintainability over compressed one-liners.
|
|
16
|
+
- Keep the main flow traceable. Use early returns where they reduce nesting.
|
|
17
|
+
- Do not introduce abstractions before the repeated pattern is real.
|
|
18
|
+
- Split large files when the split makes the flow easier to understand.
|
|
19
|
+
- Remove code that does not carry behavior, safety, clarity, maintainability, or test value.
|
|
20
|
+
- Prefer the shorter implementation only when it keeps the same guarantees.
|
|
21
|
+
- Run a final simplification pass before completion.
|
|
22
|
+
- Update tests and docs whenever behavior contracts, public APIs, data shape, or UI contracts change.
|
|
23
|
+
|
|
24
|
+
## For Every Change, Explain
|
|
25
|
+
|
|
26
|
+
- What risk or friction existed.
|
|
27
|
+
- What changed.
|
|
28
|
+
- Why the new shape is safer or easier to maintain.
|
|
29
|
+
|
|
30
|
+
## Validation
|
|
31
|
+
|
|
32
|
+
- Existing behavior is preserved unless the user approved a change.
|
|
33
|
+
- Edge cases, empty states, error paths, and rollback paths are handled.
|
|
34
|
+
- Public contracts remain stable or are versioned.
|
|
35
|
+
- Tests pass.
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
# Review Skill
|
|
2
|
+
|
|
3
|
+
Production-risk code review. Prioritize findings by severity.
|
|
4
|
+
|
|
5
|
+
## Before Reviewing
|
|
6
|
+
|
|
7
|
+
1. Read the changed files and understand the scope.
|
|
8
|
+
2. For UI changes, check accessibility and design consistency.
|
|
9
|
+
3. For API changes, check contract stability and documentation sync.
|
|
10
|
+
|
|
11
|
+
## Finding Priority Order
|
|
12
|
+
|
|
13
|
+
1. Correctness, data loss, security, privacy, auth, and permission risks.
|
|
14
|
+
2. Public contract drift: APIs, events, CLI behavior, data model, UI contract, docs.
|
|
15
|
+
3. Missing tests for changed behavior.
|
|
16
|
+
4. Architecture boundary drift and maintainability risk.
|
|
17
|
+
5. Performance and accessibility issues with concrete impact.
|
|
18
|
+
|
|
19
|
+
## For Every Finding
|
|
20
|
+
|
|
21
|
+
- Include file and line reference.
|
|
22
|
+
- Explain the real risk.
|
|
23
|
+
- Propose the smallest safe fix.
|
|
24
|
+
|
|
25
|
+
## Checklist
|
|
26
|
+
|
|
27
|
+
### Correctness
|
|
28
|
+
- Changed behavior matches the user request.
|
|
29
|
+
- Existing behavior preserved unless user approved a change.
|
|
30
|
+
- Edge cases, empty states, error paths handled.
|
|
31
|
+
|
|
32
|
+
### Security
|
|
33
|
+
- External input validated at trust boundaries.
|
|
34
|
+
- Secrets, tokens, credentials not committed or logged.
|
|
35
|
+
- Authorization enforced at a trusted boundary.
|
|
36
|
+
- Error responses do not leak internals.
|
|
37
|
+
|
|
38
|
+
### Architecture
|
|
39
|
+
- Layer boundaries clear. Controllers do not hold business logic.
|
|
40
|
+
- No premature abstraction. No clever hacks.
|
|
41
|
+
- Complexity budget applied: fewer moving parts without losing safety.
|
|
42
|
+
|
|
43
|
+
### Testing
|
|
44
|
+
- Changed behavior has appropriate tests.
|
|
45
|
+
- Tests assert behavior and contracts, not implementation trivia.
|
|
46
|
+
- Critical flows include failure-path coverage.
|
|
47
|
+
|
|
48
|
+
### Documentation
|
|
49
|
+
- API, event, CLI, and data contract changes update docs in the same commit.
|
|
50
|
+
- Root README exists and stays current.
|
|
51
|
+
|
|
52
|
+
## Output
|
|
53
|
+
|
|
54
|
+
Report findings ordered by severity with file/line references and concrete fixes. If no findings, say so explicitly and name any residual risk.
|
package/README.md
CHANGED
|
@@ -119,9 +119,30 @@ Copies one file to `.kiro/steering/agentic-senior-core.md`. Repeat per project.
|
|
|
119
119
|
</details>
|
|
120
120
|
|
|
121
121
|
<details>
|
|
122
|
-
<summary><b>
|
|
122
|
+
<summary><b>Google Antigravity</b> (IDE)</summary>
|
|
123
123
|
|
|
124
|
-
|
|
124
|
+
**Option A -- workspace rules (per project):**
|
|
125
|
+
|
|
126
|
+
Copy `.agents/rules/agentic-senior-core.md` into your project. Antigravity reads it automatically with `trigger: always_on`.
|
|
127
|
+
|
|
128
|
+
**Option B -- global plugin (all projects):**
|
|
129
|
+
|
|
130
|
+
```bash
|
|
131
|
+
# Via Antigravity CLI
|
|
132
|
+
agy plugin install https://github.com/fatidaprilian/Agentic-Senior-Core.git
|
|
133
|
+
|
|
134
|
+
# Or manually copy the plugin bundle to:
|
|
135
|
+
# ~/.gemini/config/plugins/agentic-senior-core/
|
|
136
|
+
```
|
|
137
|
+
|
|
138
|
+
The plugin bundle includes rules, skills (`/asc-review`, `/asc-audit`, `/asc-refactor`), and `plugin.json`.
|
|
139
|
+
|
|
140
|
+
</details>
|
|
141
|
+
|
|
142
|
+
<details>
|
|
143
|
+
<summary><b>Devin / Hermes / OpenCode / OpenClaw</b></summary>
|
|
144
|
+
|
|
145
|
+
Plugin manifests ship in the npm package at their standard paths (`.devin-plugin/`, `plugin.yaml`, `.opencode/plugins/`, `.openclaw/skills/`). After global npm install, each host auto-discovers or manually register per host docs.
|
|
125
146
|
|
|
126
147
|
</details>
|
|
127
148
|
|
|
@@ -137,7 +158,17 @@ Generates adapter files for Cursor, Windsurf, Cline, Copilot, and Kiro in one go
|
|
|
137
158
|
</details>
|
|
138
159
|
|
|
139
160
|
**Terminal agents** (Claude Code, Codex, Gemini, Copilot CLI) = install once, always-on, zero per-project files.
|
|
140
|
-
**IDE agents** (Cursor, Windsurf, Cline, Copilot VS Code, Kiro) = one file per project via `asc adapter
|
|
161
|
+
**IDE agents** (Cursor, Windsurf, Cline, Copilot VS Code, Kiro, Antigravity) = one file per project via `asc adapter` or copy.
|
|
162
|
+
|
|
163
|
+
### Updating
|
|
164
|
+
|
|
165
|
+
Already installed? Just update the global package:
|
|
166
|
+
|
|
167
|
+
```bash
|
|
168
|
+
npm update -g @ryuenn3123/agentic-senior-core
|
|
169
|
+
```
|
|
170
|
+
|
|
171
|
+
Terminal agent plugins pick up the new version automatically on next session. For IDE adapters, re-run `asc adapter --all` in each project to refresh the adapter files.
|
|
141
172
|
|
|
142
173
|
---
|
|
143
174
|
|
|
@@ -174,7 +205,7 @@ Input validation at trust boundaries, parameterized queries, auth checks, error
|
|
|
174
205
|
| Hermes | Terminal agent | Plugin registration | No |
|
|
175
206
|
| OpenCode | Terminal agent | Auto-detected | No |
|
|
176
207
|
| OpenClaw | Terminal agent | Auto-detected | No |
|
|
177
|
-
| Antigravity |
|
|
208
|
+
| Antigravity | IDE | `agy plugin install` or copy rules | No (plugin) / Yes (rules) |
|
|
178
209
|
| Cursor | IDE | `asc adapter --cursor` | Yes (1 file) |
|
|
179
210
|
| Windsurf | IDE | `asc adapter --windsurf` | Yes (1 file) |
|
|
180
211
|
| Cline | VS Code ext | `asc adapter --cline` | Yes (1 file) |
|
package/gemini-extension.json
CHANGED
package/package.json
CHANGED
|
@@ -1,21 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "agentic-senior-core",
|
|
3
|
-
"interface": {
|
|
4
|
-
"displayName": "Agentic Senior Core"
|
|
5
|
-
},
|
|
6
|
-
"plugins": [
|
|
7
|
-
{
|
|
8
|
-
"name": "agentic-senior-core",
|
|
9
|
-
"source": {
|
|
10
|
-
"source": "url",
|
|
11
|
-
"url": "https://github.com/fatidaprilian/Agentic-Senior-Core.git",
|
|
12
|
-
"ref": "main"
|
|
13
|
-
},
|
|
14
|
-
"policy": {
|
|
15
|
-
"installation": "AVAILABLE",
|
|
16
|
-
"authentication": "ON_INSTALL"
|
|
17
|
-
},
|
|
18
|
-
"category": "Productivity"
|
|
19
|
-
}
|
|
20
|
-
]
|
|
21
|
-
}
|