@stigmer/plugin-package 3.35.0 → 3.36.0

package/src/__tests__/fixtures/cursor-plugins/github/README.md

@@ -1,64 +0,0 @@
-# GitHub
-
-Cursor plugin that connects agents to [GitHub](https://github.com) through GitHub's official remote [Model Context Protocol](https://modelcontextprotocol.io/) server.
-
-Work with repositories, issues, pull requests, code search, and Actions under the permissions of a personal access token you provide.
-
-## Install
-
-1. Open **Cursor Settings → Plugins**.
-2. Search for **GitHub**.
-3. Click **Install**, then set your GitHub personal access token (below).
-
-Or run `/add-plugin github` in chat.
-
-## MCP
-
-```json
-{
-  "mcpServers": {
-    "github": {
-      "type": "http",
-      "url": "https://api.githubcopilot.com/mcp/",
-      "headers": {
-        "Authorization": "Bearer ${GITHUB_PERSONAL_ACCESS_TOKEN}"
-      }
-    }
-  }
-}
-```
-
-## Setup
-
-GitHub's remote MCP server authenticates with a **personal access token (PAT)**. Create one, then paste it into the plugin config.
-
-### 1. Create a personal access token
-
-1. Open https://github.com/settings/tokens.
-2. Create either a **fine-grained** token or a **classic** token.
-3. Grant only the scopes the agent needs. Typical choices:
-   - **Repositories / contents** — read or write code and files
-   - **Issues** — list, create, and update issues
-   - **Pull requests** — list, review, and manage PRs
-   - **Actions** — inspect workflow runs (if you want CI access)
-   - **Metadata** — always required on fine-grained tokens
-4. Set an expiration you are comfortable with, then generate and copy the token.
-
-Prefer a fine-grained token scoped to specific repositories when that is enough. Classic tokens with `repo` are broader and should be treated carefully.
-
-### 2. Configure the plugin
-
-In **Dashboard → Plugins → Configure**, set **GitHub personal access token** to the value you just created.
-
-Tool calls run with that token's permissions. Rotate or revoke the token from GitHub Settings if it is ever exposed.
-
-## Docs
-
-- Use the GitHub MCP server: https://docs.github.com/en/copilot/how-tos/context/use-mcp/use-the-github-mcp-server
-- Managing personal access tokens: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
-
-Logo is GitHub's official Octocat mark, placed on a white tile with padding so it reads well in the Cursor UI.
-
-## License
-
-MIT

package/src/__tests__/fixtures/cursor-plugins/github/mcp.json

@@ -1,11 +0,0 @@
-{
-  "mcpServers": {
-    "github": {
-      "type": "http",
-      "url": "https://api.githubcopilot.com/mcp/",
-      "headers": {
-        "Authorization": "Bearer ${GITHUB_PERSONAL_ACCESS_TOKEN}"
-      }
-    }
-  }
-}

package/src/__tests__/fixtures/cursor-plugins/playwright/.cursor-plugin/plugin.json

@@ -1,35 +0,0 @@
-{
-  "name": "playwright",
-  "displayName": "Playwright",
-  "version": "1.0.0",
-  "minClientVersions": {
-    "cursor": "3.13.0"
-  },
-  "description": "Navigate, click, screenshot, and test in a real browser.",
-  "author": {
-    "name": "Cursor",
-    "email": "plugins@cursor.com"
-  },
-  "homepage": "https://github.com/microsoft/playwright-mcp",
-  "repository": "https://github.com/cursor/plugins",
-  "license": "MIT",
-  "logo": "assets/logo.svg",
-  "keywords": [
-    "playwright",
-    "browser",
-    "automation",
-    "testing",
-    "e2e",
-    "mcp"
-  ],
-  "category": "integrations",
-  "tags": [
-    "playwright",
-    "browser",
-    "automation",
-    "testing",
-    "e2e",
-    "mcp"
-  ],
-  "mcpServers": "./mcp.json"
-}

package/src/__tests__/fixtures/cursor-plugins/playwright/CHANGELOG.md

@@ -1,8 +0,0 @@
-# Changelog
-
-All notable changes to this plugin will be documented here.
-
-## 1.0.0 — initial release
-
-- Logo: Microsoft's official Playwright mark from playwright.dev, on a padded white tile.
-- Added the `playwright` MCP server launched via `npx -y @playwright/mcp@latest`.

package/src/__tests__/fixtures/cursor-plugins/playwright/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Cursor
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/src/__tests__/fixtures/cursor-plugins/playwright/README.md

@@ -1,46 +0,0 @@
-# Playwright
-
-Cursor plugin that connects agents to a real browser through Microsoft's [Playwright MCP](https://github.com/microsoft/playwright-mcp) server.
-
-Navigate pages, click and fill elements, take accessibility snapshots and screenshots, and run end-to-end checks from chat.
-
-## Install
-
-1. Open **Cursor Settings → Plugins**.
-2. Search for **Playwright**.
-3. Click **Install**.
-
-Or run `/add-plugin playwright` in chat.
-
-## Requirements
-
-This is a **local stdio** MCP server. Cursor launches it with `npx -y @playwright/mcp@latest`, so the machine running Cursor needs **Node.js** installed and on `PATH`. The `-y` flag skips `npx`'s install confirmation so the first launch cannot hang waiting for interactive input over stdio.
-
-The first run downloads Playwright's browser binaries. That can take a minute and needs network access; later runs reuse the cached browsers.
-
-## MCP
-
-```json
-{
-  "mcpServers": {
-    "playwright": {
-      "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest"]
-    }
-  }
-}
-```
-
-No credentials are required. The server runs locally and drives a browser on the same machine.
-
-## Docs
-
-- Playwright MCP: https://github.com/microsoft/playwright-mcp
-- Playwright: https://playwright.dev
-
-Logo is Microsoft's official Playwright mark from the Playwright website, placed on a white tile with padding so it reads well in the Cursor UI:
-https://github.com/microsoft/playwright.dev/blob/main/static/img/playwright-logo.svg
-
-## License
-
-MIT

package/src/__tests__/fixtures/cursor-plugins/playwright/mcp.json

@@ -1,8 +0,0 @@
-{
-  "mcpServers": {
-    "playwright": {
-      "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest"]
-    }
-  }
-}

package/src/__tests__/fixtures/cursor-plugins/salesforce/.cursor-plugin/plugin.json

@@ -1,48 +0,0 @@
-{
-  "name": "salesforce",
-  "displayName": "Salesforce",
-  "version": "1.0.0",
-  "description": "Query, create, and update records in your org.",
-  "author": {
-    "name": "Cursor",
-    "email": "plugins@cursor.com"
-  },
-  "homepage": "https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/cursor.html",
-  "repository": "https://github.com/cursor/plugins",
-  "license": "MIT",
-  "logo": "assets/logo.svg",
-  "keywords": [
-    "salesforce",
-    "crm",
-    "mcp",
-    "sales",
-    "soql",
-    "sobject"
-  ],
-  "category": "integrations",
-  "tags": [
-    "mcp",
-    "crm",
-    "sales"
-  ],
-  "variables": {
-    "type": "object",
-    "properties": {
-      "SALESFORCE_MCP_URL": {
-        "type": "string",
-        "title": "Salesforce MCP server URL",
-        "description": "Server URL from Setup → MCP Servers. Production: https://api.salesforce.com/platform/mcp/v1/platform/sobject-all. Sandbox or scratch: https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all. For custom servers, replace platform/ with custom/."
-      },
-      "CLIENT_ID": {
-        "type": "string",
-        "title": "Salesforce Consumer Key",
-        "description": "Consumer Key of the External Client App you created for this integration (Setup → External Client App Manager → your app → Settings → Consumer Key and Secret)."
-      }
-    },
-    "required": [
-      "SALESFORCE_MCP_URL",
-      "CLIENT_ID"
-    ]
-  },
-  "mcpServers": "./mcp.json"
-}

package/src/__tests__/fixtures/cursor-plugins/salesforce/CHANGELOG.md

@@ -1,10 +0,0 @@
-# Changelog
-
-All notable changes to this plugin will be documented here.
-
-## 1.0.0 — initial release
-
-- Logo: Salesforce's official cloud mark, centered on a transparent 192×192 canvas with padding so it reads well on light and dark backgrounds.
-- Added the `salesforce` MCP server backed by Salesforce Hosted MCP.
-- Declared `SALESFORCE_MCP_URL` and `CLIENT_ID` plugin variables so each org can point at its own server and External Client App.
-- Pinned OAuth scopes to `mcp_api` and `refresh_token`.

package/src/__tests__/fixtures/cursor-plugins/salesforce/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Cursor
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/src/__tests__/fixtures/cursor-plugins/salesforce/README.md

@@ -1,95 +0,0 @@
-# Salesforce
-
-Cursor plugin that connects agents to [Salesforce](https://www.salesforce.com) through [Salesforce Hosted MCP](https://developer.salesforce.com/docs/platform/hosted-mcp-servers/), Salesforce's first-party [Model Context Protocol](https://modelcontextprotocol.io/) service.
-
-Run SOQL and SOSL, inspect object schemas, traverse relationships, and create, update, or delete records — all under the signed-in user's own permissions and field-level security.
-
-## Install
-
-1. Open **Cursor Settings → Plugins**.
-2. Search for **Salesforce**.
-3. Click **Install**, then set the server URL and consumer key (below) and complete the Salesforce sign-in prompt.
-
-Or run `/add-plugin salesforce` in chat.
-
-## MCP
-
-```json
-{
-  "mcpServers": {
-    "salesforce": {
-      "type": "http",
-      "url": "${SALESFORCE_MCP_URL}",
-      "auth": {
-        "CLIENT_ID": "${CLIENT_ID}",
-        "scopes": ["mcp_api", "refresh_token"]
-      }
-    }
-  }
-}
-```
-
-## Setup
-
-Salesforce Hosted MCP requires an **External Client App** in your org. Connected Apps are not supported.
-
-### 1. Create the External Client App
-
-From Setup, go to **External Client App Manager → New External Client App**, fill in the basics, then expand **API (Enable OAuth Settings)** and check **Enable OAuth**.
-
-Add every callback URL you need — Cursor uses different ones per surface:
-
-| Surface | Callback URL |
-|:--------|:-------------|
-| Desktop | `http://localhost:8787/callback` |
-| Web and Cloud Agents | `https://www.cursor.com/agents/mcp/oauth/callback` |
-| Older desktop builds | `cursor://anysphere.cursor-mcp/oauth/callback` |
-
-Under **OAuth Scopes**, select exactly these two and nothing broader:
-
-- **Access Salesforce hosted MCP servers** (`mcp_api`)
-- **Perform requests at any time** (`refresh_token`, `offline_access`)
-
-The second one is easy to miss because the picker labels scopes by description rather than by value. Without it the plugin cannot refresh, and every user has to re-authenticate when their access token expires. Do not add **Full access** (`full`) — Hosted MCP does not need it.
-
-Under **Security**, select **Issue JSON Web Token (JWT)-based access tokens for named users**. This is required: without it Salesforce issues opaque tokens and every tool call fails with `JWT Token is required`. Leave **Require Secret for Web Server Flow** off — Cursor authenticates as a public client using PKCE, so no client secret is involved. Do not enable the **JWT Bearer Flow**, which is a different feature and needs a certificate.
-
-Finally, copy the **Consumer Key** from **Settings → Consumer Key and Secret**.
-
-A new External Client App can take up to 30 minutes to propagate. Until it does, authentication fails with `invalid_client_id`; wait rather than recreating the app.
-
-### 2. Activate a server and copy its URL
-
-In Setup, open **MCP Servers**, activate the server you want, and copy its **Server URL**. The URL encodes both the org type and the server:
-
-| Org type | Standard server | Custom server |
-|:---------|:----------------|:--------------|
-| Production, Developer, Enterprise | `https://api.salesforce.com/platform/mcp/v1/platform/sobject-all` | `https://api.salesforce.com/platform/mcp/v1/custom/myserver` |
-| Sandbox or scratch | `https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all` | `https://api.salesforce.com/platform/mcp/v1/sandbox/custom/myserver` |
-
-Salesforce ships several standard servers with different blast radii — `sobject-reads` for read-only access, `sobject-mutations` for reads plus create and update, `sobject-deletes`, and `sobject-all` for everything. Point the plugin at the narrowest one that does the job.
-
-### 3. Configure the plugin
-
-In **Dashboard → Plugins → Configure**, set **Salesforce MCP server URL** and **Salesforce Consumer Key**, then complete the Salesforce login when Cursor prompts.
-
-On a team marketplace an admin sets both values once. Each member still authenticates individually, so tools run with that member's own object and field permissions.
-
-## Troubleshooting
-
-| Symptom | Cause |
-|:--------|:------|
-| `invalid_client_id` | The External Client App has not finished propagating. Wait up to 30 minutes. |
-| `invalid_scope` | The app is missing **Access Salesforce hosted MCP servers** or **Perform requests at any time**. |
-| `JWT Token is required` or `Invalid token` after a successful login | **Issue JSON Web Token (JWT)-based access tokens for named users** is not enabled. |
-| Auth succeeds but the server 404s | The MCP server is not activated in Setup, or the URL's org type does not match the org you logged into. |
-
-## Docs
-
-- Configure Cursor: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/cursor.html
-- Create an External Client App: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/create-external-client-app.html
-- Available servers: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/references/reference/sobject-all.html
-
-## License
-
-MIT

package/src/__tests__/fixtures/cursor-plugins/salesforce/mcp.json

@@ -1,12 +0,0 @@
-{
-  "mcpServers": {
-    "salesforce": {
-      "type": "http",
-      "url": "${SALESFORCE_MCP_URL}",
-      "auth": {
-        "CLIENT_ID": "${CLIENT_ID}",
-        "scopes": ["mcp_api", "refresh_token"]
-      }
-    }
-  }
-}

package/src/__tests__/fixtures/cursor-plugins/thermos/.cursor-plugin/plugin.json

@@ -1,32 +0,0 @@
-{
-  "name": "thermos",
-  "displayName": "Thermos",
-  "version": "1.0.0",
-  "description": "Thermo-nuclear branch review: deep correctness and security audits plus harsh code-quality rubrics, parallel subagents, thermos orchestration, and optional take-the-wheel and FSD merge-ready flows.",
-  "author": {
-    "name": "Cursor",
-    "email": "plugins@cursor.com"
-  },
-  "homepage": "https://github.com/cursor/plugins",
-  "repository": "https://github.com/cursor/plugins",
-  "license": "MIT",
-  "logo": "assets/logo.png",
-  "keywords": [
-    "thermos",
-    "thermo-nuclear",
-    "code-review",
-    "deep-review",
-    "code-quality",
-    "security-review",
-    "subagents"
-  ],
-  "category": "developer-tools",
-  "tags": [
-    "review",
-    "quality",
-    "shipping",
-    "automation"
-  ],
-  "skills": "./skills/",
-  "agents": "./agents/"
-}

package/src/__tests__/fixtures/cursor-plugins/thermos/CHANGELOG.md

@@ -1,8 +0,0 @@
-# Changelog
-
-## 1.0.0
-
-- Initial Thermos plugin release.
-- Skills: `thermo-nuclear-review`, `thermo-nuclear-code-quality-review`, `thermos`.
-- Agents: `thermo-nuclear-review-subagent`, `thermo-nuclear-code-quality-review-subagent`.
-- Architecture diagram embedded as a mermaid block in README.

package/src/__tests__/fixtures/cursor-plugins/thermos/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Cursor
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/src/__tests__/fixtures/cursor-plugins/thermos/README.md

@@ -1,70 +0,0 @@
-# Thermos plugin
-
-Thermo-nuclear branch review for Cursor agents: deep correctness and security audits, harsh maintainability rubrics, and parallel subagent orchestration.
-
-## Installation
-
-```bash
-/add-plugin thermos
-```
-
-## Architecture
-
-```mermaid
-flowchart TB
-  subgraph L2["Orchestrator"]
-    TH[thermos]
-  end
-
-  subgraph L1["Subagents"]
-    SNR[thermo-nuclear-review-subagent]
-    SNCQ[thermo-nuclear-code-quality-review-subagent]
-  end
-
-  DIFF[git diff + file contents]
-
-  subgraph L0["Skills"]
-    TNR[thermo-nuclear-review]
-    TNCQ[thermo-nuclear-code-quality-review]
-  end
-
-  TH --> SNR
-  TH --> SNCQ
-  SNR --> TNR
-  SNR --> DIFF
-  SNCQ --> TNCQ
-  SNCQ --> DIFF
-```
-
-## Skills
-
-| Skill | Description |
-|:------|:------------|
-| `thermo-nuclear-review` | Deep branch audit (bugs, breakages, security, devex, feature-gate leaks). |
-| `thermo-nuclear-code-quality-review` | Strict maintainability audit (code-judo, 1k-line rule, spaghetti, boundaries). |
-| `thermos` | Run both review subagents in parallel and synthesize findings. |
-
-## Agents
-
-| Agent | Description |
-|:------|:------------|
-| `thermo-nuclear-review-subagent` | Task subagent for deep review rubric (diff-scoped). |
-| `thermo-nuclear-code-quality-review-subagent` | Task subagent for code-quality rubric (diff-scoped). |
-
-## Typical usage
-
-**Double review (thermos):**
-
-1. Gather `git diff main...HEAD` and full contents of changed files.
-2. Invoke both subagents in one message with `run_in_background: true`.
-3. Synthesize prioritized, deduped findings.
-
-**Single skill:** invoke `thermo-nuclear-review` or `thermo-nuclear-code-quality-review` in the main agent, or the matching subagent after gathering diff context.
-
-## Migration from cursor-team-kit
-
-`cursor-team-kit` previously included only `thermo-nuclear-code-quality-review`. That skill and agent now live in **Thermos** alongside deep review and `thermos`. Remove the old thermo entries from team-kit when you install this plugin to avoid duplicates.
-
-## License
-
-MIT

package/src/__tests__/fixtures/cursor-plugins/thermos/agents/thermo-nuclear-code-quality-review-subagent.md

@@ -1,23 +0,0 @@
----
-name: thermo-nuclear-code-quality-review-subagent
-description: Thermo-nuclear code quality audit (maintainability, structure, 1k-line rule, spaghetti, code-judo). Invoked via Task after a parent gathers diff and file contents. Loads rubric from the thermo-nuclear-code-quality-review skill in the Thermos plugin.
----
-
-# Thermo-Nuclear Code Quality Review
-
-You are a **Task subagent**. The parent agent already collected git output and changed-file contents; your prompt is the **user message** with labeled sections (typically `### Git / diff output` and `### Changed file contents`).
-
-## Rubric
-
-1. Load the `thermo-nuclear-code-quality-review` skill (shipped in the Thermos plugin) and treat its `SKILL.md` as the **complete** rubric — tone, approval bar, output ordering, code-judo / 1k-line / spaghetti rules.
-2. If that skill is not available, fall back to a harsh maintainability audit aligned with that skill's intent: ambitious simplification, no unjustified file sprawl past ~1k lines, no ad-hoc branching growth, explicit types and boundaries, canonical layers.
-
-## Work
-
-- Apply the rubric **only** to what the diff and contents show. Trace cross-file impact when the change touches module boundaries.
-- Output in the **priority order** the rubric specifies. Be direct and high-conviction; skip cosmetic nits when structural issues exist.
-- Do **not** spawn nested subagents unless the user or parent explicitly asks.
-
-## Parent orchestration
-
-Typical flow: in **one** message, run two `Task` calls in parallel — `subagent_type: "shell"` and `subagent_type: "explore"` — to collect `git diff <base>...HEAD` output and full contents of changed files (default base `main`). Then invoke this agent with `subagent_type: "thermo-nuclear-code-quality-review-subagent"` and a user prompt containing `### Git / diff output` and `### Changed file contents`.

package/src/__tests__/fixtures/cursor-plugins/thermos/agents/thermo-nuclear-review-subagent.md

@@ -1,28 +0,0 @@
----
-name: thermo-nuclear-review-subagent
-description: Thermo-nuclear branch audit (bugs, breaking changes, security, devex, feature-flag leaks) scoped to the diff. Invoked via Task after a parent gathers diff and file contents. Loads rubric from the thermo-nuclear-review skill in the Thermos plugin.
----
-
-# Thermo Nuclear Review (Deep review)
-
-You are a **Task subagent**. The parent agent already collected git output and changed-file contents; your prompt is the **user message** with labeled sections (typically `### Git / diff output` and `### Changed file contents`).
-
-## Rubric
-
-1. Load the `thermo-nuclear-review` skill (shipped in the Thermos plugin) and follow its `SKILL.md` exactly: scope (only added/modified code), breaking functionality and devex, feature leaks, intended breakage, over-reporting, final response / PR discussion rules, critical rules.
-2. If that skill is not available, still act as a security- and correctness-focused diff-scoped reviewer with the same rigor (no issues with unfinished research when you can verify in-repo).
-
-## Work
-
-1. Perform the full audit against **only** the changed code in the diff. Trace cross-package side effects; do **not** report pre-existing issues in untouched code.
-2. Finish your **independent** audit first (fresh eyes).
-3. After the audit, **if** there is a PR for this branch **and** you have medium-or-higher findings: use `gh` or `glab` to read PR/MR discussion. Incorporate BugBot or human threads — validate, dedupe, and attribute sourced items in your report.
-4. **Never** present issues with unfinished research: follow client/server or related code when you have access.
-
-Calibrate severity honestly. Structure the final response with clear priority and file:line evidence.
-
-Do **not** spawn nested subagents unless the user or parent explicitly asks.
-
-## Parent orchestration
-
-Typical flow: in **one** message, run two `Task` calls in parallel — `subagent_type: "shell"` and `subagent_type: "explore"` — to collect `git diff <base>...HEAD` output and full contents of changed files (default base `main`). Then invoke this agent with `subagent_type: "thermo-nuclear-review-subagent"` and a user prompt containing `### Git / diff output` and `### Changed file contents`.