@su-record/vibe 2.16.4 → 3.1.0

package/skills/systematic-debugging/SKILL.md

@@ -1,142 +0,0 @@
----
-name: systematic-debugging
-user-invocable: false
-invocation: [auto]
-tier: core
-description: "Enforce reproduce-first, root-cause-first, failing-test-first debugging. Auto-activates on bug, error, fail, broken, crash, flaky keywords."
-triggers: [bug, error, fail, broken, crash, flaky, not working, regression, unexpected, stack trace, exception, debug]
-priority: 90
----
-
-# Systematic Debugging
-
-## Hard Gates
-
-These rules have NO exceptions:
-
-1. **Never fix before reproducing or observing the failure.**
-2. **State a root-cause hypothesis before changing code.**
-3. **Write a failing test (or equivalent) before fixing.**
-4. **Test one hypothesis at a time.**
-5. **No "while I'm here" refactoring during a fix.**
-6. **3 failed fixes → suspect structural issue, stop patching.**
-
-These excuses are NOT allowed:
-- "It looks simple, I'll just fix it"
-- "No time, let me patch and move on"
-- "This seems like the issue, let me just change it"
-
-## Workflow
-
-Follow this order strictly.
-
-### Phase 1. Define The Problem
-
-```text
-Problem: <expected> but got <actual> under <condition>
-```
-
-Good: "Product detail API returns 500 when brand is null."
-Bad: "Serializer is broken because brand mapping seems wrong."
-
-### Phase 2. Reproduce Or Instrument
-
-Priority:
-1. Reproduce with existing test
-2. Minimal integration test
-3. Unit test
-4. Reproduction script/command
-5. Add logging/instrumentation to observe
-
-Rules:
-- Make reproduction path as small as possible.
-- If UI-only bug, prefer reproducing at a lower layer.
-- If flaky, add logging for inputs, timing, concurrency conditions.
-- If can't reproduce, do NOT proceed to fix — increase observability first.
-
-### Phase 3. Gather Evidence
-
-Collect observable facts only:
-- Full error message and stack trace
-- Failing input values
-- Recent changed files/commits
-- Environment/config differences
-- Call path and data flow
-
-At each boundary (controller → service → repository), check:
-- What came in?
-- What went out?
-- What was transformed?
-- Under what condition does it break?
-
-Do NOT fix before locating the problem.
-
-### Phase 4. Isolate Root Cause
-
-State exactly one candidate:
-
-```text
-Hypothesis: <root cause> because <evidence>
-```
-
-Good hypothesis conditions:
-- Points to a single cause
-- Connected to observed evidence
-- Falsifiable with a small experiment
-
-Bad: "Something async seems wrong" / "The whole serializer area is unstable"
-
-### Phase 5. Lock The Failure
-
-Before fixing, lock the failure:
-1. Automated failing test (preferred)
-2. Add regression case to existing test
-3. Minimal reproduction script
-4. Temporary log/assertion guard
-
-The test MUST fail before fix, pass after fix.
-
-### Phase 6. Single Fix
-
-Allowed:
-- Minimal code change addressing the root cause
-- Minimal supporting changes for verification
-
-Forbidden:
-- Bundling multiple "related" fixes
-- Refactoring alongside the fix
-- Formatting/renaming/cleanup
-- Adding null-guards without evidence
-- Swallowing exceptions
-
-If fix fails → go back to Phase 3. Previous hypothesis was wrong.
-
-### Phase 7. Verify And Close
-
-ALL must be true:
-1. Original reproduction path no longer fails
-2. New failing guard now passes
-3. Related tests don't break
-4. Fix addresses cause, not symptom
-
-For flaky bugs: single pass is not enough. Repeat or vary conditions.
-
-## Red Flags — Stop Immediately
-
-If you think any of these, STOP and go back:
-
-- "Let me just change this one line"
-- "I'll check logs later, let me fix first"
-- "I'll add the test later"
-- "Let me fix this and that together"
-- "The error is gone so it doesn't matter what caused it"
-
-## Completion Checklist
-
-- [ ] Problem defined in one sentence
-- [ ] Failure reproduced or made observable
-- [ ] Evidence collected
-- [ ] Single root-cause hypothesis stated
-- [ ] Failing guard created before fix
-- [ ] Single fix applied
-- [ ] Verified via same reproduction path

package/skills/techdebt/SKILL.md

@@ -1,126 +0,0 @@
----
-name: techdebt
-user-invocable: false
-invocation: [auto, chain]
-tier: core
-description: "Technical debt cleanup — detect and fix duplicate code, console.log, unused imports, any types, etc. Recommended before session end. Activates on techdebt, cleanup, debt keywords."
-triggers: [techdebt, cleanup, debt, unused imports, console.log, dead code]
-priority: 60
-chain-next: [commit-push-pr]
----
-
-# Techdebt — Technical Debt Cleanup
-
-Detect and clean up technical debt in the codebase before session end or periodically.
-
-## Inspection Items
-
-### 1. Duplicate Code
-
-- Check for similar functions/logic across multiple files
-- Identify code extractable into common utilities
-- Method: Detect similar code with `core_analyze_complexity`
-
-### 2. Unused Code
-
-- Unused import statements
-- Unused variables/functions
-- Commented-out code blocks
-
-Detection tools:
-
-```
-# Detect unused imports (using Grep tool)
-Grep: pattern="^import .+ from" → cross-reference usage
-
-# Detect commented-out code blocks
-Grep: pattern="^\\s*//.*\\b(function|const|let|var|class|import)\\b"
-```
-
-### 3. Debug Code
-
-- `console.log` / `console.error` / `console.warn`
-- `debugger` statements
-- Temporary comments: `// TODO`, `// FIXME`, `// HACK`, `// XXX`
-
-Detection tools:
-
-```
-# Detect console statements (using Grep tool)
-Grep: pattern="console\\.(log|error|warn|debug)" glob="*.{ts,tsx}"
-
-# Detect TODO/FIXME
-Grep: pattern="(TODO|FIXME|HACK|XXX)" glob="*.{ts,tsx}"
-
-# Detect debugger statements
-Grep: pattern="\\bdebugger\\b" glob="*.{ts,tsx}"
-```
-
-### 4. Code Quality
-
-- `any` type usage (TypeScript)
-- Hardcoded values (magic numbers/strings)
-- Functions exceeding 50 lines
-- Nesting deeper than 4 levels
-
-Detection tools:
-
-```
-# Detect any types (using Grep tool)
-Grep: pattern=": any\\b|as any\\b" glob="*.{ts,tsx}"
-
-# Analyze complexity with built-in VIBE tools
-core_analyze_complexity: filePath="src/**/*.ts"
-core_validate_code_quality: filePath="src/**/*.ts"
-```
-
-## Output Format
-
-```markdown
-## Technical Debt Report
-
-### Duplicate Code (N items)
-- src/utils.ts:formatDate ↔ src/helpers.ts:formatDateTime
-
-### Unused Imports (N items)
-- src/components/Button.tsx:3 — React (unused)
-
-### Debug Code (N items)
-- src/api/auth.ts:23 — console.log
-
-### Code Quality Issues (N items)
-- src/services/user.ts:45 — any type usage
-- src/utils/calc.ts:10 — magic number (hardcoded 365)
-
-Total: N technical debt items found.
-```
-
-## Auto-fix Scope
-
-### Auto-fixable (Safe)
-
-| Item | Fix Method |
-|------|-----------|
-| Unused imports | Delete the import statement |
-| `console.log` / `debugger` | Delete the line |
-| Trailing whitespace / blank lines | Apply formatter |
-
-### Requires Manual Review (Safety Guard)
-
-| Item | Reason |
-|------|--------|
-| Duplicate code extraction | Need to verify logic equivalence |
-| `any` type fixes | Need proper type design |
-| Magic number extraction | Need to decide constant names and locations |
-| Long function splitting | Need to decide logic separation criteria |
-
-> Always show the scope of changes to the user and get confirmation before auto-fixing.
-
-## VIBE Tool Integration
-
-| Tool | Purpose |
-|------|---------|
-| `core_analyze_complexity` | Measure function complexity (nesting, line count) |
-| `core_validate_code_quality` | Detect code quality rule violations |
-| `core_suggest_improvements` | Generate improvement suggestions |
-| `core_check_coupling_cohesion` | Analyze module coupling/cohesion |

package/skills/techdebt/agents/analyzer.md

@@ -1,50 +0,0 @@
----
-name: techdebt-analyzer
-role: Analyzes severity and blast radius of each scanned finding
-tools: [Read, Grep]
----
-
-# Techdebt Analyzer
-
-## Role
-Receives raw scan findings and evaluates each item's severity, effort to fix, and risk of breakage. Classifies findings into auto-fixable vs. manual-review categories and assigns a priority score to guide the fixer.
-
-## Responsibilities
-- Classify each finding by severity: Critical / High / Medium / Low
-- Assess auto-fix safety: safe (delete line), risky (needs refactor), manual-only
-- Estimate fix effort: trivial (1 line), minor (< 10 lines), major (multi-file)
-- Detect clusters — multiple related findings that should be fixed together
-- Flag findings in test files separately (lower priority, different rules apply)
-
-## Input
-Raw findings JSON array from `techdebt-scanner` with file, line, category, and snippet fields.
-
-## Output
-Enriched findings list with severity and fix metadata:
-```json
-[
-  {
-    "category": "console-log",
-    "file": "src/api/auth.ts",
-    "line": 12,
-    "snippet": "console.log(token)",
-    "severity": "High",
-    "autoFixable": true,
-    "effort": "trivial",
-    "fixMethod": "delete-line"
-  }
-]
-```
-Plus a summary: total counts by severity, estimated total fix time.
-
-## Communication
-- Reports enriched findings to: `techdebt-fixer` (auto-fixable items) and orchestrator (manual items)
-- Receives instructions from: techdebt orchestrator (SKILL.md)
-
-## Domain Knowledge
-Severity heuristics:
-- **Critical**: `any` in public API surface, `console.log` logging credentials/tokens
-- **High**: `any` in business logic, `console.log` in production paths
-- **Medium**: magic numbers, unused imports, commented-out blocks
-- **Low**: unused imports in test files, minor style issues
-Auto-fix safety rules: never auto-fix type changes, logic extractions, or multi-file changes.

package/skills/techdebt/agents/fixer.md

@@ -1,41 +0,0 @@
----
-name: techdebt-fixer
-role: Generates safe auto-fix patches for trivially fixable techdebt items
-tools: [Read, Edit]
----
-
-# Techdebt Fixer
-
-## Role
-Applies safe, deterministic fixes to auto-fixable findings identified by the analyzer. Operates strictly within the boundaries set by the analyzer — never attempts fixes marked `manual-only` or `risky`. Each fix is atomic and targets a single file at a time.
-
-## Responsibilities
-- Delete `console.log`, `console.error`, `console.warn`, and `debugger` lines
-- Remove unused import statements (single-identifier and named imports)
-- Delete commented-out code blocks that contain dead code constructs
-- Preserve surrounding blank lines and indentation conventions
-- Record every change made for the reviewer's diff check
-
-## Input
-Filtered findings list from `techdebt-analyzer` where `autoFixable: true` and `effort: "trivial"`, plus the full file content via Read.
-
-## Output
-A change log of all edits applied:
-```json
-[
-  { "file": "src/api/auth.ts", "line": 12, "action": "deleted", "was": "console.log(token)" },
-  { "file": "src/components/Button.tsx", "line": 3, "action": "deleted", "was": "import React from 'react'" }
-]
-```
-Edited files are modified in place using the Edit tool.
-
-## Communication
-- Reports change log to: `techdebt-reviewer`
-- Receives instructions from: techdebt orchestrator (SKILL.md)
-
-## Domain Knowledge
-Fix safety rules:
-- Only delete lines — never rewrite or rearrange code
-- When removing a named import `{ A, B }`, if only `A` is unused, rewrite to `{ B }`, not delete the line
-- Never remove imports flagged as side-effect imports (e.g., `import './styles.css'`)
-- Stop and escalate if a file has been modified by another agent in the same session

package/skills/techdebt/agents/reviewer.md

@@ -1,47 +0,0 @@
----
-name: techdebt-reviewer
-role: Reviews auto-fix patches for correctness and safety before presenting to user
-tools: [Read, Grep]
----
-
-# Techdebt Reviewer
-
-## Role
-Acts as the final quality gate before fixes are presented to the user for confirmation. Re-reads every modified file, verifies that only the intended lines were changed, and checks that no new issues were introduced. Produces a human-readable summary with before/after context.
-
-## Responsibilities
-- Re-read each modified file and diff against the change log from `techdebt-fixer`
-- Verify no unintended lines were altered (scope creep check)
-- Confirm removed imports were genuinely unused by re-scanning usage in file body
-- Check that removing a `console.log` did not break a surrounding `if` block structure
-- Produce a formatted summary grouped by category for user confirmation
-
-## Input
-Change log JSON from `techdebt-fixer` plus current file content from Read tool.
-
-## Output
-Human-readable review report:
-```markdown
-## Techdebt Fix Review
-
-### Ready to Apply (N changes)
-- src/api/auth.ts:12 — removed console.log(token) [verified safe]
-- src/components/Button.tsx:3 — removed unused React import [verified safe]
-
-### Flagged for Manual Review (N items)
-- src/services/user.ts:45 — any type, needs proper interface definition
-
-All changes are reversible with git checkout.
-```
-Final confirmation prompt to user before any edits are committed.
-
-## Communication
-- Reports review summary to: orchestrator / user
-- Receives instructions from: techdebt orchestrator (SKILL.md)
-
-## Domain Knowledge
-Verification checklist:
-- Import removal: identifier must appear zero times outside the import line
-- Console removal: surrounding block must remain syntactically valid
-- Commented code removal: must not be a doc comment (`/** */`) or license header
-- Scope rule: reviewer changes nothing — read-only gate only

package/skills/techdebt/agents/scanner.md

@@ -1,44 +0,0 @@
----
-name: techdebt-scanner
-role: Scans codebase for code smells — any types, console.log, unused imports, magic numbers
-tools: [Grep, Glob, Read]
----
-
-# Techdebt Scanner
-
-## Role
-Performs broad pattern-based scanning across the codebase to locate instances of known code smells. Produces a raw findings list with file paths and line numbers. Does not assess severity — that is the analyzer's job.
-
-## Responsibilities
-- Scan for `any` and `as any` TypeScript type violations
-- Detect `console.log`, `console.error`, `console.warn`, `debugger` statements
-- Find unused import statements by cross-referencing declaration vs. usage
-- Locate magic numbers and hardcoded string literals outside constant files
-- Detect commented-out code blocks containing code constructs
-
-## Input
-- Root directory path to scan
-- Optional glob filter (e.g., `src/**/*.{ts,tsx}`)
-- Optional category filter (e.g., scan only `any-types`)
-
-## Output
-Structured findings list in JSON format:
-```json
-[
-  { "category": "any-type", "file": "src/services/user.ts", "line": 34, "snippet": ": any" },
-  { "category": "console-log", "file": "src/api/auth.ts", "line": 12, "snippet": "console.log(token)" },
-  { "category": "magic-number", "file": "src/utils/calc.ts", "line": 10, "snippet": "* 365" }
-]
-```
-
-## Communication
-- Reports findings to: `techdebt-analyzer`
-- Receives instructions from: techdebt orchestrator (SKILL.md)
-
-## Domain Knowledge
-Scan patterns:
-- `any` types: `: any\b`, `as any\b`, `<any>`
-- Debug code: `console\.(log|error|warn|debug|info)`, `\bdebugger\b`
-- Magic numbers: numeric literals outside `const` declarations, ignoring 0, 1, -1, 100
-- Commented code: `^\s*//.*\b(function|const|let|var|class|import)\b`
-- Unused imports: declared in `import { X }` but `X` never referenced in file body

package/skills/techdebt/orchestrator.md

@@ -1,72 +0,0 @@
----
-name: techdebt-orchestrator
-type: orchestrator
-agents: [scanner, analyzer, fixer, reviewer]
----
-
-# Techdebt Orchestrator
-
-> 구조·섹션·네이밍은 vibe/rules/orchestrator-contract.md (SSOT) 를 따른다.
-
-## Workflow
-
-### Phase 1: Scan
-- **Agent**: scanner
-- **Input**: Changed file paths (or root dir + glob filter)
-- **Output**: Raw findings list `[{category, file, line, snippet}]`
-- **Parallel**: yes — each file scanned independently
-
-### Phase 2: Analyze
-- **Agent**: analyzer
-- **Input**: Raw findings list from Phase 1
-- **Output**: Scored findings with severity (P0–P3) and auto-fix eligibility flag
-- **Parallel**: no — requires full findings set for deduplication
-
-### Phase 3: Fix
-- **Agent**: fixer
-- **Input**: Findings flagged `auto-fixable: true` from Phase 2
-- **Output**: Patch set (file edits) for each auto-fixable item
-- **Parallel**: yes — patches per file are independent
-
-### Phase 4: Review
-- **Agent**: reviewer
-- **Input**: Patch set from Phase 3
-- **Output**: Approved patches + rejected patches with rejection reason
-- **Parallel**: no — needs holistic view to catch patch conflicts
-
-### Phase 5: Apply
-- **Agent**: orchestrator (self)
-- **Input**: Approved patches from Phase 4 + manual-review items from Phase 2
-- **Output**: Applied fixes + final report with manual-review list
-- **Parallel**: no — sequential file writes to avoid conflicts
-
-## DAG (Dependency Graph)
-
-```mermaid
-graph TD
-    A[Phase 1: Scanner\nparallel per file] --> B[Phase 2: Analyzer]
-    B --> C[Phase 3: Fixer\nparallel per file]
-    B --> E[Manual Review Items]
-    C --> D[Phase 4: Reviewer]
-    D --> F[Phase 5: Apply]
-    E --> F
-```
-
-## Error Handling
-
-| Phase | Failure Mode | Strategy |
-|-------|-------------|----------|
-| Phase 1 | File unreadable / binary file | Skip file, log warning, continue |
-| Phase 1 | Glob returns 0 files | Escalate — prompt user to verify path |
-| Phase 2 | Analyzer returns 0 findings | Skip phases 3–4, output clean report |
-| Phase 3 | Patch generation fails for a file | Skip that file, flag for manual review |
-| Phase 4 | Reviewer rejects all patches | Fallback to manual-review-only report |
-| Phase 5 | Write conflict detected | Abort apply, show diff for manual resolution |
-
-## Scalability Modes
-
-| Mode | When | Agents Used |
-|------|------|-------------|
-| Full | Normal operation | scanner + analyzer + fixer + reviewer |
-| Reduced | Time pressure / large repo | scanner + analyzer only (no auto-fix) |
-| Single | Quick scan / pre-commit check | scanner only — raw findings, no scoring |

package/skills/techdebt/rubrics/severity.md

@@ -1,51 +0,0 @@
-# Techdebt Severity Rubric
-
-## P1 — Blocks Merge
-
-Issues that introduce bugs, security holes, or break type safety. Must fix before merging.
-
-| Pattern | Why P1 |
-|---------|--------|
-| `: any` / `as any` | Breaks TypeScript safety guarantee |
-| `@ts-ignore` | Hides real type errors |
-| `debugger` statement | Halts execution in production |
-| Hardcoded secrets / credentials | Security risk |
-| Circular imports causing runtime errors | Breaks module loading |
-
-**Rule**: P1 count must be 0 before merge.
-
-## P2 — Fix Before PR
-
-Issues that reduce maintainability, performance, or correctness. Should be resolved before PR review.
-
-| Pattern | Why P2 |
-|---------|--------|
-| `console.log` / `console.warn` | Debug noise in production logs |
-| Functions > 50 lines | Violates complexity limit; hard to test |
-| Nesting depth > 4 | Cognitive overload; obscures logic |
-| Unused imports | Bundle bloat; misleading code |
-| TODO/FIXME without ticket | Ambiguous ownership |
-| Duplicate logic (2+ files) | Maintenance hazard |
-
-**Rule**: P2 items are warnings. Resolve or create a tracked P3 ticket before merge.
-
-## P3 — Backlog
-
-Issues that are cosmetic or nice-to-have. Address during scheduled cleanup sessions.
-
-| Pattern | Why P3 |
-|---------|--------|
-| Magic numbers (non-critical) | Readability |
-| Commented-out code | Noise |
-| Inconsistent naming | Style drift |
-| Missing JSDoc on internal helpers | Documentation gap |
-| Slightly long files (200–499 lines) | Future extraction candidate |
-
-**Rule**: P3 items never block. Review weekly; archive when resolved.
-
-## Convergence Rule
-
-- Round 1: address all P1 + P2
-- Round 2: address remaining P1 + P2 only
-- Round 3+: P1 only
-- Same findings as previous round → stop immediately

package/skills/techdebt/scripts/scan.js

@@ -1,90 +0,0 @@
-#!/usr/bin/env node
-/**
- * techdebt/scripts/scan.js
- * Scan a directory for technical debt patterns.
- * Usage: node scan.js <directory>
- * Output: JSON array of findings to stdout.
- */
-
-import fs from 'fs';
-import path from 'path';
-
-const TARGET_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx']);
-
-/** @returns {string[]} */
-function collectFiles(dir) {
-  const results = [];
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'dist') continue;
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) results.push(...collectFiles(full));
-    else if (TARGET_EXTENSIONS.has(path.extname(entry.name))) results.push(full);
-  }
-  return results;
-}
-
-/** @param {string} file @returns {import('./scan.js').Finding[]} */
-function scanFile(file) {
-  const lines = fs.readFileSync(file, 'utf-8').split('\n');
-  const findings = [];
-  let functionLineStart = -1;
-  let braceDepth = 0;
-  let functionLineCount = 0;
-  let maxNesting = 0;
-  let currentNesting = 0;
-
-  const push = (line, type, severity, message) =>
-    findings.push({ file, line: line + 1, type, severity, message });
-
-  for (let i = 0; i < lines.length; i++) {
-    const raw = lines[i];
-    const trimmed = raw.trim();
-
-    if (/:\s*any\b|as\s+any\b/.test(trimmed)) push(i, 'any-type', 'P1', `'any' type usage detected`);
-    if (/console\.(log|warn|error|debug)\s*\(/.test(trimmed)) push(i, 'console-log', 'P2', `console statement found`);
-    if (/^import\s+/.test(trimmed)) {
-      const match = trimmed.match(/^import\s+\{([^}]+)\}/);
-      if (match) {
-        const names = match[1].split(',').map(n => n.trim().split(/\s+as\s+/).pop());
-        for (const name of names) {
-          const usedElsewhere = lines.slice(i + 1).some(l => new RegExp(`\\b${name}\\b`).test(l));
-          if (!usedElsewhere) push(i, 'unused-import', 'P2', `Possibly unused import: ${name}`);
-        }
-      }
-    }
-    const magicNumber = trimmed.match(/(?<![A-Za-z_$'"`])\b([2-9]\d{2,}|\d{4,})\b(?![A-Za-z_$'"`])/);
-    if (magicNumber && !/^\s*(\/\/|\/\*)/.test(raw)) push(i, 'magic-number', 'P3', `Magic number: ${magicNumber[1]}`);
-
-    const opens = (raw.match(/\{/g) || []).length;
-    const closes = (raw.match(/\}/g) || []).length;
-    if (/\bfunction\b|\=\>/.test(raw) && opens > closes) {
-      functionLineStart = i;
-      functionLineCount = 0;
-      braceDepth = opens - closes;
-    } else if (functionLineStart >= 0) {
-      braceDepth += opens - closes;
-      functionLineCount++;
-      if (braceDepth <= 0) {
-        if (functionLineCount > 50) push(functionLineStart, 'long-function', 'P2', `Function is ${functionLineCount} lines (limit: 50)`);
-        functionLineStart = -1;
-      }
-    }
-
-    const indent = raw.match(/^(\s*)/)[1].length;
-    currentNesting = Math.floor(indent / 2);
-    if (currentNesting > maxNesting) maxNesting = currentNesting;
-    if (currentNesting > 4) push(i, 'deep-nesting', 'P2', `Nesting depth ${currentNesting} exceeds limit of 4`);
-  }
-
-  return findings;
-}
-
-const dir = process.argv[2] || process.cwd();
-if (!fs.existsSync(dir)) {
-  process.stderr.write(`Directory not found: ${dir}\n`);
-  process.exit(1);
-}
-
-const files = collectFiles(path.resolve(dir));
-const findings = files.flatMap(scanFile);
-process.stdout.write(JSON.stringify(findings, null, 2) + '\n');