@su-record/vibe 2.6.35 → 2.6.41

package/skills/parallel-research/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: parallel-research
+description: "Parallel research guide. Auto-activates for complex features, new technologies, security-critical work, architecture design, or technology selection decisions."
+triggers: [parallel research, complex feature, technology selection, architecture design, security critical]
+priority: 60
+---
+# Parallel Research
+
+Parallel research patterns for solving complex problems.
+
+## When Parallel Research is Needed
+
+| Situation | Reason |
+|-----------|--------|
+| New technology adoption | Need best practices |
+| Security-related features | Multi-angle review needed |
+| Architecture design | Multiple perspectives needed |
+| Technology selection | Comparison analysis needed |
+| Complex bugs | Explore multiple causes |
+
+## Research Agents (4 Parallel)
+
+| Agent | Role | Tools |
+|-------|------|-------|
+| best-practices | Search best practices | Web Search, context7 |
+| framework-docs | Search official docs | context7 |
+| codebase-patterns | Analyze existing code patterns | Grep, Glob |
+| security-advisory | Search security advisories | Web Search |
+
+## Usage Methods
+
+### Method 1: Direct Orchestrator Call
+
+```bash
+node -e "import('@su-record/vibe/orchestrator').then(o =>
+  o.research('passkey authentication', ['React', 'Supabase'])
+  .then(r => console.log(r.content[0].text))
+)"
+```
+
+### Method 2: Use /vibe.spec
+
+```
+/vibe.spec "feature-name"
+→ Parallel research runs automatically after requirements confirmed
+```
+
+### Method 3: Parallel Task Tool Execution
+
+```
+Task 1: "Search React auth best practices"
+Task 2: "Search Supabase Auth official docs" (concurrent)
+Task 3: "Analyze existing auth code patterns" (concurrent)
+Task 4: "Search auth security vulnerabilities" (concurrent)
+```
+
+## Using Research Results
+
+```
+Parallel research complete
+    ↓
+Synthesize results
+    ↓
+Reflect in SPEC Context section
+OR
+Reference during implementation
+```
+
+## When Research is NOT Needed
+
+- Simple CRUD operations
+- Already familiar patterns
+- Similar code exists in project
+- Time-critical (supplement with review later)
+
+## Notes
+
+- Research runs **after requirements confirmed**
+- Split overly broad topics
+- Research results are references, not absolute truth

package/skills/priority-todos/SKILL.md

@@ -0,0 +1,242 @@
+---
+name: priority-todos
+description: "Priority-based TODO management (P1/P2/P3). Auto-activates when managing tasks, reviewing issues, or organizing work by priority."
+triggers: [todo, priority, P1, P2, P3, task management, issue, organize]
+priority: 60
+---
+# Priority-Based Todo Management Skill
+
+Priority-based TODO management system
+
+## Overview
+
+Classify tasks by P1/P2/P3 priority to handle important items first
+
+## Priority Levels
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│  Priority Levels                                                 │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                 │
+│  🔴 P1 (Critical)                                               │
+│  ├── Security vulnerabilities                                   │
+│  ├── Data loss risk                                             │
+│  ├── Production incidents                                       │
+│  └── Merge-blocking issues                                      │
+│                                                                 │
+│  🟡 P2 (Important)                                              │
+│  ├── Performance issues                                         │
+│  ├── Missing tests                                              │
+│  ├── Architecture violations                                    │
+│  └── Technical debt                                             │
+│                                                                 │
+│  🔵 P3 (Nice-to-have)                                           │
+│  ├── Code style                                                 │
+│  ├── Refactoring suggestions                                    │
+│  ├── Documentation                                              │
+│  └── Optimization opportunities                                 │
+│                                                                 │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+## File-Based Todo System
+
+### Directory Structure
+
+```
+.claude/vibe/todos/
+├── P1-security-sql-injection.md
+├── P1-data-transaction-missing.md
+├── P2-perf-n1-query.md
+├── P2-test-missing-edge-case.md
+├── P2-arch-circular-dependency.md
+├── P3-style-extract-helper.md
+├── P3-docs-add-readme.md
+└── index.md
+```
+
+### Todo File Format
+
+```markdown
+# [P1] SQL Injection Vulnerability
+
+## Summary
+User input directly concatenated in SQL query without sanitization.
+
+## Priority Justification
+- 🔴 P1 (Critical)
+- Category: Security
+- Impact: High (data breach risk)
+- Effort: Low (simple fix)
+
+## Location
+- **File**: src/api/users.py
+- **Line**: 42-45
+- **Function**: `get_user_by_email()`
+
+## Current Code
+```python
+def get_user_by_email(email: str):
+    query = f"SELECT * FROM users WHERE email = '{email}'"
+    return db.execute(query)
+```
+
+## Suggested Fix
+```python
+def get_user_by_email(email: str):
+    query = "SELECT * FROM users WHERE email = %s"
+    return db.execute(query, (email,))
+```
+
+## Checklist
+- [ ] Fix implemented
+- [ ] Unit test added
+- [ ] Security test added
+- [ ] Code reviewed
+- [ ] Merged
+
+## References
+- OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection
+- Project Security Guide: docs/security.md
+
+## Metadata
+- Created: 2026-01-11
+- Author: Claude
+- Review: /vibe.review PR#123
+```
+
+### Index File
+
+```markdown
+# Todo Index
+
+## Summary
+| Priority | Count | Status |
+|----------|-------|--------|
+| 🔴 P1 | 2 | 🚨 Blocks merge |
+| 🟡 P2 | 5 | ⚠️ Should fix |
+| 🔵 P3 | 3 | 💡 Backlog |
+
+## 🔴 P1 Critical (Blocks Merge)
+
+| # | Title | Location | Status |
+|---|-------|----------|--------|
+| 1 | SQL Injection | users.py:42 | ❌ Open |
+| 2 | Missing Rollback | payment.py:128 | ❌ Open |
+
+## 🟡 P2 Important
+
+| # | Title | Location | Status |
+|---|-------|----------|--------|
+| 3 | N+1 Query | orders.py:78 | ❌ Open |
+| 4 | Missing Tests | auth.py | ❌ Open |
+| 5 | Circular Dep | services/ | ❌ Open |
+
+## 🔵 P3 Nice-to-have
+
+| # | Title | Location | Status |
+|---|-------|----------|--------|
+| 6 | Extract Helper | utils.py:45 | 💤 Backlog |
+| 7 | Add README | /payment | 💤 Backlog |
+
+---
+
+Last updated: 2026-01-11 10:30
+```
+
+## Workflow Commands
+
+### Create Todo
+
+```bash
+# Auto-generated from /vibe.review results
+/vibe.review PR#123
+# -> Creates files in .claude/vibe/todos/
+
+# Manual creation
+core todo add "SQL Injection in users.py" --priority P1 --category security
+```
+
+### List Todos
+
+```bash
+# Full list
+core todo list
+
+# By priority
+core todo list --priority P1
+core todo list --priority P2
+
+# By category
+core todo list --category security
+core todo list --category performance
+```
+
+### Complete Todo
+
+```bash
+# Mark as complete
+core todo done P1-security-sql-injection
+
+# Updates checklist in file + updates index
+```
+
+### Clean Up
+
+```bash
+# Archive completed items
+core todo archive
+
+# Result:
+# .claude/vibe/todos/P1-security-sql-injection.md
+# -> .claude/vibe/todos/done/2026-01-11-P1-security-sql-injection.md
+```
+
+## Integration with TodoWrite
+
+Integration with existing TodoWrite tool:
+
+```javascript
+TodoWrite({
+  todos: [
+    {
+      content: "[P1] Fix SQL injection in users.py:42",
+      status: "in_progress",
+      activeForm: "Fixing SQL injection vulnerability",
+      priority: "P1",  // extended field
+      category: "security"  // extended field
+    },
+    {
+      content: "[P2] Add missing tests for auth",
+      status: "pending",
+      activeForm: "Adding auth tests",
+      priority: "P2",
+      category: "testing"
+    }
+  ]
+})
+```
+
+## Auto-Blocking Rules
+
+```yaml
+# .claude/vibe/config.yaml
+merge_blocking:
+  P1: true   # Block merge if P1 exists
+  P2: false  # Warning only
+  P3: false  # Ignore
+
+notifications:
+  P1: immediate  # Immediate notification
+  P2: daily      # Daily summary
+  P3: weekly     # Weekly summary
+```
+
+## Best Practices
+
+1. **Handle P1 immediately**: Stop other work and fix
+2. **Handle P2 before PR**: Recommended to resolve before merge
+3. **P3 is backlog**: Handle when time permits
+4. **Regular cleanup**: Review todos weekly
+5. **Document completions**: Document how issues were resolved

package/skills/techdebt/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: techdebt
+description: "Technical debt cleanup — detect and fix duplicate code, console.log, unused imports, any types, etc. Recommended before session end. Activates on techdebt, cleanup, debt keywords."
+triggers: [techdebt, cleanup, debt, unused imports, console.log, dead code]
+priority: 60
+---
+
+# Techdebt — Technical Debt Cleanup
+
+Detect and clean up technical debt in the codebase before session end or periodically.
+
+## Inspection Items
+
+### 1. Duplicate Code
+
+- Check for similar functions/logic across multiple files
+- Identify code extractable into common utilities
+- Method: Detect similar code with `core_analyze_complexity`
+
+### 2. Unused Code
+
+- Unused import statements
+- Unused variables/functions
+- Commented-out code blocks
+
+Detection tools:
+
+```
+# Detect unused imports (using Grep tool)
+Grep: pattern="^import .+ from" → cross-reference usage
+
+# Detect commented-out code blocks
+Grep: pattern="^\\s*//.*\\b(function|const|let|var|class|import)\\b"
+```
+
+### 3. Debug Code
+
+- `console.log` / `console.error` / `console.warn`
+- `debugger` statements
+- Temporary comments: `// TODO`, `// FIXME`, `// HACK`, `// XXX`
+
+Detection tools:
+
+```
+# Detect console statements (using Grep tool)
+Grep: pattern="console\\.(log|error|warn|debug)" glob="*.{ts,tsx}"
+
+# Detect TODO/FIXME
+Grep: pattern="(TODO|FIXME|HACK|XXX)" glob="*.{ts,tsx}"
+
+# Detect debugger statements
+Grep: pattern="\\bdebugger\\b" glob="*.{ts,tsx}"
+```
+
+### 4. Code Quality
+
+- `any` type usage (TypeScript)
+- Hardcoded values (magic numbers/strings)
+- Functions exceeding 50 lines
+- Nesting deeper than 4 levels
+
+Detection tools:
+
+```
+# Detect any types (using Grep tool)
+Grep: pattern=": any\\b|as any\\b" glob="*.{ts,tsx}"
+
+# Analyze complexity with built-in VIBE tools
+core_analyze_complexity: filePath="src/**/*.ts"
+core_validate_code_quality: filePath="src/**/*.ts"
+```
+
+## Output Format
+
+```markdown
+## Technical Debt Report
+
+### Duplicate Code (N items)
+- src/utils.ts:formatDate ↔ src/helpers.ts:formatDateTime
+
+### Unused Imports (N items)
+- src/components/Button.tsx:3 — React (unused)
+
+### Debug Code (N items)
+- src/api/auth.ts:23 — console.log
+
+### Code Quality Issues (N items)
+- src/services/user.ts:45 — any type usage
+- src/utils/calc.ts:10 — magic number (hardcoded 365)
+
+Total: N technical debt items found.
+```
+
+## Auto-fix Scope
+
+### Auto-fixable (Safe)
+
+| Item | Fix Method |
+|------|-----------|
+| Unused imports | Delete the import statement |
+| `console.log` / `debugger` | Delete the line |
+| Trailing whitespace / blank lines | Apply formatter |
+
+### Requires Manual Review (Safety Guard)
+
+| Item | Reason |
+|------|--------|
+| Duplicate code extraction | Need to verify logic equivalence |
+| `any` type fixes | Need proper type design |
+| Magic number extraction | Need to decide constant names and locations |
+| Long function splitting | Need to decide logic separation criteria |
+
+> Always show the scope of changes to the user and get confirmation before auto-fixing.
+
+## VIBE Tool Integration
+
+| Tool | Purpose |
+|------|---------|
+| `core_analyze_complexity` | Measure function complexity (nesting, line count) |
+| `core_validate_code_quality` | Detect code quality rule violations |
+| `core_suggest_improvements` | Generate improvement suggestions |
+| `core_check_coupling_cohesion` | Analyze module coupling/cohesion |

package/skills/tool-fallback/SKILL.md

@@ -0,0 +1,193 @@
+---
+name: tool-fallback
+description: "Tool failure fallback strategies with circuit breaker. Auto-activates on API errors, search failures, timeouts, 429, 5xx, overloaded errors."
+triggers: [API error, search failure, timeout, 429, 5xx, overloaded, fallback, circuit breaker]
+priority: 80
+---
+# Tool Fallback Strategies
+
+Guide for finding alternatives when tools fail to continue work.
+
+## Circuit Breaker Pattern
+
+Track tool failures and temporarily disable unreliable tools:
+
+```
+Tool State Machine:
+┌─────────┐   3 failures   ┌─────────┐   30s cooldown   ┌─────────────┐
+│ CLOSED  │ ─────────────→ │  OPEN   │ ───────────────→ │ HALF-OPEN   │
+│ (normal)│                │ (block) │                  │ (test 1 req)│
+└─────────┘                └─────────┘                  └─────────────┘
+     ↑                                                        │
+     │                      success                           │
+     └────────────────────────────────────────────────────────┘
+```
+
+| State | Behavior |
+|-------|----------|
+| **CLOSED** | Normal operation, count failures |
+| **OPEN** | Block all requests, use alternative immediately |
+| **HALF-OPEN** | Allow 1 test request after cooldown |
+
+**Per-tool tracking:**
+```
+GPT hook: failures=2, state=CLOSED
+Gemini hook: failures=0, state=CLOSED
+WebSearch: failures=3, state=OPEN (blocked until 14:32:00)
+context7: failures=1, state=CLOSED
+```
+
+## When Web Search Fails
+
+| Alternative | Method |
+|-------------|--------|
+| context7 plugin | `resolve-library-id` → `get-library-docs` |
+| VibeOrchestrator | `smartWebSearch()` - auto fallback chain |
+| Cached knowledge | Use Claude's built-in knowledge |
+
+```
+Web Search fails (429, 529, timeout)
+    ↓
+Check circuit breaker state
+    ↓
+If OPEN → Skip to alternative immediately
+    ↓
+If CLOSED → Try context7 for library docs
+    ↓
+If still fails: VibeOrchestrator.smartWebSearch()
+    ↓
+Last resort: Claude's built-in knowledge
+```
+
+## API Error Responses
+
+| Error | Cause | Response | Circuit Breaker |
+|-------|-------|----------|-----------------|
+| 429 | Rate Limit | Exponential backoff | +1 failure count |
+| 5xx | Server Error | Switch to alternative | +1 failure count |
+| 529 | Overloaded | Wait and retry | +1 failure count |
+| Timeout | Network | Split request or retry | +1 failure count |
+| 401/403 | Auth Error | Re-auth or alternative | Don't count (auth issue) |
+
+## When File/Code Not Found
+
+```
+Glob fails
+    ↓
+Expand pattern: *.ts → **/*.ts → **/*
+    ↓
+Use Grep for content-based search
+    ↓
+Check git log for history
+```
+
+## When External LLM Fails
+
+**Production (VibeOrchestrator):**
+
+```
+VibeOrchestrator.smartRoute({ type, prompt })
+    ↓
+LLM priority based on task type:
+  - architecture/debugging: GPT → Gemini → Claude
+  - uiux/code-analysis: Gemini → GPT → Claude
+  - code-gen: Claude only
+    ↓
+Auto fallback on primary LLM failure
+    ↓
+Claude handles directly when all fail
+```
+
+**Test/Debug Hooks (development only):**
+
+```
+gpt- or gpt. [question] fails
+    ↓
+Check circuit: If OPEN, skip to next
+    ↓
+Try gemini- or gemini. [question] (similar capability)
+    ↓
+Try context7 (for docs)
+    ↓
+Claude solves alone
+```
+
+> **Note:** `test-gpt`, `test-gemini` prefixes are for hook connectivity testing only.
+> For actual work, use VIBE commands (`/vibe.run`, `/vibe.spec`, etc.) and
+> VibeOrchestrator will automatically select the appropriate LLM.
+
+## Retry Strategy with Circuit Breaker
+
+```
+Request to tool
+    ↓
+Check circuit state
+    ↓
+┌─ OPEN? ──→ Use alternative immediately (no retry)
+│
+└─ CLOSED/HALF-OPEN? ──→ Try request
+                              ↓
+                         Success? ──→ Reset failure count
+                              ↓ No
+                         Retry with backoff:
+                           retry(1): wait 2s
+                           retry(2): wait 4s
+                           retry(3): wait 8s
+                              ↓
+                         All failed? ──→ +1 failure, check threshold
+                              ↓
+                         failures >= 3? ──→ OPEN circuit for 30s
+                              ↓
+                         Use alternative
+```
+
+## VibeOrchestrator Smart Routing
+
+VIBE commands (`/vibe.spec`, `/vibe.run`, etc.) use VibeOrchestrator internally.
+
+### LLM Priority by Task Type
+
+| Task Type       | Primary | Secondary | Fallback |
+|-----------------|---------|-----------|----------|
+| `architecture`  | GPT     | Gemini    | Claude   |
+| `debugging`     | GPT     | Gemini    | Claude   |
+| `uiux`          | Gemini  | GPT       | Claude   |
+| `code-analysis` | Gemini  | GPT       | Claude   |
+| `web-search`    | GPT     | Gemini    | Claude   |
+| `code-gen`      | Claude  | -         | -        |
+| `general`       | Claude  | -         | -        |
+
+### Auto Fallback Logic
+
+```
+smartRoute({ type: 'architecture', prompt })
+    ↓
+1. Try GPT (max 2 retries)
+    ↓ fails (429, 401, 5xx)
+2. Try Gemini (max 2 retries)
+    ↓ fails
+3. Claude handles directly (fallback message)
+```
+
+### Retry vs Immediate Switch
+
+| Error            | Action                 |
+|------------------|------------------------|
+| 429 Rate Limit   | Skip to next LLM       |
+| 401/403 Auth     | Skip to next LLM       |
+| Network Error    | Retry with backoff     |
+| 5xx Server Error | Retry then switch      |
+
+### Availability Cache
+
+- 5-minute TTL for LLM status cache
+- Auto-disable after 3 consecutive failures
+- Failed LLMs are skipped in subsequent requests
+
+## Principles
+
+1. **Never stop** - Always find an alternative
+2. **Before asking user** - Try alternatives first
+3. **Track failures** - Open circuit after 3 consecutive failures
+4. **Auto-recover** - Test after 30s cooldown
+5. **Fail fast** - Skip blocked tools immediately