@su-record/vibe 2.9.25 → 2.9.32

package/skills/techdebt/agents/scanner.md

@@ -1,44 +1,44 @@
----
-name: techdebt-scanner
-role: Scans codebase for code smells — any types, console.log, unused imports, magic numbers
-tools: [Grep, Glob, Read]
----
-
-# Techdebt Scanner
-
-## Role
-Performs broad pattern-based scanning across the codebase to locate instances of known code smells. Produces a raw findings list with file paths and line numbers. Does not assess severity — that is the analyzer's job.
-
-## Responsibilities
-- Scan for `any` and `as any` TypeScript type violations
-- Detect `console.log`, `console.error`, `console.warn`, `debugger` statements
-- Find unused import statements by cross-referencing declaration vs. usage
-- Locate magic numbers and hardcoded string literals outside constant files
-- Detect commented-out code blocks containing code constructs
-
-## Input
-- Root directory path to scan
-- Optional glob filter (e.g., `src/**/*.{ts,tsx}`)
-- Optional category filter (e.g., scan only `any-types`)
-
-## Output
-Structured findings list in JSON format:
-```json
-[
-  { "category": "any-type", "file": "src/services/user.ts", "line": 34, "snippet": ": any" },
-  { "category": "console-log", "file": "src/api/auth.ts", "line": 12, "snippet": "console.log(token)" },
-  { "category": "magic-number", "file": "src/utils/calc.ts", "line": 10, "snippet": "* 365" }
-]
-```
-
-## Communication
-- Reports findings to: `techdebt-analyzer`
-- Receives instructions from: techdebt orchestrator (SKILL.md)
-
-## Domain Knowledge
-Scan patterns:
-- `any` types: `: any\b`, `as any\b`, `<any>`
-- Debug code: `console\.(log|error|warn|debug|info)`, `\bdebugger\b`
-- Magic numbers: numeric literals outside `const` declarations, ignoring 0, 1, -1, 100
-- Commented code: `^\s*//.*\b(function|const|let|var|class|import)\b`
-- Unused imports: declared in `import { X }` but `X` never referenced in file body
+---
+name: techdebt-scanner
+role: Scans codebase for code smells — any types, console.log, unused imports, magic numbers
+tools: [Grep, Glob, Read]
+---
+
+# Techdebt Scanner
+
+## Role
+Performs broad pattern-based scanning across the codebase to locate instances of known code smells. Produces a raw findings list with file paths and line numbers. Does not assess severity — that is the analyzer's job.
+
+## Responsibilities
+- Scan for `any` and `as any` TypeScript type violations
+- Detect `console.log`, `console.error`, `console.warn`, `debugger` statements
+- Find unused import statements by cross-referencing declaration vs. usage
+- Locate magic numbers and hardcoded string literals outside constant files
+- Detect commented-out code blocks containing code constructs
+
+## Input
+- Root directory path to scan
+- Optional glob filter (e.g., `src/**/*.{ts,tsx}`)
+- Optional category filter (e.g., scan only `any-types`)
+
+## Output
+Structured findings list in JSON format:
+```json
+[
+  { "category": "any-type", "file": "src/services/user.ts", "line": 34, "snippet": ": any" },
+  { "category": "console-log", "file": "src/api/auth.ts", "line": 12, "snippet": "console.log(token)" },
+  { "category": "magic-number", "file": "src/utils/calc.ts", "line": 10, "snippet": "* 365" }
+]
+```
+
+## Communication
+- Reports findings to: `techdebt-analyzer`
+- Receives instructions from: techdebt orchestrator (SKILL.md)
+
+## Domain Knowledge
+Scan patterns:
+- `any` types: `: any\b`, `as any\b`, `<any>`
+- Debug code: `console\.(log|error|warn|debug|info)`, `\bdebugger\b`
+- Magic numbers: numeric literals outside `const` declarations, ignoring 0, 1, -1, 100
+- Commented code: `^\s*//.*\b(function|const|let|var|class|import)\b`
+- Unused imports: declared in `import { X }` but `X` never referenced in file body

package/skills/techdebt/orchestrator.md

@@ -1,70 +1,70 @@
----
-name: techdebt-orchestrator
-type: orchestrator
-agents: [scanner, analyzer, fixer, reviewer]
----
-
-# Techdebt Orchestrator
-
-## Workflow
-
-### Phase 1: Scan
-- **Agent**: scanner
-- **Input**: Changed file paths (or root dir + glob filter)
-- **Output**: Raw findings list `[{category, file, line, snippet}]`
-- **Parallel**: yes — each file scanned independently
-
-### Phase 2: Analyze
-- **Agent**: analyzer
-- **Input**: Raw findings list from Phase 1
-- **Output**: Scored findings with severity (P0–P3) and auto-fix eligibility flag
-- **Parallel**: no — requires full findings set for deduplication
-
-### Phase 3: Fix
-- **Agent**: fixer
-- **Input**: Findings flagged `auto-fixable: true` from Phase 2
-- **Output**: Patch set (file edits) for each auto-fixable item
-- **Parallel**: yes — patches per file are independent
-
-### Phase 4: Review
-- **Agent**: reviewer
-- **Input**: Patch set from Phase 3
-- **Output**: Approved patches + rejected patches with rejection reason
-- **Parallel**: no — needs holistic view to catch patch conflicts
-
-### Phase 5: Apply
-- **Agent**: orchestrator (self)
-- **Input**: Approved patches from Phase 4 + manual-review items from Phase 2
-- **Output**: Applied fixes + final report with manual-review list
-- **Parallel**: no — sequential file writes to avoid conflicts
-
-## DAG (Dependency Graph)
-
-```mermaid
-graph TD
-    A[Phase 1: Scanner\nparallel per file] --> B[Phase 2: Analyzer]
-    B --> C[Phase 3: Fixer\nparallel per file]
-    B --> E[Manual Review Items]
-    C --> D[Phase 4: Reviewer]
-    D --> F[Phase 5: Apply]
-    E --> F
-```
-
-## Error Handling
-
-| Phase | Failure Mode | Strategy |
-|-------|-------------|----------|
-| Phase 1 | File unreadable / binary file | Skip file, log warning, continue |
-| Phase 1 | Glob returns 0 files | Escalate — prompt user to verify path |
-| Phase 2 | Analyzer returns 0 findings | Skip phases 3–4, output clean report |
-| Phase 3 | Patch generation fails for a file | Skip that file, flag for manual review |
-| Phase 4 | Reviewer rejects all patches | Fallback to manual-review-only report |
-| Phase 5 | Write conflict detected | Abort apply, show diff for manual resolution |
-
-## Scalability Modes
-
-| Mode | When | Agents Used |
-|------|------|-------------|
-| Full | Normal operation | scanner + analyzer + fixer + reviewer |
-| Reduced | Time pressure / large repo | scanner + analyzer only (no auto-fix) |
-| Single | Quick scan / pre-commit check | scanner only — raw findings, no scoring |
+---
+name: techdebt-orchestrator
+type: orchestrator
+agents: [scanner, analyzer, fixer, reviewer]
+---
+
+# Techdebt Orchestrator
+
+## Workflow
+
+### Phase 1: Scan
+- **Agent**: scanner
+- **Input**: Changed file paths (or root dir + glob filter)
+- **Output**: Raw findings list `[{category, file, line, snippet}]`
+- **Parallel**: yes — each file scanned independently
+
+### Phase 2: Analyze
+- **Agent**: analyzer
+- **Input**: Raw findings list from Phase 1
+- **Output**: Scored findings with severity (P0–P3) and auto-fix eligibility flag
+- **Parallel**: no — requires full findings set for deduplication
+
+### Phase 3: Fix
+- **Agent**: fixer
+- **Input**: Findings flagged `auto-fixable: true` from Phase 2
+- **Output**: Patch set (file edits) for each auto-fixable item
+- **Parallel**: yes — patches per file are independent
+
+### Phase 4: Review
+- **Agent**: reviewer
+- **Input**: Patch set from Phase 3
+- **Output**: Approved patches + rejected patches with rejection reason
+- **Parallel**: no — needs holistic view to catch patch conflicts
+
+### Phase 5: Apply
+- **Agent**: orchestrator (self)
+- **Input**: Approved patches from Phase 4 + manual-review items from Phase 2
+- **Output**: Applied fixes + final report with manual-review list
+- **Parallel**: no — sequential file writes to avoid conflicts
+
+## DAG (Dependency Graph)
+
+```mermaid
+graph TD
+    A[Phase 1: Scanner\nparallel per file] --> B[Phase 2: Analyzer]
+    B --> C[Phase 3: Fixer\nparallel per file]
+    B --> E[Manual Review Items]
+    C --> D[Phase 4: Reviewer]
+    D --> F[Phase 5: Apply]
+    E --> F
+```
+
+## Error Handling
+
+| Phase | Failure Mode | Strategy |
+|-------|-------------|----------|
+| Phase 1 | File unreadable / binary file | Skip file, log warning, continue |
+| Phase 1 | Glob returns 0 files | Escalate — prompt user to verify path |
+| Phase 2 | Analyzer returns 0 findings | Skip phases 3–4, output clean report |
+| Phase 3 | Patch generation fails for a file | Skip that file, flag for manual review |
+| Phase 4 | Reviewer rejects all patches | Fallback to manual-review-only report |
+| Phase 5 | Write conflict detected | Abort apply, show diff for manual resolution |
+
+## Scalability Modes
+
+| Mode | When | Agents Used |
+|------|------|-------------|
+| Full | Normal operation | scanner + analyzer + fixer + reviewer |
+| Reduced | Time pressure / large repo | scanner + analyzer only (no auto-fix) |
+| Single | Quick scan / pre-commit check | scanner only — raw findings, no scoring |

package/skills/techdebt/rubrics/severity.md

@@ -1,51 +1,51 @@
-# Techdebt Severity Rubric
-
-## P1 — Blocks Merge
-
-Issues that introduce bugs, security holes, or break type safety. Must fix before merging.
-
-| Pattern | Why P1 |
-|---------|--------|
-| `: any` / `as any` | Breaks TypeScript safety guarantee |
-| `@ts-ignore` | Hides real type errors |
-| `debugger` statement | Halts execution in production |
-| Hardcoded secrets / credentials | Security risk |
-| Circular imports causing runtime errors | Breaks module loading |
-
-**Rule**: P1 count must be 0 before merge.
-
-## P2 — Fix Before PR
-
-Issues that reduce maintainability, performance, or correctness. Should be resolved before PR review.
-
-| Pattern | Why P2 |
-|---------|--------|
-| `console.log` / `console.warn` | Debug noise in production logs |
-| Functions > 50 lines | Violates complexity limit; hard to test |
-| Nesting depth > 4 | Cognitive overload; obscures logic |
-| Unused imports | Bundle bloat; misleading code |
-| TODO/FIXME without ticket | Ambiguous ownership |
-| Duplicate logic (2+ files) | Maintenance hazard |
-
-**Rule**: P2 items are warnings. Resolve or create a tracked P3 ticket before merge.
-
-## P3 — Backlog
-
-Issues that are cosmetic or nice-to-have. Address during scheduled cleanup sessions.
-
-| Pattern | Why P3 |
-|---------|--------|
-| Magic numbers (non-critical) | Readability |
-| Commented-out code | Noise |
-| Inconsistent naming | Style drift |
-| Missing JSDoc on internal helpers | Documentation gap |
-| Slightly long files (200–499 lines) | Future extraction candidate |
-
-**Rule**: P3 items never block. Review weekly; archive when resolved.
-
-## Convergence Rule
-
-- Round 1: address all P1 + P2
-- Round 2: address remaining P1 + P2 only
-- Round 3+: P1 only
-- Same findings as previous round → stop immediately
+# Techdebt Severity Rubric
+
+## P1 — Blocks Merge
+
+Issues that introduce bugs, security holes, or break type safety. Must fix before merging.
+
+| Pattern | Why P1 |
+|---------|--------|
+| `: any` / `as any` | Breaks TypeScript safety guarantee |
+| `@ts-ignore` | Hides real type errors |
+| `debugger` statement | Halts execution in production |
+| Hardcoded secrets / credentials | Security risk |
+| Circular imports causing runtime errors | Breaks module loading |
+
+**Rule**: P1 count must be 0 before merge.
+
+## P2 — Fix Before PR
+
+Issues that reduce maintainability, performance, or correctness. Should be resolved before PR review.
+
+| Pattern | Why P2 |
+|---------|--------|
+| `console.log` / `console.warn` | Debug noise in production logs |
+| Functions > 50 lines | Violates complexity limit; hard to test |
+| Nesting depth > 4 | Cognitive overload; obscures logic |
+| Unused imports | Bundle bloat; misleading code |
+| TODO/FIXME without ticket | Ambiguous ownership |
+| Duplicate logic (2+ files) | Maintenance hazard |
+
+**Rule**: P2 items are warnings. Resolve or create a tracked P3 ticket before merge.
+
+## P3 — Backlog
+
+Issues that are cosmetic or nice-to-have. Address during scheduled cleanup sessions.
+
+| Pattern | Why P3 |
+|---------|--------|
+| Magic numbers (non-critical) | Readability |
+| Commented-out code | Noise |
+| Inconsistent naming | Style drift |
+| Missing JSDoc on internal helpers | Documentation gap |
+| Slightly long files (200–499 lines) | Future extraction candidate |
+
+**Rule**: P3 items never block. Review weekly; archive when resolved.
+
+## Convergence Rule
+
+- Round 1: address all P1 + P2
+- Round 2: address remaining P1 + P2 only
+- Round 3+: P1 only
+- Same findings as previous round → stop immediately

package/skills/techdebt/scripts/scan.js

@@ -1,90 +1,90 @@
-#!/usr/bin/env node
-/**
- * techdebt/scripts/scan.js
- * Scan a directory for technical debt patterns.
- * Usage: node scan.js <directory>
- * Output: JSON array of findings to stdout.
- */
-
-import fs from 'fs';
-import path from 'path';
-
-const TARGET_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx']);
-
-/** @returns {string[]} */
-function collectFiles(dir) {
-  const results = [];
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'dist') continue;
-    const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) results.push(...collectFiles(full));
-    else if (TARGET_EXTENSIONS.has(path.extname(entry.name))) results.push(full);
-  }
-  return results;
-}
-
-/** @param {string} file @returns {import('./scan.js').Finding[]} */
-function scanFile(file) {
-  const lines = fs.readFileSync(file, 'utf-8').split('\n');
-  const findings = [];
-  let functionLineStart = -1;
-  let braceDepth = 0;
-  let functionLineCount = 0;
-  let maxNesting = 0;
-  let currentNesting = 0;
-
-  const push = (line, type, severity, message) =>
-    findings.push({ file, line: line + 1, type, severity, message });
-
-  for (let i = 0; i < lines.length; i++) {
-    const raw = lines[i];
-    const trimmed = raw.trim();
-
-    if (/:\s*any\b|as\s+any\b/.test(trimmed)) push(i, 'any-type', 'P1', `'any' type usage detected`);
-    if (/console\.(log|warn|error|debug)\s*\(/.test(trimmed)) push(i, 'console-log', 'P2', `console statement found`);
-    if (/^import\s+/.test(trimmed)) {
-      const match = trimmed.match(/^import\s+\{([^}]+)\}/);
-      if (match) {
-        const names = match[1].split(',').map(n => n.trim().split(/\s+as\s+/).pop());
-        for (const name of names) {
-          const usedElsewhere = lines.slice(i + 1).some(l => new RegExp(`\\b${name}\\b`).test(l));
-          if (!usedElsewhere) push(i, 'unused-import', 'P2', `Possibly unused import: ${name}`);
-        }
-      }
-    }
-    const magicNumber = trimmed.match(/(?<![A-Za-z_$'"`])\b([2-9]\d{2,}|\d{4,})\b(?![A-Za-z_$'"`])/);
-    if (magicNumber && !/^\s*(\/\/|\/\*)/.test(raw)) push(i, 'magic-number', 'P3', `Magic number: ${magicNumber[1]}`);
-
-    const opens = (raw.match(/\{/g) || []).length;
-    const closes = (raw.match(/\}/g) || []).length;
-    if (/\bfunction\b|\=\>/.test(raw) && opens > closes) {
-      functionLineStart = i;
-      functionLineCount = 0;
-      braceDepth = opens - closes;
-    } else if (functionLineStart >= 0) {
-      braceDepth += opens - closes;
-      functionLineCount++;
-      if (braceDepth <= 0) {
-        if (functionLineCount > 50) push(functionLineStart, 'long-function', 'P2', `Function is ${functionLineCount} lines (limit: 50)`);
-        functionLineStart = -1;
-      }
-    }
-
-    const indent = raw.match(/^(\s*)/)[1].length;
-    currentNesting = Math.floor(indent / 2);
-    if (currentNesting > maxNesting) maxNesting = currentNesting;
-    if (currentNesting > 4) push(i, 'deep-nesting', 'P2', `Nesting depth ${currentNesting} exceeds limit of 4`);
-  }
-
-  return findings;
-}
-
-const dir = process.argv[2] || process.cwd();
-if (!fs.existsSync(dir)) {
-  process.stderr.write(`Directory not found: ${dir}\n`);
-  process.exit(1);
-}
-
-const files = collectFiles(path.resolve(dir));
-const findings = files.flatMap(scanFile);
-process.stdout.write(JSON.stringify(findings, null, 2) + '\n');
+#!/usr/bin/env node
+/**
+ * techdebt/scripts/scan.js
+ * Scan a directory for technical debt patterns.
+ * Usage: node scan.js <directory>
+ * Output: JSON array of findings to stdout.
+ */
+
+import fs from 'fs';
+import path from 'path';
+
+const TARGET_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx']);
+
+/** @returns {string[]} */
+function collectFiles(dir) {
+  const results = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name.startsWith('.') || entry.name === 'node_modules' || entry.name === 'dist') continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) results.push(...collectFiles(full));
+    else if (TARGET_EXTENSIONS.has(path.extname(entry.name))) results.push(full);
+  }
+  return results;
+}
+
+/** @param {string} file @returns {import('./scan.js').Finding[]} */
+function scanFile(file) {
+  const lines = fs.readFileSync(file, 'utf-8').split('\n');
+  const findings = [];
+  let functionLineStart = -1;
+  let braceDepth = 0;
+  let functionLineCount = 0;
+  let maxNesting = 0;
+  let currentNesting = 0;
+
+  const push = (line, type, severity, message) =>
+    findings.push({ file, line: line + 1, type, severity, message });
+
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i];
+    const trimmed = raw.trim();
+
+    if (/:\s*any\b|as\s+any\b/.test(trimmed)) push(i, 'any-type', 'P1', `'any' type usage detected`);
+    if (/console\.(log|warn|error|debug)\s*\(/.test(trimmed)) push(i, 'console-log', 'P2', `console statement found`);
+    if (/^import\s+/.test(trimmed)) {
+      const match = trimmed.match(/^import\s+\{([^}]+)\}/);
+      if (match) {
+        const names = match[1].split(',').map(n => n.trim().split(/\s+as\s+/).pop());
+        for (const name of names) {
+          const usedElsewhere = lines.slice(i + 1).some(l => new RegExp(`\\b${name}\\b`).test(l));
+          if (!usedElsewhere) push(i, 'unused-import', 'P2', `Possibly unused import: ${name}`);
+        }
+      }
+    }
+    const magicNumber = trimmed.match(/(?<![A-Za-z_$'"`])\b([2-9]\d{2,}|\d{4,})\b(?![A-Za-z_$'"`])/);
+    if (magicNumber && !/^\s*(\/\/|\/\*)/.test(raw)) push(i, 'magic-number', 'P3', `Magic number: ${magicNumber[1]}`);
+
+    const opens = (raw.match(/\{/g) || []).length;
+    const closes = (raw.match(/\}/g) || []).length;
+    if (/\bfunction\b|\=\>/.test(raw) && opens > closes) {
+      functionLineStart = i;
+      functionLineCount = 0;
+      braceDepth = opens - closes;
+    } else if (functionLineStart >= 0) {
+      braceDepth += opens - closes;
+      functionLineCount++;
+      if (braceDepth <= 0) {
+        if (functionLineCount > 50) push(functionLineStart, 'long-function', 'P2', `Function is ${functionLineCount} lines (limit: 50)`);
+        functionLineStart = -1;
+      }
+    }
+
+    const indent = raw.match(/^(\s*)/)[1].length;
+    currentNesting = Math.floor(indent / 2);
+    if (currentNesting > maxNesting) maxNesting = currentNesting;
+    if (currentNesting > 4) push(i, 'deep-nesting', 'P2', `Nesting depth ${currentNesting} exceeds limit of 4`);
+  }
+
+  return findings;
+}
+
+const dir = process.argv[2] || process.cwd();
+if (!fs.existsSync(dir)) {
+  process.stderr.write(`Directory not found: ${dir}\n`);
+  process.exit(1);
+}
+
+const files = collectFiles(path.resolve(dir));
+const findings = files.flatMap(scanFile);
+process.stdout.write(JSON.stringify(findings, null, 2) + '\n');