@sylphx/flow 0.2.1 → 0.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/assets/agents/coder.md +1 -1
- package/assets/agents/orchestrator.md +1 -1
- package/assets/agents/reviewer.md +1 -1
- package/assets/agents/writer.md +13 -13
- package/assets/slash-commands/context.md +112 -0
- package/dist/assets/agents/coder.md +32 -0
- package/dist/assets/agents/orchestrator.md +36 -0
- package/dist/assets/agents/reviewer.md +30 -0
- package/dist/assets/agents/writer.md +30 -0
- package/dist/assets/knowledge/data/sql.md +216 -0
- package/dist/assets/knowledge/guides/saas-template.md +85 -0
- package/dist/assets/knowledge/guides/system-prompt.md +344 -0
- package/dist/assets/knowledge/guides/tech-stack.md +92 -0
- package/dist/assets/knowledge/guides/ui-ux.md +44 -0
- package/dist/assets/knowledge/stacks/nextjs-app.md +165 -0
- package/dist/assets/knowledge/stacks/node-api.md +220 -0
- package/dist/assets/knowledge/stacks/react-app.md +232 -0
- package/dist/assets/knowledge/universal/deployment.md +109 -0
- package/dist/assets/knowledge/universal/performance.md +121 -0
- package/dist/assets/knowledge/universal/security.md +79 -0
- package/dist/assets/knowledge/universal/testing.md +111 -0
- package/dist/assets/output-styles/silent.md +23 -0
- package/dist/assets/rules/core.md +144 -0
- package/dist/assets/slash-commands/commit.md +23 -0
- package/dist/assets/slash-commands/context.md +112 -0
- package/dist/assets/slash-commands/explain.md +35 -0
- package/dist/assets/slash-commands/mep.md +63 -0
- package/dist/assets/slash-commands/review.md +39 -0
- package/dist/assets/slash-commands/test.md +30 -0
- package/dist/chunk-1rptg3yg.js +4 -0
- package/dist/chunk-1rptg3yg.js.map +10 -0
- package/dist/{chunk-124wqbdb.js → chunk-4fr8q0jy.js} +3 -3
- package/dist/{chunk-124wqbdb.js.map → chunk-4fr8q0jy.js.map} +1 -1
- package/dist/{chunk-f6y5vttn.js → chunk-5szm4n3x.js} +3 -3
- package/dist/{chunk-f6y5vttn.js.map → chunk-5szm4n3x.js.map} +1 -1
- package/dist/chunk-7nht27vs.js +4 -0
- package/dist/{chunk-g9t3me0w.js.map → chunk-7nht27vs.js.map} +2 -2
- package/dist/chunk-8krxe10w.js +3 -0
- package/dist/{chunk-e966bjm5.js.map → chunk-8krxe10w.js.map} +2 -2
- package/dist/{chunk-wpe7rw5c.js → chunk-8z1sf25t.js} +3 -3
- package/dist/{chunk-wpe7rw5c.js.map → chunk-8z1sf25t.js.map} +1 -1
- package/dist/chunk-9c2nr2fz.js +25 -0
- package/dist/chunk-9c2nr2fz.js.map +61 -0
- package/dist/{chunk-4p754rhd.js → chunk-asr22mbn.js} +2 -2
- package/dist/{chunk-4p754rhd.js.map → chunk-asr22mbn.js.map} +2 -2
- package/dist/chunk-bnxtqetr.js +23 -0
- package/dist/chunk-bnxtqetr.js.map +11 -0
- package/dist/chunk-cs1s5c3g.js +54 -0
- package/dist/chunk-cs1s5c3g.js.map +53 -0
- package/dist/chunk-cv1nhr27.js +2 -0
- package/dist/{chunk-hshjnpm0.js.map → chunk-cv1nhr27.js.map} +1 -1
- package/dist/chunk-d4hj6d4t.js +6 -0
- package/dist/chunk-d4hj6d4t.js.map +11 -0
- package/dist/chunk-f06ma45b.js +15 -0
- package/dist/chunk-f06ma45b.js.map +16 -0
- package/dist/chunk-fs3f7acb.js +4 -0
- package/dist/chunk-fs3f7acb.js.map +12 -0
- package/dist/{chunk-5r4afhzp.js → chunk-gh83x9ya.js} +3 -3
- package/dist/{chunk-5r4afhzp.js.map → chunk-gh83x9ya.js.map} +1 -1
- package/dist/{chunk-qa8b725g.js → chunk-gyq335sw.js} +6 -5
- package/dist/{chunk-qa8b725g.js.map → chunk-gyq335sw.js.map} +1 -1
- package/dist/{chunk-hs3nxzyz.js → chunk-hft1735c.js} +2 -2
- package/dist/{chunk-hs3nxzyz.js.map → chunk-hft1735c.js.map} +2 -2
- package/dist/chunk-hj6r7703.js +3 -0
- package/dist/{chunk-78bfvh46.js.map → chunk-hj6r7703.js.map} +2 -2
- package/dist/chunk-hxj4eapp.js +14 -0
- package/dist/chunk-hxj4eapp.js.map +20 -0
- package/dist/chunk-jgsq3xax.js +23 -0
- package/dist/chunk-jgsq3xax.js.map +132 -0
- package/dist/{chunk-646h52kd.js → chunk-m9nt0bj3.js} +3 -3
- package/dist/{chunk-646h52kd.js.map → chunk-m9nt0bj3.js.map} +1 -1
- package/dist/{chunk-bd11hvvz.js → chunk-ndah8mn9.js} +2 -2
- package/dist/{chunk-bd11hvvz.js.map → chunk-ndah8mn9.js.map} +1 -1
- package/dist/chunk-s6g21d1g.js +27 -0
- package/dist/{chunk-0h7sfwq3.js.map → chunk-s6g21d1g.js.map} +4 -5
- package/dist/{chunk-hshjnpm0.js → chunk-sxy6vp20.js} +2 -2
- package/dist/chunk-sxy6vp20.js.map +9 -0
- package/dist/chunk-vjf57v4h.js +4 -0
- package/dist/chunk-vjf57v4h.js.map +10 -0
- package/dist/{chunk-jxny6xft.js → chunk-w2vbmr93.js} +2 -2
- package/dist/{chunk-jxny6xft.js.map → chunk-w2vbmr93.js.map} +1 -1
- package/dist/chunk-wd9qbbe5.js +5 -0
- package/dist/chunk-wd9qbbe5.js.map +10 -0
- package/dist/chunk-wnaa55wn.js +108 -0
- package/dist/chunk-wnaa55wn.js.map +24 -0
- package/dist/chunk-wrx1n6q6.js +16 -0
- package/dist/chunk-wrx1n6q6.js.map +16 -0
- package/dist/chunk-xata5rw6.js +119 -0
- package/dist/{chunk-878q8xdr.js.map → chunk-xata5rw6.js.map} +7 -18
- package/dist/chunk-z2rtyk3d.js +7 -0
- package/dist/{chunk-ygdr4fw7.js.map → chunk-z2rtyk3d.js.map} +2 -2
- package/dist/index.js +446 -482
- package/dist/index.js.map +301 -202
- package/package.json +4 -1
- package/dist/chunk-0h7sfwq3.js +0 -27
- package/dist/chunk-78bfvh46.js +0 -3
- package/dist/chunk-878q8xdr.js +0 -86
- package/dist/chunk-e966bjm5.js +0 -3
- package/dist/chunk-fxwaa2mg.js +0 -4
- package/dist/chunk-fxwaa2mg.js.map +0 -10
- package/dist/chunk-g9t3me0w.js +0 -4
- package/dist/chunk-ygdr4fw7.js +0 -7
|
@@ -0,0 +1,79 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: Security Best Practices
|
|
3
|
+
description: OWASP, authentication, authorization, vulnerabilities, secure coding
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Security Best Practices
|
|
7
|
+
|
|
8
|
+
## OWASP Top 10
|
|
9
|
+
|
|
10
|
+
### SQL Injection
|
|
11
|
+
**Never** concatenate user input into SQL
|
|
12
|
+
```javascript
|
|
13
|
+
// BAD: Vulnerable
|
|
14
|
+
db.query(`SELECT * FROM users WHERE id = ${userId}`)
|
|
15
|
+
|
|
16
|
+
// GOOD: Parameterized
|
|
17
|
+
db.query('SELECT * FROM users WHERE id = $1', [userId])
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
### XSS (Cross-Site Scripting)
|
|
21
|
+
- Sanitize/escape user content before rendering
|
|
22
|
+
- Use CSP headers
|
|
23
|
+
- Never use `dangerouslySetInnerHTML` without sanitization
|
|
24
|
+
- Validate server-side, not just client
|
|
25
|
+
|
|
26
|
+
### Authentication & Authorization
|
|
27
|
+
- Use established libraries (Passport, NextAuth, Auth0)
|
|
28
|
+
- Hash passwords (bcrypt/argon2), never plain text
|
|
29
|
+
- Rate limit login endpoints
|
|
30
|
+
- httpOnly, secure, sameSite cookies for tokens
|
|
31
|
+
- Separate authentication (who) from authorization (what)
|
|
32
|
+
|
|
33
|
+
### CSRF (Cross-Site Request Forgery)
|
|
34
|
+
- CSRF tokens for state-changing ops
|
|
35
|
+
- Check Origin/Referer headers
|
|
36
|
+
- SameSite cookie attribute
|
|
37
|
+
|
|
38
|
+
## Secrets Management
|
|
39
|
+
**Never** commit secrets to git (.env in .gitignore)
|
|
40
|
+
- Environment variables for secrets
|
|
41
|
+
- Rotate credentials regularly
|
|
42
|
+
- Use secret managers (AWS Secrets Manager, Vault)
|
|
43
|
+
|
|
44
|
+
## Input Validation
|
|
45
|
+
- Validate server-side (client is UX only)
|
|
46
|
+
- Whitelist approach: Define allowed, reject all else
|
|
47
|
+
- Sanitize file uploads (check type, size, scan)
|
|
48
|
+
- Schema validation (Zod, Joi)
|
|
49
|
+
|
|
50
|
+
## API Security
|
|
51
|
+
- HTTPS everywhere
|
|
52
|
+
- Rate limiting
|
|
53
|
+
- Validate Content-Type headers
|
|
54
|
+
- API keys/tokens with least privilege
|
|
55
|
+
- Log security events (failed logins, unusual activity)
|
|
56
|
+
|
|
57
|
+
## Common Vulnerabilities
|
|
58
|
+
|
|
59
|
+
### Path Traversal
|
|
60
|
+
Validate file paths, never trust user input. Use path.resolve() and verify within allowed directory.
|
|
61
|
+
|
|
62
|
+
### Command Injection
|
|
63
|
+
Never pass user input to shell commands. If unavoidable, use libraries that escape properly.
|
|
64
|
+
|
|
65
|
+
### JWT Security
|
|
66
|
+
- Verify signature on every request
|
|
67
|
+
- Check expiration (exp claim)
|
|
68
|
+
- Short expiration (15min) + refresh tokens
|
|
69
|
+
- Store in httpOnly cookies, not localStorage
|
|
70
|
+
|
|
71
|
+
## Security Checklist
|
|
72
|
+
- [ ] All inputs validated/sanitized
|
|
73
|
+
- [ ] Secrets in environment variables
|
|
74
|
+
- [ ] HTTPS enforced
|
|
75
|
+
- [ ] Rate limiting on sensitive endpoints
|
|
76
|
+
- [ ] Auth + authz on protected routes
|
|
77
|
+
- [ ] CORS configured
|
|
78
|
+
- [ ] Security headers (CSP, X-Frame-Options)
|
|
79
|
+
- [ ] Dependencies updated (npm audit)
|
|
@@ -0,0 +1,111 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: Testing Strategies
|
|
3
|
+
description: Unit, integration, e2e, TDD, mocking, test architecture
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Testing Strategies
|
|
7
|
+
|
|
8
|
+
## Testing Pyramid
|
|
9
|
+
```
|
|
10
|
+
/\
|
|
11
|
+
/E2E\ (10% - Slow, expensive, brittle)
|
|
12
|
+
/------\
|
|
13
|
+
/Integr.\ (20% - Medium speed/cost)
|
|
14
|
+
/----------\
|
|
15
|
+
/Unit Tests \ (70% - Fast, cheap, stable)
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
## Unit Testing
|
|
19
|
+
|
|
20
|
+
### What to Test
|
|
21
|
+
**Do**: Business logic, edge cases, error handling, pure functions
|
|
22
|
+
**Don't**: Third-party libraries, implementation details, trivial code
|
|
23
|
+
|
|
24
|
+
### Best Practices
|
|
25
|
+
|
|
26
|
+
**AAA Pattern**: Arrange → Act → Assert
|
|
27
|
+
|
|
28
|
+
**Test names**: Describe behavior (`returns 404 when user not found`)
|
|
29
|
+
|
|
30
|
+
**One assertion per test** (ideally)
|
|
31
|
+
|
|
32
|
+
### Mocking
|
|
33
|
+
|
|
34
|
+
**When**: External APIs, databases, file system, time/date, random values
|
|
35
|
+
**How**: Mock boundaries only, not internal code
|
|
36
|
+
|
|
37
|
+
## Integration Testing
|
|
38
|
+
|
|
39
|
+
**Test**: Multiple units together, DB interactions, API endpoints, auth flows
|
|
40
|
+
|
|
41
|
+
**Database**: Use test DB, reset before each test, use transactions (rollback after)
|
|
42
|
+
|
|
43
|
+
## E2E Testing
|
|
44
|
+
|
|
45
|
+
**Test**: Critical user flows only (happy path + common errors)
|
|
46
|
+
**Example**: Login → Create → Edit → Delete → Logout
|
|
47
|
+
|
|
48
|
+
**Stability**: Use data-testid, wait for elements, retry assertions, headless in CI
|
|
49
|
+
**Speed**: Run parallel, skip UI steps (use API for setup)
|
|
50
|
+
|
|
51
|
+
## TDD (Test-Driven Development)
|
|
52
|
+
|
|
53
|
+
### Red-Green-Refactor
|
|
54
|
+
1. Write failing test
|
|
55
|
+
2. Write minimal code to pass
|
|
56
|
+
3. Refactor while keeping tests green
|
|
57
|
+
|
|
58
|
+
**Good for**: Well-defined requirements, complex logic, bug fixes
|
|
59
|
+
**Not for**: Prototypes, UI styling, simple CRUD
|
|
60
|
+
|
|
61
|
+
## Testing Patterns
|
|
62
|
+
|
|
63
|
+
### Parameterized Tests
|
|
64
|
+
```javascript
|
|
65
|
+
test.each([
|
|
66
|
+
[1, 2, 3],
|
|
67
|
+
[2, 3, 5],
|
|
68
|
+
])('adds %i + %i = %i', (a, b, expected) => {
|
|
69
|
+
expect(add(a, b)).toBe(expected)
|
|
70
|
+
})
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
### Test Doubles
|
|
74
|
+
- **Stub**: Returns canned response
|
|
75
|
+
- **Mock**: Verifies interactions
|
|
76
|
+
- **Spy**: Records calls
|
|
77
|
+
- **Fake**: Working implementation (in-memory DB)
|
|
78
|
+
|
|
79
|
+
## Code Coverage
|
|
80
|
+
|
|
81
|
+
**Metrics**: Line, branch, function, statement
|
|
82
|
+
**Target**: 80%+ (critical paths 100%)
|
|
83
|
+
|
|
84
|
+
**Don't chase numbers**: Coverage ≠ quality. 70% with good tests > 95% shallow tests.
|
|
85
|
+
|
|
86
|
+
## React Component Testing
|
|
87
|
+
|
|
88
|
+
**React Testing Library**: Test user interactions, not implementation
|
|
89
|
+
|
|
90
|
+
**Query priority**: getByRole > getByLabelText > getByText > getByTestId
|
|
91
|
+
|
|
92
|
+
## Performance Testing
|
|
93
|
+
|
|
94
|
+
**Load Testing Metrics**: RPS, response time (p50/p95/p99), error rate, resource usage
|
|
95
|
+
|
|
96
|
+
**Scenarios**: Baseline (normal), stress (peak 3x), spike (sudden surge), soak (sustained hours)
|
|
97
|
+
|
|
98
|
+
**Tools**: k6, Artillery, JMeter
|
|
99
|
+
|
|
100
|
+
## CI/CD Integration
|
|
101
|
+
|
|
102
|
+
**On commit**: Linting, unit tests, integration tests
|
|
103
|
+
**On PR**: Full suite, coverage report, benchmarks
|
|
104
|
+
**On deploy**: E2E (staging), smoke tests (production)
|
|
105
|
+
|
|
106
|
+
## Common Pitfalls
|
|
107
|
+
|
|
108
|
+
❌ **Testing implementation** → Test public API/behavior
|
|
109
|
+
❌ **Brittle tests** → Use semantic queries, independent tests, proper waits
|
|
110
|
+
❌ **Slow tests** → Mock external calls, parallelize, focus on unit tests
|
|
111
|
+
❌ **Flaky tests** → Investigate root cause (timing, shared state, external deps)
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: Silent
|
|
3
|
+
description: Execute without narration - speak only through tool calls and commits
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Silent Execution Style
|
|
7
|
+
|
|
8
|
+
## During Execution
|
|
9
|
+
|
|
10
|
+
Use tool calls only. Do not produce text responses.
|
|
11
|
+
|
|
12
|
+
User sees your work through:
|
|
13
|
+
- Tool call executions
|
|
14
|
+
- File creation and modifications
|
|
15
|
+
- Test results
|
|
16
|
+
|
|
17
|
+
## At Completion
|
|
18
|
+
|
|
19
|
+
Document in commit message or PR description.
|
|
20
|
+
|
|
21
|
+
## Never
|
|
22
|
+
|
|
23
|
+
Do not narrate actions, explain reasoning, report status, or provide summaries during execution.
|
|
@@ -0,0 +1,144 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: Shared Agent Guidelines
|
|
3
|
+
description: Universal principles and standards for all agents
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# SHARED GUIDELINES
|
|
7
|
+
|
|
8
|
+
## Performance
|
|
9
|
+
|
|
10
|
+
**Parallel Execution**: Multiple tool calls in ONE message = parallel. Multiple messages = sequential.
|
|
11
|
+
|
|
12
|
+
Use parallel whenever tools are independent. Watch for dependencies and ordering requirements.
|
|
13
|
+
|
|
14
|
+
---
|
|
15
|
+
|
|
16
|
+
## Cognitive Framework
|
|
17
|
+
|
|
18
|
+
### Understanding Depth
|
|
19
|
+
- **Shallow OK**: Well-defined, low-risk, established patterns → Implement
|
|
20
|
+
- **Deep required**: Ambiguous, high-risk, novel, irreversible → Investigate first
|
|
21
|
+
|
|
22
|
+
### Complexity Navigation
|
|
23
|
+
- **Mechanical**: Known patterns → Execute fast
|
|
24
|
+
- **Analytical**: Multiple components → Design then build
|
|
25
|
+
- **Emergent**: Unknown domain → Research, prototype, design, build
|
|
26
|
+
|
|
27
|
+
### State Awareness
|
|
28
|
+
- **Flow**: Clear path, tests pass → Push forward
|
|
29
|
+
- **Friction**: Hard to implement, messy → Reassess, simplify
|
|
30
|
+
- **Uncertain**: Missing info → Assume reasonably, document, continue
|
|
31
|
+
|
|
32
|
+
**Signals to pause**: Can't explain simply, too many caveats, hesitant without reason, over-confident without alternatives.
|
|
33
|
+
|
|
34
|
+
---
|
|
35
|
+
|
|
36
|
+
## Principles
|
|
37
|
+
|
|
38
|
+
### Programming
|
|
39
|
+
- **Functional composition**: Pure functions, immutable data, explicit side effects
|
|
40
|
+
- **Composition over inheritance**: Prefer function composition, mixins, dependency injection
|
|
41
|
+
- **Declarative over imperative**: Express what you want, not how
|
|
42
|
+
- **Event-driven when appropriate**: Decouple components through events/messages
|
|
43
|
+
|
|
44
|
+
### Quality
|
|
45
|
+
- **YAGNI**: Build what's needed now, not hypothetical futures
|
|
46
|
+
- **KISS**: Choose simple solutions over complex ones
|
|
47
|
+
- **DRY**: Extract duplication on 3rd occurrence. Balance with readability
|
|
48
|
+
- **Separation of concerns**: Each module handles one responsibility
|
|
49
|
+
- **Dependency inversion**: Depend on abstractions, not implementations
|
|
50
|
+
|
|
51
|
+
---
|
|
52
|
+
|
|
53
|
+
## Technical Standards
|
|
54
|
+
|
|
55
|
+
**Code Quality**: Self-documenting names, test critical paths (100%) and business logic (80%+), comments explain WHY not WHAT, make illegal states unrepresentable.
|
|
56
|
+
|
|
57
|
+
**Security**: Validate inputs at boundaries, never log sensitive data, secure defaults (auth required, deny by default), include rollback plan for risky changes.
|
|
58
|
+
|
|
59
|
+
**Error Handling**: Handle explicitly at boundaries, use Result/Either for expected failures, never mask failures, log with context, actionable messages.
|
|
60
|
+
|
|
61
|
+
**Refactoring**: Extract on 3rd duplication, when function >20 lines or cognitive load high. When thinking "I'll clean later" → Clean NOW. When adding TODO → Implement NOW.
|
|
62
|
+
|
|
63
|
+
---
|
|
64
|
+
|
|
65
|
+
## Documentation
|
|
66
|
+
|
|
67
|
+
Communicate through code using inline comments and docstrings.
|
|
68
|
+
|
|
69
|
+
Separate documentation files only when explicitly requested.
|
|
70
|
+
|
|
71
|
+
---
|
|
72
|
+
|
|
73
|
+
## Anti-Patterns
|
|
74
|
+
|
|
75
|
+
**Technical Debt Rationalization**: "I'll clean this later" → You won't. "Just one more TODO" → Compounds. "Tests slow me down" → Bugs slow more. Refactor AS you make it work, not after.
|
|
76
|
+
|
|
77
|
+
**Reinventing the Wheel**: Before ANY feature: research best practices + search codebase + check package registry + check framework built-ins.
|
|
78
|
+
|
|
79
|
+
Example:
|
|
80
|
+
```typescript
|
|
81
|
+
Don't: Custom Result type → Do: import { Result } from 'neverthrow'
|
|
82
|
+
Don't: Custom validation → Do: import { z } from 'zod'
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
**Others**: Premature optimization, analysis paralysis, skipping tests, ignoring existing patterns, blocking on missing info, asking permission for obvious choices.
|
|
86
|
+
|
|
87
|
+
---
|
|
88
|
+
|
|
89
|
+
## Version Control
|
|
90
|
+
|
|
91
|
+
Feature branches `{type}/{description}`, semantic commits `<type>(<scope>): <description>`, atomic commits.
|
|
92
|
+
|
|
93
|
+
---
|
|
94
|
+
|
|
95
|
+
## File Handling
|
|
96
|
+
|
|
97
|
+
**Scratch work**: System temp directory (/tmp on Unix, %TEMP% on Windows)
|
|
98
|
+
**Final deliverables**: Working directory or user-specified location
|
|
99
|
+
|
|
100
|
+
---
|
|
101
|
+
|
|
102
|
+
## Autonomous Decisions
|
|
103
|
+
|
|
104
|
+
**Never block. Always proceed with assumptions.**
|
|
105
|
+
|
|
106
|
+
Safe assumptions: Standard patterns (REST, JWT), framework conventions, existing codebase patterns.
|
|
107
|
+
|
|
108
|
+
**Document in code**:
|
|
109
|
+
```javascript
|
|
110
|
+
// ASSUMPTION: JWT auth (REST standard, matches existing APIs)
|
|
111
|
+
// ALTERNATIVE: Session-based
|
|
112
|
+
```
|
|
113
|
+
|
|
114
|
+
**Decision hierarchy**: existing patterns > simplicity > maintainability
|
|
115
|
+
|
|
116
|
+
Important decisions: Document in commit message or PR description.
|
|
117
|
+
|
|
118
|
+
---
|
|
119
|
+
|
|
120
|
+
## High-Stakes Decisions
|
|
121
|
+
|
|
122
|
+
Use structured reasoning only for high-stakes decisions. Most decisions: decide autonomously without explanation.
|
|
123
|
+
|
|
124
|
+
**When to use**:
|
|
125
|
+
- Decision difficult to reverse (schema changes, architecture choices)
|
|
126
|
+
- Affects >3 major components
|
|
127
|
+
- Security-critical
|
|
128
|
+
- Long-term maintenance impact
|
|
129
|
+
|
|
130
|
+
**Quick check**: Easy to reverse? → Decide autonomously. Clear best practice? → Follow it.
|
|
131
|
+
|
|
132
|
+
### Decision Frameworks
|
|
133
|
+
|
|
134
|
+
**🎯 First Principles** - Break down to fundamentals, challenge assumptions. *Novel problems without precedent.*
|
|
135
|
+
|
|
136
|
+
**⚖️ Decision Matrix** - Score options against weighted criteria. *3+ options with multiple criteria.*
|
|
137
|
+
|
|
138
|
+
**🔄 Trade-off Analysis** - Compare competing aspects. *Performance vs cost, speed vs quality.*
|
|
139
|
+
|
|
140
|
+
### Process
|
|
141
|
+
1. Recognize trigger
|
|
142
|
+
2. Choose framework
|
|
143
|
+
3. Analyze decision
|
|
144
|
+
4. Document in commit message or PR description
|
|
@@ -0,0 +1,23 @@
|
|
|
1
|
+
---
|
|
2
|
+
description: Create a git commit with meaningful message
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
# Create Git Commit
|
|
6
|
+
|
|
7
|
+
## Context
|
|
8
|
+
|
|
9
|
+
- Current git status: !`git status`
|
|
10
|
+
- Current git diff (staged and unstaged changes): !`git diff HEAD`
|
|
11
|
+
- Current branch: !`git branch --show-current`
|
|
12
|
+
- Recent commits: !`git log --oneline -10`
|
|
13
|
+
|
|
14
|
+
## Your Task
|
|
15
|
+
|
|
16
|
+
Based on the above changes, create a single git commit with a meaningful commit message that:
|
|
17
|
+
|
|
18
|
+
1. Follows conventional commits format: `type(scope): description`
|
|
19
|
+
2. Accurately describes what changed and why
|
|
20
|
+
3. Includes any breaking changes or important notes
|
|
21
|
+
4. Uses present tense ("add" not "added")
|
|
22
|
+
|
|
23
|
+
After creating the commit, show the commit message for review.
|
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
---
|
|
2
|
+
description: Display current context window usage and token breakdown
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
# Context Window Usage
|
|
6
|
+
|
|
7
|
+
Display detailed information about the current context window usage, including token counts for different components.
|
|
8
|
+
|
|
9
|
+
## Your Task
|
|
10
|
+
|
|
11
|
+
Analyze and display the context window usage with the following sections:
|
|
12
|
+
|
|
13
|
+
### 1. Model Information
|
|
14
|
+
Show the current model being used and its token limits.
|
|
15
|
+
|
|
16
|
+
### 2. Visual Token Usage Bar
|
|
17
|
+
Create a visual bar chart (10 blocks wide) showing token usage breakdown using these Unicode characters:
|
|
18
|
+
- ⛁ (filled) - Used tokens
|
|
19
|
+
- ⛀ (half-filled) - Partially used blocks
|
|
20
|
+
- ⛶ (empty) - Reserved/System tokens
|
|
21
|
+
- ⛝ (light) - Free space/buffer
|
|
22
|
+
|
|
23
|
+
### 3. Token Breakdown
|
|
24
|
+
|
|
25
|
+
Calculate and display tokens for each category:
|
|
26
|
+
|
|
27
|
+
#### System Prompt
|
|
28
|
+
- Count tokens in the system prompt
|
|
29
|
+
- Show: `⛁ System prompt: X.Xk tokens (X.X%)`
|
|
30
|
+
|
|
31
|
+
#### System Tools
|
|
32
|
+
- Count tokens for all built-in tool definitions (filesystem, shell, search, interaction tools)
|
|
33
|
+
- Show: `⛁ System tools: X.Xk tokens (X.X%)`
|
|
34
|
+
|
|
35
|
+
#### MCP Tools
|
|
36
|
+
- Count tokens for all MCP tool definitions
|
|
37
|
+
- List each MCP tool with its token count
|
|
38
|
+
- Show: `⛁ MCP tools: X.Xk tokens (X.X%)`
|
|
39
|
+
|
|
40
|
+
#### Custom Agents
|
|
41
|
+
- Count tokens for custom agent definitions (if any)
|
|
42
|
+
- List each agent with token count
|
|
43
|
+
- Show: `⛁ Custom agents: X tokens (X.X%)`
|
|
44
|
+
|
|
45
|
+
#### Messages
|
|
46
|
+
- Count tokens in all messages in the current session
|
|
47
|
+
- Show: `⛁ Messages: X tokens (X.X%)`
|
|
48
|
+
|
|
49
|
+
#### Free Space
|
|
50
|
+
- Calculate remaining available tokens
|
|
51
|
+
- Show: `⛶ Free space: XXXk (XX.X%)`
|
|
52
|
+
|
|
53
|
+
#### Autocompact Buffer
|
|
54
|
+
- Calculate reserved buffer space (typically 22.5% of total)
|
|
55
|
+
- Show: `⛝ Autocompact buffer: XX.Xk tokens (XX.X%)`
|
|
56
|
+
|
|
57
|
+
### 4. Detailed Listings
|
|
58
|
+
|
|
59
|
+
Show expandable sections with details:
|
|
60
|
+
|
|
61
|
+
```
|
|
62
|
+
MCP tools · /mcp
|
|
63
|
+
└ mcp__tool_name (server-name): XXX tokens
|
|
64
|
+
└ ...
|
|
65
|
+
|
|
66
|
+
Custom agents · /agents
|
|
67
|
+
└ agent-name (Project): XX tokens
|
|
68
|
+
└ ...
|
|
69
|
+
|
|
70
|
+
SlashCommand Tool · X commands
|
|
71
|
+
└ Total: XXX tokens
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
## Display Format
|
|
75
|
+
|
|
76
|
+
Use this exact format for the output:
|
|
77
|
+
|
|
78
|
+
```
|
|
79
|
+
Context Usage
|
|
80
|
+
⛁ ⛁ ⛁ ⛁ ⛁ ⛁ ⛁ ⛀ ⛁ ⛁ model-name · XXk/XXXk tokens (XX%)
|
|
81
|
+
⛀ ⛀ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶
|
|
82
|
+
⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛁ System prompt: X.Xk tokens (X.X%)
|
|
83
|
+
⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛁ System tools: XX.Xk tokens (X.X%)
|
|
84
|
+
⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛁ MCP tools: X.Xk tokens (X.X%)
|
|
85
|
+
⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛁ Custom agents: XX tokens (X.X%)
|
|
86
|
+
⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛁ Messages: XXX tokens (X.X%)
|
|
87
|
+
⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛶ ⛝ ⛝ ⛝ ⛶ Free space: XXXk (XX.X%)
|
|
88
|
+
⛝ ⛝ ⛝ ⛝ ⛝ ⛝ ⛝ ⛝ ⛝ ⛝ ⛝ Autocompact buffer: XX.Xk tokens (XX.X%)
|
|
89
|
+
⛝ ⛝ ⛝ ⛝ ⛝ ⛝ ⛝ ⛝ ⛝ ⛝
|
|
90
|
+
|
|
91
|
+
MCP tools · /mcp
|
|
92
|
+
└ tool_name (server-name): XXX tokens
|
|
93
|
+
└ ...
|
|
94
|
+
|
|
95
|
+
Custom agents · /agents
|
|
96
|
+
└ agent-name (Project): XX tokens
|
|
97
|
+
└ ...
|
|
98
|
+
|
|
99
|
+
SlashCommand Tool · X commands
|
|
100
|
+
└ Total: XXX tokens
|
|
101
|
+
```
|
|
102
|
+
|
|
103
|
+
## Implementation Notes
|
|
104
|
+
|
|
105
|
+
1. Use the `countTokens()` utility from `src/utils/token-counter.ts` with the current session model name
|
|
106
|
+
2. Get current session from app store to access model name and messages
|
|
107
|
+
3. Get system prompt from `src/core/ai-sdk.ts` (SYSTEM_PROMPT constant)
|
|
108
|
+
4. Get tool definitions from `src/tools/registry.ts` (getAISDKTools())
|
|
109
|
+
5. Calculate percentages based on the model's max token limit (e.g., 200k for Claude Sonnet 4.5)
|
|
110
|
+
6. Round token counts appropriately (show decimals for k, no decimals for raw numbers)
|
|
111
|
+
7. Ensure the bar chart accurately represents the proportions
|
|
112
|
+
8. Use proper indentation and alignment for readability
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
---
|
|
2
|
+
description: Explain code in detail
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
# Explain Code
|
|
6
|
+
|
|
7
|
+
## Context
|
|
8
|
+
|
|
9
|
+
$ARGUMENTS
|
|
10
|
+
|
|
11
|
+
## Your Task
|
|
12
|
+
|
|
13
|
+
Provide a comprehensive explanation of the code above (or at the specified location) that includes:
|
|
14
|
+
|
|
15
|
+
1. **Overview**
|
|
16
|
+
- What does this code do?
|
|
17
|
+
- What problem does it solve?
|
|
18
|
+
|
|
19
|
+
2. **How It Works**
|
|
20
|
+
- Step-by-step breakdown of the logic
|
|
21
|
+
- Key algorithms or patterns used
|
|
22
|
+
- Important design decisions
|
|
23
|
+
|
|
24
|
+
3. **Components**
|
|
25
|
+
- Main functions/classes/modules
|
|
26
|
+
- Their roles and responsibilities
|
|
27
|
+
- How they interact
|
|
28
|
+
|
|
29
|
+
4. **Important Details**
|
|
30
|
+
- Edge cases handled
|
|
31
|
+
- Performance considerations
|
|
32
|
+
- Security implications
|
|
33
|
+
- Dependencies and requirements
|
|
34
|
+
|
|
35
|
+
Use clear language and provide examples where helpful.
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
---
|
|
2
|
+
description: Convert verbose prompt to MEP (Minimal Effective Prompt)
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
# MEP - Minimal Effective Prompt
|
|
6
|
+
|
|
7
|
+
## Context
|
|
8
|
+
|
|
9
|
+
User's original prompt:
|
|
10
|
+
```
|
|
11
|
+
$ARGUMENTS
|
|
12
|
+
```
|
|
13
|
+
|
|
14
|
+
## Your Task
|
|
15
|
+
|
|
16
|
+
Analyze the user's prompt above and refactor it into a **Minimal Effective Prompt (MEP)** that:
|
|
17
|
+
|
|
18
|
+
### Remove Unnecessary Context
|
|
19
|
+
❌ Remove information that AI already knows:
|
|
20
|
+
- Current date/time (AI has access via hooks)
|
|
21
|
+
- System information (platform, CPU, memory - provided automatically)
|
|
22
|
+
- Project structure (AI can search codebase)
|
|
23
|
+
- Tech stack (AI can detect from package.json and code)
|
|
24
|
+
- File locations (AI can search)
|
|
25
|
+
- Existing code patterns (AI can search codebase)
|
|
26
|
+
|
|
27
|
+
### Keep Essential Information
|
|
28
|
+
✅ Keep only what AI cannot infer:
|
|
29
|
+
- Specific business requirements
|
|
30
|
+
- User preferences or constraints
|
|
31
|
+
- Domain-specific knowledge
|
|
32
|
+
- Desired outcome or behavior
|
|
33
|
+
- Acceptance criteria
|
|
34
|
+
|
|
35
|
+
### Apply MEP Principles
|
|
36
|
+
|
|
37
|
+
1. **Be Specific About What, Not How**
|
|
38
|
+
- ❌ "Create a React component with useState hook, useEffect for data fetching, proper error handling..."
|
|
39
|
+
- ✅ "Add user profile page with real-time data"
|
|
40
|
+
|
|
41
|
+
2. **Trust AI's Knowledge**
|
|
42
|
+
- ❌ "Using TypeScript with proper types, following our code style..."
|
|
43
|
+
- ✅ "Add user authentication" (AI will use TypeScript, follow existing patterns)
|
|
44
|
+
|
|
45
|
+
3. **Focus on Intent**
|
|
46
|
+
- ❌ "I need a function that takes an array and returns unique values using Set..."
|
|
47
|
+
- ✅ "Remove duplicate items from the list"
|
|
48
|
+
|
|
49
|
+
4. **Remove Redundancy**
|
|
50
|
+
- ❌ "Add comprehensive error handling with try-catch blocks and proper error messages..."
|
|
51
|
+
- ✅ "Add error handling" (comprehensive is default)
|
|
52
|
+
|
|
53
|
+
### Output Format
|
|
54
|
+
|
|
55
|
+
Provide the refactored MEP prompt as a single, concise statement (1-3 sentences max) that captures the essence of the user's intent.
|
|
56
|
+
|
|
57
|
+
**Original:** [quote the original]
|
|
58
|
+
|
|
59
|
+
**MEP Version:** [your refactored minimal prompt]
|
|
60
|
+
|
|
61
|
+
**Removed Context:** [list what was removed and why - explain that AI already has this info]
|
|
62
|
+
|
|
63
|
+
**Preserved Intent:** [confirm the core requirement is maintained]
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
---
|
|
2
|
+
description: Review code for quality, security, and best practices
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
# Code Review
|
|
6
|
+
|
|
7
|
+
## Context
|
|
8
|
+
|
|
9
|
+
$ARGUMENTS
|
|
10
|
+
|
|
11
|
+
## Your Task
|
|
12
|
+
|
|
13
|
+
Review the code above (or at the specified location) and provide feedback on:
|
|
14
|
+
|
|
15
|
+
1. **Code Quality**
|
|
16
|
+
- Readability and maintainability
|
|
17
|
+
- Code organization and structure
|
|
18
|
+
- Naming conventions
|
|
19
|
+
- Comments and documentation
|
|
20
|
+
|
|
21
|
+
2. **Security**
|
|
22
|
+
- Potential vulnerabilities
|
|
23
|
+
- Input validation
|
|
24
|
+
- Authentication/authorization issues
|
|
25
|
+
- Data exposure risks
|
|
26
|
+
|
|
27
|
+
3. **Performance**
|
|
28
|
+
- Algorithmic efficiency
|
|
29
|
+
- Resource usage
|
|
30
|
+
- Potential bottlenecks
|
|
31
|
+
- Scalability concerns
|
|
32
|
+
|
|
33
|
+
4. **Best Practices**
|
|
34
|
+
- Language-specific idioms
|
|
35
|
+
- Design patterns
|
|
36
|
+
- Error handling
|
|
37
|
+
- Testing coverage
|
|
38
|
+
|
|
39
|
+
Provide specific, actionable suggestions for improvement.
|
|
@@ -0,0 +1,30 @@
|
|
|
1
|
+
---
|
|
2
|
+
description: Write comprehensive tests for code
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
# Write Tests
|
|
6
|
+
|
|
7
|
+
## Context
|
|
8
|
+
|
|
9
|
+
$ARGUMENTS
|
|
10
|
+
|
|
11
|
+
## Your Task
|
|
12
|
+
|
|
13
|
+
Write comprehensive tests for the code above (or at the specified location) that include:
|
|
14
|
+
|
|
15
|
+
1. **Unit Tests**
|
|
16
|
+
- Test individual functions/methods
|
|
17
|
+
- Cover edge cases and boundary conditions
|
|
18
|
+
- Test error handling
|
|
19
|
+
|
|
20
|
+
2. **Integration Tests** (if applicable)
|
|
21
|
+
- Test component interactions
|
|
22
|
+
- Test with realistic data
|
|
23
|
+
|
|
24
|
+
3. **Test Coverage**
|
|
25
|
+
- Aim for high coverage of critical paths
|
|
26
|
+
- Include positive and negative test cases
|
|
27
|
+
- Test validation and error conditions
|
|
28
|
+
|
|
29
|
+
Use the project's existing testing framework and follow its conventions.
|
|
30
|
+
Ensure tests are readable, maintainable, and properly documented.
|
|
@@ -0,0 +1,4 @@
|
|
|
1
|
+
import"./chunk-sxy6vp20.js";import{AutoTokenizer as B}from"@huggingface/transformers";var Q=new Map,V=new Set,W=new Set,G=3,U={"gpt-4":"Xenova/gpt-4","gpt-4-turbo":"Xenova/gpt-4","gpt-4o":"Xenova/gpt-4","gpt-3.5-turbo":"Xenova/gpt-3.5-turbo","gpt-3.5":"Xenova/gpt-3.5-turbo","claude-3-opus":"Xenova/claude-tokenizer","claude-3-sonnet":"Xenova/claude-tokenizer","claude-3-haiku":"Xenova/claude-tokenizer","claude-3.5-sonnet":"Xenova/claude-tokenizer","claude-3.5-haiku":"Xenova/claude-tokenizer",starcoder:"bigcode/starcoder",starcoder2:"bigcode/starcoder2-3b",codellama:"codellama/CodeLlama-7b-hf",gemini:"Xenova/gpt-4",default:"Xenova/gpt-4"};function H(j){if(!j)return U.default;if(U[j])return U[j];let q=j.toLowerCase();for(let[J,P]of Object.entries(U))if(q.includes(J))return P;return U.default}function Y(j){if(!j)return 0;let q=j.split(/\s+/).filter(Boolean).length,J=j.length,P=Math.ceil(J/3.5),v=Math.ceil(q*1.3);return Math.round((P+v)/2)}async function S(j){let q=H(j);if(Q.has(q))return Q.get(q);if(W.has(q))return null;while(V.has(q))await new Promise((J)=>setTimeout(J,100));if(Q.has(q))return Q.get(q);if(W.has(q))return null;try{V.add(q);let J=await B.from_pretrained(q,{cache_dir:"./models/.cache",local_files_only:!1});if(Q.size>=G){let P=Q.keys().next().value;if(P)Q.delete(P)}return Q.set(q,J),V.delete(q),J}catch(J){return console.warn("[TokenCounter] BPE tokenizer initialization failed, using fallback estimation:",J),W.add(q),V.delete(q),null}}async function $(j,q){if(!j)return 0;let J=await S(q);if(!J)return Y(j);try{let P=await J(j);if(P.input_ids&&P.input_ids.size)return P.input_ids.size;if(Array.isArray(P.input_ids))return P.input_ids.length;if(P.input_ids.data)return P.input_ids.data.length;return Y(j)}catch(P){return console.warn("[TokenCounter] Token counting failed, using fallback:",P),Y(j)}}function X(j){return Y(j)}function p(j){if(j<1000)return j.toString();if(j<1e6)return`${(j/1000).toFixed(1)}K`;return`${(j/1e6).toFixed(1)}M`}async function y(j,q){return $(j,q)}async function A(j,q){let J=await $(j,q);return`${p(J)} Tokens`}function b(j){let q=X(j);return`${p(q)} Tokens`}async function f(j,q){return Promise.all(j.map((J)=>$(J,q)))}function D(j){return j.map(X)}async function L(j){let q=H(j),J=await S(j);return{modelName:j||"default",tokenizerName:q,loaded:J!==null,failed:W.has(q)}}function R(){return Object.keys(U).filter((j)=>j!=="default")}export{L as getTokenizerInfo,R as getSupportedModels,p as formatTokenCount,D as estimateTokensBatch,X as estimateTokens,y as countTokensForModel,f as countTokensBatch,$ as countTokens,b as countAndFormatSync,A as countAndFormat};
|
|
2
|
+
export{p as t,L as u};
|
|
3
|
+
|
|
4
|
+
//# debugId=0C9FB9C9D50392DD64756E2164756E21
|