@sylphx/flow 2.16.0 → 2.16.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (29) hide show
  1. package/CHANGELOG.md +20 -0
  2. package/assets/{slash-commands/guideline-account-security.md → skills/account-security/SKILL.md} +2 -3
  3. package/assets/{slash-commands/guideline-admin.md → skills/admin/SKILL.md} +2 -3
  4. package/assets/{slash-commands/guideline-auth.md → skills/auth/SKILL.md} +2 -3
  5. package/assets/{slash-commands/guideline-billing.md → skills/billing/SKILL.md} +2 -3
  6. package/assets/{slash-commands/guideline-code-quality.md → skills/code-quality/SKILL.md} +2 -3
  7. package/assets/{slash-commands/guideline-data-architecture.md → skills/data-architecture/SKILL.md} +2 -3
  8. package/assets/{slash-commands/guideline-database.md → skills/database/SKILL.md} +2 -3
  9. package/assets/{slash-commands/guideline-delivery.md → skills/delivery/SKILL.md} +2 -3
  10. package/assets/{slash-commands/guideline-discovery.md → skills/discovery/SKILL.md} +2 -3
  11. package/assets/{slash-commands/guideline-growth.md → skills/growth/SKILL.md} +2 -3
  12. package/assets/{slash-commands/guideline-i18n.md → skills/i18n/SKILL.md} +2 -3
  13. package/assets/{slash-commands/guideline-ledger.md → skills/ledger/SKILL.md} +2 -3
  14. package/assets/{slash-commands/guideline-observability.md → skills/observability/SKILL.md} +2 -3
  15. package/assets/{slash-commands/guideline-operability.md → skills/operability/SKILL.md} +2 -3
  16. package/assets/{slash-commands/guideline-performance.md → skills/performance/SKILL.md} +2 -3
  17. package/assets/{slash-commands/guideline-pricing.md → skills/pricing/SKILL.md} +2 -3
  18. package/assets/{slash-commands/guideline-privacy.md → skills/privacy/SKILL.md} +2 -3
  19. package/assets/{slash-commands/guideline-pwa.md → skills/pwa/SKILL.md} +2 -3
  20. package/assets/{slash-commands/guideline-referral.md → skills/referral/SKILL.md} +2 -3
  21. package/assets/{slash-commands/guideline-security.md → skills/security/SKILL.md} +2 -3
  22. package/assets/{slash-commands/guideline-seo.md → skills/seo/SKILL.md} +2 -3
  23. package/assets/{slash-commands/guideline-storage.md → skills/storage/SKILL.md} +2 -3
  24. package/assets/{slash-commands/guideline-support.md → skills/support/SKILL.md} +2 -3
  25. package/assets/{slash-commands/guideline-trust-safety.md → skills/trust-safety/SKILL.md} +2 -3
  26. package/assets/{slash-commands/guideline-uiux.md → skills/uiux/SKILL.md} +2 -3
  27. package/assets/slash-commands/continue.md +71 -140
  28. package/assets/slash-commands/review.md +22 -72
  29. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,25 @@
1
1
  # @sylphx/flow
2
2
 
3
+ ## 2.16.2 (2025-12-17)
4
+
5
+ ### 🐛 Bug Fixes
6
+
7
+ - **commands:** tell LLM to use SlashCommand tool for /review and /continue ([6983015](https://github.com/SylphxAI/flow/commit/6983015b97e89a48e973106828672b8b3000dce8))
8
+
9
+ ### ♻️ Refactoring
10
+
11
+ - **assets:** convert guidelines to Skills (model-invoked) ([2eb8d01](https://github.com/SylphxAI/flow/commit/2eb8d01162f00a127c5666c8afd9b63fc477ea42))
12
+
13
+ ### 🔧 Chores
14
+
15
+ - trigger release workflow ([69d661c](https://github.com/SylphxAI/flow/commit/69d661c582157650df855a3a31e21ad6a8b3e7bf))
16
+
17
+ ## 2.16.1 (2025-12-17)
18
+
19
+ ### ♻️ Refactoring
20
+
21
+ - **commands:** simplify /continue and /review - think, don't checklist ([754eec1](https://github.com/SylphxAI/flow/commit/754eec1211719fc68f25ce47510e5797a33e1469))
22
+
3
23
  ## 2.16.0 (2025-12-17)
4
24
 
5
25
  ### ✨ Features
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-account-security
3
- description: Guideline: account security - sessions, MFA, devices, security events
4
- agent: coder
2
+ name: account-security
3
+ description: Account security - MFA, sessions, recovery. Use when protecting user accounts.
5
4
  ---
6
5
 
7
6
  # Account Security Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-admin
3
- description: Guideline: admin - RBAC, bootstrap, audit, operational tools
4
- agent: coder
2
+ name: admin
3
+ description: Admin panel - RBAC, config, admin tools. Use when building admin UI.
5
4
  ---
6
5
 
7
6
  # Admin Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-auth
3
- description: Guideline: authentication - sign-in, SSO, passkeys, verification
4
- agent: coder
2
+ name: auth
3
+ description: Authentication patterns - sign-in, SSO, passkeys, sessions. Use when implementing auth flows.
5
4
  ---
6
5
 
7
6
  # Auth Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-billing
3
- description: Guideline: billing - Stripe integration, webhooks, subscription state
4
- agent: coder
2
+ name: billing
3
+ description: Billing - Stripe, webhooks, subscriptions. Use when implementing payments.
5
4
  ---
6
5
 
7
6
  # Billing Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-code-quality
3
- description: Guideline: code quality - architecture, types, testing, maintainability
4
- agent: coder
2
+ name: code-quality
3
+ description: Code quality - patterns, testing, maintainability. Use for code review.
5
4
  ---
6
5
 
7
6
  # Code Quality Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-data-architecture
3
- description: Guideline: data architecture - boundaries, consistency, state machines
4
- agent: coder
2
+ name: data-architecture
3
+ description: Data architecture - models, relationships. Use when designing data structures.
5
4
  ---
6
5
 
7
6
  # Data Architecture Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-database
3
- description: Guideline: database - schema, migrations, performance, reliability
4
- agent: coder
2
+ name: database
3
+ description: Database - schema, indexes, migrations. Use when working with databases.
5
4
  ---
6
5
 
7
6
  # Database Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-delivery
3
- description: Guideline: delivery - CI gates, automated verification, release safety
4
- agent: coder
2
+ name: delivery
3
+ description: Delivery - CI/CD, testing, releases. Use when improving pipelines.
5
4
  ---
6
5
 
7
6
  # Delivery Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-discovery
3
- description: Guideline: discovery - competitive research, opportunities, market positioning
4
- agent: coder
2
+ name: discovery
3
+ description: Feature discovery - competitive analysis. Use when exploring features.
5
4
  ---
6
5
 
7
6
  # Discovery Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-growth
3
- description: Guideline: growth - activation, retention, virality
4
- agent: coder
2
+ name: growth
3
+ description: Growth - onboarding, activation, retention. Use for growth features.
5
4
  ---
6
5
 
7
6
  # Growth Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-i18n
3
- description: Guideline: i18n - localization, routing, translation quality
4
- agent: coder
2
+ name: i18n
3
+ description: Internationalization - localization, translations. Use when adding languages.
5
4
  ---
6
5
 
7
6
  # i18n Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-ledger
3
- description: Guideline: ledger - balance systems, financial integrity, reconciliation
4
- agent: coder
2
+ name: ledger
3
+ description: Financial ledger - transactions, audit trails. Use when tracking money.
5
4
  ---
6
5
 
7
6
  # Ledger Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-observability
3
- description: Guideline: observability - logging, tracing, alerting, debugging
4
- agent: coder
2
+ name: observability
3
+ description: Observability - logging, metrics, tracing. Use when adding monitoring.
5
4
  ---
6
5
 
7
6
  # Observability Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-operability
3
- description: Guideline: operability - workflows, retries, DLQ, incident response
4
- agent: coder
2
+ name: operability
3
+ description: Operations - deployment, rollback, feature flags. Use for ops tooling.
5
4
  ---
6
5
 
7
6
  # Operability Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-performance
3
- description: Guideline: performance - speed, Core Web Vitals, bottlenecks
4
- agent: coder
2
+ name: performance
3
+ description: Performance - Core Web Vitals, bundle size. Use when optimizing speed.
5
4
  ---
6
5
 
7
6
  # Performance Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-pricing
3
- description: Guideline: pricing - strategy, packaging, monetization
4
- agent: coder
2
+ name: pricing
3
+ description: Pricing strategy - tiers, feature gating. Use when designing pricing.
5
4
  ---
6
5
 
7
6
  # Pricing Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-privacy
3
- description: Guideline: privacy - consent, PII, data lifecycle, compliance
4
- agent: coder
2
+ name: privacy
3
+ description: Privacy and data protection - GDPR, CCPA, consent. Use when handling user data.
5
4
  ---
6
5
 
7
6
  # Privacy Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-pwa
3
- description: Guideline: PWA - offline experience, installation, engagement
4
- agent: coder
2
+ name: pwa
3
+ description: PWA - service workers, offline support. Use when building PWA features.
5
4
  ---
6
5
 
7
6
  # PWA Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-referral
3
- description: Guideline: referral - attribution, rewards, fraud prevention
4
- agent: coder
2
+ name: referral
3
+ description: Referral systems - referral programs, viral loops. Use for referrals.
5
4
  ---
6
5
 
7
6
  # Referral Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-security
3
- description: Guideline: security - OWASP, headers, authentication, secrets
4
- agent: coder
2
+ name: security
3
+ description: Application security - OWASP, validation, secrets. Use when securing the app.
5
4
  ---
6
5
 
7
6
  # Security Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-seo
3
- description: Guideline: SEO - discoverability, metadata, search rankings
4
- agent: coder
2
+ name: seo
3
+ description: SEO - meta tags, structured data. Use when optimizing for search.
5
4
  ---
6
5
 
7
6
  # SEO Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-storage
3
- description: Guideline: storage - uploads, file handling, security
4
- agent: coder
2
+ name: storage
3
+ description: File storage - uploads, CDN, blobs. Use when handling files.
5
4
  ---
6
5
 
7
6
  # Storage Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-support
3
- description: Guideline: support - help experience, communications, user satisfaction
4
- agent: coder
2
+ name: support
3
+ description: Support - help center, tickets, docs. Use when building support.
5
4
  ---
6
5
 
7
6
  # Support Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-trust-safety
3
- description: Guideline: trust & safety - abuse prevention, moderation, user protection
4
- agent: coder
2
+ name: trust-safety
3
+ description: Trust and safety - abuse prevention, rate limiting. Use when fighting bad actors.
5
4
  ---
6
5
 
7
6
  # Trust Safety Guideline
@@ -1,7 +1,6 @@
1
1
  ---
2
- name: guideline-uiux
3
- description: Guideline: UI/UX - design system, accessibility, user experience
4
- agent: coder
2
+ name: uiux
3
+ description: UI/UX - design system, accessibility. Use when building interfaces.
5
4
  ---
6
5
 
7
6
  # UI/UX Guideline
@@ -1,160 +1,91 @@
1
1
  ---
2
2
  name: continue
3
- description: Continue incomplete work - finish features, fix bugs, complete TODOs
3
+ description: Continue incomplete work - find gaps, finish features, fix what's broken
4
4
  agent: coder
5
5
  ---
6
6
 
7
- # Continue Incomplete Work
7
+ # Continue
8
8
 
9
- Scan codebase for incomplete work. Prioritize. Finish.
9
+ Find what's incomplete. Finish it.
10
10
 
11
11
  ## Mandate
12
12
 
13
- * Perform a **deep, thorough scan** of incomplete work in this codebase.
14
- * **Delegate to multiple workers** to research different aspects in parallel; you act as the **final gate** to synthesize and verify quality.
15
- * **Research then Act**: understand full scope first, then **implement fixes directly**. Don't just report finish.
16
- * **Single-pass delivery**: no deferrals; deliver complete implementation.
17
- * **Be thorough**: incomplete work hides in comments, stubs, error messages, and "temporary" solutions.
18
-
19
- ## Discovery Approach
20
-
21
- ### Phase 1: Code Analysis
22
- Scan for explicit incomplete markers:
23
- - `TODO`, `FIXME`, `XXX`, `HACK`, `BUG`, `@todo`
24
- - `NotImplementedError`, `throw new Error('not implemented')`
25
- - Stub implementations (hardcoded returns, empty catches, `pass`)
26
- - `test.skip`, `it.skip`, empty test files
27
- - Commented-out code, debug statements
28
-
29
- ### Phase 2: Role-Based Simulation
30
-
31
- **👤 User Perspective** — Walk through every user-facing flow:
32
- - Onboarding: Can a new user complete setup without confusion?
33
- - Happy path: Does the core feature work end-to-end?
34
- - Error states: What happens when things go wrong? Are messages helpful?
35
- - Edge cases: Empty states, first-time use, account limits, expired sessions
36
- - Accessibility: Keyboard nav, screen readers, color contrast
37
- - Mobile/responsive: Does it work on all devices?
38
-
39
- **🔧 Developer Perspective** — Evaluate DX and maintainability:
40
- - Setup: Can someone clone and run in < 5 minutes?
41
- - Documentation: Are APIs documented? Examples provided?
42
- - Error messages: Do stack traces help identify root cause?
43
- - Debugging: Are there logs at appropriate levels?
44
- - Testing: Can tests run locally? Are mocks available?
45
- - Dependencies: Any outdated, deprecated, or vulnerable packages?
46
-
47
- **🛡️ Admin/Ops Perspective** — Consider operational readiness:
48
- - Monitoring: Can you tell if the system is healthy?
49
- - Logging: Is there enough info to debug production issues?
50
- - Configuration: Can settings be changed without code deploy?
51
- - Backup/Recovery: Can data be restored if something fails?
52
- - Security: Are admin actions audited? Permissions enforced?
53
- - Scaling: What happens under 10x load?
54
-
55
- ### Phase 3: Scenario Simulation
56
-
57
- Run through these scenarios mentally or via code paths:
58
-
59
- | Scenario | Questions to Answer |
60
- |----------|---------------------|
61
- | New user signup | Every step works? Validation clear? Email sent? |
62
- | Returning user login | Session handling? Password reset works? |
63
- | Core action fails | Error shown? User knows what to do? Data preserved? |
64
- | Network offline | Graceful degradation? Retry logic? |
65
- | Concurrent users | Race conditions? Locks? Optimistic updates? |
66
- | Bad actor attempts | Input sanitized? Rate limited? Logged? |
67
- | Admin intervention | Can support help user? Audit trail exists? |
68
-
69
- ## Execution Process
70
-
71
- 1. **Parallel Discovery** (delegate to workers):
72
- - Worker 1: Code markers & stubs (grep TODO, FIXME, placeholders)
73
- - Worker 2: User journey simulation (trace main flows, find dead ends)
74
- - Worker 3: Developer experience audit (setup, docs, error messages)
75
- - Worker 4: Ops readiness check (logging, monitoring, config)
76
- - Worker 5: Test coverage & edge cases (skipped tests, missing scenarios)
77
-
78
- 2. **Synthesize & Prioritize**:
79
- - Collect all findings
80
- - Group by severity: Critical → High → Medium → Low
81
- - Critical: Security issues, data loss risks, broken features
82
- - High: User-facing bugs, incomplete core features
83
- - Medium: Code quality, missing tests
84
- - Low: Documentation, style issues
85
-
86
- 3. **Implement Fixes**:
87
- - Start with Critical items
88
- - Complete each fix fully before moving on
89
- - Run tests after each significant change
90
- - Commit atomically per logical fix
91
-
92
- 4. **Deep Dive with /review** (when needed):
93
- If issues cluster in a specific domain, invoke `/review <domain>` for thorough analysis:
94
-
95
- | Domain | When to Invoke |
96
- |--------|----------------|
97
- | `auth` | Auth flow issues, session bugs, SSO problems |
98
- | `security` | Validation gaps, injection risks, secrets exposure |
99
- | `billing` | Payment bugs, subscription issues, webhook failures |
100
- | `performance` | Slow pages, bundle bloat, unnecessary re-renders |
101
- | `database` | Schema issues, missing indexes, N+1 queries |
102
- | `observability` | Missing logs, no alerts, debugging blind spots |
103
- | `i18n` | Hardcoded strings, locale issues, RTL bugs |
104
-
105
- Full domain list: auth, account-security, privacy, billing, pricing, ledger, security, trust-safety, uiux, seo, pwa, performance, i18n, database, data-architecture, storage, observability, operability, delivery, growth, referral, support, admin, discovery, code-quality
106
-
107
- 5. **Loop: Re-invoke /continue**:
108
- After completing fixes, **invoke `/continue` again** to:
109
- - Verify fixes didn't introduce new issues
110
- - Discover issues that were hidden by previous bugs
111
- - Continue until no Critical/High items remain
112
-
113
- **Exit condition**: No Critical or High severity items found.
114
-
115
- ## Output Format
116
-
117
- ### Discovery Summary
118
- ```
119
- ## Incomplete Work Found
13
+ * **Think, don't checklist.** Understand the project first. What is it trying to do? What would "done" look like?
14
+ * **Delegate workers** for parallel research. You synthesize and verify.
15
+ * **Fix, don't report.** Implement solutions directly.
16
+ * **One pass.** No deferrals. Complete each fix fully.
120
17
 
121
- ### Critical (X items)
122
- - [ ] File:line - Description
18
+ ## How to Find Incomplete Work
123
19
 
124
- ### High (X items)
125
- - [ ] File:line - Description
20
+ Don't grep for TODO and call it done. Incomplete work hides in:
126
21
 
127
- ### Medium (X items)
128
- - [ ] File:line - Description
22
+ **What's explicitly unfinished** — Yes, scan for TODO/FIXME/HACK. But ask: why are they there? What was the person avoiding?
129
23
 
130
- ### Low (X items)
131
- - [ ] File:line - Description
132
- ```
24
+ **What's implicitly broken** — Code that "works" but:
25
+ - Fails silently (empty catch blocks, swallowed errors)
26
+ - Works only in happy path (no validation, no edge cases)
27
+ - Works but confuses users (unclear errors, missing feedback)
28
+ - Works but can't be debugged (no logs, no context)
133
29
 
134
- ### Progress Updates
135
- ```
136
- ✓ Fixed: [description] (file:line)
137
- ⚠ Blocked: [description] - needs [reason]
138
- → Deep dive: invoking /review [domain]
139
- ↻ Loop: re-invoking /continue
140
- ```
30
+ **What's missing entirely** — Features referenced but not implemented. UI that leads nowhere. Promises in docs that code doesn't deliver.
141
31
 
142
- ### Completion
143
- ```
144
- ## Continue Complete
32
+ ## The Real Test
33
+
34
+ For each part of the system, ask:
35
+
36
+ > "If I were a user trying to accomplish their goal, where would I get stuck?"
37
+
38
+ > "If this broke at 3am, could someone figure out why?"
39
+
40
+ > "If requirements changed tomorrow, what would be painful to modify?"
41
+
42
+ > "If we had 100x traffic, what would fall over first?"
43
+
44
+ These questions reveal incompleteness that checklists miss.
45
+
46
+ ## Execution
47
+
48
+ 1. **Understand the project** — Read README, main entry points, core flows. What is this thing supposed to do?
49
+
50
+ 2. **Walk the critical paths** — Trace actual user journeys through code. Where does the path get uncertain, error-prone, or incomplete?
51
+
52
+ 3. **Find the gaps** — Not just TODOs, but:
53
+ - Dead ends (code that starts something but doesn't finish)
54
+ - Weak spots (minimal implementation that will break under pressure)
55
+ - Missing pieces (what's referenced but doesn't exist)
145
56
 
146
- X issues fixed
147
- ⚠ X issues need manual intervention
148
- Invoked /review for: [domains]
57
+ 4. **Prioritize by impact** — What blocks users? What causes data loss? What makes debugging impossible? Fix those first.
58
+
59
+ 5. **Fix completely** Don't patch. Understand root cause. Implement proper solution. Test it works.
60
+
61
+ ## Skills
62
+
63
+ Domain knowledge auto-activates when relevant. Available skills:
64
+
65
+ auth, account-security, privacy, billing, pricing, ledger, security, trust-safety, uiux, seo, pwa, performance, i18n, database, data-architecture, storage, observability, operability, delivery, growth, referral, support, admin, discovery, code-quality
66
+
67
+ ## Loop
68
+
69
+ After fixing: "Did my fixes introduce new gaps? Did fixing X reveal Y was also broken?"
70
+
71
+ If yes → run `/continue` again. If no Critical/High issues remain → done.
72
+
73
+ ## Output
149
74
 
150
- Next: [/continue again | no further action needed]
151
75
  ```
76
+ ## What I Found
77
+
78
+ [Describe the gaps discovered — not a checklist, but an understanding of what's incomplete and why]
79
+
80
+ ## What I Fixed
81
+
82
+ - [Description of fix and why it matters]
152
83
 
153
- ## Driving Questions
84
+ ## What Remains
154
85
 
155
- 1. **User**: What flows break or confuse real users? Where do they get stuck?
156
- 2. **Developer**: What would frustrate someone onboarding to this codebase?
157
- 3. **Admin/Ops**: What would make a 3am incident harder to debug?
158
- 4. **Security**: What incomplete validation could be exploited?
159
- 5. **Quality**: What "temporary" solutions became permanent debt?
160
- 6. **Scale**: What works now but will break at 10x growth?
86
+ - [Issues that need human decision or are blocked]
87
+
88
+ ## Next
89
+
90
+ [/continue again | done]
91
+ ```
@@ -1,94 +1,44 @@
1
1
  ---
2
2
  name: review
3
- description: Review codebase by domain - usage: /review auth, /review billing, etc.
3
+ description: Review codebase by topic - /review <what to review>
4
4
  agent: coder
5
5
  args:
6
- - name: domain
7
- description: Domain to review (auth, billing, security, etc.)
6
+ - name: topic
7
+ description: What to review (e.g., auth, security, "the login flow", "why it's slow")
8
8
  required: true
9
9
  ---
10
10
 
11
11
  # Review: $ARGS
12
12
 
13
- Perform a focused review of the specified domain(s) in this codebase.
14
-
15
13
  ## Mandate
16
14
 
17
- * **Delegate to multiple workers** to research different aspects in parallel; you act as the **final gate** to synthesize and verify quality.
18
- * **Deep, thorough analysis**: don't skim understand root causes and systemic patterns.
19
- * **Review then Act**: identify issues, then **implement fixes directly**. Don't just report fix.
20
- * **Single-pass delivery**: no deferrals; deliver complete implementation.
21
- * **Explore beyond the spec**: identify gaps, inefficiencies, and opportunities the checklist doesn't cover.
22
-
23
- ## Guidelines Reference
24
-
25
- Based on the domain(s) requested, read the relevant guideline(s) below. You may read multiple guidelines in parallel if the review spans multiple domains.
15
+ * **Understand first.** Absorb the principles, then apply judgment.
16
+ * **Think like the failure mode.** Security? Think like an attacker. Performance? Think like a slow network. Auth? Think like a confused user.
17
+ * **Delegate workers** for parallel research. You synthesize and verify.
18
+ * **Fix, don't report.** Implement solutions directly.
26
19
 
27
- | Domain | Guideline | Description |
28
- |--------|-----------|-------------|
29
- | **Identity & Auth** |||
30
- | `auth` | `/guideline-auth` | Sign-in, SSO, passkeys, verification |
31
- | `account-security` | `/guideline-account-security` | MFA, session management, account recovery |
32
- | `privacy` | `/guideline-privacy` | Data handling, consent, GDPR/CCPA |
33
- | **Billing & Revenue** |||
34
- | `billing` | `/guideline-billing` | Stripe integration, webhooks, subscriptions |
35
- | `pricing` | `/guideline-pricing` | Pricing models, tiers, feature gating |
36
- | `ledger` | `/guideline-ledger` | Transaction records, audit trails, reconciliation |
37
- | **Security** |||
38
- | `security` | `/guideline-security` | OWASP, input validation, secrets management |
39
- | `trust-safety` | `/guideline-trust-safety` | Abuse prevention, rate limiting, fraud |
40
- | **Frontend & UX** |||
41
- | `uiux` | `/guideline-uiux` | Design system, accessibility, interactions |
42
- | `seo` | `/guideline-seo` | Meta tags, structured data, crawlability |
43
- | `pwa` | `/guideline-pwa` | Service workers, offline, installability |
44
- | `performance` | `/guideline-performance` | Core Web Vitals, bundle size, caching |
45
- | `i18n` | `/guideline-i18n` | Localization, routing, hreflang |
46
- | **Data** |||
47
- | `database` | `/guideline-database` | Schema design, indexes, migrations |
48
- | `data-architecture` | `/guideline-data-architecture` | Data models, relationships, integrity |
49
- | `storage` | `/guideline-storage` | File uploads, CDN, blob storage |
50
- | **Operations** |||
51
- | `observability` | `/guideline-observability` | Logging, metrics, tracing, alerts |
52
- | `operability` | `/guideline-operability` | Deployment, rollback, feature flags |
53
- | `delivery` | `/guideline-delivery` | CI/CD, testing, release process |
54
- | **Growth & Support** |||
55
- | `growth` | `/guideline-growth` | Onboarding, activation, retention |
56
- | `referral` | `/guideline-referral` | Referral programs, viral loops |
57
- | `support` | `/guideline-support` | Help systems, tickets, documentation |
58
- | **Admin & Discovery** |||
59
- | `admin` | `/guideline-admin` | Admin panel, RBAC, config management |
60
- | `discovery` | `/guideline-discovery` | Feature discovery, competitive analysis |
61
- | **Code Quality** |||
62
- | `code-quality` | `/guideline-code-quality` | Patterns, testing, maintainability |
20
+ ## Skills
63
21
 
64
- ## Execution
22
+ Domain knowledge is available through Skills that auto-activate based on context:
65
23
 
66
- 1. Parse the `$ARGS` to identify which domain(s) to review
67
- 2. Read the corresponding guideline file(s) — **read in parallel** if multiple domains
68
- 3. Use the guideline's Tech Stack, Non-Negotiables, Context, and Driving Questions to guide your review
69
- 4. Delegate workers to investigate different aspects simultaneously
70
- 5. Synthesize findings and implement fixes
24
+ auth, account-security, privacy, billing, pricing, ledger, security, trust-safety, uiux, seo, pwa, performance, i18n, database, data-architecture, storage, observability, operability, delivery, growth, referral, support, admin, discovery, code-quality
71
25
 
72
- ## Multi-Domain Reviews
26
+ You don't need to invoke them — they activate when relevant.
73
27
 
74
- You can review multiple domains at once:
75
- - `/review auth security` — Review both auth and security
76
- - `/review billing pricing ledger` — Full revenue stack review
77
- - `/review performance seo pwa` — Frontend optimization review
78
-
79
- When reviewing multiple domains, look for **cross-cutting concerns** and **gaps between domains**.
80
-
81
- ## Output Format
28
+ ## Output
82
29
 
83
30
  ```
84
- ## Review: [domain(s)]
31
+ ## Review: [topic]
32
+
33
+ ### Understanding
34
+ [How this is implemented. Architecture, choices, tradeoffs.]
85
35
 
86
- ### Critical Issues
87
- - [ ] Issue description Fix implemented
36
+ ### Issues
37
+ [What's wrong and why it matters]
88
38
 
89
- ### Improvements Made
90
- - ✓ What was fixed/improved
39
+ ### Fixed
40
+ [Changes made]
91
41
 
92
- ### Recommendations
93
- - Future considerations (if can't fix now)
42
+ ### Remaining
43
+ [Needs human decision or blocked]
94
44
  ```
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@sylphx/flow",
3
- "version": "2.16.0",
3
+ "version": "2.16.2",
4
4
  "description": "One CLI to rule them all. Unified orchestration layer for Claude Code, OpenCode, Cursor and all AI development tools. Auto-detection, auto-installation, auto-upgrade.",
5
5
  "type": "module",
6
6
  "bin": {