@sylphx/flow 2.28.2 → 2.28.4

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @sylphx/flow
 
+## 2.28.4 (2026-01-04)
+
+Rewrite continue command with SSOT principles and comprehensive system correctness guidelines
+
+### 📚 Documentation
+
+- **commands:** rewrite continue command with SSOT principles ([b3ca5e0](https://github.com/SylphxAI/flow/commit/b3ca5e048b7580ed2f723936297b015a03964932))
+
+## 2.28.3 (2025-12-19)
+
+### 🐛 Bug Fixes
+
+- **prompts:** instruct agents to use Skill tool explicitly ([45a2d34](https://github.com/SylphxAI/flow/commit/45a2d34fca6cf3064193980b15acdc922ac0f554))
+
 ## 2.28.2 (2025-12-19)
 
 Enhance PWA skill with comprehensive native app parity checklist (35 capabilities)

package/assets/agents/builder.md

@@ -43,14 +43,7 @@ Build toward that.
 
 **Ultrathink.** Many minds beat one. Delegate workers to explore from different angles. They critique, you synthesize. Never self-assess.
 
-**Skills.** Before acting on any domain — invoke the skill:
-```
-abuse-prevention, account-security, admin, appsec, auth, billing,
-code-quality, competitive-analysis, data-modeling, database, delivery,
-deployments, growth, i18n, ledger, observability, performance, pricing,
-privacy, pwa, referral, seo, storage, support, uiux
-```
-Skills contain: tech stack decisions, non-negotiables, driving questions. Then exceed them.
+**Skills.** Before acting on any domain — use the Skill tool to load guidelines. Read the guidelines. Then exceed them.
 
 **Act.** No permission needed. No workarounds. Ship it.
 

package/assets/slash-commands/continue.md

@@ -5,24 +5,95 @@ description: Trigger autonomous product iteration - think, improve, ship
 
 # Continue
 
-**Go.** You are the builder.
+Continuously commit.
 
-Push for world-class:
-- What would users love?
-- What would make them pay and spread?
-- What would beat competitors?
+The entire system — not limited to data — must strictly obey a Single Source of Truth (SSOT) principle.
+Every state, behavior, flow, permission, architecture decision, UI behavior, and side effect
+must have exactly one authoritative source, one interpretation, and one correct path.
 
-**Be the user.** What frustrates? What delights?
+The system must be fully reason-able end to end.
+There must be no implicit behavior, hidden assumptions, magic defaults, or silent fallbacks.
 
-**Never self-assess.** Delegate to workers — they critique, you synthesize. Final Gate.
+Continuously and repeatedly review, validate, and correct the entire system:
+- Membership and identity correctness and completeness
+- Consistency across state, permissions, flows, and lifecycle
+- Architectural boundaries, modularity, and separation of responsibilities
+- UI behavior matching system intent, state, and permissions
+- Alignment with modern industry standards and best practices
 
-**Invoke skills** before acting on any domain:
-```
-abuse-prevention, account-security, admin, appsec, auth, billing,
-code-quality, competitive-analysis, data-modeling, database, delivery,
-deployments, growth, i18n, ledger, observability, performance, pricing,
-privacy, pwa, referral, seo, storage, support, uiux
-```
-Skills contain: tech stack decisions, non-negotiables, driving questions. Then exceed them.
+No workarounds.
+No hacks.
+No temporary solutions.
+No backward compatibility.
+No deprecated logic.
+No TODOs.
+No dead code.
+No unused code.
+No incorrect or misleading code.
 
-`/continue`
+Every feature must be built intent-first:
+- The correct model must exist before implementation
+- No duplicated concepts, parallel truths, or shadow logic
+- Any feature must be removable or refactorable without destabilizing the system
+
+Continuously perform:
+- Deduplication
+- Refactoring
+- Polishing
+- Modularity enforcement
+- Responsibility separation
+- Architectural correction
+
+The system must remain:
+- Stateless
+- Serverless-friendly
+- Scalable
+- Reasonable
+- Testable
+- Observable
+
+All technologies must be used correctly, consistently, and idiomatically:
+tRPC, Next.js, Radix UI, next-intl, Drizzle,
+Better Auth, Stripe, Upstash, Neon, Vercel,
+Resend (email), Vercel Blob (storage),
+AI SDK with OpenRouter provider,
+Iconify, Bun, Biome, Bun test,
+Responsive Web Design.
+
+Any identity or permission bootstrap (e.g. super admin):
+- Must be defined via environment configuration
+- Must execute exactly once in the system's lifetime
+- Must be non-reentrant
+- Must not be bypassable
+- Must not become a permanent logic dependency
+
+All sensitive operations require explicit re-authentication:
+        Sensitive action triggered
+                    ↓
+            Check verified session
+                    ↓
+        Does the user have a password?
+            ├─ Yes → Verify password
+            └─ No  → Send email OTP (6 digits, 10-minute expiry)
+                    ↓
+            Verification succeeds
+                    ↓
+            Mark session as verified
+                    ↓
+        Allow scoped, time-bound sensitive actions
+        (2FA setup, email change, account deletion, etc.)
+
+The verified state must:
+- Have explicit scope
+- Have explicit expiration
+- Never be implicitly reused
+- Never be shared across sessions or contexts
+
+Any ambiguity, inconsistency, incompleteness, or undefined behavior
+must be treated as a bug, not a feature.
+
+The system must withstand repeated review, rejection, refactor, and redesign,
+and after every correction,
+become simpler, more consistent, and closer to the correct model.
+
+Ultrathink.

package/assets/slash-commands/review.md

@@ -17,14 +17,7 @@ args:
 
 ## Execution
 
-1. **Invoke skills** — Load guidelines for relevant domains:
-   ```
-   abuse-prevention, account-security, admin, appsec, auth, billing,
-   code-quality, competitive-analysis, data-modeling, database, delivery,
-   deployments, growth, i18n, ledger, observability, performance, pricing,
-   privacy, pwa, referral, seo, storage, support, uiux
-   ```
-   Skills contain: tech stack decisions, non-negotiables, driving questions.
+1. **Load skills** — Use the Skill tool to load guidelines for relevant domains. Read the guidelines.
 
 2. **Understand** — How is this implemented? Architecture, choices, tradeoffs.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sylphx/flow",
-	"version": "2.28.2",
+	"version": "2.28.4",
 	"description": "One CLI to rule them all. Unified orchestration layer for AI coding assistants. Auto-detection, auto-installation, auto-upgrade.",
 	"type": "module",
 	"bin": {