@torus-engineering/tas-kit 1.11.1 → 1.12.0

package/.claude/skills/tas-implementation-complete/SKILL.md

@@ -1,100 +0,0 @@
----
-name: tas-implementation-complete
-description: |
-  Auto-invoke when user signals implementation complete: "done", "xong", "finished",
-  "đã xong", "đã implement xong", "implementation complete", "code xong rồi",
-  "viết xong rồi", "đã code xong", "completed", "code done", "finished coding".
-  Trigger parallel post-implementation review gate.
-allowed-tools: Read, Bash, Grep, Glob, Agent
----
-
-# TAS Implementation Complete
-
-When user signals implementation complete, automatically trigger post-implementation review gate.
-Don't wait for user to manually run `/tas-review-code`.
-
-## When to Use
-
-- User just finished implementing a Story or feature
-- User says "xong", "done", "finished" after writing code
-- DO NOT invoke when: user is asking about status, asking about plan, or no code changes yet
-
-## Always / Ask / Never
-
-| | Action |
-|---|---|
-| **Always** | Confirm scope with user before launching agents |
-| **Always** | Launch code-reviewer + security-reviewer simultaneously |
-| **Always** | Report gate result clearly: pass or block with reason |
-| **Ask** | When unsure about review scope (file path? git diff? Story?) |
-| **Ask** | When >5 files changed — confirm user wants full review |
-| **Never** | Auto-commit after review passes |
-| **Never** | Skip review and report "looks good" without running agents |
-
-## Process
-
-### Step 1 — Determine scope
-Ask user or infer from context:
-- Story ID available? → get file list from Story
-- Not available? → use `git diff HEAD --name-only` to get recently changed files
-
-### Step 2 — Stack Detection
-Read `CLAUDE.md` at root, find `## Tech Stack` section:
-- Backend contains `.NET` / `C#` → `lang_agent = csharp-reviewer`
-- Backend contains `Node.js` / `TypeScript` → `lang_agent = typescript-reviewer`
-- Backend contains `Python` / `FastAPI` / `Django` → `lang_agent = python-reviewer`
-- Frontend contains `React` → add `typescript-reviewer`
-
-### Step 3 — Launch Parallel Review Gate
-
-Launch agents SIMULTANEOUSLY:
-
-**Agent 1 — `code-reviewer`** (always run):
-> Review [scope]. Read `.tas/checklists/code-review.md`.
-> Focus: acceptance criteria compliance, naming, error handling, test coverage, DRY.
-> Format: Critical / High / Medium / Low with file:line and specific fix.
-
-**Agent 2 — `security-reviewer`** (always run):
-> Security audit [scope]. Read `.claude/rules/common/security.md`.
-> If stack identified, also read `.claude/rules/[stack]/security.md`.
-> Focus: user input handling, SQL injection, hardcoded secrets, auth checks.
-> Format: Critical / High / Medium / Low with file:line and remediation.
-
-**Agent 3 — Language reviewer** (per stack detection):
-> Language-specific review [scope].
-> Read `.claude/rules/[stack]/coding-style.md`, `.claude/rules/[stack]/patterns.md`, `.claude/rules/[stack]/testing.md`.
-> If stack has React: also read `.claude/rules/web/design-quality.md`, `.claude/rules/web/testing.md`, `.claude/rules/web/performance.md`.
-> Format: Critical / High / Medium / Low with file:line.
-
-Wait for ALL agents to complete.
-
-### Step 4 — Gate Decision
-
-**Has Critical/High findings:**
-→ List each finding clearly, STOP, require fix before continuing.
-→ Don't tick Definition of Done.
-
-**Only Medium/Low:**
-→ List suggestions, ask if user wants to fix.
-→ After user confirms: remind to run `/tas-review-code` for full review (hygiene scan + test run).
-
-## Red Flags
-
-- User says "xong" but no files changed in git diff → ask again
-- Review gate skipped because "code is simple" → no exceptions, always run gate
-- Agent returns "No issues found" on large codebase → verify agent read correct files
-
-## Verification
-
-- [ ] `git diff HEAD --name-only` has at least 1 changed file
-- [ ] All agents ran and returned results (no timeout)
-- [ ] Gate decision made clearly: pass or block
-- [ ] If pass: user knows next step is `/tas-review-code`
-
-## Anti-Rationalization
-
-| Rationalization | Counter |
-|---|---|
-| "Code is simple, no need to review" | Review gate always runs — this is safety net, not quality judgment |
-| "Security reviewer will slow down workflow" | Parallel execution — 3 agents run simultaneously, no added time |
-| "User didn't ask about review" | Skill auto-invokes when user says "done" — this is expected behavior |

package/.claude/skills/token-logger/SKILL.md

@@ -1,19 +0,0 @@
----
-name: token-logger
-description: |
-  Invoke when TAS command completes to write AI Usage Log into artifact file.
-  Auto-invoke after /tas-* commands when there's Write/Edit to docs/.
-  DO NOT invoke when user manually edits file or uses non-TAS commands.
-allowed-tools: Read, Edit, Write
----
-
-# Token Logger
-
-Write `## AI Usage Log` into artifact file after TAS command completes.
-
-## Process
-
-1. Identify artifact file: from invocation (if specified) or last `docs/` file Write/Edit in session.
-2. Read `.claude/rules/common/token-logging.md` for format and update rules.
-3. Read artifact file — check if `## AI Usage Log` already exists.
-4. Write or update section. Silent on success — no output to conversation.

package/.tas/checklists/code-review.md

@@ -1,29 +0,0 @@
-# Code Review Checklist
-
-## Architecture
-- [ ] Code aligns with SAD
-- [ ] No ADR violations
-- [ ] Correct layer separation
-
-## Code Quality
-- [ ] Naming follows conventions in CLAUDE.md
-- [ ] No magic numbers/strings
-- [ ] Error handling complete
-- [ ] Meaningful logging
-- [ ] No code duplication
-
-## Security
-- [ ] Input validation
-- [ ] No SQL injection risk
-- [ ] No XSS risk
-- [ ] Sensitive data not logged
-
-## Testing
-- [ ] Unit tests cover happy path
-- [ ] Unit tests cover edge cases
-- [ ] Tests have clear assertions
-
-## Performance
-- [ ] No N+1 queries
-- [ ] Async/await used correctly
-- [ ] Resources disposed properly

package/.tas/checklists/security.md

@@ -1,21 +0,0 @@
-# Security Checklist - .NET Specific
-
-## Authentication & Authorization
-- [ ] JWT validation correct
-- [ ] Role-based authorization
-- [ ] Anti-forgery token for forms
-
-## Data Protection
-- [ ] Connection strings in secrets, not hardcoded
-- [ ] PII data encrypted at rest
-- [ ] HTTPS enforced
-
-## Input Validation
-- [ ] Model validation attributes
-- [ ] Parameterized queries (EF Core)
-- [ ] File upload validation
-
-## CORS & Headers
-- [ ] CORS policy restrictive
-- [ ] Security headers: X-Content-Type-Options, X-Frame-Options
-- [ ] HSTS enabled