@vibe-interviewing/scenarios 0.1.0

package/README.md

@@ -0,0 +1,13 @@
+# @vibe-interviewing/scenarios
+
+Built-in interview scenarios for [vibe-interviewing](https://github.com/cpaczek/vibe-interviewing).
+
+## Available Scenarios
+
+| Scenario                | Difficulty | Time    | Description                                                                      |
+| ----------------------- | ---------- | ------- | -------------------------------------------------------------------------------- |
+| `rate-limiter-boundary` | Medium     | ~30-45m | Off-by-one in express-rate-limit's sliding window lets one extra request through |
+
+## Creating Custom Scenarios
+
+Use the `/create-scenario` skill in Claude Code, or see the [main README](../../README.md#creating-custom-scenarios) for manual setup instructions.

package/index.d.ts

@@ -0,0 +1,2 @@
+/** Returns the absolute path to the scenarios package directory */
+export function getScenariosDir(): string

package/index.js

@@ -0,0 +1,7 @@
+import { dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/** Returns the absolute path to this scenarios package directory */
+export function getScenariosDir() {
+  return dirname(fileURLToPath(import.meta.url))
+}

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@vibe-interviewing/scenarios",
+  "version": "0.1.0",
+  "description": "Built-in interview scenarios for vibe-interviewing",
+  "type": "module",
+  "main": "./index.js",
+  "types": "./index.d.ts",
+  "files": [
+    "index.js",
+    "index.d.ts",
+    "registry.yaml",
+    "rate-limiter-boundary/"
+  ],
+  "scripts": {},
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/cpaczek/vibe-interviewing.git",
+    "directory": "packages/scenarios"
+  }
+}

package/rate-limiter-boundary/scenario.yaml

@@ -0,0 +1,71 @@
+name: rate-limiter-boundary
+description: "Off-by-one in express-rate-limit's sliding window lets one extra request through"
+difficulty: medium
+estimated_time: '30-45m'
+tags:
+  - node
+  - express
+  - middleware
+  - rate-limiting
+  - off-by-one
+
+repo: 'https://github.com/express-rate-limit/express-rate-limit'
+commit: '4e8b18bf972eff2890ed67bd11d8a08a2c6502d5'
+
+setup:
+  - 'npm install --ignore-scripts'
+
+patch:
+  - file: 'source/rate-limit.ts'
+    find: 'if (totalHits > limit) {'
+    replace: 'if (totalHits > limit + 1) {'
+
+briefing: |
+  Hey — we're getting reports from a few customers that our rate limiting isn't working correctly. They're saying they can make one more request than the configured limit before getting a 429.
+
+  For example, if the limit is set to 5, clients can make 6 successful requests before being blocked. It's not a huge deal but it's inconsistent and a couple of enterprise customers have flagged it in their security audits.
+
+  We're using express-rate-limit. I've already cloned the repo and set it up locally — can you dig into the source and figure out what's going on?
+
+  To run the tests: `npx jest --no-coverage`
+
+  The main source is in `source/` and tests are in `test/library/`. Good luck!
+
+ai_rules:
+  role: |
+    You are a senior engineer helping a candidate debug an off-by-one error
+    in the express-rate-limit middleware. Act as a patient but not overly
+    helpful colleague — you're available for questions but you don't
+    volunteer the answer.
+  rules:
+    - 'Never reveal the exact location or nature of the bug directly'
+    - 'If asked, confirm whether the candidate is looking in the right area'
+    - 'Encourage the candidate to write or run tests to reproduce the issue'
+    - 'If the candidate is stuck for more than 10 minutes, suggest looking at where totalHits is compared to the limit'
+    - 'Praise good debugging methodology (reading tests, adding logging, bisecting)'
+  knowledge: |
+    The bug is on line 507 of source/rate-limit.ts. The comparison
+    `if (totalHits > limit)` was changed to `if (totalHits > limit + 1)`.
+    This means the rate limiter allows limit+1 requests instead of limit
+    requests before returning 429. The fix is to change it back to
+    `if (totalHits > limit)`.
+
+solution: |
+  In source/rate-limit.ts line 507, change:
+    `if (totalHits > limit + 1) {`
+  back to:
+    `if (totalHits > limit) {`
+
+  The off-by-one was introduced by adding `+ 1` to the limit comparison,
+  allowing one extra request through before rate limiting kicks in.
+
+evaluation:
+  criteria:
+    - 'Identified the bug location in source/rate-limit.ts'
+    - 'Understood the off-by-one nature of the bug'
+    - 'Used tests or manual testing to reproduce the issue'
+    - 'Applied the correct fix'
+    - 'Used AI effectively as a debugging partner'
+  expected_fix: 'Change `totalHits > limit + 1` back to `totalHits > limit`'
+
+license: MIT

package/registry.yaml

@@ -0,0 +1,7 @@
+scenarios:
+  - name: rate-limiter-boundary
+    description: "Off-by-one in express-rate-limit's sliding window lets one extra request through"
+    difficulty: medium
+    estimated_time: '30-45m'
+    repo: 'https://github.com/express-rate-limit/express-rate-limit'
+    commit: '4e8b18bf972eff2890ed67bd11d8a08a2c6502d5'