@wrongstack/core 0.255.0 → 0.256.0

package/skills/prompt-engineering/SKILL.save.md

@@ -0,0 +1,29 @@
+# Prompt Engineering — WrongStack (Compact)
+
+Designs, critiques, and fixes system prompts, tool descriptions, and skill definitions.
+
+## Rules
+
+1. Static content first, volatile last — cache-friendly prompts cost less.
+2. First sentence of skill description = trigger — keep it specific.
+3. Tool descriptions must say: when to use, key parameters, what it returns.
+4. Remove filler ("Please be helpful", "Sure, I'd be happy to") — wastes tokens.
+5. Always read before edit — agents should read first, then edit.
+
+## WrongStack's 4-layer prompt structure
+
+```
+Layer 1: Identity     — Who you are (static, cacheable)
+Layer 2: Tool usage   — Tools and usage hints (static)
+Layer 3: Environment  — Context, skills, modes (semistatic)
+Layer 4: Volatile     — Session state, errors, mode prompt (dynamic)
+```
+
+## Anti-patterns
+
+| Anti-pattern | Fix |
+|--------------|-----|
+| "Please be helpful" | Remove it |
+| Vague parameter docs | Add concrete examples |
+| Long preamble | Put question first |
+| Ambiguous pronouns | Name the specific thing |

package/skills/react-modern/SKILL.md

@@ -208,4 +208,5 @@ const inputRef = useRef<HTMLInputElement>(null);
 
 - `typescript-strict` — for TypeScript patterns
 - `node-modern` — for React server components with Node.js
-- `bug-hunter` — for React-specific bugs (stale closures, memory leaks)
+- `bug-hunter` — for React-specific bugs (stale closures, memory leaks)
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/react-modern/SKILL.save.md

@@ -0,0 +1,24 @@
+# Modern React (19+) — WrongStack (Compact)
+
+React 19+ patterns: Server Components by default, `use` hook for promises, clean client boundary management.
+
+## Rules
+
+1. Default to Server Components — mark `'use client'` only for interactive code.
+2. Keep the client boundary minimal.
+3. Don't use `useEffect` for data fetching — use Server Components or `use(promise)`.
+4. Don't use `forwardRef` in new code — `ref` is a regular prop in React 19.
+5. Use named exports for components.
+6. Event handlers must have explicit types: `React.MouseEvent<HTMLButtonElement>`.
+
+## Hook guide
+
+| Hook | When to use | Anti-pattern |
+|------|-------------|--------------|
+| `useState` | Local state | Don't sync with props via useEffect |
+| `useTransition` | Non-blocking updates | Don't use for urgent changes |
+| `useDeferredValue` | Deferring expensive rendering | Don't use for simple state |
+| `useCallback` | Stable function refs for deps | Don't memoize everything |
+| `useMemo` | Expensive computations | Don't memoize trivial calcs |
+| `use` | Awaiting promises in render | Only in component render |
+| `useEffect` | Side effects only | Not for data fetching |

package/skills/refactor-planner/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when planning a multi-file refactor, code modernization,
   or technical debt resolution in WrongStack. Triggers: user says "refactor",
   "technical debt", "modernize", "clean up", "restructure", "decompose".
-version: 1.1.0
+version: 1.2.0
 ---
 
 # Refactor Planner — WrongStack
@@ -155,6 +155,12 @@ config.ts → logger.ts → path-resolver.ts
 - [ ] All Phase 1 tasks pass `pnpm test`
 - [ ] No circular deps in `src/core`
 - [ ] `Context` interface < 20 methods
+
+<next_steps>
+1. [Phase 1] Extract `ToolExecutor` interface in core/tool-executor.ts
+2. [Phase 1] Decouple `SessionStore` from Agent in core/session-store.ts
+3. [Phase 2] Break circular dep: Config ↔ Logger in core/config.ts
+</next_steps>
 ```
 
 ## Anti-patterns
@@ -169,4 +175,5 @@ config.ts → logger.ts → path-resolver.ts
 
 - `bug-hunter` — for finding bugs exposed by the refactor
 - `git-flow` — for committing each phase properly
-- `multi-agent` — for parallel analysis of multiple modules
+- `multi-agent` — for parallel analysis of multiple modules
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/refactor-planner/SKILL.save.md

@@ -0,0 +1,26 @@
+# Refactor Planner — WrongStack (Compact)
+
+Analyzes code structure and produces a phased refactoring plan with risk assessment, dependency ordering, and rollback strategy.
+
+## Rules
+
+1. Always build a dependency graph before planning.
+2. Always include a rollback strategy — every refactor can fail.
+3. Never skip Phase 1 (low-risk quick wins) — momentum matters.
+4. Never over-phase — if a task takes <1h, merge it.
+5. Rate each module by: cyclomatic complexity, test coverage, fan-out, public API surface.
+
+## Risk criteria
+
+| Factor | Low | Medium | High |
+|--------|-----|--------|------|
+| Cyclomatic complexity | <10 | 10-20 | >20 |
+| Test coverage | >80% | 50-80% | <50% |
+| Fan-out | <5 | 5-15 | >15 |
+| Public API | unchanged | modified | removed |
+
+## Phase structure
+
+1. **Low Risk / High Payoff**: No behavior change, tests already pass.
+2. **Medium Risk**: Test heavily, may need rollback plan.
+3. **High Risk**: Full regression, integration tests required.

package/skills/research-web/SKILL.md

@@ -340,3 +340,4 @@ Agent: web_search("TypeScript null check best practices") // NO
 - `security-scanner` — for CVE and vulnerability research
 - `prompt-engineering` — for crafting effective search queries
 - `multi-agent` — for fanning out research to subagents
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/research-web/SKILL.save.md

@@ -0,0 +1,25 @@
+# Research Web — WrongStack (Compact)
+
+Conducts current-data web research with discipline: when to search, how to cross-validate, how to inject findings.
+
+## Rules
+
+1. Verify before claiming — never state a version number from training data without a live check.
+2. Two-source minimum: single-source is tentative, two agreeing is signal.
+3. Inject, don't repeat — use context_manager add_note after research.
+4. Respect the stop rule: 2-3 searches + 1-2 fetches per topic.
+5. Match tool to task: web_search for discovery, web_fetch for detail.
+
+## Workflow
+
+1. Quick lookup (1-2 turns): search → fetch → inject
+2. Deep investigation (3-4 turns): search → parallel fetches → cross-reference → inject
+3. Landscape survey: delegate to subagents, one per topic
+
+## Source quality
+
+| Tier | Examples | Trust |
+|------|----------|-------|
+| **Primary** | Official docs, GitHub releases | Cite as fact |
+| **Secondary** | Tech blogs, conference talks | Cite with "according to" |
+| **Tertiary** | Stack Overflow, Reddit | Corroborate before citing |

package/skills/sdd/SKILL.md

@@ -131,4 +131,5 @@ Stage shown in real-time. Pause stops after current iteration completes.
 
 - `refactor-planner` — when the spec reveals a multi-file refactor
 - `bug-hunter` — when a bugfix spec needs a root cause analysis section
-- `multi-agent` — for executing parallel task groups
+- `multi-agent` — for executing parallel task groups
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/sdd/SKILL.save.md

@@ -0,0 +1,19 @@
+# Spec-Driven Development — WrongStack (Compact)
+
+Guides the SDD workflow: spec creation, task decomposition, and execution tracking.
+
+## Rules
+
+1. Always start with a spec — document acceptance criteria before writing code.
+2. Decompose specs into atomic, testable tasks with clear dependencies.
+3. Track progress via structured task graph, not ad-hoc checklists.
+4. Validate implementation against spec acceptance criteria before marking complete.
+5. Update the spec when discovery changes the design.
+
+## Workflow
+
+1. **Spec**: Define acceptance criteria with given/when/then.
+2. **Decompose**: Break into tasks, identify dependencies.
+3. **Execute**: Implement one task at a time, validate against AC.
+4. **Review**: Verify the implementation satisfies the spec.
+5. **Close**: Mark task done, update spec if needed.

package/skills/security-scanner/SKILL.md

@@ -4,7 +4,7 @@ description: |
   Use this skill when scanning code or configuration for security vulnerabilities
   in WrongStack. Triggers: user says "security", "vulnerability", "CVE", "secret",
   "injection", "XSS", "SQL injection", "audit security", "supply chain".
-version: 1.1.0
+version: 1.2.0
 ---
 
 # Security Scanner — WrongStack
@@ -94,7 +94,7 @@ const query = "SELECT * FROM users WHERE id = " + userId;
 
 ```typescript
 // ❌ CRITICAL — hardcoded AWS credentials
-const awsKey = "AKIAIOSFODNN7EXAMPLE";
+const awsKey = "[REDACTED:aws_access_key]";
 
 // ❌ CRITICAL — private key committed
 const pem = "-----BEGIN RSA PRIVATE KEY-----\nMIIE...";
@@ -155,10 +155,17 @@ element.textContent = userInput;
 - [ ] Move secrets to environment variables, add to .gitignore
 - [ ] Use parameterized queries in `src/db/` files
 - [ ] Add rate limiting to `src/api/` routes
+
+<next_steps>
+1. [CRITICAL] `src/config.ts` — remove hardcoded API key, use env var
+2. [HIGH] `src/auth/login.ts` — replace exec() with execFile()
+3. [MEDIUM] `src/api/routes.ts` — add rate limiting middleware
+</next_steps>
 ```
 
 ## Skills in scope
 
 - `bug-hunter` — for general code quality bugs found during security scan
 - `audit-log` — for dependency version audit trails
-- `git-flow` — for committing security patches properly
+- `git-flow` — for committing security patches properly
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/security-scanner/SKILL.save.md

@@ -0,0 +1,23 @@
+# Security Scanner — WrongStack (Compact)
+
+Scans code, configs, and dependencies for security issues. Reports with severity and concrete remediation.
+
+## Rules
+
+1. Always provide remediation — "found X" without "do Y" is useless.
+2. Don't scan `node_modules` — use `npm audit` for supply chain.
+3. Don't flag test fixtures — mock credentials in tests are acceptable.
+4. Always run dependency audit — supply chain is a real attack vector.
+5. Flag config issues (TLS disabled, HTTP in production) as CRITICAL.
+
+## Critical patterns
+
+| Pattern | Severity |
+|---------|----------|
+| Hardcoded GitHub token `ghp_[a-zA-Z0-9]{36}` | CRITICAL |
+| Hardcoded AWS key `[A-Z0-9]{20}` | CRITICAL |
+| Private key PEM `-----BEGIN.*PRIVATE KEY-----` | CRITICAL |
+| `innerHTML = x` — use `textContent` | HIGH |
+| `exec(\`cmd ${input}\`)` — use `execFile` with args | HIGH |
+| SQL concatenation — use parameterized queries | CRITICAL |
+| JWT in code `eyJ[a-zA-Z0-9_-]+` | HIGH |

package/skills/skill-creator/SKILL.md

@@ -125,4 +125,5 @@ Before writing the file, verify:
 ## Skills in scope
 
 - `prompt-engineering` — for crafting the skill description and prompt text
-- `git-flow` — for committing the new skill file
+- `git-flow` — for committing the new skill file
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/skill-creator/SKILL.save.md

@@ -0,0 +1,20 @@
+# Skill Creator — WrongStack (Compact)
+
+Guides the creation of new WrongStack skills. A skill is a Markdown file with YAML frontmatter.
+
+## Rules
+
+1. First sentence of `description` = trigger — the only thing the skill loader matches on.
+2. Name must be kebab-case: `my-skill`, `docker-deploy` — lowercase, hyphens only.
+3. Skills live in `.wrongstack/skills/<name>/SKILL.md` (project level) or `packages/core/skills/<name>/SKILL.md` (bundled).
+4. After the trigger sentence, add `Triggers: user says "X", "Y", "Z".`
+5. Content must be actionable — rules, patterns, anti-patterns.
+6. End with "Skills in scope" listing related skills for delegation.
+
+## Workflow
+
+1. Ask the name — suggest kebab-case, validate format
+2. Ask the trigger — "What situation should activate this skill?"
+3. Ask the coverage — what rules, patterns, workflows?
+4. Generate the SKILL.md — write to `.wrongstack/skills/<name>/SKILL.md`
+5. Confirm — show the path

package/skills/tech-stack/SKILL.md

@@ -1,17 +1,10 @@
 ---
 name: tech-stack
 description: |
-  Use this skill when choosing, installing, or recommending packages, libraries,
-  frameworks, or tooling for ANY programming language — decisions that involve
-  a version number or a technology name. This skill detects the ecosystem,
-  verifies latest versions against the correct registry, blocks dead/obsolete
-  choices, and intervenes when the LLM hallucinates version numbers or
-  suggests 5+ year-old technology.
-  Triggers: user says "install", "package", "dependency", "upgrade",
-  "latest version", "add package", "pip install", "cargo add", "go get",
-  "gem install", "composer require", "nuget", "what version",
-  "which library", "tech stack", "choose framework".
-version: 2.0.0
+  Use this skill when validating package versions, checking for outdated dependencies,
+  or evaluating third-party libraries in WrongStack. Triggers: user says "dependency",
+  "package version", "outdated", "npm audit", "deprecated package", "tech stack".
+version: 1.2.0
 ---
 
 # Tech Stack Validator — WrongStack (Language-Agnostic)
@@ -61,9 +54,8 @@ ecosystem. Runs as a single-shot delegate — fast, read-only, fire-and-forget.
    - NuGet: deprecated flag, `listed: false`
 
 5. **Reject prehistoric technology.** Any package/library/pattern that was
-   superseded ≥5 years ago is automatically rejected. Use the per-ecosystem
-   reject lists below. If the package is NOT in the baked-in list, fall back
-   to web search: `"is <package> deprecated <ecosystem> <current_year>"`.
+   superseded ≥5 years ago is automatically rejected. Use the per-ecosystem built-in
+   preference map below before greenlighting any third-party dependency.
 
 6. **Prefer built-in over third-party.** Every modern language runtime ships
    standard library that obsoletes packages. Check the per-ecosystem built-in
@@ -73,77 +65,6 @@ ecosystem. Runs as a single-shot delegate — fast, read-only, fire-and-forget.
    complete in 1–2 iterations. Detect → search registry → verify → report.
    Do not recursively analyze transitive dependencies.
 
-## Patterns
-
-### Do
-
-```
-User: "Add requests to the project"
-Agent: [detects pyproject.toml → Python ecosystem]
-✅ requests 2.32.4 (latest stable as of 2026-06)
-Verified via PyPI. requests is the de-facto HTTP library for Python.
-**Install**: `pip install requests>=2.32`
-```
-
-```
-User: "Cargo add serde"
-Agent: [detects Cargo.toml → Rust ecosystem]
-✅ serde 1.0.217 (latest stable)
-Verified via crates.io. serde is the standard serialization framework for Rust.
-**Install**: `cargo add serde@1`
-```
-
-```
-User: "Add urllib2 for HTTP calls in our Python project"
-Agent: ❌ REJECTED
-"This isn't code, this is 16-year-old technology."
-urllib2 was part of Python 2.x (released 2000). Python 3 unified everything
-into `urllib.request` (stdlib) and `requests` (third-party, the community
-standard). No package needed — or use `requests` for a better API.
-→ Use: `import requests` or `from urllib.request import urlopen`
-```
-
-```
-User: "Add axios for API calls"
-Agent: ❌ REJECTED
-"This isn't code, this is 12-year-old technology."
-axios was released in 2014. Node.js 18+ (2022) includes native fetch with
-AbortSignal.timeout(), streaming, and FormData. No package needed.
-→ Use: `const res = await fetch(url, { signal: AbortSignal.timeout(5000) })`
-```
-
-### Don't
-
-```
-❌ Trusting the LLM's stale training data
-Agent: "Use React 18.3.1 — it's the latest stable."
-→ WRONG. React 19 has been stable since Dec 2024. Always check the registry.
-
-❌ Assuming npm for everything
-Agent: "pnpm add django" — Django is a Python package. Ecosystem detection
-must happen before any install command is suggested.
-
-❌ Accepting a package that doesn't exist
-Agent: "Install @anthropic/sdk version 2.0.0" — verify against the correct registry first.
-
-❌ Suggesting moment.js without challenge
-Agent: "Use moment for date formatting" — moment is legacy. Suggest date-fns or Temporal.
-```
-
-## Workflow
-
-```
-0. DETECT    — What ecosystem is this? (explicit hint → project files → ask)
-1. LOOKUP    — Find registry adapter for the ecosystem (see map below)
-2. VERIFY    — Fetch {registry.host}{registry.path/{pkg}} → extract {registry.field}
-3. AUDIT      — Age check (>2 years no release?), prehistoric check (in reject list?),
-                built-in check (stdlib alternative?), dead signals (deprecated/yanked?)
-4. REPORT    — APPROVED (with latest version + install command)
-              or REJECTED (with replacement + migration step + evidence)
-              Use the exact phrase "This isn't code, this is X-year-old technology"
-              when rejecting on age/prehistoric grounds.
-```
-
 ## Ecosystem Registry Map
 
 The central dispatch table. When verifying a package, use the adapter for the
@@ -161,147 +82,7 @@ detected ecosystem:
 | `elixir` | Elixir | `hex.pm` | `/api/packages/{pkg}` | `releases[0].version` | mix | `{:pkg, "~> {major}.{minor}"}` (add to mix.exs) |
 | `jvm` | Java/JVM | `search.maven.org` | `/solrsearch/select?q=g:{group}+AND+a:{artifact}&rows=1&wt=json` | `response.docs[0].latestVersion` | maven/gradle | `implementation '{group}:{artifact}:{version}'` |
 
-**For registry endpoints that return complex nested structures** (NuGet, Packagist,
-Maven), fetch the endpoint, parse the JSON, then navigate to the version field
-as specified. If the API shape has changed, fall back to web search.
-
-**For ecosystems NOT in this table**, detect the language, then web-search
-`"<language> package registry API latest version"` to discover the endpoint.
-
-### Version checking — fallback chain
-
-When the registry adapter is insufficient, try in this order:
-1. **Registry API** (primary): fetch per the Ecosystem Registry Map above
-2. **GitHub releases**: `fetch('https://api.github.com/repos/<owner>/<repo>/releases/latest')`
-3. **Web search**: `"<package> latest version <ecosystem> <current_year>"`
-4. **Project homepage**: fetch the package's documented "Install" page
-
-## Per-Ecosystem Reject Lists
-
-### JavaScript / TypeScript
-
-| Prehistoric | Age | Replacement |
-|-------------|-----|-------------|
-| `axios`, `node-fetch`, `got`, `request` | 10-13yr | native `fetch` (Node 18+, 2022) |
-| `moment` | 14yr | `date-fns`, `luxon`, or `Temporal` |
-| `left-pad` | 10yr | native `String.prototype.padStart` |
-| `crypto-js` | 12yr | native `Web Crypto` / `node:crypto` |
-| `jQuery` (new projects) | 18yr | vanilla DOM / React / Vue / Svelte |
-| `Backbone`, `Ember` | 14-15yr | React / Vue / Svelte |
-| `Gulp`, `Grunt` | 12-13yr | `tsup`, `esbuild`, `vite` |
-| `Bower` | 13yr | npm / pnpm |
-| `CoffeeScript` | 16yr | TypeScript |
-| `Flow` | 10yr | TypeScript |
-| `Bluebird` | 12yr | native Promises |
-| `underscore` | 16yr | `lodash` or native ES2020+ |
-| `classnames` | 10yr | `clsx` or native `classList` |
-
-### Python
-
-| Prehistoric | Age | Replacement |
-|-------------|-----|-------------|
-| `urllib2`, `httplib` | 20+yr | `requests` or `httpx` |
-| `distutils`, `setup.py` (new projects) | 20+yr | `pyproject.toml` + `hatch`/`poetry`/`setuptools` |
-| `os.path` for path manipulation | — | `pathlib` (stdlib since 3.4) |
-| `mock` (third-party) | 12yr | `unittest.mock` (stdlib since 3.3) |
-| `pathlib2` | 8yr | `pathlib` (stdlib since 3.4) |
-| `python-dateutil` (basic usage) | — | `datetime` + `zoneinfo` (stdlib 3.9+) |
-| `typing` (backport) | — | stdlib `typing` (3.5+) |
-| `2to3` tooling | 16yr | Python 3 is the only supported version |
-| `futures` (backport) | — | `concurrent.futures` (stdlib 3.2+) |
-
-### Rust
-
-| Prehistoric | Age | Replacement |
-|-------------|-----|-------------|
-| `lazy_static` | 8yr | `std::sync::LazyLock` (1.80+, 2024) or `once_cell` |
-| `try!` macro | 10yr | `?` operator (1.13+, 2016) |
-| `error-chain` | 8yr | `thiserror` + `anyhow` |
-| `rustc-serialize` | 10yr | `serde` |
-
-### Go
-
-| Prehistoric | Age | Replacement |
-|-------------|-----|-------------|
-| `dep` (tool) | 8yr | Go modules (`go mod`, 1.11+, 2018) |
-| `ioutil` (stdlib, deprecated) | — | `io` + `os` packages (1.16+, 2021) |
-| `gopath` dependency management | 10+yr | Go modules |
-| `gopkg.in/yaml.v2` (for new code) | — | `gopkg.in/yaml.v3` or `encoding/json` |
-| `glide`, `godep` | 9-10yr | Go modules |
-
-### Ruby
-
-| Prehistoric | Age | Replacement |
-|-------------|-----|-------------|
-| `therubyracer` | 12yr | `mini_racer` or Node.js-based execjs |
-| `json` gem (explicit) | — | stdlib `json` (bundled since 2.3) |
-| `rails` < 6.x (new projects) | 7+yr | Rails 7.x / 8.x |
-| `protected_attributes` | 10yr | `strong_parameters` (Rails 4+) |
-
-### .NET
-
-| Prehistoric | Age | Replacement |
-|-------------|-----|-------------|
-| `System.Web` / WebForms | 20+yr | ASP.NET Core |
-| `Windows Forms` (new projects) | 20+yr | WPF / MAUI / Avalonia |
-| ` packages.config ` | 10+yr | `PackageReference` in csproj |
-| `Newtonsoft.Json` (for new System.Text.Json-capable projects) | — | `System.Text.Json` (.NET Core 3+) |
-
-### PHP
-
-| Prehistoric | Age | Replacement |
-|-------------|-----|-------------|
-| `mysql_*` functions | 13yr | PDO or mysqli |
-| `mcrypt` | 10yr | `openssl` / `sodium` (PHP 7.2+) |
-| `PEAR` | 15+yr | Composer |
-| `PHPUnit` < 9.x | — | PHPUnit 10.x / 11.x |
-
-## Built-In Preference Map
-
-Before approving any third-party package, check if the language's standard
-library already solves this. These are the most common cases where a package
-is unnecessary:
-
-### JavaScript / TypeScript (Node 22+)
-- `node:test` over `jest`/`mocha` (new projects)
-- `node:sqlite` over `better-sqlite3` (Node 22.5+)
-- `fetch`, `WebSocket`, `Web Crypto`, `AbortController`, `EventTarget` — all native
-- `node:fs/promises` over `fs-extra`
-- `URL` / `URLSearchParams` over `qs` / `query-string`
-
-### Python (3.12+)
-- `pathlib` over `os.path` / `glob`
-- `unittest` + `pytest` (pytest *is* still preferred, but unittest exists)
-- `dataclasses` over `attrs` (simple cases)
-- `tomllib` over `toml` (3.11+)
-- `zoneinfo` over `pytz` (3.9+)
-- `graphlib` over custom topological sort (3.9+)
-- `importlib.resources` over `pkg_resources`
-
-### Rust (stable)
-- `std::sync::LazyLock` over `lazy_static` / `once_cell` (1.80+)
-- `std::sync::OnceLock` over `once_cell::sync::OnceCell`
-- `std::cell::OnceCell` over `once_cell::unsync::OnceCell`
-- `std::net` over `reqwest` (simple HTTP client cases)
-
-### Go (1.22+)
-- `net/http` over third-party HTTP routers (for simple APIs)
-- `log/slog` over `logrus` / `zap` (1.21+)
-- `slices` / `maps` packages over `golang.org/x/exp` backports (1.21+)
-- `cmp` / `math/rand/v2` / `unique` — all stdlib additions
-
-## Dead Package Criteria
-
-| Signal | Threshold | Action |
-|--------|-----------|--------|
-| No release | >2 years | Flag + check for replacement |
-| No release + critical CVEs | >1 year | REJECT automatically |
-| Deprecated/yanked on registry | Any | REJECT + suggest replacement |
-| Repository archived | Any | REJECT + suggest replacement |
-| Low adoption | <500 weekly downloads (npm) / <100 stars + no recent commits | WARN + suggest alternative |
-| Last commit | >3 years ago, no response to issues | WARN + flag as unmaintained |
-
-## Output Format
+## Output format
 
 ```
 ### Tech Stack Validation — <package>
@@ -322,6 +103,11 @@ When REJECTED:
 When APPROVED:
 **Install**: `<ecosystem install command>`
 **Note**: <any caveats about the version, semver range, or compatibility>
+
+<next_steps>
+1. [APPROVED/REJECTED] Package decision with rationale
+2. [If rejected] Migration step to the recommended alternative
+</next_steps>
 ```
 
 ## Skills in scope
@@ -331,3 +117,4 @@ When APPROVED:
 - `typescript-strict` — for TypeScript version alignment
 - `security-scanner` — for packages with known CVEs
 - `docker-deploy` — for base image version pinning
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/tech-stack/SKILL.save.md

@@ -0,0 +1,25 @@
+# Tech Stack Validator — WrongStack (Compact)
+
+Validates package/library/framework choices before they are committed.
+
+## Rules
+
+1. Detect the ecosystem first (package.json → JS, pyproject.toml → Python, Cargo.toml → Rust, etc.).
+2. Verify existence — consult the ecosystem's registry endpoint.
+3. Check the latest version from the registry (never trust training data versions).
+4. Reject dead packages — no release in >2 years + unresolved critical issues.
+5. Reject prehistoric technology — superseded ≥5 years ago.
+6. Prefer built-in over third-party — many modern runtimes obsolete packages.
+7. Single-shot budget: detect → search registry → verify → report.
+
+## Ecosystem registry map
+
+| Language | Registry | Package Manager |
+|----------|----------|-----------------|
+| JavaScript/TS | registry.npmjs.org | pnpm/npm/yarn |
+| Python | pypi.org | pip/poetry |
+| Rust | crates.io | cargo |
+| Go | proxy.golang.org | go |
+| Ruby | rubygems.org | bundler |
+| .NET | api.nuget.org | dotnet |
+| PHP | repo.packagist.org | composer |

package/skills/testing/SKILL.md

@@ -168,3 +168,4 @@ coverageThreshold: {
 - `typescript-strict` — for type-safe test assertions
 - `node-modern` — for async/test patterns with AbortSignal
 - `git-flow` — for committing tests with the code they test
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/testing/SKILL.save.md

@@ -0,0 +1,22 @@
+# Testing — WrongStack (Compact)
+
+Writes and reviews tests for WrongStack TypeScript code (vitest, pnpm workspaces).
+
+## Rules
+
+1. Co-locate tests: `src/foo.ts` → `tests/foo.test.ts` (same package).
+2. Always test public API surfaces — don't test internals.
+3. Use `vi.mock()` for external deps; never mock internal modules.
+4. Every async test needs a timeout: `test(..., { timeout: 5000 })`.
+5. Mock time with `vi.useFakeTimers()` for debounce/throttle tests.
+6. Coverage gate: new code must have ≥70% coverage.
+7. Don't commit test-only deps — test deps go in `devDependencies`.
+8. Tests must be isolated — each test cleans up its mocks/state.
+
+## Key patterns
+
+- **Unit**: Pure logic, parsing, transformations.
+- **Integration**: API calls, file I/O, tool chains.
+- **E2E**: Full command flow, CLI smoke tests.
+- Mock `node:fs/promises` with `vi.mock()`, use `vi.mocked(fs.readFile).mockResolvedValue()`.
+- Use `afterEach(() => { vi.restoreAllMocks(); })` for isolation.

package/skills/typescript-strict/SKILL.md

@@ -236,4 +236,5 @@ console.log(name!.toUpperCase());
 
 - `node-modern` — for TypeScript + ESM patterns
 - `react-modern` — for React + TypeScript patterns
-- `bug-hunter` — for type-related bugs like unsafe casts
+- `bug-hunter` — for type-related bugs like unsafe casts
+- `output-standards` — for standardized `<next_steps>` formatting

package/skills/typescript-strict/SKILL.save.md

@@ -0,0 +1,19 @@
+# TypeScript Strict Mode — WrongStack (Compact)
+
+Strict TypeScript patterns for WrongStack: exhaustive switch, branded types, discriminated unions, and `noUncheckedIndexedAccess`.
+
+## Rules
+
+1. Never silence errors with `as any` — use `as unknown as T` only at trust boundaries with a comment.
+2. Don't use `!` non-null assertion — silence the type checker without explanation.
+3. Always annotate return types on exported functions.
+4. Use `Promise<unknown>` or generics instead of `Promise<any>`.
+5. Be specific with types — `Function` and `Object` are too broad.
+6. Enable `noUncheckedIndexedAccess` — always handle the `undefined` case.
+
+## Key patterns
+
+- **Exhaustive switch**: Create `assertNever(x: never)` and use it in the `default` branch of every switch on a union.
+- **Branded types**: `type UserId = string & { readonly __brand: 'UserId' }` for invariant string types.
+- **Discriminated unions**: Prefer `{ status: 'success'; data: T } | { status: 'error'; error: E }` over optional fields.
+- **noUncheckedIndexedAccess**: Use `items.at(0)` or `if (items[0] !== undefined)` — never assume array access succeeds.