cc-codeconductor 0.4.3 → 1.0.0

package/presets/cursor/skills/astro/SKILL.md

@@ -0,0 +1,322 @@
+---
+id: astro
+version: 1.0.0
+name: Astro
+description: >
+  Provides expert knowledge for building Astro 5+ sites with Islands Architecture, Content Collections, TypeScript, and performance-first rendering strategies.
+
+user-invokable: true
+license: MIT
+metadata:
+  author: lgzarturo
+  category: frontend
+
+compatibility:
+  tools: [claude, codex, gemini, agy, opencode]
+  stacks:
+    languages: []
+    frameworks: []
+
+risk:
+  level: low
+  can_execute_shell: false
+  can_modify_files: true
+  requires_network: false
+
+inputs: []
+
+outputs: []
+
+quality:
+  reviewed_by: codeconductor-core
+  version: 0.1.0
+paths:
+  - "**/*.astro"
+  - "**/astro.config.*"
+---
+
+
+
+# Astro
+
+## Islands Architecture
+
+Astro renders everything to static HTML by default. JavaScript ships only for
+components that explicitly opt in — these are called Islands.
+
+### Hydration Directives
+
+| Directive | When JS loads | Use case |
+|-----------|--------------|----------|
+| `client:load` | On page load | Interactive above-the-fold UI |
+| `client:idle` | When browser is idle | Non-critical interactive widgets |
+| `client:visible` | When element enters viewport | Below-the-fold islands |
+| `client:media` | When CSS media query matches | Responsive interactive components |
+| `client:only` | Client-only, no SSR | Components that require the DOM (e.g., charting libs) |
+
+```astro
+---
+import Counter from '../components/Counter.tsx';
+import HeavyChart from '../components/HeavyChart.tsx';
+import MobileNav from '../components/MobileNav.tsx';
+---
+
+<!-- Hydrates immediately — user interacts right away -->
+<Counter client:load />
+
+<!-- Hydrates when scrolled into view — saves initial JS -->
+<HeavyChart client:visible />
+
+<!-- Only on mobile, only when query matches -->
+<MobileNav client:media="(max-width: 768px)" />
+```
+
+Rules:
+
+- Default to no hydration directive — most UI does not need JavaScript
+- `client:load` is the most expensive directive; use it sparingly
+- `client:only` skips server rendering entirely — the component receives no
+  props from the server; pass all data via props or fetch inside the component
+- Do not use `client:load` for components that could use `client:visible`
+
+### Framework Components Inside Astro
+
+```astro
+---
+import ReactButton from './Button.tsx';   // React island
+import VueWidget from './Widget.vue';     // Vue island
+---
+
+<!-- Both can coexist on the same page -->
+<ReactButton client:idle label="Click me" />
+<VueWidget client:visible />
+```
+
+Each framework ships its own runtime only when at least one island of that
+framework is on the page.
+
+## Content Collections
+
+Content Collections provide type-safe access to Markdown, MDX, and data files.
+Define schemas in `src/content/config.ts`.
+
+### Schema Definition
+
+```typescript
+// src/content/config.ts
+import { defineCollection, z } from 'astro:content';
+
+const blog = defineCollection({
+  type: 'content',   // .md or .mdx files
+  schema: z.object({
+    title: z.string(),
+    description: z.string(),
+    pubDate: z.coerce.date(),
+    updatedDate: z.coerce.date().optional(),
+    author: z.string().default('Anonymous'),
+    tags: z.array(z.string()).default([]),
+    draft: z.boolean().default(false),
+    image: z.object({
+      src: z.string(),
+      alt: z.string(),
+    }).optional(),
+  }),
+});
+
+const docs = defineCollection({
+  type: 'content',
+  schema: z.object({
+    title: z.string(),
+    order: z.number(),
+    section: z.enum(['guide', 'reference', 'tutorial']),
+  }),
+});
+
+export const collections = { blog, docs };
+```
+
+### Querying Collections
+
+```astro
+---
+import { getCollection, getEntry } from 'astro:content';
+
+// All published posts, sorted by date
+const posts = (await getCollection('blog', ({ data }) => !data.draft))
+  .sort((a, b) => b.data.pubDate.valueOf() - a.data.pubDate.valueOf());
+
+// Single entry by slug
+const post = await getEntry('blog', 'my-first-post');
+const { Content } = await post.render();
+---
+
+{posts.map(post => (
+  <article>
+    <h2><a href={`/blog/${post.slug}`}>{post.data.title}</a></h2>
+    <time>{post.data.pubDate.toLocaleDateString()}</time>
+  </article>
+))}
+```
+
+### Dynamic Routes from Collections
+
+```astro
+---
+// src/pages/blog/[slug].astro
+import { getCollection } from 'astro:content';
+
+export async function getStaticPaths() {
+  const posts = await getCollection('blog');
+  return posts.map(post => ({
+    params: { slug: post.slug },
+    props: { post },
+  }));
+}
+
+const { post } = Astro.props;
+const { Content, headings } = await post.render();
+---
+
+<article>
+  <h1>{post.data.title}</h1>
+  <Content />
+</article>
+```
+
+## Rendering Strategies
+
+### SSG (Static Site Generation) — default
+
+Every page is pre-rendered at build time. Best for content that does not change
+per request.
+
+```javascript
+// astro.config.mjs — no output config needed; SSG is the default
+export default defineConfig({
+  site: 'https://example.com',
+});
+```
+
+### SSR (Server-Side Rendering)
+
+Renders pages on each request. Required for: authenticated routes, personalized
+content, live data.
+
+```javascript
+// astro.config.mjs
+import node from '@astrojs/node';
+
+export default defineConfig({
+  output: 'server',
+  adapter: node({ mode: 'standalone' }),
+});
+```
+
+### Hybrid Mode
+
+Mix SSG and SSR on a per-page basis. Most pages are static; specific routes opt
+into server rendering.
+
+```javascript
+// astro.config.mjs
+export default defineConfig({
+  output: 'hybrid',
+  adapter: node({ mode: 'standalone' }),
+});
+```
+
+```astro
+---
+// src/pages/dashboard.astro — this page is server-rendered
+export const prerender = false;
+
+// src/pages/about.astro — this page is statically generated (hybrid default)
+export const prerender = true;
+---
+```
+
+Use hybrid mode when: most content is static but a few routes need auth or
+live data. Do not make everything `output: 'server'` — you lose the performance
+benefits of static generation.
+
+## Image Optimization
+
+Use the built-in `<Image>` and `<Picture>` components. Never use raw `<img>`
+for local assets — you lose automatic optimization.
+
+```astro
+---
+import { Image, Picture } from 'astro:assets';
+import heroImage from '../assets/hero.png';
+---
+
+<!-- Optimized single image -->
+<Image
+  src={heroImage}
+  alt="Hero illustration"
+  width={800}
+  height={600}
+  format="webp"
+  quality={80}
+/>
+
+<!-- Responsive with multiple formats -->
+<Picture
+  src={heroImage}
+  formats={['avif', 'webp']}
+  alt="Hero illustration"
+  widths={[400, 800, 1200]}
+  sizes="(max-width: 800px) 100vw, 800px"
+/>
+```
+
+Rules:
+
+- Always provide `alt` — empty string is acceptable only for decorative images
+- Prefer `avif` + `webp` fallback for best compression
+- Use `widths` + `sizes` on above-the-fold images to serve the right size per
+  viewport
+- Remote images require explicit `width` and `height` to prevent layout shift
+
+## Project Structure
+
+```text
+src/
+  assets/          — images and static assets processed by Astro
+  components/      — .astro components (and framework islands)
+  content/
+    blog/          — .md and .mdx files
+    config.ts      — collection schemas
+  layouts/         — page shell layouts
+  pages/           — file-based routing; every file is a route
+  styles/          — global CSS
+astro.config.mjs
+tsconfig.json
+```
+
+Colocation rule: put framework island components (`.tsx`, `.vue`) in
+`src/components/`. Do not scatter them in `src/pages/`.
+
+## TypeScript Conventions
+
+```json
+// tsconfig.json — use the strict Astro preset
+{
+  "extends": "astro/tsconfigs/strict"
+}
+```
+
+```astro
+---
+// Type props explicitly in the frontmatter
+interface Props {
+  title: string;
+  description?: string;
+  tags: string[];
+}
+
+const { title, description = '', tags } = Astro.props;
+---
+```
+
+Astro infers prop types from `interface Props` automatically. Do not use `any`.

package/presets/cursor/skills/auth-token-inspector/SKILL.md

@@ -0,0 +1,33 @@
+---
+id: auth-token-inspector
+version: 1.0.0
+name: Auth Token Inspector
+description: >
+  Audits token storage mechanisms to prevent XSS-based JWT theft.
+user-invokable: true
+license: MIT
+metadata:
+  author: lgzarturo
+  category: security
+compatibility:
+  tools: [claude, codex, gemini, agy, opencode]
+  stacks:
+    languages: [typescript, javascript, python, kotlin, java, php]
+paths:
+  - "**/*.{ts,tsx,py,kt,php}"
+---
+# Auth Token Inspector
+
+## Core Principles
+
+1. **Secure Storage**: JWTs or session tokens must NOT be stored in `localStorage` or `sessionStorage` due to vulnerability to Cross-Site Scripting (XSS).
+2. **HttpOnly Cookies**: Deliver tokens via `HttpOnly`, `Secure`, and `SameSite=Strict` (or `Lax`) cookies to protect them from client-side JS access.
+3. **Short Expiration**: Ensure access tokens have short expiration times, and implement secure, rotation-enabled refresh tokens stored in cookies.
+
+## Storage Comparison
+
+| Storage Mode | Vulnerable to XSS | Vulnerable to CSRF | Recommended |
+| :--- | :--- | :--- | :--- |
+| **localStorage** | Yes (High Risk) | No | **NO** |
+| **sessionStorage** | Yes (High Risk) | No | **NO** |
+| **HttpOnly Cookie** | No (Secure) | Yes (Mitigated via SameSite/Tokens) | **YES** |

package/presets/cursor/skills/code-review/SKILL.md

@@ -0,0 +1,208 @@
+---
+id: code-review
+version: 1.0.0
+name: Code Review
+description: >
+  Provides a structured framework for conducting thorough code reviews covering correctness, security, architecture alignment, performance, and technical debt.
+
+user-invokable: true
+license: MIT
+metadata:
+  author: lgzarturo
+  category: review
+
+compatibility:
+  tools: [claude, codex, gemini, agy, opencode]
+  stacks:
+    languages: []
+    frameworks: []
+
+risk:
+  level: low
+  can_execute_shell: false
+  can_modify_files: true
+  requires_network: false
+
+inputs: []
+
+outputs: []
+
+quality:
+  reviewed_by: codeconductor-core
+  version: 0.1.0
+---
+
+
+
+# Code Review
+
+## Review Axes
+
+Every finding must reference exactly one axis. This prevents vague feedback and
+makes it actionable.
+
+| Axis | What to check |
+|------|--------------|
+| **Correctness** | Does the logic handle all cases in the acceptance criteria? |
+| **Security** | Injection vectors, secret exposure, auth bypasses, insecure defaults |
+| **Architecture** | Does the code follow existing patterns and module boundaries? |
+| **Performance** | N+1 queries, unnecessary allocations, blocking I/O in hot paths |
+| **Error handling** | Are failure cases handled explicitly and safely? |
+| **Test coverage** | Do tests verify the acceptance criteria, not just happy paths? |
+| **Scope** | Are there changes outside the stated task boundary? |
+| **Technical debt** | Does the implementation introduce debt without acknowledging it? |
+
+## Finding Categories
+
+### CRITICAL — must be resolved before merge
+
+- Logic failures that violate acceptance criteria
+- Security vulnerabilities (injection, auth bypass, secret exposure)
+- Data loss or corruption risk
+- Breaking changes to public API or shared contracts
+- Missing error handling that causes silent failures
+
+### WARNING — should be resolved before merge
+
+- Missing edge case coverage in tests
+- Scope creep (changes outside the task boundary)
+- Pattern inconsistency that will confuse future maintainers
+- Performance issue that will degrade under load
+- Missing input validation at system boundaries
+
+### SUGGESTION — optional improvement
+
+- Naming clarity improvements
+- Extracting a reusable abstraction
+- Test readability
+- Documentation gaps on non-obvious behavior
+
+## Review Report Format
+
+```markdown
+## Review Report
+
+**Task**: [objective from task card]
+**Verdict**: [approved | approved with warnings | blocked]
+
+---
+
+### CRITICAL
+
+- [ ] [C1] `path/to/file:line` — [description]
+  Axis: [axis] | Evidence: `[quoted code]` | Required action: [what must change]
+
+_(none)_ if no critical findings
+
+### WARNING
+
+- [ ] [W1] `path/to/file:line` — [description]
+  Axis: [axis] | Recommended action: [what should change]
+
+_(none)_ if no warning findings
+
+### SUGGESTION
+
+- [ ] [S1] — [description] | Rationale: [brief reason]
+
+_(none)_ if no suggestions
+
+### Summary
+
+- Critical: [count] | Warning: [count] | Suggestion: [count]
+- **Verdict justification**: [one sentence]
+```
+
+**Verdict rules:**
+
+- `blocked` — any CRITICAL finding present
+- `approved with warnings` — no CRITICAL, at least one WARNING
+- `approved` — no CRITICAL, no WARNING
+
+## What to Check — by Axis
+
+### Correctness
+
+- Does every acceptance criterion have a corresponding code path?
+- Are null/empty/zero values handled explicitly?
+- Are boundary conditions checked (off-by-one, empty collections, max values)?
+- Do conditional branches cover all cases (exhaustive when/switch)?
+
+### Security
+
+```text
+Injection: SQL, command, LDAP, XML — is input sanitized or parameterized?
+Auth: is the endpoint protected? are role checks correct?
+Secrets: no hardcoded credentials, tokens, or keys in source
+Headers: are security headers set (CSP, HSTS, X-Frame-Options)?
+CORS: is the origin whitelist explicit, not wildcard?
+Dependencies: are new dependencies from trusted sources?
+```
+
+### Performance
+
+```text
+N+1 queries: does a loop call the database per iteration?
+Eager loading: are JOINs or includes used where needed?
+Pagination: are all list endpoints paginated?
+Caching: is expensive computation cached at an appropriate layer?
+Index: do new query filters have corresponding DB indexes?
+```
+
+### Error Handling
+
+```text
+Are exceptions caught at the right layer (not swallowed silently)?
+Is the error response format consistent with the rest of the API?
+Is the original exception logged before translating to a user-facing error?
+Are transient failures retried with backoff, or propagated immediately?
+```
+
+## What NOT to Flag
+
+**Personal style preferences.** If the code follows the project's established
+conventions, do not flag it because you would have written it differently.
+
+**Trivial naming.** Variable names are a SUGGESTION at most, never a WARNING.
+Do not block a PR over naming unless the name is genuinely misleading.
+
+**Tests for trivial code.** Do not demand tests for getters, setters, or data
+class construction. Test behavior, not boilerplate.
+
+**Refactors not in scope.** If you notice an improvement opportunity outside
+the task boundary, log it as a SUGGESTION. Do not block the PR for work that
+was not requested.
+
+**Framework defaults.** Do not second-guess framework conventions (Spring
+dependency injection, Next.js file-based routing). Trust the framework.
+
+## Exact Diff Recommendations
+
+When a finding requires a code change, provide the exact replacement:
+
+```text
+# Current code (path/to/file:42)
+val user = userRepository.findById(id)
+return user.name   // NPE if not found
+
+# Recommended fix
+val user = userRepository.findById(id)
+  ?: throw NotFoundException("User $id not found")
+return user.name
+```
+
+Vague instructions ("handle the null case") force the author to guess your
+intent. Exact diffs remove ambiguity and speed up the review cycle.
+
+## Prioritization Order
+
+When multiple findings exist, address them in this order:
+
+1. Security — security issues can silently compromise users or data
+2. Correctness — broken behavior defeats the purpose of the change
+3. Error handling — silent failures are hard to debug in production
+4. Test coverage — gaps mean regressions will be invisible
+5. Performance — degrade gradually; fix before it causes incidents
+6. Architecture — inconsistency compounds over time
+7. Technical debt — acknowledge and track; do not always block for it
+8. Suggestions — apply at author's discretion

package/presets/cursor/skills/conductor-setup/SKILL.md

@@ -0,0 +1,127 @@
+---
+name: conductor-setup
+description: Configure a Rails project to work with Conductor (parallel coding agents)
+allowed-tools: Bash(chmod *), Bash(bundle *), Bash(npm *), Bash(script/server)
+context: fork
+risk: unknown
+source: community
+metadata:
+  author: Shpigford
+  version: "1.0"
+
+disable-model-invocation: true
+---
+
+Set up this Rails project for Conductor, the Mac app for parallel coding agents.
+
+## When to Use
+- You need to configure a Rails project so it runs correctly inside Conductor workspaces.
+- The project should support parallel coding agents with isolated ports, Redis settings, and shared secrets.
+- You want the standard `conductor.json`, `bin/conductor-setup`, and `script/server` scaffolding for a Rails repo.
+
+# What to Create
+
+## 1. conductor.json (project root)
+
+Create `conductor.json` in the project root if it doesn't already exist:
+
+```json
+{
+  "scripts": {
+    "setup": "bin/conductor-setup",
+    "run": "script/server"
+  }
+}
+```
+
+## 2. bin/conductor-setup (executable)
+
+Create `bin/conductor-setup` if it doesn't already exist:
+
+```bash
+#!/bin/bash
+set -e
+
+# Symlink .env from repo root (where secrets live, outside worktrees)
+[ -f "$CONDUCTOR_ROOT_PATH/.env" ] && ln -sf "$CONDUCTOR_ROOT_PATH/.env" .env
+
+# Symlink Rails master key
+[ -f "$CONDUCTOR_ROOT_PATH/config/master.key" ] && ln -sf "$CONDUCTOR_ROOT_PATH/config/master.key" config/master.key
+
+# Install dependencies
+bundle install
+npm install
+```
+
+Make it executable with `chmod +x bin/conductor-setup`.
+
+## 3. script/server (executable)
+
+Create the `script` directory if needed, then create `script/server` if it doesn't already exist:
+
+```bash
+#!/bin/bash
+
+# === Port Configuration ===
+export PORT=${CONDUCTOR_PORT:-3000}
+export VITE_RUBY_PORT=$((PORT + 1000))
+
+# === Redis Isolation ===
+if [ -n "$CONDUCTOR_WORKSPACE_NAME" ]; then
+  HASH=$(printf '%s' "$CONDUCTOR_WORKSPACE_NAME" | cksum | cut -d' ' -f1)
+  REDIS_DB=$((HASH % 16))
+  export REDIS_URL="redis://localhost:6379/${REDIS_DB}"
+fi
+
+exec bin/dev
+```
+
+Make it executable with `chmod +x script/server`.
+
+## 4. Update Rails Config Files
+
+For each of the following files, if they exist and contain Redis configuration, update them to use `ENV.fetch('REDIS_URL', ...)` or `ENV['REDIS_URL']` with a fallback:
+
+### config/initializers/sidekiq.rb
+If this file exists and configures Redis, update it to use:
+```ruby
+redis_url = ENV.fetch('REDIS_URL', 'redis://localhost:6379/0')
+```
+
+### config/cable.yml
+If this file exists, update the development adapter to use:
+```yaml
+development:
+  adapter: redis
+  url: <%= ENV.fetch('REDIS_URL', 'redis://localhost:6379/1') %>
+```
+
+### config/environments/development.rb
+If this file configures Redis for caching, update to use:
+```ruby
+config.cache_store = :redis_cache_store, { url: ENV.fetch('REDIS_URL', 'redis://localhost:6379/0') }
+```
+
+### config/initializers/rack_attack.rb
+If this file exists and configures a Redis cache store, update to use:
+```ruby
+Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(url: ENV.fetch('REDIS_URL', 'redis://localhost:6379/0'))
+```
+
+# Implementation Notes
+
+- **Don't overwrite existing files**: Check if conductor.json, bin/conductor-setup, and script/server exist before creating them. If they exist, skip creation and inform the user.
+- **Rails config updates**: Only modify Redis-related configuration. If a file doesn't exist or doesn't use Redis, skip it gracefully.
+- **Create directories as needed**: Create `script/` directory if it doesn't exist.
+
+# Verification
+
+After creating the files:
+1. Confirm all Conductor files exist and scripts are executable
+2. Run `script/server` to verify it starts without errors
+3. Check that Rails configs properly reference `ENV['REDIS_URL']` or `ENV.fetch('REDIS_URL', ...)`
+
+## Limitations
+- Use this skill only when the task clearly matches the scope described above.
+- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
+- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.