cc-codeconductor 1.4.2 → 1.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +37 -12
- package/dist/index.js +291 -109
- package/docs/generated/cli.md +8 -0
- package/package.json +1 -1
- package/presets/agy/README.md +1 -1
- package/presets/agy/hooks.json +1 -1
- package/presets/agy/scripts/invoke-hook.cjs +20 -5
- package/presets/agy/settings.json +1 -1
- package/presets/agy/skills/api-versioning/SKILL.md +394 -0
- package/presets/agy/skills/astro/SKILL.md +318 -0
- package/presets/agy/skills/auth-token-inspector/SKILL.md +30 -0
- package/presets/agy/skills/cc-pagespeed/SKILL.md +2 -3
- package/presets/agy/skills/code-review/SKILL.md +207 -0
- package/presets/agy/skills/django-orm/SKILL.md +460 -0
- package/presets/agy/skills/django-uv/SKILL.md +405 -0
- package/presets/agy/skills/drizzle-schema-architect/SKILL.md +50 -0
- package/presets/agy/skills/fastapi-pydantic-strict/SKILL.md +43 -0
- package/presets/agy/skills/jpa-nplusone-detector/SKILL.md +45 -0
- package/presets/agy/skills/jpa-postgres/SKILL.md +623 -0
- package/presets/agy/skills/livewire-alpine-bridge/SKILL.md +35 -0
- package/presets/agy/skills/nextjs-typescript/SKILL.md +390 -0
- package/presets/agy/skills/python/SKILL.md +611 -0
- package/presets/agy/skills/seo-analytics-injector/SKILL.md +43 -0
- package/presets/agy/skills/spring-auth-auditor/SKILL.md +29 -0
- package/presets/agy/skills/spring-boot-feature/SKILL.md +563 -0
- package/presets/agy/skills/spring-boot-testing-strategy/SKILL.md +475 -0
- package/presets/agy/skills/tailwind-responsive-auditor/SKILL.md +29 -0
- package/presets/agy/skills/tdd-mutation-tester/SKILL.md +27 -0
- package/presets/agy/workflows/cc-pagespeed.md +2 -3
- package/presets/agy/workflows/cc-review.md +31 -0
- package/presets/agy/workflows/cc-security.md +1 -1
- package/presets/claude/commands/cc/review.md +33 -0
- package/presets/claude/settings.json +2 -2
- package/presets/claude/skills/android/SKILL.md +1 -1
- package/presets/claude/skills/api-versioning/SKILL.md +1 -1
- package/presets/claude/skills/astro/SKILL.md +318 -0
- package/presets/claude/skills/auth-token-inspector/SKILL.md +30 -0
- package/presets/claude/skills/code-review/SKILL.md +207 -0
- package/presets/claude/skills/django-orm/SKILL.md +1 -1
- package/presets/claude/skills/django-testing/SKILL.md +1 -1
- package/presets/claude/skills/django-uv/SKILL.md +405 -0
- package/presets/claude/skills/drizzle-schema-architect/SKILL.md +50 -0
- package/presets/claude/skills/fastapi-pydantic-strict/SKILL.md +43 -0
- package/presets/claude/skills/jpa-nplusone-detector/SKILL.md +45 -0
- package/presets/claude/skills/jpa-postgres/SKILL.md +1 -1
- package/presets/claude/skills/livewire-alpine-bridge/SKILL.md +35 -0
- package/presets/claude/skills/nextjs-typescript/SKILL.md +390 -0
- package/presets/claude/skills/pagespeed-perf/SKILL.md +1 -1
- package/presets/claude/skills/python/SKILL.md +1 -1
- package/presets/claude/skills/python-django-stack/SKILL.md +1 -1
- package/presets/claude/skills/python-fastapi-stack/SKILL.md +1 -1
- package/presets/claude/skills/security/SKILL.md +1 -1
- package/presets/claude/skills/seo-analytics-injector/SKILL.md +43 -0
- package/presets/claude/skills/spring-auth-auditor/SKILL.md +29 -0
- package/presets/claude/skills/spring-boot-feature/SKILL.md +1 -1
- package/presets/claude/skills/spring-boot-kotlin/SKILL.md +1 -1
- package/presets/claude/skills/spring-boot-testing-strategy/SKILL.md +475 -0
- package/presets/claude/skills/sqlalchemy/SKILL.md +1 -1
- package/presets/claude/skills/tailwind-responsive-auditor/SKILL.md +29 -0
- package/presets/claude/skills/tdd-mutation-tester/SKILL.md +27 -0
- package/presets/claude/skills/testing-strategy/SKILL.md +1 -1
- package/presets/codex/skills/android/SKILL.md +1 -1
- package/presets/codex/skills/api-versioning/SKILL.md +1 -1
- package/presets/codex/skills/astro/SKILL.md +318 -0
- package/presets/codex/skills/auth-token-inspector/SKILL.md +30 -0
- package/presets/codex/skills/cc-openspec/SKILL.md +1 -1
- package/presets/codex/skills/cc-pagespeed/SKILL.md +2 -3
- package/presets/codex/skills/cc-review/SKILL.md +31 -0
- package/presets/codex/skills/cc-security/SKILL.md +1 -1
- package/presets/codex/skills/code-review/SKILL.md +207 -0
- package/presets/codex/skills/django-orm/SKILL.md +1 -1
- package/presets/codex/skills/django-testing/SKILL.md +1 -1
- package/presets/codex/skills/django-uv/SKILL.md +405 -0
- package/presets/codex/skills/drizzle-schema-architect/SKILL.md +50 -0
- package/presets/codex/skills/fastapi-pydantic-strict/SKILL.md +43 -0
- package/presets/codex/skills/jpa-nplusone-detector/SKILL.md +45 -0
- package/presets/codex/skills/jpa-postgres/SKILL.md +1 -1
- package/presets/codex/skills/livewire-alpine-bridge/SKILL.md +35 -0
- package/presets/codex/skills/nextjs-typescript/SKILL.md +390 -0
- package/presets/codex/skills/pagespeed-perf/SKILL.md +1 -1
- package/presets/codex/skills/python/SKILL.md +1 -1
- package/presets/codex/skills/python-django-stack/SKILL.md +1 -1
- package/presets/codex/skills/python-fastapi-stack/SKILL.md +1 -1
- package/presets/codex/skills/security-ai-llm/SKILL.md +43 -0
- package/presets/codex/skills/security-blue-team/SKILL.md +43 -0
- package/presets/codex/skills/security-cloud/SKILL.md +43 -0
- package/presets/codex/skills/security-crypto/SKILL.md +43 -0
- package/presets/codex/skills/security-exploit-dev/SKILL.md +45 -0
- package/presets/codex/skills/security-grc/SKILL.md +43 -0
- package/presets/codex/skills/security-incident-response/SKILL.md +45 -0
- package/presets/codex/skills/security-log-analysis/SKILL.md +43 -0
- package/presets/codex/skills/security-malware-analysis/SKILL.md +44 -0
- package/presets/codex/skills/security-mobile/SKILL.md +43 -0
- package/presets/codex/skills/security-network/SKILL.md +43 -0
- package/presets/codex/skills/security-ot-ics/SKILL.md +43 -0
- package/presets/codex/skills/security-recon/SKILL.md +45 -0
- package/presets/codex/skills/security-red-team/SKILL.md +44 -0
- package/presets/codex/skills/security-reverse-engineering/SKILL.md +44 -0
- package/presets/codex/skills/security-soc-automation/SKILL.md +43 -0
- package/presets/codex/skills/security-threat-hunting/SKILL.md +43 -0
- package/presets/codex/skills/security-vuln-assessment/SKILL.md +45 -0
- package/presets/codex/skills/security-web/SKILL.md +44 -0
- package/presets/codex/skills/seo-analytics-injector/SKILL.md +43 -0
- package/presets/codex/skills/spring-auth-auditor/SKILL.md +29 -0
- package/presets/codex/skills/spring-boot-feature/SKILL.md +2 -2
- package/presets/codex/skills/spring-boot-kotlin/SKILL.md +1 -1
- package/presets/codex/skills/spring-boot-testing-strategy/SKILL.md +475 -0
- package/presets/codex/skills/sqlalchemy/SKILL.md +1 -1
- package/presets/codex/skills/tailwind-responsive-auditor/SKILL.md +29 -0
- package/presets/codex/skills/tdd-mutation-tester/SKILL.md +27 -0
- package/presets/codex/skills/testing-strategy/SKILL.md +1 -1
- package/presets/cursor/commands/cc/openspec.md +1 -1
- package/presets/cursor/commands/cc/pagespeed.md +2 -3
- package/presets/cursor/commands/cc/review.md +31 -0
- package/presets/cursor/commands/cc/security.md +1 -1
- package/presets/cursor/skills/android/SKILL.md +1 -1
- package/presets/cursor/skills/api-versioning/SKILL.md +2 -1
- package/presets/cursor/skills/astro/SKILL.md +1 -1
- package/presets/cursor/skills/auth-token-inspector/SKILL.md +1 -1
- package/presets/cursor/skills/code-review/SKILL.md +1 -1
- package/presets/cursor/skills/django-orm/SKILL.md +3 -5
- package/presets/cursor/skills/django-testing/SKILL.md +1 -1
- package/presets/cursor/skills/django-uv/SKILL.md +1 -1
- package/presets/cursor/skills/drizzle-schema-architect/SKILL.md +1 -1
- package/presets/cursor/skills/fastapi-pydantic-strict/SKILL.md +1 -1
- package/presets/cursor/skills/jpa-nplusone-detector/SKILL.md +1 -1
- package/presets/cursor/skills/jpa-postgres/SKILL.md +2 -4
- package/presets/cursor/skills/livewire-alpine-bridge/SKILL.md +1 -1
- package/presets/cursor/skills/nextjs-typescript/SKILL.md +1 -1
- package/presets/cursor/skills/pagespeed-perf/SKILL.md +1 -1
- package/presets/cursor/skills/python/SKILL.md +6 -7
- package/presets/cursor/skills/python-django-stack/SKILL.md +1 -1
- package/presets/cursor/skills/python-fastapi-stack/SKILL.md +1 -1
- package/presets/cursor/skills/security/SKILL.md +1 -1
- package/presets/cursor/skills/seo-analytics-injector/SKILL.md +1 -1
- package/presets/cursor/skills/spring-auth-auditor/SKILL.md +1 -1
- package/presets/cursor/skills/spring-boot-feature/SKILL.md +2 -4
- package/presets/cursor/skills/spring-boot-kotlin/SKILL.md +1 -1
- package/presets/cursor/skills/spring-boot-testing-strategy/SKILL.md +1 -1
- package/presets/cursor/skills/sqlalchemy/SKILL.md +1 -1
- package/presets/cursor/skills/tailwind-responsive-auditor/SKILL.md +1 -1
- package/presets/cursor/skills/tdd-mutation-tester/SKILL.md +1 -1
- package/presets/gemini/commands/cc/openspec.toml +1 -1
- package/presets/gemini/commands/cc/pagespeed.toml +2 -3
- package/presets/gemini/commands/cc/review.toml +31 -0
- package/presets/gemini/commands/cc/security.toml +1 -1
- package/presets/opencode/README.md +45 -52
- package/presets/opencode/commands/cc-pagespeed.md +2 -3
- package/presets/opencode/commands/cc-review.md +31 -0
- package/presets/opencode/commands/cc-security.md +1 -1
- package/presets/opencode/opencode.jsonc +1 -1
- package/presets/opencode/skills/android/SKILL.md +1 -1
- package/presets/opencode/skills/api-versioning/SKILL.md +2 -1
- package/presets/opencode/skills/astro/SKILL.md +1 -1
- package/presets/opencode/skills/auth-token-inspector/SKILL.md +1 -1
- package/presets/opencode/skills/code-review/SKILL.md +1 -1
- package/presets/opencode/skills/django-orm/SKILL.md +3 -3
- package/presets/opencode/skills/django-testing/SKILL.md +1 -1
- package/presets/opencode/skills/django-uv/SKILL.md +1 -1
- package/presets/opencode/skills/drizzle-schema-architect/SKILL.md +1 -1
- package/presets/opencode/skills/fastapi-pydantic-strict/SKILL.md +1 -1
- package/presets/opencode/skills/jpa-nplusone-detector/SKILL.md +1 -1
- package/presets/opencode/skills/jpa-postgres/SKILL.md +2 -1
- package/presets/opencode/skills/livewire-alpine-bridge/SKILL.md +1 -1
- package/presets/opencode/skills/nextjs-typescript/SKILL.md +1 -1
- package/presets/opencode/skills/pagespeed-perf/SKILL.md +1 -1
- package/presets/opencode/skills/python/SKILL.md +6 -5
- package/presets/opencode/skills/python-django-stack/SKILL.md +1 -1
- package/presets/opencode/skills/python-fastapi-stack/SKILL.md +1 -1
- package/presets/opencode/skills/security/SKILL.md +1 -1
- package/presets/opencode/skills/seo-analytics-injector/SKILL.md +1 -1
- package/presets/opencode/skills/spring-auth-auditor/SKILL.md +1 -1
- package/presets/opencode/skills/spring-boot-feature/SKILL.md +2 -1
- package/presets/opencode/skills/spring-boot-kotlin/SKILL.md +1 -1
- package/presets/opencode/skills/spring-boot-testing-strategy/SKILL.md +1 -1
- package/presets/opencode/skills/sqlalchemy/SKILL.md +1 -1
- package/presets/opencode/skills/tailwind-responsive-auditor/SKILL.md +1 -1
- package/presets/opencode/skills/tdd-mutation-tester/SKILL.md +1 -1
- package/presets/seo-hotel/skills/astro-seo/SKILL.md +1 -1
- package/presets/seo-hotel/skills/geo-readiness/SKILL.md +1 -1
- package/presets/seo-hotel/skills/off-page/SKILL.md +1 -1
- package/presets/seo-hotel/skills/schema-validator/SKILL.md +1 -1
- package/presets/seo-hotel/skills/seo-audit/SKILL.md +1 -1
- package/presets/shared/invoke-hook.cjs +20 -5
- package/src/presets/models/roles.yml +28 -28
- package/src/presets/shared-skills.yml +58 -22
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
id: jpa-postgres
|
|
3
|
-
name:
|
|
3
|
+
name: jpa-postgres
|
|
4
4
|
description: >
|
|
5
5
|
Provides expert knowledge of JPA entity design, relationship mapping, Flyway
|
|
6
6
|
migrations, and PostgreSQL-specific optimizations.
|
|
@@ -40,10 +40,8 @@ outputs:
|
|
|
40
40
|
quality:
|
|
41
41
|
reviewed_by: codeconductor-core
|
|
42
42
|
version: 0.1.0
|
|
43
|
-
paths:
|
|
44
|
-
- "**/*.kt"
|
|
45
|
-
- "**/*.java"
|
|
46
43
|
---
|
|
44
|
+
|
|
47
45
|
# JPA + PostgreSQL
|
|
48
46
|
|
|
49
47
|
## Entity Design
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
id: python
|
|
3
|
-
name:
|
|
3
|
+
name: python
|
|
4
4
|
description: >
|
|
5
5
|
Python development best practices: clean code, patterns,
|
|
6
6
|
type hints, decorators, context managers, and architecture.
|
|
@@ -39,9 +39,8 @@ outputs:
|
|
|
39
39
|
quality:
|
|
40
40
|
reviewed_by: codeconductor-core
|
|
41
41
|
version: 0.1.0
|
|
42
|
-
paths:
|
|
43
|
-
- "**/*.py"
|
|
44
42
|
---
|
|
43
|
+
|
|
45
44
|
## When to Use
|
|
46
45
|
|
|
47
46
|
- Writing any Python code in the project
|
|
@@ -606,7 +605,7 @@ items = items_to_keep
|
|
|
606
605
|
|
|
607
606
|
## Resources
|
|
608
607
|
|
|
609
|
-
- **PEP 8** — Style Guide:
|
|
610
|
-
- **PEP 484** — Type Hints:
|
|
611
|
-
- **Real Python**:
|
|
612
|
-
- **Python Docs**:
|
|
608
|
+
- **PEP 8** — Style Guide: https://peps.python.org/pep-0008/
|
|
609
|
+
- **PEP 484** — Type Hints: https://peps.python.org/pep-0484/
|
|
610
|
+
- **Real Python**: https://realpython.com/
|
|
611
|
+
- **Python Docs**: https://docs.python.org/3/
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
id: spring-boot-feature
|
|
3
|
-
name:
|
|
3
|
+
name: spring-boot-feature
|
|
4
4
|
description: >
|
|
5
5
|
Guides the creation of complete Spring Boot features following a structured,
|
|
6
6
|
layer-by-layer workflow: entity, repository, service, controller, and tests.
|
|
@@ -43,10 +43,8 @@ outputs:
|
|
|
43
43
|
quality:
|
|
44
44
|
reviewed_by: codeconductor-core
|
|
45
45
|
version: 0.1.0
|
|
46
|
-
paths:
|
|
47
|
-
- "**/*.kt"
|
|
48
|
-
- "**/build.gradle.kts"
|
|
49
46
|
---
|
|
47
|
+
|
|
50
48
|
# Spring Boot Feature Creation
|
|
51
49
|
|
|
52
50
|
When asked to create a feature, follow these steps **in order**. Do not skip
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
id: spring-boot-testing-strategy
|
|
3
|
-
name:
|
|
3
|
+
name: spring-boot-testing-strategy
|
|
4
4
|
description: >
|
|
5
5
|
Provides expert knowledge of the testing pyramid, test design principles, MockK patterns, and integration testing conventions for Spring Boot + Kotlin projects.
|
|
6
6
|
|
|
@@ -208,5 +208,5 @@ Report completion: Task Cards executed, scorecard verdict, change folder path, f
|
|
|
208
208
|
|
|
209
209
|
## Skill
|
|
210
210
|
|
|
211
|
-
Apply `.
|
|
211
|
+
Apply `.gemini/skills/openspec/SKILL.md` for backlog format rules and state transitions.
|
|
212
212
|
"""
|
|
@@ -66,9 +66,8 @@ the following steps in order:
|
|
|
66
66
|
the output filename: `{YYYY-MM-DD}_pagespeed-{hostname}-claude.md`.
|
|
67
67
|
|
|
68
68
|
2. **Collect** — Call the PageSpeed Insights API for the requested strategy
|
|
69
|
-
(`mobile`, `desktop`, or `both`)
|
|
70
|
-
|
|
71
|
-
Otherwise, use `WebFetch` to call the PSI endpoint directly.
|
|
69
|
+
(`mobile`, `desktop`, or `both`) using `WebFetch` to call the PSI endpoint
|
|
70
|
+
directly.
|
|
72
71
|
|
|
73
72
|
3. **Analyze** — Extract Core Web Vitals (LCP, INP, CLS, FCP, TTFB, TBT),
|
|
74
73
|
identify the LCP element, enumerate third-party scripts by blocking time,
|
|
@@ -110,6 +110,37 @@ Evaluate the diff against the following checklist:
|
|
|
110
110
|
|
|
111
111
|
---
|
|
112
112
|
|
|
113
|
+
## Severity Rubric
|
|
114
|
+
|
|
115
|
+
Classify every finding using these concrete anchors — not general judgment —
|
|
116
|
+
so the same finding gets the same category on any run.
|
|
117
|
+
|
|
118
|
+
**CRITICAL** (always):
|
|
119
|
+
|
|
120
|
+
- Unauthenticated access to a protected resource
|
|
121
|
+
- Injection (SQL, command, XSS) reachable from untrusted input
|
|
122
|
+
- A secret or credential present in the diff
|
|
123
|
+
- A destructive operation with no confirmation
|
|
124
|
+
- The build or test suite is broken
|
|
125
|
+
- A direct contradiction of an explicit acceptance criterion
|
|
126
|
+
|
|
127
|
+
**WARNING**:
|
|
128
|
+
|
|
129
|
+
- Missing test for a new branch or edge case
|
|
130
|
+
- An error is silently swallowed — no log, no propagation
|
|
131
|
+
- A change outside the declared scope
|
|
132
|
+
- Inconsistent with an established pattern already in the module
|
|
133
|
+
- Missing input validation in an internal function (not exposed at a trust boundary)
|
|
134
|
+
|
|
135
|
+
**SUGGESTION**:
|
|
136
|
+
|
|
137
|
+
- Style or naming
|
|
138
|
+
- Minor readability
|
|
139
|
+
- Speculative refactor that wasn't requested
|
|
140
|
+
- Non-blocking micro-optimization
|
|
141
|
+
|
|
142
|
+
---
|
|
143
|
+
|
|
113
144
|
## Step 3 — Review Report
|
|
114
145
|
|
|
115
146
|
Produce a structured Review Report with findings in three categories:
|
|
@@ -59,7 +59,7 @@ If `graphify-out/graph.json` exists, run `graphify query "{{args}}"` (and
|
|
|
59
59
|
`graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`
|
|
60
60
|
to map modules, conventions, and impact radius. Do not write code in this step.
|
|
61
61
|
Record a Repo Map artifact before intake. Load the matching `security-*` skill
|
|
62
|
-
for the named domain (see `.
|
|
62
|
+
for the named domain (see `.gemini/skills/security-*/SKILL.md`). Keep the OWASP
|
|
63
63
|
`security` skill for application-security reviews.
|
|
64
64
|
|
|
65
65
|
---
|
|
@@ -2,8 +2,8 @@
|
|
|
2
2
|
|
|
3
3
|
## Model Selection Guide
|
|
4
4
|
|
|
5
|
-
This preset
|
|
6
|
-
|
|
5
|
+
This preset uses the four requested **OpenCode Go** models. Claude (Anthropic)
|
|
6
|
+
can be selected as an explicit override.
|
|
7
7
|
|
|
8
8
|
---
|
|
9
9
|
|
|
@@ -13,37 +13,39 @@ providers)** models.
|
|
|
13
13
|
|
|
14
14
|
| Model | Strength | Best For |
|
|
15
15
|
| --------------------------- | ------------------------------- | ------------------------------- |
|
|
16
|
-
| `claude-opus-
|
|
17
|
-
| `claude-sonnet-
|
|
16
|
+
| `claude-opus-5` | Complex reasoning, architecture | Architect, complex design |
|
|
17
|
+
| `claude-sonnet-5` | Balanced, general purpose | Implementation, testing |
|
|
18
18
|
| `claude-haiku-4-5-20251001` | Fast, lightweight | Task Coach, Docs, Repo Explorer |
|
|
19
19
|
|
|
20
20
|
### OpenCode Go models
|
|
21
21
|
|
|
22
|
-
Canonical
|
|
23
|
-
|
|
24
|
-
|
|
22
|
+
Canonical role assignments live in `src/presets/models/roles.yml`. Model IDs
|
|
23
|
+
were verified against [OpenCode Go](https://opencode.ai/docs/go/) and the live
|
|
24
|
+
catalog on September 25, 2026.
|
|
25
25
|
|
|
26
26
|
| Model | Best for |
|
|
27
27
|
| --- | --- |
|
|
28
|
-
| `deepseek-v4-
|
|
29
|
-
| `
|
|
30
|
-
| `
|
|
31
|
-
| `
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
28
|
+
| `opencode-go/deepseek-v4.1-flash` | Architect, reviewer, contract-builder, orchestrator (TUI default), planner, goal-planner |
|
|
29
|
+
| `opencode-go/mimo-v2.6-flash` | Implementer, tester |
|
|
30
|
+
| `opencode-go/glm-5.3-flash` | Security-reviewer, devil, complexity-auditor, task-coach, repo-explorer |
|
|
31
|
+
| `opencode-go/muse-spark-1.3-contributor` | Docs |
|
|
32
|
+
|
|
33
|
+
These assignments are workflow choices, not a provider ranking. Generated
|
|
34
|
+
agents leave sampling and reasoning settings at provider defaults rather than
|
|
35
|
+
copying Claude-specific `effort` or forcing a shared `temperature` onto different
|
|
36
|
+
models. No unverified variants are configured.
|
|
37
|
+
|
|
38
|
+
Muse Contributor is included at the request of the maintainer. OpenCode documents
|
|
39
|
+
that it uses prompts/completions for training, is not ZDR, and has regional
|
|
40
|
+
restrictions. Do not send confidential material to that model; override the docs
|
|
41
|
+
agent with another verified model when required.
|
|
39
42
|
|
|
40
43
|
---
|
|
41
44
|
|
|
42
45
|
## Agent Model Matrix
|
|
43
46
|
|
|
44
|
-
See `skills/cc-update-preset-models/references/role-map.md
|
|
45
|
-
|
|
46
|
-
`minimax-m3`, reviewer `qwen3.8-max`.
|
|
47
|
+
See `skills/cc-update-preset-models/references/role-map.md` for the complete
|
|
48
|
+
cross-preset role matrix.
|
|
47
49
|
|
|
48
50
|
---
|
|
49
51
|
|
|
@@ -66,6 +68,10 @@ examples: architect `deepseek-v4-pro`, implementer `mimo-v2.5`, tester
|
|
|
66
68
|
|
|
67
69
|
This preset uses OpenCode's permission system (v1.1.1+) with granular control:
|
|
68
70
|
|
|
71
|
+
Keep the V1-compatible `permission` dictionary for the `opencode` CLI. V2's
|
|
72
|
+
`permissions` rule list is exclusive to `opencode2` and is rejected by OpenCode
|
|
73
|
+
V1. Validate generated files with the actual CLI version before migrating formats.
|
|
74
|
+
|
|
69
75
|
- **Global defaults**: Most operations require approval (`ask`)
|
|
70
76
|
- **Read access**: Allowed by default, with sensitive files denied
|
|
71
77
|
- **Write/Edit**: Requires approval, with protected paths denied
|
|
@@ -87,8 +93,8 @@ The following paths are denied by default:
|
|
|
87
93
|
|
|
88
94
|
### Simple Tasks (Q&A, intake, documentation)
|
|
89
95
|
|
|
90
|
-
**
|
|
91
|
-
|
|
96
|
+
**Preset choice:** `glm-5.3-flash` for intake/exploration;
|
|
97
|
+
`muse-spark-1.3-contributor` for non-confidential docs.
|
|
92
98
|
|
|
93
99
|
- Task Coach intake
|
|
94
100
|
- Repo Explorer mapping
|
|
@@ -96,8 +102,8 @@ The following paths are denied by default:
|
|
|
96
102
|
|
|
97
103
|
### Medium Tasks (Implementation, testing)
|
|
98
104
|
|
|
99
|
-
**
|
|
100
|
-
`
|
|
105
|
+
**Preset choice:** `mimo-v2.6-flash` for implementation and testing;
|
|
106
|
+
`deepseek-v4.1-flash` for reviews.
|
|
101
107
|
|
|
102
108
|
- Implementer code writing
|
|
103
109
|
- Tester test generation
|
|
@@ -105,7 +111,8 @@ The following paths are denied by default:
|
|
|
105
111
|
|
|
106
112
|
### Complex Tasks (Architecture, security, multi-agent coordination)
|
|
107
113
|
|
|
108
|
-
**
|
|
114
|
+
**Preset choice:** `deepseek-v4.1-flash` for design/coordination;
|
|
115
|
+
`glm-5.3-flash` for defensive security review.
|
|
109
116
|
|
|
110
117
|
- Architect technical design
|
|
111
118
|
- Orchestrator routing decisions
|
|
@@ -115,17 +122,14 @@ The following paths are denied by default:
|
|
|
115
122
|
|
|
116
123
|
## Usage in Agent Contracts
|
|
117
124
|
|
|
118
|
-
|
|
119
|
-
frontmatter:
|
|
125
|
+
Agent templates contain placeholders. Installation resolves the role model
|
|
126
|
+
into YAML frontmatter:
|
|
120
127
|
|
|
121
128
|
```yaml
|
|
122
129
|
---
|
|
123
130
|
description: ...
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|----------|-------|----------|
|
|
127
|
-
| Claude | claude-opus-4-7 | Complex architecture, ADRs |
|
|
128
|
-
| OpenCode Go | deepseek-v4-pro | Best — excels at reasoning |
|
|
131
|
+
model: opencode-go/deepseek-v4.1-flash
|
|
132
|
+
mode: subagent
|
|
129
133
|
---
|
|
130
134
|
```
|
|
131
135
|
|
|
@@ -144,21 +148,10 @@ configuration in `opencode.jsonc`.
|
|
|
144
148
|
|
|
145
149
|
## Environment Variables
|
|
146
150
|
|
|
147
|
-
OpenCode Go
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
export DEEPSEEK_API_KEY="your-key"
|
|
152
|
-
|
|
153
|
-
# Qwen (Alibaba)
|
|
154
|
-
export DASHSCOPE_API_KEY="your-key"
|
|
155
|
-
|
|
156
|
-
# MiniMax
|
|
157
|
-
export MINIMAX_API_KEY="your-key"
|
|
158
|
-
|
|
159
|
-
# Kimi (Moonshot)
|
|
160
|
-
export KIMI_API_KEY="your-key"
|
|
161
|
-
```
|
|
151
|
+
Connect to **OpenCode Go** through `/connect` and use the Go API key. The
|
|
152
|
+
`opencode-go/` provider does not use individual DeepSeek, GLM, MiMo, or Meta keys.
|
|
153
|
+
Do not store API keys in the preset. Run `opencode models opencode-go` to check
|
|
154
|
+
availability before using or overriding a role model.
|
|
162
155
|
|
|
163
156
|
---
|
|
164
157
|
|
|
@@ -166,10 +159,10 @@ export KIMI_API_KEY="your-key"
|
|
|
166
159
|
|
|
167
160
|
| Scenario | Recommended |
|
|
168
161
|
| ------------------------------- | -------------------------------------------------- |
|
|
169
|
-
| Complex reasoning, architecture | OpenCode Go (`deepseek-v4-
|
|
170
|
-
| Fast iteration, simple tasks | OpenCode Go (`
|
|
171
|
-
| Code implementation | OpenCode Go (`mimo-v2.
|
|
172
|
-
|
|
|
162
|
+
| Complex reasoning, architecture | OpenCode Go (`deepseek-v4.1-flash`) or Claude (`opus`) |
|
|
163
|
+
| Fast iteration, simple tasks | OpenCode Go (`glm-5.3-flash`) or Claude (`haiku`) |
|
|
164
|
+
| Code implementation | OpenCode Go (`mimo-v2.6-flash`) or Claude (`sonnet`) |
|
|
165
|
+
| Non-confidential documentation | OpenCode Go (`muse-spark-1.3-contributor`) |
|
|
173
166
|
| Availability issues | Switch to alternative from the matrix |
|
|
174
167
|
|
|
175
168
|
## Approach
|
|
@@ -39,9 +39,8 @@ without a key, but CrUX field data requires it.
|
|
|
39
39
|
Call the PageSpeed Insights API for the URL provided above.
|
|
40
40
|
|
|
41
41
|
- Strategy: `both` (mobile + desktop) unless the user specified otherwise.
|
|
42
|
-
-
|
|
43
|
-
-
|
|
44
|
-
source for manual resource-hint analysis.
|
|
42
|
+
- Call PSI directly via WebFetch and fetch the HTML source for manual
|
|
43
|
+
resource-hint analysis.
|
|
45
44
|
|
|
46
45
|
---
|
|
47
46
|
|
|
@@ -118,6 +118,37 @@ reviewer must evaluate the diff against the following checklist:
|
|
|
118
118
|
|
|
119
119
|
---
|
|
120
120
|
|
|
121
|
+
## Severity Rubric
|
|
122
|
+
|
|
123
|
+
Classify every finding using these concrete anchors — not general judgment —
|
|
124
|
+
so the same finding gets the same category on any run.
|
|
125
|
+
|
|
126
|
+
**CRITICAL** (always):
|
|
127
|
+
|
|
128
|
+
- Unauthenticated access to a protected resource
|
|
129
|
+
- Injection (SQL, command, XSS) reachable from untrusted input
|
|
130
|
+
- A secret or credential present in the diff
|
|
131
|
+
- A destructive operation with no confirmation
|
|
132
|
+
- The build or test suite is broken
|
|
133
|
+
- A direct contradiction of an explicit acceptance criterion
|
|
134
|
+
|
|
135
|
+
**WARNING**:
|
|
136
|
+
|
|
137
|
+
- Missing test for a new branch or edge case
|
|
138
|
+
- An error is silently swallowed — no log, no propagation
|
|
139
|
+
- A change outside the declared scope
|
|
140
|
+
- Inconsistent with an established pattern already in the module
|
|
141
|
+
- Missing input validation in an internal function (not exposed at a trust boundary)
|
|
142
|
+
|
|
143
|
+
**SUGGESTION**:
|
|
144
|
+
|
|
145
|
+
- Style or naming
|
|
146
|
+
- Minor readability
|
|
147
|
+
- Speculative refactor that wasn't requested
|
|
148
|
+
- Non-blocking micro-optimization
|
|
149
|
+
|
|
150
|
+
---
|
|
151
|
+
|
|
121
152
|
## Step 3 — Review Report
|
|
122
153
|
|
|
123
154
|
reviewer produces a structured Review Report with findings in three categories:
|
|
@@ -62,7 +62,7 @@ If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"` (and
|
|
|
62
62
|
`graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`
|
|
63
63
|
to map modules, conventions, and impact radius. Do not write code in this step.
|
|
64
64
|
Record a Repo Map artifact before intake. Load the matching `security-*` skill
|
|
65
|
-
for the named domain (see `.
|
|
65
|
+
for the named domain (see `.opencode/skills/security-*/SKILL.md`). Keep the OWASP
|
|
66
66
|
`security` skill for application-security reviews.
|
|
67
67
|
|
|
68
68
|
---
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
id: android
|
|
3
|
-
name:
|
|
3
|
+
name: android
|
|
4
4
|
description: >
|
|
5
5
|
Provides expert knowledge for building modern native Android apps using Kotlin, Jetpack Compose, Material Design 3, MVI architecture, Hilt dependency injection, and Media3/ExoPlayer.
|
|
6
6
|
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
id: api-versioning
|
|
3
|
-
name:
|
|
3
|
+
name: api-versioning
|
|
4
4
|
description: >
|
|
5
5
|
Provides expert knowledge for designing, implementing, and managing REST API
|
|
6
6
|
versioning strategies with deprecation workflows.
|
|
@@ -39,6 +39,7 @@ quality:
|
|
|
39
39
|
reviewed_by: codeconductor-core
|
|
40
40
|
version: 0.1.0
|
|
41
41
|
---
|
|
42
|
+
|
|
42
43
|
# API Versioning
|
|
43
44
|
|
|
44
45
|
## Versioning Strategies
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
---
|
|
2
2
|
id: django-orm
|
|
3
|
-
name:
|
|
3
|
+
name: django-orm
|
|
4
4
|
description: >
|
|
5
5
|
Django ORM patterns for multi-tenant POS projects: efficient queries,
|
|
6
6
|
bulk operations, transactions, and multi-schema upload paths.
|
|
@@ -41,6 +41,7 @@ quality:
|
|
|
41
41
|
reviewed_by: codeconductor-core
|
|
42
42
|
version: 0.1.0
|
|
43
43
|
---
|
|
44
|
+
|
|
44
45
|
## When to Use
|
|
45
46
|
|
|
46
47
|
- Writing or reviewing queryset code in any `apps/*/`
|
|
@@ -456,5 +457,4 @@ def on_order_save(sender, instance, created, **kwargs):
|
|
|
456
457
|
- **Annotation examples**: `apps/pos/views.py` lines 59-75
|
|
457
458
|
- **Exists usage**: `apps/catalog/views.py` line 112
|
|
458
459
|
- **Upload paths**: `apps/catalog/models.py`
|
|
459
|
-
- **Django ORM docs**:
|
|
460
|
-
<https://docs.djangoproject.com/en/5.2/topics/db/queries/>
|
|
460
|
+
- **Django ORM docs**: https://docs.djangoproject.com/en/5.2/topics/db/queries/
|