cc-codeconductor 1.4.2 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (186) hide show
  1. package/README.md +37 -12
  2. package/dist/index.js +291 -109
  3. package/docs/generated/cli.md +8 -0
  4. package/package.json +1 -1
  5. package/presets/agy/README.md +1 -1
  6. package/presets/agy/hooks.json +1 -1
  7. package/presets/agy/scripts/invoke-hook.cjs +20 -5
  8. package/presets/agy/settings.json +1 -1
  9. package/presets/agy/skills/api-versioning/SKILL.md +394 -0
  10. package/presets/agy/skills/astro/SKILL.md +318 -0
  11. package/presets/agy/skills/auth-token-inspector/SKILL.md +30 -0
  12. package/presets/agy/skills/cc-pagespeed/SKILL.md +2 -3
  13. package/presets/agy/skills/code-review/SKILL.md +207 -0
  14. package/presets/agy/skills/django-orm/SKILL.md +460 -0
  15. package/presets/agy/skills/django-uv/SKILL.md +405 -0
  16. package/presets/agy/skills/drizzle-schema-architect/SKILL.md +50 -0
  17. package/presets/agy/skills/fastapi-pydantic-strict/SKILL.md +43 -0
  18. package/presets/agy/skills/jpa-nplusone-detector/SKILL.md +45 -0
  19. package/presets/agy/skills/jpa-postgres/SKILL.md +623 -0
  20. package/presets/agy/skills/livewire-alpine-bridge/SKILL.md +35 -0
  21. package/presets/agy/skills/nextjs-typescript/SKILL.md +390 -0
  22. package/presets/agy/skills/python/SKILL.md +611 -0
  23. package/presets/agy/skills/seo-analytics-injector/SKILL.md +43 -0
  24. package/presets/agy/skills/spring-auth-auditor/SKILL.md +29 -0
  25. package/presets/agy/skills/spring-boot-feature/SKILL.md +563 -0
  26. package/presets/agy/skills/spring-boot-testing-strategy/SKILL.md +475 -0
  27. package/presets/agy/skills/tailwind-responsive-auditor/SKILL.md +29 -0
  28. package/presets/agy/skills/tdd-mutation-tester/SKILL.md +27 -0
  29. package/presets/agy/workflows/cc-pagespeed.md +2 -3
  30. package/presets/agy/workflows/cc-review.md +31 -0
  31. package/presets/agy/workflows/cc-security.md +1 -1
  32. package/presets/claude/commands/cc/review.md +33 -0
  33. package/presets/claude/settings.json +2 -2
  34. package/presets/claude/skills/android/SKILL.md +1 -1
  35. package/presets/claude/skills/api-versioning/SKILL.md +1 -1
  36. package/presets/claude/skills/astro/SKILL.md +318 -0
  37. package/presets/claude/skills/auth-token-inspector/SKILL.md +30 -0
  38. package/presets/claude/skills/code-review/SKILL.md +207 -0
  39. package/presets/claude/skills/django-orm/SKILL.md +1 -1
  40. package/presets/claude/skills/django-testing/SKILL.md +1 -1
  41. package/presets/claude/skills/django-uv/SKILL.md +405 -0
  42. package/presets/claude/skills/drizzle-schema-architect/SKILL.md +50 -0
  43. package/presets/claude/skills/fastapi-pydantic-strict/SKILL.md +43 -0
  44. package/presets/claude/skills/jpa-nplusone-detector/SKILL.md +45 -0
  45. package/presets/claude/skills/jpa-postgres/SKILL.md +1 -1
  46. package/presets/claude/skills/livewire-alpine-bridge/SKILL.md +35 -0
  47. package/presets/claude/skills/nextjs-typescript/SKILL.md +390 -0
  48. package/presets/claude/skills/pagespeed-perf/SKILL.md +1 -1
  49. package/presets/claude/skills/python/SKILL.md +1 -1
  50. package/presets/claude/skills/python-django-stack/SKILL.md +1 -1
  51. package/presets/claude/skills/python-fastapi-stack/SKILL.md +1 -1
  52. package/presets/claude/skills/security/SKILL.md +1 -1
  53. package/presets/claude/skills/seo-analytics-injector/SKILL.md +43 -0
  54. package/presets/claude/skills/spring-auth-auditor/SKILL.md +29 -0
  55. package/presets/claude/skills/spring-boot-feature/SKILL.md +1 -1
  56. package/presets/claude/skills/spring-boot-kotlin/SKILL.md +1 -1
  57. package/presets/claude/skills/spring-boot-testing-strategy/SKILL.md +475 -0
  58. package/presets/claude/skills/sqlalchemy/SKILL.md +1 -1
  59. package/presets/claude/skills/tailwind-responsive-auditor/SKILL.md +29 -0
  60. package/presets/claude/skills/tdd-mutation-tester/SKILL.md +27 -0
  61. package/presets/claude/skills/testing-strategy/SKILL.md +1 -1
  62. package/presets/codex/skills/android/SKILL.md +1 -1
  63. package/presets/codex/skills/api-versioning/SKILL.md +1 -1
  64. package/presets/codex/skills/astro/SKILL.md +318 -0
  65. package/presets/codex/skills/auth-token-inspector/SKILL.md +30 -0
  66. package/presets/codex/skills/cc-openspec/SKILL.md +1 -1
  67. package/presets/codex/skills/cc-pagespeed/SKILL.md +2 -3
  68. package/presets/codex/skills/cc-review/SKILL.md +31 -0
  69. package/presets/codex/skills/cc-security/SKILL.md +1 -1
  70. package/presets/codex/skills/code-review/SKILL.md +207 -0
  71. package/presets/codex/skills/django-orm/SKILL.md +1 -1
  72. package/presets/codex/skills/django-testing/SKILL.md +1 -1
  73. package/presets/codex/skills/django-uv/SKILL.md +405 -0
  74. package/presets/codex/skills/drizzle-schema-architect/SKILL.md +50 -0
  75. package/presets/codex/skills/fastapi-pydantic-strict/SKILL.md +43 -0
  76. package/presets/codex/skills/jpa-nplusone-detector/SKILL.md +45 -0
  77. package/presets/codex/skills/jpa-postgres/SKILL.md +1 -1
  78. package/presets/codex/skills/livewire-alpine-bridge/SKILL.md +35 -0
  79. package/presets/codex/skills/nextjs-typescript/SKILL.md +390 -0
  80. package/presets/codex/skills/pagespeed-perf/SKILL.md +1 -1
  81. package/presets/codex/skills/python/SKILL.md +1 -1
  82. package/presets/codex/skills/python-django-stack/SKILL.md +1 -1
  83. package/presets/codex/skills/python-fastapi-stack/SKILL.md +1 -1
  84. package/presets/codex/skills/security-ai-llm/SKILL.md +43 -0
  85. package/presets/codex/skills/security-blue-team/SKILL.md +43 -0
  86. package/presets/codex/skills/security-cloud/SKILL.md +43 -0
  87. package/presets/codex/skills/security-crypto/SKILL.md +43 -0
  88. package/presets/codex/skills/security-exploit-dev/SKILL.md +45 -0
  89. package/presets/codex/skills/security-grc/SKILL.md +43 -0
  90. package/presets/codex/skills/security-incident-response/SKILL.md +45 -0
  91. package/presets/codex/skills/security-log-analysis/SKILL.md +43 -0
  92. package/presets/codex/skills/security-malware-analysis/SKILL.md +44 -0
  93. package/presets/codex/skills/security-mobile/SKILL.md +43 -0
  94. package/presets/codex/skills/security-network/SKILL.md +43 -0
  95. package/presets/codex/skills/security-ot-ics/SKILL.md +43 -0
  96. package/presets/codex/skills/security-recon/SKILL.md +45 -0
  97. package/presets/codex/skills/security-red-team/SKILL.md +44 -0
  98. package/presets/codex/skills/security-reverse-engineering/SKILL.md +44 -0
  99. package/presets/codex/skills/security-soc-automation/SKILL.md +43 -0
  100. package/presets/codex/skills/security-threat-hunting/SKILL.md +43 -0
  101. package/presets/codex/skills/security-vuln-assessment/SKILL.md +45 -0
  102. package/presets/codex/skills/security-web/SKILL.md +44 -0
  103. package/presets/codex/skills/seo-analytics-injector/SKILL.md +43 -0
  104. package/presets/codex/skills/spring-auth-auditor/SKILL.md +29 -0
  105. package/presets/codex/skills/spring-boot-feature/SKILL.md +2 -2
  106. package/presets/codex/skills/spring-boot-kotlin/SKILL.md +1 -1
  107. package/presets/codex/skills/spring-boot-testing-strategy/SKILL.md +475 -0
  108. package/presets/codex/skills/sqlalchemy/SKILL.md +1 -1
  109. package/presets/codex/skills/tailwind-responsive-auditor/SKILL.md +29 -0
  110. package/presets/codex/skills/tdd-mutation-tester/SKILL.md +27 -0
  111. package/presets/codex/skills/testing-strategy/SKILL.md +1 -1
  112. package/presets/cursor/commands/cc/openspec.md +1 -1
  113. package/presets/cursor/commands/cc/pagespeed.md +2 -3
  114. package/presets/cursor/commands/cc/review.md +31 -0
  115. package/presets/cursor/commands/cc/security.md +1 -1
  116. package/presets/cursor/skills/android/SKILL.md +1 -1
  117. package/presets/cursor/skills/api-versioning/SKILL.md +2 -1
  118. package/presets/cursor/skills/astro/SKILL.md +1 -1
  119. package/presets/cursor/skills/auth-token-inspector/SKILL.md +1 -1
  120. package/presets/cursor/skills/code-review/SKILL.md +1 -1
  121. package/presets/cursor/skills/django-orm/SKILL.md +3 -5
  122. package/presets/cursor/skills/django-testing/SKILL.md +1 -1
  123. package/presets/cursor/skills/django-uv/SKILL.md +1 -1
  124. package/presets/cursor/skills/drizzle-schema-architect/SKILL.md +1 -1
  125. package/presets/cursor/skills/fastapi-pydantic-strict/SKILL.md +1 -1
  126. package/presets/cursor/skills/jpa-nplusone-detector/SKILL.md +1 -1
  127. package/presets/cursor/skills/jpa-postgres/SKILL.md +2 -4
  128. package/presets/cursor/skills/livewire-alpine-bridge/SKILL.md +1 -1
  129. package/presets/cursor/skills/nextjs-typescript/SKILL.md +1 -1
  130. package/presets/cursor/skills/pagespeed-perf/SKILL.md +1 -1
  131. package/presets/cursor/skills/python/SKILL.md +6 -7
  132. package/presets/cursor/skills/python-django-stack/SKILL.md +1 -1
  133. package/presets/cursor/skills/python-fastapi-stack/SKILL.md +1 -1
  134. package/presets/cursor/skills/security/SKILL.md +1 -1
  135. package/presets/cursor/skills/seo-analytics-injector/SKILL.md +1 -1
  136. package/presets/cursor/skills/spring-auth-auditor/SKILL.md +1 -1
  137. package/presets/cursor/skills/spring-boot-feature/SKILL.md +2 -4
  138. package/presets/cursor/skills/spring-boot-kotlin/SKILL.md +1 -1
  139. package/presets/cursor/skills/spring-boot-testing-strategy/SKILL.md +1 -1
  140. package/presets/cursor/skills/sqlalchemy/SKILL.md +1 -1
  141. package/presets/cursor/skills/tailwind-responsive-auditor/SKILL.md +1 -1
  142. package/presets/cursor/skills/tdd-mutation-tester/SKILL.md +1 -1
  143. package/presets/gemini/commands/cc/openspec.toml +1 -1
  144. package/presets/gemini/commands/cc/pagespeed.toml +2 -3
  145. package/presets/gemini/commands/cc/review.toml +31 -0
  146. package/presets/gemini/commands/cc/security.toml +1 -1
  147. package/presets/opencode/README.md +45 -52
  148. package/presets/opencode/commands/cc-pagespeed.md +2 -3
  149. package/presets/opencode/commands/cc-review.md +31 -0
  150. package/presets/opencode/commands/cc-security.md +1 -1
  151. package/presets/opencode/opencode.jsonc +1 -1
  152. package/presets/opencode/skills/android/SKILL.md +1 -1
  153. package/presets/opencode/skills/api-versioning/SKILL.md +2 -1
  154. package/presets/opencode/skills/astro/SKILL.md +1 -1
  155. package/presets/opencode/skills/auth-token-inspector/SKILL.md +1 -1
  156. package/presets/opencode/skills/code-review/SKILL.md +1 -1
  157. package/presets/opencode/skills/django-orm/SKILL.md +3 -3
  158. package/presets/opencode/skills/django-testing/SKILL.md +1 -1
  159. package/presets/opencode/skills/django-uv/SKILL.md +1 -1
  160. package/presets/opencode/skills/drizzle-schema-architect/SKILL.md +1 -1
  161. package/presets/opencode/skills/fastapi-pydantic-strict/SKILL.md +1 -1
  162. package/presets/opencode/skills/jpa-nplusone-detector/SKILL.md +1 -1
  163. package/presets/opencode/skills/jpa-postgres/SKILL.md +2 -1
  164. package/presets/opencode/skills/livewire-alpine-bridge/SKILL.md +1 -1
  165. package/presets/opencode/skills/nextjs-typescript/SKILL.md +1 -1
  166. package/presets/opencode/skills/pagespeed-perf/SKILL.md +1 -1
  167. package/presets/opencode/skills/python/SKILL.md +6 -5
  168. package/presets/opencode/skills/python-django-stack/SKILL.md +1 -1
  169. package/presets/opencode/skills/python-fastapi-stack/SKILL.md +1 -1
  170. package/presets/opencode/skills/security/SKILL.md +1 -1
  171. package/presets/opencode/skills/seo-analytics-injector/SKILL.md +1 -1
  172. package/presets/opencode/skills/spring-auth-auditor/SKILL.md +1 -1
  173. package/presets/opencode/skills/spring-boot-feature/SKILL.md +2 -1
  174. package/presets/opencode/skills/spring-boot-kotlin/SKILL.md +1 -1
  175. package/presets/opencode/skills/spring-boot-testing-strategy/SKILL.md +1 -1
  176. package/presets/opencode/skills/sqlalchemy/SKILL.md +1 -1
  177. package/presets/opencode/skills/tailwind-responsive-auditor/SKILL.md +1 -1
  178. package/presets/opencode/skills/tdd-mutation-tester/SKILL.md +1 -1
  179. package/presets/seo-hotel/skills/astro-seo/SKILL.md +1 -1
  180. package/presets/seo-hotel/skills/geo-readiness/SKILL.md +1 -1
  181. package/presets/seo-hotel/skills/off-page/SKILL.md +1 -1
  182. package/presets/seo-hotel/skills/schema-validator/SKILL.md +1 -1
  183. package/presets/seo-hotel/skills/seo-audit/SKILL.md +1 -1
  184. package/presets/shared/invoke-hook.cjs +20 -5
  185. package/src/presets/models/roles.yml +28 -28
  186. package/src/presets/shared-skills.yml +58 -22
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: django-testing
3
- name: Django Testing
3
+ name: django-testing
4
4
  description: >
5
5
  Testing patterns for multi-tenant Django POS projects using pytest-django,
6
6
  RequestFactory, and mocks. No factories, no complex conftest.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: django-uv
3
- name: Django + UV
3
+ name: django-uv
4
4
  description: >
5
5
  Provides expert knowledge for building Django 5+ projects with UV as the package manager, domain-driven app structure, ruff for linting, and pytest-django for testing.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: drizzle-schema-architect
3
- name: Drizzle Schema Architect
3
+ name: drizzle-schema-architect
4
4
  description: >
5
5
  Generates strictly typed Drizzle ORM schemas for PostgreSQL with indexes,
6
6
  foreign keys, and Zod schema deduction.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: fastapi-pydantic-strict
3
- name: FastAPI Pydantic Strict
3
+ name: fastapi-pydantic-strict
4
4
  description: >
5
5
  Enforces Pydantic v2 strict models, asynchronous dependency generators, and uv environment setup.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: jpa-nplusone-detector
3
- name: JPA N+1 Query Detector
3
+ name: jpa-nplusone-detector
4
4
  description: >
5
5
  Audits Hibernate database interactions to prevent N+1 query problems in JVM apps.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: jpa-postgres
3
- name: JPA + PostgreSQL
3
+ name: jpa-postgres
4
4
  description: >
5
5
  Provides expert knowledge of JPA entity design, relationship mapping, Flyway
6
6
  migrations, and PostgreSQL-specific optimizations.
@@ -40,10 +40,8 @@ outputs:
40
40
  quality:
41
41
  reviewed_by: codeconductor-core
42
42
  version: 0.1.0
43
- paths:
44
- - "**/*.kt"
45
- - "**/*.java"
46
43
  ---
44
+
47
45
  # JPA + PostgreSQL
48
46
 
49
47
  ## Entity Design
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: livewire-alpine-bridge
3
- name: Livewire Alpine Bridge
3
+ name: livewire-alpine-bridge
4
4
  description: >
5
5
  Schedules reactive frontend states cleanly using entangle directives in PHP and JS.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: nextjs-typescript
3
- name: Next.js + TypeScript
3
+ name: nextjs-typescript
4
4
  description: >
5
5
  Provides expert knowledge for building Next.js 15+ applications with the App Router, TypeScript, Server Components, Server Actions, and TanStack Query.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: pagespeed-perf
3
- name: PageSpeed Performance Audit
3
+ name: pagespeed-perf
4
4
  description: >
5
5
  Web Performance Engineering — analyzes Core Web Vitals using the PageSpeed
6
6
  Insights API (PSI v5) and applies the 80/20 principle: identify the 20% of
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: python
3
- name: Python
3
+ name: python
4
4
  description: >
5
5
  Python development best practices: clean code, patterns,
6
6
  type hints, decorators, context managers, and architecture.
@@ -39,9 +39,8 @@ outputs:
39
39
  quality:
40
40
  reviewed_by: codeconductor-core
41
41
  version: 0.1.0
42
- paths:
43
- - "**/*.py"
44
42
  ---
43
+
45
44
  ## When to Use
46
45
 
47
46
  - Writing any Python code in the project
@@ -606,7 +605,7 @@ items = items_to_keep
606
605
 
607
606
  ## Resources
608
607
 
609
- - **PEP 8** — Style Guide: <https://peps.python.org/pep-0008/>
610
- - **PEP 484** — Type Hints: <https://peps.python.org/pep-0484/>
611
- - **Real Python**: <https://realpython.com/>
612
- - **Python Docs**: <https://docs.python.org/3/>
608
+ - **PEP 8** — Style Guide: https://peps.python.org/pep-0008/
609
+ - **PEP 484** — Type Hints: https://peps.python.org/pep-0484/
610
+ - **Real Python**: https://realpython.com/
611
+ - **Python Docs**: https://docs.python.org/3/
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: python-django-stack
3
- name: Python Django Stack
3
+ name: python-django-stack
4
4
  description: >
5
5
  Python and Django conventions for multi-tenant SaaS POS projects:
6
6
  views, services, naming, JSON APIs, PDFs, and cart patterns.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: python-fastapi-stack
3
- name: Python FastAPI Stack
3
+ name: python-fastapi-stack
4
4
  description: >
5
5
  FastAPI conventions for REST APIs: routers, Pydantic v2 schemas, dependency
6
6
  injection, error handling, pagination, and project structure.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: security
3
- name: Security
3
+ name: security
4
4
  description: >
5
5
  Provides expert knowledge for implementing and reviewing application security following OWASP Top 10 (2021), with stack-specific patterns for Spring Boot, Django, Next.js, and Astro.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: seo-analytics-injector
3
- name: SEO Analytics Injector
3
+ name: seo-analytics-injector
4
4
  description: >
5
5
  Verifies and injects Google Tag Manager (GTM), GA4 event triggers, and optimized meta tags.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: spring-auth-auditor
3
- name: Spring Auth Auditor
3
+ name: spring-auth-auditor
4
4
  description: >
5
5
  Secures Spring Security filters, JWT validations, OAuth2 setups, and CORS/CSRF headers.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: spring-boot-feature
3
- name: Spring Boot Feature Creation
3
+ name: spring-boot-feature
4
4
  description: >
5
5
  Guides the creation of complete Spring Boot features following a structured,
6
6
  layer-by-layer workflow: entity, repository, service, controller, and tests.
@@ -43,10 +43,8 @@ outputs:
43
43
  quality:
44
44
  reviewed_by: codeconductor-core
45
45
  version: 0.1.0
46
- paths:
47
- - "**/*.kt"
48
- - "**/build.gradle.kts"
49
46
  ---
47
+
50
48
  # Spring Boot Feature Creation
51
49
 
52
50
  When asked to create a feature, follow these steps **in order**. Do not skip
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: spring-boot-kotlin
3
- name: Spring Boot + Kotlin
3
+ name: spring-boot-kotlin
4
4
  description: >
5
5
  Provides expert knowledge of Spring Boot conventions, Kotlin idioms, and MVC
6
6
  patterns for backend API development.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: spring-boot-testing-strategy
3
- name: Spring Boot Testing Strategy
3
+ name: spring-boot-testing-strategy
4
4
  description: >
5
5
  Provides expert knowledge of the testing pyramid, test design principles, MockK patterns, and integration testing conventions for Spring Boot + Kotlin projects.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: sqlalchemy
3
- name: SQLAlchemy
3
+ name: sqlalchemy
4
4
  description: >
5
5
  SQLAlchemy 2.x patterns for async FastAPI projects: models, sessions, queries,
6
6
  bulk operations, transactions, and Alembic migrations.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: tailwind-responsive-auditor
3
- name: Tailwind Responsive Auditor
3
+ name: tailwind-responsive-auditor
4
4
  description: >
5
5
  Audits Tailwind CSS usage ensuring mobile-first responsive utilities and clean classes.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: tdd-mutation-tester
3
- name: TDD Mutation Tester
3
+ name: tdd-mutation-tester
4
4
  description: >
5
5
  Performs simple mutation testing to verify test coverage and assertions.
6
6
  user-invokable: true
@@ -208,5 +208,5 @@ Report completion: Task Cards executed, scorecard verdict, change folder path, f
208
208
 
209
209
  ## Skill
210
210
 
211
- Apply `.claude/skills/openspec/SKILL.md` for backlog format rules and state transitions.
211
+ Apply `.gemini/skills/openspec/SKILL.md` for backlog format rules and state transitions.
212
212
  """
@@ -66,9 +66,8 @@ the following steps in order:
66
66
  the output filename: `{YYYY-MM-DD}_pagespeed-{hostname}-claude.md`.
67
67
 
68
68
  2. **Collect** — Call the PageSpeed Insights API for the requested strategy
69
- (`mobile`, `desktop`, or `both`). Prefer the Bun scripts in
70
- `~/.claude/skills/pagespeed-perf/scripts/run.ts` if Bun is available.
71
- Otherwise, use `WebFetch` to call the PSI endpoint directly.
69
+ (`mobile`, `desktop`, or `both`) using `WebFetch` to call the PSI endpoint
70
+ directly.
72
71
 
73
72
  3. **Analyze** — Extract Core Web Vitals (LCP, INP, CLS, FCP, TTFB, TBT),
74
73
  identify the LCP element, enumerate third-party scripts by blocking time,
@@ -110,6 +110,37 @@ Evaluate the diff against the following checklist:
110
110
 
111
111
  ---
112
112
 
113
+ ## Severity Rubric
114
+
115
+ Classify every finding using these concrete anchors — not general judgment —
116
+ so the same finding gets the same category on any run.
117
+
118
+ **CRITICAL** (always):
119
+
120
+ - Unauthenticated access to a protected resource
121
+ - Injection (SQL, command, XSS) reachable from untrusted input
122
+ - A secret or credential present in the diff
123
+ - A destructive operation with no confirmation
124
+ - The build or test suite is broken
125
+ - A direct contradiction of an explicit acceptance criterion
126
+
127
+ **WARNING**:
128
+
129
+ - Missing test for a new branch or edge case
130
+ - An error is silently swallowed — no log, no propagation
131
+ - A change outside the declared scope
132
+ - Inconsistent with an established pattern already in the module
133
+ - Missing input validation in an internal function (not exposed at a trust boundary)
134
+
135
+ **SUGGESTION**:
136
+
137
+ - Style or naming
138
+ - Minor readability
139
+ - Speculative refactor that wasn't requested
140
+ - Non-blocking micro-optimization
141
+
142
+ ---
143
+
113
144
  ## Step 3 — Review Report
114
145
 
115
146
  Produce a structured Review Report with findings in three categories:
@@ -59,7 +59,7 @@ If `graphify-out/graph.json` exists, run `graphify query "{{args}}"` (and
59
59
  `graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`
60
60
  to map modules, conventions, and impact radius. Do not write code in this step.
61
61
  Record a Repo Map artifact before intake. Load the matching `security-*` skill
62
- for the named domain (see `.claude/skills/security-*/SKILL.md`). Keep the OWASP
62
+ for the named domain (see `.gemini/skills/security-*/SKILL.md`). Keep the OWASP
63
63
  `security` skill for application-security reviews.
64
64
 
65
65
  ---
@@ -2,8 +2,8 @@
2
2
 
3
3
  ## Model Selection Guide
4
4
 
5
- This preset supports both **Claude (Anthropic)** and **OpenCode Go (Chinese
6
- providers)** models.
5
+ This preset uses the four requested **OpenCode Go** models. Claude (Anthropic)
6
+ can be selected as an explicit override.
7
7
 
8
8
  ---
9
9
 
@@ -13,37 +13,39 @@ providers)** models.
13
13
 
14
14
  | Model | Strength | Best For |
15
15
  | --------------------------- | ------------------------------- | ------------------------------- |
16
- | `claude-opus-4-7` | Complex reasoning, architecture | Architect, complex design |
17
- | `claude-sonnet-4-6` | Balanced, general purpose | Default for most agents |
16
+ | `claude-opus-5` | Complex reasoning, architecture | Architect, complex design |
17
+ | `claude-sonnet-5` | Balanced, general purpose | Implementation, testing |
18
18
  | `claude-haiku-4-5-20251001` | Fast, lightweight | Task Coach, Docs, Repo Explorer |
19
19
 
20
20
  ### OpenCode Go models
21
21
 
22
- Canonical slugs live in `src/presets/models/*.yml`. Production roles never use
23
- `muse-spark-1.2-contributor` (trains on prompts). `ox-alpha-free` is an optional
24
- fallback, not a default.
22
+ Canonical role assignments live in `src/presets/models/roles.yml`. Model IDs
23
+ were verified against [OpenCode Go](https://opencode.ai/docs/go/) and the live
24
+ catalog on September 25, 2026.
25
25
 
26
26
  | Model | Best for |
27
27
  | --- | --- |
28
- | `deepseek-v4-pro` | Architect |
29
- | `kimi-k3` | Security reviewer |
30
- | `qwen3.8-max` | Reviewer, contract-builder |
31
- | `glm-5.3` | Devil, complexity-auditor |
32
- | `mimo-v2.5` | Implementer |
33
- | `minimax-m3` | Tester |
34
- | `qwen3.7-plus` | Orchestrator (TUI default) |
35
- | `gpt-5.6-luna` | Task coach, planner |
36
- | `deepseek-v4-flash` | Goal planner |
37
- | `longcat-2.0` | Repo explorer |
38
- | `hy3` | Docs |
28
+ | `opencode-go/deepseek-v4.1-flash` | Architect, reviewer, contract-builder, orchestrator (TUI default), planner, goal-planner |
29
+ | `opencode-go/mimo-v2.6-flash` | Implementer, tester |
30
+ | `opencode-go/glm-5.3-flash` | Security-reviewer, devil, complexity-auditor, task-coach, repo-explorer |
31
+ | `opencode-go/muse-spark-1.3-contributor` | Docs |
32
+
33
+ These assignments are workflow choices, not a provider ranking. Generated
34
+ agents leave sampling and reasoning settings at provider defaults rather than
35
+ copying Claude-specific `effort` or forcing a shared `temperature` onto different
36
+ models. No unverified variants are configured.
37
+
38
+ Muse Contributor is included at the request of the maintainer. OpenCode documents
39
+ that it uses prompts/completions for training, is not ZDR, and has regional
40
+ restrictions. Do not send confidential material to that model; override the docs
41
+ agent with another verified model when required.
39
42
 
40
43
  ---
41
44
 
42
45
  ## Agent Model Matrix
43
46
 
44
- See `skills/cc-update-preset-models/references/role-map.md`. OpenCode column
45
- examples: architect `deepseek-v4-pro`, implementer `mimo-v2.5`, tester
46
- `minimax-m3`, reviewer `qwen3.8-max`.
47
+ See `skills/cc-update-preset-models/references/role-map.md` for the complete
48
+ cross-preset role matrix.
47
49
 
48
50
  ---
49
51
 
@@ -66,6 +68,10 @@ examples: architect `deepseek-v4-pro`, implementer `mimo-v2.5`, tester
66
68
 
67
69
  This preset uses OpenCode's permission system (v1.1.1+) with granular control:
68
70
 
71
+ Keep the V1-compatible `permission` dictionary for the `opencode` CLI. V2's
72
+ `permissions` rule list is exclusive to `opencode2` and is rejected by OpenCode
73
+ V1. Validate generated files with the actual CLI version before migrating formats.
74
+
69
75
  - **Global defaults**: Most operations require approval (`ask`)
70
76
  - **Read access**: Allowed by default, with sensitive files denied
71
77
  - **Write/Edit**: Requires approval, with protected paths denied
@@ -87,8 +93,8 @@ The following paths are denied by default:
87
93
 
88
94
  ### Simple Tasks (Q&A, intake, documentation)
89
95
 
90
- **Recommended:** `qwen3.6-plus` (OpenCode Go) or `claude-haiku-4-5-20251001`
91
- (Claude)
96
+ **Preset choice:** `glm-5.3-flash` for intake/exploration;
97
+ `muse-spark-1.3-contributor` for non-confidential docs.
92
98
 
93
99
  - Task Coach intake
94
100
  - Repo Explorer mapping
@@ -96,8 +102,8 @@ The following paths are denied by default:
96
102
 
97
103
  ### Medium Tasks (Implementation, testing)
98
104
 
99
- **Recommended:** `mimo-v2.5` or `minimax-m3` (OpenCode Go) or
100
- `claude-sonnet-4-6` (Claude)
105
+ **Preset choice:** `mimo-v2.6-flash` for implementation and testing;
106
+ `deepseek-v4.1-flash` for reviews.
101
107
 
102
108
  - Implementer code writing
103
109
  - Tester test generation
@@ -105,7 +111,8 @@ The following paths are denied by default:
105
111
 
106
112
  ### Complex Tasks (Architecture, security, multi-agent coordination)
107
113
 
108
- **Recommended:** `deepseek-v4-pro` (OpenCode Go) or `claude-opus-4-7` (Claude)
114
+ **Preset choice:** `deepseek-v4.1-flash` for design/coordination;
115
+ `glm-5.3-flash` for defensive security review.
109
116
 
110
117
  - Architect technical design
111
118
  - Orchestrator routing decisions
@@ -115,17 +122,14 @@ The following paths are denied by default:
115
122
 
116
123
  ## Usage in Agent Contracts
117
124
 
118
- Each agent file in `agents/` contains a model selection table in its
119
- frontmatter:
125
+ Agent templates contain placeholders. Installation resolves the role model
126
+ into YAML frontmatter:
120
127
 
121
128
  ```yaml
122
129
  ---
123
130
  description: ...
124
- # Model Selection
125
- | Provider | Model | Use Case |
126
- |----------|-------|----------|
127
- | Claude | claude-opus-4-7 | Complex architecture, ADRs |
128
- | OpenCode Go | deepseek-v4-pro | Best — excels at reasoning |
131
+ model: opencode-go/deepseek-v4.1-flash
132
+ mode: subagent
129
133
  ---
130
134
  ```
131
135
 
@@ -144,21 +148,10 @@ configuration in `opencode.jsonc`.
144
148
 
145
149
  ## Environment Variables
146
150
 
147
- OpenCode Go requires appropriate API keys. Set these in your environment:
148
-
149
- ```bash
150
- # DeepSeek
151
- export DEEPSEEK_API_KEY="your-key"
152
-
153
- # Qwen (Alibaba)
154
- export DASHSCOPE_API_KEY="your-key"
155
-
156
- # MiniMax
157
- export MINIMAX_API_KEY="your-key"
158
-
159
- # Kimi (Moonshot)
160
- export KIMI_API_KEY="your-key"
161
- ```
151
+ Connect to **OpenCode Go** through `/connect` and use the Go API key. The
152
+ `opencode-go/` provider does not use individual DeepSeek, GLM, MiMo, or Meta keys.
153
+ Do not store API keys in the preset. Run `opencode models opencode-go` to check
154
+ availability before using or overriding a role model.
162
155
 
163
156
  ---
164
157
 
@@ -166,10 +159,10 @@ export KIMI_API_KEY="your-key"
166
159
 
167
160
  | Scenario | Recommended |
168
161
  | ------------------------------- | -------------------------------------------------- |
169
- | Complex reasoning, architecture | OpenCode Go (`deepseek-v4-pro`) or Claude (`opus`) |
170
- | Fast iteration, simple tasks | OpenCode Go (`qwen3.6-plus`) or Claude (`haiku`) |
171
- | Code implementation | OpenCode Go (`mimo-v2.5`) or Claude (`sonnet`) |
172
- | Budget constraints | OpenCode Go (generally lower cost) |
162
+ | Complex reasoning, architecture | OpenCode Go (`deepseek-v4.1-flash`) or Claude (`opus`) |
163
+ | Fast iteration, simple tasks | OpenCode Go (`glm-5.3-flash`) or Claude (`haiku`) |
164
+ | Code implementation | OpenCode Go (`mimo-v2.6-flash`) or Claude (`sonnet`) |
165
+ | Non-confidential documentation | OpenCode Go (`muse-spark-1.3-contributor`) |
173
166
  | Availability issues | Switch to alternative from the matrix |
174
167
 
175
168
  ## Approach
@@ -39,9 +39,8 @@ without a key, but CrUX field data requires it.
39
39
  Call the PageSpeed Insights API for the URL provided above.
40
40
 
41
41
  - Strategy: `both` (mobile + desktop) unless the user specified otherwise.
42
- - If Bun is available, use `~/.claude/skills/pagespeed-perf/scripts/run.ts`.
43
- - If Bun is unavailable, call PSI directly via WebFetch and fetch the HTML
44
- source for manual resource-hint analysis.
42
+ - Call PSI directly via WebFetch and fetch the HTML source for manual
43
+ resource-hint analysis.
45
44
 
46
45
  ---
47
46
 
@@ -118,6 +118,37 @@ reviewer must evaluate the diff against the following checklist:
118
118
 
119
119
  ---
120
120
 
121
+ ## Severity Rubric
122
+
123
+ Classify every finding using these concrete anchors — not general judgment —
124
+ so the same finding gets the same category on any run.
125
+
126
+ **CRITICAL** (always):
127
+
128
+ - Unauthenticated access to a protected resource
129
+ - Injection (SQL, command, XSS) reachable from untrusted input
130
+ - A secret or credential present in the diff
131
+ - A destructive operation with no confirmation
132
+ - The build or test suite is broken
133
+ - A direct contradiction of an explicit acceptance criterion
134
+
135
+ **WARNING**:
136
+
137
+ - Missing test for a new branch or edge case
138
+ - An error is silently swallowed — no log, no propagation
139
+ - A change outside the declared scope
140
+ - Inconsistent with an established pattern already in the module
141
+ - Missing input validation in an internal function (not exposed at a trust boundary)
142
+
143
+ **SUGGESTION**:
144
+
145
+ - Style or naming
146
+ - Minor readability
147
+ - Speculative refactor that wasn't requested
148
+ - Non-blocking micro-optimization
149
+
150
+ ---
151
+
121
152
  ## Step 3 — Review Report
122
153
 
123
154
  reviewer produces a structured Review Report with findings in three categories:
@@ -62,7 +62,7 @@ If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"` (and
62
62
  `graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`
63
63
  to map modules, conventions, and impact radius. Do not write code in this step.
64
64
  Record a Repo Map artifact before intake. Load the matching `security-*` skill
65
- for the named domain (see `.claude/skills/security-*/SKILL.md`). Keep the OWASP
65
+ for the named domain (see `.opencode/skills/security-*/SKILL.md`). Keep the OWASP
66
66
  `security` skill for application-security reviews.
67
67
 
68
68
  ---
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "$schema": "https://opencode.ai/config.json",
3
- "model": "opencode-go/qwen3.7-plus",
3
+ "model": "opencode-go/deepseek-v4.1-flash",
4
4
  "permission": {
5
5
  "*": "ask",
6
6
  "read": {
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: android
3
- name: Android + Kotlin (Jetpack Compose & Media3)
3
+ name: android
4
4
  description: >
5
5
  Provides expert knowledge for building modern native Android apps using Kotlin, Jetpack Compose, Material Design 3, MVI architecture, Hilt dependency injection, and Media3/ExoPlayer.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: api-versioning
3
- name: API Versioning
3
+ name: api-versioning
4
4
  description: >
5
5
  Provides expert knowledge for designing, implementing, and managing REST API
6
6
  versioning strategies with deprecation workflows.
@@ -39,6 +39,7 @@ quality:
39
39
  reviewed_by: codeconductor-core
40
40
  version: 0.1.0
41
41
  ---
42
+
42
43
  # API Versioning
43
44
 
44
45
  ## Versioning Strategies
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: astro
3
- name: Astro
3
+ name: astro
4
4
  description: >
5
5
  Provides expert knowledge for building Astro 5+ sites with Islands Architecture, Content Collections, TypeScript, and performance-first rendering strategies.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: auth-token-inspector
3
- name: Auth Token Inspector
3
+ name: auth-token-inspector
4
4
  description: >
5
5
  Audits token storage mechanisms to prevent XSS-based JWT theft.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: code-review
3
- name: Code Review
3
+ name: code-review
4
4
  description: >
5
5
  Provides a structured framework for conducting thorough code reviews covering correctness, security, architecture alignment, performance, and technical debt.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: django-orm
3
- name: Django ORM
3
+ name: django-orm
4
4
  description: >
5
5
  Django ORM patterns for multi-tenant POS projects: efficient queries,
6
6
  bulk operations, transactions, and multi-schema upload paths.
@@ -41,6 +41,7 @@ quality:
41
41
  reviewed_by: codeconductor-core
42
42
  version: 0.1.0
43
43
  ---
44
+
44
45
  ## When to Use
45
46
 
46
47
  - Writing or reviewing queryset code in any `apps/*/`
@@ -456,5 +457,4 @@ def on_order_save(sender, instance, created, **kwargs):
456
457
  - **Annotation examples**: `apps/pos/views.py` lines 59-75
457
458
  - **Exists usage**: `apps/catalog/views.py` line 112
458
459
  - **Upload paths**: `apps/catalog/models.py`
459
- - **Django ORM docs**:
460
- <https://docs.djangoproject.com/en/5.2/topics/db/queries/>
460
+ - **Django ORM docs**: https://docs.djangoproject.com/en/5.2/topics/db/queries/
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: django-testing
3
- name: Django Testing
3
+ name: django-testing
4
4
  description: >
5
5
  Testing patterns for multi-tenant Django POS projects using pytest-django,
6
6
  RequestFactory, and mocks. No factories, no complex conftest.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: django-uv
3
- name: Django + UV
3
+ name: django-uv
4
4
  description: >
5
5
  Provides expert knowledge for building Django 5+ projects with UV as the package manager, domain-driven app structure, ruff for linting, and pytest-django for testing.
6
6