claude-code-pilot 3.1.1 → 3.3.0

package/CHANGELOG.md

@@ -0,0 +1,57 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [3.3.0] - 2026-06-29
+
+The Resync II — a post-v3.2 audit + cherry-pick of high-value additions from the ECC (2.0.0-rc.1) and GSD (1.42.1) upstreams, behind three mandatory preflight gates, followed by a full GSD↔ECC coherence pass. Drop-in upgrade from v3.2.x.
+
+### Added
+- ~14 P1 ECC skills cherry-picked into `src/skills/` (angular-developer, fastapi-patterns, vite-patterns, mysql-patterns, prisma-patterns, error-handling, and ~8 more)
+- GSD MVP-mode: `/ccp:mvp-phase` command + 10 reference docs (SPIDR story-splitting, mvp-concepts, planner/verify/execute MVP modes, story + skeleton templates, and more)
+- 6 paired reviewer/build-resolver agents (fastapi-reviewer, fsharp-reviewer, swift-reviewer, django-reviewer, swift-build-resolver, django-build-resolver)
+- 3 ECC commands under `/ccp:`: `/ccp:pr-ecc`, `/ccp:plan-prd`, `/ccp:cost-report`
+- AgentShield external wrap: `/ccp:security-scan` thin wrapper (shells to `npx ecc-agentshield scan`), opt-in `_agentshield` `.mcp.json` stanza, `manifest.json` `external.agentshield` entry (pinned v1.4.0), and a 5-file policy-schema reference asset under `src/skills/security-scan/references/`
+- Re-authored standalone `ccp-*` hooks: `ccp-pre-bash-dispatcher`, `ccp-write-gateguard` (+ `src/lib/shell-substitution.js`), `ccp-doc-file-warning` (18 event hooks total, each with a unique fingerprint)
+- Context-monitor cost-warning opt-out via the `CCP_CONTEXT_MONITOR_COST_WARNINGS` environment variable
+- `tests/lib/13-migration-v32-v33.test.js` — v3.2→v3.3 migration test asserting the hook and file deltas
+
+### Changed
+- Upstream sync: GSD 1.42.1 (`d4d4178`) and ECC 2.0.0-rc.1 (`744f4169`) pinned in `manifest.json`
+- Full GSD↔ECC coherence pass: brand-leak-zero on the installed surface, hook fingerprint uniqueness, and manifest allowlist enforcement
+- `agent-harness-construction` renamed to `agent-harness-design`; the `pr` ECC command landed as `/ccp:pr-ecc` so it coexists with the existing `/ccp:pr-branch`
+- Installed file count is now ~678 (up from ~594)
+
+### Breaking Changes
+- None. v3.3.0 is a drop-in upgrade from v3.2.x — `npx claude-code-pilot@3.3.0 --update` preserves a customized CLAUDE.md and existing settings.
+
+### Migration
+- Run `npx claude-code-pilot@3.3.0 --update`. The installer removes any legacy `gsd-` fingerprinted hooks and registers the new `ccp-*` hooks idempotently — no manual steps required.
+- Excluded items are deferred to v3.4: the `chief-of-staff` agent, `harmonyos-build-resolver`, and the GSD `surface` / `ns-*` / `runtime-artifact-layout` namespace tooling.
+
+## [2.0.0] - 2026-03-18
+
+### Added
+- One-command install via `npx claude-code-pilot` for any project
+- Bundled GSD v1.22.4 (Get Shit Done methodology -- 32 commands, 12 agents, planning workflows)
+- Bundled ECC v1.8.0 (Everything Claude Code toolbox -- 9 commands, 6 agents, language rules, continuous learning)
+- Auto-setup wizard (`/setup`) with source directory detection and MCP auto-configuration
+- External tool integration: find-skills (Vercel Labs) and Context7 MCP (Upstash)
+- Automated test harness with 12 tests validating install, update, uninstall, and path handling
+- GitHub Actions CI with Node.js version matrix (20, 22), tarball validation, and smoke testing
+- Support for both `--local` (project-scoped) and `--global` installations
+- `--update` flag for idempotent upgrades (preserves customized CLAUDE.md, deduplicates hooks)
+- `--uninstall` flag for clean removal (preserves CLAUDE.md and settings.json)
+- Path replacement system ensuring `./.claude/` paths for local installs
+- ECC getClaudeDir() patching for install-location-aware hook execution
+- Zero runtime dependencies -- uses only Node.js stdlib (fs, path, os, child_process)
+
+### Changed
+- Package architecture: source IS the product (no build step)
+- Minimum Node.js version: 16.7.0
+
+### Breaking Changes
+- First major release -- no prior stable version to break from

package/README.md

@@ -1,6 +1,6 @@
 # Claude Code Pilot
 
-Universal Claude Code configuration for any project. One-command install, auto-setup wizard, 101 commands, 51 agents, 87 skills.
+Universal Claude Code configuration for any project. One-command install, auto-setup wizard, 122 commands, 67 agents, 127 skills.
 
 ## Install
 
@@ -35,17 +35,17 @@ claude -> /ccp:setup               <- wizard scans codebase, generates CLAUDE.md
 /ccp:update                        <- update everything
 ```
 
-## What's Included (~494 files after install)
+## What's Included (~678 files after install)
 
 | Category | Count | Description |
 |----------|-------|-------------|
-| `/ccp:` commands | 101 | Development lifecycle, quality gates, session management, learning |
-| Agents | 51 | Planning, execution, review, testing, security, documentation |
-| Skill packs | 87 | Continuous learning, verification, strategic compaction, and more |
-| Hooks | 15 | 14 event + 1 statusLine: safety guards, context management, notifications, session persistence |
+| `/ccp:` commands | 122 | Development lifecycle, quality gates, session management, learning |
+| Agents | 67 | Planning, execution, review, testing, security, documentation |
+| Skill packs | 127 | Continuous learning, verification, strategic compaction, and more |
+| Hooks | 19 | 18 event + 1 statusLine: safety guards, context management, notifications, session persistence |
 | Common rules | 10 | Always active (coding style, security, testing, performance, etc.) |
 | Chinese language rules | 11 | Always active (zh/ translations of common rules) |
-| Language-specific rule sets | 11 | Activated by `/ccp:setup` (see Language Rules below) |
+| Language-specific rule sets | 13 | Activated by `/ccp:setup` (see Language Rules below) |
 | Context modes | 3 | dev, research, review |
 | Reference examples | 6 | CLAUDE.md examples for different project types |
 
@@ -63,12 +63,17 @@ claude -> /ccp:setup               <- wizard scans codebase, generates CLAUDE.md
 | `/ccp:resume-session` | Load previous session context |
 | `/ccp:learn` | Extract reusable patterns from session |
 | `/ccp:evolve` | Promote learned instincts into skills, commands, or agents |
+| `/ccp:mvp-phase N` | Plan a phase as a vertical MVP slice (user story + SPIDR splitting) |
+| `/ccp:security-scan` | Scan `.claude/` config for security issues via AgentShield (opt-in `npx`) |
+| `/ccp:plan-prd` | Generate a lean, problem-first PRD and hand off to planning |
+| `/ccp:cost-report` | Generate a local Claude Code cost report from a cost-tracker DB |
+| `/ccp:pr-ecc` | Create a GitHub PR from the current branch's unpushed commits |
 
-Run `/ccp:help` for the full list of all 101 commands.
+Run `/ccp:help` for the full list of all 122 commands.
 
-## Hooks (15 total)
+## Hooks (19 total)
 
-14 event hooks and 1 statusLine, all registered automatically during install.
+18 event hooks and 1 statusLine, all registered automatically during install.
 
 | Hook | Event | Description |
 |------|-------|-------------|
@@ -92,7 +97,7 @@ Run `/ccp:help` for the full list of all 101 commands.
 
 10 common rules are always active. 11 language-specific rule sets are available in `available-rules/` and activated by the `/ccp:setup` wizard when it detects your project language.
 
-Available language rule sets: TypeScript, Python, Go, Swift, Kotlin, PHP, Perl, Java, C++, C#, Rust.
+Available language rule sets: TypeScript, Python, Go, Swift, Kotlin, PHP, Perl, Java, C++, C#, Rust, Dart, Web.
 
 ## Self-Updating
 

package/bin/install.js

@@ -99,6 +99,10 @@ const MCP_TEMPLATE = {
       "command": "codebase-memory-mcp",
       "args": [],
       "_install": "curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash"
+    },
+    "_agentshield": {
+      "_comment": "OPT-IN: AgentShield security scanner (external, not vendored). Run via /ccp:security-scan or `npx ecc-agentshield scan`. This entry is inert (underscore-prefixed); rename to enable. AgentShield ships a `scan` CLI, not an MCP server.",
+      "_install": "npx ecc-agentshield scan --path ."
     }
   }
 };
@@ -122,11 +126,28 @@ function copyDir(srcDir, destDir, opts = {}) {
     if (entry.isDirectory()) {
       count += copyDir(s, d, opts);
     } else {
+      // Hook-version substitution applies to any hook file (.sh or .js) carrying
+      // the {{CCP_VERSION}} placeholder. Combined with .md/.sh path replacement.
+      const isHookFile = /[\\/]hooks[\\/]/.test(d);
       if (replacePaths && (entry.name.endsWith('.md') || entry.name.endsWith('.sh'))) {
         let text = fs.readFileSync(s, 'utf8');
         text = text.replace(/~\/\.claude\//g, pathPrefix);
         text = text.replace(/\$HOME\/\.claude\//g, pathPrefix);
+        text = text.replace(/\$\{CLAUDE_PLUGIN_ROOT\}/g, pathPrefix.replace(/\/$/, ''));
+        text = text.replace(/\{\{CCP_VERSION\}\}/g, pkg.version);
         fs.writeFileSync(d, text);
+      } else if (isHookFile && entry.name.endsWith('.js')) {
+        // .js hook files: substitute version + plugin-root placeholders if
+        // present. Otherwise raw-copy to preserve byte-identical content.
+        const raw = fs.readFileSync(s, 'utf8');
+        if (raw.includes('{{CCP_VERSION}}') || raw.includes('${CLAUDE_PLUGIN_ROOT}')) {
+          let text = raw;
+          text = text.replace(/\$\{CLAUDE_PLUGIN_ROOT\}/g, pathPrefix.replace(/\/$/, ''));
+          text = text.replace(/\{\{CCP_VERSION\}\}/g, pkg.version);
+          fs.writeFileSync(d, text);
+        } else {
+          fs.copyFileSync(s, d);
+        }
       } else {
         fs.copyFileSync(s, d);
       }
@@ -152,6 +173,17 @@ function copyFile(s, d, replace = false) {
 function addHookIfMissing(settings, event, matcher, fingerprint, hookCmd, description) {
   if (!settings.hooks) settings.hooks = {};
   if (!settings.hooks[event]) settings.hooks[event] = [];
+  let updated = false;
+  for (const entry of settings.hooks[event]) {
+    for (const h of entry.hooks || []) {
+      if (h.command && h.command.includes(fingerprint) && h.command !== hookCmd) {
+        // Stale hook with our fingerprint but different command (e.g. relative path
+        // from older install, or absolute path from a different machine). Replace it.
+        h.command = hookCmd;
+        updated = true;
+      }
+    }
+  }
   const exists = settings.hooks[event].some(e =>
     e.hooks?.some(h => h.command?.includes(fingerprint))
   );
@@ -162,7 +194,7 @@ function addHookIfMissing(settings, event, matcher, fingerprint, hookCmd, descri
     settings.hooks[event].push(entry);
     return true;
   }
-  return false;
+  return updated;
 }
 
 // --- Migration ---
@@ -171,9 +203,63 @@ const LEGACY_HOOK_FINGERPRINTS = [
   'gsd-context-monitor',
   'gsd-check-update',
   'gsd-statusline',
-  'kit-check-update'
+  // Phase 33 GATE-12: parent of Phase 32 -pre/-failure split (commit 8742c81).
+  // Strips stale v3.2 'hooks/mcp-health-check' registrations on --update.
+  // CRITICAL: removeLegacyHooks MUST run before addHookIfMissing in install()
+  // body — the two new fingerprints contain this string as substring and would
+  // be wrongly stripped if order is flipped. See bin/install.js:272 vs :345,:360.
+  'hooks/mcp-health-check'
 ];
 
+// Allowlist source-of-truth: .planning/phases/31-audit-scope/31-ALLOWLIST.md. Drift caught by tests/lib/06-phase-33-gates.test.js.
+const ALLOWLIST = {
+  ecc_exclude_paths: [
+    'ecc2/',
+    '.opencode/',
+    'ecc-tools.json',
+    'assets/',
+    'docs/business/',
+    'docs/releases/',
+    'tests/docs/',
+    'hooks/hooks.json'
+  ],
+  gsd_exclude_patterns: [
+    'runtimes/',
+    'runtime-artifact-layout.cjs',
+    'ns-*'
+  ]
+};
+
+// Pure: returns true if relPath is NOT excluded by source's allowlist patterns.
+function isPathAllowed(relPath, source) {
+  if (typeof relPath !== 'string' || !relPath) return false;
+  if (source !== 'ecc' && source !== 'gsd') {
+    throw new Error('isPathAllowed: source must be "ecc" or "gsd", got ' + JSON.stringify(source));
+  }
+  const list = source === 'ecc'
+    ? ALLOWLIST.ecc_exclude_paths
+    : ALLOWLIST.gsd_exclude_patterns;
+  for (const pat of list) {
+    if (pat.endsWith('*')) {
+      const prefix = pat.slice(0, -1);
+      if (relPath.startsWith(prefix)) return false;
+    } else if (relPath === pat || relPath.startsWith(pat)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// Throws if relPath is excluded; used as a guard at cherry-pick call sites.
+function assertAllowed(relPath, source) {
+  if (!isPathAllowed(relPath, source)) {
+    throw new Error(
+      '[allowlist] Refused to cherry-pick "' + relPath + '" from ' + source +
+      ' — excluded by .planning/phases/31-audit-scope/31-ALLOWLIST.md'
+    );
+  }
+}
+
 const LEGACY_DIRS = [
   'gsd', 'ecc', 'kit', 'commands/gsd',
   'get-shit-done', 'ecc-scripts', 'ecc-examples', 'kit-version'
@@ -294,7 +380,7 @@ function install() {
   }
 
   // =======================================
-  // Hook registration (14 event hooks + 1 statusLine)
+  // Hook registration (15 event hooks + 1 statusLine)
   // =======================================
 
   // Safety hooks
@@ -312,7 +398,10 @@ function install() {
     'Config protection');
 
   // MCP health check (PreToolUse)
-  addHookIfMissing(settings, 'PreToolUse', 'mcp_', 'hooks/mcp-health-check',
+  // Phase 32 GATE-08: disambiguated from prior shared fingerprint
+  // 'hooks/mcp-health-check'. Phase 33 GATE-12 extends LEGACY_HOOK_FINGERPRINTS
+  // to clean up stale v3.2 registrations on --update.
+  addHookIfMissing(settings, 'PreToolUse', 'mcp_', 'hooks/mcp-health-check-pre',
     `node ${pathPrefix}hooks/mcp-health-check.js`,
     'MCP health check');
 
@@ -321,8 +410,13 @@ function install() {
     `node ${pathPrefix}hooks/ccp-context-monitor.js`,
     'CCP context window monitor');
 
+  // Read injection scanner -- advisory hook fired on Read tool returns
+  addHookIfMissing(settings, 'PostToolUse', 'Read', 'ccp-read-injection-scanner',
+    `node ${pathPrefix}hooks/ccp-read-injection-scanner.js`,
+    'Read content injection scanner (advisory)');
+
   // MCP health check (PostToolUseFailure)
-  addHookIfMissing(settings, 'PostToolUseFailure', 'mcp_', 'hooks/mcp-health-check',
+  addHookIfMissing(settings, 'PostToolUseFailure', 'mcp_', 'hooks/mcp-health-check-failure',
     `node ${pathPrefix}hooks/mcp-health-check.js`,
     'MCP health check (failure recovery)');
 
@@ -350,13 +444,31 @@ function install() {
     `node ${pathPrefix}hooks/suggest-compact.js`,
     'Strategic compact suggestions');
 
-  // Notifications
+  // Phase 38 (HOOK-01/03/04): ECC hook behaviors re-authored as standalone
+  // ccp-* scripts (no plugin-discovery resolver). Fingerprints verified
+  // substring-collision-safe vs existing + LEGACY_HOOK_FINGERPRINTS.
+  addHookIfMissing(settings, 'PreToolUse', 'Bash', 'ccp-pre-bash-dispatcher',
+    `node ${pathPrefix}hooks/ccp-pre-bash-dispatcher.js`,
+    'CCP pre-bash dispatcher chain (GateGuard Bash branch)');
+
+  addHookIfMissing(settings, 'PreToolUse', 'Write|Edit|MultiEdit', 'ccp-write-gateguard',
+    `node ${pathPrefix}hooks/ccp-write-gateguard.js`,
+    'CCP GateGuard fact-forcing gate (opt-in: CCP_HOOK_PROFILE=strict)');
+
+  addHookIfMissing(settings, 'PreToolUse', 'Write', 'ccp-doc-file-warning',
+    `node ${pathPrefix}hooks/ccp-doc-file-warning.js`,
+    'CCP doc-file advisory (warns on ad-hoc doc filenames)');
+
+  // Notifications -- silent by default to avoid AudioFileOpen errors on systems
+  // missing system sounds. Set CCP_NOTIFY_SOUND=1 to opt back into sound.
+  // Cross-platform: macOS (terminal-notifier/osascript), Linux (notify-send),
+  // Windows (PowerShell BurntToast or msg).
   addHookIfMissing(settings, 'Stop', '', 'Task completed',
-    `bash -c 'if command -v terminal-notifier &>/dev/null; then terminal-notifier -title "Claude Code" -message "Task completed" -sound default; elif command -v osascript &>/dev/null; then osascript -e "display notification \\"Task completed\\" with title \\"Claude Code\\" sound name \\"Glass\\""; elif command -v notify-send &>/dev/null; then notify-send -u normal "Claude Code" "Task completed"; fi'`,
+    `bash -c 'if [ "$CCP_NOTIFY" = "0" ]; then exit 0; fi; SOUND_FLAG=""; OSASCRIPT_SOUND=""; if [ "$CCP_NOTIFY_SOUND" = "1" ]; then SOUND_FLAG="-sound default"; OSASCRIPT_SOUND=" sound name \\"Glass\\""; fi; if command -v terminal-notifier >/dev/null 2>&1; then terminal-notifier -title "Claude Code" -message "Task completed" $SOUND_FLAG 2>/dev/null; elif command -v osascript >/dev/null 2>&1; then osascript -e "display notification \\"Task completed\\" with title \\"Claude Code\\"$OSASCRIPT_SOUND" 2>/dev/null; elif command -v notify-send >/dev/null 2>&1; then notify-send -u normal "Claude Code" "Task completed" 2>/dev/null; elif command -v powershell.exe >/dev/null 2>&1; then powershell.exe -NoProfile -Command "[reflection.assembly]::LoadWithPartialName(\\"System.Windows.Forms\\") | Out-Null; \\$n = New-Object System.Windows.Forms.NotifyIcon; \\$n.Icon = [System.Drawing.SystemIcons]::Information; \\$n.Visible = \\$true; \\$n.ShowBalloonTip(3000, \\"Claude Code\\", \\"Task completed\\", \\"Info\\")" 2>/dev/null; fi; exit 0'`,
     'Notification: task completed');
 
   addHookIfMissing(settings, 'Notification', 'idle_prompt', 'Ready for input',
-    `bash -c 'if command -v terminal-notifier &>/dev/null; then terminal-notifier -title "Claude Code" -message "Ready for input" -sound default; elif command -v osascript &>/dev/null; then osascript -e "display notification \\"Ready for input\\" with title \\"Claude Code\\" sound name \\"Glass\\""; elif command -v notify-send &>/dev/null; then notify-send -u normal "Claude Code" "Ready for input"; fi'`,
+    `bash -c 'if [ "$CCP_NOTIFY" = "0" ]; then exit 0; fi; SOUND_FLAG=""; OSASCRIPT_SOUND=""; if [ "$CCP_NOTIFY_SOUND" = "1" ]; then SOUND_FLAG="-sound default"; OSASCRIPT_SOUND=" sound name \\"Glass\\""; fi; if command -v terminal-notifier >/dev/null 2>&1; then terminal-notifier -title "Claude Code" -message "Ready for input" $SOUND_FLAG 2>/dev/null; elif command -v osascript >/dev/null 2>&1; then osascript -e "display notification \\"Ready for input\\" with title \\"Claude Code\\"$OSASCRIPT_SOUND" 2>/dev/null; elif command -v notify-send >/dev/null 2>&1; then notify-send -u normal "Claude Code" "Ready for input" 2>/dev/null; elif command -v powershell.exe >/dev/null 2>&1; then powershell.exe -NoProfile -Command "[reflection.assembly]::LoadWithPartialName(\\"System.Windows.Forms\\") | Out-Null; \\$n = New-Object System.Windows.Forms.NotifyIcon; \\$n.Icon = [System.Drawing.SystemIcons]::Information; \\$n.Visible = \\$true; \\$n.ShowBalloonTip(3000, \\"Claude Code\\", \\"Ready for input\\", \\"Info\\")" 2>/dev/null; fi; exit 0'`,
     'Notification: idle prompt');
 
   addHookIfMissing(settings, 'Notification', 'permission_prompt', 'Permission needed',
@@ -443,6 +555,10 @@ function uninstall() {
 }
 
 // --- Main ---
-if (hasUninstall) { uninstall(); }
-else if (!hasGlobal && !hasLocal) { console.log(`  ${dim}Defaulting to local install (.claude/)${reset}\n`); install(); }
-else { install(); }
+if (require.main === module) {
+  if (hasUninstall) { uninstall(); }
+  else if (!hasGlobal && !hasLocal) { console.log(`  ${dim}Defaulting to local install (.claude/)${reset}\n`); install(); }
+  else { install(); }
+} else {
+  module.exports = { isPathAllowed, assertAllowed, ALLOWLIST };
+}

package/manifest.json

@@ -1,5 +1,17 @@
 {
-  "version": "3.1.1",
+  "version": "3.3.0",
+  "bundled": {
+    "gsd": {
+      "version": "1.42.1",
+      "commit": "d4d417860343421adacb141baef511cc2f0f43b1",
+      "source": "https://github.com/gsd-build/get-shit-done"
+    },
+    "ecc": {
+      "version": "2.0.0-rc.1",
+      "commit": "744f4169972fd81618c3114ea1ca5ffb85ef4c82",
+      "source": "https://github.com/affaan-m/everything-claude-code"
+    }
+  },
   "external": {
     "find-skills": {
       "install": "npx skills add https://github.com/vercel-labs/skills --skill find-skills -g -a claude-code -y",
@@ -12,6 +24,13 @@
     "codebase-memory-mcp": {
       "install": "curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash",
       "repo": "https://github.com/DeusData/codebase-memory-mcp"
+    },
+    "agentshield": {
+      "package": "ecc-agentshield",
+      "version": "1.4.0",
+      "commit": "bff08f0bcd5b8501b46a9bd9b493c4910379a3e2",
+      "invoke": "npx ecc-agentshield scan",
+      "repo": "https://github.com/affaan-m/agentshield"
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-pilot",
-  "version": "3.1.1",
+  "version": "3.3.0",
   "description": "Claude Code Pilot -- universal AI coding companion with spec-driven development, session persistence, and auto-setup.",
   "bin": {
     "claude-code-pilot": "bin/install.js"
@@ -9,7 +9,8 @@
     "bin",
     "src",
     "docs",
-    "manifest.json"
+    "manifest.json",
+    "CHANGELOG.md"
   ],
   "keywords": [
     "claude",
@@ -40,7 +41,7 @@
     "node": ">=16.7.0"
   },
   "scripts": {
-    "test": "node test/run.js",
+    "test": "node tests/run-all.js",
     "prepublishOnly": "node scripts/prepublish-checks.js"
   }
 }

package/src/agents/a11y-architect.md

@@ -0,0 +1,141 @@
+---
+name: a11y-architect
+description: Accessibility Architect specializing in WCAG 2.2 compliance for Web and Native platforms. Use PROACTIVELY when designing UI components, establishing design systems, or auditing code for inclusive user experiences.
+model: sonnet
+tools: ["Read", "Write", "Edit", "Bash", "Grep", "Glob"]
+model: opus
+---
+
+You are a Senior Accessibility Architect. Your goal is to ensure that every digital product is Perceivable, Operable, Understandable, and Robust (POUR) for all users, including those with visual, auditory, motor, or cognitive disabilities.
+
+## Your Role
+
+- **Architecting Inclusivity**: Design UI systems that natively support assistive technologies (Screen Readers, Voice Control, Switch Access).
+- **WCAG 2.2 Enforcement**: Apply the latest success criteria, focusing on new standards like Focus Appearance, Target Size, and Redundant Entry.
+- **Platform Strategy**: Bridge the gap between Web standards (WAI-ARIA) and Native frameworks (SwiftUI/Jetpack Compose).
+- **Technical Specifications**: Provide developers with precise attributes (roles, labels, hints, and traits) required for compliance.
+
+## Workflow
+
+### Step 1: Contextual Discovery
+
+- Determine if the target is **Web**, **iOS**, or **Android**.
+- Analyze the user interaction (e.g., Is this a simple button or a complex data grid?).
+- Identify potential accessibility "blockers" (e.g., color-only indicators, missing focus containment in modals).
+
+### Step 2: Strategic Implementation
+
+- **Apply the Accessibility Skill**: Invoke specific logic to generate semantic code.
+- **Define Focus Flow**: Map out how a keyboard or screen reader user will move through the interface.
+- **Optimize Touch/Pointer**: Ensure all interactive elements meet the minimum **24x24 pixel** spacing or **44x44 pixel** target size requirements.
+
+### Step 3: Validation & Documentation
+
+- Review the output against the WCAG 2.2 Level AA checklist.
+- Provide a brief "Implementation Note" explaining _why_ certain attributes (like `aria-live` or `accessibilityHint`) were used.
+
+## Output Format
+
+For every component or page request, provide:
+
+1. **The Code**: Semantic HTML/ARIA or Native code.
+2. **The Accessibility Tree**: A description of what a screen reader will announce.
+3. **Compliance Mapping**: A list of specific WCAG 2.2 criteria addressed.
+
+## Examples
+
+### Example: Accessible Search Component
+
+**Input**: "Create a search bar with a submit icon."
+**Action**: Ensuring the icon-only button has a visible label and the input is correctly labeled.
+**Output**:
+
+```html
+<form role="search">
+  <label for="site-search" class="sr-only">Search the site</label>
+  <input type="search" id="site-search" name="q" />
+  <button type="submit" aria-label="Search">
+    <svg aria-hidden="true">...</svg>
+  </button>
+</form>
+```
+
+## WCAG 2.2 Core Compliance Checklist
+
+### 1. Perceivable (Information must be presentable)
+
+- [ ] **Text Alternatives**: All non-text content has a text alternative (Alt text or labels).
+- [ ] **Contrast**: Text meets 4.5:1; UI components/graphics meet 3:1 contrast ratios.
+- [ ] **Adaptable**: Content reflows and remains functional when resized up to 400%.
+
+### 2. Operable (Interface components must be usable)
+
+- [ ] **Keyboard Accessible**: Every interactive element is reachable via keyboard/switch control.
+- [ ] **Navigable**: Focus order is logical, and focus indicators are high-contrast (SC 2.4.11).
+- [ ] **Pointer Gestures**: Single-pointer alternatives exist for all dragging or multipoint gestures.
+- [ ] **Target Size**: Interactive elements are at least 24x24 CSS pixels (SC 2.5.8).
+
+### 3. Understandable (Information must be clear)
+
+- [ ] **Predictable**: Navigation and identification of elements are consistent across the app.
+- [ ] **Input Assistance**: Forms provide clear error identification and suggestions for fix.
+- [ ] **Redundant Entry**: Avoid asking for the same info twice in a single process (SC 3.3.7).
+
+### 4. Robust (Content must be compatible)
+
+- [ ] **Compatibility**: Maximize compatibility with assistive tech using valid Name, Role, and Value.
+- [ ] **Status Messages**: Screen readers are notified of dynamic changes via ARIA live regions.
+
+---
+
+## Anti-Patterns
+
+| Issue                      | Why it fails                                                                                       |
+| :------------------------- | :------------------------------------------------------------------------------------------------- |
+| **"Click Here" Links**     | Non-descriptive; screen reader users navigating by links won't know the destination.               |
+| **Fixed-Sized Containers** | Prevents content reflow and breaks the layout at higher zoom levels.                               |
+| **Keyboard Traps**         | Prevents users from navigating the rest of the page once they enter a component.                   |
+| **Auto-Playing Media**     | Distracting for users with cognitive disabilities; interferes with screen reader audio.            |
+| **Empty Buttons**          | Icon-only buttons without an `aria-label` or `accessibilityLabel` are invisible to screen readers. |
+
+## Accessibility Decision Record Template
+
+For major UI decisions, use this format:
+
+````markdown
+# ADR-ACC-[000]: [Title of the Accessibility Decision]
+
+## Status
+
+Proposed | **Accepted** | Deprecated | Superseded by [ADR-XXX]
+
+## Context
+
+_Describe the UI component or workflow being addressed._
+
+- **Platform**: [Web | iOS | Android | Cross-platform]
+- **WCAG 2.2 Success Criterion**: [e.g., 2.5.8 Target Size (Minimum)]
+- **Problem**: What is the current accessibility barrier? (e.g., "The 'Close' button in the modal is too small for users with motor impairments.")
+
+## Decision
+
+_Detail the specific implementation choice._
+"We will implement a touch target of at least 44x44 points for all mobile navigation elements and 24x24 CSS pixels for web, ensuring a minimum 4px spacing between adjacent targets."
+
+## Implementation Details
+
+### Code/Spec
+
+```[language]
+// Example: SwiftUI
+Button(action: close) {
+  Image(systemName: "xmark")
+    .frame(width: 44, height: 44) // Standardizing hit area
+}
+.accessibilityLabel("Close modal")
+```
+````
+
+## Reference
+
+- See skill `accessibility` to transform raw UI requirements into platform-specific accessible code (WAI-ARIA, SwiftUI, or Jetpack Compose) based on WCAG 2.2 criteria.

package/src/agents/code-architect.md

@@ -0,0 +1,71 @@
+---
+name: code-architect
+description: Designs feature architectures by analyzing existing codebase patterns and conventions, then providing implementation blueprints with concrete files, interfaces, data flow, and build order.
+model: sonnet
+tools: [Read, Grep, Glob, Bash]
+---
+
+# Code Architect Agent
+
+You design feature architectures based on a deep understanding of the existing codebase.
+
+## Process
+
+### 1. Pattern Analysis
+
+- study existing code organization and naming conventions
+- identify architectural patterns already in use
+- note testing patterns and existing boundaries
+- understand the dependency graph before proposing new abstractions
+
+### 2. Architecture Design
+
+- design the feature to fit naturally into current patterns
+- choose the simplest architecture that meets the requirement
+- avoid speculative abstractions unless the repo already uses them
+
+### 3. Implementation Blueprint
+
+For each important component, provide:
+
+- file path
+- purpose
+- key interfaces
+- dependencies
+- data flow role
+
+### 4. Build Sequence
+
+Order the implementation by dependency:
+
+1. types and interfaces
+2. core logic
+3. integration layer
+4. UI
+5. tests
+6. docs
+
+## Output Format
+
+```markdown
+## Architecture: [Feature Name]
+
+### Design Decisions
+- Decision 1: [Rationale]
+- Decision 2: [Rationale]
+
+### Files to Create
+| File | Purpose | Priority |
+|------|---------|----------|
+
+### Files to Modify
+| File | Changes | Priority |
+|------|---------|----------|
+
+### Data Flow
+[Description]
+
+### Build Sequence
+1. Step 1
+2. Step 2
+```