code-ai-installer 1.3.0 → 1.4.0

package/locales/en/.agents/code_review_checklist/SKILL.md

@@ -1,200 +0,0 @@
----
-name: code_review_checklist
-description: Universal review checklist — code quality, readability, testability, security, contracts, DoD.
----
-
-# Skill: Code Review Checklist
-
-Systematic PR/code review for compliance with project standards.
-
-**Sections:**
-1. [Workflow](#1-workflow)
-2. [Checklist](#2-checklist)
-3. [Automated Checks](#3-automated)
-4. [Severity](#4-severity)
-5. [Output Template](#5-output)
-
----
-
-## 1. Workflow
-
-```
-1. Read PR description / task
-   └── What should change? Which acceptance criteria?
-
-2. Automatic checks (section 3)
-   └── grep patterns, lint, tests, audit
-
-3. Go through by checklist (section 2)
-   └── For each item: PASS / FINDING (P0/P1/P2)
-
-4. Form review report (section 5)
-   └── Summary + findings + verdict
-```
-
----
-
-## 2. Checklist
-
-### 2.1 Code Quality
-
-| # | Check | Guidance | Status |
-|---|-------|---------|--------|
-| Q1 | Clear names | Functions = verb+object (`createCoupon`), variables = existing (`activeCount`). No `data`, `temp`, `x` | ☐ |
-| Q2 | Small functions | One responsibility, < 40 lines. If > 60 → split | ☐ |
-| Q3 | No duplication | DRY without fanaticism. 3+ repetitions = extract into a helper | ☐ |
-| Q4 | No magic | No implicit side effects, hidden globals, undocumented hooks with business logic | ☐ |
-| Q5 | JSDoc on functions | `@param`, `@returns`, description. Mandatory for public API | ☐ |
-| Q6 | No `console.log` | Replace on pino logger. Exception: tests | ☐ |
-| Q7 | No `any` / `@ts-ignore` | Each usage = intentional exception with a comment | ☐ |
-
-### 2.2 Architecture
-
-| # | Check | Guidance | Status |
-|---|-------|---------|--------|
-| A1 | Matches Architecture Doc / ADR | New module → check what it in diagram | ☐ |
-| A2 | No tight coupling | Module A not imports internals module B. Only public API | ☐ |
-| A3 | No God Object | File < 500 lines, class < 10 public methods | ☐ |
-| A4 | Layer boundaries | Router → Controller → Service → Repository. No DB calls in router | ☐ |
-| A5 | New decisions → ADR | If introduced a new pattern, library, or strategy → ADR required | ☐ |
-
-### 2.3 API & Data
-
-| # | Check | Guidance | Status |
-|---|-------|---------|--------|
-| D1 | API contracts | Request/Response match `$api_contracts` spec. New endpoints documented | ☐ |
-| D2 | Validation on boundary | Zod schema in middleware, to business logic | ☐ |
-| D3 | Error format | Unified `{ error: { code, message, details } }`. No stack/DB errors in response | ☐ |
-| D4 | Status codes | 201 for create, 204 for delete, 409 for duplicate. Not everything 200 | ☐ |
-| D5 | Data model consistent | Schema changes + migration present. Indexes added for new queries | ☐ |
-
-### 2.4 Tests
-
-| # | Check | Guidance | Status |
-|---|-------|---------|--------|
-| T1 | Tests added/updated | New code = new tests. Changed code = updated tests | ☐ |
-| T2 | Happy path covered | Main scenario works | ☐ |
-| T3 | Edge cases | Empty input, max values, boundary conditions | ☐ |
-| T4 | Error paths | Invalid input → 400, not found → 404, auth → 401 | ☐ |
-| T5 | No flaky tests | No `setTimeout`, no order dependency, stable tests | ☐ |
-| T6 | AAA pattern | Arrange → Act → Assert. One assert per concept | ☐ |
-| T7 | No test magic | No hardcoded IDs, no shared mutable state between tests | ☐ |
-
-### 2.5 Security
-
-| # | Check | Guidance | Status |
-|---|-------|---------|--------|
-| S1 | AuthZ on server | `req.appInstanceId` verified before data access. No IDOR | ☐ |
-| S2 | No secrets in code | No hardcoded passwords, API keys, tokens | ☐ |
-| S3 | Safe error messages | No stack trace, no DB error, no PII in response | ☐ |
-| S4 | Input sanitization | No `eval()`, no `dangerouslySetInnerHTML` without sanitize | ☐ |
-| S5 | Dependency audit | No known high/critical vulnerabilities | ☐ |
-
-### 2.6 Observability & Ops
-
-| # | Check | Guidance | Status |
-|---|-------|---------|--------|
-| O1 | Structured logging | pino with level, message, context fields | ☐ |
-| O2 | requestId correlation | All logs in request chainclude requestId | ☐ |
-| O3 | No PII in logs | No email, password, token, creditCard logged | ☐ |
-| O4 | Health endpoints | `/health/live` and `/health/ready` working | ☐ |
-| O5 | Build/run instructions | README or comments explain how to run changed code | ☐ |
-
----
-
-## 3. Automated Checks
-
-### Grep patterns (run during review)
-
-```bash
-# Security
-grep_search: Query="console.log"              → P1: replace with pino
-grep_search: Query="eval("                    → P0: code injection risk
-grep_search: Query="dangerouslySetInnerHTML"   → P0: XSS risk
-grep_search: Query="password.*=.*\""          → P0: hardcoded secret
-grep_search: Query="@ts-ignore"               → P1: type safety bypass
-grep_search: Query="any"  Includes=["*.ts"]   → P1: weak typing
-grep_search: Query="eslint-disable"           → P1: rule bypass
-grep_search: Query="TODO|FIXME|HACK|XXX"      → P2: track tech debt
-
-# Architecture
-grep_search: Query="mongoose" Includes=["*/routes/*","*/controllers/*"]  → P1: DB in wrong layer
-grep_search: Query="req.body" Includes=["*/services/*"]                  → P1: HTTP in service layer
-
-# Tests
-find_by_name: Pattern="*.test.*" → count test files vs source files
-find_by_name: Pattern="*.spec.*" → same
-```
-
----
-
-## 4. Severity
-
-| Level | Description | Action |
-|-------|-----------|--------|
-| 🔴 **P0** | Security vulnerability, data loss, broken core flow | Block merge. Fix immediately |
-| 🟠 **P1** | Tech debt, missing validation, no tests, architecture violation | Request fix before merge |
-| 🟡 **P2** | Style, naming, minor optimization, nice-to-have | Optional. Note for future |
-
----
-
-## 5. Output Template
-
-```markdown
-# Code Review Report
-
-**PR/Task:** <title>
-**Reviewer:** Reviewer Agent
-**Date:** YYYY-MM-DD
-**Files reviewed:** <count>
-
-## Summary
-<1-2 sentences: what this PR does, overall quality assessment>
-
-## Automated Checks
-| Check | Result |
-|-------|--------|
-| Lint (biome) | ✅ Pass |
-| Tests (vitest) | ✅ Pass (42/42) |
-| npm audit | ⚠️ 1 moderate |
-| Secret scan | ✅ Clean |
-
-## Findings
-
-| # | Severity | Category | File | Finding | Recommendation |
-|---|----------|----------|------|---------|----------------|
-| 1 | 🔴 P0 | Security | `api/routes/settings.js:32` | No authZ check — any user can update any settings | Add appInstanceId ownership check |
-| 2 | 🟠 P1 | Tests | `api/services/coupon.test.js` | No error path test for duplicate coupon | Add test: POST with duplicate code → 409 |
-| 3 | 🟡 P2 | Quality | `dashboard/components/Timer.jsx:15` | Magic number `60` | Extract to constant `SECONDS_PER_MINUTE` |
-
-## Checklist Summary
-
-| Section | Pass | Findings | Total |
-|---------|:----:|:--------:|:-----:|
-| Code Quality | 6 | 1 | 7 |
-| Architecture | 5 | 0 | 5 |
-| API & Data | 4 | 1 | 5 |
-| Tests | 5 | 2 | 7 |
-| Security | 4 | 1 | 5 |
-| Observability | 5 | 0 | 5 |
-| **Total** | **29** | **5** | **34** |
-
-## Verdict
-- ✅ **APPROVED** — no P0/P1, minor P2 notes
-- ⚠️ **CHANGES REQUESTED** — P0/P1 must be fixed before merge
-- ❌ **REJECTED** — fundamental issues, needs redesign
-
-## DoD Verification
-- [x] CI green (lint + tests + audit)
-- [x] Acceptance criteria met
-- [ ] P0/P1 findings resolved ← blocking
-- [x] Documentation updated
-```
-
----
-
-## See also
-- `$security_review` — deep security review (when S1-S5 need more depth)
-- `$tests_quality_review` — deep test quality review
-- `$api_contract_compliance_review` — API contract verification
-- `$review_reference_snippets` — DO/DON'T code examples

package/locales/en/.agents/current_state_analysis/SKILL.md

@@ -1,225 +0,0 @@
----
-name: current_state_analysis
-description: Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency.
----
-
-#Skill: Current State Analysis
-
-System audit of the existing code before starting a new task.
-
-**Sections:**
-1. [When to use](#1-when-to-use)
-2. [Audit algorithm](#2-audit-algorithm)
-3. [What to search for (checklist)](#3-what-to-search-for)
-4. [Severity levels](#4-severity)
-5. [Output Template](#5-output-template)
-6. [Example analysis](#6-example)
-
----
-
-## 1. When use
-
-- The project already exists / there is a repository with code
-- Before the ARCH gate (new feature, refactoring, migration)
-- There are legacy or partially implemented features
-- The team wants to understand the current state before planning
-
----
-
-## 2. Algorithm
-
-```
-1. Structure overview (5 min)
-   ├── list_dir → root, src/, packages/
-   ├── package.json → deps, scripts, engines
-   ??? Docker files ? services, ports, volumes
-   └── Config files → .env.example, tsconfig, biome, vitest
-
-2. Pattern identification (10 min)
-   ├── FE: framework, state management, routing, styling
-   ├── BE: framework, layers (router/controller/service/repo), middleware
-   ├── Data: ORM/ODM, schema strategy, migrations
-   └── Infra: CI/CD, Docker, reverse proxy, certs
-
-3. Search for bottlenecks (10 min)
-   ├── grep_search → console.log, TODO, FIXME, HACK, XXX
-   ├── grep_search → hardcoded secrets, passwords, API keys
-   ├── grep_search → any, eslint-disable, @ts-ignore
-   ├── find_by_name → *.test.*, *.spec.* (coverage)
-   └── Manual check → N+1, god objects, tight coupling
-
-4. Recording findings (5 min)
-   ??? Fill in the Output Template (section 5)
-
-5. Form recommendations
-   └── Quick wins (< 1h) vs Strategic (> 1 sprint)
-```
-
----
-
-## 3. What search
-
-### Structure and conventions
-
-| What check | How | Red flag |
-|--------------|-----|----------|
-| Layers (FE/BE) | `list_dir` src/ | No clear separation |
-| Naming | Files, variables, exports | Mixed styles (camelCase + snake_case) |
-| JSDoc | `grep_search` `@param` | No documentation functions |
-| Imports | Absolute vs relative | `../../../` ? deep nesting |
-| Config | `.env.example`, schema validation | No validation env vars |
-
-### Technical debt
-
-| What search | Grep pattern | Severity |
-|-----------|-------------|----------|
-| `console.log` in production | `console.log` (excluding tests) | P1 |
-| TODO/FIXME | `TODO\|FIXME\|HACK\|XXX` | P1-P2 |
-| Hardcoded secrets | `password.*=\|secret.*=\|apiKey.*=` | 🔴 P0 |
-| Disabled linting | `eslint-disable\|@ts-ignore\|biome-ignore` | P1 |
-| `any` types | `:\s*any` (in .ts files) | P1 |
-| Missing error handling | `catch\s*\(\s*\)` (empty catch) | P1 |
-| Outdated deps | `npm outdated` / `npm audit` | P1-P2 |
-| Dead code | Unused exports, unreachable branches | P2 |
-
-### Performance
-
-| What search | Where | Red flag |
-|-----------|-----|----------|
-| N+1 queries | Loops with DB calls inside | 🔴 P0 |
-| Missing indexes | Schema definitions | P0-P1 |
-| No `.lean()` | Mongoose queries in API responses | P1 |
-| No `.select()` | Full document fetch for list endpoints | P1 |
-| `skip()` pagination | Large collections | P1 |
-| Sync heavy ops | Main thread blocking | P0 |
-
-### Security
-
-| What search | How | Severity |
-|-----------|-----|----------|
-| NoSQL injection | `Model.find(req.query)` | 🔴 P0 |
-| XSS | `dangerouslySetInnerHTML` without sanitize | 🔴 P0 |
-| Secrets in code | `grep_search` API keys, tokens | 🔴 P0 |
-| No Helmet | Express without `helmet()` | P1 |
-| No CORS whitelist | `cors({ origin: '*' })` | P1 |
-| No rate limiting | Public endpoints without throttle | P1 |
-
----
-
-## 4. Severity
-
-| Level | Description | Action |
-|-------|---------|----------|
-| 🔴 **P0** | Blocker: security vulnerability, data loss risk, broken core flow | Fix to release |
-| ?? **P1** | Important: tech debt, missing validation, no tests, performance risk | Plan in the current sprint |
-| 🟡 **P2** | Improvement: code style, naming, dead code, minor optimizations | Backlog |
-
----
-
-## 5. Output Template
-
-```markdown
-# Current State Analysis: <project-name>
-
-**Date:** YYYY-MM-DD
-**Analyst:** Architect Agent
-**Scope:** <what analysis>
-
-## Summary
-<1-2 paragraphs: what it means for the project, key technologies, current status>
-
-## Stack
-| Layer | Technology | Version |
-|-------|-----------|---------|
-| Frontend | React | 18.x |
-| Backend | Express | 4.x |
-| Database | MongoDB + Mongoose | 7.x |
-| Infra | Docker + Caddy | ... |
-
-## Conventions (detected patterns)
-- **Naming:** camelCase for files, PascalCase for components
-- **Layers:** router → controller → service → repository
-- **State:** Zustand / context
-- **Styling:** CSS Modules / Tailwind
-- **Testing:** Vitest + RTL
-
-## Technical Debt
-
-| # | Finding | Severity | Location | Recommendation |
-|---|---------|----------|----------|----------------|
-| 1 | No input validation on API endpoints | 🔴 P0 | `api/routes/*.js` | Add Zod schemas |
-| 2 | console.log in production code | 🟠 P1 | 12 files | Replace with pino logger |
-| 3 | No JSDoc on service functions | 🟡 P2 | `api/services/` | Add JSDoc blocks |
-
-## Scalability Limits
-- <concrete bottlenecks: no indexes, sync ops, no cache, etc.>
-
-## Security Notes
-- <hardcoded secrets, no CORS, injection risks, etc.>
-
-## Recommendations
-
-### Quick Wins (< 1 hour each)
-1. Add Helmet middleware
-2. Add .env validation (Zod)
-3. Replace console.log with pino
-
-### Strategic (requires planning)
-1. ARCH-xx: Implement input validation layer
-2. ARCH-xx: Add integration tests for critical paths
-3. ARCH-xx: Set up CI pipeline
-
-## Next Actions
-- [ ] ARCH-01: <description>
-- [ ] ARCH-02: <description>
-```
-
----
-
-## 6. Example analysis (fragment)
-
-```markdown
-# Current State Analysis: Smart Cart Rescue
-
-**Date:** 2025-12-01
-**Scope:** Full repository audit
-
-## Summary
-Wix Self-Hosted App with Dashboard (React 18 + Vite) and API (Express 4).
-Embedded Script shows a popup on Wix sites.
-Monorepo with Docker Compose + Caddy gateway.
-
-## Technical Debt
-
-| # | Finding | Severity | Location | Recommendation |
-|---|---------|----------|----------|----------------|
-| 1 | Widget payload hardcoded in script | 🔴 P0 | `widget/embedded-script.js` | Fetch from API |
-| 2 | No error boundaries in React | 🟠 P1 | Dashboard components | Add ErrorBoundary wrapper |
-| 3 | Mixed import styles (CJS + ESM) | 🟡 P2 | API server files | Migrate to ESM |
-
-## Scalability Limits
-- No DB indexes on `settings.appInstanceId` (collection scan on every widget request)
-- Embedded script fetches config on every page load (no caching)
-
-## Quick Wins
-1. Add compound index `{ appInstanceId: 1 }` on settings collection
-2. Add `Cache-Control` header to widget endpoint
-3. Add Helmet to Express app
-```
-
----
-
-## Deliverables
-
-| Artifact | Format | Where to store |
-|---------|--------|---------------|
-| Current State Analysis | Markdown (output template above) | `docs/architecture/current-state-analysis.md` |
-| Tech Debt backlog | ARCH-xx items | `docs/architecture/tech-debt.md` or tasks in backlog |
-
----
-
-## See also
-- `$system_design_checklist` — checklist for new design
-- `$architecture_doc` — full Architecture Document
-- `$security_baseline_dev` — detail check security
-- `$observability_logging` — observability

package/locales/en/.agents/current_state_analysis/agents/claude.json

@@ -1,19 +0,0 @@
-{
-  "name": "current_state_analysis",
-  "display_name": "Current State Analysis: <project-name>",
-  "description": "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency.",
-  "default_prompt": "Use $current_state_analysis when the task matches the \"Current State Analysis: <project-name>\" skill.",
-  "triggers": [
-    "current_state_analysis",
-    "current state analysis",
-    "Current State Analysis: <project-name>",
-    "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency"
-  ],
-  "capabilities": [
-    "current",
-    "state",
-    "analysis"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/current_state_analysis/agents/copilot.json

@@ -1,19 +0,0 @@
-{
-  "name": "current_state_analysis",
-  "display_name": "Current State Analysis: <project-name>",
-  "description": "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency.",
-  "default_prompt": "Use $current_state_analysis when the task matches the \"Current State Analysis: <project-name>\" skill.",
-  "triggers": [
-    "current_state_analysis",
-    "current state analysis",
-    "Current State Analysis: <project-name>",
-    "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency"
-  ],
-  "capabilities": [
-    "current",
-    "state",
-    "analysis"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/current_state_analysis/agents/gemini.json

@@ -1,19 +0,0 @@
-{
-  "name": "current_state_analysis",
-  "display_name": "Current State Analysis: <project-name>",
-  "description": "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency.",
-  "default_prompt": "Use $current_state_analysis when the task matches the \"Current State Analysis: <project-name>\" skill.",
-  "triggers": [
-    "current_state_analysis",
-    "current state analysis",
-    "Current State Analysis: <project-name>",
-    "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency"
-  ],
-  "capabilities": [
-    "current",
-    "state",
-    "analysis"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/current_state_analysis/agents/openai.yaml

@@ -1,8 +0,0 @@
-interface:
-  display_name: "Current State Analysis: <project-name>"
-  short_description: "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bot…"
-  default_prompt: "Use $current_state_analysis when the task matches the \"Current State Analysis: <project-name>\" skill."
-dependencies:
-  tools: []
-policy:
-  allow_implicit_invocation: true

package/locales/en/.agents/current_state_analysis/agents/qwen.json

@@ -1,19 +0,0 @@
-{
-  "name": "current_state_analysis",
-  "display_name": "Current State Analysis: <project-name>",
-  "description": "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency.",
-  "default_prompt": "Use $current_state_analysis when the task matches the \"Current State Analysis: <project-name>\" skill.",
-  "triggers": [
-    "current_state_analysis",
-    "current state analysis",
-    "Current State Analysis: <project-name>",
-    "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency"
-  ],
-  "capabilities": [
-    "current",
-    "state",
-    "analysis"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/current_state_analysis/agents/skill.yaml

@@ -1,23 +0,0 @@
-version: 1
-name: "current_state_analysis"
-display_name: "Current State Analysis: <project-name>"
-description: "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency."
-default_prompt: "Use $current_state_analysis when the task matches the \"Current State Analysis: <project-name>\" skill."
-triggers:
-  - "current_state_analysis"
-  - "current state analysis"
-  - "Current State Analysis: <project-name>"
-  - "Analysis of the current repository architecture ? conventions, patterns, tech debt, scaling bottlenecks, security risks, and consistency"
-capabilities:
-  - "current"
-  - "state"
-  - "analysis"
-tools: []
-invocation:
-  explicit: true
-  implicit: true
-localization:
-  default_locale: "en"
-  available_locales:
-    - "ru"
-    - "en"