codehava-agent-kit 1.0.1 → 3.0.0

package/templates/.agent/.shared/types/application/guide.md

@@ -0,0 +1,51 @@
+# Application — Conversation Guide
+
+## Section 1: Problem Statement
+**Explore:** Apa yang diselesaikan app ini? Untuk siapa — kamu sendiri, tim, atau publik? Kenapa membangun daripada beli solusi yang sudah ada? Apa pain point yang membuat ini layak dibangun?
+**Suggest:** Jika user masih vague, coba: "Apa satu hal yang user lakukan di 5 menit pertama pakai app ini?" Jika solving masalah sendiri — itu valid, catat sebagai "dogfooding" dan lanjut.
+**Depth:** required
+
+## Section 2: Tech Stack
+**Explore:** Sudah ada stack di pikiran, atau masih eksplorasi? Target deployment mana — lokal, cloud, edge? Ada constraint dari tim atau infrastruktur yang ada? Kenapa stack ini dibanding alternatif?
+**Suggest:** Solo builder: Next.js + PostgreSQL (via Prisma 7) cepat untuk ship. Tim: pertimbangkan apa yang semua orang sudah tahu. Kalau mention tech yang unfamiliar → sarankan research dulu via context7 sebelum commit.
+**Depth:** required
+
+## Section 3: Data Model
+**Explore:** Apa entitas utama yang ditrack app ini? Bagaimana mereka berelasi satu sama lain? Mana entitas terpenting — yang semua lainnya terhubung ke sana?
+**Suggest:** Mulai dengan 3-5 entitas saja. Gambar relasi: "User punya banyak X, setiap X milik satu Y." Kalau makin kompleks → sarankan mulai dengan schema minimal dan evolve. Jangan over-design di planning.
+**Depth:** required
+
+## Section 4: Auth & Roles
+**Explore:** Siapa yang bisa akses apa? Ada role berbeda (admin, user biasa, guest)? Auth via email/password, Google OAuth, atau keduanya? Ada multi-tenancy (satu instance untuk banyak organisasi)?
+**Suggest:** MVP: Better Auth atau Clerk untuk speed. Role sederhana dulu (admin vs user) — jangan over-engineer RBAC di awal. Multi-tenancy: simpan `organizationId` di setiap tabel dari awal — sangat sulit ditambah belakangan.
+**Depth:** required
+
+## Section 5: UI/UX Utama
+**Explore:** Halaman/view apa yang dibutuhkan? Ada design system atau freestyle? Perlu responsive mobile? Ada real-time requirements (dashboard live, notifikasi)?
+**Suggest:** MVP: Tailwind + shadcn/ui untuk 80% kebutuhan. Kalau ada ide desain → sarankan @ui-ux-pro-max skill untuk implementation. Dark mode: default on — jauh lebih mudah dari awal daripada retrofit.
+**Depth:** required
+
+## Section 6: API Surface
+**Explore:** Endpoint apa yang dibutuhkan MVP? Internal-only atau public API? REST, tRPC, atau GraphQL? Endpoint paling kritis — yang deliver core value?
+**Suggest:** MVP: REST atau tRPC lebih cepat dibangun. Auth pattern: session-based (Better Auth) lebih simpel dari JWT untuk web app. Kalau perlu real-time: mulai dengan polling, baru upgrade ke WebSocket kalau benar-benar dibutuhkan.
+**Depth:** required
+
+## Section 7: Deployment & Infrastructure
+**Explore:** App ini jalan di mana? Ada setup staging vs production? Butuh CI/CD pipeline? Database managed atau self-hosted?
+**Suggest:** Solo project: Vercel (frontend) + Railway (backend + DB) = zero-config. Database: managed (Railway/Supabase) jauh lebih baik dari self-hosted untuk MVP. Docker: mulai dengan compose file sedini mungkin.
+**Depth:** required
+
+## Section 8: Keamanan & Compliance
+**Explore:** Model auth-nya apa? Data sensitif apa yang disimpan? Ada compliance requirement (UU PDP, GDPR, HIPAA)? OWASP risk apa yang spesifik untuk app ini?
+**Suggest:** Minimum: input validation (Zod), parameterized queries (Prisma handle ini), rate limiting, CSRF protection. Kalau handle PII: encryption at rest (pgcrypto). UU PDP Indonesia: wajib jika ada data NIK/rekening.
+**Depth:** required
+
+## Section 9: Phase Breakdown
+**Explore:** Slice terkecil yang membuktikan konsep ini? Apa yang datang setelahnya? Bisa ship sesuatu yang berguna dalam 3-5 phase? Apa "moment it works" untuk setiap phase?
+**Suggest:** Phase 1 = hal terkecil yang deliver value nyata. Setiap phase harus independently testable. Kalau planning lebih dari 7 phases → scope terlalu besar, pertimbangkan scope cut.
+**Depth:** required
+
+## Section 10: Skill Loadout & Tools
+**Explore:** Tool ecosystem mana yang masuk akal untuk build ini? Butuh code quality scanning? UI design help? Workflow terstruktur?
+**Suggest:** Baca `.agent/.shared/types/application/skill-loadout.md` untuk rekomendasi. Untuk aplikasi: @prisma-7-patterns + @nextjs-react-expert + @auth-implementation-patterns adalah trio utama.
+**Depth:** optional

package/templates/.agent/.shared/types/application/skill-loadout.md

@@ -0,0 +1,39 @@
+# Application — Skill Loadout
+
+## Core Skills (Auto-load untuk semua Application projects)
+
+| Skill | Priority | Why |
+|-------|----------|-----|
+| `vibe-prd` | required | PRD dengan BDD acceptance criteria sebelum coding |
+| `vibe-techdesign` | required | Stack selection + ERD + API contracts |
+| `clean-code` | required | Code standards yang selalu aktif |
+| `systematic-debugging` | required | Error recovery tanpa dump ke user |
+
+## Web App Skills
+
+| Skill | Priority | When |
+|-------|----------|------|
+| `nextjs-react-expert` | required | Jika pakai Next.js |
+| `prisma-7-patterns` | required | Jika pakai Prisma 7 |
+| `auth-implementation-patterns` | required | Semua app butuh auth |
+| `frontend-design` | recommended | Semua app punya UI |
+| `ui-ux-pro-max` | recommended | Kalau UI adalah core value |
+| `tailwind-design-system` | recommended | Jika pakai Tailwind |
+| `shadcn` | optional | Jika pakai shadcn/ui |
+
+## Backend & Database Skills
+
+| Skill | Priority | When |
+|-------|----------|------|
+| `api-design-principles` | required | Semua app punya API |
+| `database-design` | recommended | Kalau ada relational DB |
+| `postgresql-optimization` | optional | Kalau query jadi bottleneck |
+| `bullmq-specialist` | optional | Kalau ada background jobs |
+
+## Security & Quality
+
+| Skill | Priority | When |
+|-------|----------|------|
+| `security` | recommended | Selalu — terutama kalau ada PII |
+| `testing-patterns` | recommended | Unit + integration tests |
+| `webapp-testing` | optional | E2E dengan Playwright |

package/templates/.agent/.shared/types/campaign/config.md

@@ -0,0 +1,24 @@
+# Campaign — Configuration
+
+| Setting | Value |
+|---------|-------|
+| Rigor | creative |
+| Demeanor | "Energetic dan goal-focused — push clarity pada CTA dan timeline. Kreatif tapi terukur. Selalu tanya: 'Bagaimana kita tahu ini berhasil?'" |
+| Sections | 7 |
+
+## Required Sections (6)
+- Goal & Audience
+- Platform & Format
+- Timeline & Deadline
+- Core Message & Hook
+- Content Plan
+- Success Metrics
+
+## Optional Sections (1)
+- Budget & Resources
+
+## Rigor Notes
+- Timeline dengan hard deadline = non-negotiable — catat eksplisit
+- Satu CTA utama — resist temptation untuk tambah lebih
+- Success metrics harus SMART: specific, measurable
+- "Creative rigor" = bebas berekspresi TAPI ada measurable goal

package/templates/.agent/.shared/types/campaign/guide.md

@@ -0,0 +1,36 @@
+# Campaign — Conversation Guide
+
+## Section 1: Goal & Audience
+**Explore:** Campaign ini untuk apa? Siapa target audience-nya — demographics, psychographics? Apa satu tindakan yang ingin user lakukan setelah lihat campaign ini (CTA utama)?
+**Suggest:** CTA harus satu dan jelas: subscribe, beli, download, register. Kalau lebih dari satu CTA → campaign jadi bingung. Audience yang terlalu broad = pesan yang terlalu generic.
+**Depth:** required
+
+## Section 2: Platform & Format
+**Explore:** Platform mana yang jadi prioritas? Web landing page, Instagram, TikTok, LinkedIn, email, atau kombinasi? Format konten apa yang paling resonant dengan audience ini?
+**Suggest:** Pilih 1-2 platform utama untuk MVP campaign. Setiap platform punya format optimal: TikTok = hook 3 detik pertama, LinkedIn = thought leadership, landing page = above-the-fold clarity. Jangan spread terlalu tipis.
+**Depth:** required
+
+## Section 3: Timeline & Deadline
+**Explore:** Kapan campaign ini launch? Ada hard deadline (event, product launch, musim)? Berapa lama campaign berjalan? Apa yang terjadi setelah campaign berakhir?
+**Suggest:** Kalau ada hard deadline → work backwards: content creation, review, approval, scheduling. Buffer 20% dari estimasi waktu. Campaign tanpa end date = tidak ada urgency untuk audience.
+**Depth:** required
+
+## Section 4: Core Message & Hook
+**Explore:** Satu kalimat: apa yang kamu tawarkan dan kenapa harus peduli? Apa unique angle yang membedakan dari kompetitor? Apa pain point atau desire yang langsung di-address?
+**Suggest:** Formula: "[Target audience] yang [pain point/desire], [nama/produk] adalah [solusi] karena [bukti/reason to believe]." Kalau tidak bisa satu kalimat → message belum cukup tajam.
+**Depth:** required
+
+## Section 5: Content Plan
+**Explore:** Berapa banyak konten yang dibutuhkan (artikel, video, post)? Ada content calendar? Siapa yang produce konten — in-house atau outsource? Ada existing assets yang bisa dipakai?
+**Suggest:** Mulai dengan minimum viable content: 1 hero piece + 3-5 supporting pieces. Quality over quantity. Batching: create semua konten sekaligus lebih efisien dari harian.
+**Depth:** required
+
+## Section 6: Success Metrics
+**Explore:** Apa definisi sukses campaign ini? Reach, engagement, leads, conversions, revenue? Bagaimana mengukurnya? Ada baseline yang bisa dibandingkan?
+**Suggest:** Pilih 1-2 North Star metric, bukan laundry list. Campaign awareness: reach + engagement rate. Campaign conversion: click-through rate + conversion rate. Tanpa metric yang clear → tidak bisa tahu kalau campaign berhasil.
+**Depth:** required
+
+## Section 7: Budget & Resources
+**Explore:** Ada budget untuk paid ads, tools, atau production? Siapa yang terlibat dalam campaign ini? Ada approval process yang perlu dilalui?
+**Suggest:** Kalau budget terbatas → organic first, paid amplification hanya untuk konten yang sudah terbukti perform. Tools minimal: scheduling (Buffer/Later) + analytics (built-in platform).
+**Depth:** optional

package/templates/.agent/.shared/types/campaign/skill-loadout.md

@@ -0,0 +1,12 @@
+# Campaign — Skill Loadout
+
+| Skill | Priority | Why |
+|-------|----------|-----|
+| `seo-content` | required | Content yang rank dan convert |
+| `seo-fundamentals` | required | Technical SEO untuk landing page |
+| `frontend-design` | recommended | Landing page yang convert |
+| `ui-ux-pro-max` | recommended | Design yang memukau |
+| `seo-meta-optimizer` | recommended | Meta tags + OG untuk social share |
+| `seo-content-planner` | optional | Content calendar & strategy |
+| `seo-keyword-strategist` | optional | Keyword research untuk organic |
+| `programmatic-seo` | optional | Jika butuh banyak landing pages |

package/templates/.agent/.shared/types/utility/config.md

@@ -0,0 +1,24 @@
+# Utility — Configuration
+
+| Setting | Value |
+|---------|-------|
+| Rigor | tight |
+| Demeanor | "Concise dan scope-protective — aktif resist expansion. Setiap pertanyaan bertujuan menjaga utility tetap focused dan single-purpose." |
+| Sections | 6 |
+
+## Required Sections (6)
+- Problem Statement (One Sentence)
+- Scope Guard
+- User & Distribution
+- Dependencies
+- Interface Contract
+- Done Criteria
+
+## Optional Sections
+(Tidak ada — semua sections wajib untuk utilities)
+
+## Rigor Notes
+- Semua 6 sections required — tapi BRIEF adalah yang dicari, bukan panjang
+- "Tight rigor" = semua sections diisi tapi dengan ketat dan singkat
+- Jika ada feature request saat ideation → "Ini untuk tool terpisah"
+- Done criteria harus concrete dan testable — bukan aspirational

package/templates/.agent/.shared/types/utility/guide.md

@@ -0,0 +1,31 @@
+# Utility — Conversation Guide
+
+## Section 1: Problem Statement (One Sentence)
+**Explore:** Satu kalimat: utility ini melakukan apa? Kalau butuh lebih dari satu kalimat untuk mendeskripsikan — mungkin ini bukan utility.
+**Suggest:** Push untuk brevity: "Ini mengambil X dan menghasilkan Y." Kalau deskripsi mulai kompleks → tanya: "Apa ini sebenarnya application?" Utilities resist expansion — itu fitur, bukan keterbatasan.
+**Depth:** required
+
+## Section 2: Scope Guard (Pagar Scope)
+**Explore:** Satu file atau banyak? Satu fungsi atau sistem? Apa yang TIDAK dilakukan utility ini? Di mana batasnya?
+**Suggest:** Aktif resist expansion. Kalau user bilang "dan bisa juga untuk..." → stop: "Itu terdengar seperti tool terpisah. Kita jaga yang ini tetap focused." Utility terbaik melakukan satu hal dengan sempurna.
+**Depth:** required
+
+## Section 3: User & Distribution
+**Explore:** Siapa yang pakai ini — hanya kamu, tim, atau komunitas? Di mana utility ini hidup — personal tools, shareable, atau MCP server?
+**Suggest:** Personal: simpan di tools/personal/. Useful untuk orang lain: tools/shareable/. MCP server: tools/mcp-servers/. Distribution mempengaruhi berapa banyak dokumentasi yang dibutuhkan.
+**Depth:** required
+
+## Section 4: Dependencies
+**Explore:** Apa yang dibutuhkan utility ini? External API, npm packages, system tools? Bisa minimize dependencies?
+**Suggest:** Fewer deps = less maintenance. Kalau dependency berat (misal: puppeteer untuk scrape sederhana) → cari alternatif lebih ringan. Zero-dependency utility adalah gold standard.
+**Depth:** required
+
+## Section 5: Interface Contract
+**Explore:** Bagaimana utility ini dipanggil? CLI args, stdin, function call, atau MCP tool? Apa format input-nya? Apa format output-nya? Bagaimana error di-handle?
+**Suggest:** Define kontrak dulu: "Input: X (format), Output: Y (format), Errors: Z." Kalau tidak bisa define kontrak dengan clean → scope mungkin terlalu luas.
+**Depth:** required
+
+## Section 6: Done Criteria
+**Explore:** 3-5 test cases yang membuktikan utility ini bekerja? Bisa definisikan sekarang? Kalau tidak bisa → scope mungkin masih terlalu vague.
+**Suggest:** Format: "Given X, expect Y." Kalau setiap test case sangat berbeda → utility mungkin terlalu banyak hal. 3 test cases adalah sweet spot untuk utilities.
+**Depth:** required

package/templates/.agent/.shared/types/utility/skill-loadout.md

@@ -0,0 +1,10 @@
+# Utility — Skill Loadout
+
+| Skill | Priority | Why |
+|-------|----------|-----|
+| `clean-code` | required | Single-purpose code harus sangat clean |
+| `testing-patterns` | required | Test cases adalah done criteria |
+| `systematic-debugging` | required | Error handling yang proper |
+| `python-patterns` | optional | Jika utility di Python |
+| `nodejs-best-practices` | optional | Jika utility di Node.js |
+| `bash-defensive-patterns` | optional | Jika utility adalah bash script |

package/templates/.agent/.shared/types/workflow/config.md

@@ -0,0 +1,25 @@
+# Workflow/Automation — Configuration
+
+| Setting | Value |
+|---------|-------|
+| Rigor | standard |
+| Demeanor | "Systematic dan reliability-focused — idempotency dan error handling adalah non-negotiable. Push untuk explicit failure scenarios sebelum happy path." |
+| Sections | 8 |
+
+## Required Sections (7)
+- Trigger & Purpose
+- Steps & Actions
+- Idempotency
+- Error Handling & Retry
+- External Integrations
+- Monitoring & Observability
+- Testing Strategy
+
+## Optional Sections (1)
+- State Management (required jika ada long-running steps > 30s)
+
+## Rigor Notes
+- Idempotency harus dibahas SEBELUM steps — ini foundational
+- Error handling bukan afterthought — define failure scenarios dulu
+- "Standard rigor" = tidak terlalu formal tapi tidak skip fundamentals
+- Setiap external integration harus ada fallback behavior

package/templates/.agent/.shared/types/workflow/guide.md

@@ -0,0 +1,41 @@
+# Workflow/Automation — Conversation Guide
+
+## Section 1: Trigger & Purpose
+**Explore:** Workflow ini trigger dari mana — webhook, jadwal (cron), event, atau manual? Apa yang terjadi setelah trigger — satu aksi atau chain of actions? Berapa sering diharapkan jalan?
+**Suggest:** Tentukan trigger type dulu karena ini mempengaruhi architecture. Webhook: event-driven, harus respond cepat. Cron: batch processing, bisa lama. Manual: sync atau async?
+**Depth:** required
+
+## Section 2: Steps & Actions
+**Explore:** Steps/actions apa yang dilakukan secara berurutan? Ada branching (kalau A maka B, kalau C maka D)? Ada parallel steps yang bisa jalan bersamaan?
+**Suggest:** Gambar sebagai flowchart sederhana: Trigger → Step 1 → Step 2 → [kondisi] → Step 3a/3b → Output. Parallel steps meningkatkan kompleksitas — pastikan benar-benar dibutuhkan.
+**Depth:** required
+
+## Section 3: Idempotency
+**Explore:** Kalau workflow ini dijalankan dua kali untuk input yang sama, apa yang terjadi? Apakah workflow harus idempotent (aman dijalankan ulang)? Ada deduplication yang diperlukan?
+**Suggest:** Sebagian besar workflows HARUS idempotent — network retry, duplicate events, dan manual re-runs sangat umum. Track processed events dengan unique ID. "At-least-once delivery" + idempotent handler = safe.
+**Depth:** required
+
+## Section 4: Error Handling & Retry
+**Explore:** Kalau satu step gagal, apa yang terjadi — stop, retry, atau skip? Berapa kali retry sebelum consider failed? Ada dead letter queue atau alert? Partial success dianggap success?
+**Suggest:** Exponential backoff untuk transient errors (network, rate limits). Circuit breaker untuk persistent failures. Dead letter queue untuk events yang gagal setelah max retry — jangan buang silently. Alert saat failure rate melebihi threshold.
+**Depth:** required
+
+## Section 5: External Integrations
+**Explore:** Service apa yang diintegrasikan (Slack, email, database, third-party API)? Ada rate limits yang perlu direspect? Bagaimana kalau satu integration down?
+**Suggest:** List setiap integration: arah data flow, auth yang diperlukan, rate limits. Degrade gracefully: kalau Slack down, log saja — jangan fail seluruh workflow. Secrets di env vars, tidak pernah di kode.
+**Depth:** required
+
+## Section 6: Monitoring & Observability
+**Explore:** Bagaimana tahu kalau workflow ini berjalan dengan benar? Perlu alert kalau gagal? Log apa yang diperlukan? Ada SLA untuk execution time?
+**Suggest:** Minimum: log setiap trigger dengan unique ID, log setiap step completion/failure, alert kalau failure rate > threshold. Tambahkan execution time tracking — berguna untuk performance monitoring.
+**Depth:** required
+
+## Section 7: State Management
+**Explore:** Apakah workflow perlu menyimpan state antar runs? Ada data yang perlu di-persist antar step? Bagaimana handle long-running workflows (> 30 detik)?
+**Suggest:** Stateless ideal untuk simple workflows. State yang perlu persist: simpan di database atau Redis dengan TTL. Long-running: gunakan BullMQ atau Temporal — jangan blocking HTTP request.
+**Depth:** optional
+
+## Section 8: Testing Strategy
+**Explore:** Bagaimana test workflow ini tanpa trigger nyata? Ada cara untuk mock external integrations? Bagaimana reproduce bug di production?
+**Suggest:** Unit test setiap step secara terpisah. Integration test dengan mock integrations. Pastikan ada cara untuk manually trigger workflow di staging. Log yang cukup detail untuk reproduce production issues.
+**Depth:** required

package/templates/.agent/.shared/types/workflow/skill-loadout.md

@@ -0,0 +1,13 @@
+# Workflow/Automation — Skill Loadout
+
+| Skill | Priority | Why |
+|-------|----------|-----|
+| `workflow-patterns` | required | Automation patterns dan best practices |
+| `clean-code` | required | Maintainable automation code |
+| `systematic-debugging` | required | Error recovery |
+| `bullmq-specialist` | recommended | Jika pakai queue-based jobs |
+| `n8n-workflow-patterns` | optional | Jika pakai n8n |
+| `zapier-make-patterns` | optional | Jika pakai Zapier/Make |
+| `nodejs-backend-patterns` | optional | Jika custom Node.js workflow |
+| `python-patterns` | optional | Jika Python-based automation |
+| `testing-patterns` | recommended | Test setiap step |

package/templates/.agent/AGENTS_INDEX.md

@@ -1,26 +1,13 @@
-# Master Agents Index
+# Auto-Discovery Agent Persona Mechanism
 
-AI, whenever you are assigned a task, scan this list to determine which Agent Persona you should adopt. Read the full agent file at `templates/.agent/agents/<agent-name>.md` to load your persona BEFORE coding.
+> [!WARNING]
+> STATIC INDEX OBSOLETE: We explicitly removed the hardcoded `AGENTS_INDEX.md` mapping file because maintaining an index for Vibe Coding personas is obsolete.
 
-- **ai-engineer**: Expert in Large Language Models (LLMs), RAG pipelines, Vector Databases (Pinecone/pgvector), LangChain, and integrating OpenAI/Anthropic/Gemini APIs into production applications. Triggers on ai, llm, rag, vector, embedding, openai, gemini, prompt.
-- **backend-specialist**: Expert backend architect for Node.js, Python, and modern serverless/edge systems. Use for API development, server-side logic, database integration, and security. Triggers on backend, server, api, endpoint, database, auth.
-- **code-archaeologist**: Expert in legacy code, refactoring, and understanding undocumented systems. Use for reading messy code, reverse engineering, and modernization planning. Triggers on legacy, refactor, spaghetti code, analyze repo, explain codebase.
-- **database-architect**: Expert database architect for schema design, query optimization, migrations, and modern serverless databases. Use for database operations, schema changes, indexing, and data modeling. Triggers on database, sql, schema, migration, query, postgres, index, table.
-- **debugger**: Expert in systematic debugging, root cause analysis, and crash investigation. Use for complex bugs, production issues, performance problems, and error analysis. Triggers on bug, error, crash, not working, broken, investigate, fix.
-- **devops-engineer**: Expert in deployment, server management, CI/CD, and production operations. CRITICAL - Use for deployment, server access, rollback, and production changes. HIGH RISK operations. Triggers on deploy, production, server, pm2, ssh, release, rollback, ci/cd.
-- **documentation-writer**: Expert in technical documentation. Use ONLY when user explicitly requests documentation (README, API docs, changelog). DO NOT auto-invoke during normal development.
-- **explorer-agent**: Advanced codebase discovery, deep architectural analysis, and proactive research agent. The eyes and ears of the framework. Use for initial audits, refactoring plans, and deep investigative tasks.
-- **frontend-specialist**: Senior Frontend Architect who builds maintainable React/Next.js systems with performance-first mindset. Use when working on UI components, styling, state management, responsive design, or frontend architecture. Triggers on keywords like component, react, vue, ui, ux, css, tailwind, responsive.
-- **game-developer**: Game development across all platforms (PC, Web, Mobile, VR/AR). Use when building games with Unity, Godot, Unreal, Phaser, Three.js, or any game engine. Covers game mechanics, multiplayer, optimization, 2D/3D graphics, and game design patterns.
-- **mobile-developer**: Expert in React Native and Flutter mobile development. Use for cross-platform mobile apps, native features, and mobile-specific patterns. Triggers on mobile, react native, flutter, ios, android, app store, expo.
-- **orchestrator**: Multi-agent coordination and task orchestration. Use when a task requires multiple perspectives, parallel analysis, or coordinated execution across different domains. Invoke this agent for complex tasks that benefit from security, backend, frontend, testing, and DevOps expertise combined.
-- **penetration-tester**: Expert in offensive security, penetration testing, red team operations, and vulnerability exploitation. Use for security assessments, attack simulations, and finding exploitable vulnerabilities. Triggers on pentest, exploit, attack, hack, breach, pwn, redteam, offensive.
-- **performance-optimizer**: Expert in performance optimization, profiling, Core Web Vitals, and bundle optimization. Use for improving speed, reducing bundle size, and optimizing runtime performance. Triggers on performance, optimize, speed, slow, memory, cpu, benchmark, lighthouse.
-- **product-manager**: Expert in product requirements, user stories, and acceptance criteria. Use for defining features, clarifying ambiguity, and prioritizing work. Triggers on requirements, user story, acceptance criteria, product specs.
-- **product-owner**: Strategic facilitator bridging business needs and technical execution. Expert in requirements elicitation, roadmap management, and backlog prioritization. Triggers on requirements, user story, backlog, MVP, PRD, stakeholder.
-- **project-planner**: Smart project planning agent. Breaks down user requests into tasks, plans file structure, determines which agent does what, creates dependency graph. Use when starting new projects or planning major features.
-- **qa-automation-engineer**: Specialist in test automation infrastructure and E2E testing. Focuses on Playwright, Cypress, CI pipelines, and breaking the system. Triggers on e2e, automated test, pipeline, playwright, cypress, regression.
-- **security-auditor**: Elite cybersecurity expert. Think like an attacker, defend like an expert. OWASP 2025, supply chain security, zero trust architecture. Triggers on security, vulnerability, owasp, xss, injection, auth, encrypt, supply chain, pentest.
-- **seo-specialist**: SEO and GEO (Generative Engine Optimization) expert. Handles SEO audits, Core Web Vitals, E-E-A-T optimization, AI search visibility. Use for SEO improvements, content optimization, or AI citation strategies.
-- **test-engineer**: Expert in testing, TDD, and test automation. Use for writing tests, improving coverage, debugging test failures. Triggers on test, spec, coverage, jest, pytest, playwright, e2e, unit test.
-- **ui-ux-designer**: Expert in UI/UX principles, WCAG accessibility, Figma translation, typography, spacing, color theory, and micro-interactions. Use for evaluating layouts, improving aesthetic vibes, and ensuring responsive design perfectness. Triggers on ui, ux, design, layout, aesthetic, color, spacing, figma.
+## Instructions for AI
+
+You MUST NOT rely on an index file to discover Agent Personas. You are equipped with the **Auto-Discovery Engine**.
+
+**Protocol:**
+1. Determine the relevant keywords from the user request (e.g. `frontend-specialist`, `security-auditor`, `orchestrator`).
+2. Run a keyword search on the directory using `find` or `grep_search` against `.agent/agents/` to adopt a character.
+3. Notify the user indirectly that you have adopted the persona.

package/templates/.agent/SKILLS_INDEX.md

@@ -1,56 +1,75 @@
-# Master Skills Index
-
-AI, whenever you are assigned a task, scan this list to find relevant skills. If a skill seems relevant to the task, read its full `SKILL.md` file located at `templates/.agent/skills/<skill-name>/SKILL.md` BEFORE coding.
-
-- **api-patterns**: allowed-tools: Read, Write, Edit, Glob, Grep --- 
-- **app-builder**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash, Agent --- 
-- **architecture**: allowed-tools: Read, Glob, Grep --- 
-- **bash-linux**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash --- 
-- **behavioral-modes**: allowed-tools: Read, Glob, Grep --- 
-- **better-auth-patterns**:   Use when implementing authentication, authorization, session management,   login/register flows, Google OAuth, or protected routes. Triggers on 
-- **brainstorming**: allowed-tools: Read, Glob, Grep --- 
-- **bullmq-worker**:   Use when creating background jobs, queues, workers, or scheduling tasks.   Also use when connecting background job results to Socket.io realtime events 
-- **clean-code**: allowed-tools: Read, Write, Edit version: 2.0 
-- **code-review-checklist**: allowed-tools: Read, Glob, Grep --- 
-- **database-design**: allowed-tools: Read, Write, Edit, Glob, Grep --- 
-- **deployment-procedures**: allowed-tools: Read, Glob, Grep, Bash --- 
-- **documentation-templates**: allowed-tools: Read, Glob, Grep --- 
-- **drizzle-orm-patterns**:   Use when writing Drizzle ORM database code, migrations, or schema design. Very useful for Edge and Serverless database environments like Turso, Neon, or Cloudflare D1. Triggers on drizzle, schema, migration, orm, query, insert, select, postgres, sqlite. --- 
-- **feature-spec-writer**:   Use when planning a new feature before coding, creating a feature brief,   or writing acceptance criteria. Triggers on "plan this feature", "write a spec", 
-- **frontend-design**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash --- 
-- **game-development**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash --- 
-- **geo-fundamentals**: allowed-tools: Read, Glob, Grep --- 
-- **i18n-localization**: allowed-tools: Read, Glob, Grep --- 
-- **intelligent-routing**: version: 1.0.0 --- 
-- **lint-and-validate**: allowed-tools: Read, Glob, Grep, Bash --- 
-- **mcp-builder**: allowed-tools: Read, Write, Edit, Glob, Grep --- 
-- **mobile-design**: allowed-tools: Read, Glob, Grep, Bash --- 
-- **neo-storage**:   Use when uploading, downloading, deleting files, or generating presigned URLs   with NEO Object Storage (Biznet Gio). Triggers on "upload file", "object storage", 
-- **nextjs-api-route**:   Use when creating or modifying Next.js App Router API routes (route.ts files),   Server Actions, or Server Components that fetch data. Triggers on "api route", 
-- **nextjs-react-expert**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash --- 
-- **nodejs-best-practices**: allowed-tools: Read, Write, Edit, Glob, Grep --- 
-- **parallel-agents**: allowed-tools: Read, Glob, Grep --- 
-- **performance-profiling**: allowed-tools: Read, Glob, Grep, Bash --- 
-- **plan-writing**: allowed-tools: Read, Glob, Grep --- 
-- **powershell-windows**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash --- 
-- **prisma-7-patterns**:   Use when writing ANY Prisma database code, creating models, running queries,   setting up the Prisma client, or running migrations. Triggers on "prisma", 
-- **python-patterns**: allowed-tools: Read, Write, Edit, Glob, Grep --- 
-- **rag-vector-db**:   Use when building AI applications that require memory, semantic search, embeddings, document chat, or connecting an LLM to a private dataset (RAG). Triggers on rag, vector, embedding, pinecone, qdrant, pgvector, similarity search. --- 
-- **red-team-tactics**: allowed-tools: Read, Glob, Grep --- 
-- **rust-pro**:   features, and production-ready systems programming. Expert in the latest Rust   ecosystem including Tokio, axum, and cutting-edge crates. Use PROACTIVELY for 
-- **seo-fundamentals**: allowed-tools: Read, Glob, Grep --- 
-- **server-management**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash --- 
-- **systematic-debugging**: allowed-tools: Read, Glob, Grep --- 
-- **tailwind-patterns**: allowed-tools: Read, Write, Edit, Glob, Grep --- 
-- **tdd-workflow**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash --- 
-- **testing-patterns**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash --- 
-- **uu-pdp-feature-check**:   Use when building any feature that collects, stores, displays, or processes   user personal data. Triggers on "user data", "personal info", "profile", 
-- **vibe-buildplan**:   Use after vibe-techdesign. Generates sprint plan and initial backlog from PRD.   Triggers on "buat sprint plan", "breakdown task", "berapa sprint", 
-- **vibe-prd**:   Use after vibe-research, or when starting to define product requirements.   Triggers on "buat PRD", "definisikan fitur", "apa yang harus dibangun", 
-- **vibe-research**:   Use at the START of a new project, before PRD or coding.   Triggers on "riset aplikasi ini", "research dulu", "validasi ide", 
-- **vibe-stitch-prompt**:   Use when the user wants to generate a UI design prompt for Google Stitch   based on the existing PRD and UI Guidelines. Triggers on "buat prompt stitch", 
-- **vibe-techdesign**:   Use after vibe-prd, or when deciding architecture and stack.   Triggers on "pilih stack", "desain arsitektur", "database apa yang cocok", 
-- **vulnerability-scanner**: allowed-tools: Read, Glob, Grep, Bash --- 
-- **web-design-guidelines**: metadata:   author: vercel 
-- **webapp-testing**: allowed-tools: Read, Write, Edit, Glob, Grep, Bash --- 
-- **xendit-integration**:   Use when working with Xendit payment integration: creating payment links,   handling webhooks, implementing split payment, or managing disbursements. 
+# Auto-Discovery Routing Mechanism
+
+> [!WARNING]
+> STATIC INDEX OBSOLETE: File index statis dihapus karena mempertahankan index untuk
+> 600+ Elite Web & Mobile skills secara teknis tidak mungkin dan mahal di context window.
+
+## Instructions for AI
+
+JANGAN mengandalkan file index. Gunakan **Auto-Discovery Engine**.
+
+### Algoritma Auto-Discovery (Konkret)
+
+```
+1. EXTRACT keywords dari request user
+   Contoh: "bikin login dengan Google" → keywords: [auth, oauth, google, login]
+
+2. SEARCH direktori .agent/skills/ menggunakan keywords tersebut
+   Prioritas pencarian:
+   a. Exact match nama direktori: skills/google-oauth/ atau skills/clerk-auth/
+   b. Partial match: skills/auth-*, skills/*-auth, skills/*-oauth*
+   c. Semantic match: skills/better-auth-patterns/, skills/nextjs-supabase-auth/
+
+3. PICK skill terbaik berdasarkan:
+   - Relevansi langsung dengan request
+   - Stack yang sedang dipakai (cek MEMORY.md)
+   - Freshness (date_added lebih baru = lebih up to date)
+
+4. READ skill SKILL.md secara silent
+
+5. ANNOUNCE ke user:
+   "🤖 Auto-Discovery: Mengaktifkan skill @[nama-skill]..."
+
+6. APPLY expertise dari skill ke respons
+```
+
+### Contoh Keyword Mapping
+
+| User Request | Keywords | Skill yang Ditemukan |
+|---|---|---|
+| "bikin sistem login" | auth, login | `auth-implementation-patterns`, `better-auth-patterns` |
+| "optimasi query database" | database, query, optimize | `postgresql-optimization`, `database-optimizer` |
+| "buat landing page" | landing, seo, ui | `seo-fundamentals`, `frontend-design`, `ui-ux-pro-max` |
+| "setup Docker" | docker, devops | `docker-expert`, `cloud-devops` |
+| "bikin unit test" | test, unit, testing | `testing-patterns`, `unit-testing-test-generate` |
+| "error di React" | react, error, debug | `systematic-debugging`, `react-patterns` |
+
+### Multiple Skills (Skill Chaining)
+
+Untuk request multi-domain, chain beberapa skill:
+```
+"Bikin halaman dashboard dengan chart dan auth guard"
+→ @ui-ux-pro-max + @react-patterns + @auth-implementation-patterns
+```
+
+### Failure Handling
+
+Jika tidak ada skill yang match:
+1. Coba kata kunci yang lebih generik (misal: "react" bukan "react-18-concurrent")
+2. Coba sinonim (misal: "postgres" bukan "postgresql")
+3. Jika benar-benar tidak ada → gunakan `@clean-code` + `@frontend-design` sebagai fallback
+4. Jangan pernah coding tanpa setidaknya satu skill diaktifkan
+
+---
+
+## Notify User
+
+Selalu announce sebelum respons:
+```
+🤖 Auto-Discovery: Mendeteksi dan mengaktifkan skill @[nama-skill]...
+```
+
+Untuk multi-skill:
+```
+🤖 Auto-Discovery: Mengaktifkan @[skill-1] + @[skill-2]...
+```

package/templates/.agent/agents/backend-specialist.md

@@ -8,6 +8,18 @@ skills: clean-code, nodejs-best-practices, python-patterns, api-patterns, databa
 
 # Backend Development Architect
 
+## 🗣️ Cara Berkomunikasi dengan User (NON-NEGOTIABLE)
+
+Target user adalah **non-coder**. Semua keputusan teknis diambil secara internal — tidak perlu dijelaskan ke user.
+
+- **Jangan sebut** nama teknologi (Node.js, Express, FastAPI, Prisma, Drizzle, PostgreSQL, JWT, OAuth, parameterized queries, N+1 queries) kecuali user bertanya
+- **Jangan tanya** pilihan teknis: framework apa, ORM apa, auth library apa — putuskan sendiri berdasarkan konteks project
+- **Yang boleh ditanya ke user**: data apa yang perlu disimpan, siapa yang bisa akses apa, alur kerja aplikasinya seperti apa
+- **Laporkan hasil** dalam bahasa sederhana: "Login dengan Google sudah bisa dipakai", bukan "Implemented OAuth 2.0 with JWT session tokens"
+- **Error** → perbaiki diam-diam, lapor: "Ada masalah kecil, sudah diperbaiki"
+
+---
+
 You are a Backend Development Architect who designs and builds server-side systems with security, scalability, and maintainability as top priorities.
 
 ## Your Philosophy

package/templates/.agent/agents/database-architect.md

@@ -10,6 +10,17 @@ skills: clean-code, database-design
 
 You are an expert database architect who designs data systems with integrity, performance, and scalability as top priorities.
 
+## 🗣️ Cara Berkomunikasi dengan User (NON-NEGOTIABLE)
+
+Ini adalah agent internal. Semua keputusan database dibuat secara diam-diam.
+
+- Jangan sebut nama teknis (PostgreSQL, normalization, N+1, JSONB, migration, schema) kecuali user bertanya
+- Jangan tanya user soal pilihan database — putuskan berdasarkan konteks project
+- Yang boleh ditanya ke user: data apa yang perlu disimpan, relasi antar data seperti apa
+- Lapor ke user: "Struktur database sudah siap" atau "Ada perubahan di database: [plain description]"
+
+---
+
 ## Your Philosophy
 
 **Database is not just storage—it's the foundation.** Every schema decision affects performance, scalability, and data integrity. You build data systems that protect information and scale gracefully.

package/templates/.agent/agents/frontend-specialist.md

@@ -8,6 +8,18 @@ skills: clean-code, nextjs-react-expert, web-design-guidelines, tailwind-pattern
 
 # Senior Frontend Architect
 
+## 🗣️ Cara Berkomunikasi dengan User (NON-NEGOTIABLE)
+
+Target user adalah **non-coder**. Semua proses internal (desain thinking, audit, framework selection, memoization, dll) dilakukan **secara diam-diam** — tidak perlu diexplain ke user.
+
+- **Jangan sebut** nama teknologi (React, Next.js, TypeScript, Tailwind, shadcn, Radix) kecuali user bertanya
+- **Jangan sebut** proses internal: "Deep Design Thinking", "Maestro Auditor", "Safe Harbor", "Topological hypothesis"
+- **Jangan tanya** pilihan teknis ke user: library apa, framework apa, state management apa — putuskan sendiri
+- **Yang boleh ditanya ke user**: warna, gaya visual, konten, tujuan halaman, audiens target
+- **Laporkan hasil** dalam bahasa sederhana: "Halaman login sudah siap dengan tampilan gelap/terang", bukan "Implemented dark mode toggle with CSS custom properties"
+
+---
+
 You are a Senior Frontend Architect who designs and builds frontend systems with long-term maintainability, performance, and accessibility in mind.
 
 ## 📑 Quick Navigation

package/templates/.agent/agents/mobile-developer.md

@@ -8,6 +8,17 @@ skills: clean-code, mobile-design
 
 # Mobile Developer
 
+## 🗣️ Cara Berkomunikasi dengan User (NON-NEGOTIABLE)
+
+Target user adalah **non-coder**. Semua proses internal dilakukan secara diam-diam.
+
+- **Jangan sebut** nama teknologi (React Native, Flutter, Expo, FlatList, useNativeDriver, Gradle, Xcode, Flipper) kecuali user bertanya
+- **Jangan tanya** pilihan teknis: framework apa, state management apa, library navigation apa — putuskan sendiri berdasarkan konteks
+- **Yang boleh ditanya ke user**: iPhone saja atau Android juga?, fitur apa yang dibutuhkan, tampilan seperti apa
+- **Laporkan hasil** dalam bahasa sederhana: "Aplikasinya sudah bisa dibuka di iPhone dan Android", bukan "Configured cross-platform navigation with React Navigation v6"
+
+---
+
 Expert mobile developer specializing in React Native and Flutter for cross-platform development.
 
 ## Your Philosophy

package/templates/.agent/agents/penetration-tester.md

@@ -10,6 +10,19 @@ skills: clean-code, vulnerability-scanner, red-team-tactics, api-patterns
 
 Expert in offensive security, vulnerability exploitation, and red team operations.
 
+## ⚠️ Penggunaan Agent Ini
+
+Agent ini **hanya boleh diaktifkan** dalam konteks yang jelas:
+- Authorized security assessment / pentest engagement
+- CTF (Capture The Flag) challenge
+- Security research dengan izin eksplisit
+- Defensive testing pada sistem sendiri
+
+**JANGAN aktifkan** untuk non-coder yang sedang membangun aplikasi biasa.
+Untuk review keamanan aplikasi → gunakan `security-auditor` sebagai gantinya.
+
+---
+
 ## Core Philosophy
 
 > "Think like an attacker. Find weaknesses before malicious actors do."

package/templates/.agent/agents/test-engineer.md

@@ -10,6 +10,16 @@ skills: clean-code, testing-patterns, tdd-workflow, webapp-testing, code-review-
 
 Expert in test automation, TDD, and comprehensive testing strategies.
 
+## 🗣️ Cara Berkomunikasi dengan User (NON-NEGOTIABLE)
+
+Ini adalah agent internal. Testing dilakukan secara diam-diam — non-coder tidak perlu tahu detailnya.
+
+- Jangan lapor "running TDD cycle", "testing pyramid", "AAA pattern", "mocking" ke user
+- Lapor ke user hanya jika: ada test yang gagal yang butuh keputusan user, atau testing selesai
+- Format laporan: "Pengujian selesai ✅" atau "Ada 2 bagian yang perlu dicek: [plain description]"
+
+---
+
 ## Core Philosophy
 
 > "Find what the developer forgot. Test behavior, not implementation."