codeninja 2.0.0 → 3.2.0

package/commands/debug.workflow.md

@@ -0,0 +1,94 @@
+---
+type: workflow
+name: debug
+description: >
+  Diagnose and fix bugs using full project context — DB schema, middleware
+  chain, service config, and established patterns. Traces the exact failure
+  path and produces a concrete fix.
+---
+
+# Workflow: @debug / /codeninja:debug
+
+## Goal
+Find the root cause of a bug and produce a concrete fix using actual project
+context. Never guess — trace the real code path.
+
+## Rules
+- Trace the full request path before concluding anything
+- Cross-reference context.db.schema before assuming a DB mismatch
+- Check middleware chain order before assuming an auth issue
+- One question at a time when gathering information
+
+---
+
+## Step-by-Step Execution
+
+### Step 1 — Gather Error Information
+Ask (one at a time if not already provided):
+1. "Paste the full error message and stack trace."
+2. "Which endpoint or operation triggered it? (e.g., POST /v1/scores/submit)"
+3. "What did you expect to happen vs what actually happened?"
+4. "What changed recently before this error appeared?"
+
+### Step 2 — Load Context
+1. Call `context_read` — load services, DB schema, project config
+2. Call `fs_read` on the relevant route.js
+3. Call `fs_read` on the relevant _model.js
+4. Call `fs_exists` on the migration file for any table mentioned in the error
+
+### Step 3 — Trace the Failure Path
+
+Walk the request lifecycle in order:
+```
+Request received
+  → Language middleware (extracts Accept-Language)
+  → API key middleware (validates api-key header)
+  → Auth middleware (validates JWT, if protected)
+  → Validation (validatorjs schema)
+  → Route handler (calls model)
+  → Model function (executes query)
+  → Database (pg pool)
+  → Response formatter
+```
+
+Mark the exact step where the error occurs.
+
+### Step 4 — Check Common Root Causes
+
+| Symptom | Check |
+|---|---|
+| `column does not exist` | context.db.schema vs actual column names in model.js |
+| `undefined is not a function` | wrong import path or missing export in model |
+| `Cannot read property of undefined` | missing null check after DB query returns 0 rows |
+| `401 Unauthorized` | middleware order — apiKey middleware applied? header name correct? |
+| `500 Internal Server Error` | missing try/catch around async DB call |
+| `Wrong number of rows` | missing dedup query, RANK vs DENSE_RANK, missing WHERE clause |
+| `Migration not applied` | table exists in code but not in DB — run migration |
+| Stale context data | context.db.schema out of date — suggest /codeninja:db:sync |
+
+### Step 5 — Produce Fix
+
+```
+Root cause: [one sentence — be precise]
+
+Fix:
+File: path/to/file.js
+
+Before:
+[the buggy code]
+
+After:
+[the corrected code]
+
+Why this fixes it: [one sentence]
+```
+
+If multiple files need changes, show each one in order.
+
+### Step 6 — Verify Plan
+"Before I apply this fix, confirm: does this match what you're seeing?
+Once confirmed, I'll make the changes."
+
+### Step 7 — Prevent Recurrence
+After fixing: suggest one guard that prevents this class of bug in the future.
+(e.g., a missing index, an added null check helper, a context convention)

package/commands/explain.workflow.md

@@ -0,0 +1,59 @@
+---
+type: workflow
+name: explain
+description: >
+  Explain any file, function, pattern, or architectural concept in this project
+  using full project context. Useful for onboarding, code review, and exam prep.
+---
+
+# Workflow: @explain / /codeninja:explain
+
+## Goal
+Give a clear, context-aware explanation of any part of the codebase.
+Reference real file names, table names, service names — never placeholders.
+
+## Rules
+- Always read the actual file before explaining it
+- Use `context.db.schema` to reference real table/column names
+- Use `context.services` to reference real service names and ports
+- Explain the "why" not just the "what"
+
+---
+
+## Step-by-Step Execution
+
+### Step 1 — Identify Target
+If not specified, ask: "What would you like me to explain?
+(e.g., a file path, a function name, a pattern like 'the auth middleware', or a concept like 'why we use DENSE_RANK')"
+
+### Step 2 — Load Context
+1. Call MCP tool `context_read`
+2. Call MCP tool `fs_read` on the target file (if a file was specified)
+3. Read 1 related file to understand how the target fits in the system
+
+### Step 3 — Explain
+
+Structure the explanation as:
+
+**What it is** (1–2 sentences — plain English)
+> This is the route handler for the leaderboard endpoint. It validates the
+> incoming request, calls the model to fetch ranked scores, and returns them
+> in the project's standard response format.
+
+**How it works** (step-by-step walkthrough of the key logic)
+> 1. The `apiKeyMiddleware` checks the `api-key` header against the env value
+> 2. `validatorjs` ensures `weekId` is present and a non-empty string
+> 3. `LeaderboardModel.getTopScores(weekId)` runs the DENSE_RANK query
+> 4. The result is wrapped in `{ status: 1, message: lang.success, data: rows }`
+
+**Why this way** (the architectural decision)
+> We use DENSE_RANK instead of RANK because tied scores should get the same
+> position without gaps — position 3 should follow position 2, even with ties.
+
+**Where it connects** (related files/functions)
+> - Model: `modules/v1/Leaderboard/leaderboard_model.js`
+> - Language strings: `languages/en.js` → `leaderboard_success`
+> - Route registration: `modules/v1/route_manager.js` line ~45
+
+### Step 4 — Offer Follow-up
+End with: "Want me to explain any part in more detail, or show how to modify it?"

package/commands/optimize.workflow.md

@@ -0,0 +1,124 @@
+---
+type: workflow
+name: optimize
+description: >
+  Analyse and improve performance of a route, query, or service using real
+  project context — actual table sizes, existing indexes, query patterns, and
+  middleware overhead. Produces ranked recommendations with concrete code.
+---
+
+# Workflow: @optimize / /codeninja:optimize
+
+## Goal
+Find real performance bottlenecks using actual project data. Every
+recommendation includes a concrete fix and an estimated impact.
+No generic advice — only changes grounded in this codebase.
+
+## Rules
+- Check context.db.schema for existing indexes before recommending new ones
+- Reference real table names and column names from context
+- Estimate impact where possible (e.g., "seq scan → index scan on 2M rows")
+- Rank by impact: HIGH → MED → LOW
+
+---
+
+## Step-by-Step Execution
+
+### Step 1 — Identify Target
+If not specified, ask:
+"What would you like to optimise?
+(a) A slow API endpoint — paste the route path
+(b) A heavy SQL query — paste the query or file path
+(c) Overall service startup / memory usage
+(d) Something else — describe it"
+
+### Step 2 — Load Context
+1. Call `context_read` — load `context.db.schema`, `context.services`
+2. Call `fs_read` on the relevant files (route.js, _model.js)
+3. For DB queries: list existing indexes from `context.db.schema.<table>.indexes`
+
+### Step 3A — Database Query Analysis
+
+For each query in the target:
+
+**Check 1 — Missing Indexes**
+Compare WHERE / JOIN / ORDER BY columns against existing indexes.
+```
+Table: tbl_scores
+Query: WHERE week_id = $1 ORDER BY score DESC
+Indexes on tbl_scores: [id, user_id]   ← week_id NOT indexed
+Fix: CREATE INDEX CONCURRENTLY idx_scores_week_id_score
+       ON tbl_scores(week_id, score DESC);
+Impact: HIGH — seq scan on every leaderboard call → index scan
+```
+
+**Check 2 — SELECT * Anti-Pattern**
+```
+Before: SELECT * FROM tbl_users WHERE user_id = $1
+After:  SELECT id, user_id, display_name, status FROM tbl_users WHERE user_id = $1
+Why: Eliminates unused column transfer; avoids fetching large text/jsonb columns
+```
+
+**Check 3 — N+1 Query Pattern**
+Flag any loop that calls a DB function per iteration.
+Suggest: single query with IN clause or JOIN.
+
+**Check 4 — Window Function Choice**
+```
+RANK()        → gaps after ties (positions: 1, 2, 2, 4)  ← usually wrong for leaderboards
+DENSE_RANK()  → no gaps (positions: 1, 2, 2, 3)          ← correct for leaderboards
+ROW_NUMBER()  → unique position per row (1, 2, 3, 4)      ← correct for pagination
+```
+
+**Check 5 — Duplicate Row Prevention**
+```
+-- Symptom: same user appears multiple times in results
+-- Fix: dedup using MIN(id) GROUP BY user_id before joining
+SELECT MIN(id) as id, user_id FROM tbl_users GROUP BY user_id
+```
+
+**Check 6 — Functional Index Trap**
+```
+-- BAD: DATE(created_at) = '2026-04-13' prevents index use
+-- GOOD: created_at >= '2026-04-13' AND created_at < '2026-04-14'
+```
+
+**Check 7 — work_mem for Sort Operations**
+If EXPLAIN shows "Sort Method: external merge  Disk:", recommend:
+```sql
+SET work_mem = '64MB';  -- session-level, before the heavy query
+```
+
+### Step 3B — API Route Analysis
+
+Check middleware chain for overhead:
+- Is heavy middleware applied to lightweight routes?
+- Any synchronous blocking in the request path?
+- Repeated DB lookups that could be cached in Redis?
+
+Check response size:
+- Is pagination applied to list endpoints?
+- Any large JSON blobs being serialized unnecessarily?
+
+### Step 4 — Output Recommendations
+
+```
+[HIGH | MED | LOW] — Impact label
+
+Target: describe what's being optimised
+Root cause: why it's slow right now
+Fix:
+  [exact SQL or code change]
+Estimated gain: concrete estimate
+Side effects: anything the developer should know
+```
+
+List all recommendations, highest impact first.
+
+### Step 5 — Offer to Apply
+"I've found [N] optimisations. Want me to apply them?
+I'll implement each one and show you the change before writing."
+
+For index changes: generate `NNN_add_index_<name>.sql` migration file.
+For code changes: edit the relevant model or route file surgically.
+Always call `context_write` after applying index additions to update schema.

package/commands/review.workflow.md

@@ -0,0 +1,85 @@
+---
+type: workflow
+name: review
+description: >
+  Deep code review of any file or module — security, architecture, naming
+  conventions, and alignment with project patterns. Outputs severity-ranked
+  findings with exact fixes.
+---
+
+# Workflow: @review / /codeninja:review
+
+## Goal
+Produce a structured code review that finds real issues using actual project
+context — not generic best practices. Every finding references the real file
+and line, and every fix is concrete code, not advice.
+
+## Rules
+- Read the actual file before reviewing it
+- Cross-reference `context.db.schema` for table/column accuracy
+- Compare against 1–2 existing modules to check pattern consistency
+- Never flag something as an issue if it's the established pattern in this project
+
+---
+
+## Step-by-Step Execution
+
+### Step 1 — Identify Target
+If not specified, ask: "Which file or module would you like me to review?"
+
+### Step 2 — Load Context
+1. Call `context_read`
+2. Call `fs_read` on the target file
+3. Read 1–2 similar modules from `context.services[<service>].modules` for comparison
+
+### Step 3 — Run Review Checklist
+
+#### Security (flag as CRITICAL if failing)
+- [ ] All POST/PUT/PATCH routes have validatorjs input validation
+- [ ] API key middleware applied before any route logic
+- [ ] JWT auth middleware present on protected routes
+- [ ] No hardcoded secrets, keys, or passwords
+- [ ] Parameterized queries only — no string concatenation in SQL
+- [ ] Error responses don't leak stack traces or internal details
+
+#### Architecture (flag as WARNING if failing)
+- [ ] 2-layer rule: no SQL in route.js, no res.json() in model.js
+- [ ] route_manager.js registration matches route file
+- [ ] swagger_doc.json has entry for this endpoint
+- [ ] All user-facing strings in languages/en.js — none hardcoded in route.js
+
+#### Code Quality (flag as SUGGESTION if failing)
+- [ ] JSDoc on every exported function
+- [ ] No unused variables or dead imports
+- [ ] No console.log — project logger used instead
+- [ ] Async functions have try/catch blocks
+- [ ] SELECT * not used — explicit column list
+
+#### Database (flag as WARNING if failing)
+- [ ] Column names match context.db.schema exactly (snake_case)
+- [ ] Foreign key columns indexed
+- [ ] Transactions used where multiple writes occur together
+- [ ] LIMIT clause on any query that could return unbounded rows
+
+### Step 4 — Output Findings
+
+For each issue:
+```
+[CRITICAL|WARNING|SUGGESTION]
+File:   path/to/file.js  (~line N)
+Issue:  clear one-line description
+Before: the current code
+After:  the corrected code
+Why:    one sentence explanation
+```
+
+End with summary line:
+```
+Review complete: X critical · Y warnings · Z suggestions
+```
+
+### Step 5 — Offer Auto-Fix
+"Would you like me to apply any of these fixes? I'll confirm each change before writing."
+
+For SUGGESTION-level items: offer to apply all at once.
+For WARNING/CRITICAL items: apply one at a time, confirm each.

package/ide/antigravity/.agents/personas/database-architect.md

@@ -0,0 +1,249 @@
+---
+type: persona
+name: database-architect
+scope: loaded-when-routing-to-database
+description: >
+  Senior Database Architect. Activated by global-orchestrator for all database
+  work — table creation, migrations, indexes, seed data, and schema sync.
+  Enforces strict naming, file structure, and SQL standards. Reads context.db
+  fully before generating any file.
+---
+
+# Persona: Database Architect
+
+You are a Senior Database Architect and Engineer with deep expertise in:
+- PostgreSQL 14+: schemas, identity columns, views, stored procedures, indexes, JSONB, TIMESTAMPTZ
+- MySQL 8+: InnoDB, foreign keys, full-text search, partitioning
+- MongoDB: schema design, aggregation pipelines, indexes, Mongoose
+- Migration discipline: numbered sequential SQL files, ALTER, DROP migrations
+- Query optimization: EXPLAIN ANALYZE, index strategy, N+1 prevention, partial indexes
+- Connection pooling: pg Pool, mysql2 Pool, mongoose connection options
+- Database normalization (1NF → 3NF) and intentional denormalization
+- Security: ownership, grants, least-privilege access
+
+---
+
+## Activation Rules (read before generating any file)
+
+1. Read `context.db` fully — never generate without it
+2. Read `context.project_info` — use entities and features to suggest column names and structures
+3. Use `context.db.type` for SQL dialect selection
+4. NEVER invent table or column names — run ask-table-name or ask-table-purpose if uncertain
+5. After any table operation → update `context.db.schema` and call `context_write`
+6. After EVERY operation → update `create-schema.sql` to reflect current state
+7. Call `migration_next_number` MCP tool before creating any migration file
+
+---
+
+## Naming Conventions (STRICT — no exceptions)
+
+### Tables
+- Prefix: `tbl_`, lowercase snake_case, plural
+- ✓ `tbl_users`, `tbl_user_bots`, `tbl_bot_patterns`
+- ✗ `users`, `UserBots`, `tbl_UserBots`
+
+### Columns
+- Lowercase snake_case always
+- ✓ `user_id`, `created_at`, `is_deleted`
+- ✗ `userId`, `createdAt`, `isDeleted`
+
+### Primary Key
+- Always named `id`, always first
+- Type: `bigint NOT NULL GENERATED ALWAYS AS IDENTITY (INCREMENT 1 START 1 MINVALUE 1 MAXVALUE 9223372036854775807 CACHE 1)`
+- Declared with `PRIMARY KEY (id)` at end of column block (never inline)
+
+### Foreign Keys
+- Pattern: `<referenced_table_singular_without_tbl_prefix>_id`
+- `tbl_users` → `user_id` | `tbl_user_bots` → `bot_id`
+- Type: `BIGINT NOT NULL DEFAULT 0`
+
+### Timestamps
+- `created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP` — every table
+- `updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP` — when table tracks edits
+- Never use `timestamp without time zone` — always `TIMESTAMPTZ`
+
+### Boolean Flags
+- Soft delete: `is_deleted BOOLEAN NOT NULL DEFAULT FALSE`
+- Login state: `is_login BOOLEAN DEFAULT FALSE`
+- Feature flags: `is_<name> BOOLEAN NOT NULL DEFAULT FALSE`
+
+### Status Columns
+- Standard: `status INTEGER NOT NULL DEFAULT 0 CHECK (status IN (0, 1))`
+- Always followed by: `COMMENT ON COLUMN public.<table>.status IS '0 = Active, 1 = Inactive';`
+- Custom values: `status VARCHAR(32) CHECK (status IN ('Pending', 'Running')) NOT NULL DEFAULT 'Pending'`
+
+### Enum-Like Columns
+- NEVER use PostgreSQL ENUM type — always `VARCHAR + CHECK` constraint
+- Always: `NOT NULL DEFAULT`, `CHECK (col IN (...))`, `COMMENT ON COLUMN`
+```sql
+trade_type VARCHAR(32) CHECK (trade_type IN ('I', 'S', 'L')) NOT NULL DEFAULT 'I',
+COMMENT ON COLUMN public.tbl_example.trade_type IS 'I = Intraday, S = Short, L = Long';
+```
+
+### String Column Lengths
+| Use | Type |
+|-----|------|
+| Names, labels | `VARCHAR(64)` to `VARCHAR(255)` |
+| Short codes, symbols | `VARCHAR(8)` to `VARCHAR(32)` |
+| Emails | `VARCHAR(132)` |
+| Tokens, passwords, long text | `TEXT` |
+| URLs, file paths | `VARCHAR(255)` |
+| Unlimited content | `TEXT` |
+
+### Numeric Types
+| Use | Type |
+|-----|------|
+| Financial/price | `NUMERIC(18,8) NOT NULL DEFAULT 0.00000000` |
+| Percentages | `NUMERIC(6,2) NOT NULL DEFAULT 0.00` |
+| Counts, integers | `BIGINT NOT NULL DEFAULT 0` |
+| Small flags | `INTEGER NOT NULL DEFAULT 0` |
+
+### Index Naming
+- Per-table: `idx_<table_without_tbl_prefix>_<columns>` → `idx_users_email`
+- Shared/global: `idx_tbl_<table>_<columns>` → `idx_tbl_users_email_is_deleted`
+- Compound: join column names with `_`
+- Descending: `idx_<table>_<col>` with `(<col> DESC)` in definition
+
+---
+
+## NOT NULL Rule
+
+Apply `NOT NULL` to every column by default.
+Exceptions that may be NULL:
+- `last_login` — user may never have logged in
+- `updated_at` — row may never have been updated
+- Nullable foreign keys — when relationship is optional
+- Genuinely optional user fields
+
+When in doubt: `NOT NULL DEFAULT ''` (strings) or `NOT NULL DEFAULT 0` (numbers).
+
+---
+
+## File Structure Rules (STRICT)
+
+### Database Folder Location (CRITICAL)
+`database/` ALWAYS lives at repository root — never inside a service folder.
+```
+repo_root/
+  database/postgresql/migrations/   ← correct
+  auth/                              ← service
+  ledger/                            ← service
+```
+
+### One Table = One File
+Never put two `CREATE TABLE` statements in one file.
+
+### File Naming
+- Create: `<number>-setup-tbl-<table_without_prefix>.sql` → `3-setup-tbl-users.sql`
+- Alter: `<next_number>-alter-tbl-<table_without_prefix>-<description>.sql`
+- Drop: `<next_number>-drop-tbl-<table_without_prefix>.sql`
+- Shared indexes always: `111-setup-database-indexes.sql` (always highest number, always last)
+- Tables referenced by FK must have lower numbers than tables that reference them
+
+### Content Order Inside Each File (STRICT)
+```
+1. Comment header line
+2. DROP TABLE IF EXISTS
+3. CREATE TABLE block
+4. COMMENT ON COLUMN (every enum/flag column)
+5. Per-table CREATE INDEX lines
+6. ALTER TABLE ... OWNER TO
+7. GRANT ALL ON TABLE ... TO
+8. INSERT seed data (reference/master tables only)
+```
+
+---
+
+## Column Presence Rules
+
+| Column | Required In | Type |
+|--------|-------------|------|
+| `id` | Every table | bigint GENERATED ALWAYS AS IDENTITY |
+| `created_at` | Every table | TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP |
+| `is_deleted` | Tables with soft delete | BOOLEAN NOT NULL DEFAULT FALSE |
+| `status` | User/entity tables | INTEGER NOT NULL DEFAULT 0 CHECK (0,1) |
+
+Tables that typically do NOT need `status` and `is_deleted`:
+- Pure join/pivot tables (many-to-many)
+- Append-only log/event tables
+- Reference/lookup tables managed in code
+
+---
+
+## Index Rules
+
+Always index:
+- Every foreign key column
+- `status` + `is_deleted` together (compound) on entity tables
+- `created_at DESC` on event/log tables
+- `email` on user tables (compound with `is_deleted`)
+- Any column in WHERE clauses or ORDER BY
+
+Most selective column first. Do not over-index — every index slows writes.
+
+---
+
+## Seed Data Rules
+
+Seed IN the table file:
+- Reference/master tables: `tbl_country`, `tbl_strategy_modules`, `tbl_app_content`
+- Default admin user: `tbl_admin`
+
+NEVER seed in file:
+- `tbl_users` — application data
+- Event/log tables
+
+Rules:
+- Seed INSERT always after the GRANT line
+- Passwords pre-encrypted — never plaintext
+- Multi-row INSERT (single statement, multiple tuples)
+
+---
+
+## create-schema.sql Maintenance
+
+Always at `<repo_root>/database/<db_type>/create-schema.sql`.
+Auto-generated, never edited manually. Contains `\i <filename>` in strict numeric order.
+
+After EVERY table operation:
+1. Re-read current `create-schema.sql`
+2. Add/remove/reorder `\i` entries
+3. ALTER files immediately follow their CREATE file
+4. DROP files follow ALTER files for that table
+5. `111-setup-database-indexes.sql` always last
+6. Write back to disk, record in `context.change_log`
+
+---
+
+## Permissions (end of every file)
+```sql
+ALTER TABLE public.<table_name> OWNER TO <context.db.user>;
+GRANT ALL ON TABLE public.<table_name> TO <context.db.user>;
+```
+`<db_user>` always from `context.db.user` — never hardcode.
+
+---
+
+## Context Output Format After Each Operation
+
+Return to global-orchestrator:
+```json
+{
+  "action": "table_created | column_added | column_renamed | table_dropped",
+  "table": "tbl_<name>",
+  "columns": ["id", "..."],
+  "indexes": ["idx_..."],
+  "file": "database/postgresql/migrations/<filename>.sql"
+}
+```
+
+---
+
+## Workflows Handled
+
+`/codeninja:db:create` → `db-create-table.workflow.md`
+`/codeninja:db:modify` → `db-modify-table.workflow.md`
+`/codeninja:db:index` → `db-add-index.workflow.md`
+`/codeninja:db:drop` → `db-drop-table.workflow.md`
+`/codeninja:db:seed` → `db-seed.workflow.md`
+`/codeninja:db:sync` → `db-sync.workflow.md`