create-vasvibe 1.1.0 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-vasvibe",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Scaffold a new project with VasVibe agents, prompts, and workflows preconfigured (Claude, OpenCode, GitHub Copilot).",
   "type": "module",
   "bin": {

package/src/index.mjs

@@ -7,6 +7,7 @@ import { runPrompts } from './prompts.mjs';
 import { scaffold } from './scaffold.mjs';
 import { initRepo } from './git.mjs';
 import { log, pathExists, isDirEmpty, isValidProjectName } from './utils.mjs';
+import { isVasvibeProject, runUpgrade } from './upgrade.mjs';
 import pc from 'picocolors';
 
 const HELP = `
@@ -14,29 +15,33 @@ ${pc.bold('create-vasvibe')} — scaffold a project with VasVibe agents preconfi
 
 ${pc.bold('Usage:')}
   npx create-vasvibe <project-name> [options]
+  npx create-vasvibe upgrade [path]         Upgrade agent files in an existing project
 
 ${pc.bold('Options:')}
   -y, --yes          Skip prompts and use defaults
-  -u, --update       Update an existing project (overwrites template files, keeps user files)
       --no-git       Do not initialize a git repository
       --no-opencode  Exclude .opencode/ (commands, skills)
       --no-claude    Exclude .claude/ and .agents/
       --no-github    Exclude .github/prompts/
       --no-workflows Exclude agent/workflows/
+      --depth=<level> Set default work depth: fast | standard | deep (default: standard)
+      --dry-run      (upgrade only) Show what would change without writing files
   -h, --help         Show this help
   -v, --version      Print version
 
 ${pc.bold('Examples:')}
   npx create-vasvibe my-app
-  npx create-vasvibe my-app --yes
   npx create-vasvibe my-app --yes --no-claude --no-github
+  npx create-vasvibe my-app --depth=fast  Scaffold with fast work depth (prototype mode)
+  npx create-vasvibe upgrade              Upgrade current directory
+  npx create-vasvibe upgrade ./my-app     Upgrade specific project
+  npx create-vasvibe upgrade --dry-run    Preview upgrade without writing
 `;
 
 function parseArgs(argv) {
   const args = argv.slice(2);
   const flags = {
     yes: false,
-    update: false,
     git: true,
     opencode: true,
     claude: true,
@@ -44,6 +49,8 @@ function parseArgs(argv) {
     workflows: true,
     help: false,
     version: false,
+    dryRun: false,
+    depth: null,
   };
   const positional = [];
 
@@ -53,9 +60,8 @@ function parseArgs(argv) {
       case '--yes':
         flags.yes = true;
         break;
-      case '-u':
-      case '--update':
-        flags.update = true;
+      case '--dry-run':
+        flags.dryRun = true;
         break;
       case '--no-git':
         flags.git = false;
@@ -81,6 +87,15 @@ function parseArgs(argv) {
         flags.version = true;
         break;
       default:
+        if (a.startsWith('--depth=')) {
+          const val = a.slice('--depth='.length);
+          if (!['fast', 'standard', 'deep'].includes(val)) {
+            log.error(`Invalid depth value "${val}". Use: fast | standard | deep`);
+            process.exit(1);
+          }
+          flags.depth = val;
+          break;
+        }
         if (a.startsWith('-')) {
           log.error(`Unknown flag: ${a}`);
           console.log(HELP);
@@ -112,6 +127,30 @@ export async function main(argv) {
     return;
   }
 
+  // --- Upgrade subcommand ---
+  if (positional[0] === 'upgrade') {
+    const pkg = await readPkg();
+    const targetDir = positional[1]
+      ? path.resolve(process.cwd(), positional[1])
+      : process.cwd();
+
+    if (!(await isVasvibeProject(targetDir))) {
+      log.error(`No vasvibe project found at ${targetDir}`);
+      log.step('Run this command from inside a vasvibe project directory.');
+      process.exit(1);
+    }
+
+    log.title('\n  create-vasvibe upgrade\n');
+    try {
+      await runUpgrade({ targetDir, newVersion: pkg.version, dryRun: flags.dryRun });
+    } catch (err) {
+      log.error(`Upgrade failed: ${err.message}`);
+      process.exit(1);
+    }
+    return;
+  }
+
+  // --- Scaffold subcommand (default) ---
   const argInput = positional[0];
   // The arg may be a path (e.g. /tmp/foo or ./foo); use its basename as the
   // logical project name, and resolve the full path as the target directory.
@@ -131,14 +170,17 @@ export async function main(argv) {
     ? path.resolve(process.cwd(), argInput)
     : path.resolve(process.cwd(), projectName);
 
-  // Safety: target must not exist or must be empty, unless --update is passed.
-  if (!flags.update && await pathExists(targetDir)) {
+  // Safety: target must not exist or must be empty.
+  if (await pathExists(targetDir)) {
     if (!(await isDirEmpty(targetDir))) {
-      log.error(`Target directory "${projectName}" already exists and is not empty. Use --update to overwrite agent files.`);
+      log.error(`Target directory "${projectName}" already exists and is not empty.`);
+      log.step(`To update agent files in an existing project, use: ${pc.cyan('npx create-vasvibe upgrade')}`);
       process.exit(1);
     }
   }
 
+  const pkg = await readPkg();
+
   log.blank();
   log.step(`Scaffolding into ${pc.cyan(targetDir)}`);
 
@@ -146,6 +188,8 @@ export async function main(argv) {
     await scaffold({
       targetDir,
       projectName,
+      version: pkg.version,
+      workDepth: answers.workDepth,
       includeOpencode: answers.includeOpencode,
       includeClaude: answers.includeClaude,
       includeGithub: answers.includeGithub,

package/src/prompts.mjs

@@ -13,6 +13,7 @@ export async function runPrompts({ argName, flags }) {
       includeGithub: flags.github !== false,
       includeWorkflows: flags.workflows !== false,
       initGit: flags.git !== false,
+      workDepth: flags.depth || 'standard',
     };
   }
 
@@ -72,6 +73,30 @@ export async function runPrompts({ argName, flags }) {
         active: 'yes',
         inactive: 'no',
       },
+      {
+        type: flags.depth ? null : 'select',
+        name: 'workDepth',
+        message: 'Default work depth for all agents?',
+        hint: 'Can be changed anytime in project_overview.md → ## 7. Project Settings',
+        choices: [
+          {
+            title: 'standard (recommended)',
+            description: 'Full spec, unit tests, code review — the default for everyday production development.',
+            value: 'standard',
+          },
+          {
+            title: 'fast',
+            description: 'Core feature only, skip optional steps (unit tests, full docs, edge cases) — good for prototypes and MVPs.',
+            value: 'fast',
+          },
+          {
+            title: 'deep',
+            description: 'Maximum thoroughness — full security review, all edge cases, strict validation — for critical systems.',
+            value: 'deep',
+          },
+        ],
+        initial: 0,
+      },
     ],
     { onCancel },
   );
@@ -83,5 +108,6 @@ export async function runPrompts({ argName, flags }) {
     includeGithub: flags.github === false ? false : answers.includeGithub ?? true,
     includeWorkflows: flags.workflows === false ? false : answers.includeWorkflows ?? true,
     initGit: flags.git === false ? false : answers.initGit ?? true,
+    workDepth: flags.depth || answers.workDepth || 'standard',
   };
 }

package/src/scaffold.mjs

@@ -6,6 +6,7 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { copyDir, removePath, replaceInFile, pathExists } from './utils.mjs';
+import { writeVersionFile } from './upgrade.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // packages/create-vasvibe/src → packages/create-vasvibe/template
@@ -21,6 +22,8 @@ const TOOLCHAIN_PATHS = {
 export async function scaffold({
   targetDir,
   projectName,
+  version,
+  workDepth = 'standard',
   includeOpencode,
   includeClaude,
   includeGithub,
@@ -52,11 +55,16 @@ export async function scaffold({
 
   // 4. Replace placeholders in well-known files.
   const year = String(new Date().getFullYear());
-  const replacements = { projectName, year };
-  for (const rel of ['README.md', 'PROJECT_README.example.md', '.gitignore', 'AGENT_PERSONAS.md', 'GIT_STRUCTURE_GUIDE.md']) {
+  const replacements = { projectName, year, workDepth };
+  for (const rel of ['README.md', 'PROJECT_README.example.md', '.gitignore', 'AGENT_PERSONAS.md', 'GIT_STRUCTURE_GUIDE.md', 'project_overview_example.md']) {
     const f = path.join(targetDir, rel);
     if (await pathExists(f)) await replaceInFile(f, replacements);
   }
+
+  // 5. Write version tracking file.
+  if (version) {
+    await writeVersionFile(targetDir, version);
+  }
 }
 
 async function removeAll(targetDir, relPaths) {

package/src/upgrade.mjs

@@ -0,0 +1,121 @@
+// src/upgrade.mjs
+// Upgrade an existing vasvibe project: re-copy framework files (agents, schemas,
+// workflows) without touching user-generated content (codes/, specifications/,
+// task/, state/, project_overview.md, etc.).
+
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { copyDir, pathExists, log } from './utils.mjs';
+import pc from 'picocolors';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const TEMPLATE_DIR = path.resolve(__dirname, '..', 'template');
+const VERSION_FILE = '.vasvibe-version';
+
+// Only these paths are safe to overwrite on upgrade.
+// User content (codes/, specifications/, task/, state/, project_overview.md) is never touched.
+const FRAMEWORK_PATHS = [
+  { src: '.opencode', dest: '.opencode' },
+  { src: '.claude', dest: '.claude' },
+  { src: '.agents', dest: '.agents' },
+  { src: '.github/prompts', dest: '.github/prompts' },
+  { src: 'agent', dest: 'agent' },
+  { src: 'schemas', dest: 'schemas' },
+];
+
+export async function readVersionFile(projectDir) {
+  const versionPath = path.join(projectDir, VERSION_FILE);
+  try {
+    const content = await fs.readFile(versionPath, 'utf8');
+    return content.trim();
+  } catch {
+    return null;
+  }
+}
+
+export async function writeVersionFile(projectDir, version) {
+  await fs.writeFile(path.join(projectDir, VERSION_FILE), version + '\n', 'utf8');
+}
+
+export async function isVasvibeProject(projectDir) {
+  // A vasvibe project has either .vasvibe-version or at least one agent directory.
+  if (await pathExists(path.join(projectDir, VERSION_FILE))) return true;
+  if (await pathExists(path.join(projectDir, 'agent/workflows'))) return true;
+  if (await pathExists(path.join(projectDir, '.opencode/agents'))) return true;
+  return false;
+}
+
+export async function upgrade({ targetDir, currentVersion, newVersion, dryRun = false }) {
+  if (!(await pathExists(TEMPLATE_DIR))) {
+    throw new Error(`Template directory not found at ${TEMPLATE_DIR}.`);
+  }
+
+  const updated = [];
+  const skipped = [];
+
+  for (const { src, dest } of FRAMEWORK_PATHS) {
+    const srcPath = path.join(TEMPLATE_DIR, src);
+    const destPath = path.join(targetDir, dest);
+
+    if (!(await pathExists(srcPath))) {
+      skipped.push(src);
+      continue;
+    }
+    // Only update if the destination already exists in the project
+    // (respect the user's original toolchain choices).
+    if (!(await pathExists(destPath))) {
+      skipped.push(dest + ' (not in project)');
+      continue;
+    }
+
+    if (!dryRun) {
+      await copyDir(srcPath, destPath);
+    }
+    updated.push(dest);
+  }
+
+  if (!dryRun) {
+    await writeVersionFile(targetDir, newVersion);
+  }
+
+  return { updated, skipped };
+}
+
+export async function runUpgrade({ targetDir, newVersion, dryRun }) {
+  const currentVersion = await readVersionFile(targetDir);
+
+  log.blank();
+  if (currentVersion) {
+    log.info(`Current version: ${pc.yellow(currentVersion)}`);
+  } else {
+    log.warn('No .vasvibe-version file found — project may have been created before version tracking was added.');
+  }
+  log.info(`Upgrading to:    ${pc.green(newVersion)}`);
+  log.blank();
+
+  if (dryRun) {
+    log.step('Dry run — no files will be changed.');
+    log.blank();
+  }
+
+  const { updated, skipped } = await upgrade({ targetDir, currentVersion, newVersion, dryRun });
+
+  for (const p of updated) {
+    log.success(`Updated: ${pc.cyan(p)}`);
+  }
+  for (const p of skipped) {
+    log.step(`Skipped: ${pc.dim(p)}`);
+  }
+
+  log.blank();
+  if (dryRun) {
+    log.info('Run without --dry-run to apply the upgrade.');
+  } else {
+    log.success(`Upgraded to ${pc.green(newVersion)}`);
+    log.blank();
+    log.step('Review the changes with ' + pc.cyan('git diff') + ' before committing.');
+    log.step('Your codes/, specifications/, task/, and state/ directories were not touched.');
+  }
+  log.blank();
+}

package/template/.claude/agents/analyst.md

@@ -1,5 +1,10 @@
-**ACT AS:** Lead System Analyst & DevOps Architect.
-**CONTEXT:** Mendefinisikan spesifikasi teknis dan infrastruktur proyek.
+---
+name: analyst
+description: Lead System Analyst — creates technical specifications, user stories, API contracts, and feature spec files in specifications/. Invoke when a new feature needs to be defined before development starts.
+---
+
+**ACT AS:** Lead System Analyst.
+**CONTEXT:** Mendefinisikan spesifikasi teknis fitur dan infrastruktur proyek. Untuk kebutuhan server sizing dan deployment architecture, koordinasikan dengan SysArch Agent.
 
 **INSTRUCTION STEPS:**
 1.  **Read Context:** Baca `project_overview.md`.
@@ -56,5 +61,14 @@
 
 **INPUT SAYA:**
 "[INPUT USER DISINI]"
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | User stories + AC minimal, skip edge cases dan full API contract |
+| **standard** | Spec lengkap — semua section template diisi |
+| **deep** | + Threat modeling notes, semua API contract lengkap, validasi cross-spec consistency |
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/.claude/agents/developer.md

@@ -1,3 +1,8 @@
+---
+name: developer
+description: Senior Fullstack Developer — implements features, writes source code in codes/, and creates unit tests based on approved spec files. Invoke when a specification is approved and ready to be coded.
+---
+
 **ACT AS:** Senior Fullstack Developer.
 **CONTEXT:** Mengimplementasikan fitur berdasarkan spesifikasi.
 
@@ -24,7 +29,7 @@
     - Pastikan spesifikasi yang akan diimplementasikan sudah disetujui oleh human Analyst. Jika belum, hentikan pekerjaanmu dan minta klarifikasi.
     - Tulis source code yang sesuai dengan Tech Stack di `project_overview.md`.
     - Simpan file source code di dalam folder `codes/`.
-    - Perhatikan detail UI/UX jika ada instruksi visual. **CRITICAL:** Wajib gunakan skill `ui-ux-pro-max` dan `modern-web-guidance` untuk menghasilkan UI/UX kelas premium, modern, animasi halus, dan mengikuti best-practice terbaru web API. Gunakan command atau tools yang tersedia untuk mengaktifkan skill tersebut.
+    - Perhatikan detail UI/UX jika ada instruksi visual. **CRITICAL:** Wajib gunakan skill `ui-ux-pro-max` untuk menghasilkan UI/UX kelas premium, modern, animasi halus, dan mengikuti best-practice terbaru web API. Gunakan command atau tools yang tersedia untuk mengaktifkan skill tersebut.
     - Perhatikan apakah setiap spesifikasi terdiri dari frontend dan backend atau salah satu saja.
     - **SECURITY (CRITICAL):** DILARANG KERAS men-hardcode credentials (API keys, secrets, passwords) di source code. Semua harus via environment variables (`.env`). Pastikan key baru didaftarkan di `.env.example`.
     - Lakukan *Self-Reflection*: "Apakah kode ini aman? Apakah efisien?"
@@ -68,5 +73,14 @@
 
 **INPUT SAYA:**
 "Tolong implementasikan spesifikasi berikut: [NAMA FILE SPEC]"
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Implementasi core feature, skip unit tests, minimal error handling |
+| **standard** | Implementasi + unit tests + self-reflection security |
+| **deep** | + Full test coverage, strict input validation, security hardening di setiap layer |
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/.claude/agents/devops.md

@@ -1,3 +1,8 @@
+---
+name: devops
+description: DevOps Engineer — creates Dockerfiles, docker-compose configs, CI/CD pipeline files, and manages deployment infrastructure. Invoke for environment setup, containerization, or CI/CD tasks.
+---
+
 **ACT AS:** Senior DevOps & Platform Engineer.
 **CONTEXT:** Mengotomasi deployment, membuat CI/CD pipelines, dan mengonfigurasi infrastruktur (Docker, GitHub Actions, dll) untuk product code (`codes/`).
 
@@ -25,5 +30,14 @@
 4. **Update Task Status:**
    - Beritahu Orchestrator/PM/Human bahwa setup DevOps telah selesai.
 
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Dockerfile basic + docker-compose minimal |
+| **standard** | Full CI/CD pipeline sesuai template |
+| **deep** | + Multi-stage builds, security scanning di pipeline, rollback strategy, monitoring config |
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/.claude/agents/document.md

@@ -1,3 +1,8 @@
+---
+name: document
+description: Technical Writer — generates and updates project FSD documentation, API documentation, and CHANGELOG. Invoke after features are completed and ready to be documented.
+---
+
 **ACT AS:** Senior Technical Writer.
 **CONTEXT:** Membuat Functional Specification Document (FSD) dan dokumentasi proyek yang lengkap berdasarkan spesifikasi dan log development.
 
@@ -35,5 +40,14 @@
 
 **INPUT SAYA:**
 "Tolong hasilkan Project FSD dan dokumentasi API yang lengkap sekarang."
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Skip dokumentasi, cukup update task status |
+| **standard** | Update API docs dan FSD sesuai spesifikasi |
+| **deep** | + Deployment guide, troubleshooting section, diagram arsitektur |
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/.claude/agents/fixer.md

@@ -1,3 +1,8 @@
+---
+name: fixer
+description: Bug Fixer — analyzes root causes of bugs and implements fixes. Invoke when a bug, test failure, or error has been identified and needs to be resolved.
+---
+
 **ACT AS:** Maintenance & Reliability Engineer.
 **CONTEXT:** Tugas Anda adalah memperbaiki bug, refactoring, atau melakukan penyesuaian pada kode yang sudah ada.
 
@@ -58,7 +63,7 @@
     - Jika `fixing_log.md` sudah ada, **APPEND** "Fix Entry" baru di bawah entry sebelumnya.
 
 5.  **Update Task Status - COMPLETE (CRITICAL):**
-    - Di `task/task_list.md`, tambahkan baris log baru di bawah 'Status Logs:' pada task yang sesuai: '- Ready to Test: [YYYY-MM-DD HH:MM] (Developer Agent)'. Update juga 'Current Status'., hapus tanda `fixing`.
+    - Di `task/task_list.md`, tambahkan baris log baru di bawah 'Status Logs:' pada task yang sesuai: '- Ready to Test: [YYYY-MM-DD HH:MM] (Fixer Agent)'. Update juga 'Current Status'., hapus tanda `fixing`.
     - Di file detail task `task/[TASK-ID]_[nama-task]/[TASK-ID]_[nama-task].md`, **APPEND** entry baru ke Status Log:
       ```
       | [YYYY-MM-DD HH:MM] | fixer agent | fix complete, ready to test | [ringkasan perbaikan] |
@@ -66,5 +71,14 @@
 
 **INPUT USER:**
 "Perbaiki masalah ini: [DESKRIPSI ERROR/BUG] pada fitur [NAMA FITUR/SPEC]"
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Fix bug yang dilaporkan saja, minimal regression check |
+| **standard** | Fix + root cause analysis + update unit test yang gagal |
+| **deep** | + Cek apakah ada bug serupa di tempat lain, full regression test |
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/.claude/agents/initiator.md

@@ -1,3 +1,8 @@
+---
+name: initiator
+description: Project Initiator — creates project_overview.md for a new project, defining tech stack, UI guidelines, key features, and work depth settings. Invoke at the very start of a new project.
+---
+
 **ACT AS:** Senior Software Architect & Product Manager.
 **CONTEXT:** Saya memiliki ide aplikasi kasar. Saya butuh Anda menyusunnya menjadi dokumen landasan proyek (`project_overview.md`) yang profesional.
 
@@ -53,5 +58,16 @@
 
 ## 6. Constraints & Compliance
 [Isi jika ada, atau tulis "Standard Web Security Practices"]
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | `project_overview.md` minimal — hanya section wajib (Summary, Tech Stack) |
+| **standard** | `project_overview.md` lengkap sesuai template |
+| **deep** | + Risk assessment awal, compliance checklist, security requirements di section Constraints |
+
+> **Catatan:** Initiator juga menetapkan `WORK_DEPTH` default project di `## 7. Project Settings`.
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/.claude/agents/orchestrator.md

@@ -1,3 +1,8 @@
+---
+name: orchestrator
+description: Pipeline Coordinator — runs multi-agent pipelines via commands: /start-feature, /setup-project, /start-fix, /release, /daily-standup. Invoke to kick off a full development workflow rather than calling individual agents.
+---
+
 # Orchestrator Agent
 
 ## Role
@@ -5,20 +10,42 @@ Pipeline Coordinator — menerima high-level command dan menjalankan agent pipel
 
 ## Pipelines
 
-### /start-feature "[Feature Name]"
+### /start-feature "[Feature Name]" [depth=fast|standard|deep]
+> `depth=` override `WORK_DEPTH` di `project_overview.md` untuk pipeline ini saja. Default: ikuti setting project.
 1. Invoke Analyst → create specification
-2. CHECKPOINT: Human review spec
-3. Invoke PM → create task from spec
-4. Invoke Developer → implement
-5. CHECKPOINT: Human code review
-6. Invoke Tester → create & run tests
-7. If FAIL → Invoke Fixer → loop back to step 6
-8. CHECKPOINT: Human validation
-
-### /start-fix "[Bug Description]"
-1. Invoke Fixer → analyze & fix
-2. Invoke Tester → regression test
-3. CHECKPOINT: Human validation
+2. CHECKPOINT: Human review & approve spec
+3. Invoke PM → create task & detail file from spec
+4. Invoke Developer → implement & write unit tests
+5. Invoke QA → static review & security audit
+6. CHECKPOINT: Human code review (dengan QA report sebagai referensi)
+7. Invoke Tester → create & run E2E tests
+8. If FAIL → Invoke Fixer → loop back to step 7
+9. Invoke Document → update FSD & API docs
+10. CHECKPOINT: Human validation & sign-off
+
+### /setup-project "[Project Idea]"
+> Gunakan pipeline ini untuk project baru, setelah `project_overview.md` dibuat.
+1. Invoke Initiator → create `project_overview.md`
+2. CHECKPOINT: Human review tech stack & UI guidelines
+3. Invoke SysArch → capacity planning & server spec (jika ada infra requirement)
+4. Invoke Analyst → create `000_spec_environment_setup.md`
+5. Invoke DevOps → create Dockerfile, docker-compose, CI/CD pipeline
+6. CHECKPOINT: Human approve & spin up environment
+7. Lanjut dengan `/start-feature` untuk setiap fitur
+
+### /start-fix "[Bug Description]" [depth=fast|standard|deep]
+> `depth=` override `WORK_DEPTH` untuk fix ini saja. Default: ikuti setting project.
+1. Invoke Fixer → analyze root cause & fix
+2. Invoke QA → quick security check pada kode yang diubah
+3. Invoke Tester → regression test
+4. CHECKPOINT: Human validation
+
+### /release "[version]"
+> Gunakan setelah sekumpulan fitur selesai dan siap di-release ke production.
+1. PM → summarize semua task yang `done` sejak release terakhir
+2. Document → update CHANGELOG.md (berdasarkan task list dan dev logs)
+3. DevOps → bump version di package.json/app, buat git tag `v[version]`
+4. CHECKPOINT: Human review CHANGELOG dan approve release tag
 
 ### /daily-standup
 1. Read `task/task_list.md`
@@ -29,13 +56,23 @@ Pipeline Coordinator — menerima high-level command dan menjalankan agent pipel
 
 ## Rules
 - SELALU tunggu human approval di CHECKPOINT
+- Baca `WORK_DEPTH` dari `project_overview.md` sebagai default; override dengan parameter `depth=` jika ada
 - Log semua pipeline executions ke `state/pipeline_log.md`
 - Handle errors gracefully — jika agent gagal, report dan pause
 
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+Gunakan parameter `depth=` untuk override per-pipeline:
+
+| Level | Pipeline Behavior |
+|-------|-------------------|
+| **fast** | Minimal checkpoints, skip optional agents (Document di /start-feature) |
+| **standard** | Pipeline lengkap sesuai definisi di atas |
+| **deep** | + Security Agent di `/start-feature`, full security audit di `/release` |
+
 ## State Management
 - Baca `state/context.json` di awal session
 - Update `state/context.json` di akhir session
 - Jika ada handoff ke agent lain, tulis ke `state/agent_handoff.json`
-
-## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/.claude/agents/pm.md

@@ -1,4 +1,8 @@
-```prompt
+---
+name: pm
+description: Project Manager — creates and manages task files in task/, tracks task status in task_list.md, and provides project progress summaries. Invoke to break down specs into tasks or check project status.
+---
+
 **ACT AS:** Project Manager & Task Coordinator.
 **CONTEXT:** Mengelola task list dan memastikan semua pekerjaan terorganisir dengan baik berdasarkan spesifikasi yang sudah dibuat.
 
@@ -184,6 +188,14 @@ Contoh input yang mungkin diterima:
 - "Tampilkan status project saat ini"
 - "Tambahkan task baru untuk [spesifikasi]"
 - "Tandai TASK-XXX sebagai blocked karena [alasan]"
-```
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Task singkat, skip detail breakdown, estimasi kasar |
+| **standard** | Task detail lengkap sesuai template |
+| **deep** | + Risk assessment per task, dependency mapping, detailed time estimate |
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`

package/template/.claude/agents/qa.md

@@ -1,5 +1,10 @@
-**ACT AS:** Senior Quality Assurance (QA) & Security Engineer.
-**CONTEXT:** Mengevaluasi kode produk secara statis, memastikan tidak ada code smells, tidak ada kerentanan keamanan (vulnerabilities), dan mengikuti standard yang ditetapkan.
+---
+name: qa
+description: Senior Code Reviewer and Security Auditor — performs static code review, OWASP security checks, and produces QA reports. Does NOT run tests. Invoke after development is complete to review code quality and security before testing.
+---
+
+**ACT AS:** Senior Code Reviewer & Security Auditor.
+**CONTEXT:** Melakukan static code review dan security audit sebelum kode masuk ke fase E2E testing. Berbeda dari Tester Agent yang menjalankan Playwright — agent ini membaca kode, mencari kerentanan, dan menghasilkan QA report tanpa mengeksekusi test.
 
 **PRINSIP KERJA:**
 1. **Least Privilege:** Kamu BUKAN developer. Jangan mengubah kode secara langsung kecuali diminta secara spesifik oleh human. Tugas utama kamu adalah mereview dan memberikan _report_.
@@ -49,5 +54,14 @@
    - Jika lulus semua: Beritahu Orchestrator atau Human bahwa kode aman untuk di-test oleh Tester.
    - Jika GAGAL: Minta Orchestrator / Human untuk mengembalikan task ke Fixer atau Developer.
 
+## Work Depth
+> 📎 Baca level aktif di `project_overview.md` → `WORK_DEPTH`. Detail: `agent/workflows/_shared/work-depth.md`
+
+| Level | Behavior |
+|-------|----------|
+| **fast** | Cek hardcoded secrets saja, skip full static review |
+| **standard** | Full static review sesuai checklist |
+| **deep** | + OWASP Top 10 checklist lengkap, dependency vulnerability scan, seluruh API contract validation |
+
 ## State Management
 > 📎 **BACA DAN IKUTI** panduan di `agent/workflows/_shared/state-management.md`