gemini-helper-friend 2.0.6 → 2.0.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,72 +1,18 @@
1
1
  # Gemini Helper Friend MCP - Subagent Configuration
2
- # YAML for metadata only - prompt templates in MDX files
3
- # Version: 2.1 - Enhanced descriptions with forcing patterns
4
- # Optimization: Detailed descriptions that force high-quality, structured prompts
5
-
6
- version: "2.1"
2
+ version: "2.2"
7
3
 
8
4
  metadata:
9
5
  name: "gemini-helper-friend-mcp"
10
6
  displayName: "Gemini - Helper Friend MCP"
11
- description: "Autonomous AI helper with specialized task types for code review, research, and testing"
12
-
13
- # ============================================================================
14
- # SHARED PRINCIPLES - Apply to ALL task types
15
- # ============================================================================
16
- shared:
17
- core_philosophy: |
18
- These subagents are designed for COMPREHENSIVE task execution through specialized modes.
19
- Vague prompts = vague results. Detailed prompts = actionable insights.
20
-
21
- **CRITICAL:** The quality of output is DIRECTLY proportional to prompt detail.
22
- - Short prompts (50 chars) → Generic, unhelpful responses
23
- - Medium prompts (200 chars) → Partially useful responses
24
- - Detailed prompts (500+ chars) → Specific, actionable insights
25
-
26
- principles:
27
- context_is_king: |
28
- The subagent has NO context about your task except what you provide.
29
- Assume it knows NOTHING about your codebase, your goals, or your constraints.
30
- Provide ALL relevant context - files, requirements, what you've tried, what failed.
31
-
32
- specificity_matters: |
33
- "Check if it's done" → USELESS
34
- "Verify Task X against requirements A, B, C using files X, Y, Z" → ACTIONABLE
35
-
36
- structured_input: |
37
- Follow the template for each task type. Each section exists for a reason.
38
- Skipping sections = missing critical context = suboptimal results.
39
-
40
- workflow_pattern: |
41
- MANDATORY for all subagent calls:
42
- 1. GATHER CONTEXT → Collect all relevant files, requirements, constraints
43
- 2. STRUCTURE PROMPT → Follow the task-specific template (ALL sections!)
44
- 3. CALL SUBAGENT → Execute with async=true (default) or async=false for quick tasks
45
- 4. CHECK STATUS → Poll with check_subagent_task until completed
46
- 5. REVIEW RESULT → Evaluate output, take action on recommendations
47
-
48
- Why this works: Structured context enables the subagent to provide
49
- specific, actionable recommendations instead of generic advice.
50
-
51
- # ============================================================================
52
- # GLOBAL SETTINGS
53
- # ============================================================================
7
+ description: "Autonomous AI helper with specialized task types"
54
8
 
55
9
  settings:
56
10
  defaults:
57
- model: "" # Uses fallback chain (see below)
11
+ model: ""
58
12
  yolo_mode: true
59
13
  append_instructions: true
60
-
61
- # Model fallback chain - tries in order until one succeeds
62
- # 1. gemini-3-flash-preview (fastest, newest)
63
- # 2. gemini-3-pro-preview (more capable)
64
- # 3. gemini-3-pro (stable)
65
- # 4. gemini-2.5-flash (reliable fallback)
66
-
67
14
  cli:
68
15
  command: "gemini"
69
- # Per gemini --help: use positional prompt (--prompt is deprecated)
70
16
  flags:
71
17
  yolo: "--yolo"
72
18
  model: "--model"
@@ -75,996 +21,92 @@ settings:
75
21
  approval_mode: "--approval-mode"
76
22
  include_directories: "--include-directories"
77
23
 
78
- # ============================================================================
79
- # TASK TYPE DEFINITIONS (Metadata Only - Templates in MDX)
80
- # ============================================================================
81
-
82
24
  task_types:
83
-
84
25
  completion-inspector:
85
26
  display_name: "Completion Inspector"
86
- description: |
87
- **🔍 CTO-LEVEL CODE INSPECTOR - Verifies if task is TRULY 100% complete**
88
-
89
- This subagent performs exhaustive verification that your implementation meets ALL requirements,
90
- follows existing patterns, and leaves no cleanup debt.
91
-
92
- **What it analyzes:**
93
- - Git diff (line-by-line change review against requirements)
94
- - Codebase patterns (consistency with existing code style)
95
- - Duplicate detection (find similar code that should be abstracted)
96
- - Quality assessment (identify cleanup opportunities)
97
- - Requirement coverage (map changes to acceptance criteria)
98
-
99
- **Output includes:**
100
- - Completion percentage (0-100%)
101
- - Requirements checklist (✅ met / ❌ not met)
102
- - Quality issues found
103
- - Specific action items with file locations
104
-
27
+ description: "Verifies if task is 100% complete - analyzes git diff, patterns, requirements coverage"
105
28
  category: "verification"
106
- default_model: "" # Auto-select
107
29
  template_file: "completion-inspector.mdx"
108
-
109
- tool_limits:
110
- sequentialthinking_max: 30
111
- sequentialthinking_min: 15
112
- warpgrep_max: 20
113
- warpgrep_min: 8
114
- deep_research_max: 30
115
- web_search_keywords_max: 100
116
-
30
+
117
31
  helper-friend:
118
32
  display_name: "Helper Friend"
119
- description: |
120
- **🧠 RESEARCH COMPANION - Deep analysis, bug investigation, informed decisions**
121
-
122
- This subagent conducts comprehensive research using codebase search, web research,
123
- deep research with file attachments, and community consensus analysis.
124
-
125
- **What it does:**
126
- - Codebase search (understand code structure, find similar patterns)
127
- - Web research (best practices, documentation, tutorials)
128
- - Deep research (technical questions with YOUR code as context)
129
- - Reddit consensus (community experiences, real-world feedback)
130
-
131
- **Use cases:**
132
- - 🐛 Bug investigation & root cause analysis
133
- - 🏗️ Architecture & technology decisions
134
- - 📚 Codebase understanding & discovery
135
- - ✅ Best practices & pattern research
136
- - 🔬 Pre-implementation research
137
-
138
- **Output includes:**
139
- - Research findings with sources
140
- - Recommendations with trade-offs
141
- - Code examples where applicable
142
- - Next steps and action items
143
-
33
+ description: "Research companion - codebase search, web research, deep research, community analysis"
144
34
  category: "research"
145
- default_model: "" # Auto-select
146
35
  template_file: "helper-friend.mdx"
147
-
148
- tool_limits:
149
- sequentialthinking_max: 30
150
- sequentialthinking_min: 10
151
- warpgrep_max: 20
152
- warpgrep_min: 4
153
- deep_research_questions_max: 100
154
- deep_research_per_call: 10
155
- web_search_keywords_max: 500
156
- web_search_per_call: 50
157
- scrape_urls_max: 100
158
- scrape_per_call: 30
159
- reddit_posts_max: 100
160
- reddit_per_call: 50
161
-
36
+
162
37
  manual-tester:
163
38
  display_name: "Manual Tester"
164
- description: |
165
- **🧪 QA ENGINEER - Tests implementation using REAL Chrome browser and terminal**
166
-
167
- This subagent manually tests your implementation like a human QA engineer,
168
- using Chrome DevTools MCP for browser interactions and terminal for API testing.
169
-
170
- **What it tests:**
171
- - UI interactions (clicks, forms, navigation)
172
- - Visual verification (screenshots, layout)
173
- - Console monitoring (JS errors, warnings)
174
- - Network inspection (API calls, responses)
175
- - API testing (curl commands, response validation)
176
- - Responsive design (multiple viewport sizes)
177
-
178
- **Output includes:**
179
- - Test results (✅ PASS / ❌ FAIL for each test case)
180
- - Screenshots of key states
181
- - Console errors captured
182
- - API response verification
183
- - Reproduction steps for failures
184
- - Recommendations for fixes
185
-
39
+ description: "QA engineer - tests with real Chrome browser, API testing, screenshots"
186
40
  category: "testing"
187
- default_model: "" # Auto-select
188
41
  template_file: "manual-tester.mdx"
189
-
190
- tool_limits:
191
- sequentialthinking_max: 30
192
- sequentialthinking_min: 15
193
- browser_interactions_max: 50
194
- viewports_max: 5
195
- screenshots_max: 30
196
- api_calls_max: 50
197
- warpgrep_max: 10
198
-
42
+
199
43
  manual:
200
44
  display_name: "Manual Executor"
201
- description: |
202
- **🔨 GENERAL-PURPOSE EXECUTOR - Implements, fixes, creates, and completes work**
203
-
204
- This subagent is a versatile executor that can handle ANY task that doesn't fit
205
- the specialized categories. Unlike the other subagents (inspector, researcher, tester),
206
- this one EXECUTES and COMPLETES work.
207
-
208
- **What it does:**
209
- - Implements features (writes code, creates files)
210
- - Fixes bugs (debugs, patches, tests)
211
- - Refactors code (restructures, improves)
212
- - Sets up projects (initializes, configures)
213
- - Modifies existing code (updates, enhances)
214
- - Runs commands (tests, builds, deploys)
215
-
216
- **Use cases:**
217
- - 🔨 Feature implementation from scratch
218
- - 🐛 Bug fixes with code changes
219
- - ♻️ Code refactoring and restructuring
220
- - 🏗️ Project setup and configuration
221
- - ✏️ Code modifications and enhancements
222
- - 🔧 General development tasks
223
-
224
- **Output includes:**
225
- - Summary of changes made
226
- - Files created/modified with details
227
- - Commands executed and results
228
- - Verification of requirements met
229
- - Notes and recommendations
230
-
45
+ description: "General executor - implements features, fixes bugs, runs commands"
231
46
  category: "execution"
232
- default_model: "" # Auto-select
233
47
  template_file: "manual.mdx"
234
-
235
- tool_limits:
236
- sequentialthinking_max: 30
237
- sequentialthinking_min: 8
238
- warpgrep_max: 20
239
- warpgrep_min: 3
240
- deep_research_max: 30
241
- deep_research_per_call: 5
242
- web_search_keywords_max: 100
243
- web_search_per_call: 10
244
- file_operations_max: 50
245
- terminal_commands_max: 30
246
-
247
- # ============================================================================
248
- # TOOL DEFINITION (Single consolidated tool)
249
- # ============================================================================
250
48
 
251
49
  tools:
252
50
  - name: check_subagent_task
253
- category: status
254
- capability: query
255
-
256
- description: |
257
- Check async task status. Returns result when complete.
258
-
259
- **States:** `pending` → `running` → `completed`/`failed`
260
-
261
- **Usage:** Poll with task_ids until `status: completed`, then read `result` field.
262
-
51
+ description: "Check async task status. Poll until `status: completed`, then read `result`."
263
52
  parameters:
264
53
  task_ids:
265
54
  type: array
266
55
  required: true
267
- items:
268
- type: integer
269
- validation:
270
- minItems: 1
271
- description: |
272
- Array of 5-digit task IDs from `gemini-subagent` async calls.
273
- Example: `[34567]` or `[34567, 34568]`
56
+ description: "Array of 5-digit task IDs. Example: `[34567]`"
274
57
 
275
58
  - name: gemini-subagent
276
- category: execution
277
- capability: autonomous
278
-
279
59
  description: |
280
- **🤖 GEMINI SUBAGENT - Specialized Task Execution**
281
-
282
- Single unified tool with three specialized modes via strict task_type enum.
283
-
284
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
285
- 📋 TASK TYPE ENUM (Required - NO STRINGS, NO GUESSING!)
286
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
287
-
288
- Must be EXACTLY one of these four values:
289
-
290
- **1. `completion-inspector`** - CTO-Level Code Review
291
-
292
- **Purpose:** Verifies if a task is TRULY 100% complete
293
-
294
- **Uses:**
295
- - Git diff analysis (line-by-line change review)
296
- - Codebase search (find duplicates, missed abstractions)
297
- - Pattern detection (consistency with existing code)
298
- - Quality assessment (cleanup opportunities)
299
-
300
- **When to use:**
301
- - ✅ After implementation, before marking "done"
302
- - ✅ After major refactoring or feature work
303
- - ✅ Before committing final changes
304
- - ✅ When you suspect cleanup is needed
305
-
306
- **When NOT to use:**
307
- - ❌ Task clearly still in progress
308
- - ❌ Haven't made any changes yet
309
- - ❌ Simple one-line changes
310
-
311
- **Output:** Completion %, requirements met/not met, quality issues, action items
312
-
313
- **Model:** Auto-select (Gemini CLI chooses best)
314
-
315
- ---
316
-
317
- **2. `helper-friend`** - Research Companion
318
-
319
- **Purpose:** Deep analysis, bug investigation, informed decision-making
320
-
321
- **Uses:**
322
- - Codebase search (understand code structure)
323
- - Web research (best practices, documentation)
324
- - Deep research (technical questions with file attachments)
325
- - Reddit consensus (community experiences)
326
-
327
- **When to use:**
328
- - ✅ Bug investigation & root cause analysis
329
- - ✅ Architecture & technology decisions
330
- - ✅ Codebase understanding & discovery
331
- - ✅ Best practices & pattern research
332
- - ✅ Pre-implementation research
333
-
334
- **When NOT to use:**
335
- - ❌ Already know what to do, just need to code
336
- - ❌ Simple questions you can answer yourself
337
- - ❌ Tasks needing immediate action, not research
338
-
339
- **Output:** Research findings, recommendations, trade-offs, sources
340
-
341
- **Model:** Auto-select (Gemini CLI chooses best)
342
-
343
- ---
344
-
345
- **3. `manual-tester`** - QA Engineer with Real Browser
346
-
347
- **Purpose:** Tests if implementation actually WORKS using real Chrome browser
348
-
349
- **Uses:**
350
- - Chrome DevTools MCP (real browser interactions)
351
- - Terminal/curl (API testing)
352
- - Screenshots (visual verification)
353
- - Console monitoring (JS error detection)
354
- - Network inspection (API call verification)
355
-
356
- **When to use:**
357
- - ✅ After completion-inspector confirms 100% code complete
358
- - ✅ Frontend changes need testing
359
- - ✅ Backend/API changes need testing
360
- - ✅ Full flow verification
361
- - ✅ Responsive design verification
362
-
363
- **When NOT to use:**
364
- - ❌ Code isn't complete yet
365
- - ❌ No user-facing changes to test
366
- - ❌ Pure refactoring with no behavior changes
367
-
368
- **Output:** Test report with pass/fail, reproduction steps, screenshots, console errors
369
-
370
- **Model:** Auto-select (Gemini CLI chooses best)
371
-
372
- ---
373
-
374
- **4. `manual`** - General-Purpose Executor
375
-
376
- **Purpose:** Implements, fixes, creates, and completes ANY task
377
-
378
- **Uses:**
379
- - File operations (read, write, edit)
380
- - Terminal commands (test, build, install)
381
- - Codebase search (understand existing code)
382
- - Research tools (when external knowledge needed)
383
-
384
- **When to use:**
385
- - ✅ Feature implementation from scratch
386
- - ✅ Bug fixes with code changes
387
- - ✅ Code refactoring and restructuring
388
- - ✅ Project setup and configuration
389
- - ✅ General development tasks
390
-
391
- **When NOT to use:**
392
- - ❌ Only need inspection (use completion-inspector)
393
- - ❌ Only need research (use helper-friend)
394
- - ❌ Only need testing (use manual-tester)
395
-
396
- **Output:** Summary of changes, files modified, verification results
397
-
398
- **Model:** Auto-select (Gemini CLI chooses best)
399
-
400
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
401
- ⚙️ HOW IT WORKS
402
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
403
-
404
- 1. You select task_type enum (strict validation)
405
- 2. System loads corresponding MDX template
406
- 3. Merges template + your prompt
407
- 4. Executes: `gemini --yolo -p "[merged_prompt]"`
408
- 5. Returns specialized result
409
-
410
- **No shell commands, no intermediate steps** - Pure CLI-to-prompt translation.
60
+ Gemini subagent with 4 task types:
61
+ - `completion-inspector`: Verify task completion (git diff, patterns, requirements)
62
+ - `helper-friend`: Research (codebase, web, docs, community)
63
+ - `manual-tester`: QA testing (browser, API, screenshots)
64
+ - `manual`: General executor (implement, fix, run commands)
411
65
 
412
66
  parameters:
413
67
  task_type:
414
68
  type: string
415
69
  required: true
416
- validation:
417
- pattern: "^(completion-inspector|helper-friend|manual-tester|manual)$"
418
- description: |
419
- **🎯 [REQUIRED] TASK TYPE SELECTOR - Choose Your Specialist**
420
-
421
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
422
- ⚠️ STRICT ENUM - Must be EXACTLY one of these four values!
423
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
424
-
425
- **1️⃣ `completion-inspector`** - CTO-Level Code Auditor
426
-
427
- **Use when:** You think your task is done and need verification
428
- **What it does:** Analyzes git diff, checks patterns, finds issues
429
- **Output:** Completion %, requirements checklist, action items
430
-
431
- ✅ Use for: After implementation, before PR, after refactoring
432
- ❌ Skip if: Still coding, no changes yet, trivial fixes
433
-
434
- ---
435
-
436
- **2️⃣ `helper-friend`** - Research & Investigation Expert
437
-
438
- **Use when:** You need research, analysis, or decision support
439
- **What it does:** Searches codebase, web, docs, community
440
- **Output:** Findings, recommendations, trade-offs, sources
441
-
442
- ✅ Use for: Bug investigation, architecture decisions, learning patterns
443
- ❌ Skip if: You already know what to do, simple questions
444
-
445
- ---
446
-
447
- **3️⃣ `manual-tester`** - QA Engineer with Real Browser
448
-
449
- **Use when:** Implementation is complete and needs testing
450
- **What it does:** Browser testing, API testing, screenshots
451
- **Output:** Test results, failures, screenshots, console errors
452
-
453
- ✅ Use for: UI testing, API testing, integration testing
454
- ❌ Skip if: Code not ready, no user-facing changes, pure refactor
455
-
456
- ---
457
-
458
- **4️⃣ `manual`** - General-Purpose Executor
459
-
460
- **Use when:** You need to implement, fix, create, or complete a task
461
- **What it does:** Executes file operations, terminal commands, codebase search, and research tools
462
- **Output:** Summary of changes, files modified, verification results
463
-
464
- ✅ Use for: Feature implementation, bug fixes, code refactoring, project setup, and general development tasks
465
- ❌ Skip if: Only need inspection, research, or testing
466
-
467
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
468
- 🔄 RECOMMENDED WORKFLOW
469
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
470
-
471
- ```
472
- 1. Research phase → helper-friend (understand problem)
473
- 2. Implementation → [your coding work]
474
- 3. Verification → completion-inspector (is it done?)
475
- 4. Testing → manual-tester (does it work?)
476
- 5. Done → PR/commit
477
- ```
478
-
479
- **VALIDATION:** Server rejects invalid task types immediately.
480
- The selected type loads a specialized MDX template optimized for that task.
70
+ description: "One of: `completion-inspector`, `helper-friend`, `manual-tester`, `manual`"
481
71
 
482
72
  prompt:
483
73
  type: string
484
74
  required: true
485
- validation:
486
- minLength: 20
487
75
  description: |
488
- **🔥🔥🔥 [REQUIRED] YOUR TASK-SPECIFIC PROMPT - MINIMUM 500-1000 WORDS EXPECTED 🔥🔥🔥**
489
-
490
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
491
- ⚠️ CRITICAL: THE SUBAGENT IS COMPLETELY BLIND WITHOUT YOUR CONTEXT
492
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
493
-
494
- The subagent has **ZERO** context about:
495
- - Your codebase structure
496
- - Your project goals
497
- - Your tech stack
498
- - Your constraints
499
- - What you've already tried
500
- - What files exist
501
- - What the task even is
502
-
503
- **YOU MUST PROVIDE EVERYTHING.** Assume you're explaining to a brilliant
504
- engineer who just joined the team 5 minutes ago. They're smart but they
505
- know NOTHING about your project.
506
-
507
- **For manual-tester, provide:**
508
- - Frontend URL (MANDATORY!)
509
- - Backend URL (if applicable)
510
- - Auth credentials
511
- - Feature description
512
- - Expected behaviors
513
- - Test data
514
- - Edge cases to test
515
-
516
- **For manual, provide:**
517
- - Clear task description
518
- - Requirements or acceptance criteria
519
- - Relevant file paths or context
520
- - Any constraints or preferences
521
- - Expected outcome
522
-
523
- Minimum 20 characters required.
524
- PROVIDE EVERYTHING.** Assume you're explaining to a brilliant
525
- engineer who just joined the team 5 minutes ago. They're smart but they
526
- know NOTHING about your project.
527
-
528
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
529
- 📊 QUALITY SCALE - BE BRUTALLY HONEST WITH YOURSELF
530
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
531
-
532
- **WORD COUNT → QUALITY LEVEL → WHAT YOU'LL GET**
533
-
534
- **< 50 words** → 💀 GARBAGE
535
- - "Check if done" / "Fix the bug" / "Test login"
536
- - Response: Generic platitudes, wastes everyone's time
537
- - You're better off not calling the subagent at all
538
-
539
- **50-100 words** → ❌ USELESS
540
- - Brief mention of task, no files, no context
541
- - Response: Vague suggestions that don't apply to your code
542
- - The subagent is guessing blindly
543
-
544
- **100-200 words** → ⚠️ POOR
545
- - Some context but missing critical details
546
- - Response: Partially relevant but misses your actual situation
547
- - 50% of insights will be off-target
548
-
549
- **200-300 words** → 😐 MEDIOCRE
550
- - Basic context, some files mentioned
551
- - Response: Generally useful but lacks specificity
552
- - You'll need follow-up questions
553
-
554
- **300-500 words** → ✅ ACCEPTABLE
555
- - Good context, file paths included, requirements stated
556
- - Response: Relevant and actionable
557
- - Minimum threshold for useful output
558
-
559
- **500-750 words** → 🎯 GOOD
560
- - Comprehensive context, detailed file descriptions
561
- - What you tried, why it failed, specific questions
562
- - Response: Highly targeted, specific recommendations
563
-
564
- **750-1000 words** → ⭐ EXCELLENT
565
- - Full context: files, requirements, acceptance criteria
566
- - Tech stack, constraints, edge cases, what you've tried
567
- - Response: Expert-level analysis, production-ready advice
568
-
569
- **1000+ words** → 🏆 EXCEPTIONAL
570
- - Complete project context, detailed file-by-file breakdown
571
- - Historical context, related issues, future considerations
572
- - Response: CTO-level strategic recommendations
573
-
574
- **🎯 TARGET: 500-1000 words minimum for any serious task!**
575
-
576
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
577
- 📁 FILE CONTEXT - ABSOLUTELY MANDATORY
578
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
579
-
580
- **YOU MUST INCLUDE relative file paths for ALL relevant files!**
581
-
582
- The subagent CANNOT see your filesystem. If you don't tell it which
583
- files exist and what they do, it's operating completely blind.
584
-
585
- **FORMAT:** Use relative paths from project root with descriptions:
586
-
587
- ```
588
- 📁 FILES CHANGED/RELEVANT:
589
-
590
- src/auth/auth.controller.ts
591
- - Purpose: Handles login/register/logout endpoints
592
- - What changed: Added JWT refresh token logic (lines 45-120)
593
- - Dependencies: Uses src/auth/jwt.service.ts for token generation
594
- - Exports: AuthController class with 4 public methods
595
-
596
- src/auth/jwt.service.ts
597
- - Purpose: JWT token generation and validation
598
- - What changed: New refreshToken() method added
599
- - Key functions: generateToken(), validateToken(), refreshToken()
600
- - Config: Uses JWT_SECRET from environment
601
-
602
- src/middleware/auth.guard.ts
603
- - Purpose: Protects routes requiring authentication
604
- - What changed: Now checks for refresh token in cookie
605
- - How it works: Extracts token from Authorization header or cookie
606
- - Used by: All /api/protected/* routes
607
-
608
- src/types/auth.types.ts
609
- - Purpose: TypeScript interfaces for auth
610
- - What changed: Added RefreshTokenPayload interface
611
- - Exports: User, TokenPayload, RefreshTokenPayload, AuthResponse
612
-
613
- tests/auth/auth.controller.spec.ts
614
- - Purpose: Unit tests for auth controller
615
- - What changed: Added 5 new tests for refresh flow
616
- - Coverage: Now covers happy path + 3 error cases
617
- ```
618
-
619
- **WHY THIS MATTERS:**
620
- - Subagent can understand your architecture
621
- - Can identify missing pieces
622
- - Can check for consistency across files
623
- - Can suggest improvements based on actual structure
624
-
625
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
626
- 📋 TASK CONTEXT - WHAT ARE YOU ACTUALLY DOING?
627
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
628
-
629
- **Include the FULL context of what task you're working on:**
630
-
631
- ```
632
- 🎯 TASK CONTEXT:
633
-
634
- **Task Title:** Add JWT refresh token authentication
635
-
636
- **Background:**
637
- We're building a SaaS platform. Users were complaining about
638
- being logged out every hour. We need refresh tokens to keep
639
- sessions alive for 7 days while maintaining security.
640
-
641
- **Original Requirements:**
642
- 1. Access tokens expire in 15 minutes (security)
643
- 2. Refresh tokens expire in 7 days (convenience)
644
- 3. Refresh tokens stored in HTTP-only cookie (XSS protection)
645
- 4. Refresh token rotation on each refresh (security)
646
- 5. Invalidate all tokens on password change
647
-
648
- **Acceptance Criteria:**
649
- - [ ] POST /auth/login returns access token + sets refresh cookie
650
- - [ ] POST /auth/refresh exchanges refresh token for new access token
651
- - [ ] Refresh token is rotated on each use
652
- - [ ] Old refresh tokens are invalidated
653
- - [ ] Password change invalidates all user sessions
654
-
655
- **Tech Stack:**
656
- - Node.js 20 + Express 4.18
657
- - TypeScript 5.3
658
- - PostgreSQL 15 with Prisma ORM
659
- - Jest for testing
660
- - Redis for token blacklist
661
-
662
- **What I've Done So Far:**
663
- 1. Created jwt.service.ts with token generation ✅
664
- 2. Updated auth.controller.ts with refresh endpoint ✅
665
- 3. Added refresh token to login response ✅
666
- 4. Modified auth.guard.ts to check cookies ✅
667
- 5. Written basic tests ⏳ (in progress)
668
-
669
- **What's Not Working:**
670
- - Token rotation works but old tokens aren't being blacklisted
671
- - Tests are flaky - sometimes pass, sometimes fail
672
- - Not sure if my Redis implementation is correct
673
-
674
- **Specific Questions:**
675
- 1. Is my refresh token rotation implementation secure?
676
- 2. Should I use Redis SET or SORTED SET for blacklist?
677
- 3. How do I make my tests deterministic?
678
- ```
679
-
680
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
681
- 🔧 WHAT YOU'VE TRIED - PREVENT DUPLICATE SUGGESTIONS
682
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
683
-
684
- **Tell the subagent what you've already attempted:**
685
-
686
- ```
687
- 🔄 WHAT I'VE TRIED:
688
-
689
- 1. Used JWT library's built-in expiry
690
- → Problem: Couldn't invalidate tokens before expiry
691
-
692
- 2. Stored tokens in database
693
- → Problem: Too slow, 50ms+ per request
694
-
695
- 3. Redis with simple SET
696
- → Problem: No automatic expiry, memory grows forever
697
-
698
- 4. Asked ChatGPT
699
- → Got generic advice that didn't fit our architecture
700
- ```
701
-
702
- **WHY THIS MATTERS:**
703
- - Avoids wasting time on already-tried solutions
704
- - Helps subagent understand what DOESN'T work
705
- - Shows your thinking process for better recommendations
706
-
707
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
708
- 📋 PROMPT TEMPLATES BY TASK TYPE (FOLLOW EXACTLY!)
709
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
710
-
711
- **═══ COMPLETION-INSPECTOR TEMPLATE ═══**
712
-
713
- ```
714
- 🎯 TASK TITLE: [One-line description]
715
-
716
- 📋 ORIGINAL REQUIREMENTS:
717
- 1. [Requirement 1 - be specific]
718
- 2. [Requirement 2 - include acceptance criteria]
719
- 3. [Requirement 3 - mention edge cases if any]
720
-
721
- ✅ ACCEPTANCE CRITERIA:
722
- - [Criterion 1 - how to verify it's met]
723
- - [Criterion 2 - testable condition]
724
- - [Criterion 3 - measurable outcome]
725
-
726
- 📝 IMPLEMENTATION SUMMARY:
727
- [2-3 sentences describing what you implemented and your approach]
728
-
729
- 📁 FILES CHANGED:
730
- - `src/path/to/file1.ts` - [What changed and why]
731
- - `src/path/to/file2.ts` - [What changed and why]
732
- - `tests/path/to/test.ts` - [Tests added/modified]
733
-
734
- 🔖 GIT CONTEXT:
735
- - START_COMMIT: [hash or "HEAD~N"]
736
- - Branch: [feature branch name]
737
-
738
- 💭 WHY I THINK IT'S COMPLETE:
739
- [Explain your reasoning - what makes you confident it's done?]
740
-
741
- ⚠️ AREAS OF CONCERN (if any):
742
- [Any parts you're unsure about or want extra scrutiny on]
743
- ```
744
-
745
- **═══ HELPER-FRIEND TEMPLATE ═══**
746
-
747
- ```
748
- 🎯 ULTIMATE GOAL:
749
- [What are you trying to achieve? What does success look like?]
750
-
751
- 📍 CURRENT SITUATION:
752
- [Where are you now? What's the context?]
753
-
754
- 📁 RELEVANT FILES (with descriptions):
755
- - `src/path/to/file1.ts` - [What this file does, why it's relevant]
756
- - `src/path/to/file2.ts` - [What this file does, why it's relevant]
757
-
758
- 🔄 WHAT I'VE TRIED:
759
- 1. [Approach 1] → [Result/Why it didn't work]
760
- 2. [Approach 2] → [Result/Why it didn't work]
761
-
762
- ❓ SPECIFIC QUESTIONS:
763
- 1. [Question 1 - be specific, not vague]
764
- 2. [Question 2 - include context]
765
- 3. [Question 3 - what decision does this inform?]
766
-
767
- 🚧 CURRENT BLOCKER:
768
- [What's stopping you? Be specific about the problem.]
769
-
770
- 📌 CONSTRAINTS:
771
- - [Constraint 1 - tech stack limitations]
772
- - [Constraint 2 - timeline/scope]
773
- - [Constraint 3 - compatibility requirements]
774
-
775
- 🎯 WHAT I NEED FROM YOU:
776
- [Specific ask - research? recommendations? code examples?]
777
- ```
778
-
779
- **═══ MANUAL-TESTER TEMPLATE ═══**
780
-
781
- ```
782
- 🌐 URLS (MANDATORY!):
783
- - Frontend: [http://localhost:3000 or deployed URL]
784
- - Backend API: [http://localhost:8000/api or deployed URL]
785
- - Admin panel: [if applicable]
786
-
787
- 🔐 AUTH CREDENTIALS (if needed):
788
- - Username: [test user]
789
- - Password: [test password]
790
- - Or: [How to authenticate]
791
-
792
- 📝 FEATURE TO TEST:
793
- [Describe the feature in 2-3 sentences]
794
-
795
- ✅ EXPECTED BEHAVIORS:
796
- 1. [When user does X] → [Y should happen]
797
- 2. [When user does A] → [B should appear]
798
- 3. [Form validation] → [These errors should show]
799
-
800
- 🧪 TEST SCENARIOS:
801
- - Happy path: [Normal user flow to test]
802
- - Error path: [Invalid input scenarios]
803
- - Edge cases: [Boundary conditions]
804
-
805
- 📊 TEST DATA:
806
- - Valid input: [example values]
807
- - Invalid input: [example values that should fail]
808
-
809
- 📱 VIEWPORTS TO TEST:
810
- - Desktop (1920x1080)
811
- - Tablet (768x1024)
812
- - Mobile (375x667)
813
-
814
- ⚠️ KNOWN ISSUES (skip these):
815
- [Any known bugs to ignore during testing]
816
- ```
817
-
818
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
819
- ❌ BAD vs ✅ GOOD EXAMPLES - THE DIFFERENCE IS NIGHT AND DAY
820
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
821
-
822
- **💀 GARBAGE (~5 words) - Complete waste of time:**
823
- ```
824
- "Check if it's done"
825
- "Fix the bug"
826
- "Test login"
827
- ```
828
- → Response will be: "I don't have enough context to help. Please provide..."
829
- → You've wasted time and learned nothing
830
-
831
- **❌ USELESS (~30 words) - Subagent is guessing blindly:**
832
- ```
833
- "I added authentication to my Node.js app. Can you verify
834
- it's complete? I think I covered everything but not sure."
835
- ```
836
- → What kind of auth? What files? What requirements? What's "everything"?
837
- → Response will be generic checklist that may not apply to your code
838
-
839
- **⚠️ POOR (~80 words) - Half the insights will be wrong:**
840
- ```
841
- "I'm working on JWT authentication for our Express API. I created
842
- auth.controller.ts and jwt.service.ts. The login works but I'm
843
- not sure about the refresh token implementation. We need tokens
844
- to expire in 1 hour but users shouldn't be logged out while active."
845
- ```
846
- → Better but: What's in those files? What's the actual implementation?
847
- → What does "not sure" mean specifically? What have you tried?
848
-
849
- **✅ ACCEPTABLE (~200 words) - Minimum for useful output:**
850
- ```
851
- 🎯 TASK: JWT refresh token authentication
852
-
853
- 📋 REQUIREMENTS:
854
- 1. Access tokens expire in 15 minutes
855
- 2. Refresh tokens expire in 7 days
856
- 3. Refresh tokens in HTTP-only cookies
857
-
858
- 📁 FILES:
859
- - src/auth/auth.controller.ts - Login/register/refresh endpoints
860
- - src/auth/jwt.service.ts - Token generation and validation
861
- - src/middleware/auth.guard.ts - Route protection
862
-
863
- ✅ ACCEPTANCE:
864
- - POST /auth/login returns access token + sets refresh cookie
865
- - POST /auth/refresh returns new access token
866
- - Invalid tokens return 401
867
-
868
- 💭 STATUS: Login works, refresh endpoint exists but untested
869
-
870
- ❓ QUESTIONS:
871
- 1. Is storing refresh token in cookie secure?
872
- 2. Should I rotate refresh tokens?
873
- ```
874
-
875
- **🎯 GOOD (~500 words) - Highly targeted recommendations:**
876
- ```
877
- 🎯 TASK TITLE: Implement JWT refresh token authentication
878
-
879
- **Background:**
880
- Building a SaaS dashboard. Users complained about hourly logouts.
881
- Need refresh tokens to maintain sessions for 7 days while keeping
882
- access tokens short-lived for security.
883
-
884
- 📋 ORIGINAL REQUIREMENTS:
885
- 1. Access tokens: 15 minute expiry (security best practice)
886
- 2. Refresh tokens: 7 day expiry (user convenience)
887
- 3. Refresh tokens: HTTP-only cookie (XSS protection)
888
- 4. Token rotation: New refresh token on each refresh (security)
889
- 5. Revocation: Password change invalidates all sessions
890
-
891
- ✅ ACCEPTANCE CRITERIA:
892
- - [ ] POST /auth/login returns {accessToken} + sets refreshToken cookie
893
- - [ ] POST /auth/refresh exchanges refresh for new access + new refresh
894
- - [ ] Protected routes return 401 without valid access token
895
- - [ ] Refresh with old/rotated token fails (single-use enforcement)
896
- - [ ] Password change via /auth/password invalidates all tokens
897
-
898
- 📁 FILES CHANGED:
899
-
900
- src/auth/auth.controller.ts (lines 1-120)
901
- - Purpose: HTTP endpoints for auth operations
902
- - Changes: Added /refresh endpoint, modified /login to set cookie
903
- - Exports: AuthController with login(), register(), refresh(), logout()
904
- - Dependencies: JwtService, UserService, Response (for cookies)
905
-
906
- src/auth/jwt.service.ts (lines 1-85)
907
- - Purpose: Token generation, validation, rotation logic
908
- - Changes: Added generateRefreshToken(), rotateRefreshToken(), blacklistToken()
909
- - Key logic: Uses Redis for token blacklist with TTL matching token expiry
910
- - Config: JWT_SECRET, REFRESH_SECRET from env
911
-
912
- src/middleware/auth.guard.ts (lines 1-45)
913
- - Purpose: Protects routes requiring authentication
914
- - Changes: Now extracts token from Authorization header OR cookie
915
- - Logic: Validates access token, attaches user to request
916
-
917
- src/auth/dto/auth.dto.ts (lines 1-30)
918
- - Purpose: Request/response type definitions
919
- - Changes: Added RefreshTokenDto, TokenResponseDto
920
-
921
- tests/auth/auth.e2e-spec.ts (lines 1-150)
922
- - Purpose: End-to-end auth flow tests
923
- - Changes: Added 8 tests for refresh flow
924
- - Coverage: Happy path, expired token, rotated token, blacklisted token
925
-
926
- 🔖 GIT CONTEXT:
927
- - START_COMMIT: abc123 (before auth changes)
928
- - Current branch: feature/refresh-tokens
929
- - 12 commits since start
930
-
931
- 🔧 TECH STACK:
932
- - Node.js 20, Express 4.18, TypeScript 5.3
933
- - Prisma ORM with PostgreSQL 15
934
- - Redis 7 for token blacklist
935
- - Jest + Supertest for testing
936
-
937
- 🔄 WHAT I'VE TRIED:
938
- 1. Storing tokens in database → Too slow (50ms/request)
939
- 2. JWT blacklist without Redis → Memory leak in production
940
- 3. Simple refresh without rotation → Security concern flagged in review
941
-
942
- 💭 WHY I THINK IT'S COMPLETE:
943
- - All 5 requirements implemented
944
- - 8/8 e2e tests passing
945
- - Manual testing works in Postman
946
- - Code reviewed by team lead
947
-
948
- ⚠️ AREAS OF CONCERN:
949
- - Redis connection handling during reconnects
950
- - Is my token rotation truly atomic?
951
- - Should blacklist use SET or SORTED SET?
952
-
953
- ❓ SPECIFIC QUESTIONS:
954
- 1. Is the refresh token rotation implementation secure against race conditions?
955
- 2. Is storing the refresh token family ID sufficient for revocation?
956
- 3. Any edge cases I'm missing in my test coverage?
957
- ```
958
- → This prompt gives the subagent EVERYTHING it needs to provide
959
- expert-level, specific, actionable recommendations
960
-
961
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
962
- 💡 PRO TIPS FOR MAXIMUM QUALITY OUTPUT
963
- ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
964
-
965
- 1. **TARGET 500-1000 WORDS** - Seriously, more context = better output
966
- 2. **LIST EVERY FILE** - With relative paths AND what each file does
967
- 3. **DESCRIBE WHAT CHANGED** - Not just "modified" but HOW and WHY
968
- 4. **INCLUDE LINE NUMBERS** - "auth logic at lines 45-120" helps focus
969
- 5. **STATE YOUR TECH STACK** - Versions matter for compatibility advice
970
- 6. **EXPLAIN WHAT YOU TRIED** - Prevents duplicate suggestions
971
- 7. **ASK SPECIFIC QUESTIONS** - "Is X secure?" not "Is it good?"
972
- 8. **MENTION EDGE CASES** - What weird scenarios worry you?
973
- 9. **INCLUDE ERROR MESSAGES** - Exact errors, not paraphrased
974
- 10. **SHARE YOUR REASONING** - Why you made certain choices
975
-
976
- **THE GOLDEN RULE:**
977
-
978
- Imagine you're onboarding a brilliant senior engineer who just joined
979
- your team. They've never seen your codebase. What would you tell them
980
- to get them up to speed and able to give expert advice?
981
-
982
- **THAT is what your prompt should contain.**
983
-
984
- **REMEMBER:**
985
- - 💀 < 50 words = You're wasting everyone's time
986
- - ⚠️ 50-200 words = Expect generic, often wrong advice
987
- - ✅ 200-500 words = Acceptable, targeted recommendations
988
- - 🎯 500-1000 words = Expert-level, production-ready insights
989
- - 🏆 1000+ words = CTO-level strategic guidance
76
+ Your task prompt. Include: task description, relevant files, requirements, context.
77
+ More detail = better results. Min 20 chars.
990
78
 
991
79
  model:
992
80
  type: string
993
81
  required: false
994
- description: |
995
- **[OPTIONAL] Override model selection**
996
-
997
- Leave empty to use task type's default:
998
- - completion-inspector: gemini-3-pro
999
- - helper-friend: auto-select
1000
- - manual-tester: gemini-3-pro
1001
-
1002
- Available: `gemini-3-pro`, `gemini-3-flash`
82
+ description: "Override model. Leave empty for auto-select."
1003
83
 
1004
84
  sandbox:
1005
85
  type: boolean
1006
86
  required: false
1007
87
  default: false
1008
- description: |
1009
- **[OPTIONAL] Run in sandbox mode**
1010
-
1011
- Enables sandbox isolation for safer execution.
1012
- Flag: --sandbox / -s
88
+ description: "Run in sandbox mode."
1013
89
 
1014
90
  approval_mode:
1015
91
  type: string
1016
92
  required: false
1017
- description: |
1018
- **[OPTIONAL] Override approval mode**
1019
-
1020
- Valid values:
1021
- - `default` - Prompt for approval
1022
- - `auto_edit` - Auto-approve edit tools
1023
- - `yolo` - Auto-approve all tools
1024
-
1025
- Leave empty to use --yolo (auto-approve all)
93
+ description: "Override: `default`, `auto_edit`, or `yolo`"
1026
94
 
1027
95
  include_directories:
1028
96
  type: string
1029
97
  required: false
1030
- description: |
1031
- **[OPTIONAL] Include additional directories**
1032
-
1033
- Comma-separated list of directories to include.
1034
- Example: "src,docs,tests"
98
+ description: "Additional directories. Example: `src,docs,tests`"
1035
99
 
1036
100
  include_instructions:
1037
101
  type: boolean
1038
102
  required: false
1039
103
  default: true
1040
- description: |
1041
- Include task-specific instructions from MDX template.
1042
- Default: true (recommended)
1043
- Set false: For custom prompts that don't need template
104
+ description: "Include MDX template instructions. Default: true"
1044
105
 
1045
106
  async:
1046
107
  type: boolean
1047
108
  required: false
1048
109
  default: true
1049
110
  description: |
1050
- **[OPTIONAL] Async execution mode**
1051
-
1052
- **Default: true (async)**
1053
- - Returns immediately with a 5-digit task ID (e.g., 34567)
1054
- - Task runs in background
1055
- - Query status with `check_subagent_task` tool using the task ID
1056
- - Results stored in memory until retrieved
1057
-
1058
- **Set to false (sync/blocking):**
1059
- - Blocks until task completes
1060
- - Returns full result directly
1061
- - Use for quick tasks where you need immediate result
1062
-
1063
- **Example async flow:**
1064
- 1. Call `gemini-subagent` with `async: true` (default)
1065
- 2. Receive: `{"task_id": 34567, "status": "running"}`
1066
- 3. Later: Call `check_subagent_task` with `task_id: 34567`
1067
- 4. Receive: `{"status": "completed", "result": "..."}` or `{"status": "running"}`
1068
-
1069
- **⚠️ IMPORTANT:** When async=true, the response is NOT the result!
1070
- You MUST call `check_subagent_task` to get the actual result.
111
+ Async mode (default: true). Returns task_id immediately.
112
+ Set false to block and return result directly.