gemini-helper-friend 2.0.6 → 2.0.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,72 +1,18 @@
|
|
|
1
1
|
# Gemini Helper Friend MCP - Subagent Configuration
|
|
2
|
-
|
|
3
|
-
# Version: 2.1 - Enhanced descriptions with forcing patterns
|
|
4
|
-
# Optimization: Detailed descriptions that force high-quality, structured prompts
|
|
5
|
-
|
|
6
|
-
version: "2.1"
|
|
2
|
+
version: "2.2"
|
|
7
3
|
|
|
8
4
|
metadata:
|
|
9
5
|
name: "gemini-helper-friend-mcp"
|
|
10
6
|
displayName: "Gemini - Helper Friend MCP"
|
|
11
|
-
description: "Autonomous AI helper with specialized task types
|
|
12
|
-
|
|
13
|
-
# ============================================================================
|
|
14
|
-
# SHARED PRINCIPLES - Apply to ALL task types
|
|
15
|
-
# ============================================================================
|
|
16
|
-
shared:
|
|
17
|
-
core_philosophy: |
|
|
18
|
-
These subagents are designed for COMPREHENSIVE task execution through specialized modes.
|
|
19
|
-
Vague prompts = vague results. Detailed prompts = actionable insights.
|
|
20
|
-
|
|
21
|
-
**CRITICAL:** The quality of output is DIRECTLY proportional to prompt detail.
|
|
22
|
-
- Short prompts (50 chars) → Generic, unhelpful responses
|
|
23
|
-
- Medium prompts (200 chars) → Partially useful responses
|
|
24
|
-
- Detailed prompts (500+ chars) → Specific, actionable insights
|
|
25
|
-
|
|
26
|
-
principles:
|
|
27
|
-
context_is_king: |
|
|
28
|
-
The subagent has NO context about your task except what you provide.
|
|
29
|
-
Assume it knows NOTHING about your codebase, your goals, or your constraints.
|
|
30
|
-
Provide ALL relevant context - files, requirements, what you've tried, what failed.
|
|
31
|
-
|
|
32
|
-
specificity_matters: |
|
|
33
|
-
"Check if it's done" → USELESS
|
|
34
|
-
"Verify Task X against requirements A, B, C using files X, Y, Z" → ACTIONABLE
|
|
35
|
-
|
|
36
|
-
structured_input: |
|
|
37
|
-
Follow the template for each task type. Each section exists for a reason.
|
|
38
|
-
Skipping sections = missing critical context = suboptimal results.
|
|
39
|
-
|
|
40
|
-
workflow_pattern: |
|
|
41
|
-
MANDATORY for all subagent calls:
|
|
42
|
-
1. GATHER CONTEXT → Collect all relevant files, requirements, constraints
|
|
43
|
-
2. STRUCTURE PROMPT → Follow the task-specific template (ALL sections!)
|
|
44
|
-
3. CALL SUBAGENT → Execute with async=true (default) or async=false for quick tasks
|
|
45
|
-
4. CHECK STATUS → Poll with check_subagent_task until completed
|
|
46
|
-
5. REVIEW RESULT → Evaluate output, take action on recommendations
|
|
47
|
-
|
|
48
|
-
Why this works: Structured context enables the subagent to provide
|
|
49
|
-
specific, actionable recommendations instead of generic advice.
|
|
50
|
-
|
|
51
|
-
# ============================================================================
|
|
52
|
-
# GLOBAL SETTINGS
|
|
53
|
-
# ============================================================================
|
|
7
|
+
description: "Autonomous AI helper with specialized task types"
|
|
54
8
|
|
|
55
9
|
settings:
|
|
56
10
|
defaults:
|
|
57
|
-
model: ""
|
|
11
|
+
model: ""
|
|
58
12
|
yolo_mode: true
|
|
59
13
|
append_instructions: true
|
|
60
|
-
|
|
61
|
-
# Model fallback chain - tries in order until one succeeds
|
|
62
|
-
# 1. gemini-3-flash-preview (fastest, newest)
|
|
63
|
-
# 2. gemini-3-pro-preview (more capable)
|
|
64
|
-
# 3. gemini-3-pro (stable)
|
|
65
|
-
# 4. gemini-2.5-flash (reliable fallback)
|
|
66
|
-
|
|
67
14
|
cli:
|
|
68
15
|
command: "gemini"
|
|
69
|
-
# Per gemini --help: use positional prompt (--prompt is deprecated)
|
|
70
16
|
flags:
|
|
71
17
|
yolo: "--yolo"
|
|
72
18
|
model: "--model"
|
|
@@ -75,996 +21,92 @@ settings:
|
|
|
75
21
|
approval_mode: "--approval-mode"
|
|
76
22
|
include_directories: "--include-directories"
|
|
77
23
|
|
|
78
|
-
# ============================================================================
|
|
79
|
-
# TASK TYPE DEFINITIONS (Metadata Only - Templates in MDX)
|
|
80
|
-
# ============================================================================
|
|
81
|
-
|
|
82
24
|
task_types:
|
|
83
|
-
|
|
84
25
|
completion-inspector:
|
|
85
26
|
display_name: "Completion Inspector"
|
|
86
|
-
description:
|
|
87
|
-
**🔍 CTO-LEVEL CODE INSPECTOR - Verifies if task is TRULY 100% complete**
|
|
88
|
-
|
|
89
|
-
This subagent performs exhaustive verification that your implementation meets ALL requirements,
|
|
90
|
-
follows existing patterns, and leaves no cleanup debt.
|
|
91
|
-
|
|
92
|
-
**What it analyzes:**
|
|
93
|
-
- Git diff (line-by-line change review against requirements)
|
|
94
|
-
- Codebase patterns (consistency with existing code style)
|
|
95
|
-
- Duplicate detection (find similar code that should be abstracted)
|
|
96
|
-
- Quality assessment (identify cleanup opportunities)
|
|
97
|
-
- Requirement coverage (map changes to acceptance criteria)
|
|
98
|
-
|
|
99
|
-
**Output includes:**
|
|
100
|
-
- Completion percentage (0-100%)
|
|
101
|
-
- Requirements checklist (✅ met / ❌ not met)
|
|
102
|
-
- Quality issues found
|
|
103
|
-
- Specific action items with file locations
|
|
104
|
-
|
|
27
|
+
description: "Verifies if task is 100% complete - analyzes git diff, patterns, requirements coverage"
|
|
105
28
|
category: "verification"
|
|
106
|
-
default_model: "" # Auto-select
|
|
107
29
|
template_file: "completion-inspector.mdx"
|
|
108
|
-
|
|
109
|
-
tool_limits:
|
|
110
|
-
sequentialthinking_max: 30
|
|
111
|
-
sequentialthinking_min: 15
|
|
112
|
-
warpgrep_max: 20
|
|
113
|
-
warpgrep_min: 8
|
|
114
|
-
deep_research_max: 30
|
|
115
|
-
web_search_keywords_max: 100
|
|
116
|
-
|
|
30
|
+
|
|
117
31
|
helper-friend:
|
|
118
32
|
display_name: "Helper Friend"
|
|
119
|
-
description:
|
|
120
|
-
**🧠 RESEARCH COMPANION - Deep analysis, bug investigation, informed decisions**
|
|
121
|
-
|
|
122
|
-
This subagent conducts comprehensive research using codebase search, web research,
|
|
123
|
-
deep research with file attachments, and community consensus analysis.
|
|
124
|
-
|
|
125
|
-
**What it does:**
|
|
126
|
-
- Codebase search (understand code structure, find similar patterns)
|
|
127
|
-
- Web research (best practices, documentation, tutorials)
|
|
128
|
-
- Deep research (technical questions with YOUR code as context)
|
|
129
|
-
- Reddit consensus (community experiences, real-world feedback)
|
|
130
|
-
|
|
131
|
-
**Use cases:**
|
|
132
|
-
- 🐛 Bug investigation & root cause analysis
|
|
133
|
-
- 🏗️ Architecture & technology decisions
|
|
134
|
-
- 📚 Codebase understanding & discovery
|
|
135
|
-
- ✅ Best practices & pattern research
|
|
136
|
-
- 🔬 Pre-implementation research
|
|
137
|
-
|
|
138
|
-
**Output includes:**
|
|
139
|
-
- Research findings with sources
|
|
140
|
-
- Recommendations with trade-offs
|
|
141
|
-
- Code examples where applicable
|
|
142
|
-
- Next steps and action items
|
|
143
|
-
|
|
33
|
+
description: "Research companion - codebase search, web research, deep research, community analysis"
|
|
144
34
|
category: "research"
|
|
145
|
-
default_model: "" # Auto-select
|
|
146
35
|
template_file: "helper-friend.mdx"
|
|
147
|
-
|
|
148
|
-
tool_limits:
|
|
149
|
-
sequentialthinking_max: 30
|
|
150
|
-
sequentialthinking_min: 10
|
|
151
|
-
warpgrep_max: 20
|
|
152
|
-
warpgrep_min: 4
|
|
153
|
-
deep_research_questions_max: 100
|
|
154
|
-
deep_research_per_call: 10
|
|
155
|
-
web_search_keywords_max: 500
|
|
156
|
-
web_search_per_call: 50
|
|
157
|
-
scrape_urls_max: 100
|
|
158
|
-
scrape_per_call: 30
|
|
159
|
-
reddit_posts_max: 100
|
|
160
|
-
reddit_per_call: 50
|
|
161
|
-
|
|
36
|
+
|
|
162
37
|
manual-tester:
|
|
163
38
|
display_name: "Manual Tester"
|
|
164
|
-
description:
|
|
165
|
-
**🧪 QA ENGINEER - Tests implementation using REAL Chrome browser and terminal**
|
|
166
|
-
|
|
167
|
-
This subagent manually tests your implementation like a human QA engineer,
|
|
168
|
-
using Chrome DevTools MCP for browser interactions and terminal for API testing.
|
|
169
|
-
|
|
170
|
-
**What it tests:**
|
|
171
|
-
- UI interactions (clicks, forms, navigation)
|
|
172
|
-
- Visual verification (screenshots, layout)
|
|
173
|
-
- Console monitoring (JS errors, warnings)
|
|
174
|
-
- Network inspection (API calls, responses)
|
|
175
|
-
- API testing (curl commands, response validation)
|
|
176
|
-
- Responsive design (multiple viewport sizes)
|
|
177
|
-
|
|
178
|
-
**Output includes:**
|
|
179
|
-
- Test results (✅ PASS / ❌ FAIL for each test case)
|
|
180
|
-
- Screenshots of key states
|
|
181
|
-
- Console errors captured
|
|
182
|
-
- API response verification
|
|
183
|
-
- Reproduction steps for failures
|
|
184
|
-
- Recommendations for fixes
|
|
185
|
-
|
|
39
|
+
description: "QA engineer - tests with real Chrome browser, API testing, screenshots"
|
|
186
40
|
category: "testing"
|
|
187
|
-
default_model: "" # Auto-select
|
|
188
41
|
template_file: "manual-tester.mdx"
|
|
189
|
-
|
|
190
|
-
tool_limits:
|
|
191
|
-
sequentialthinking_max: 30
|
|
192
|
-
sequentialthinking_min: 15
|
|
193
|
-
browser_interactions_max: 50
|
|
194
|
-
viewports_max: 5
|
|
195
|
-
screenshots_max: 30
|
|
196
|
-
api_calls_max: 50
|
|
197
|
-
warpgrep_max: 10
|
|
198
|
-
|
|
42
|
+
|
|
199
43
|
manual:
|
|
200
44
|
display_name: "Manual Executor"
|
|
201
|
-
description:
|
|
202
|
-
**🔨 GENERAL-PURPOSE EXECUTOR - Implements, fixes, creates, and completes work**
|
|
203
|
-
|
|
204
|
-
This subagent is a versatile executor that can handle ANY task that doesn't fit
|
|
205
|
-
the specialized categories. Unlike the other subagents (inspector, researcher, tester),
|
|
206
|
-
this one EXECUTES and COMPLETES work.
|
|
207
|
-
|
|
208
|
-
**What it does:**
|
|
209
|
-
- Implements features (writes code, creates files)
|
|
210
|
-
- Fixes bugs (debugs, patches, tests)
|
|
211
|
-
- Refactors code (restructures, improves)
|
|
212
|
-
- Sets up projects (initializes, configures)
|
|
213
|
-
- Modifies existing code (updates, enhances)
|
|
214
|
-
- Runs commands (tests, builds, deploys)
|
|
215
|
-
|
|
216
|
-
**Use cases:**
|
|
217
|
-
- 🔨 Feature implementation from scratch
|
|
218
|
-
- 🐛 Bug fixes with code changes
|
|
219
|
-
- ♻️ Code refactoring and restructuring
|
|
220
|
-
- 🏗️ Project setup and configuration
|
|
221
|
-
- ✏️ Code modifications and enhancements
|
|
222
|
-
- 🔧 General development tasks
|
|
223
|
-
|
|
224
|
-
**Output includes:**
|
|
225
|
-
- Summary of changes made
|
|
226
|
-
- Files created/modified with details
|
|
227
|
-
- Commands executed and results
|
|
228
|
-
- Verification of requirements met
|
|
229
|
-
- Notes and recommendations
|
|
230
|
-
|
|
45
|
+
description: "General executor - implements features, fixes bugs, runs commands"
|
|
231
46
|
category: "execution"
|
|
232
|
-
default_model: "" # Auto-select
|
|
233
47
|
template_file: "manual.mdx"
|
|
234
|
-
|
|
235
|
-
tool_limits:
|
|
236
|
-
sequentialthinking_max: 30
|
|
237
|
-
sequentialthinking_min: 8
|
|
238
|
-
warpgrep_max: 20
|
|
239
|
-
warpgrep_min: 3
|
|
240
|
-
deep_research_max: 30
|
|
241
|
-
deep_research_per_call: 5
|
|
242
|
-
web_search_keywords_max: 100
|
|
243
|
-
web_search_per_call: 10
|
|
244
|
-
file_operations_max: 50
|
|
245
|
-
terminal_commands_max: 30
|
|
246
|
-
|
|
247
|
-
# ============================================================================
|
|
248
|
-
# TOOL DEFINITION (Single consolidated tool)
|
|
249
|
-
# ============================================================================
|
|
250
48
|
|
|
251
49
|
tools:
|
|
252
50
|
- name: check_subagent_task
|
|
253
|
-
|
|
254
|
-
capability: query
|
|
255
|
-
|
|
256
|
-
description: |
|
|
257
|
-
Check async task status. Returns result when complete.
|
|
258
|
-
|
|
259
|
-
**States:** `pending` → `running` → `completed`/`failed`
|
|
260
|
-
|
|
261
|
-
**Usage:** Poll with task_ids until `status: completed`, then read `result` field.
|
|
262
|
-
|
|
51
|
+
description: "Check async task status. Poll until `status: completed`, then read `result`."
|
|
263
52
|
parameters:
|
|
264
53
|
task_ids:
|
|
265
54
|
type: array
|
|
266
55
|
required: true
|
|
267
|
-
|
|
268
|
-
type: integer
|
|
269
|
-
validation:
|
|
270
|
-
minItems: 1
|
|
271
|
-
description: |
|
|
272
|
-
Array of 5-digit task IDs from `gemini-subagent` async calls.
|
|
273
|
-
Example: `[34567]` or `[34567, 34568]`
|
|
56
|
+
description: "Array of 5-digit task IDs. Example: `[34567]`"
|
|
274
57
|
|
|
275
58
|
- name: gemini-subagent
|
|
276
|
-
category: execution
|
|
277
|
-
capability: autonomous
|
|
278
|
-
|
|
279
59
|
description: |
|
|
280
|
-
|
|
281
|
-
|
|
282
|
-
|
|
283
|
-
|
|
284
|
-
|
|
285
|
-
📋 TASK TYPE ENUM (Required - NO STRINGS, NO GUESSING!)
|
|
286
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
287
|
-
|
|
288
|
-
Must be EXACTLY one of these four values:
|
|
289
|
-
|
|
290
|
-
**1. `completion-inspector`** - CTO-Level Code Review
|
|
291
|
-
|
|
292
|
-
**Purpose:** Verifies if a task is TRULY 100% complete
|
|
293
|
-
|
|
294
|
-
**Uses:**
|
|
295
|
-
- Git diff analysis (line-by-line change review)
|
|
296
|
-
- Codebase search (find duplicates, missed abstractions)
|
|
297
|
-
- Pattern detection (consistency with existing code)
|
|
298
|
-
- Quality assessment (cleanup opportunities)
|
|
299
|
-
|
|
300
|
-
**When to use:**
|
|
301
|
-
- ✅ After implementation, before marking "done"
|
|
302
|
-
- ✅ After major refactoring or feature work
|
|
303
|
-
- ✅ Before committing final changes
|
|
304
|
-
- ✅ When you suspect cleanup is needed
|
|
305
|
-
|
|
306
|
-
**When NOT to use:**
|
|
307
|
-
- ❌ Task clearly still in progress
|
|
308
|
-
- ❌ Haven't made any changes yet
|
|
309
|
-
- ❌ Simple one-line changes
|
|
310
|
-
|
|
311
|
-
**Output:** Completion %, requirements met/not met, quality issues, action items
|
|
312
|
-
|
|
313
|
-
**Model:** Auto-select (Gemini CLI chooses best)
|
|
314
|
-
|
|
315
|
-
---
|
|
316
|
-
|
|
317
|
-
**2. `helper-friend`** - Research Companion
|
|
318
|
-
|
|
319
|
-
**Purpose:** Deep analysis, bug investigation, informed decision-making
|
|
320
|
-
|
|
321
|
-
**Uses:**
|
|
322
|
-
- Codebase search (understand code structure)
|
|
323
|
-
- Web research (best practices, documentation)
|
|
324
|
-
- Deep research (technical questions with file attachments)
|
|
325
|
-
- Reddit consensus (community experiences)
|
|
326
|
-
|
|
327
|
-
**When to use:**
|
|
328
|
-
- ✅ Bug investigation & root cause analysis
|
|
329
|
-
- ✅ Architecture & technology decisions
|
|
330
|
-
- ✅ Codebase understanding & discovery
|
|
331
|
-
- ✅ Best practices & pattern research
|
|
332
|
-
- ✅ Pre-implementation research
|
|
333
|
-
|
|
334
|
-
**When NOT to use:**
|
|
335
|
-
- ❌ Already know what to do, just need to code
|
|
336
|
-
- ❌ Simple questions you can answer yourself
|
|
337
|
-
- ❌ Tasks needing immediate action, not research
|
|
338
|
-
|
|
339
|
-
**Output:** Research findings, recommendations, trade-offs, sources
|
|
340
|
-
|
|
341
|
-
**Model:** Auto-select (Gemini CLI chooses best)
|
|
342
|
-
|
|
343
|
-
---
|
|
344
|
-
|
|
345
|
-
**3. `manual-tester`** - QA Engineer with Real Browser
|
|
346
|
-
|
|
347
|
-
**Purpose:** Tests if implementation actually WORKS using real Chrome browser
|
|
348
|
-
|
|
349
|
-
**Uses:**
|
|
350
|
-
- Chrome DevTools MCP (real browser interactions)
|
|
351
|
-
- Terminal/curl (API testing)
|
|
352
|
-
- Screenshots (visual verification)
|
|
353
|
-
- Console monitoring (JS error detection)
|
|
354
|
-
- Network inspection (API call verification)
|
|
355
|
-
|
|
356
|
-
**When to use:**
|
|
357
|
-
- ✅ After completion-inspector confirms 100% code complete
|
|
358
|
-
- ✅ Frontend changes need testing
|
|
359
|
-
- ✅ Backend/API changes need testing
|
|
360
|
-
- ✅ Full flow verification
|
|
361
|
-
- ✅ Responsive design verification
|
|
362
|
-
|
|
363
|
-
**When NOT to use:**
|
|
364
|
-
- ❌ Code isn't complete yet
|
|
365
|
-
- ❌ No user-facing changes to test
|
|
366
|
-
- ❌ Pure refactoring with no behavior changes
|
|
367
|
-
|
|
368
|
-
**Output:** Test report with pass/fail, reproduction steps, screenshots, console errors
|
|
369
|
-
|
|
370
|
-
**Model:** Auto-select (Gemini CLI chooses best)
|
|
371
|
-
|
|
372
|
-
---
|
|
373
|
-
|
|
374
|
-
**4. `manual`** - General-Purpose Executor
|
|
375
|
-
|
|
376
|
-
**Purpose:** Implements, fixes, creates, and completes ANY task
|
|
377
|
-
|
|
378
|
-
**Uses:**
|
|
379
|
-
- File operations (read, write, edit)
|
|
380
|
-
- Terminal commands (test, build, install)
|
|
381
|
-
- Codebase search (understand existing code)
|
|
382
|
-
- Research tools (when external knowledge needed)
|
|
383
|
-
|
|
384
|
-
**When to use:**
|
|
385
|
-
- ✅ Feature implementation from scratch
|
|
386
|
-
- ✅ Bug fixes with code changes
|
|
387
|
-
- ✅ Code refactoring and restructuring
|
|
388
|
-
- ✅ Project setup and configuration
|
|
389
|
-
- ✅ General development tasks
|
|
390
|
-
|
|
391
|
-
**When NOT to use:**
|
|
392
|
-
- ❌ Only need inspection (use completion-inspector)
|
|
393
|
-
- ❌ Only need research (use helper-friend)
|
|
394
|
-
- ❌ Only need testing (use manual-tester)
|
|
395
|
-
|
|
396
|
-
**Output:** Summary of changes, files modified, verification results
|
|
397
|
-
|
|
398
|
-
**Model:** Auto-select (Gemini CLI chooses best)
|
|
399
|
-
|
|
400
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
401
|
-
⚙️ HOW IT WORKS
|
|
402
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
403
|
-
|
|
404
|
-
1. You select task_type enum (strict validation)
|
|
405
|
-
2. System loads corresponding MDX template
|
|
406
|
-
3. Merges template + your prompt
|
|
407
|
-
4. Executes: `gemini --yolo -p "[merged_prompt]"`
|
|
408
|
-
5. Returns specialized result
|
|
409
|
-
|
|
410
|
-
**No shell commands, no intermediate steps** - Pure CLI-to-prompt translation.
|
|
60
|
+
Gemini subagent with 4 task types:
|
|
61
|
+
- `completion-inspector`: Verify task completion (git diff, patterns, requirements)
|
|
62
|
+
- `helper-friend`: Research (codebase, web, docs, community)
|
|
63
|
+
- `manual-tester`: QA testing (browser, API, screenshots)
|
|
64
|
+
- `manual`: General executor (implement, fix, run commands)
|
|
411
65
|
|
|
412
66
|
parameters:
|
|
413
67
|
task_type:
|
|
414
68
|
type: string
|
|
415
69
|
required: true
|
|
416
|
-
|
|
417
|
-
pattern: "^(completion-inspector|helper-friend|manual-tester|manual)$"
|
|
418
|
-
description: |
|
|
419
|
-
**🎯 [REQUIRED] TASK TYPE SELECTOR - Choose Your Specialist**
|
|
420
|
-
|
|
421
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
422
|
-
⚠️ STRICT ENUM - Must be EXACTLY one of these four values!
|
|
423
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
424
|
-
|
|
425
|
-
**1️⃣ `completion-inspector`** - CTO-Level Code Auditor
|
|
426
|
-
|
|
427
|
-
**Use when:** You think your task is done and need verification
|
|
428
|
-
**What it does:** Analyzes git diff, checks patterns, finds issues
|
|
429
|
-
**Output:** Completion %, requirements checklist, action items
|
|
430
|
-
|
|
431
|
-
✅ Use for: After implementation, before PR, after refactoring
|
|
432
|
-
❌ Skip if: Still coding, no changes yet, trivial fixes
|
|
433
|
-
|
|
434
|
-
---
|
|
435
|
-
|
|
436
|
-
**2️⃣ `helper-friend`** - Research & Investigation Expert
|
|
437
|
-
|
|
438
|
-
**Use when:** You need research, analysis, or decision support
|
|
439
|
-
**What it does:** Searches codebase, web, docs, community
|
|
440
|
-
**Output:** Findings, recommendations, trade-offs, sources
|
|
441
|
-
|
|
442
|
-
✅ Use for: Bug investigation, architecture decisions, learning patterns
|
|
443
|
-
❌ Skip if: You already know what to do, simple questions
|
|
444
|
-
|
|
445
|
-
---
|
|
446
|
-
|
|
447
|
-
**3️⃣ `manual-tester`** - QA Engineer with Real Browser
|
|
448
|
-
|
|
449
|
-
**Use when:** Implementation is complete and needs testing
|
|
450
|
-
**What it does:** Browser testing, API testing, screenshots
|
|
451
|
-
**Output:** Test results, failures, screenshots, console errors
|
|
452
|
-
|
|
453
|
-
✅ Use for: UI testing, API testing, integration testing
|
|
454
|
-
❌ Skip if: Code not ready, no user-facing changes, pure refactor
|
|
455
|
-
|
|
456
|
-
---
|
|
457
|
-
|
|
458
|
-
**4️⃣ `manual`** - General-Purpose Executor
|
|
459
|
-
|
|
460
|
-
**Use when:** You need to implement, fix, create, or complete a task
|
|
461
|
-
**What it does:** Executes file operations, terminal commands, codebase search, and research tools
|
|
462
|
-
**Output:** Summary of changes, files modified, verification results
|
|
463
|
-
|
|
464
|
-
✅ Use for: Feature implementation, bug fixes, code refactoring, project setup, and general development tasks
|
|
465
|
-
❌ Skip if: Only need inspection, research, or testing
|
|
466
|
-
|
|
467
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
468
|
-
🔄 RECOMMENDED WORKFLOW
|
|
469
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
470
|
-
|
|
471
|
-
```
|
|
472
|
-
1. Research phase → helper-friend (understand problem)
|
|
473
|
-
2. Implementation → [your coding work]
|
|
474
|
-
3. Verification → completion-inspector (is it done?)
|
|
475
|
-
4. Testing → manual-tester (does it work?)
|
|
476
|
-
5. Done → PR/commit
|
|
477
|
-
```
|
|
478
|
-
|
|
479
|
-
**VALIDATION:** Server rejects invalid task types immediately.
|
|
480
|
-
The selected type loads a specialized MDX template optimized for that task.
|
|
70
|
+
description: "One of: `completion-inspector`, `helper-friend`, `manual-tester`, `manual`"
|
|
481
71
|
|
|
482
72
|
prompt:
|
|
483
73
|
type: string
|
|
484
74
|
required: true
|
|
485
|
-
validation:
|
|
486
|
-
minLength: 20
|
|
487
75
|
description: |
|
|
488
|
-
|
|
489
|
-
|
|
490
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
491
|
-
⚠️ CRITICAL: THE SUBAGENT IS COMPLETELY BLIND WITHOUT YOUR CONTEXT
|
|
492
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
493
|
-
|
|
494
|
-
The subagent has **ZERO** context about:
|
|
495
|
-
- Your codebase structure
|
|
496
|
-
- Your project goals
|
|
497
|
-
- Your tech stack
|
|
498
|
-
- Your constraints
|
|
499
|
-
- What you've already tried
|
|
500
|
-
- What files exist
|
|
501
|
-
- What the task even is
|
|
502
|
-
|
|
503
|
-
**YOU MUST PROVIDE EVERYTHING.** Assume you're explaining to a brilliant
|
|
504
|
-
engineer who just joined the team 5 minutes ago. They're smart but they
|
|
505
|
-
know NOTHING about your project.
|
|
506
|
-
|
|
507
|
-
**For manual-tester, provide:**
|
|
508
|
-
- Frontend URL (MANDATORY!)
|
|
509
|
-
- Backend URL (if applicable)
|
|
510
|
-
- Auth credentials
|
|
511
|
-
- Feature description
|
|
512
|
-
- Expected behaviors
|
|
513
|
-
- Test data
|
|
514
|
-
- Edge cases to test
|
|
515
|
-
|
|
516
|
-
**For manual, provide:**
|
|
517
|
-
- Clear task description
|
|
518
|
-
- Requirements or acceptance criteria
|
|
519
|
-
- Relevant file paths or context
|
|
520
|
-
- Any constraints or preferences
|
|
521
|
-
- Expected outcome
|
|
522
|
-
|
|
523
|
-
Minimum 20 characters required.
|
|
524
|
-
PROVIDE EVERYTHING.** Assume you're explaining to a brilliant
|
|
525
|
-
engineer who just joined the team 5 minutes ago. They're smart but they
|
|
526
|
-
know NOTHING about your project.
|
|
527
|
-
|
|
528
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
529
|
-
📊 QUALITY SCALE - BE BRUTALLY HONEST WITH YOURSELF
|
|
530
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
531
|
-
|
|
532
|
-
**WORD COUNT → QUALITY LEVEL → WHAT YOU'LL GET**
|
|
533
|
-
|
|
534
|
-
**< 50 words** → 💀 GARBAGE
|
|
535
|
-
- "Check if done" / "Fix the bug" / "Test login"
|
|
536
|
-
- Response: Generic platitudes, wastes everyone's time
|
|
537
|
-
- You're better off not calling the subagent at all
|
|
538
|
-
|
|
539
|
-
**50-100 words** → ❌ USELESS
|
|
540
|
-
- Brief mention of task, no files, no context
|
|
541
|
-
- Response: Vague suggestions that don't apply to your code
|
|
542
|
-
- The subagent is guessing blindly
|
|
543
|
-
|
|
544
|
-
**100-200 words** → ⚠️ POOR
|
|
545
|
-
- Some context but missing critical details
|
|
546
|
-
- Response: Partially relevant but misses your actual situation
|
|
547
|
-
- 50% of insights will be off-target
|
|
548
|
-
|
|
549
|
-
**200-300 words** → 😐 MEDIOCRE
|
|
550
|
-
- Basic context, some files mentioned
|
|
551
|
-
- Response: Generally useful but lacks specificity
|
|
552
|
-
- You'll need follow-up questions
|
|
553
|
-
|
|
554
|
-
**300-500 words** → ✅ ACCEPTABLE
|
|
555
|
-
- Good context, file paths included, requirements stated
|
|
556
|
-
- Response: Relevant and actionable
|
|
557
|
-
- Minimum threshold for useful output
|
|
558
|
-
|
|
559
|
-
**500-750 words** → 🎯 GOOD
|
|
560
|
-
- Comprehensive context, detailed file descriptions
|
|
561
|
-
- What you tried, why it failed, specific questions
|
|
562
|
-
- Response: Highly targeted, specific recommendations
|
|
563
|
-
|
|
564
|
-
**750-1000 words** → ⭐ EXCELLENT
|
|
565
|
-
- Full context: files, requirements, acceptance criteria
|
|
566
|
-
- Tech stack, constraints, edge cases, what you've tried
|
|
567
|
-
- Response: Expert-level analysis, production-ready advice
|
|
568
|
-
|
|
569
|
-
**1000+ words** → 🏆 EXCEPTIONAL
|
|
570
|
-
- Complete project context, detailed file-by-file breakdown
|
|
571
|
-
- Historical context, related issues, future considerations
|
|
572
|
-
- Response: CTO-level strategic recommendations
|
|
573
|
-
|
|
574
|
-
**🎯 TARGET: 500-1000 words minimum for any serious task!**
|
|
575
|
-
|
|
576
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
577
|
-
📁 FILE CONTEXT - ABSOLUTELY MANDATORY
|
|
578
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
579
|
-
|
|
580
|
-
**YOU MUST INCLUDE relative file paths for ALL relevant files!**
|
|
581
|
-
|
|
582
|
-
The subagent CANNOT see your filesystem. If you don't tell it which
|
|
583
|
-
files exist and what they do, it's operating completely blind.
|
|
584
|
-
|
|
585
|
-
**FORMAT:** Use relative paths from project root with descriptions:
|
|
586
|
-
|
|
587
|
-
```
|
|
588
|
-
📁 FILES CHANGED/RELEVANT:
|
|
589
|
-
|
|
590
|
-
src/auth/auth.controller.ts
|
|
591
|
-
- Purpose: Handles login/register/logout endpoints
|
|
592
|
-
- What changed: Added JWT refresh token logic (lines 45-120)
|
|
593
|
-
- Dependencies: Uses src/auth/jwt.service.ts for token generation
|
|
594
|
-
- Exports: AuthController class with 4 public methods
|
|
595
|
-
|
|
596
|
-
src/auth/jwt.service.ts
|
|
597
|
-
- Purpose: JWT token generation and validation
|
|
598
|
-
- What changed: New refreshToken() method added
|
|
599
|
-
- Key functions: generateToken(), validateToken(), refreshToken()
|
|
600
|
-
- Config: Uses JWT_SECRET from environment
|
|
601
|
-
|
|
602
|
-
src/middleware/auth.guard.ts
|
|
603
|
-
- Purpose: Protects routes requiring authentication
|
|
604
|
-
- What changed: Now checks for refresh token in cookie
|
|
605
|
-
- How it works: Extracts token from Authorization header or cookie
|
|
606
|
-
- Used by: All /api/protected/* routes
|
|
607
|
-
|
|
608
|
-
src/types/auth.types.ts
|
|
609
|
-
- Purpose: TypeScript interfaces for auth
|
|
610
|
-
- What changed: Added RefreshTokenPayload interface
|
|
611
|
-
- Exports: User, TokenPayload, RefreshTokenPayload, AuthResponse
|
|
612
|
-
|
|
613
|
-
tests/auth/auth.controller.spec.ts
|
|
614
|
-
- Purpose: Unit tests for auth controller
|
|
615
|
-
- What changed: Added 5 new tests for refresh flow
|
|
616
|
-
- Coverage: Now covers happy path + 3 error cases
|
|
617
|
-
```
|
|
618
|
-
|
|
619
|
-
**WHY THIS MATTERS:**
|
|
620
|
-
- Subagent can understand your architecture
|
|
621
|
-
- Can identify missing pieces
|
|
622
|
-
- Can check for consistency across files
|
|
623
|
-
- Can suggest improvements based on actual structure
|
|
624
|
-
|
|
625
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
626
|
-
📋 TASK CONTEXT - WHAT ARE YOU ACTUALLY DOING?
|
|
627
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
628
|
-
|
|
629
|
-
**Include the FULL context of what task you're working on:**
|
|
630
|
-
|
|
631
|
-
```
|
|
632
|
-
🎯 TASK CONTEXT:
|
|
633
|
-
|
|
634
|
-
**Task Title:** Add JWT refresh token authentication
|
|
635
|
-
|
|
636
|
-
**Background:**
|
|
637
|
-
We're building a SaaS platform. Users were complaining about
|
|
638
|
-
being logged out every hour. We need refresh tokens to keep
|
|
639
|
-
sessions alive for 7 days while maintaining security.
|
|
640
|
-
|
|
641
|
-
**Original Requirements:**
|
|
642
|
-
1. Access tokens expire in 15 minutes (security)
|
|
643
|
-
2. Refresh tokens expire in 7 days (convenience)
|
|
644
|
-
3. Refresh tokens stored in HTTP-only cookie (XSS protection)
|
|
645
|
-
4. Refresh token rotation on each refresh (security)
|
|
646
|
-
5. Invalidate all tokens on password change
|
|
647
|
-
|
|
648
|
-
**Acceptance Criteria:**
|
|
649
|
-
- [ ] POST /auth/login returns access token + sets refresh cookie
|
|
650
|
-
- [ ] POST /auth/refresh exchanges refresh token for new access token
|
|
651
|
-
- [ ] Refresh token is rotated on each use
|
|
652
|
-
- [ ] Old refresh tokens are invalidated
|
|
653
|
-
- [ ] Password change invalidates all user sessions
|
|
654
|
-
|
|
655
|
-
**Tech Stack:**
|
|
656
|
-
- Node.js 20 + Express 4.18
|
|
657
|
-
- TypeScript 5.3
|
|
658
|
-
- PostgreSQL 15 with Prisma ORM
|
|
659
|
-
- Jest for testing
|
|
660
|
-
- Redis for token blacklist
|
|
661
|
-
|
|
662
|
-
**What I've Done So Far:**
|
|
663
|
-
1. Created jwt.service.ts with token generation ✅
|
|
664
|
-
2. Updated auth.controller.ts with refresh endpoint ✅
|
|
665
|
-
3. Added refresh token to login response ✅
|
|
666
|
-
4. Modified auth.guard.ts to check cookies ✅
|
|
667
|
-
5. Written basic tests ⏳ (in progress)
|
|
668
|
-
|
|
669
|
-
**What's Not Working:**
|
|
670
|
-
- Token rotation works but old tokens aren't being blacklisted
|
|
671
|
-
- Tests are flaky - sometimes pass, sometimes fail
|
|
672
|
-
- Not sure if my Redis implementation is correct
|
|
673
|
-
|
|
674
|
-
**Specific Questions:**
|
|
675
|
-
1. Is my refresh token rotation implementation secure?
|
|
676
|
-
2. Should I use Redis SET or SORTED SET for blacklist?
|
|
677
|
-
3. How do I make my tests deterministic?
|
|
678
|
-
```
|
|
679
|
-
|
|
680
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
681
|
-
🔧 WHAT YOU'VE TRIED - PREVENT DUPLICATE SUGGESTIONS
|
|
682
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
683
|
-
|
|
684
|
-
**Tell the subagent what you've already attempted:**
|
|
685
|
-
|
|
686
|
-
```
|
|
687
|
-
🔄 WHAT I'VE TRIED:
|
|
688
|
-
|
|
689
|
-
1. Used JWT library's built-in expiry
|
|
690
|
-
→ Problem: Couldn't invalidate tokens before expiry
|
|
691
|
-
|
|
692
|
-
2. Stored tokens in database
|
|
693
|
-
→ Problem: Too slow, 50ms+ per request
|
|
694
|
-
|
|
695
|
-
3. Redis with simple SET
|
|
696
|
-
→ Problem: No automatic expiry, memory grows forever
|
|
697
|
-
|
|
698
|
-
4. Asked ChatGPT
|
|
699
|
-
→ Got generic advice that didn't fit our architecture
|
|
700
|
-
```
|
|
701
|
-
|
|
702
|
-
**WHY THIS MATTERS:**
|
|
703
|
-
- Avoids wasting time on already-tried solutions
|
|
704
|
-
- Helps subagent understand what DOESN'T work
|
|
705
|
-
- Shows your thinking process for better recommendations
|
|
706
|
-
|
|
707
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
708
|
-
📋 PROMPT TEMPLATES BY TASK TYPE (FOLLOW EXACTLY!)
|
|
709
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
710
|
-
|
|
711
|
-
**═══ COMPLETION-INSPECTOR TEMPLATE ═══**
|
|
712
|
-
|
|
713
|
-
```
|
|
714
|
-
🎯 TASK TITLE: [One-line description]
|
|
715
|
-
|
|
716
|
-
📋 ORIGINAL REQUIREMENTS:
|
|
717
|
-
1. [Requirement 1 - be specific]
|
|
718
|
-
2. [Requirement 2 - include acceptance criteria]
|
|
719
|
-
3. [Requirement 3 - mention edge cases if any]
|
|
720
|
-
|
|
721
|
-
✅ ACCEPTANCE CRITERIA:
|
|
722
|
-
- [Criterion 1 - how to verify it's met]
|
|
723
|
-
- [Criterion 2 - testable condition]
|
|
724
|
-
- [Criterion 3 - measurable outcome]
|
|
725
|
-
|
|
726
|
-
📝 IMPLEMENTATION SUMMARY:
|
|
727
|
-
[2-3 sentences describing what you implemented and your approach]
|
|
728
|
-
|
|
729
|
-
📁 FILES CHANGED:
|
|
730
|
-
- `src/path/to/file1.ts` - [What changed and why]
|
|
731
|
-
- `src/path/to/file2.ts` - [What changed and why]
|
|
732
|
-
- `tests/path/to/test.ts` - [Tests added/modified]
|
|
733
|
-
|
|
734
|
-
🔖 GIT CONTEXT:
|
|
735
|
-
- START_COMMIT: [hash or "HEAD~N"]
|
|
736
|
-
- Branch: [feature branch name]
|
|
737
|
-
|
|
738
|
-
💭 WHY I THINK IT'S COMPLETE:
|
|
739
|
-
[Explain your reasoning - what makes you confident it's done?]
|
|
740
|
-
|
|
741
|
-
⚠️ AREAS OF CONCERN (if any):
|
|
742
|
-
[Any parts you're unsure about or want extra scrutiny on]
|
|
743
|
-
```
|
|
744
|
-
|
|
745
|
-
**═══ HELPER-FRIEND TEMPLATE ═══**
|
|
746
|
-
|
|
747
|
-
```
|
|
748
|
-
🎯 ULTIMATE GOAL:
|
|
749
|
-
[What are you trying to achieve? What does success look like?]
|
|
750
|
-
|
|
751
|
-
📍 CURRENT SITUATION:
|
|
752
|
-
[Where are you now? What's the context?]
|
|
753
|
-
|
|
754
|
-
📁 RELEVANT FILES (with descriptions):
|
|
755
|
-
- `src/path/to/file1.ts` - [What this file does, why it's relevant]
|
|
756
|
-
- `src/path/to/file2.ts` - [What this file does, why it's relevant]
|
|
757
|
-
|
|
758
|
-
🔄 WHAT I'VE TRIED:
|
|
759
|
-
1. [Approach 1] → [Result/Why it didn't work]
|
|
760
|
-
2. [Approach 2] → [Result/Why it didn't work]
|
|
761
|
-
|
|
762
|
-
❓ SPECIFIC QUESTIONS:
|
|
763
|
-
1. [Question 1 - be specific, not vague]
|
|
764
|
-
2. [Question 2 - include context]
|
|
765
|
-
3. [Question 3 - what decision does this inform?]
|
|
766
|
-
|
|
767
|
-
🚧 CURRENT BLOCKER:
|
|
768
|
-
[What's stopping you? Be specific about the problem.]
|
|
769
|
-
|
|
770
|
-
📌 CONSTRAINTS:
|
|
771
|
-
- [Constraint 1 - tech stack limitations]
|
|
772
|
-
- [Constraint 2 - timeline/scope]
|
|
773
|
-
- [Constraint 3 - compatibility requirements]
|
|
774
|
-
|
|
775
|
-
🎯 WHAT I NEED FROM YOU:
|
|
776
|
-
[Specific ask - research? recommendations? code examples?]
|
|
777
|
-
```
|
|
778
|
-
|
|
779
|
-
**═══ MANUAL-TESTER TEMPLATE ═══**
|
|
780
|
-
|
|
781
|
-
```
|
|
782
|
-
🌐 URLS (MANDATORY!):
|
|
783
|
-
- Frontend: [http://localhost:3000 or deployed URL]
|
|
784
|
-
- Backend API: [http://localhost:8000/api or deployed URL]
|
|
785
|
-
- Admin panel: [if applicable]
|
|
786
|
-
|
|
787
|
-
🔐 AUTH CREDENTIALS (if needed):
|
|
788
|
-
- Username: [test user]
|
|
789
|
-
- Password: [test password]
|
|
790
|
-
- Or: [How to authenticate]
|
|
791
|
-
|
|
792
|
-
📝 FEATURE TO TEST:
|
|
793
|
-
[Describe the feature in 2-3 sentences]
|
|
794
|
-
|
|
795
|
-
✅ EXPECTED BEHAVIORS:
|
|
796
|
-
1. [When user does X] → [Y should happen]
|
|
797
|
-
2. [When user does A] → [B should appear]
|
|
798
|
-
3. [Form validation] → [These errors should show]
|
|
799
|
-
|
|
800
|
-
🧪 TEST SCENARIOS:
|
|
801
|
-
- Happy path: [Normal user flow to test]
|
|
802
|
-
- Error path: [Invalid input scenarios]
|
|
803
|
-
- Edge cases: [Boundary conditions]
|
|
804
|
-
|
|
805
|
-
📊 TEST DATA:
|
|
806
|
-
- Valid input: [example values]
|
|
807
|
-
- Invalid input: [example values that should fail]
|
|
808
|
-
|
|
809
|
-
📱 VIEWPORTS TO TEST:
|
|
810
|
-
- Desktop (1920x1080)
|
|
811
|
-
- Tablet (768x1024)
|
|
812
|
-
- Mobile (375x667)
|
|
813
|
-
|
|
814
|
-
⚠️ KNOWN ISSUES (skip these):
|
|
815
|
-
[Any known bugs to ignore during testing]
|
|
816
|
-
```
|
|
817
|
-
|
|
818
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
819
|
-
❌ BAD vs ✅ GOOD EXAMPLES - THE DIFFERENCE IS NIGHT AND DAY
|
|
820
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
821
|
-
|
|
822
|
-
**💀 GARBAGE (~5 words) - Complete waste of time:**
|
|
823
|
-
```
|
|
824
|
-
"Check if it's done"
|
|
825
|
-
"Fix the bug"
|
|
826
|
-
"Test login"
|
|
827
|
-
```
|
|
828
|
-
→ Response will be: "I don't have enough context to help. Please provide..."
|
|
829
|
-
→ You've wasted time and learned nothing
|
|
830
|
-
|
|
831
|
-
**❌ USELESS (~30 words) - Subagent is guessing blindly:**
|
|
832
|
-
```
|
|
833
|
-
"I added authentication to my Node.js app. Can you verify
|
|
834
|
-
it's complete? I think I covered everything but not sure."
|
|
835
|
-
```
|
|
836
|
-
→ What kind of auth? What files? What requirements? What's "everything"?
|
|
837
|
-
→ Response will be generic checklist that may not apply to your code
|
|
838
|
-
|
|
839
|
-
**⚠️ POOR (~80 words) - Half the insights will be wrong:**
|
|
840
|
-
```
|
|
841
|
-
"I'm working on JWT authentication for our Express API. I created
|
|
842
|
-
auth.controller.ts and jwt.service.ts. The login works but I'm
|
|
843
|
-
not sure about the refresh token implementation. We need tokens
|
|
844
|
-
to expire in 1 hour but users shouldn't be logged out while active."
|
|
845
|
-
```
|
|
846
|
-
→ Better but: What's in those files? What's the actual implementation?
|
|
847
|
-
→ What does "not sure" mean specifically? What have you tried?
|
|
848
|
-
|
|
849
|
-
**✅ ACCEPTABLE (~200 words) - Minimum for useful output:**
|
|
850
|
-
```
|
|
851
|
-
🎯 TASK: JWT refresh token authentication
|
|
852
|
-
|
|
853
|
-
📋 REQUIREMENTS:
|
|
854
|
-
1. Access tokens expire in 15 minutes
|
|
855
|
-
2. Refresh tokens expire in 7 days
|
|
856
|
-
3. Refresh tokens in HTTP-only cookies
|
|
857
|
-
|
|
858
|
-
📁 FILES:
|
|
859
|
-
- src/auth/auth.controller.ts - Login/register/refresh endpoints
|
|
860
|
-
- src/auth/jwt.service.ts - Token generation and validation
|
|
861
|
-
- src/middleware/auth.guard.ts - Route protection
|
|
862
|
-
|
|
863
|
-
✅ ACCEPTANCE:
|
|
864
|
-
- POST /auth/login returns access token + sets refresh cookie
|
|
865
|
-
- POST /auth/refresh returns new access token
|
|
866
|
-
- Invalid tokens return 401
|
|
867
|
-
|
|
868
|
-
💭 STATUS: Login works, refresh endpoint exists but untested
|
|
869
|
-
|
|
870
|
-
❓ QUESTIONS:
|
|
871
|
-
1. Is storing refresh token in cookie secure?
|
|
872
|
-
2. Should I rotate refresh tokens?
|
|
873
|
-
```
|
|
874
|
-
|
|
875
|
-
**🎯 GOOD (~500 words) - Highly targeted recommendations:**
|
|
876
|
-
```
|
|
877
|
-
🎯 TASK TITLE: Implement JWT refresh token authentication
|
|
878
|
-
|
|
879
|
-
**Background:**
|
|
880
|
-
Building a SaaS dashboard. Users complained about hourly logouts.
|
|
881
|
-
Need refresh tokens to maintain sessions for 7 days while keeping
|
|
882
|
-
access tokens short-lived for security.
|
|
883
|
-
|
|
884
|
-
📋 ORIGINAL REQUIREMENTS:
|
|
885
|
-
1. Access tokens: 15 minute expiry (security best practice)
|
|
886
|
-
2. Refresh tokens: 7 day expiry (user convenience)
|
|
887
|
-
3. Refresh tokens: HTTP-only cookie (XSS protection)
|
|
888
|
-
4. Token rotation: New refresh token on each refresh (security)
|
|
889
|
-
5. Revocation: Password change invalidates all sessions
|
|
890
|
-
|
|
891
|
-
✅ ACCEPTANCE CRITERIA:
|
|
892
|
-
- [ ] POST /auth/login returns {accessToken} + sets refreshToken cookie
|
|
893
|
-
- [ ] POST /auth/refresh exchanges refresh for new access + new refresh
|
|
894
|
-
- [ ] Protected routes return 401 without valid access token
|
|
895
|
-
- [ ] Refresh with old/rotated token fails (single-use enforcement)
|
|
896
|
-
- [ ] Password change via /auth/password invalidates all tokens
|
|
897
|
-
|
|
898
|
-
📁 FILES CHANGED:
|
|
899
|
-
|
|
900
|
-
src/auth/auth.controller.ts (lines 1-120)
|
|
901
|
-
- Purpose: HTTP endpoints for auth operations
|
|
902
|
-
- Changes: Added /refresh endpoint, modified /login to set cookie
|
|
903
|
-
- Exports: AuthController with login(), register(), refresh(), logout()
|
|
904
|
-
- Dependencies: JwtService, UserService, Response (for cookies)
|
|
905
|
-
|
|
906
|
-
src/auth/jwt.service.ts (lines 1-85)
|
|
907
|
-
- Purpose: Token generation, validation, rotation logic
|
|
908
|
-
- Changes: Added generateRefreshToken(), rotateRefreshToken(), blacklistToken()
|
|
909
|
-
- Key logic: Uses Redis for token blacklist with TTL matching token expiry
|
|
910
|
-
- Config: JWT_SECRET, REFRESH_SECRET from env
|
|
911
|
-
|
|
912
|
-
src/middleware/auth.guard.ts (lines 1-45)
|
|
913
|
-
- Purpose: Protects routes requiring authentication
|
|
914
|
-
- Changes: Now extracts token from Authorization header OR cookie
|
|
915
|
-
- Logic: Validates access token, attaches user to request
|
|
916
|
-
|
|
917
|
-
src/auth/dto/auth.dto.ts (lines 1-30)
|
|
918
|
-
- Purpose: Request/response type definitions
|
|
919
|
-
- Changes: Added RefreshTokenDto, TokenResponseDto
|
|
920
|
-
|
|
921
|
-
tests/auth/auth.e2e-spec.ts (lines 1-150)
|
|
922
|
-
- Purpose: End-to-end auth flow tests
|
|
923
|
-
- Changes: Added 8 tests for refresh flow
|
|
924
|
-
- Coverage: Happy path, expired token, rotated token, blacklisted token
|
|
925
|
-
|
|
926
|
-
🔖 GIT CONTEXT:
|
|
927
|
-
- START_COMMIT: abc123 (before auth changes)
|
|
928
|
-
- Current branch: feature/refresh-tokens
|
|
929
|
-
- 12 commits since start
|
|
930
|
-
|
|
931
|
-
🔧 TECH STACK:
|
|
932
|
-
- Node.js 20, Express 4.18, TypeScript 5.3
|
|
933
|
-
- Prisma ORM with PostgreSQL 15
|
|
934
|
-
- Redis 7 for token blacklist
|
|
935
|
-
- Jest + Supertest for testing
|
|
936
|
-
|
|
937
|
-
🔄 WHAT I'VE TRIED:
|
|
938
|
-
1. Storing tokens in database → Too slow (50ms/request)
|
|
939
|
-
2. JWT blacklist without Redis → Memory leak in production
|
|
940
|
-
3. Simple refresh without rotation → Security concern flagged in review
|
|
941
|
-
|
|
942
|
-
💭 WHY I THINK IT'S COMPLETE:
|
|
943
|
-
- All 5 requirements implemented
|
|
944
|
-
- 8/8 e2e tests passing
|
|
945
|
-
- Manual testing works in Postman
|
|
946
|
-
- Code reviewed by team lead
|
|
947
|
-
|
|
948
|
-
⚠️ AREAS OF CONCERN:
|
|
949
|
-
- Redis connection handling during reconnects
|
|
950
|
-
- Is my token rotation truly atomic?
|
|
951
|
-
- Should blacklist use SET or SORTED SET?
|
|
952
|
-
|
|
953
|
-
❓ SPECIFIC QUESTIONS:
|
|
954
|
-
1. Is the refresh token rotation implementation secure against race conditions?
|
|
955
|
-
2. Is storing the refresh token family ID sufficient for revocation?
|
|
956
|
-
3. Any edge cases I'm missing in my test coverage?
|
|
957
|
-
```
|
|
958
|
-
→ This prompt gives the subagent EVERYTHING it needs to provide
|
|
959
|
-
expert-level, specific, actionable recommendations
|
|
960
|
-
|
|
961
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
962
|
-
💡 PRO TIPS FOR MAXIMUM QUALITY OUTPUT
|
|
963
|
-
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
964
|
-
|
|
965
|
-
1. **TARGET 500-1000 WORDS** - Seriously, more context = better output
|
|
966
|
-
2. **LIST EVERY FILE** - With relative paths AND what each file does
|
|
967
|
-
3. **DESCRIBE WHAT CHANGED** - Not just "modified" but HOW and WHY
|
|
968
|
-
4. **INCLUDE LINE NUMBERS** - "auth logic at lines 45-120" helps focus
|
|
969
|
-
5. **STATE YOUR TECH STACK** - Versions matter for compatibility advice
|
|
970
|
-
6. **EXPLAIN WHAT YOU TRIED** - Prevents duplicate suggestions
|
|
971
|
-
7. **ASK SPECIFIC QUESTIONS** - "Is X secure?" not "Is it good?"
|
|
972
|
-
8. **MENTION EDGE CASES** - What weird scenarios worry you?
|
|
973
|
-
9. **INCLUDE ERROR MESSAGES** - Exact errors, not paraphrased
|
|
974
|
-
10. **SHARE YOUR REASONING** - Why you made certain choices
|
|
975
|
-
|
|
976
|
-
**THE GOLDEN RULE:**
|
|
977
|
-
|
|
978
|
-
Imagine you're onboarding a brilliant senior engineer who just joined
|
|
979
|
-
your team. They've never seen your codebase. What would you tell them
|
|
980
|
-
to get them up to speed and able to give expert advice?
|
|
981
|
-
|
|
982
|
-
**THAT is what your prompt should contain.**
|
|
983
|
-
|
|
984
|
-
**REMEMBER:**
|
|
985
|
-
- 💀 < 50 words = You're wasting everyone's time
|
|
986
|
-
- ⚠️ 50-200 words = Expect generic, often wrong advice
|
|
987
|
-
- ✅ 200-500 words = Acceptable, targeted recommendations
|
|
988
|
-
- 🎯 500-1000 words = Expert-level, production-ready insights
|
|
989
|
-
- 🏆 1000+ words = CTO-level strategic guidance
|
|
76
|
+
Your task prompt. Include: task description, relevant files, requirements, context.
|
|
77
|
+
More detail = better results. Min 20 chars.
|
|
990
78
|
|
|
991
79
|
model:
|
|
992
80
|
type: string
|
|
993
81
|
required: false
|
|
994
|
-
description:
|
|
995
|
-
**[OPTIONAL] Override model selection**
|
|
996
|
-
|
|
997
|
-
Leave empty to use task type's default:
|
|
998
|
-
- completion-inspector: gemini-3-pro
|
|
999
|
-
- helper-friend: auto-select
|
|
1000
|
-
- manual-tester: gemini-3-pro
|
|
1001
|
-
|
|
1002
|
-
Available: `gemini-3-pro`, `gemini-3-flash`
|
|
82
|
+
description: "Override model. Leave empty for auto-select."
|
|
1003
83
|
|
|
1004
84
|
sandbox:
|
|
1005
85
|
type: boolean
|
|
1006
86
|
required: false
|
|
1007
87
|
default: false
|
|
1008
|
-
description:
|
|
1009
|
-
**[OPTIONAL] Run in sandbox mode**
|
|
1010
|
-
|
|
1011
|
-
Enables sandbox isolation for safer execution.
|
|
1012
|
-
Flag: --sandbox / -s
|
|
88
|
+
description: "Run in sandbox mode."
|
|
1013
89
|
|
|
1014
90
|
approval_mode:
|
|
1015
91
|
type: string
|
|
1016
92
|
required: false
|
|
1017
|
-
description:
|
|
1018
|
-
**[OPTIONAL] Override approval mode**
|
|
1019
|
-
|
|
1020
|
-
Valid values:
|
|
1021
|
-
- `default` - Prompt for approval
|
|
1022
|
-
- `auto_edit` - Auto-approve edit tools
|
|
1023
|
-
- `yolo` - Auto-approve all tools
|
|
1024
|
-
|
|
1025
|
-
Leave empty to use --yolo (auto-approve all)
|
|
93
|
+
description: "Override: `default`, `auto_edit`, or `yolo`"
|
|
1026
94
|
|
|
1027
95
|
include_directories:
|
|
1028
96
|
type: string
|
|
1029
97
|
required: false
|
|
1030
|
-
description:
|
|
1031
|
-
**[OPTIONAL] Include additional directories**
|
|
1032
|
-
|
|
1033
|
-
Comma-separated list of directories to include.
|
|
1034
|
-
Example: "src,docs,tests"
|
|
98
|
+
description: "Additional directories. Example: `src,docs,tests`"
|
|
1035
99
|
|
|
1036
100
|
include_instructions:
|
|
1037
101
|
type: boolean
|
|
1038
102
|
required: false
|
|
1039
103
|
default: true
|
|
1040
|
-
description:
|
|
1041
|
-
Include task-specific instructions from MDX template.
|
|
1042
|
-
Default: true (recommended)
|
|
1043
|
-
Set false: For custom prompts that don't need template
|
|
104
|
+
description: "Include MDX template instructions. Default: true"
|
|
1044
105
|
|
|
1045
106
|
async:
|
|
1046
107
|
type: boolean
|
|
1047
108
|
required: false
|
|
1048
109
|
default: true
|
|
1049
110
|
description: |
|
|
1050
|
-
|
|
1051
|
-
|
|
1052
|
-
**Default: true (async)**
|
|
1053
|
-
- Returns immediately with a 5-digit task ID (e.g., 34567)
|
|
1054
|
-
- Task runs in background
|
|
1055
|
-
- Query status with `check_subagent_task` tool using the task ID
|
|
1056
|
-
- Results stored in memory until retrieved
|
|
1057
|
-
|
|
1058
|
-
**Set to false (sync/blocking):**
|
|
1059
|
-
- Blocks until task completes
|
|
1060
|
-
- Returns full result directly
|
|
1061
|
-
- Use for quick tasks where you need immediate result
|
|
1062
|
-
|
|
1063
|
-
**Example async flow:**
|
|
1064
|
-
1. Call `gemini-subagent` with `async: true` (default)
|
|
1065
|
-
2. Receive: `{"task_id": 34567, "status": "running"}`
|
|
1066
|
-
3. Later: Call `check_subagent_task` with `task_id: 34567`
|
|
1067
|
-
4. Receive: `{"status": "completed", "result": "..."}` or `{"status": "running"}`
|
|
1068
|
-
|
|
1069
|
-
**⚠️ IMPORTANT:** When async=true, the response is NOT the result!
|
|
1070
|
-
You MUST call `check_subagent_task` to get the actual result.
|
|
111
|
+
Async mode (default: true). Returns task_id immediately.
|
|
112
|
+
Set false to block and return result directly.
|