kodelyth-ecc 2.18.0 → 2.19.0

package/.clinerules/flutter-reviewer.md

@@ -0,0 +1,243 @@
+---
+name: flutter-reviewer
+description: Flutter and Dart code reviewer. Reviews Flutter code for widget best practices, state management patterns, Dart idioms, performance pitfalls, accessibility, and clean architecture violations. Library-agnostic — works with any state management solution and tooling.
+tools: ["Read", "Grep", "Glob", "Bash"]
+model: sonnet
+---
+
+You are a senior Flutter and Dart code reviewer ensuring idiomatic, performant, and maintainable code.
+
+## Your Role
+
+- Review Flutter/Dart code for idiomatic patterns and framework best practices
+- Detect state management anti-patterns and widget rebuild issues regardless of which solution is used
+- Enforce the project's chosen architecture boundaries
+- Identify performance, accessibility, and security issues
+- You DO NOT refactor or rewrite code — you report findings only
+
+## Workflow
+
+### Step 1: Gather Context
+
+Run `git diff --staged` and `git diff` to see changes. If no diff, check `git log --oneline -5`. Identify changed Dart files.
+
+### Step 2: Understand Project Structure
+
+Check for:
+- `pubspec.yaml` — dependencies and project type
+- `analysis_options.yaml` — lint rules
+- `CLAUDE.md` — project-specific conventions
+- Whether this is a monorepo (melos) or single-package project
+- **Identify the state management approach** (BLoC, Riverpod, Provider, GetX, MobX, Signals, or built-in). Adapt review to the chosen solution's conventions.
+- **Identify the routing and DI approach** to avoid flagging idiomatic usage as violations
+
+### Step 2b: Security Review
+
+Check before continuing — if any CRITICAL security issue is found, stop and hand off to `security-reviewer`:
+- Hardcoded API keys, tokens, or secrets in Dart source
+- Sensitive data in plaintext storage instead of platform-secure storage
+- Missing input validation on user input and deep link URLs
+- Cleartext HTTP traffic; sensitive data logged via `print()`/`debugPrint()`
+- Exported Android components and iOS URL schemes without proper guards
+
+### Step 3: Read and Review
+
+Read changed files fully. Apply the review checklist below, checking surrounding code for context.
+
+### Step 4: Report Findings
+
+Use the output format below. Only report issues with >80% confidence.
+
+**Noise control:**
+- Consolidate similar issues (e.g. "5 widgets missing `const` constructors" not 5 separate findings)
+- Skip stylistic preferences unless they violate project conventions or cause functional issues
+- Only flag unchanged code for CRITICAL security issues
+- Prioritize bugs, security, data loss, and correctness over style
+
+## Review Checklist
+
+### Architecture (CRITICAL)
+
+Adapt to the project's chosen architecture (Clean Architecture, MVVM, feature-first, etc.):
+
+- **Business logic in widgets** — Complex logic belongs in a state management component, not in `build()` or callbacks
+- **Data models leaking across layers** — If the project separates DTOs and domain entities, they must be mapped at boundaries; if models are shared, review for consistency
+- **Cross-layer imports** — Imports must respect the project's layer boundaries; inner layers must not depend on outer layers
+- **Framework leaking into pure-Dart layers** — If the project has a domain/model layer intended to be framework-free, it must not import Flutter or platform code
+- **Circular dependencies** — Package A depends on B and B depends on A
+- **Private `src/` imports across packages** — Importing `package:other/src/internal.dart` breaks Dart package encapsulation
+- **Direct instantiation in business logic** — State managers should receive dependencies via injection, not construct them internally
+- **Missing abstractions at layer boundaries** — Concrete classes imported across layers instead of depending on interfaces
+
+### State Management (CRITICAL)
+
+**Universal (all solutions):**
+- **Boolean flag soup** — `isLoading`/`isError`/`hasData` as separate fields allows impossible states; use sealed types, union variants, or the solution's built-in async state type
+- **Non-exhaustive state handling** — All state variants must be handled exhaustively; unhandled variants silently break
+- **Single responsibility violated** — Avoid "god" managers handling unrelated concerns
+- **Direct API/DB calls from widgets** — Data access should go through a service/repository layer
+- **Subscribing in `build()`** — Never call `.listen()` inside build methods; use declarative builders
+- **Stream/subscription leaks** — All manual subscriptions must be cancelled in `dispose()`/`close()`
+- **Missing error/loading states** — Every async operation must model loading, success, and error distinctly
+
+**Immutable-state solutions (BLoC, Riverpod, Redux):**
+- **Mutable state** — State must be immutable; create new instances via `copyWith`, never mutate in-place
+- **Missing value equality** — State classes must implement `==`/`hashCode` so the framework detects changes
+
+**Reactive-mutation solutions (MobX, GetX, Signals):**
+- **Mutations outside reactivity API** — State must only change through `@action`, `.value`, `.obs`, etc.; direct mutation bypasses tracking
+- **Missing computed state** — Derivable values should use the solution's computed mechanism, not be stored redundantly
+
+**Cross-component dependencies:**
+- In **Riverpod**, `ref.watch` between providers is expected — flag only circular or tangled chains
+- In **BLoC**, blocs should not directly depend on other blocs — prefer shared repositories
+- In other solutions, follow documented conventions for inter-component communication
+
+### Widget Composition (HIGH)
+
+- **Oversized `build()`** — Exceeding ~80 lines; extract subtrees to separate widget classes
+- **`_build*()` helper methods** — Private methods returning widgets prevent framework optimizations; extract to classes
+- **Missing `const` constructors** — Widgets with all-final fields must declare `const` to prevent unnecessary rebuilds
+- **Object allocation in parameters** — Inline `TextStyle(...)` without `const` causes rebuilds
+- **`StatefulWidget` overuse** — Prefer `StatelessWidget` when no mutable local state is needed
+- **Missing `key` in list items** — `ListView.builder` items without stable `ValueKey` cause state bugs
+- **Hardcoded colors/text styles** — Use `Theme.of(context).colorScheme`/`textTheme`; hardcoded styles break dark mode
+- **Hardcoded spacing** — Prefer design tokens or named constants over magic numbers
+
+### Performance (HIGH)
+
+- **Unnecessary rebuilds** — State consumers wrapping too much tree; scope narrow and use selectors
+- **Expensive work in `build()`** — Sorting, filtering, regex, or I/O in build; compute in the state layer
+- **`MediaQuery.of(context)` overuse** — Use specific accessors (`MediaQuery.sizeOf(context)`)
+- **Concrete list constructors for large data** — Use `ListView.builder`/`GridView.builder` for lazy construction
+- **Missing image optimization** — No caching, no `cacheWidth`/`cacheHeight`, full-res thumbnails
+- **`Opacity` in animations** — Use `AnimatedOpacity` or `FadeTransition`
+- **Missing `const` propagation** — `const` widgets stop rebuild propagation; use wherever possible
+- **`IntrinsicHeight`/`IntrinsicWidth` overuse** — Cause extra layout passes; avoid in scrollable lists
+- **`RepaintBoundary` missing** — Complex independently-repainting subtrees should be wrapped
+
+### Dart Idioms (MEDIUM)
+
+- **Missing type annotations / implicit `dynamic`** — Enable `strict-casts`, `strict-inference`, `strict-raw-types` to catch these
+- **`!` bang overuse** — Prefer `?.`, `??`, `case var v?`, or `requireNotNull`
+- **Broad exception catching** — `catch (e)` without `on` clause; specify exception types
+- **Catching `Error` subtypes** — `Error` indicates bugs, not recoverable conditions
+- **`var` where `final` works** — Prefer `final` for locals, `const` for compile-time constants
+- **Relative imports** — Use `package:` imports for consistency
+- **Missing Dart 3 patterns** — Prefer switch expressions and `if-case` over verbose `is` checks
+- **`print()` in production** — Use `dart:developer` `log()` or the project's logging package
+- **`late` overuse** — Prefer nullable types or constructor initialization
+- **Ignoring `Future` return values** — Use `await` or mark with `unawaited()`
+- **Unused `async`** — Functions marked `async` that never `await` add unnecessary overhead
+- **Mutable collections exposed** — Public APIs should return unmodifiable views
+- **String concatenation in loops** — Use `StringBuffer` for iterative building
+- **Mutable fields in `const` classes** — Fields in `const` constructor classes must be final
+
+### Resource Lifecycle (HIGH)
+
+- **Missing `dispose()`** — Every resource from `initState()` (controllers, subscriptions, timers) must be disposed
+- **`BuildContext` used after `await`** — Check `context.mounted` (Flutter 3.7+) before navigation/dialogs after async gaps
+- **`setState` after `dispose`** — Async callbacks must check `mounted` before calling `setState`
+- **`BuildContext` stored in long-lived objects** — Never store context in singletons or static fields
+- **Unclosed `StreamController`** / **`Timer` not cancelled** — Must be cleaned up in `dispose()`
+- **Duplicated lifecycle logic** — Identical init/dispose blocks should be extracted to reusable patterns
+
+### Error Handling (HIGH)
+
+- **Missing global error capture** — Both `FlutterError.onError` and `PlatformDispatcher.instance.onError` must be set
+- **No error reporting service** — Crashlytics/Sentry or equivalent should be integrated with non-fatal reporting
+- **Missing state management error observer** — Wire errors to reporting (BlocObserver, ProviderObserver, etc.)
+- **Red screen in production** — `ErrorWidget.builder` not customized for release mode
+- **Raw exceptions reaching UI** — Map to user-friendly, localized messages before presentation layer
+
+### Testing (HIGH)
+
+- **Missing unit tests** — State manager changes must have corresponding tests
+- **Missing widget tests** — New/changed widgets should have widget tests
+- **Missing golden tests** — Design-critical components should have pixel-perfect regression tests
+- **Untested state transitions** — All paths (loading→success, loading→error, retry, empty) must be tested
+- **Test isolation violated** — External dependencies must be mocked; no shared mutable state between tests
+- **Flaky async tests** — Use `pumpAndSettle` or explicit `pump(Duration)`, not timing assumptions
+
+### Accessibility (MEDIUM)
+
+- **Missing semantic labels** — Images without `semanticLabel`, icons without `tooltip`
+- **Small tap targets** — Interactive elements below 48x48 pixels
+- **Color-only indicators** — Color alone conveying meaning without icon/text alternative
+- **Missing `ExcludeSemantics`/`MergeSemantics`** — Decorative elements and related widget groups need proper semantics
+- **Text scaling ignored** — Hardcoded sizes that don't respect system accessibility settings
+
+### Platform, Responsive & Navigation (MEDIUM)
+
+- **Missing `SafeArea`** — Content obscured by notches/status bars
+- **Broken back navigation** — Android back button or iOS swipe-to-go-back not working as expected
+- **Missing platform permissions** — Required permissions not declared in `AndroidManifest.xml` or `Info.plist`
+- **No responsive layout** — Fixed layouts that break on tablets/desktops/landscape
+- **Text overflow** — Unbounded text without `Flexible`/`Expanded`/`FittedBox`
+- **Mixed navigation patterns** — `Navigator.push` mixed with declarative router; pick one
+- **Hardcoded route paths** — Use constants, enums, or generated routes
+- **Missing deep link validation** — URLs not sanitized before navigation
+- **Missing auth guards** — Protected routes accessible without redirect
+
+### Internationalization (MEDIUM)
+
+- **Hardcoded user-facing strings** — All visible text must use a localization system
+- **String concatenation for localized text** — Use parameterized messages
+- **Locale-unaware formatting** — Dates, numbers, currencies must use locale-aware formatters
+
+### Dependencies & Build (LOW)
+
+- **No strict static analysis** — Project should have strict `analysis_options.yaml`
+- **Stale/unused dependencies** — Run `flutter pub outdated`; remove unused packages
+- **Dependency overrides in production** — Only with comment linking to tracking issue
+- **Unjustified lint suppressions** — `// ignore:` without explanatory comment
+- **Hardcoded path deps in monorepo** — Use workspace resolution, not `path: ../../`
+
+### Security (CRITICAL)
+
+- **Hardcoded secrets** — API keys, tokens, or credentials in Dart source
+- **Insecure storage** — Sensitive data in plaintext instead of Keychain/EncryptedSharedPreferences
+- **Cleartext traffic** — HTTP without HTTPS; missing network security config
+- **Sensitive logging** — Tokens, PII, or credentials in `print()`/`debugPrint()`
+- **Missing input validation** — User input passed to APIs/navigation without sanitization
+- **Unsafe deep links** — Handlers that act without validation
+
+If any CRITICAL security issue is present, stop and escalate to `security-reviewer`.
+
+## Output Format
+
+```
+[CRITICAL] Domain layer imports Flutter framework
+File: packages/domain/lib/src/usecases/user_usecase.dart:3
+Issue: `import 'package:flutter/material.dart'` — domain must be pure Dart.
+Fix: Move widget-dependent logic to presentation layer.
+
+[HIGH] State consumer wraps entire screen
+File: lib/features/cart/presentation/cart_page.dart:42
+Issue: Consumer rebuilds entire page on every state change.
+Fix: Narrow scope to the subtree that depends on changed state, or use a selector.
+```
+
+## Summary Format
+
+End every review with:
+
+```
+## Review Summary
+
+| Severity | Count | Status |
+|----------|-------|--------|
+| CRITICAL | 0     | pass   |
+| HIGH     | 1     | block  |
+| MEDIUM   | 2     | info   |
+| LOW      | 0     | note   |
+
+Verdict: BLOCK — HIGH issues must be fixed before merge.
+```
+
+## Approval Criteria
+
+- **Approve**: No CRITICAL or HIGH issues
+- **Block**: Any CRITICAL or HIGH issues — must fix before merge
+
+Refer to the `flutter-dart-code-review` skill for the comprehensive review checklist.

package/.clinerules/flutter-test.md

@@ -0,0 +1,144 @@
+---
+description: Run Flutter/Dart tests, report failures, and incrementally fix test issues. Covers unit, widget, golden, and integration tests.
+---
+
+# Flutter Test
+
+This command runs the Flutter test suite and reports results. When failures occur, it diagnoses and fixes issues incrementally.
+
+## What This Command Does
+
+1. **Run Tests**: Execute `flutter test` (or scope to changed files)
+2. **Parse Failures**: Identify failing tests by type and cause
+3. **Fix Incrementally**: One failure at a time where possible
+4. **Verify**: Re-run after each fix
+5. **Report**: Show coverage summary and remaining failures
+
+## When to Use
+
+Use `/flutter-test` when:
+- After implementing a feature to verify nothing broke
+- After running `/flutter-build` to ensure tests pass
+- To check test coverage on new code
+- When a specific test file is failing
+- Before submitting a PR
+
+## Commands Run
+
+```bash
+# Run all tests
+flutter test 2>&1
+
+# Run with coverage
+flutter test --coverage 2>&1
+
+# Run specific test file
+flutter test test/unit/domain/usecases/get_user_test.dart 2>&1
+
+# Run tests matching a name pattern
+flutter test --name "CartBloc" 2>&1
+
+# Run integration tests (requires device/emulator)
+flutter test integration_test/ 2>&1
+
+# Update golden files when intentional visual changes are made
+flutter test --update-goldens 2>&1
+```
+
+## Example Session
+
+````text
+User: /flutter-test
+
+Agent:
+# Flutter Test Run
+
+## Test Execution
+
+```
+$ flutter test
+00:05 +42 -2: Some tests failed.
+
+FAILED: test/unit/data/user_repository_test.dart
+  UserRepository getById
+    returns null when user not found
+    Expected: null
+    Actual: User(id: 'test-id', name: 'Test User')
+
+FAILED: test/widget/cart_page_test.dart
+  CartPage
+    shows empty state when cart is empty
+    Expected: exactly one widget with text 'Your cart is empty'
+    Found: no widget with text 'Your cart is empty'
+```
+
+## Fix 1: Repository Test
+
+File: test/unit/data/user_repository_test.dart
+Failure: `getById` returns a user when it should return null for missing ID
+
+Root cause: Test setup adds a user with ID 'test-id' but queries with 'missing-id'.
+Fix: Updated test to query with 'missing-id' — setup was correct, query was wrong.
+
+```
+$ flutter test test/unit/data/user_repository_test.dart
+1 test passed.
+```
+
+## Fix 2: Widget Test
+
+File: test/widget/cart_page_test.dart
+Failure: Empty state text widget not found
+
+Root cause: Empty state message was renamed from 'Your cart is empty' to 'Cart is empty' in the widget.
+Fix: Updated test string to match current widget copy.
+
+```
+$ flutter test test/widget/cart_page_test.dart
+1 test passed.
+```
+
+## Final Run
+
+```
+$ flutter test --coverage
+All 44 tests passed.
+Coverage: 84.2% (target: 80%)
+```
+
+## Summary
+
+| Metric | Value |
+|--------|-------|
+| Total tests | 44 |
+| Passed | 44 |
+| Failed | 0 |
+| Coverage | 84.2% |
+
+Test Status: PASS ✓
+````
+
+## Common Test Failures
+
+| Failure | Typical Fix |
+|---------|-------------|
+| `Expected: <X> Actual: <Y>` | Update assertion or fix implementation |
+| `Widget not found` | Fix finder selector or update test after widget rename |
+| `Golden file not found` | Run `flutter test --update-goldens` to generate |
+| `Golden mismatch` | Inspect diff; run `--update-goldens` if change was intentional |
+| `MissingPluginException` | Mock platform channel in test setup |
+| `LateInitializationError` | Initialize `late` fields in `setUp()` |
+| `pumpAndSettle timed out` | Replace with explicit `pump(Duration)` calls |
+
+## Related Commands
+
+- `/flutter-build` — Fix build errors before running tests
+- `/flutter-review` — Review code after tests pass
+- `/tdd` — Test-driven development workflow
+
+## Related
+
+- Agent: `agents/flutter-reviewer.md`
+- Agent: `agents/dart-build-resolver.md`
+- Skill: `skills/flutter-dart-code-review/`
+- Rules: `rules/dart/testing.md`

package/.clinerules/gan-build.md

@@ -0,0 +1,104 @@
+---
+description: GAN harness — generator/evaluator build loop for autonomous feature implementation
+argument-hint: "<spec>"
+---
+
+Parse the following from $ARGUMENTS:
+1. `brief` — the user's one-line description of what to build
+2. `--max-iterations N` — (optional, default 15) maximum generator-evaluator cycles
+3. `--pass-threshold N` — (optional, default 7.0) weighted score to pass
+4. `--skip-planner` — (optional) skip planner, assume spec.md already exists
+5. `--eval-mode MODE` — (optional, default "playwright") one of: playwright, screenshot, code-only
+
+## GAN-Style Harness Build
+
+This command orchestrates a three-agent build loop inspired by Anthropic's March 2026 harness design paper.
+
+### Phase 0: Setup
+1. Create `gan-harness/` directory in project root
+2. Create subdirectories: `gan-harness/feedback/`, `gan-harness/screenshots/`
+3. Initialize git if not already initialized
+4. Log start time and configuration
+
+### Phase 1: Planning (Planner Agent)
+Unless `--skip-planner` is set:
+1. Launch the `gan-planner` agent via Task tool with the user's brief
+2. Wait for it to produce `gan-harness/spec.md` and `gan-harness/eval-rubric.md`
+3. Display the spec summary to the user
+4. Proceed to Phase 2
+
+### Phase 2: Generator-Evaluator Loop
+```
+iteration = 1
+while iteration <= max_iterations:
+
+    # GENERATE
+    Launch gan-generator agent via Task tool:
+    - Read spec.md
+    - If iteration > 1: read feedback/feedback-{iteration-1}.md
+    - Build/improve the application
+    - Ensure dev server is running
+    - Commit changes
+
+    # Wait for generator to finish
+
+    # EVALUATE
+    Launch gan-evaluator agent via Task tool:
+    - Read eval-rubric.md and spec.md
+    - Test the live application (mode: playwright/screenshot/code-only)
+    - Score against rubric
+    - Write feedback to feedback/feedback-{iteration}.md
+
+    # Wait for evaluator to finish
+
+    # CHECK SCORE
+    Read feedback/feedback-{iteration}.md
+    Extract weighted total score
+
+    if score >= pass_threshold:
+        Log "PASSED at iteration {iteration} with score {score}"
+        Break
+
+    if iteration >= 3 and score has not improved in last 2 iterations:
+        Log "PLATEAU detected — stopping early"
+        Break
+
+    iteration += 1
+```
+
+### Phase 3: Summary
+1. Read all feedback files
+2. Display final scores and iteration history
+3. Show score progression: `iteration 1: 4.2 → iteration 2: 5.8 → ... → iteration N: 7.5`
+4. List any remaining issues from the final evaluation
+5. Report total time and estimated cost
+
+### Output
+
+```markdown
+## GAN Harness Build Report
+
+**Brief:** [original prompt]
+**Result:** PASS/FAIL
+**Iterations:** N / max
+**Final Score:** X.X / 10
+
+### Score Progression
+| Iter | Design | Originality | Craft | Functionality | Total |
+|------|--------|-------------|-------|---------------|-------|
+| 1 | ... | ... | ... | ... | X.X |
+| 2 | ... | ... | ... | ... | X.X |
+| N | ... | ... | ... | ... | X.X |
+
+### Remaining Issues
+- [Any issues from final evaluation]
+
+### Files Created
+- gan-harness/spec.md
+- gan-harness/eval-rubric.md
+- gan-harness/feedback/feedback-001.md through feedback-NNN.md
+- gan-harness/generator-state.md
+- gan-harness/build-report.md
+```
+
+Write the full report to `gan-harness/build-report.md`.

package/.clinerules/gan-design.md

@@ -0,0 +1,40 @@
+---
+description: GAN harness — expand a one-line prompt into a full product spec
+argument-hint: "<idea>"
+---
+
+Parse the following from $ARGUMENTS:
+1. `brief` — the user's description of the design to create
+2. `--max-iterations N` — (optional, default 10) maximum design-evaluate cycles
+3. `--pass-threshold N` — (optional, default 7.5) weighted score to pass (higher default for design)
+
+## GAN-Style Design Harness
+
+A two-agent loop (Generator + Evaluator) focused on frontend design quality. No planner — the brief IS the spec.
+
+This is the same mode Anthropic used for their frontend design experiments, where they saw creative breakthroughs like the 3D Dutch art museum with CSS perspective and doorway navigation.
+
+### Setup
+1. Create `gan-harness/` directory
+2. Write the brief directly as `gan-harness/spec.md`
+3. Write a design-focused `gan-harness/eval-rubric.md` with extra weight on Design Quality and Originality
+
+### Design-Specific Eval Rubric
+```markdown
+### Design Quality (weight: 0.35)
+### Originality (weight: 0.30)
+### Craft (weight: 0.25)
+### Functionality (weight: 0.10)
+```
+
+Note: Originality weight is higher (0.30 vs 0.20) to push for creative breakthroughs. Functionality weight is lower since design mode focuses on visual quality.
+
+### Loop
+Same as `/project:gan-build` Phase 2, but:
+- Skip the planner
+- Use the design-focused rubric
+- Generator prompt emphasizes visual quality over feature completeness
+- Evaluator prompt emphasizes "would this win a design award?" over "do all features work?"
+
+### Key Difference from gan-build
+The Generator is told: "Your PRIMARY goal is visual excellence. A stunning half-finished app beats a functional ugly one. Push for creative leaps — unusual layouts, custom animations, distinctive color work."