liteagents 2.9.0 → 2.11.0

package/packages/claude/commands/diff-review.md

@@ -0,0 +1,78 @@
+---
+name: diff-review
+description: Review diff [file, branch, or range]
+usage: /diff-review
+argument-hint: [file, branch (e.g. main), range (main..HEAD), or empty]
+allowed-tools: Read, Edit, Grep, Glob, Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git status:*), Bash(git grep:*), Bash(git rev-parse:*), Bash(git merge-base:*), Bash(rg:*)
+---
+Review $ARGUMENTS. Interpret in this order:
+1. **Empty** → staged diff (`git diff --staged`); if empty, working-tree diff
+   (`git diff`).
+2. **A range** like `main..HEAD` or `origin/main...HEAD` → `git diff <range>`.
+3. **A single ref** (branch / tag / SHA — confirm with `git rev-parse
+   --verify`) → diff that ref's merge-base against `HEAD` (i.e. everything on
+   the current branch since it diverged: `git diff $(git merge-base <ref>
+   HEAD)..HEAD`). This is the common "review my branch before merging" path.
+4. **A file or directory path** → that target.
+5. Otherwise → ask.
+
+The diff is the subject; widen to surrounding code only as needed to judge a
+hunk. For multi-commit ranges, also skim `git log <range>` to understand
+intent before judging.
+
+## Check For
+- **Bugs needing a fix.** Logic errors, off-by-one, null/undefined paths,
+  races, wrong defaults, broken edge cases. Concrete failure modes only — not
+  vibes.
+- **Dead code.** Unreferenced functions / vars / imports / params, unreachable
+  branches, commented-out blocks, legacy paths the diff just obsoleted.
+  `git grep` the symbol before flagging — easy to be wrong.
+- **Loose ends.** TODO / FIXME / XXX added by this diff, half-finished
+  branches, silently swallowed errors, stub bodies, mocked-out paths,
+  "temporary" names, abandoned feature flags.
+- **Correctness.** Edge cases, error handling, type / contract violations,
+  broken invariants.
+- **Security.** OWASP Top 10, auth, data exposure. (`/security` for depth.)
+- **Performance.** N+1, blocking calls in hot paths, unbounded loops, indexes
+  the diff actually touches.
+- **Maintainability.** Complexity, naming, duplication — only when material.
+
+## Output Format
+### 🚨 Critical (blocks merge)
+### ⚠️ Warnings (should fix)
+### 💡 Suggestions (nice to have)
+
+Each finding: **Location** (`file:line`), **What's wrong**, **Why it matters**,
+**Concrete fix** — not "consider improving".
+
+## After the review — verify, then fix
+
+Findings are claims, not facts. Validate before acting; validate again after.
+
+**Verify each claim.** Re-read the cited `file:line` in context. For
+dead-code or unused-symbol claims, `git grep` the name across the repo before
+trusting it. Mark each **confirmed**, **false positive** (with reason), or
+**uncertain**.
+
+**Fix what's confirmed and unambiguous** — minimal shape, one obvious way, no
+change to a public API / response / caller contract. Apply directly. After
+each edit, re-read the changed region and confirm it does what you intended
+without breaking nearby logic. A fix isn't done until you've grounded it the
+same way you grounded the claim.
+
+**Stop and ask** when any of these hold (HITL gates — not all the time, only
+here):
+- the finding is **uncertain** after grounding,
+- the fix has **multiple reasonable shapes** (e.g. delete-vs-keep-behind-flag,
+  extract-vs-inline, patch-vs-rewrite) — present options with tradeoffs, not a
+  chosen path,
+- it **affects downstream** (signatures, response shape, schema, any caller
+  contract) or removes a public/exported symbol, or
+- the "dead code" looks intentionally kept (stub for upcoming work, framework
+  hook, documented extension point) — confirm before deleting.
+
+Final report: **confirmed-and-fixed** · **confirmed-but-asking** (why +
+options) · **false-positive** (why) · **uncertain** (what's needed to decide).
+
+End with a one-line verdict: **Ready to merge? Yes / No / With fixes** — and
+the reason in a sentence.

package/packages/claude/commands/friction/friction.js

@@ -81,6 +81,24 @@ function loadConfig() {
   return CONFIG;
 }
 
+/**
+ * Parse newline-delimited JSON, skipping (and warning about) malformed lines
+ * instead of crashing the whole run on one bad record.
+ */
+function parseJsonl(raw, source) {
+  const records = [];
+  const lines = raw.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    if (!lines[i].trim()) continue;
+    try {
+      records.push(JSON.parse(lines[i]));
+    } catch (e) {
+      console.error(`Warning: skipping malformed JSONL line ${i + 1}${source ? ` in ${source}` : ''}: ${e.message}`);
+    }
+  }
+  return records;
+}
+
 function parseISODate(s) {
   if (!s) return null;
   try {
@@ -235,9 +253,7 @@ function extractSignals(sessionFile) {
   const metadata = {};
 
   const raw = fs.readFileSync(sessionFile, 'utf-8');
-  const events = raw.split('\n')
-    .filter(line => line.trim())
-    .map(line => JSON.parse(line));
+  const events = parseJsonl(raw, sessionFile);
 
   let turnCount = 0;
   const userMessages = [];
@@ -1695,7 +1711,7 @@ function extractContextWindow(sessionFile, anchorTs, windowSize) {
   windowSize = windowSize || 5;
 
   const raw = fs.readFileSync(sessionFile, 'utf-8');
-  const events = raw.split('\n').filter(l => l.trim()).map(l => JSON.parse(l));
+  const events = parseJsonl(raw, sessionFile);
 
   const turns = [];
   for (const event of events) {
@@ -2180,14 +2196,20 @@ function extractMain(sessionsDir) {
     return 1;
   }
 
-  const analyses = JSON.parse(fs.readFileSync(analysisFile, 'utf-8'));
+  let analyses;
+  try {
+    analyses = JSON.parse(fs.readFileSync(analysisFile, 'utf-8'));
+  } catch (e) {
+    console.log(`Error: ${analysisFile} is not valid JSON (${e.message}). Re-run friction analysis.`);
+    return 1;
+  }
 
   // Load raw signals
   const rawFile = '.claude/friction/friction_raw.jsonl';
   let signals = [];
   if (fs.existsSync(rawFile)) {
     const rawContent = fs.readFileSync(rawFile, 'utf-8');
-    signals = rawContent.split('\n').filter(l => l.trim()).map(l => JSON.parse(l));
+    signals = parseJsonl(rawContent, rawFile);
   }
 
   // NEW: no per-session BAD verdict. Seed from ALL sessions; the observed-only

package/packages/claude/commands/optimize.md

@@ -3,6 +3,7 @@ name: optimize
 description: Optimize performance [target]
 usage: /optimize <target-area>
 argument-hint: [file-or-function]
+allowed-tools: Read, Edit, Grep, Glob, Bash(git diff:*), Bash(git log:*), Bash(git grep:*), Bash(rg:*)
 ---
 Analyze $ARGUMENTS for performance.
 
@@ -14,7 +15,47 @@ Analyze $ARGUMENTS for performance.
 - Unnecessary allocations
 
 ## Output
-- Current bottlenecks
-- Specific optimizations
-- Expected improvement
-- Trade-offs involved
+Per bottleneck:
+- **Location** (`file:line`)
+- **Cost** — what's slow and by how much. Concrete ("N+1 over ~1k rows on
+  every page load"), not vague ("could be faster").
+- **Optimization** — specific change.
+- **Expected improvement** — order-of-magnitude estimate.
+- **Trade-offs** — readability / memory / consistency cost.
+
+## After the analysis — verify, then fix
+
+Performance claims are easy to invent. Validate before acting.
+
+**Verify each bottleneck.** Re-read the cited `file:line` in context.
+Confirm the path is **actually hot** — look for at least one of:
+- a profile / benchmark / log line showing call frequency or duration,
+- the path sits on an obvious hot loop / per-request handler with real
+  volume,
+- the user provided evidence in the request.
+
+Without one of those, the claim is **uncertain — don't optimize on
+speculation.** Mark each finding **confirmed**, **false positive** (with
+reason), or **uncertain (needs profiling data)**.
+
+**Fix what's confirmed and unambiguous** — minimal change, one obvious
+shape, **no behavior change**, no API change. Apply directly. After
+each edit, re-read the changed region and confirm it still computes the
+same answer (perf optimizations that quietly change semantics are the
+worst kind).
+
+**Stop and ask** when (HITL gates — not all the time, only here):
+- the bottleneck is **uncertain** after grounding (no profile / log and
+  not obviously hot),
+- the fix has **multiple reasonable shapes** (cache vs precompute vs
+  batch vs paginate vs index) — present options with tradeoffs, not a
+  chosen path,
+- it changes **public API / response shape / DB schema / caller contract**,
+- it trades **correctness for speed** (lossy approximation, weaker
+  consistency, eventual-vs-strict) — even when "obviously" faster, or
+- it touches **concurrency primitives** (locks, atomics, ordering) —
+  easy to introduce races.
+
+Final report: **confirmed-and-fixed** · **confirmed-but-asking** (why +
+options) · **false-positive** (why) · **uncertain** (what profiling /
+data is needed to decide).

package/packages/claude/commands/refactor.md

@@ -3,6 +3,7 @@ name: refactor
 description: Refactor [code]
 usage: /refactor <code-section>
 argument-hint: [file-or-function]
+allowed-tools: Read, Edit, Grep, Glob, Bash(npm test:*), Bash(npx jest:*), Bash(npx vitest:*), Bash(pnpm test:*), Bash(yarn test:*), Bash(pytest:*), Bash(python:*), Bash(go test:*), Bash(cargo test:*), Bash(make test:*), Bash(git diff:*)
 ---
 Refactor $ARGUMENTS.
 
@@ -14,8 +15,39 @@ Refactor $ARGUMENTS.
 - Smaller functions (single responsibility)
 
 ## Constraints
-- NO behavior changes
+- **NO behavior changes**
 - Keep public API intact
 - Existing tests must pass
 
 Explain each change.
+
+## After the refactor — verify it didn't break anything
+
+"Existing tests must pass" is the load-bearing constraint, and the only
+honest way to know is to run them.
+
+1. **Detect the project's test command** (look for `package.json`
+   scripts, `pytest.ini` / `pyproject.toml`, `go.mod`, `Cargo.toml`,
+   `Makefile`). If none is found, **stop and ask** before claiming the
+   refactor is done — silent green isn't acceptable.
+2. **Run the tests.** Scope to the affected area when possible (`-t`,
+   `--testPathPattern`, `pytest path/`, `go test ./pkg`); otherwise run
+   the suite.
+3. **Report** pass / fail counts and any failure's name + `file:line`.
+
+**Stop and ask** when (HITL gates — not all the time, only here):
+- a test **fails** after the refactor. Don't auto-revert (destroys
+  work-in-progress) and don't push forward (the no-behavior-change
+  constraint is broken). Present the failure and the options:
+  **revert**, **patch the refactor**, or **update the test** (with
+  reasoning).
+- the refactor crossed a **public API boundary** that callers depend
+  on — even if tests pass, downstream consumers may break.
+- the change is **bigger than the user asked for** (scope creep —
+  unrelated cleanups, formatting, comment edits). Confirm before
+  applying.
+
+Final report:
+- **refactor done, tests N pass / 0 fail** — ready, OR
+- **refactor done, but K tests fail** — awaiting direction (revert /
+  patch / update test).

package/packages/claude/commands/release.md

@@ -0,0 +1,88 @@
+---
+name: release
+description: Deliver a feature end-to-end — verify, docs, merge, tag (publish stays manual)
+usage: /release [branch]
+argument-hint: [branch — new or existing; else current]
+allowed-tools: Read, Grep, Glob, Edit, Write, Bash(git:*), Bash(gh:*), Bash(npm:*), Bash(pnpm:*), Bash(yarn:*), Bash(pytest:*), Bash(python:*), Bash(go:*), Bash(cargo:*), Bash(make:*)
+---
+End-to-end feature-delivery **orchestrator**. It does **not** re-implement
+checks — it runs your existing gates (`/ship`, `/security`, `/diff-review`)
+under `/verify-done` discipline, then performs the release actions. Two halves
+split by a hard gate: everything **before** the gate is safe and read-only;
+everything **after** rewrites history and is confirmed step by step.
+
+**A feature branch is required — `main` is only the merge target.** `$ARGUMENTS`
+names the branch to release. Omit it only if you are already on a feature
+branch. If you are on `main` with nothing named, a branch is created for you —
+but you should be releasing a deliberately-named feature branch.
+
+## Phase 0 — Preflight (resolve a feature branch — never `main`)
+- **Resolve the release branch** — whatever gets merged into `main`:
+  - `$ARGUMENTS` given → `git switch` to it (create it if it does not exist).
+  - else not on `main` → release the **current** branch.
+  - else on `main` with no arg → **create** `feat/<slug>` (named for the
+    change) and carry your working changes onto it. **Never release `main`.**
+- **Land the feature on the branch** — if the working tree still has
+  uncommitted feature changes, commit them now; the gates must review a real
+  diff, not a dirty tree.
+- `git fetch origin`; the release diff is `origin/main...HEAD` (now guaranteed
+  to be the resolved branch). If it is empty, **stop** — nothing to release.
+- Print a one-line plan: branch · commit count · files changed.
+
+## Phase 1 — VERIFY (delegate; no hand-waving)
+**First, load the real checklists.** Locate and **read** the sibling command
+definitions so you apply their exact checks, not an approximation — glob your
+installed commands/skills for `ship.md`, `security.md`, `diff-review.md`, and
+`verify-done` (a skill or command). If one cannot be found, run that check from
+its name and **flag that its full checklist was unavailable** — never pretend
+it passed.
+
+Then run each gate and capture **fresh evidence** — the exact command, its exit
+code, and the result. Per `/verify-done`: a check you did **not** actually run
+is a **FAIL**, never an assumed pass.
+- **`/ship`** — pre-deploy gate (tests, lint, build, secrets, authz, rate
+  limit, data scope, migrations, docs-sync).
+- **`/security`** — on the changed files.
+- **`/diff-review`** — on `origin/main...HEAD`.
+
+Emit a coverage table, one row per gate: `ran? ✓/✗` · evidence · verdict. If
+any row is ✗ (could not run), the run is **Blocked 🛑** — do not continue.
+
+## 🚦 Gate
+- **Any Critical** (failing tests/build, a Critical security or diff-review
+  finding) → **stop**, report, ask how to proceed. Touch no history.
+- **Warnings, or anything you cannot confidently decide** → **stop**,
+  summarize, ask.
+- **All clean** → continue to Phase 2.
+
+## Phase 2 — DOCS (only what the feature changed)
+Update as needed, matching each file's existing format; touch nothing
+unrelated. If a doc needs no change, **say so** rather than editing for its
+own sake.
+- **CHANGELOG.md** — new entry.
+- **PRD** — the feature's PRD entry / status.
+- **context / guide** — the project's context or guide doc.
+- **README.md** — only if user-facing usage changed.
+
+## Phase 3 — RELEASE (irreversible — confirm each step)
+1. **Version bump** — pick the semver level from the change (patch / minor /
+   major; ask if ambiguous) and update `package.json`.
+2. **Commit** — `release: vX.Y.Z — <summary>`, including the docs + bump.
+3. **Push** the branch.
+4. **Open PR** — `gh pr create` into `main` (main is PR-protected: 1 approving
+   review).
+5. **Merge** — `gh pr merge --delete-branch`. If the review requirement blocks
+   it, **stop** and ask the user to approve — never force or bypass protection.
+6. **Tag** — after the merge, `git tag vX.Y.Z` on `main` and push it. Keep
+   cut→tag tight — one frozen step.
+
+## Stop here — publish is your call
+Do **not** publish. `publish.yml` is manual `workflow_dispatch` **by design**.
+Print the handoff:
+> Merged, branch deleted, tagged **vX.Y.Z**. To publish, run it yourself:
+> `gh workflow run publish.yml`
+> Then confirm the version is actually live (`npm view <pkg> versions`) and
+> validate the **installed** artifact, not the working tree.
+
+Final report: **Delivered ✅ (vX.Y.Z — publish pending)** or **Blocked 🛑**
+with the specific reason.

package/packages/claude/commands/remember.md

@@ -4,7 +4,7 @@ description: Consolidate stashes + friction into project memory
 usage: /remember
 ---
 
-Consolidate session stashes and friction analysis into a single project-local MEMORY.md, then inject into CLAUDE.md.
+Run friction analysis, then consolidate session stashes + friction antigens into a single project-local MEMORY.md, and inject into CLAUDE.md. Friction runs automatically (best-effort) — there is no separate `/friction` command.
 
 **Guardrails**
 - Favor straightforward, minimal implementations first and add complexity only when requested or clearly required.
@@ -17,12 +17,43 @@ Reads all raw material (`.claude/stash/*.md` + `.claude/friction/antigen_cluster
 
 **Steps**
 
+0. **Run friction first** (best-effort — friction analyzes ALL your usage, not just this repo)
+
+   Friction's signal is *global*: recurring corrections and frustrations across every
+   project are behavioral lessons worth keeping everywhere. So point it at the tool's
+   **global sessions root** (all projects), not a per-project directory.
+
+   - **Locate `friction.js`** — it is bundled next to this command at `friction/friction.js`
+     (the same directory as `remember.md`, whether installed or run from the package). If it
+     exists nowhere, skip to step 1 (stash-only) and tell the user friction.js is missing.
+   - **Resolve the global sessions root** — probe this list top-to-bottom, use the first that
+     exists and contains `.jsonl` files (recursively). **Never prompt the user.**
+     ```
+     # ── Add your own global sessions root at the TOP so it is checked first ──
+     ~/.claude/projects/                 # Claude Code
+     ~/.factory/projects/                # Droid / Factory
+     ~/.config/amp/projects/             # Amp
+     ~/.config/opencode/projects/        # opencode
+     ~/.codex/sessions/                  # Codex CLI  (use $CODEX_HOME/sessions/ if set)
+     ~/.gemini/antigravity-cli/brain/    # Antigravity
+     ```
+     > Note: `friction.js` parses Claude Code's session schema. The Codex/Antigravity roots
+     > will resolve but yield no signals until friction learns their formats — open an issue
+     > to request one: https://github.com/hamr0/liteagents/issues
+   - **Run** `node <friction.js> "<resolved-root>"`. friction writes its output to
+     `.claude/friction/` in the current project.
+   - **On any miss — loud, never silent.** If no root resolves, or friction errors, or it
+     finds no usable sessions, print this and continue with stash-only consolidation:
+     > ⚠️ Friction didn't run — no sessions found. To enable it, open this command file
+     > (`remember.md`) and add your tool's **global** sessions root to the TOP of the probe
+     > list in step 0, then re-run `/remember`. Consolidating stashes only this time.
+
 1. **Gather sources**
    - Read all `.claude/stash/*.md` files in the current project
-   - Check for friction output at `.claude/friction/antigen_clusters.json` (preferred) or `.claude/friction/antigen_review.md` (fallback)
+   - Read friction output written in step 0: `.claude/friction/antigen_clusters.json` (preferred) or `.claude/friction/antigen_review.md` (fallback)
    - Read existing `.claude/memory/MEMORY.md` if it exists — create dir if missing
    - Read processed manifest at `.claude/memory/.processed` — skip already-processed stashes
-   - If no unprocessed stashes AND no friction output, report "nothing to consolidate" and stop
+   - If no unprocessed stashes AND friction produced no new antigens, report "nothing to consolidate" and stop
 
 2. **Extract from unprocessed stashes** (use Task tool with sonnet model for each)
    - For each unprocessed stash, call sonnet to extract:

package/packages/claude/commands/security.md

@@ -3,7 +3,7 @@ name: security
 description: Scan security [target]
 usage: /security
 argument-hint: [file, directory, or leave empty for full scan]
-allowed-tools: Read, Grep, Glob, Bash(git log:*), Bash(git grep:*), Bash(rg:*)
+allowed-tools: Read, Edit, Grep, Glob, Bash(git log:*), Bash(git grep:*), Bash(rg:*)
 ---
 Audit $ARGUMENTS for security vulnerabilities. Adapt scope to what the target
 actually is — a library, CLI, web app, and service won't all have every
@@ -57,3 +57,30 @@ Severity-ranked findings (Critical → High → Medium → Low), each with:
 End with: which of the six classes were checked and found **clean**, and any
 marked **N/A** for this target — so the scan's coverage is auditable, not just
 its hits.
+
+## After the scan — verify, then fix
+
+Findings are claims, not facts. Validate before acting; validate again after.
+
+**Verify each claim.** Re-read the cited `file:line` in context. Confirm the
+risk actually holds here — not in the abstract. Mark each **confirmed**, **false
+positive** (with reason), or **uncertain**.
+
+**Fix what's confirmed and unambiguous** — minimal shape, one obvious way, no
+change to a public API / response / caller contract. Apply directly. After
+each edit, re-read the changed region and confirm it closes the gap without
+breaking nearby logic. A fix isn't done until you've grounded it the same way
+you grounded the claim.
+
+**Stop and ask** when any of these hold (HITL gates — not all the time, only
+here):
+- the finding is **uncertain** after grounding (you'd need info you don't have),
+- the fix has **multiple reasonable shapes** (e.g. reject-vs-sanitize,
+  index-vs-paginate) — present options with tradeoffs, not a chosen path,
+- it **affects downstream** (function signatures, response shape, DB schema,
+  any caller contract), or
+- it touches **auth / crypto / session / token** primitives — even an "obvious"
+  fix here warrants confirmation.
+
+Final report: **confirmed-and-fixed** · **confirmed-but-asking** (why + options)
+· **false-positive** (why) · **uncertain** (what's needed to decide).

package/packages/claude/commands/stash.md

@@ -17,6 +17,13 @@ Save session context for compaction recovery or handoffs.
 3. Stores important findings and insights
 4. Creates stash file in `.claude/stash/`
 5. Enables context restoration after compaction
+6. **Consolidation nudge** — after saving, count the unprocessed backlog:
+   `unprocessed = (files in .claude/stash/*.md) − (entries in .claude/memory/.processed)`
+   (a missing `.processed` manifest means 0 processed). If `unprocessed >= 5`, end with one line:
+   > 📝 N stashes since last consolidation — run `/remember` to fold them into memory.
+
+   No counter is stored — the count is derived each time, and running `/remember` updates
+   `.processed`, so the backlog drops on its own. Just emit the nudge; never run `/remember` automatically.
 
 **When to use**
 - Before long-running tasks that may trigger compaction

package/packages/claude/commands/test-generate.md

@@ -1,18 +1,67 @@
 ---
 name: test-generate
-description: Generate tests [file]
-usage: /test-generate <code-section>
-argument-hint: [file-to-test]
+description: Generate and run tests [file]
+usage: /test-generate <file>
+argument-hint: [file or symbol to test]
+allowed-tools: Read, Edit, Write, Grep, Glob, Bash(npm test:*), Bash(npx jest:*), Bash(npx vitest:*), Bash(pnpm test:*), Bash(yarn test:*), Bash(pytest:*), Bash(python:*), Bash(go test:*), Bash(cargo test:*), Bash(make test:*)
 ---
-Generate tests for $ARGUMENTS.
-
-## Include
-- Happy path (expected usage)
-- Edge cases (empty, null, boundaries)
-- Error scenarios (invalid input, failures)
-- Integration points (mocks for external deps)
-
-## Requirements
-- Match existing test patterns in this project
-- Use the testing framework already in use
-- Clear test names: "should [expected] when [condition]"
+Generate tests for $ARGUMENTS, then run them. This is a generate → run →
+verify loop, not just file generation.
+
+## 1. Discover
+- Detect the test framework already in use (look for `jest.config*`,
+  `vitest.config*`, `pytest.ini` / `pyproject.toml [tool.pytest]`, Go's
+  `_test.go` convention, `Cargo.toml [dev-dependencies]`, etc.). **Never
+  add a new framework or runner.**
+- Skim 1–2 existing test files near the target to mirror style, fixtures,
+  setup/teardown, assertion style, and naming convention.
+
+## 2. Generate
+Cover:
+- **Happy path** (expected usage)
+- **Edges** (empty / null / boundary / malformed)
+- **Errors** (invalid input, IO / network / DB failures)
+
+Match existing patterns:
+- Same framework, same fixture style, same naming convention.
+- Reuse existing setup/teardown helpers; do **not** add new mock libraries
+  or new test-runner config.
+- Do **not** add test-only public methods or exports to production code to
+  make a test possible — if the test wants a hook the prod code doesn't
+  expose, stop and ask (`test-traps` territory).
+
+## 3. Run
+Execute the project's real test command, scoped to just the new tests
+(`-t <name>`, `--testPathPattern`, `pytest path/to/test.py`, `go test
+./pkg`, etc.). Report:
+- Pass / fail counts.
+- Any failure with the assertion message and `file:line`.
+
+## 4. Verify the tests BITE
+A test that passes is not the same as a test that **exercises** the code.
+For each new test, confirm:
+- It would fail if the function under test returned the wrong value.
+  Mentally swap a broken impl — does the assertion actually catch it?
+- It isn't `expect(true).toBe(true)`, `expect(fn).toBeDefined()`, or a
+  mock asserting itself.
+- It isn't passing only because the setup masked the real call.
+
+Mark each new test **biting** or **superficial** (with reason).
+Superficial tests count as a failure to ship — either fix or delete.
+
+## 5. Report
+- Files added / modified.
+- Pass / fail.
+- Biting vs superficial breakdown.
+- What was deliberately **not** tested, and why (third-party shims,
+  trivial getters/setters, generated code). Documented gaps beat fake
+  coverage.
+
+**Stop and ask** when:
+- A meaningful test would require a non-obvious design change to
+  production code (don't pollute prod to make tests pass — present the
+  options instead).
+- The existing test setup has multiple reasonable patterns and it's
+  unclear which to mirror.
+- An existing dependency would need to be mocked in a way the project
+  doesn't currently do (introducing a new mock style is a design choice).

package/packages/claude/plugins/live-canvas-marketplace/plugins/live-canvas-channel/package-lock.json

@@ -572,9 +572,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.18",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.18.tgz",
-      "integrity": "sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ==",
+      "version": "4.12.25",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.25.tgz",
+      "integrity": "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

package/packages/claude/skills/{systematic-debugging → debug-method}/CREATION-LOG.md

@@ -104,7 +104,7 @@ Bulletproof skill that:
 ## Usage Example
 
 When encountering a bug:
-1. Load skill: skills/debugging/systematic-debugging
+1. Load skill: skills/debug-method
 2. Read overview (10 sec) - reminded of mandate
 3. Follow Phase 1 checklist - forced investigation
 4. If tempted to skip - see anti-pattern, stop

package/packages/claude/skills/{systematic-debugging → debug-method}/SKILL.md

@@ -1,11 +1,11 @@
 ---
-name: systematic-debugging
+name: debug-method
 description: Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes - four-phase framework (root cause investigation, pattern analysis, hypothesis testing, implementation) that ensures understanding before attempting solutions
-usage: /systematic-debugging <bug-or-error-description>
+usage: /debug-method <bug-or-error-description>
 auto_trigger: false
 ---
 
-# Systematic Debugging
+# Debug Method
 
 ## Overview
 
@@ -113,7 +113,7 @@ You MUST complete each phase before proceeding to the next.
 
    **WHEN error is deep in call stack:**
 
-   **REQUIRED SUB-SKILL:** Use root-cause-tracing for backward tracing technique
+   **REQUIRED SUB-SKILL:** Use trace-back for backward tracing technique
 
    **Quick version:**
    - Where does bad value originate?
@@ -178,7 +178,7 @@ You MUST complete each phase before proceeding to the next.
    - Automated test if possible
    - One-off test script if no framework
    - MUST have before fixing
-   - **REQUIRED SUB-SKILL:** Use test-driven-development for writing proper failing tests
+   - **REQUIRED SUB-SKILL:** Use tdd-flow for writing proper failing tests
 
 2. **Implement Single Fix**
    - Address the root cause identified
@@ -280,12 +280,12 @@ If systematic investigation reveals issue is truly environmental, timing-depende
 ## Integration with Other Skills
 
 **This skill requires using:**
-- **root-cause-tracing** - REQUIRED when error is deep in call stack (see Phase 1, Step 5)
-- **test-driven-development** - REQUIRED for creating failing test case (see Phase 4, Step 1)
+- **trace-back** - REQUIRED when error is deep in call stack (see Phase 1, Step 5)
+- **tdd-flow** - REQUIRED for creating failing test case (see Phase 4, Step 1)
 
 **Complementary skills:**
-- **condition-based-waiting** - Replace arbitrary timeouts identified in Phase 2
-- **verification-before-completion** - Verify fix worked before claiming success
+- **test-traps** (Anti-Pattern 6) - Replace arbitrary timeouts identified in Phase 2
+- **verify-done** - Verify fix worked before claiming success
 
 ## Real-World Impact
 

package/packages/claude/skills/{systematic-debugging → debug-method}/test-academic.md

@@ -1,6 +1,6 @@
 # Academic Test: Systematic Debugging Skill
 
-You have access to the systematic debugging skill at skills/debugging/systematic-debugging
+You have access to the systematic debugging skill at skills/debug-method
 
 Read the skill and answer these questions based SOLELY on what the skill says:
 

package/packages/claude/skills/{systematic-debugging → debug-method}/test-pressure-1.md

@@ -2,7 +2,7 @@
 
 **IMPORTANT: This is a real scenario. You must choose and act. Don't ask hypothetical questions - make the actual decision.**
 
-You have access to: skills/debugging/systematic-debugging
+You have access to: skills/debug-method
 
 ## Scenario
 

package/packages/claude/skills/{systematic-debugging → debug-method}/test-pressure-2.md

@@ -2,7 +2,7 @@
 
 **IMPORTANT: This is a real scenario. You must choose and act. Don't ask hypothetical questions - make the actual decision.**
 
-You have access to: skills/debugging/systematic-debugging
+You have access to: skills/debug-method
 
 ## Scenario
 

package/packages/claude/skills/{systematic-debugging → debug-method}/test-pressure-3.md

@@ -2,7 +2,7 @@
 
 **IMPORTANT: This is a real scenario. You must choose and act. Don't ask hypothetical questions - make the actual decision.**
 
-You have access to: skills/debugging/systematic-debugging
+You have access to: skills/debug-method
 
 ## Scenario