memory-journal-mcp 8.0.1 → 9.1.0

package/skills/redis/SKILL.md

@@ -1,31 +0,0 @@
----
-name: redis
-description: |
-  Redis best practices. Use when configuring caching strategies, connection pooling, handling TTLs (Time-To-Live), or managing Redis data structures (Hash, Set, List) in Node/TypeScript projects. MUST-ASK: Require explicit database engine name before triggering. Never guess. Do NOT use for generic "set up a database" or "create a DB" requests without clarifying.
----
-
-# Redis Best Practices
-
-Standards for deploying and using Redis as a cache or key-value store.
-
-## 1. Connection Management
-
-- **Connection Pooling**: Use a persistent connection object across your application. Do not create a new Redis client on every request.
-- **Timeouts & Reconnects**: Always configure `connectTimeout` and strict reconnect strategies. Redis can drop connections under load; your app must handle retries gracefully without stalling.
-
-## 2. Caching Strategies
-
-- **Cache-Aside Pattern**: Read from cache; if miss, read from DB and write to cache with a TTL.
-- **Thundering Herd**: Use brief locks (distributed locking) or stale-while-revalidate patterns for heavily accessed keys that expire, to prevent database spikes.
-- **TTL (Time-To-Live)**: ALWAYS attach a TTL to cache keys unless the key is definitively a permanent config value. Use staggered TTLs (e.g., base TTL + random jitter) to avoid mass expirations.
-
-## 3. Data Structures
-
-- **Hashes (HSET/HGET)**: Use Hashes to store objects instead of stringified JSON when you need to update or read individual fields.
-- **Sets (SADD/SMEMBERS)**: Use Sets for unique collections (e.g., user IDs online) and quick membership checks.
-- **Pipelines**: Use `MULTI`/`EXEC` or Pipelines to batch commands together and save network round trips.
-
-## 4. Security
-
-- Never expose the Redis port (`6379`) to the public internet. Ensure it is accessible only within a VPC or private network.
-- Use TLS (`rediss://`) and authentication for managed instances (e.g., AWS ElastiCache, Render Redis).

package/skills/render/SKILL.md

@@ -1,35 +0,0 @@
----
-name: render
-description: |
-  Render platform deployment and management best practices. Use when configuring render.yaml (Blueprint specs), deploying web services, background workers, cron jobs, or managing Render PostgreSQL/Redis instances. NOT for AWS, GCP, Azure, or generic container orchestration. Do NOT trigger for generic "deploy my app" requests without clarifying the target platform. SECURITY: Handle deployment failures explicitly. Never hardcode secrets; always use Render environment groups.
----
-
-# Render Deployment Best Practices
-
-Guidelines for managing infrastructure and deploying applications on the Render platform.
-
-## 1. Infrastructure as Code (render.yaml)
-
-- **Blueprints**: Always use Render Blueprints (`render.yaml`) to define your infrastructure. This enables GitOps, ensures reproducibility, and prevents configuration drift in the dashboard.
-- **Sync Environments**: Define multiple environments (e.g., staging, production) using environment-specific branches and `render.yaml` configurations.
-
-## 2. Web Services & Background Workers
-
-- **Health Checks**: Always define a `healthCheckPath` in `render.yaml`. Render uses this to ensure zero-downtime deployments. If the health check fails, the new deploy is aborted and the old version remains live.
-- **Start Commands**: Ensure your start command starts a production-ready web server (e.g., `gunicorn`, `pm2`, or Node.js `server.js`). Do not use development servers (e.g., `npm run dev`, `flask run`) in production.
-- **Background Workers**: Separate long-running tasks into Background Workers. Background Workers do not have exposed HTTP ports and won't be killed for failing to bind to a port (unlike Web Services).
-
-## 3. Databases (PostgreSQL & Redis)
-
-- **Internal Connections**: Always connect Web Services to Databases using the **Internal Database URL**. This traffic stays within Render's private network, which is faster and vastly more secure.
-- **External Access**: Restrict external database access. If you must connect externally (e.g., for local debugging), use the Access Control list to whitelist specific IP addresses rather than allowing `0.0.0.0/0`.
-- **Migrations**: Execute database migrations using the `preDeployCommand`. This runs before the new code goes live, ensuring the schema is ready for the new application version.
-
-## 4. Environment Variables & Secrets
-
-- **Secret Files**: For files like `.env`, use Render's Secret Files feature. Reference them in `render.yaml`.
-- **Env Var Groups**: Group common environment variables (like AWS credentials or API keys used across multiple services) into Environment Groups and link them to services in your Blueprint.
-
-## 5. Disks & Stateful Data
-
-- **Persistent Disks**: Render's ephemeral filesystems are wiped on every deploy. If your application needs to store files locally (e.g., SQLite databases, uploaded images), you MUST attach a Persistent Disk to the service and mount it to the correct path.

package/skills/rust/SKILL.md

@@ -1,76 +0,0 @@
----
-name: rust
-description: |
-  Master production Rust code, lifetimes, and systems programming using a layer-based "meta-cognition" framework. Use whenever writing production Rust code, resolving borrow checker errors (E0382, E0596), designing ownership patterns (Arc, Mutex), or performing crate selection. Do NOT trigger for generic WASM or TS questions unless Rust is the primary focus. Do NOT trigger for generic 'build a server' requests unless the platform/language is explicitly specified.
----
-
-# Rust Development & Meta-Cognition
-
-When solving Rust problems, **do not immediately write code.** Trace through the cognitive layers first to understand the data's lifecycle, ownership, and constraints.
-
-## 🧠 1. The Meta-Cognition Framework (Before You Code)
-
-### Layer 1: Domain Constraints (WHY)
-
-What is the system trying to achieve?
-
-- **Web Service:** Concurrent, async, low-latency (Often uses `axum`, `tokio`, `Arc<Mutex<T>>`).
-- **CLI Tool:** Fast startup, zero overhead, clean exit codes (Often uses `clap`, `anyhow`, strict error formatting).
-- **Embedded / Systems:** No heap allocation (Requires `no_std`, specific hardware limitations).
-
-### Layer 2: Design Choices & Ownership (WHAT)
-
-Ask the core question: **Who should own this data?**
-
-- _Single owner, strictly unique_: Direct value or `Box<T>`.
-- _Single thread, multiple owners_: `Rc<T>` (use `RefCell<T>` for mutation).
-- _Multi-thread, multiple owners_: `Arc<T>` (use `Mutex<T>` or `RwLock<T>` for mutation).
-
-**Why does it need to mutate?** Avoid slapping `mut` everywhere. Prefer returning new values or using tight, scoped mutability.
-
-### Layer 3: Language Mechanics (HOW)
-
-Use the compiler's strictness as a tool, not an obstacle.
-
-- Implement standard traits: `Drop`, `Clone`, `Default`, `Display`, `From`, `TryFrom`.
-- Avoid `unwrap()` or `expect()` in production logic. Propagate errors natively via `?` and `Result`.
-
----
-
-## 🏗️ 2. Core Ecosystem Defaults
-
-Consult [references/ecosystem.md](references/ecosystem.md) for canonical community crates.
-
----
-
-## 🛡️ 3. Solving Borrow Checker Errors
-
-Consult [references/borrow-checker.md](references/borrow-checker.md) for diagnostics and resolution paths for common compiler errors (E0382, E0596, E0499).
-
----
-
-## ⚡ 4. High-Integrity Code Patterns
-
-1. **Avoid Panic-Driven Development**: `clone()` is an acceptable escape hatch during prototyping, but do not scatter it throughout the code. Revisit the lifetime boundaries as soon as it works.
-2. **The Newtype Pattern**: Use tuple structs to prevent invalid state. `struct UserId(u64);` avoids mixing it up with `struct OrderId(u64);`.
-3. **Exhaustive Matching**: Prefer `match` over `if let` when handling Enums or State Machines. The compiler will notify you when a new variant is added, preventing silent bugs.
-4. **Data-Oriented Modeling**: Prefer small, flat structs that compose over deep, object-oriented inheritance hierarchies.
-
----
-
-## 🛠️ 5. Standard Commands
-
-- **Run Application**: `cargo run`
-- **Linting / Idioms**: `cargo clippy -- -D warnings`
-- **Formatting**: `cargo fmt`
-- **Testing**: `cargo test`
-
-**Agent Directive:** When writing or editing Rust code, always invoke `cargo clippy` and `cargo test` dynamically to validate your implementations before concluding your task.
-
----
-
-## 🔒 6. Security & `unsafe` Blocks
-
-Avoid `unsafe` blocks. If you must use `unsafe` for FFI or performance, you MUST thoroughly document the exact safety invariants being upheld inside the block.
-
-Require user confirmation before executing any command with external side effects, including `cargo publish` and registry operations.

package/skills/rust/references/borrow-checker.md

@@ -1,13 +0,0 @@
-# Solving Borrow Checker Errors
-
-When debugging compiler errors, trace **up** from the syntax error to the fundamental design choice.
-
-- **E0382 (Use of moved value):**
-  - _Symptom:_ You are trying to use a value after it was consumed.
-  - _Resolve:_ Does the function actually _need_ ownership? Borrow it instead (`&T`), `clone()` it if lightweight, or wrap in `Arc<T>` if access needs to be shared across threads.
-- **E0596 (Cannot borrow as mutable):**
-  - _Symptom:_ You are mutating something behind an immutable reference `&T`.
-  - _Resolve:_ Change the signature to `&mut T`, or if you must have an immutable interface, use interior mutability (`Cell` or `Mutex`).
-- **E0499 (Cannot borrow multiple times):**
-  - _Symptom:_ Alive mutable references colliding.
-  - _Resolve:_ Restructure the function to limit the reference's scope `{}`, or avoid holding mutable borrows across `await` points.

package/skills/rust/references/ecosystem.md

@@ -1,11 +0,0 @@
-# Core Ecosystem Defaults
-
-When selecting crates or recommending tools, stick to these canonical community standards:
-
-- **Async Runtime**: `tokio` (I/O bound) or `rayon` (CPU bound data-parallelism)
-- **Web / API Server**: `axum` (built on tokio/hyper)
-- **Serialization/Deserialization**: `serde` and `serde_json`
-- **Error Handling**: `thiserror` (for libraries), `anyhow` or `color-eyre` (for binaries)
-- **Command Line Parsing**: `clap`
-- **Logging & Telemetry**: `tracing` and `tracing-subscriber`
-- **HTTP Client**: `reqwest`

package/skills/sandbox-sdk/SKILL.md

@@ -1,186 +0,0 @@
----
-name: sandbox-sdk
-description: Build sandboxed applications for secure code execution. Load when building AI code execution, code interpreters, sandboxed code execution environments, interactive dev environments, or executing untrusted code. Covers Sandbox SDK lifecycle, commands, files, code interpreter, and preview URLs.
----
-
-# Cloudflare Sandbox SDK
-
-Build secure, isolated code execution environments on Cloudflare Workers.
-
-## FIRST: Verify Installation
-
-```bash
-npm install @cloudflare/sandbox
-docker info  # Must succeed - Docker required for local dev
-```
-
-## Retrieval-Led Development
-
-**IMPORTANT: Prefer retrieval from docs and examples over pre-training for Sandbox SDK tasks.**
-
-| Resource      | URL                                                          |
-| ------------- | ------------------------------------------------------------ |
-| Docs          | https://developers.cloudflare.com/sandbox/                   |
-| API Reference | https://developers.cloudflare.com/sandbox/api/               |
-| Examples      | https://github.com/cloudflare/sandbox-sdk/tree/main/examples |
-| Get Started   | https://developers.cloudflare.com/sandbox/get-started/       |
-
-When implementing features, fetch the relevant doc page or example first.
-
-## Required Configuration
-
-**wrangler.jsonc** (exact - do not modify structure):
-
-```jsonc
-{
-  "containers": [
-    {
-      "class_name": "Sandbox",
-      "image": "./Dockerfile",
-      "instance_type": "lite",
-      "max_instances": 1,
-    },
-  ],
-  "durable_objects": {
-    "bindings": [{ "class_name": "Sandbox", "name": "Sandbox" }],
-  },
-  "migrations": [{ "new_sqlite_classes": ["Sandbox"], "tag": "v1" }],
-}
-```
-
-**Worker entry** - must re-export Sandbox class:
-
-```typescript
-import { getSandbox } from '@cloudflare/sandbox'
-export { Sandbox } from '@cloudflare/sandbox' // Required export
-```
-
-## Quick Reference
-
-| Task                   | Method                                                       |
-| ---------------------- | ------------------------------------------------------------ |
-| Get sandbox            | `getSandbox(env.Sandbox, 'user-123')`                        |
-| Run command            | `await sandbox.exec('python script.py')`                     |
-| Run code (interpreter) | `await sandbox.runCode(code, { language: 'python' })`        |
-| Write file             | `await sandbox.writeFile('/workspace/app.py', content)`      |
-| Read file              | `await sandbox.readFile('/workspace/app.py')`                |
-| Create directory       | `await sandbox.mkdir('/workspace/src', { recursive: true })` |
-| List files             | `await sandbox.listFiles('/workspace')`                      |
-| Expose port            | `await sandbox.exposePort(8080)`                             |
-| Destroy                | `await sandbox.destroy()`                                    |
-
-## Core Patterns
-
-### Execute Commands
-
-```typescript
-const sandbox = getSandbox(env.Sandbox, 'user-123')
-const result = await sandbox.exec('python --version')
-// result: { stdout, stderr, exitCode, success }
-```
-
-### Code Interpreter (Recommended for AI)
-
-Use `runCode()` for executing LLM-generated code with rich outputs:
-
-```typescript
-const ctx = await sandbox.createCodeContext({ language: 'python' })
-
-await sandbox.runCode('import pandas as pd; data = [1,2,3]', { context: ctx })
-const result = await sandbox.runCode('sum(data)', { context: ctx })
-// result.results[0].text = "6"
-```
-
-**Languages**: `python`, `javascript`, `typescript`
-
-State persists within context. Create explicit contexts for production.
-
-### File Operations
-
-```typescript
-await sandbox.mkdir('/workspace/project', { recursive: true })
-await sandbox.writeFile('/workspace/project/main.py', code)
-const file = await sandbox.readFile('/workspace/project/main.py')
-const files = await sandbox.listFiles('/workspace/project')
-```
-
-## When to Use What
-
-| Need                    | Use         | Why                             |
-| ----------------------- | ----------- | ------------------------------- |
-| Shell commands, scripts | `exec()`    | Direct control, streaming       |
-| LLM-generated code      | `runCode()` | Rich outputs, state persistence |
-| Build/test pipelines    | `exec()`    | Exit codes, stderr capture      |
-| Data analysis           | `runCode()` | Charts, tables, pandas          |
-
-## Extending the Dockerfile
-
-Base image (`docker.io/cloudflare/sandbox:0.7.0`) includes Python 3.11, Node.js 20, and common tools.
-
-Add dependencies by extending the Dockerfile:
-
-```dockerfile
-FROM docker.io/cloudflare/sandbox:latest
-# Pin to specific version in production: `npx wrangler versions latest sandbox`
-
-# Python packages
-RUN pip install requests beautifulsoup4
-
-# Node packages (global)
-RUN npm install -g typescript
-
-# System packages
-RUN apt-get update && apt-get install -y ffmpeg && rm -rf /var/lib/apt/lists/*
-
-EXPOSE 8080  # Required for local dev port exposure
-```
-
-Keep images lean - affects cold start time.
-
-## Preview URLs (Port Exposure)
-
-Expose HTTP services running in sandboxes:
-
-```typescript
-const { url } = await sandbox.exposePort(8080)
-// Returns preview URL for the service
-```
-
-**Production requirement**: Preview URLs need a custom domain with wildcard DNS (`*.yourdomain.com`). The `.workers.dev` domain does not support preview URL subdomains.
-
-See: https://developers.cloudflare.com/sandbox/guides/expose-services/
-
-## OpenAI Agents SDK Integration
-
-The SDK provides helpers for OpenAI Agents at `@cloudflare/sandbox/openai`:
-
-```typescript
-import { Shell, Editor } from '@cloudflare/sandbox/openai'
-```
-
-See `examples/openai-agents` for complete integration pattern.
-
-## Sandbox Lifecycle
-
-- `getSandbox()` returns immediately - container starts lazily on first operation
-- Containers sleep after 10 minutes of inactivity (configurable via `sleepAfter`)
-- Use `destroy()` to immediately free resources
-- Same `sandboxId` always returns same sandbox instance
-
-## Anti-Patterns
-
-- **Don't use internal clients** (`CommandClient`, `FileClient`) - use `sandbox.*` methods
-- **Don't skip the Sandbox export** - Worker won't deploy without `export { Sandbox }`
-- **Don't hardcode sandbox IDs for multi-user** - use user/session identifiers
-- **Don't forget cleanup** - call `destroy()` for temporary sandboxes
-
-## Detailed References
-
-- **[references/api-quick-ref.md](references/api-quick-ref.md)** - Full API with options and return types
-- **[references/examples.md](references/examples.md)** - Example index with use cases
-
-## Security
-
-- **Command Injection**: Never pass unsanitized user input to `exec()`. EXPLICITLY BANNED: String interpolation (e.g. ``exec(`ls ${userInput}`)``) into exec calls. Prefer `runCode()` with language constraints for LLM-generated code.
-- **Resource Limits**: Implement per-user rate limiting. Set `sleepAfter` to cap idle resource consumption. Always set explicit timeouts on commands (e.g. using `timeout` or the SDK's execution limits).
-- **Allowlists**: Enforce allowlists for binaries/commands when executing untrusted input.

package/skills/sandbox-sdk/references/api-quick-ref.md

@@ -1,113 +0,0 @@
-# Sandbox SDK API Reference
-
-Detailed API for `@cloudflare/sandbox`. For full docs: https://developers.cloudflare.com/sandbox/api/
-
-## Lifecycle
-
-```typescript
-getSandbox(binding: DurableObjectNamespace<Sandbox>, sandboxId: string, options?: SandboxOptions): Sandbox
-
-interface SandboxOptions {
-  sleepAfter?: string;     // Duration before auto-sleep (default: "10m")
-  keepAlive?: boolean;     // Prevent auto-sleep (default: false)
-  normalizeId?: boolean;   // Lowercase IDs for preview URLs (default: false)
-}
-
-await sandbox.destroy(): Promise<void>  // Immediately terminate and delete all state
-```
-
-## Commands
-
-```typescript
-await sandbox.exec(command: string, options?: ExecOptions): Promise<ExecResult>
-
-interface ExecOptions {
-  cwd?: string;           // Working directory
-  env?: Record<string, string>;  // Environment variables
-  timeout?: number;       // Timeout in ms (default: 60000)
-  stdin?: string;         // Input to command
-}
-
-interface ExecResult {
-  stdout: string;
-  stderr: string;
-  exitCode: number;
-  success: boolean;       // exitCode === 0
-}
-```
-
-## Code Interpreter
-
-```typescript
-await sandbox.createCodeContext(options?: CreateContextOptions): Promise<CodeContext>
-
-interface CreateContextOptions {
-  language?: 'python' | 'javascript' | 'typescript';  // default: 'python'
-  cwd?: string;           // Working directory (default: '/workspace')
-  envVars?: Record<string, string>;
-  timeout?: number;       // Request timeout in ms (default: 30000)
-}
-
-await sandbox.runCode(code: string, options?: RunCodeOptions): Promise<ExecutionResult>
-
-interface RunCodeOptions {
-  context?: CodeContext;  // Reuse context for state persistence
-  language?: 'python' | 'javascript' | 'typescript';
-  timeout?: number;       // Execution timeout in ms (default: 60000)
-}
-
-interface ExecutionResult {
-  code: string;
-  logs: { stdout: string[]; stderr: string[] };
-  results: RichOutput[];  // text, html, png, json, etc.
-  error?: { name: string; value: string; traceback: string[] };
-  executionCount: number;
-}
-```
-
-## Files
-
-```typescript
-await sandbox.writeFile(path: string, content: string | Uint8Array): Promise<void>
-await sandbox.readFile(path: string): Promise<{ content: string }>
-await sandbox.mkdir(path: string, options?: { recursive?: boolean }): Promise<void>
-await sandbox.listFiles(path: string): Promise<FileMetadata[]>
-await sandbox.deleteFile(path: string): Promise<void>
-
-interface FileMetadata {
-  name: string;
-  path: string;
-  isDirectory: boolean;
-  size: number;
-  modifiedAt: string;
-}
-```
-
-## Ports
-
-```typescript
-await sandbox.exposePort(port: number): Promise<{ url: string; token: string }>
-await sandbox.unexposePort(port: number): Promise<void>
-await sandbox.listPorts(): Promise<PortInfo[]>
-```
-
-## Error Handling
-
-Errors include context about the operation:
-
-```typescript
-try {
-  await sandbox.exec('invalid-command')
-} catch (error) {
-  // error.message includes command and sandbox context
-}
-```
-
-For `runCode()`, check `result.error` instead of catching:
-
-```typescript
-const result = await sandbox.runCode('1/0', { language: 'python' })
-if (result.error) {
-  console.error(result.error.name) // "ZeroDivisionError"
-}
-```

package/skills/sandbox-sdk/references/examples.md

@@ -1,52 +0,0 @@
-# Sandbox SDK Examples
-
-All examples: https://github.com/cloudflare/sandbox-sdk/tree/main/examples
-
-## Example Index
-
-| Example                | Use Case                          | Key File       |
-| ---------------------- | --------------------------------- | -------------- |
-| `minimal`              | Basic setup, exec, file ops       | `src/index.ts` |
-| `code-interpreter`     | AI code execution with Workers AI | `src/index.ts` |
-| `openai-agents`        | OpenAI Agents SDK integration     | `src/index.ts` |
-| `opencode`             | OpenCode agent integration        | `src/index.ts` |
-| `claude-code`          | Claude Code agent integration     | `src/index.ts` |
-| `typescript-validator` | TypeScript compilation/validation | `src/index.ts` |
-| `authentication`       | Auth patterns for sandboxes       | `src/index.ts` |
-
-## When to Use Which Example
-
-| Building                        | Start With             |
-| ------------------------------- | ---------------------- |
-| AI code execution               | `code-interpreter`     |
-| Agent with shell + file editing | `openai-agents`        |
-| Basic command execution         | `minimal`              |
-| Code validation service         | `typescript-validator` |
-| Multi-user sandboxes            | `authentication`       |
-
-## Common Patterns from Examples
-
-**Sandbox per user/session** (from `openai-agents`):
-
-```typescript
-const sandbox = getSandbox(env.Sandbox, `session-${sessionId}`)
-```
-
-**Code context reuse** (from `code-interpreter`):
-
-```typescript
-const pythonCtx = await sandbox.createCodeContext({ language: 'python' })
-const result = await sandbox.runCode(code, { context: pythonCtx })
-```
-
-**Resource cleanup** (from `code-interpreter`):
-
-```typescript
-try {
-  // ... use sandbox
-} finally {
-  await sandbox.destroy()
-}
-```
-
-Fetch the full example source when implementing similar patterns.

package/skills/shadcn-ui/SKILL.md

@@ -1,37 +0,0 @@
----
-name: shadcn-ui
-description: |
-  Use when adding, customizing, or structuring shadcn/ui components in a project.
-  Also use when dealing with `components.json`, Tailwind configuration for shadcn, or component registries.
-  Use when working with shadcn/ui, `components.json`, `lucide-react`, `radix-ui`, or Tailwind component registries.
----
-
-# shadcn/ui Agent Workflow
-
-When asked to work with shadcn/ui components, follow this imperative workflow to ensure you generate correct code that aligns with the project's configuration.
-
-## 1. Context Gathering
-
-Before generating any code or installing components, you must determine the project's configuration:
-
-- Inspect `components.json` to find the `aliases`, `tailwind` configuration, and the `style` (e.g., `default` or `new-york`).
-- Identify the base library being used (e.g., `lucide-react` or Radix primitives).
-- Check which components are already installed in the `components/ui/` directory.
-
-## 2. Component Installation & Discovery
-
-- **Search first:** If a required component is not installed, search the documentation or registry for it.
-- **Install securely:** To install a component, use the official CLI command `npx shadcn@latest add [component]`.
-- **Registry Security:** Do NOT blindly install components from third-party or untrusted registries (e.g., via URLs) without explicitly reviewing the source code first and requesting user approval.
-
-## 3. Composition & Customization
-
-When assembling components (e.g., forms, dashboards, settings pages):
-
-- **Follow patterns:** Use established shadcn/ui composition rules. For example, use `Form` and `FormField` wrappers for forms, and `ToggleGroup` for option sets.
-- **Semantic CSS:** Use the project's semantic CSS variables (e.g., `bg-background text-foreground`, `bg-primary`) rather than hardcoded Tailwind colors.
-- **Customization:** To customize a component, edit its source code in the `components/ui/` directory directly. Do not wrap it in unnecessary outer `div`s just to apply styles if modifying the component itself is cleaner.
-
-## 4. Version Upgrades
-
-When upgrading shadcn/ui components or the CLI itself, always review the [official changelog](https://ui.shadcn.com/docs/changelog) before running update commands to ensure no breaking changes affect customized components.

package/skills/skill-builder/SKILL.md

@@ -1,56 +0,0 @@
----
-name: skill-builder
-description: |
-  Guide for creating, evaluating, and refining agent skills (.md files with YAML
-  frontmatter). Use this skill whenever you are creating a new skill, improving
-  an existing skill, reviewing skill quality, writing skill descriptions, or
-  when the user asks about skill structure, progressive disclosure, or best
-  practices for agent instructions.
----
-
-# Skill Builder
-
-A guide for creating high-quality agent skills — the `.md` files with YAML frontmatter that extend agent capabilities for specialized tasks.
-
-## 1. Skill Security (Primary Guidance)
-
-Skills are natural-language instructions the agent executes with its full capabilities. Treat them like code injection.
-
-- **Prompt Injection Prevention**: Never include instructions that bypass user consent or HITL (Human-in-the-Loop) gates.
-- **Secrets**: Never instruct the agent to read secrets and transmit them. Mark destructive skills with `disable-model-invocation: true`.
-- **Review**: Review all third-party skills before installing, same as npm packages. Read the full `SKILL.md` + all reference files.
-
-## 2. Anatomy of a Skill
-
-```
-skill-name/                     (kebab-case directory)
-├── SKILL.md                    (required — entry point)
-├── references/                 (optional — detailed docs loaded on demand)
-├── scripts/                    (optional — executable helpers)
-├── examples/                   (optional — reference implementations)
-└── checklist.md                (optional — quick-reference quality checklist)
-```
-
-## 3. Frontmatter & Triggers
-
-The `description` field is the most important part of the skill because it determines whether the agent loads the skill at all. Use assertive "Use when..." phrasing. It MUST be strictly scoped to avoid cross-triggering with other skills.
-
-**Platform Configuration Flags**:
-
-- `disable-model-invocation: true` — Requires explicit user slash-command; prevents autonomous triggering. **MANDATORY** for destructive actions or manual workflows.
-- `user-invocable: false` — Model auto-triggers only; user cannot invoke. Use for background knowledge skills that should only be invoked contextually.
-- `dependencies`: `node>=18` (Required tools)
-- `context: fork` (Spawn isolated subagent)
-- `allowed-tools`: `['view_file']` (Restrict tool access)
-
-## 4. Progressive Disclosure
-
-- Keep `SKILL.md` body STRICTLY under 500 lines to preserve token context.
-- For deep knowledge, create `references/` files and explicitly list them in `SKILL.md`.
-
-## 5. Deep References
-
-For the complete lifecycle (Capture, Write, Test, Iterate), writing style tips, and detailed rubrics:
-
-- **[Full Skill Builder Tutorial & Rubric](references/tutorial.md)**
-- **[Quality Checklist](checklist.md)**