npm - mustflow - Versions diffs - 2.38.0 → 2.58.0 - Mend

mustflow 2.38.0 → 2.58.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (94) hide show

package/templates/default/manifest.toml CHANGED Viewed

@@ -1,6 +1,6 @@
 id = "default"
 name = "default"
-version = "2.38.0"
+version = "2.58.0"
 description = "Minimal workflow for LLM agents to read, edit, and verify their work in a repository."
 common_root = "common"
 locales_root = "locales"
@@ -19,9 +19,54 @@ creates = [
   ".mustflow/skills/architecture-deepening-review/SKILL.md",
   ".mustflow/skills/service-boundary-architecture/SKILL.md",
   ".mustflow/skills/auth-permission-change/SKILL.md",
+  ".mustflow/skills/security-flow-review/SKILL.md",
   ".mustflow/skills/behavior-preserving-refactor/SKILL.md",
   ".mustflow/skills/code-review/SKILL.md",
   ".mustflow/skills/ai-generated-code-hardening/SKILL.md",
+  ".mustflow/skills/module-boundary-review/SKILL.md",
+  ".mustflow/skills/change-blast-radius-review/SKILL.md",
+  ".mustflow/skills/business-rule-leakage-review/SKILL.md",
+  ".mustflow/skills/payment-integrity-review/SKILL.md",
+  ".mustflow/skills/credit-ledger-integrity-review/SKILL.md",
+  ".mustflow/skills/api-misuse-resistance-review/SKILL.md",
+  ".mustflow/skills/api-access-control-review/SKILL.md",
+  ".mustflow/skills/file-upload-security-review/SKILL.md",
+  ".mustflow/skills/error-message-integrity-review/SKILL.md",
+  ".mustflow/skills/memory-lifetime-review/SKILL.md",
+  ".mustflow/skills/desktop-memory-footprint-review/SKILL.md",
+  ".mustflow/skills/hot-path-performance-review/SKILL.md",
+  ".mustflow/skills/api-request-performance-review/SKILL.md",
+  ".mustflow/skills/web-render-performance-review/SKILL.md",
+  ".mustflow/skills/core-web-vitals-field-review/SKILL.md",
+  ".mustflow/skills/image-delivery-performance-review/SKILL.md",
+  ".mustflow/skills/client-bundle-pruning-review/SKILL.md",
+  ".mustflow/skills/frame-render-performance-review/SKILL.md",
+  ".mustflow/skills/app-startup-performance-review/SKILL.md",
+  ".mustflow/skills/desktop-background-process-stability-review/SKILL.md",
+  ".mustflow/skills/desktop-auto-update-safety-review/SKILL.md",
+  ".mustflow/skills/low-end-device-support-review/SKILL.md",
+  ".mustflow/skills/mobile-energy-efficiency-review/SKILL.md",
+  ".mustflow/skills/frontend-state-ownership-review/SKILL.md",
+  ".mustflow/skills/frontend-stress-layout-review/SKILL.md",
+  ".mustflow/skills/frontend-accessibility-tree-review/SKILL.md",
+  ".mustflow/skills/frontend-localization-review/SKILL.md",
+  ".mustflow/skills/cache-integrity-review/SKILL.md",
+  ".mustflow/skills/quadratic-scan-review/SKILL.md",
+  ".mustflow/skills/type-state-modeling-review/SKILL.md",
+  ".mustflow/skills/race-condition-review/SKILL.md",
+  ".mustflow/skills/concurrency-invariant-review/SKILL.md",
+  ".mustflow/skills/failure-integrity-review/SKILL.md",
+  ".mustflow/skills/backend-log-evidence-review/SKILL.md",
+  ".mustflow/skills/observability-debuggability-review/SKILL.md",
+  ".mustflow/skills/incident-triage-review/SKILL.md",
+  ".mustflow/skills/deployment-rollout-safety-review/SKILL.md",
+  ".mustflow/skills/cloud-cost-guardrail-review/SKILL.md",
+  ".mustflow/skills/rate-limit-integrity-review/SKILL.md",
+  ".mustflow/skills/idempotency-integrity-review/SKILL.md",
+  ".mustflow/skills/retry-policy-integrity-review/SKILL.md",
+  ".mustflow/skills/queue-processing-integrity-review/SKILL.md",
+  ".mustflow/skills/transaction-boundary-integrity-review/SKILL.md",
+  ".mustflow/skills/testability-boundary-review/SKILL.md",
   ".mustflow/skills/codebase-orientation/SKILL.md",
   ".mustflow/skills/heuristic-candidate-selection/SKILL.md",
   ".mustflow/skills/clarifying-question-gate/SKILL.md",
@@ -61,6 +106,10 @@ creates = [
   ".mustflow/skills/date-number-audit/SKILL.md",
   ".mustflow/skills/database-change-safety/SKILL.md",
   ".mustflow/skills/database-migration-change/SKILL.md",
+  ".mustflow/skills/database-query-bottleneck-review/SKILL.md",
+  ".mustflow/skills/database-json-modeling-review/SKILL.md",
+  ".mustflow/skills/deletion-lifecycle-review/SKILL.md",
+  ".mustflow/skills/database-lock-contention-review/SKILL.md",
   ".mustflow/skills/sqlite-code-change/SKILL.md",
   ".mustflow/skills/postgresql-code-change/SKILL.md",
   ".mustflow/skills/dependency-injection/SKILL.md",
@@ -76,6 +125,12 @@ creates = [
   ".mustflow/skills/test-maintenance/SKILL.md",
   ".mustflow/skills/vertical-slice-tdd/SKILL.md",
   ".mustflow/skills/llm-service-ux-review/SKILL.md",
+  ".mustflow/skills/prompt-contract-quality-review/SKILL.md",
+  ".mustflow/skills/llm-hallucination-control-review/SKILL.md",
+  ".mustflow/skills/llm-token-cost-control-review/SKILL.md",
+  ".mustflow/skills/llm-response-latency-review/SKILL.md",
+  ".mustflow/skills/agent-execution-control-review/SKILL.md",
+  ".mustflow/skills/agent-eval-integrity-review/SKILL.md",
   ".mustflow/skills/ui-quality-gate/SKILL.md",
   ".mustflow/skills/external-prompt-injection-defense/SKILL.md",
   ".mustflow/skills/external-skill-intake/SKILL.md",
@@ -132,7 +187,8 @@ after_install = [
   "Read AGENTS.md for repository-specific working rules.",
   "Run mf doctor to inspect the current state before editing.",
   "Generate REPO_MAP.md with mf map when a repository map is needed.",
-  "Add your test, lint, and build commands to .mustflow/config/commands.toml.",
+  "Review the default Bun-backed test intents in .mustflow/config/commands.toml and replace them with narrower project commands when useful.",
+  "Add your lint and build commands to .mustflow/config/commands.toml.",
   "Review repository-specific language and style defaults in .mustflow/config/preferences.toml.",
   "Record preferred frameworks, libraries, runtimes, and tools in .mustflow/config/technology.toml when useful.",
   "Confirm that .mustflow/context/PROJECT.md describes the project goals and non-goals.",
@@ -151,9 +207,54 @@ minimal = [
   "backend-reliability-change",
   "http-delivery-streaming",
   "auth-permission-change",
+  "security-flow-review",
   "behavior-preserving-refactor",
   "code-review",
   "ai-generated-code-hardening",
+  "module-boundary-review",
+  "change-blast-radius-review",
+  "business-rule-leakage-review",
+  "payment-integrity-review",
+  "credit-ledger-integrity-review",
+  "api-misuse-resistance-review",
+  "api-access-control-review",
+  "file-upload-security-review",
+  "error-message-integrity-review",
+  "memory-lifetime-review",
+  "desktop-memory-footprint-review",
+  "hot-path-performance-review",
+  "api-request-performance-review",
+  "web-render-performance-review",
+  "core-web-vitals-field-review",
+  "image-delivery-performance-review",
+  "client-bundle-pruning-review",
+  "frame-render-performance-review",
+  "app-startup-performance-review",
+  "desktop-background-process-stability-review",
+  "desktop-auto-update-safety-review",
+  "low-end-device-support-review",
+  "mobile-energy-efficiency-review",
+  "frontend-state-ownership-review",
+  "frontend-stress-layout-review",
+  "frontend-accessibility-tree-review",
+  "frontend-localization-review",
+  "cache-integrity-review",
+  "quadratic-scan-review",
+  "type-state-modeling-review",
+  "race-condition-review",
+  "concurrency-invariant-review",
+  "failure-integrity-review",
+  "backend-log-evidence-review",
+  "observability-debuggability-review",
+  "incident-triage-review",
+  "deployment-rollout-safety-review",
+  "cloud-cost-guardrail-review",
+  "rate-limit-integrity-review",
+  "idempotency-integrity-review",
+  "retry-policy-integrity-review",
+  "queue-processing-integrity-review",
+  "transaction-boundary-integrity-review",
+  "testability-boundary-review",
   "codebase-orientation",
   "heuristic-candidate-selection",
   "clarifying-question-gate",
@@ -188,6 +289,10 @@ minimal = [
   "date-number-audit",
   "database-change-safety",
   "database-migration-change",
+  "database-query-bottleneck-review",
+  "database-json-modeling-review",
+  "deletion-lifecycle-review",
+  "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
   "dependency-reality-check",
@@ -196,6 +301,12 @@ minimal = [
   "diff-risk-review",
   "docs-update",
   "external-prompt-injection-defense",
+  "prompt-contract-quality-review",
+  "llm-hallucination-control-review",
+  "llm-token-cost-control-review",
+  "llm-response-latency-review",
+  "agent-execution-control-review",
+  "agent-eval-integrity-review",
   "failure-triage",
   "file-path-cross-platform-change",
   "idea-triage",
@@ -224,9 +335,54 @@ patterns = [
   "backend-reliability-change",
   "http-delivery-streaming",
   "auth-permission-change",
+  "security-flow-review",
   "behavior-preserving-refactor",
   "code-review",
   "ai-generated-code-hardening",
+  "module-boundary-review",
+  "change-blast-radius-review",
+  "business-rule-leakage-review",
+  "payment-integrity-review",
+  "credit-ledger-integrity-review",
+  "api-misuse-resistance-review",
+  "api-access-control-review",
+  "file-upload-security-review",
+  "error-message-integrity-review",
+  "memory-lifetime-review",
+  "desktop-memory-footprint-review",
+  "hot-path-performance-review",
+  "api-request-performance-review",
+  "web-render-performance-review",
+  "core-web-vitals-field-review",
+  "image-delivery-performance-review",
+  "client-bundle-pruning-review",
+  "frame-render-performance-review",
+  "app-startup-performance-review",
+  "desktop-background-process-stability-review",
+  "desktop-auto-update-safety-review",
+  "low-end-device-support-review",
+  "mobile-energy-efficiency-review",
+  "frontend-state-ownership-review",
+  "frontend-stress-layout-review",
+  "frontend-accessibility-tree-review",
+  "frontend-localization-review",
+  "cache-integrity-review",
+  "quadratic-scan-review",
+  "type-state-modeling-review",
+  "race-condition-review",
+  "concurrency-invariant-review",
+  "failure-integrity-review",
+  "backend-log-evidence-review",
+  "observability-debuggability-review",
+  "incident-triage-review",
+  "deployment-rollout-safety-review",
+  "cloud-cost-guardrail-review",
+  "rate-limit-integrity-review",
+  "idempotency-integrity-review",
+  "retry-policy-integrity-review",
+  "queue-processing-integrity-review",
+  "transaction-boundary-integrity-review",
+  "testability-boundary-review",
   "codebase-orientation",
   "heuristic-candidate-selection",
   "clarifying-question-gate",
@@ -263,6 +419,10 @@ patterns = [
   "date-number-audit",
   "database-change-safety",
   "database-migration-change",
+  "database-query-bottleneck-review",
+  "database-json-modeling-review",
+  "deletion-lifecycle-review",
+  "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
   "dependency-injection",
@@ -272,6 +432,12 @@ patterns = [
   "diff-risk-review",
   "docs-update",
   "external-prompt-injection-defense",
+  "prompt-contract-quality-review",
+  "llm-hallucination-control-review",
+  "llm-token-cost-control-review",
+  "llm-response-latency-review",
+  "agent-execution-control-review",
+  "agent-eval-integrity-review",
   "facade-pattern",
   "failure-triage",
   "file-path-cross-platform-change",
@@ -308,9 +474,54 @@ oss = [
   "architecture-deepening-review",
   "service-boundary-architecture",
   "auth-permission-change",
+  "security-flow-review",
   "behavior-preserving-refactor",
   "code-review",
   "ai-generated-code-hardening",
+  "module-boundary-review",
+  "change-blast-radius-review",
+  "business-rule-leakage-review",
+  "payment-integrity-review",
+  "credit-ledger-integrity-review",
+  "api-misuse-resistance-review",
+  "api-access-control-review",
+  "file-upload-security-review",
+  "error-message-integrity-review",
+  "memory-lifetime-review",
+  "desktop-memory-footprint-review",
+  "hot-path-performance-review",
+  "api-request-performance-review",
+  "web-render-performance-review",
+  "core-web-vitals-field-review",
+  "image-delivery-performance-review",
+  "client-bundle-pruning-review",
+  "frame-render-performance-review",
+  "app-startup-performance-review",
+  "desktop-background-process-stability-review",
+  "desktop-auto-update-safety-review",
+  "low-end-device-support-review",
+  "mobile-energy-efficiency-review",
+  "frontend-state-ownership-review",
+  "frontend-stress-layout-review",
+  "frontend-accessibility-tree-review",
+  "frontend-localization-review",
+  "cache-integrity-review",
+  "quadratic-scan-review",
+  "type-state-modeling-review",
+  "race-condition-review",
+  "concurrency-invariant-review",
+  "failure-integrity-review",
+  "backend-log-evidence-review",
+  "observability-debuggability-review",
+  "incident-triage-review",
+  "deployment-rollout-safety-review",
+  "cloud-cost-guardrail-review",
+  "rate-limit-integrity-review",
+  "idempotency-integrity-review",
+  "retry-policy-integrity-review",
+  "queue-processing-integrity-review",
+  "transaction-boundary-integrity-review",
+  "testability-boundary-review",
   "codebase-orientation",
   "heuristic-candidate-selection",
   "clarifying-question-gate",
@@ -349,6 +560,10 @@ oss = [
   "date-number-audit",
   "database-change-safety",
   "database-migration-change",
+  "database-query-bottleneck-review",
+  "database-json-modeling-review",
+  "deletion-lifecycle-review",
+  "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
   "dependency-injection",
@@ -359,6 +574,12 @@ oss = [
   "docs-prose-review",
   "docs-update",
   "external-prompt-injection-defense",
+  "prompt-contract-quality-review",
+  "llm-hallucination-control-review",
+  "llm-token-cost-control-review",
+  "llm-response-latency-review",
+  "agent-execution-control-review",
+  "agent-eval-integrity-review",
   "external-skill-intake",
   "github-contribution-quality-gate",
   "facade-pattern",
@@ -407,9 +628,54 @@ team = [
   "backend-reliability-change",
   "http-delivery-streaming",
   "auth-permission-change",
+  "security-flow-review",
   "behavior-preserving-refactor",
   "code-review",
   "ai-generated-code-hardening",
+  "module-boundary-review",
+  "change-blast-radius-review",
+  "business-rule-leakage-review",
+  "payment-integrity-review",
+  "credit-ledger-integrity-review",
+  "api-misuse-resistance-review",
+  "api-access-control-review",
+  "file-upload-security-review",
+  "error-message-integrity-review",
+  "memory-lifetime-review",
+  "desktop-memory-footprint-review",
+  "hot-path-performance-review",
+  "api-request-performance-review",
+  "web-render-performance-review",
+  "core-web-vitals-field-review",
+  "image-delivery-performance-review",
+  "client-bundle-pruning-review",
+  "frame-render-performance-review",
+  "app-startup-performance-review",
+  "desktop-background-process-stability-review",
+  "desktop-auto-update-safety-review",
+  "low-end-device-support-review",
+  "mobile-energy-efficiency-review",
+  "frontend-state-ownership-review",
+  "frontend-stress-layout-review",
+  "frontend-accessibility-tree-review",
+  "frontend-localization-review",
+  "cache-integrity-review",
+  "quadratic-scan-review",
+  "type-state-modeling-review",
+  "race-condition-review",
+  "concurrency-invariant-review",
+  "failure-integrity-review",
+  "backend-log-evidence-review",
+  "observability-debuggability-review",
+  "incident-triage-review",
+  "deployment-rollout-safety-review",
+  "cloud-cost-guardrail-review",
+  "rate-limit-integrity-review",
+  "idempotency-integrity-review",
+  "retry-policy-integrity-review",
+  "queue-processing-integrity-review",
+  "transaction-boundary-integrity-review",
+  "testability-boundary-review",
   "codebase-orientation",
   "heuristic-candidate-selection",
   "clarifying-question-gate",
@@ -447,6 +713,10 @@ team = [
   "date-number-audit",
   "database-change-safety",
   "database-migration-change",
+  "database-query-bottleneck-review",
+  "database-json-modeling-review",
+  "deletion-lifecycle-review",
+  "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
   "dependency-injection",
@@ -456,6 +726,12 @@ team = [
   "diff-risk-review",
   "docs-update",
   "external-prompt-injection-defense",
+  "prompt-contract-quality-review",
+  "llm-hallucination-control-review",
+  "llm-token-cost-control-review",
+  "llm-response-latency-review",
+  "agent-execution-control-review",
+  "agent-eval-integrity-review",
   "github-contribution-quality-gate",
   "facade-pattern",
   "failure-triage",
@@ -492,9 +768,54 @@ product = [
   "http-delivery-streaming",
   "service-boundary-architecture",
   "auth-permission-change",
+  "security-flow-review",
   "behavior-preserving-refactor",
   "code-review",
   "ai-generated-code-hardening",
+  "module-boundary-review",
+  "change-blast-radius-review",
+  "business-rule-leakage-review",
+  "payment-integrity-review",
+  "credit-ledger-integrity-review",
+  "api-misuse-resistance-review",
+  "api-access-control-review",
+  "file-upload-security-review",
+  "error-message-integrity-review",
+  "memory-lifetime-review",
+  "desktop-memory-footprint-review",
+  "hot-path-performance-review",
+  "api-request-performance-review",
+  "web-render-performance-review",
+  "core-web-vitals-field-review",
+  "image-delivery-performance-review",
+  "client-bundle-pruning-review",
+  "frame-render-performance-review",
+  "app-startup-performance-review",
+  "desktop-background-process-stability-review",
+  "desktop-auto-update-safety-review",
+  "low-end-device-support-review",
+  "mobile-energy-efficiency-review",
+  "frontend-state-ownership-review",
+  "frontend-stress-layout-review",
+  "frontend-accessibility-tree-review",
+  "frontend-localization-review",
+  "cache-integrity-review",
+  "quadratic-scan-review",
+  "type-state-modeling-review",
+  "race-condition-review",
+  "concurrency-invariant-review",
+  "failure-integrity-review",
+  "backend-log-evidence-review",
+  "observability-debuggability-review",
+  "incident-triage-review",
+  "deployment-rollout-safety-review",
+  "cloud-cost-guardrail-review",
+  "rate-limit-integrity-review",
+  "idempotency-integrity-review",
+  "retry-policy-integrity-review",
+  "queue-processing-integrity-review",
+  "transaction-boundary-integrity-review",
+  "testability-boundary-review",
   "codebase-orientation",
   "heuristic-candidate-selection",
   "clarifying-question-gate",
@@ -531,6 +852,10 @@ product = [
   "date-number-audit",
   "database-change-safety",
   "database-migration-change",
+  "database-query-bottleneck-review",
+  "database-json-modeling-review",
+  "deletion-lifecycle-review",
+  "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
   "dependency-injection",
@@ -540,6 +865,12 @@ product = [
   "diff-risk-review",
   "docs-update",
   "external-prompt-injection-defense",
+  "prompt-contract-quality-review",
+  "llm-hallucination-control-review",
+  "llm-token-cost-control-review",
+  "llm-response-latency-review",
+  "agent-execution-control-review",
+  "agent-eval-integrity-review",
   "facade-pattern",
   "github-contribution-quality-gate",
   "failure-triage",
@@ -583,9 +914,54 @@ library = [
   "architecture-deepening-review",
   "service-boundary-architecture",
   "auth-permission-change",
+  "security-flow-review",
   "behavior-preserving-refactor",
   "code-review",
   "ai-generated-code-hardening",
+  "module-boundary-review",
+  "change-blast-radius-review",
+  "business-rule-leakage-review",
+  "payment-integrity-review",
+  "credit-ledger-integrity-review",
+  "api-misuse-resistance-review",
+  "api-access-control-review",
+  "file-upload-security-review",
+  "error-message-integrity-review",
+  "memory-lifetime-review",
+  "desktop-memory-footprint-review",
+  "hot-path-performance-review",
+  "api-request-performance-review",
+  "web-render-performance-review",
+  "core-web-vitals-field-review",
+  "image-delivery-performance-review",
+  "client-bundle-pruning-review",
+  "frame-render-performance-review",
+  "app-startup-performance-review",
+  "desktop-background-process-stability-review",
+  "desktop-auto-update-safety-review",
+  "low-end-device-support-review",
+  "mobile-energy-efficiency-review",
+  "frontend-state-ownership-review",
+  "frontend-stress-layout-review",
+  "frontend-accessibility-tree-review",
+  "frontend-localization-review",
+  "cache-integrity-review",
+  "quadratic-scan-review",
+  "type-state-modeling-review",
+  "race-condition-review",
+  "concurrency-invariant-review",
+  "failure-integrity-review",
+  "backend-log-evidence-review",
+  "observability-debuggability-review",
+  "incident-triage-review",
+  "deployment-rollout-safety-review",
+  "cloud-cost-guardrail-review",
+  "rate-limit-integrity-review",
+  "idempotency-integrity-review",
+  "retry-policy-integrity-review",
+  "queue-processing-integrity-review",
+  "transaction-boundary-integrity-review",
+  "testability-boundary-review",
   "codebase-orientation",
   "heuristic-candidate-selection",
   "clarifying-question-gate",
@@ -624,6 +1000,10 @@ library = [
   "date-number-audit",
   "database-change-safety",
   "database-migration-change",
+  "database-query-bottleneck-review",
+  "database-json-modeling-review",
+  "deletion-lifecycle-review",
+  "database-lock-contention-review",
   "sqlite-code-change",
   "postgresql-code-change",
   "dependency-injection",
@@ -634,6 +1014,12 @@ library = [
   "docs-prose-review",
   "docs-update",
   "external-prompt-injection-defense",
+  "prompt-contract-quality-review",
+  "llm-hallucination-control-review",
+  "llm-token-cost-control-review",
+  "llm-response-latency-review",
+  "agent-execution-control-review",
+  "agent-eval-integrity-review",
   "facade-pattern",
   "github-contribution-quality-gate",
   "failure-triage",