navori 0.4.2 → 0.5.0

package/dist/assets/core/core-assets/hooks/guard-destructive.sh

@@ -33,9 +33,9 @@ set -euo pipefail
 base={{shq:branchBase}}
 
 block() {
-  echo "[navori] BLOQUEADO por guard-destructive: $1" >&2
-  echo "[navori] comando: $cmd" >&2
-  echo "[navori] si es intencional, corre el comando tú mismo fuera del agente." >&2
+  echo "[navori] BLOCKED by guard-destructive: $1" >&2
+  echo "[navori] command: $cmd" >&2
+  echo "[navori] if intentional, run the command yourself outside the agent." >&2
   exit 2
 }
 
@@ -75,7 +75,7 @@ git_cp='(^|[[:space:]]|[;&|])git([[:space:]]+-[a-zA-Z-]+(=[^[:space:]]+)?([[:spa
 #    (`git commit -qn`/`-nq`) without a hyphen-word in a message tripping it.
 if printf '%s' "$scan"       | grep -qE "${git_cp}([[:space:]]|.)*--no-verify" \
   || printf '%s' "$scan_flags" | grep -qE "${git_cp}([[:space:]]|.)*[[:space:]]-[a-zA-Z]*n[a-zA-Z]*([[:space:]]|\$)"; then
-  block "git commit/push con --no-verify (saltarse los hooks/gates)"
+  block "git commit/push with --no-verify (skipping hooks/gates)"
 fi
 
 # 2. Force-push to the base branch. force-with-lease is allowed (safe rebase
@@ -87,13 +87,13 @@ if printf '%s' "$scan" | grep -qE '(^|[[:space:]]|[;&|])git([[:space:]]+-[a-zA-Z
   && printf '%s' "$scan" | grep -qE '(--force([[:space:]]|$)|[[:space:]]-f([[:space:]]|$)|[[:space:]]\+)' \
   && ! printf '%s' "$scan" | grep -qE 'force-with-lease' \
   && printf '%s' "$scan" | grep -qE "(^|[[:space:]+/])${base}([[:space:]]|\$)"; then
-  block "force-push a la rama base '${base}'"
+  block "force-push to the base branch '${base}'"
 fi
 
 # 3. rm -rf with variable indirection or absolute/home roots that static deny
 #    globs miss (e.g. PATH=/; rm -rf $PATH).
 if printf '%s' "$cmd" | grep -qE '(^|[[:space:]])rm[[:space:]]+(-[a-zA-Z]*r[a-zA-Z]*[[:space:]]+|-[a-zA-Z]*f[a-zA-Z]*[[:space:]]+)*-?[a-zA-Z]*[rf][a-zA-Z]*[[:space:]]+("?\$|/[[:space:]]*$|~[[:space:]]*$)'; then
-  block "rm recursivo sobre variable / raíz / home"
+  block "recursive rm over a variable / root / home"
 fi
 
 # 4. Fork bomb.
@@ -103,13 +103,13 @@ fi
 
 # 5. Writing to a raw block device (wipes a disk/partition).
 if printf '%s' "$cmd" | grep -qE '(of=/dev/(sd|nvme|disk|hd)|>[[:space:]]*/dev/(sd|nvme|disk|hd))'; then
-  block "escritura directa a un dispositivo de bloque"
+  block "direct write to a block device"
 fi
 
 # navori:user-section
-# user: agrega guards adicionales acá. `$cmd` ya tiene el comando completo
-# (incluye comandos compuestos) y `block "<motivo>"` aborta con exit 2.
-# Ejemplo:
+# user: add extra guards here. `$cmd` already holds the full command (compound
+# commands included) and `block "<reason>"` aborts with exit 2.
+# Example:
 #
 #   if printf '%s' "$cmd" | grep -qE 'drop[[:space:]]+(table|database)'; then
 #     block "DROP TABLE/DATABASE"

package/dist/assets/core/core-assets/hooks/quality-gate-pre-commit.sh

@@ -132,19 +132,19 @@ if is_scan_trigger "$cmd"; then
     # `exit 0` that handed a contributor zero quality gate without a word.
     detected_pm="$(detect_pm)"
     if is_pm "$gate_bin" && [ -n "$detected_pm" ] && [ "$detected_pm" != "$gate_bin" ] && command -v "$detected_pm" >/dev/null 2>&1; then
-      echo "[navori] '$gate_bin' no está en PATH; uso el package manager detectado por lockfile: '$detected_pm'." >&2
+      echo "[navori] '$gate_bin' is not on PATH; using the lockfile-detected package manager: '$detected_pm'." >&2
       run_gate "$detected_pm ${gate#* }"
     else
-      echo "[navori] quality-gate NO ejecutado: '$gate_bin' no está en PATH y no hay un package manager alternativo detectado que pueda correrlo." >&2
-      echo "[navori] Commit BLOQUEADO para no saltarnos el gate en silencio. Instala '$gate_bin', o si de verdad quieres saltártelo corre el commit tú mismo fuera del agente." >&2
+      echo "[navori] quality-gate NOT run: '$gate_bin' is not on PATH and no alternative package manager was detected that could run it." >&2
+      echo "[navori] Commit BLOCKED to avoid skipping the gate silently. Install '$gate_bin', or if you really want to skip it run the commit yourself outside the agent." >&2
       exit 2
     fi
   fi
 fi
 
 # navori:user-section
-# user: agrega checks adicionales acá. `$cmd` ya está parseado del input
-# de la tool. Ejemplo:
+# user: add extra checks here. `$cmd` is already parsed from the tool input.
+# Example:
 #
 #   case "$cmd" in
 #     'git push'*)

package/dist/assets/core/core-assets/lib-skills/citty.md

@@ -0,0 +1,74 @@
+---
+name: citty
+description: Use when adding or editing a CLI command with citty — defineCommand, runMain, typed args (positional/string/boolean/enum), subCommands, and run/setup/cleanup hooks.
+type: reference
+---
+
+# Citty — command definitions
+
+## When to use this skill
+
+When adding a subcommand, declaring typed args, wiring `run`/`setup`/`cleanup`, or debugging an unparsed flag. Citty is UnJS's zero-dependency builder over Node's `util.parseArgs`; the tree is `runMain` → root `defineCommand` → `subCommands`.
+
+## The pattern
+
+Each command is a `defineCommand` object: `meta` for help, `args` for typed input, `run` for the body. Nest `subCommands`; run the root once with `runMain`.
+
+```ts
+import { defineCommand, runMain } from "citty";
+
+const build = defineCommand({
+  meta: { name: "build", description: "Build the project" },
+  args: {
+    entry: { type: "positional", required: true, description: "Entry file" },
+    mode: { type: "enum", options: ["dev", "prod"], default: "dev" },
+    minify: { type: "boolean", description: "Minify output" },
+    out: { type: "string", alias: ["o"], valueHint: "dir" },
+  },
+  run({ args }) {
+    // args.entry, args.mode, args.minify, args.out (kebab also → camelCase)
+  },
+});
+
+const main = defineCommand({
+  meta: { name: "cli", version: "1.0.0" },
+  subCommands: { build },
+});
+runMain(main);
+```
+
+## Gotchas that bite
+
+- **A custom `-v`/`-h` shadows the built-ins.** Citty auto-handles `--version`/`-v` and `--help`/`-h`, but declaring an arg with the same name or alias silently disables them. Don't alias `verbose` to `v`.
+- **Only the run command's hooks fire.** `setup`/`cleanup` run for the executing command, not its parents — a root `setup` won't run before a subcommand. Put shared init in the leaf.
+- **`cleanup` runs even on throw.** It's your `finally`; keep it idempotent and side-effect-safe.
+- **Positionals take no `alias`.** Alias is for flags. A missing `required` positional throws before `run`.
+- **Kebab args have two names.** `--out-dir` lands as both `args["out-dir"]` and `args.outDir`; pick one.
+- **Unset optional string/enum is `undefined`, not `""`.** Give a `default` or guard before use.
+
+## Hard rules
+
+1. One `defineCommand` per file, exported; wire the tree in the entrypoint, `runMain` once.
+2. Declare every input in `args` with an explicit `type` and `description` — never read `rawArgs` by hand.
+3. `enum` args always carry `options`; give user flags a `default` so `run` never sees `undefined`.
+4. Lazy-load heavy subcommands: `sub: () => import("./sub.ts").then((m) => m.default)`.
+5. Side effects (fs, network) live in `run`, never at module top level — imports stay pure.
+6. Use `required: true` for mandatory input; let citty throw rather than validating presence yourself.
+
+## Quick table
+
+| Need | Use |
+|---|---|
+| Named flag | `{ type: "string", alias: ["o"] }` |
+| Yes/no flag | `{ type: "boolean" }` (`--no-x` negates) |
+| Constrained choice | `{ type: "enum", options: [...] }` |
+| Required arg | `{ type: "positional", required: true }` |
+| Nested command | `subCommands: { build }` |
+| Lazy subcommand | `() => import("./x.ts").then((m) => m.default)` |
+
+## Before declaring done
+
+- Every arg has a `type` and `description`; enums carry `options`; user flags have defaults.
+- Built-in `--help`/`--version` still work (no shadowing alias).
+- No side effects at import time; `cleanup` is idempotent.
+- `{{qualityGate.fast}}` green.

package/dist/assets/core/core-assets/lib-skills/clack.md

@@ -0,0 +1,81 @@
+---
+name: clack
+description: Use when building interactive CLI prompts with @clack/prompts — intro/outro, text/select/confirm/multiselect, spinner, isCancel, and group flows.
+type: reference
+---
+
+# Clack prompts — interactive CLI
+
+## When to use this skill
+
+When building interactive flows: prompting the user (`text`/`select`/`confirm`/`multiselect`), bracketing a session with `intro`/`outro`, showing progress with `spinner`, or bundling steps with `group`. `@clack/prompts` is the UI layer; every prompt is `await`ed and can be cancelled.
+
+## The pattern
+
+Bracket the flow with `intro`/`outro`. `await` each prompt, then immediately check `isCancel` — on cancel, emit `cancel(...)` and exit. Import the namespace as `p`.
+
+```ts
+import * as p from "@clack/prompts";
+
+p.intro("navori init");
+
+const name = await p.text({
+  message: "Project name?",
+  placeholder: "my-app",
+  validate: (v) => (v.length === 0 ? "Required" : undefined),
+});
+if (p.isCancel(name)) {
+  p.cancel("Cancelled.");
+  process.exit(0);
+}
+
+const kind = await p.select({
+  message: "Preset?",
+  options: [
+    { value: "spa", label: "SPA" },
+    { value: "api", label: "API", hint: "backend" },
+  ],
+});
+if (p.isCancel(kind)) {
+  p.cancel("Cancelled.");
+  process.exit(0);
+}
+
+p.outro("Done");
+```
+
+## Gotchas that bite
+
+- **A prompt returns `value | symbol`.** Cancel is a symbol, not `null`. You MUST `isCancel` after every prompt — it narrows the type so `value` is usable afterward. Skip it and a cancelled `text` is treated as a string.
+- **Forget the check and the flow misbehaves.** Nothing throws on cancel; handle it or downstream code runs with a symbol.
+- **`spinner` needs both `start` and `stop`.** `const s = p.spinner(); s.start("…"); …; s.stop("done")` — an unstopped spinner leaves the terminal spinning; wrap work in try/finally.
+- **`confirm` returns a boolean**, `multiselect` an array, `select` the chosen `value` — not the label.
+- **`group` centralizes cancel.** Its `onCancel` fires if any step cancels, so per-step `isCancel` isn't needed inside a group.
+- **`validate` returns a string (error) or `undefined` (ok)** — returning `""` still reads as valid.
+
+## Hard rules
+
+1. `intro` opens and `outro` closes every flow — matched pair.
+2. `isCancel` after every standalone prompt; on cancel, `p.cancel(msg)` then `process.exit(0)`.
+3. Prefer `group({...}, { onCancel })` for multi-step flows — one cancel handler, typed `results`.
+4. Every `spinner().start()` has a matching `.stop()`, even on error (try/finally).
+5. `select`/`multiselect` options are `{ value, label, hint? }`; consume `value`, never the label.
+6. `validate` returns an error string or `undefined`; keep prompts `await`ed — they're all async.
+
+## Quick table
+
+| Need | Use |
+|---|---|
+| Free text | `await p.text({ message })` |
+| One of many | `await p.select({ message, options })` |
+| Several | `await p.multiselect({ message, options })` |
+| Yes/no | `await p.confirm({ message })` |
+| Progress | `const s = p.spinner(); s.start(); s.stop()` |
+| Multi-step | `await p.group({...}, { onCancel })` |
+
+## Before declaring done
+
+- Every prompt is `await`ed and followed by `isCancel` (or inside a `group` with `onCancel`).
+- Every spinner is stopped; `intro`/`outro` bracket the flow.
+- `select`/`multiselect` consume `value`, not label.
+- `{{qualityGate.fast}}` green.

package/dist/assets/core/core-assets/lib-skills/jest.md

@@ -0,0 +1,87 @@
+---
+name: jest
+description: Use when testing React Native/Expo apps or the Medusa backend — jest-expo preset, transformIgnorePatterns, jest.mock hoisting, medusaIntegrationTestRunner.
+type: reference
+---
+
+# Jest — conventions
+
+## When to use this skill
+
+When the code under test is **React Native / Expo** (the mobile app) or the **Medusa backend** — those two run on Jest, not Vitest. Reach for the right preset/runner: `jest-expo` for RN/Expo, `medusaIntegrationTestRunner`/`moduleIntegrationTestRunner` from `@medusajs/test-utils` for Medusa. Everything else in the stack uses Vitest; do not introduce Jest into a Vitest project.
+
+## The pattern
+
+Preset-driven config, `jest.mock` at the top, RN queries via `@testing-library/react-native`.
+
+```js
+// jest.config.js (Expo) — the preset alone is often enough
+module.exports = {
+  preset: 'jest-expo',
+  transformIgnorePatterns: [
+    'node_modules/(?!((jest-)?react-native|@react-native(-community)?)|expo(nent)?|@expo(nent)?/.*|@expo-google-fonts/.*|react-navigation|@react-navigation/.*|@sentry/react-native)',
+  ],
+};
+```
+
+```tsx
+import { render, screen, fireEvent } from '@testing-library/react-native';
+import { LoginScreen } from './LoginScreen';
+
+jest.mock('./auth-api', () => ({ login: jest.fn() }));
+
+it('shows an error on empty submit', () => {
+  render(<LoginScreen />);
+  fireEvent.press(screen.getByText('Sign in'));
+  expect(screen.getByText('Email is required')).toBeOnTheScreen();
+});
+```
+
+Medusa boots a real framework + test DB:
+
+```ts
+import { medusaIntegrationTestRunner } from '@medusajs/test-utils';
+
+medusaIntegrationTestRunner({
+  testSuite: ({ api, getContainer }) => {
+    it('lists posts', async () => {
+      const res = await api.get('/store/posts');
+      expect(res.status).toBe(200);
+    });
+  },
+});
+```
+
+## Gotchas that bite
+
+- **`SyntaxError: Unexpected token 'export'` from node_modules** is the RN classic: an untranspiled ESM package. Whitelist the offender in `transformIgnorePatterns` (`node_modules/(?!(pkg)/)`), never transform all of `node_modules`; pnpm/Bun prepend `.pnpm`/`.bun`.
+- **`jest.mock` is hoisted above imports** like `vi.mock`. The factory can't close over later variables — declare mock fns inside it, or `jest.mock('m'); const m = jest.mocked(require('m'))`.
+- **jest-native is deprecated.** RNTL v12.4+ ships built-in matchers (`toBeOnTheScreen`/`toBeVisible`/`toHaveTextContent`) — no `@testing-library/jest-native`, no `extend-expect`. Older RNTL: add `@testing-library/jest-native/extend-expect` to `setupFilesAfterEnv`.
+- **Wrong runner for Medusa.** A plain `it` calling the service fails on the missing DI container. Single-module tests use `moduleIntegrationTestRunner<Service>({ moduleName, moduleModels, resolve, testSuite })`. Both need `testEnvironment: 'node'`, an `@swc/jest` transform, and `--runInBand --forceExit`.
+- **State leaks between tests.** Set `clearMocks: true` (call history); add `resetMocks: true` only when a mock's implementation must not carry over.
+- **Fake timers + animations.** RN animations and `setTimeout` UI need `jest.useFakeTimers()` + `act(() => jest.advanceTimersByTime(ms))`, or updates never flush.
+
+## Hard rules
+
+1. Use the preset/runner for the target: `jest-expo` for RN/Expo, `@medusajs/test-utils` runners for Medusa.
+2. Fix RN "unexpected token" via a targeted `transformIgnorePatterns` whitelist — never blanket-transform `node_modules`.
+3. `jest.mock` at top level; keep factories self-contained (hoisting).
+4. Query RN trees with `@testing-library/react-native` matchers, not `.props`.
+5. `clearMocks: true` in config; add `resetMocks` only when implementations must not persist.
+
+## Quick table
+
+| Target | Preset / runner |
+|---|---|
+| React Native / Expo | `preset: 'jest-expo'` |
+| Medusa API + full app | `medusaIntegrationTestRunner` |
+| Medusa single module | `moduleIntegrationTestRunner` |
+| RN matchers | built-in (RNTL ≥ 12.4) |
+| ESM in node_modules | whitelist in `transformIgnorePatterns` |
+
+## Before declaring done
+
+- Correct preset/runner (RN vs Medusa); no blanket node_modules transform.
+- Mocks hoisted safely and cleared between tests; RN matchers available.
+- Medusa tests boot the runner (`testEnvironment: 'node'`), not the bare service.
+- `{{qualityGate.fast}}` green.

package/dist/assets/core/core-assets/lib-skills/playwright.md

@@ -0,0 +1,66 @@
+---
+name: playwright
+description: Use when writing browser E2E tests with Playwright — @playwright/test runner, web-first assertions with auto-wait, role locators, projects, traces on failure.
+type: reference
+---
+
+# Playwright — conventions
+
+## When to use this skill
+
+When writing end-to-end browser tests that drive a real page (storefront, dashboard, Medusa e2e). Playwright is E2E only — it complements, never replaces, the Vitest/Jest unit suite. Two official pillars: **test user-visible behavior** (what the page renders, not CSS classes) and **web-first, auto-waiting assertions** — `await expect(locator).toBeVisible()` retries until the condition holds or times out, so you never sleep.
+
+## The pattern
+
+`test`/`expect` from `@playwright/test`, role/label locators, awaited web-first assertions.
+
+```ts
+import { test, expect } from '@playwright/test';
+
+test('user can log in', async ({ page }) => {
+  await page.goto('/login');
+  await page.getByLabel('Email').fill('ada@x.com');
+  await page.getByLabel('Password').fill('secret');
+  await page.getByRole('button', { name: 'Sign in' }).click();
+
+  await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
+  await expect(page).toHaveURL(/\/dashboard/);
+});
+```
+
+## Gotchas that bite
+
+- **The `expect` is Playwright's, not the runner's.** Import `test` and `expect` from `@playwright/test`. Pulling in Vitest/Jest `expect` loses auto-retry and every web-first matcher.
+- **`waitForTimeout` is a code smell.** Never sleep a fixed number of ms. Use web-first assertions (`toBeVisible`, `toHaveText`, `toHaveURL`) or `locator.waitFor()`; they retry until ready and kill flake.
+- **Assert on the locator, not a captured value.** `await expect(locator).toHaveText('x')` re-queries and retries; `expect(await locator.textContent()).toBe('x')` reads once and flakes. Keep `await` on `expect`, not inside it.
+- **Prefer user-facing locators.** Official order: `getByRole` → `getByLabel` → `getByPlaceholder` → `getByText`. Drop to `getByTestId` only when nothing user-visible works; never CSS/XPath. Narrow with `.filter({ hasText })`.
+- **Tests must be isolated.** Each test gets a fresh `page`/context; don't share auth or state through module scope. Reuse login via `storageState`/a fixture. Mock external calls with `page.route()`; don't hit servers you don't control.
+- **Multi-browser lives in `projects`.** Chromium/Firefox/WebKit are `projects` in `playwright.config.ts`, not `if` branches. Same test, matrixed by config.
+- **Debug with artifacts, not console.log.** Set `trace: 'on-first-retry'` and `screenshot: 'only-on-failure'`; open the trace viewer. To scaffold or heal tests, use the official agents (`npx playwright init-agents`) and MCP (`@playwright/mcp`).
+
+## Hard rules
+
+1. Import `test`/`expect` from `@playwright/test`; never the unit runner's `expect`.
+2. Assert user-visible behavior with web-first assertions and `locator.waitFor()`; `waitForTimeout` is banned.
+3. `await expect(locator)...` — assert on the live locator, not a captured value.
+4. Prefer role/label locators; `getByTestId` is the fallback, CSS/XPath the last resort.
+5. Keep tests independent; share auth via `storageState`/fixtures, mock third parties, matrix browsers through `projects` with trace + screenshot on failure.
+
+## Quick table
+
+| Goal | API |
+|---|---|
+| Find by role | `page.getByRole('button', { name: 'Save' })` |
+| Find by label | `page.getByLabel('Email')` |
+| Fallback locator | `page.getByTestId('cart')` |
+| Assert visible | `await expect(locator).toBeVisible()` |
+| Assert URL | `await expect(page).toHaveURL(/x/)` |
+| Multi-browser | `projects` in config |
+| Failure debug | `trace: 'on-first-retry'` |
+
+## Before declaring done
+
+- All waits are web-first assertions or `waitFor`; zero `waitForTimeout`.
+- `test`/`expect` imported from `@playwright/test`; tests run isolated in parallel; external calls mocked.
+- Locators are user-facing (role/label first); trace + screenshot on failure; browsers matrixed via `projects`.
+- `{{qualityGate.fast}}` green.

package/dist/assets/core/core-assets/lib-skills/supertest.md

@@ -0,0 +1,69 @@
+---
+name: supertest
+description: Use when integration-testing HTTP APIs — supertest against an Express/Medusa app without binding a port, status/body/header assertions, auth headers.
+type: reference
+---
+
+# Supertest — conventions
+
+## When to use this skill
+
+When integration-testing an HTTP API — real routes end to end through the middleware stack, no running server or network. Pass the **app object** (or an `http.Server`) to `request()`; if it is not listening, supertest binds an ephemeral port and tears it down — no `listen()`, no port bookkeeping. Runner-agnostic (Vitest, Jest, Mocha). Tests the app, not a deployed service.
+
+## The pattern
+
+`request(app)`, chain verb + path, assert status/headers inline via `.expect(...)`, then the body via the runner's `expect(res.body)`.
+
+```ts
+import request from 'supertest';
+import { app } from '../src/app';
+
+describe('POST /users', () => {
+  it('creates a user and returns 201', async () => {
+    const res = await request(app)
+      .post('/users')
+      .set('Authorization', `Bearer ${token}`)
+      .send({ email: 'ada@x.com', name: 'Ada' })
+      .expect('Content-Type', /json/)
+      .expect(201);
+
+    expect(res.body).toMatchObject({ email: 'ada@x.com' });
+  });
+});
+```
+
+## Gotchas that bite
+
+- **Pass the app, not a URL.** `request(app)` lets supertest manage the port; `request('http://localhost:3000')` ties the test to a manually-started server and defeats isolation.
+- **Don't `listen()` yourself.** Export the app separately from `app.listen()`. If the entry file both builds and starts the server, tests leak a port — split creation from startup.
+- **The request is lazy — `await` it or nothing runs.** A chain fires only when you `await`, `return`, `.then()`, or `.end()` it. Forget all of them and the assertion never runs (false green), or the failure floats as an unhandled rejection outside the test. With `.end((err, res) => …)`, a failed `.expect(...)` returns as `err` rather than throwing — forward it.
+- **`.expect(...)` vs the runner's `expect`.** `.expect()` (supertest) checks status, headers, or an exact body/regex inline, plus a custom `res => { … }` assertor; partial/deep body shape belongs to the runner's `expect(res.body)`. `.expect(res.body.id)` checks nothing.
+- **Auth is just a header.** Set tokens with `.set('Authorization', …)`; no session magic. Multi-step cookie/session flows: `request.agent(app)`, which persists cookies across calls.
+- **Assert body shape, not the whole object.** Use `toMatchObject`/specific fields; snapshotting `res.body` breaks on every timestamp/id and adds noise.
+
+## Hard rules
+
+1. `request(app)` with the app/server instance — never a live URL/port.
+2. Export the app separately from `listen()`; tests never bind a real port.
+3. `await` (or `return`/`.end()`) every `request(...)` chain — unawaited chains do not run.
+4. Status/headers via `.expect(...)`; body shape via the runner's `expect(res.body)`.
+5. Auth via `.set('Authorization', …)`; multi-step cookie flows via `request.agent(app)`.
+
+## Quick table
+
+| Goal | API |
+|---|---|
+| Call a route | `request(app).get('/x')` |
+| Assert status | `.expect(200)` |
+| Assert header | `.expect('Content-Type', /json/)` |
+| Custom assertion | `.expect(res => { … })` |
+| Send JSON body | `.send({ email: 'a@x.com' })` |
+| Auth header | `.set('Authorization', 'Bearer …')` |
+| Persist cookies | `request.agent(app)` |
+
+## Before declaring done
+
+- `request(app)`, app export split from `listen()`.
+- Every chain awaited/returned; status via `.expect`, body via the runner's `expect`.
+- Body assertions target fields, not snapshots.
+- `{{qualityGate.fast}}` green.

package/dist/assets/core/core-assets/lib-skills/testing-library.md

@@ -0,0 +1,66 @@
+---
+name: testing-library
+description: Use when querying rendered UI in tests — Testing Library query priority (getByRole first), get/query/find, user-event over fireEvent, React Native variant.
+type: reference
+---
+
+# Testing Library — conventions
+
+## When to use this skill
+
+When a test renders a component and needs to find nodes and assert on them — React, Vue, Svelte, or React Native. The whole library encodes one rule: **query the way a user perceives the UI** (role, label, text), not the way it's built (class names, component internals, test ids as a first resort). It works under both Vitest and Jest; it's the query layer, not the runner.
+
+## The pattern
+
+Render, query by accessible role/text via `screen`, drive interaction with `user-event`, assert with jest-dom matchers.
+
+```tsx
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { LoginForm } from './LoginForm';
+
+it('submits the email', async () => {
+  const user = userEvent.setup();
+  const onSubmit = vi.fn();
+  render(<LoginForm onSubmit={onSubmit} />);
+
+  await user.type(screen.getByRole('textbox', { name: /email/i }), 'ada@x.com');
+  await user.click(screen.getByRole('button', { name: /sign in/i }));
+
+  expect(onSubmit).toHaveBeenCalledWith({ email: 'ada@x.com' });
+});
+```
+
+## Gotchas that bite
+
+- **`getByTestId` is the last resort.** Priority: `getByRole` → `getByLabelText` (forms) → `getByPlaceholderText`/`getByText` → `getByTestId`. Reaching for a testid usually means the markup lacks an accessible name — fix the markup instead.
+- **`getBy` throws, `queryBy` returns null, `findBy` awaits.** Assert presence with `getBy*`; assert **absence** only with `queryBy*` (`expect(screen.queryByText('x')).not.toBeInTheDocument()`); wait for async UI with `await findBy*` — never poll a `getBy` inside `waitFor` for something not yet rendered.
+- **`fireEvent` skips real user behavior.** `user-event` fires the full event sequence (focus, keydown, input) and is async — `await user.click(...)`. Prefer it; keep `fireEvent` only for events user-event can't model (e.g. `scroll`).
+- **`act` warnings mean an un-awaited update.** Almost always a missing `await` on a `user.*` call or a `findBy`. Add the `await`; don't wrap things in manual `act`.
+- **jest-dom matchers must be imported.** `toBeInTheDocument`/`toBeVisible`/`toHaveValue` come from `@testing-library/jest-dom` (loaded in setup). Without it you fall back to weak truthiness checks.
+- **React Native shares the same queries now.** `@testing-library/react-native` (v12.4+) supports `getByRole` (matches the `role`/`accessibilityRole` prop) with the same priority — role first, then `getByLabelText`/`getByText`, `getByTestId` last. Its matchers (`toBeOnTheScreen`, `toBeDisabled`) are built in; do not install `@testing-library/jest-native` (deprecated).
+
+## Hard rules
+
+1. Query by role/label/text first; `getByTestId` only when no accessible name exists.
+2. `getBy` for presence, `queryBy` for absence, `findBy` (awaited) for async.
+3. Prefer `user-event` (awaited) over `fireEvent`.
+4. Load jest-dom matchers in setup (web); React Native's are built in.
+5. Test observable behavior and output, never component internals or state.
+
+## Quick table
+
+| Goal | Query |
+|---|---|
+| Interactive element | `getByRole('button', { name: /save/i })` |
+| Form field | `getByLabelText(/email/i)` |
+| Assert absence | `queryByText('x')` + `.not.toBeInTheDocument()` |
+| Async appearance | `await findByText('Loaded')` |
+| React Native | `getByRole` (v12.4+); built-in matchers |
+
+## Before declaring done
+
+- Queries follow priority (role/label before testid); absence uses `queryBy`, async uses `findBy`.
+- Interactions go through awaited `user-event`; no stray `act` warnings.
+- jest-dom loaded (web); React Native's matchers are built in.
+- `{{qualityGate.fast}}` green.

package/dist/assets/core/core-assets/lib-skills/vitest.md

@@ -0,0 +1,67 @@
+---
+name: vitest
+description: Use when writing or fixing unit/integration tests with Vitest — describe/it/expect, vi.mock hoisting, jsdom vs node env, coverage, fake timers.
+type: reference
+---
+
+# Vitest — conventions
+
+## When to use this skill
+
+When authoring or debugging Vitest unit/integration tests: asserting behavior, mocking with `vi`, choosing an environment, or fixing flaky async/timer tests. Vitest is the default runner except React Native and the Medusa backend (those use Jest). It shares Jest's `expect` surface, but the mock API lives on `vi`, and `vi.mock` is hoisted above imports.
+
+## The pattern
+
+Arrange–act–assert, one behavior per `it`, mock at the module boundary, `await` every async assertion. Prefer the `import()` form of `vi.mock`.
+
+```ts
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { getUser } from './user-service';
+import { db } from './db';
+
+vi.mock(import('./db'), () => ({ db: { findUser: vi.fn() } }));
+
+beforeEach(() => vi.clearAllMocks());
+
+describe('getUser', () => {
+  it('returns the mapped user', async () => {
+    vi.mocked(db.findUser).mockResolvedValue({ id: 1, name: 'Ada' });
+    await expect(getUser(1)).resolves.toMatchObject({ id: 1, name: 'Ada' });
+  });
+});
+```
+
+## Gotchas that bite
+
+- **`vi.mock` is hoisted above imports.** It runs before any `import`, so the factory cannot reference file-scope variables, and `vi` must come from `vitest`. Share a fn via `vi.hoisted`: `const { send } = vi.hoisted(() => ({ send: vi.fn() }))`.
+- **Wrong `environment` = `document is not defined` or a slow suite.** Default is `node`; use `environment: 'jsdom'` (or `'happy-dom'`) for DOM, or `// @vitest-environment jsdom` per file.
+- **Unawaited async assertions pass silently.** `expect(p).resolves.toBe(x)` without `await`/`return` is a false green. Always `await expect(...).resolves` / `.rejects`.
+- **Fake timers must be paired.** `vi.useFakeTimers()` in setup, `vi.useRealTimers()` in teardown; advance with `await vi.advanceTimersByTimeAsync(ms)`, or callbacks never flush.
+- **`clearAllMocks` ≠ `resetAllMocks` ≠ `restoreAllMocks`.** `clear` wipes call history; `reset` also restores the `vi.fn(impl)` implementation; `restore` reverts `vi.spyOn` spies only, not automocks. Prefer `clearAllMocks` in `beforeEach`.
+- **Snapshots rot.** Reserve for small, stable output; never a whole component tree or an object with dates/ids — assert the fields that matter with `toMatchObject`.
+
+## Hard rules
+
+1. Run with `vitest run` (or `--no-watch`) so it exits under CI and agents.
+2. Mock at top level; share fns via `vi.hoisted`, never a bare outer variable.
+3. `await` (or `return`) every `.resolves`/`.rejects` and every async timer advance.
+4. Pick `environment`: `jsdom`/`happy-dom` for DOM, `node` for backend.
+5. Reset between tests (`clearAllMocks` or `clearMocks: true`); restore only what you spied on.
+6. Coverage via `@vitest/coverage-v8` (install it); v4 dropped `coverage.all`, so set `coverage.include`. Assert behavior, not a line target.
+
+## Quick table
+
+| Need | Use |
+|---|---|
+| Mock a module | `vi.mock(import('./m'), () => ({ db: vi.fn() }))` |
+| Share a mock fn into a factory | `vi.hoisted(() => ({ fn: vi.fn() }))` |
+| DOM component test | `environment: 'jsdom'` |
+| Async assert | `await expect(p).resolves.toBe(x)` |
+| Advance timers | `await vi.advanceTimersByTimeAsync(ms)` |
+
+## Before declaring done
+
+- Every async assertion is awaited; no unhandled-rejection warnings.
+- Mocks reset between tests; environment matches the code under test (DOM vs node).
+- No sprawling snapshots; assertions target real values.
+- `{{qualityGate.fast}}` green.

package/dist/assets/core/core-assets/managed/formato-respuesta.md

@@ -16,4 +16,4 @@ CAUSA: <1 línea> / ARCHIVO: <path>:<línea> / FIX: <diff mínimo>
 [MEDIO]   ... # legibilidad, naming
 
 **Generación**: diff si modifica; archivo completo solo si es nuevo.
-**Commits**: Conventional (`feat(scope): ...`), español MX, atómicos.
+**Commits**: Conventional (`feat(scope): ...`), atómicos, en el idioma que define `commits` en la config.

package/dist/assets/plugins/acli/plugin.json

@@ -15,8 +15,7 @@
     "checkBinary": "acli",
     "install": {
       "darwin": "brew install atlassian-labs/acli/acli",
-      "linux": "curl -fsSL https://acli-releases.atlassian.com/install.sh | bash",
-      "win32": "(descarga acli para Windows y agrégalo al PATH — https://developer.atlassian.com/cloud/acli/guides/install-acli/)"
+      "linux": "curl -fsSL https://acli-releases.atlassian.com/install.sh | bash"
     }
   },
   "settingsFragment": {

package/dist/assets/plugins/codegraph/plugin.json

@@ -15,8 +15,7 @@
     "checkBinary": "codegraph",
     "install": {
       "darwin": "curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh",
-      "linux": "curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh",
-      "win32": "(codegraph no tiene instalador nativo para Windows; instálalo vía WSL — https://github.com/colbymchenry/codegraph)"
+      "linux": "curl -fsSL https://raw.githubusercontent.com/colbymchenry/codegraph/main/install.sh | sh"
     },
     "postInstall": "codegraph install && codegraph init"
   },

package/dist/assets/plugins/codegraph/skills/codegraph-rung.md

@@ -6,12 +6,12 @@ type: behavior
 
 ## Rung -1 — query the code graph first (codegraph)
 
-Before the grep/ast-grep ladder below, if the `codegraph` MCP tool is available, ask the pre-built AST graph where the code lives:
+Before the grep/ast-grep ladder above, if the `codegraph` MCP tool is available, ask the pre-built AST graph where the code lives:
 
 - **Locate a symbol / definition:** `codegraph_explore` with the symbol name or a natural-language question ("where is the auth token refreshed?"). One call returns the source span + call paths, instead of a `grep` sweep.
 - **Trace impact:** ask what calls a function or what a change touches, to size the blast-radius before reading files.
 
-The graph **forms the hypothesis** (which files/symbols matter). The rungs below still **verify** it — never edit off the graph alone:
+The graph **forms the hypothesis** (which files/symbols matter). The rungs above still **verify** it — never edit off the graph alone:
 
 - On a stale index or ambiguous name, codegraph can return the wrong symbol while claiming it's exact. Confirm the concrete span with `Grep`/`Read` before writing, especially in critical areas.
 - Treat its blast-radius / "tests found" as a hint, not a coverage gate — the repo's real tests decide.