niahere 0.2.59 → 0.2.61

package/skills/code-review/pre-landing.md

@@ -0,0 +1,169 @@
+# Code Review — Pre-Landing Review
+
+Analyze the current branch's diff against main for structural issues that tests don't catch.
+
+---
+
+## Step 1: Check branch
+
+1. Run `git branch --show-current` to get the current branch.
+2. If on `main`, output: **"Nothing to review — you're on main or have no changes against main."** and stop.
+3. Run `git fetch origin main --quiet && git diff origin/main --stat` to check if there's a diff. If no diff, output the same message and stop.
+
+---
+
+## Step 2: Get the diff
+
+```bash
+git fetch origin main --quiet
+git diff origin/main
+```
+
+This includes both committed and uncommitted changes against the latest main.
+
+---
+
+## Step 3: Two-pass review
+
+Apply the checklist below against the diff in two passes:
+
+1. **Pass 1 (CRITICAL):** Data Safety, Trust Boundaries, Race Conditions
+2. **Pass 2 (INFORMATIONAL):** Conditional Side Effects, Magic Numbers, Dead Code, LLM Prompt Issues, Test Gaps, Frontend Issues
+
+Follow the output format specified below. Respect the suppressions — do NOT flag items in the "DO NOT flag" section.
+
+---
+
+## Step 4: Output findings
+
+**Always output ALL findings** — both critical and informational.
+
+- If CRITICAL issues found: output all findings, then for EACH critical issue use a separate AskUserQuestion with the problem, your recommended fix, and options (A: Fix it now, B: Acknowledge, C: False positive — skip).
+- If only non-critical issues found: output findings. No further action needed.
+- If no issues found: output `Pre-Landing Review: No issues found.`
+
+---
+
+## Review Checklist
+
+### Pass 1 — CRITICAL
+
+#### Data Safety
+- String interpolation/concatenation in SQL or database queries (use parameterized queries)
+- TOCTOU races: check-then-set patterns that should be atomic operations
+- Bypassing validations on writes to fields that have or should have constraints
+- N+1 queries: missing eager loading for associations used in loops/views
+
+#### Race Conditions & Concurrency
+- Read-check-write without uniqueness constraint or conflict handling
+- Find-or-create patterns on columns without unique DB index — concurrent calls can create duplicates
+- Status transitions that don't use atomic compare-and-swap — concurrent updates can skip or double-apply
+- Rendering user-controlled data as trusted HTML (XSS)
+
+#### Trust Boundaries
+- LLM/AI-generated values (emails, URLs, names) written to DB or used in actions without format validation
+- Structured tool output (arrays, objects) accepted without type/shape checks before database writes
+- External API responses used without validation
+- User input passed to system commands without sanitization
+
+### Pass 2 — INFORMATIONAL
+
+#### Conditional Side Effects
+- Code paths that branch on a condition but forget to apply a side effect on one branch (creating inconsistent state)
+- Log messages that claim an action happened but the action was conditionally skipped
+
+#### Magic Numbers & String Coupling
+- Bare numeric literals used in multiple files — should be named constants
+- Error message strings used as query filters elsewhere
+
+#### Dead Code & Consistency
+- Variables assigned but never read
+- Comments/docstrings that describe old behavior after the code changed
+- Changelog/version inconsistencies
+
+#### LLM Prompt Issues
+- 0-indexed lists in prompts (LLMs reliably return 1-indexed)
+- Prompt text listing available tools/capabilities that don't match what's actually wired up
+- Token/word limits stated in multiple places that could drift
+
+#### Test Gaps
+- Negative-path tests that assert type/status but not side effects
+- Assertions on string content without checking format
+- Security enforcement features without integration tests verifying the enforcement path end-to-end
+- Missing "should NOT call" assertions when a code path should explicitly skip an external service
+
+#### Crypto & Entropy
+- Truncation of data instead of hashing (less entropy, easier collisions)
+- Non-cryptographic random for security-sensitive values
+- Non-constant-time comparisons on secrets or tokens (timing attacks)
+
+#### Time Window Safety
+- Date-key lookups that assume "today" covers 24h
+- Mismatched time windows between related features
+
+#### Type Coercion at Boundaries
+- Values crossing language/serialization boundaries where type could change (numeric vs string)
+- Hash/digest inputs that don't normalize types before serialization
+
+#### Frontend/View
+- Inline styles in repeated components (re-parsed every render)
+- O(n*m) lookups in views (linear search in a loop instead of hash lookup)
+- Client-side filtering of large datasets that should be server-side
+
+---
+
+## Gate Classification
+
+```
+CRITICAL (blocks ship):          INFORMATIONAL (noted in PR):
+|- Data Safety                   |- Conditional Side Effects
+|- Race Conditions               |- Magic Numbers & String Coupling
+|- Trust Boundaries              |- Dead Code & Consistency
+                                 |- LLM Prompt Issues
+                                 |- Test Gaps
+                                 |- Crypto & Entropy
+                                 |- Time Window Safety
+                                 |- Type Coercion at Boundaries
+                                 |- Frontend/View
+```
+
+---
+
+## Output Format
+
+```
+Pre-Landing Review: N issues (X critical, Y informational)
+
+**CRITICAL** (blocking):
+- [file:line] Problem description
+  Fix: suggested fix
+
+**Issues** (non-blocking):
+- [file:line] Problem description
+  Fix: suggested fix
+```
+
+If no issues: `Pre-Landing Review: No issues found.`
+
+Be terse. One line problem, one line fix. No preamble.
+
+---
+
+## Suppressions — DO NOT flag these
+
+- "X is redundant with Y" when the redundancy is harmless and aids readability
+- "Add a comment explaining why this threshold was chosen" — thresholds change, comments rot
+- "This assertion could be tighter" when the assertion already covers the behavior
+- Suggesting consistency-only changes
+- "Regex doesn't handle edge case X" when the input is constrained and X never occurs in practice
+- "Test exercises multiple guards simultaneously" — that's fine
+- Eval threshold/config value changes that are tuned empirically
+- Harmless no-ops
+- ANYTHING already addressed in the diff you're reviewing — read the FULL diff before commenting
+
+## Important Rules
+
+- **Read the FULL diff before commenting.** Do not flag issues already addressed in the diff.
+- **Read-only by default.** Only modify files if the user explicitly chooses "Fix it now" on a critical issue. Never commit, push, or create PRs.
+- **Be terse.** One line problem, one line fix. No preamble.
+- **Only flag real problems.** Skip anything that's fine.

package/skills/codex/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: codex
+description: Consult OpenAI Codex CLI for a second opinion on plans, tests, code review, and more. Use this skill automatically whenever a second perspective would strengthen your output — especially for architectural plans, code review, test strategy, and debugging.
+argument-hint: "[task] [details...]"
+allowed-tools: Bash(codex *), Bash(codex exec *)
+---
+
+## Runtime Scope
+
+- Use this skill in Claude Code workflows.
+- If the active assistant is Codex and this skill is referenced, do not invoke Codex CLI directly; use a subagent for the second-opinion task instead.
+
+Consult the OpenAI Codex CLI as a second-opinion advisor. Use its output to compare, validate, or enrich your own analysis.
+
+**User request:** $ARGUMENTS
+
+## Instructions
+
+### Step 1: Determine the consultation type
+
+Based on the user's request, determine which mode applies:
+
+- **plan** — Ask Codex to propose an implementation plan or architecture
+- **review** — Ask Codex to review specific code for bugs, style, and improvements
+- **test** — Ask Codex to suggest test cases or generate tests for specific code
+- **explain** — Ask Codex to explain how specific code works
+- **debug** — Ask Codex to analyze a bug or error and suggest fixes
+- **general** — Any other consultation
+
+### Step 2: Gather context
+
+Before calling Codex, gather relevant context so you can craft a focused prompt:
+
+- Read the files relevant to the user's request
+- Check `git diff --stat` or `git log --oneline -10` if the request involves recent changes
+- Understand what specific question or area the user wants Codex's perspective on
+
+### Step 3: Call Codex
+
+Run Codex via `codex exec` in non-interactive mode. Always pass `-C` with the project directory.
+
+**For read-only consultation (review, explain, debug):**
+```bash
+codex exec -s read-only "YOUR_PROMPT" -C /path/to/project
+```
+
+**For code generation (test, plan with output):**
+```bash
+codex exec -s workspace-write "YOUR_PROMPT" -C /path/to/project
+```
+
+**For code review specifically:**
+```bash
+codex exec review -C /path/to/project
+```
+
+#### CLI Reference (codex-cli v0.114.0)
+
+| Flag | Description |
+|------|-------------|
+| `-s read-only` | Read-only sandbox — can read files but not modify |
+| `-s workspace-write` | Can write to workspace |
+| `-C /path` | Set working directory |
+| `-m MODEL` | Override model (e.g. `-m o3`) |
+| `--json` | Output events as JSONL |
+| `--ephemeral` | Don't persist session files |
+| `-o FILE` | Write last message to file |
+| `-c key=value` | Override config (e.g. `-c model="o3"`) |
+| `--full-auto` | Convenience alias for sandboxed auto-execution |
+
+**Do NOT use these (they don't exist):**
+- `--quiet` — not a valid flag
+- `--approval-mode` — not a valid flag
+- Top-level `codex "prompt"` for non-interactive — use `codex exec` instead
+
+#### Prompt crafting rules
+- Include the specific file paths and relevant code context
+- Be explicit about what you want: "Review this code for bugs", "Propose a plan to implement X", "Write unit tests for Y"
+- Include constraints: "This project uses [framework/language]. Follow existing patterns."
+- Keep it focused — one clear ask per invocation
+
+If the output is too large or Codex needs to examine many files, break it into multiple focused calls.
+
+If `codex` is not installed, tell the user:
+> Codex CLI is not installed. Install it with: `npm install -g @openai/codex`
+> Make sure your `OPENAI_API_KEY` environment variable is set.
+
+Then stop.
+
+### Step 4: Synthesize
+
+Do NOT just dump Codex's raw output. Instead:
+
+1. **Present Codex's perspective** — summarize its key points clearly
+2. **Add your own analysis** — where do you agree or disagree? What did it miss? What did it catch that you wouldn't have?
+3. **Highlight conflicts** — if Codex's suggestion contradicts the project's existing patterns or the user's preferences, flag it
+4. **Give a recommendation** — a clear, unified recommendation combining the best of both perspectives
+
+Format the output as:
+
+---
+
+## Codex Consultation
+
+**Query:** (what was asked)
+
+### Codex's Take
+(summarized key points from Codex output)
+
+### My Analysis
+(where you agree, disagree, or would extend Codex's suggestions)
+
+### Conflicts & Caveats
+(any contradictions with existing codebase patterns, CLAUDE.md rules, or project conventions)
+
+### Recommendation
+(unified recommendation — the best path forward considering both perspectives)
+
+---
+
+### Step 5: Offer next steps
+
+Ask the user if they want to:
+- Act on the recommendation
+- Ask Codex a follow-up question
+- Get deeper analysis on a specific point
+
+## Keeping This Skill Up To Date
+
+This skill was last verified against **codex-cli v0.114.0**. If Codex CLI is updated and commands fail, run `codex exec --help` to check current flags and update this skill accordingly. Common things that change between versions:
+- Flag names and aliases
+- Sandbox mode values
+- Subcommands (e.g. `exec review` was added later)
+- Default model names

package/skills/content-strategy/SKILL.md

@@ -1,365 +1,23 @@
 ---
 name: content-strategy
-description: When the user wants to plan a content strategy, decide what content to create, or figure out what topics to cover. Also use when the user mentions "content strategy," "what should I write about," "content ideas," "blog strategy," "topic clusters," "content planning," "editorial calendar," "content marketing," "content roadmap," "what content should I create," "blog topics," "content pillars," or "I don't know what to write." Use this whenever someone needs help deciding what content to produce, not just writing it. For writing individual pieces, see copywriting. For SEO-specific audits, see seo-audit. For social media content specifically, see social-content.
+description: "When the user wants to plan a content strategy, decide what content to create, figure out what topics to cover, or needs marketing ideas, growth tactics, and brainstorming. Also use when the user mentions 'content strategy,' 'what should I write about,' 'content ideas,' 'blog strategy,' 'topic clusters,' 'content planning,' 'editorial calendar,' 'content marketing,' 'content roadmap,' 'what content should I create,' 'blog topics,' 'content pillars,' 'I don't know what to write,' 'marketing ideas,' 'growth ideas,' 'how to market,' 'marketing strategies,' 'marketing tactics,' 'ways to promote,' 'ideas to grow,' 'what else can I try,' 'I don't know how to market this,' 'brainstorm marketing,' or 'what marketing should I do.' For writing individual pieces, see copywriting. For SEO-specific audits, see seo. For social media content specifically, see the marketing skill's social-content mode."
 metadata:
-  version: 1.1.0
+  version: 2.0.0
 ---
 
-# Content Strategy
+# Content Strategy & Marketing Ideas
 
-You are a content strategist. Your goal is to help plan content that drives traffic, builds authority, and generates leads by being either searchable, shareable, or both.
+This skill routes to the appropriate sub-skill based on your request.
 
-## Before Planning
+## Shared Context
 
-**Check for product marketing context first:**
-If `.agents/product-marketing-context.md` exists (or `.claude/product-marketing-context.md` in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
+If `.agents/product-marketing-context.md` exists (or `.claude/product-marketing-context.md` in older setups), read it first before proceeding.
 
-Gather this context (ask if not provided):
+## Routing
 
-### 1. Business Context
-- What does the company do?
-- Who is the ideal customer?
-- What's the primary goal for content? (traffic, leads, brand awareness, thought leadership)
-- What problems does your product solve?
+| Request Type | Route |
+|---|---|
+| Content planning, topic clusters, editorial calendar, content pillars, what to write about, content roadmap, keyword research, content prioritization | [strategy.md](strategy.md) |
+| Marketing ideas, growth tactics, brainstorming, marketing strategies, ways to promote, how to market, what else can I try, marketing inspiration | [ideas.md](ideas.md) |
 
-### 2. Customer Research
-- What questions do customers ask before buying?
-- What objections come up in sales calls?
-- What topics appear repeatedly in support tickets?
-- What language do customers use to describe their problems?
-
-### 3. Current State
-- Do you have existing content? What's working?
-- What resources do you have? (writers, budget, time)
-- What content formats can you produce? (written, video, audio)
-
-### 4. Competitive Landscape
-- Who are your main competitors?
-- What content gaps exist in your market?
-
----
-
-## Searchable vs Shareable
-
-Every piece of content must be searchable, shareable, or both. Prioritize in that order—search traffic is the foundation.
-
-**Searchable content** captures existing demand. Optimized for people actively looking for answers.
-
-**Shareable content** creates demand. Spreads ideas and gets people talking.
-
-### When Writing Searchable Content
-
-- Target a specific keyword or question
-- Match search intent exactly—answer what the searcher wants
-- Use clear titles that match search queries
-- Structure with headings that mirror search patterns
-- Place keywords in title, headings, first paragraph, URL
-- Provide comprehensive coverage (don't leave questions unanswered)
-- Include data, examples, and links to authoritative sources
-- Optimize for AI/LLM discovery: clear positioning, structured content, brand consistency across the web
-
-### When Writing Shareable Content
-
-- Lead with a novel insight, original data, or counterintuitive take
-- Challenge conventional wisdom with well-reasoned arguments
-- Tell stories that make people feel something
-- Create content people want to share to look smart or help others
-- Connect to current trends or emerging problems
-- Share vulnerable, honest experiences others can learn from
-
----
-
-## Content Types
-
-### Searchable Content Types
-
-**Use-Case Content**
-Formula: [persona] + [use-case]. Targets long-tail keywords.
-- "Project management for designers"
-- "Task tracking for developers"
-- "Client collaboration for freelancers"
-
-**Hub and Spoke**
-Hub = comprehensive overview. Spokes = related subtopics.
-```
-/topic (hub)
-├── /topic/subtopic-1 (spoke)
-├── /topic/subtopic-2 (spoke)
-└── /topic/subtopic-3 (spoke)
-```
-Create hub first, then build spokes. Interlink strategically.
-
-**Note:** Most content works fine under `/blog`. Only use dedicated hub/spoke URL structures for major topics with layered depth (e.g., Atlassian's `/agile` guide). For typical blog posts, `/blog/post-title` is sufficient.
-
-**Template Libraries**
-High-intent keywords + product adoption.
-- Target searches like "marketing plan template"
-- Provide immediate standalone value
-- Show how product enhances the template
-
-### Shareable Content Types
-
-**Thought Leadership**
-- Articulate concepts everyone feels but hasn't named
-- Challenge conventional wisdom with evidence
-- Share vulnerable, honest experiences
-
-**Data-Driven Content**
-- Product data analysis (anonymized insights)
-- Public data analysis (uncover patterns)
-- Original research (run experiments, share results)
-
-**Expert Roundups**
-15-30 experts answering one specific question. Built-in distribution.
-
-**Case Studies**
-Structure: Challenge → Solution → Results → Key learnings
-
-**Meta Content**
-Behind-the-scenes transparency. "How We Got Our First $5k MRR," "Why We Chose Debt Over VC."
-
-For programmatic content at scale, see **programmatic-seo** skill.
-
----
-
-## Content Pillars and Topic Clusters
-
-Content pillars are the 3-5 core topics your brand will own. Each pillar spawns a cluster of related content.
-
-Most of the time, all content can live under `/blog` with good internal linking between related posts. Dedicated pillar pages with custom URL structures (like `/guides/topic`) are only needed when you're building comprehensive resources with multiple layers of depth.
-
-### How to Identify Pillars
-
-1. **Product-led**: What problems does your product solve?
-2. **Audience-led**: What does your ICP need to learn?
-3. **Search-led**: What topics have volume in your space?
-4. **Competitor-led**: What are competitors ranking for?
-
-### Pillar Structure
-
-```
-Pillar Topic (Hub)
-├── Subtopic Cluster 1
-│   ├── Article A
-│   ├── Article B
-│   └── Article C
-├── Subtopic Cluster 2
-│   ├── Article D
-│   ├── Article E
-│   └── Article F
-└── Subtopic Cluster 3
-    ├── Article G
-    ├── Article H
-    └── Article I
-```
-
-### Pillar Criteria
-
-Good pillars should:
-- Align with your product/service
-- Match what your audience cares about
-- Have search volume and/or social interest
-- Be broad enough for many subtopics
-
----
-
-## Keyword Research by Buyer Stage
-
-Map topics to the buyer's journey using proven keyword modifiers:
-
-### Awareness Stage
-Modifiers: "what is," "how to," "guide to," "introduction to"
-
-Example: If customers ask about project management basics:
-- "What is Agile Project Management"
-- "Guide to Sprint Planning"
-- "How to Run a Standup Meeting"
-
-### Consideration Stage
-Modifiers: "best," "top," "vs," "alternatives," "comparison"
-
-Example: If customers evaluate multiple tools:
-- "Best Project Management Tools for Remote Teams"
-- "Asana vs Trello vs Monday"
-- "Basecamp Alternatives"
-
-### Decision Stage
-Modifiers: "pricing," "reviews," "demo," "trial," "buy"
-
-Example: If pricing comes up in sales calls:
-- "Project Management Tool Pricing Comparison"
-- "How to Choose the Right Plan"
-- "[Product] Reviews"
-
-### Implementation Stage
-Modifiers: "templates," "examples," "tutorial," "how to use," "setup"
-
-Example: If support tickets show implementation struggles:
-- "Project Template Library"
-- "Step-by-Step Setup Tutorial"
-- "How to Use [Feature]"
-
----
-
-## Content Ideation Sources
-
-### 1. Keyword Data
-
-If user provides keyword exports (Ahrefs, SEMrush, GSC), analyze for:
-- Topic clusters (group related keywords)
-- Buyer stage (awareness/consideration/decision/implementation)
-- Search intent (informational, commercial, transactional)
-- Quick wins (low competition + decent volume + high relevance)
-- Content gaps (keywords competitors rank for that you don't)
-
-Output as prioritized table:
-| Keyword | Volume | Difficulty | Buyer Stage | Content Type | Priority |
-
-### 2. Call Transcripts
-
-If user provides sales or customer call transcripts, extract:
-- Questions asked → FAQ content or blog posts
-- Pain points → problems in their own words
-- Objections → content to address proactively
-- Language patterns → exact phrases to use (voice of customer)
-- Competitor mentions → what they compared you to
-
-Output content ideas with supporting quotes.
-
-### 3. Survey Responses
-
-If user provides survey data, mine for:
-- Open-ended responses (topics and language)
-- Common themes (30%+ mention = high priority)
-- Resource requests (what they wish existed)
-- Content preferences (formats they want)
-
-### 4. Forum Research
-
-Use web search to find content ideas:
-
-**Reddit:** `site:reddit.com [topic]`
-- Top posts in relevant subreddits
-- Questions and frustrations in comments
-- Upvoted answers (validates what resonates)
-
-**Quora:** `site:quora.com [topic]`
-- Most-followed questions
-- Highly upvoted answers
-
-**Other:** Indie Hackers, Hacker News, Product Hunt, industry Slack/Discord
-
-Extract: FAQs, misconceptions, debates, problems being solved, terminology used.
-
-### 5. Competitor Analysis
-
-Use web search to analyze competitor content:
-
-**Find their content:** `site:competitor.com/blog`
-
-**Analyze:**
-- Top-performing posts (comments, shares)
-- Topics covered repeatedly
-- Gaps they haven't covered
-- Case studies (customer problems, use cases, results)
-- Content structure (pillars, categories, formats)
-
-**Identify opportunities:**
-- Topics you can cover better
-- Angles they're missing
-- Outdated content to improve on
-
-### 6. Sales and Support Input
-
-Extract from customer-facing teams:
-- Common objections
-- Repeated questions
-- Support ticket patterns
-- Success stories
-- Feature requests and underlying problems
-
----
-
-## Prioritizing Content Ideas
-
-Score each idea on four factors:
-
-### 1. Customer Impact (40%)
-- How frequently did this topic come up in research?
-- What percentage of customers face this challenge?
-- How emotionally charged was this pain point?
-- What's the potential LTV of customers with this need?
-
-### 2. Content-Market Fit (30%)
-- Does this align with problems your product solves?
-- Can you offer unique insights from customer research?
-- Do you have customer stories to support this?
-- Will this naturally lead to product interest?
-
-### 3. Search Potential (20%)
-- What's the monthly search volume?
-- How competitive is this topic?
-- Are there related long-tail opportunities?
-- Is search interest growing or declining?
-
-### 4. Resource Requirements (10%)
-- Do you have expertise to create authoritative content?
-- What additional research is needed?
-- What assets (graphics, data, examples) will you need?
-
-### Scoring Template
-
-| Idea | Customer Impact (40%) | Content-Market Fit (30%) | Search Potential (20%) | Resources (10%) | Total |
-|------|----------------------|-------------------------|----------------------|-----------------|-------|
-| Topic A | 8 | 9 | 7 | 6 | 8.0 |
-| Topic B | 6 | 7 | 9 | 8 | 7.1 |
-
----
-
-## Output Format
-
-When creating a content strategy, provide:
-
-### 1. Content Pillars
-- 3-5 pillars with rationale
-- Subtopic clusters for each pillar
-- How pillars connect to product
-
-### 2. Priority Topics
-For each recommended piece:
-- Topic/title
-- Searchable, shareable, or both
-- Content type (use-case, hub/spoke, thought leadership, etc.)
-- Target keyword and buyer stage
-- Why this topic (customer research backing)
-
-### 3. Topic Cluster Map
-Visual or structured representation of how content interconnects.
-
----
-
-## Task-Specific Questions
-
-1. What patterns emerge from your last 10 customer conversations?
-2. What questions keep coming up in sales calls?
-3. Where are competitors' content efforts falling short?
-4. What unique insights from customer research aren't being shared elsewhere?
-5. Which existing content drives the most conversions, and why?
-
----
-
-## References
-
-- **[Headless CMS Guide](references/headless-cms.md)**: CMS selection, content modeling for marketing, editorial workflows, platform comparison (Sanity, Contentful, Strapi)
-
----
-
-## Related Skills
-
-- **copywriting**: For writing individual content pieces
-- **seo-audit**: For technical SEO and on-page optimization
-- **ai-seo**: For optimizing content for AI search engines and getting cited by LLMs
-- **programmatic-seo**: For scaled content generation
-- **site-architecture**: For page hierarchy, navigation design, and URL structure
-- **email-sequence**: For email-based content
-- **social-content**: For social media content
+If the request spans both (e.g., "plan my content and give me marketing ideas"), use both sub-skills and synthesize a combined response.