noah-cursor 1.2.0 → 1.3.0

package/README.md

@@ -79,7 +79,6 @@ Examples:
 # Install from Noah's official registry
 npx noah-cursor add --skill test
 npx noah-cursor add --rule test
-npx noah-cursor add --preset test
 npx noah-cursor add --all
 npx noah-cursor add itsmenoahpoli/noah-cursor --skill commit-push
 
@@ -114,10 +113,14 @@ presets/
 ### Starter assets
 
 - **skill** `test`
+- **skill** `commit-push`
+- **skill** `react-doctor-fix` — run react-doctor, fix findings, verify no regressions
+- **skill** `larastan-fix` — run Larastan on Laravel, fix findings, verify no regressions
+- **skill** `nestjs-knip-fix` — run Knip on NestJS, fix unused code/deps, verify no regressions
+- **skill** `node-doctor-fix` — bundled node-doctor (Knip + package hygiene) for generic Node
 - **rule** `test`
-- **preset** `test` (installs both)
 
-Add curated Noah assets under those folders and register them in `manifest.json`.
+Add curated Noah assets under those folders and register them in `manifest.json`. Presets are supported by the CLI but none are published in this registry yet.
 
 ### manifest.json
 
@@ -143,16 +146,7 @@ Add curated Noah assets under those folders and register them in `manifest.json`
   ],
   "prompts": [],
   "mcp": [],
-  "presets": [
-    {
-      "id": "test",
-      "version": "1.0.0",
-      "includes": {
-        "skills": ["test"],
-        "rules": ["test"]
-      }
-    }
-  ]
+  "presets": []
 }
 ```
 

package/dist/noah-registry/manifest.json

@@ -15,6 +15,30 @@
       "version": "1.0.0",
       "description": "Stage all changes, group by category, draft a linepush-style commit, commit, and push",
       "tags": ["git", "commit", "push", "conventional-commits"]
+    },
+    {
+      "id": "react-doctor-fix",
+      "version": "1.0.0",
+      "description": "Run react-doctor, fix all findings, and verify features still work",
+      "tags": ["react", "react-doctor", "lint", "refactor", "qa"]
+    },
+    {
+      "id": "larastan-fix",
+      "version": "1.0.0",
+      "description": "Run Larastan on Laravel, fix all findings, and verify features still work",
+      "tags": ["laravel", "php", "larastan", "phpstan", "qa"]
+    },
+    {
+      "id": "nestjs-knip-fix",
+      "version": "1.0.0",
+      "description": "Run Knip on NestJS, fix unused code/deps, and verify features still work",
+      "tags": ["nestjs", "knip", "node", "typescript", "qa"]
+    },
+    {
+      "id": "node-doctor-fix",
+      "version": "1.0.0",
+      "description": "Run bundled node-doctor (Knip + hygiene), fix findings, verify features still work",
+      "tags": ["node", "knip", "doctor", "qa", "cli"]
     }
   ],
   "rules": [
@@ -57,29 +81,5 @@
   ],
   "prompts": [],
   "mcp": [],
-  "presets": [
-    {
-      "id": "test",
-      "version": "1.0.0",
-      "description": "Installs the sample test skill and rule",
-      "includes": {
-        "skills": ["test"],
-        "rules": ["test"]
-      }
-    },
-    {
-      "id": "noah-web-stack",
-      "version": "1.0.0",
-      "description": "Full Noah web stack rules: architecture, React SPA, Laravel API, Next.js and Nuxt marketing",
-      "includes": {
-        "rules": [
-          "stack-architecture",
-          "react-spa-dashboard",
-          "laravel-api",
-          "nextjs-marketing",
-          "nuxt-marketing"
-        ]
-      }
-    }
-  ]
+  "presets": []
 }

package/dist/noah-registry/skills/larastan-fix/SKILL.md

@@ -0,0 +1,203 @@
+---
+name: larastan-fix
+description: >-
+  Runs Larastan (PHPStan for Laravel), constructs fixes for all findings, and
+  verifies that implementations, features, and functionalities are not broken
+  after changes. Use when the user runs /larastan-fix, asks to run Larastan,
+  PHPStan on a Laravel app, clean up static analysis errors, or fix Larastan
+  findings without regressions.
+disable-model-invocation: true
+---
+
+# /larastan-fix
+
+Run **Larastan** (PHPStan + Laravel extension), fix **all** findings, and prove behavior still works.
+
+Do **not** stop after the first file. Do **not** mass-ignore or regenerate a baseline to “pass.” Prefer root-cause fixes. After every batch of edits, re-verify with project checks so implementations, features, and functionalities are not broken.
+
+## Workflow
+
+Copy this checklist and track progress:
+
+```
+Larastan Fix Progress:
+- [ ] 1. Confirm Laravel project + Larastan setup + verification commands
+- [ ] 2. Baseline analyse
+- [ ] 3. Triage findings (priority order)
+- [ ] 4. Fix in batches (explain → edit → verify)
+- [ ] 5. Re-analyse until clean (or document intentional leftovers)
+- [ ] 6. Final verification + report
+```
+
+### 1. Confirm Laravel project + Larastan setup + verification commands
+
+From the project root:
+
+1. Confirm this is a Laravel app (`artisan`, `composer.json` with `laravel/framework`) — abort with a clear message if not.
+2. Confirm Larastan is available:
+
+```bash
+composer show larastan/larastan 2>/dev/null || composer show nunomaduro/larastan 2>/dev/null
+test -f phpstan.neon -o -f phpstan.neon.dist -o -f phpstan.dist.neon
+test -x vendor/bin/phpstan
+```
+
+If Larastan / PHPStan is missing, install only with user approval:
+
+```bash
+composer require --dev larastan/larastan
+```
+
+Ensure config includes the Larastan extension (create `phpstan.neon` only if none exists and the user wants setup):
+
+```neon
+includes:
+    - vendor/larastan/larastan/extension.neon
+    - vendor/nesbot/carbon/extension.neon
+
+parameters:
+    paths:
+        - app/
+    level: 5
+```
+
+Do **not** raise the configured level unless the user asks. Analyse at the project’s configured level.
+
+3. Detect verification commands. Prefer existing Composer / Artisan scripts:
+
+```bash
+composer test                    # or phpunit / pest
+php artisan test
+vendor/bin/pest
+vendor/bin/phpunit
+vendor/bin/pint --test           # style check only; not a substitute for tests
+php artisan route:list           # smoke when helpful
+```
+
+Record the chosen commands before editing. If no tests exist, say so and still use the strongest available checks (at least a second Larastan run + Pint if present).
+
+### 2. Baseline analyse
+
+Use the project binary (respects `phpstan.neon*`):
+
+```bash
+./vendor/bin/phpstan analyse --memory-limit=2G
+```
+
+If Composer defines a script (`composer phpstan` / `composer analyse`), prefer that.
+
+For machine-readable output when practical:
+
+```bash
+./vendor/bin/phpstan analyse --memory-limit=2G --error-format=json > .larastan-baseline.json
+```
+
+Delete or leave untracked any temporary report files before finishing.
+
+Path-scoped cleanup only when the user asks:
+
+```bash
+./vendor/bin/phpstan analyse app/Http/Controllers --memory-limit=2G
+```
+
+Default for this skill is a **full** configured analyse unless the user scopes it.
+
+### 3. Triage findings
+
+Work findings in this priority:
+
+1. **Runtime-breaking** — undefined methods/properties, wrong argument counts, impossible types that would crash
+2. **Null safety** — unsafe property/method access on nullable models, requests, relations
+3. **Laravel / Eloquent correctness** — wrong relation types, builder misuse, container/`auth`/`request` type gaps Larastan flags
+4. **PHPDoc / generics** — collection/model generics, `@var` / `@param` / `@return` that hide real bugs
+5. **Dead code / unreachable** — always-true/false conditions, unused private methods (only remove when safe)
+6. **Remaining level noise** — stricter level complaints that need small, local typing improvements
+
+Group by file or by shared root cause (e.g. one incomplete Form Request type used everywhere).
+
+### 4. Fix in batches (explain → edit → verify)
+
+For each batch (prefer one error identifier / one file group):
+
+1. **Explain the fix** briefly: what PHPStan reported, why the change is safe, what runtime behavior must stay the same.
+2. **Edit** the minimum code needed. Match Laravel project patterns (Form Requests, Actions, Eloquent APIs, API Resources).
+3. **Verify immediately** with the commands from step 1 (fastest relevant suite after each batch; full suite before the final report).
+4. If verification fails: **revert or repair** before continuing. Never leave the tree broken to chase a clean Larastan run.
+
+#### Fix construction rules
+
+- Preserve HTTP contracts: routes, status codes, JSON shapes, validation rules, auth/gates, jobs/events side effects.
+- Prefer real types and narrowing (`=== null` checks, early returns, assert helpers) over silencing.
+- Prefer accurate PHPDoc / generics on Eloquent models and collections when the code is already correct.
+- Do not change business logic to satisfy the analyser when a precise type assertion or request DTO is enough.
+- Do not upgrade Laravel/PHP major versions or rewrite architecture unless the user expands scope.
+- Keep diffs small and reviewable.
+
+#### Ignores / baseline (last resort only)
+
+Prefer fixing the root cause. Use ignores only when:
+
+- the finding is a true false positive for this Laravel version/package, **or**
+- a correct fix would be an out-of-scope rewrite the user did not approve
+
+Narrow inline ignore:
+
+```php
+// @phpstan-ignore-next-line
+```
+
+Or identifier-based ignores when the project PHPStan version supports them. Prefer next-line / specific `ignoreErrors` path patterns over global rules.
+
+Do **not** run `--generate-baseline` to clear findings unless the user explicitly asks for a baseline workflow.
+
+Document every ignore in the final report with file, message/identifier, and reason.
+
+### 5. Re-analyse until clean
+
+After fixes:
+
+```bash
+./vendor/bin/phpstan analyse --memory-limit=2G
+```
+
+Repeat triage → fix → verify until:
+
+- analyse exits 0 with no errors, **or**
+- only explicitly approved / documented ignores or deferred items remain
+
+Do not claim “all clear” if analyse still fails.
+
+### 6. Final verification + report
+
+Run the full verification set from step 1 again.
+
+Report in this shape:
+
+```markdown
+## Larastan fix report
+
+### Analyse
+- Config: <phpstan.neon*|level>
+- Baseline: <N errors>
+- Final: <clean | N remaining>
+
+### Fixed
+- <error summary> — file(s) — one-line fix summary
+
+### Ignores
+- none | file:line — reason
+
+### Verification
+- <command> — pass/fail
+- <command> — pass/fail
+
+### Deferred (needs user decision)
+- <finding> — why not fixed
+```
+
+## Safety
+
+- Do not commit or push unless the user asks.
+- Do not use `--force` git commands.
+- Do not commit secrets (`.env`, credentials).
+- Stop and ask if a “fix” requires deleting substantial features, changing API contracts, or broad behavioral changes.

package/dist/noah-registry/skills/nestjs-knip-fix/SKILL.md

@@ -0,0 +1,147 @@
+---
+name: nestjs-knip-fix
+description: >-
+  Runs Knip on NestJS projects, constructs fixes for unused files, exports, and
+  dependencies, and verifies that implementations, features, and functionalities
+  are not broken after changes. Use when the user runs /nestjs-knip-fix, asks
+  to run knip on NestJS, clean up unused NestJS code, or fix Knip findings
+  without regressions.
+disable-model-invocation: true
+---
+
+# /nestjs-knip-fix
+
+Run **`npx knip`** on a **NestJS** app, fix **all** findings, and prove behavior still works.
+
+Do **not** stop after the first issue type. Do **not** mass-ignore. Prefer root-cause removals and export cleanups. After every batch of edits, re-verify so implementations, features, and functionalities are not broken.
+
+## Workflow
+
+Copy this checklist and track progress:
+
+```
+NestJS Knip Fix Progress:
+- [ ] 1. Confirm NestJS project + verification commands
+- [ ] 2. Ensure Knip config (Nest-aware)
+- [ ] 3. Baseline knip scan
+- [ ] 4. Triage findings (priority order)
+- [ ] 5. Fix in batches (explain → edit → verify)
+- [ ] 6. Re-scan until clean (or document intentional leftovers)
+- [ ] 7. Final verification + report
+```
+
+### 1. Confirm NestJS project + verification commands
+
+From the project root:
+
+1. Confirm NestJS (`@nestjs/core` in `package.json`, usually `nest-cli.json` / `src/main.ts`) — abort if not.
+2. Detect verification commands (prefer existing scripts):
+
+```bash
+npm test                 # or pnpm / yarn / bun
+npm run test:e2e
+npm run build            # nest build / tsc
+npm run lint
+npx tsc --noEmit
+```
+
+Record the chosen commands before editing.
+
+### 2. Ensure Knip config (Nest-aware)
+
+If the project has no `knip.json` / `knip.ts` / `knip` field in `package.json`, copy the skill template into the project root as `knip.json`:
+
+- Template: [`config/knip.nestjs.json`](config/knip.nestjs.json)
+
+Adjust `entry` / `project` for monorepos (`apps/*`, `libs/*`) when needed. Prefer extending the template over inventing a blank config.
+
+Do not overwrite an existing Knip config unless the user asks — merge Nest entry patterns into the existing config instead.
+
+### 3. Baseline knip scan
+
+```bash
+npx knip --no-progress
+```
+
+If a local config path is required:
+
+```bash
+npx knip --config knip.json --no-progress
+```
+
+Optional production-only pass (after the default scan is clean or when the user asks):
+
+```bash
+npx knip --production --no-progress
+```
+
+Capture output for triage. Default for this skill is a **full** workspace scan unless the user scopes it.
+
+### 4. Triage findings
+
+Work findings in this priority:
+
+1. **Unused dependencies / devDependencies** — remove from `package.json` only after confirming Nest/CLI/plugins do not need them
+2. **Unlisted dependencies** — add the real import to `dependencies` / `devDependencies` (do not rely on transitive deps)
+3. **Unused files** — delete only when not dynamically loaded (`i18n`, `assets`, `path.join(__dirname, …)`, Nest schematics paths)
+4. **Unused exports** — remove `export` or delete dead symbols; keep Nest decorators’ public APIs (`@Module` providers/controllers/imports that Knip misunderstands → fix config, don’t gut the module)
+5. **Duplicate / enum / namespace export noise** — resolve carefully; suppress only as last resort
+
+**NestJS cautions**
+
+- Controllers, providers, guards, interceptors, pipes, filters registered only via module metadata must stay reachable from entry modules — if Knip says unused, verify `*.module.ts` wiring first.
+- Do not remove `main.ts`, `app.module.ts`, or Nest CLI schematics entrypoints.
+- Spec / e2e files: prefer config `ignore` / project patterns over deleting tests.
+
+### 5. Fix in batches (explain → edit → verify)
+
+For each batch:
+
+1. **Explain** what Knip reported and why the change is safe.
+2. **Edit** the minimum (package.json, exports, delete files).
+3. **Verify** with build + unit tests (and e2e when relevant).
+4. If verification fails: **revert or repair** before continuing.
+
+#### Fix construction rules
+
+- Preserve HTTP routes, DTO contracts, swagger models, queues, cron jobs, and microservice patterns.
+- Prefer removing unused exports over deleting whole Nest providers that are still registered.
+- Run `npm install` / lockfile update after dependency changes.
+- Keep diffs small. No drive-by refactors.
+
+#### Ignores (last resort)
+
+Use Knip `ignore`, `ignoreDependencies`, or `ignoreBinaries` only for true false positives (Nest dynamic modules, intentional public SDK barrels). Document each ignore in the final report.
+
+### 6. Re-scan until clean
+
+```bash
+npx knip --no-progress
+```
+
+Repeat until exit 0 or only approved ignores remain.
+
+### 7. Final verification + report
+
+```markdown
+## NestJS Knip fix report
+
+### Scan
+- Baseline: <summary>
+- Final: <clean | remaining>
+
+### Fixed
+- <issue type> — <what changed>
+
+### Ignores / config
+- none | <item> — reason
+
+### Verification
+- <command> — pass/fail
+```
+
+## Safety
+
+- Do not commit or push unless the user asks.
+- Do not delete `.env` or secrets.
+- Stop and ask before removing large feature modules or public API packages.

package/dist/noah-registry/skills/nestjs-knip-fix/config/knip.nestjs.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://unpkg.com/knip@5/schema.json",
+  "entry": [
+    "src/main.ts",
+    "src/main.js",
+    "apps/**/src/main.ts",
+    "src/**/*.module.ts",
+    "apps/**/*.module.ts",
+    "libs/**/src/index.ts",
+    "test/**/*.ts",
+    "test/**/*.js"
+  ],
+  "project": [
+    "src/**/*.{ts,js}",
+    "apps/**/*.{ts,js}",
+    "libs/**/*.{ts,js}",
+    "test/**/*.{ts,js}"
+  ],
+  "ignore": [
+    "**/*.spec.ts",
+    "**/*.e2e-spec.ts",
+    "dist/**",
+    "coverage/**"
+  ],
+  "ignoreDependencies": [
+    "@nestjs/schematics",
+    "@nestjs/testing"
+  ]
+}

package/dist/noah-registry/skills/node-doctor-fix/SKILL.md

@@ -0,0 +1,146 @@
+---
+name: node-doctor-fix
+description: >-
+  Runs the bundled node-doctor tool (Knip + package hygiene) on generic Node.js
+  projects, constructs fixes for all findings, and verifies that implementations,
+  features, and functionalities are not broken after changes. Use when the user
+  runs /node-doctor-fix, asks to doctor a Node.js package/CLI, clean unused
+  Node exports/deps, or fix node-doctor findings without regressions.
+disable-model-invocation: true
+---
+
+# /node-doctor-fix
+
+Run the bundled **`node-doctor`** tool on a **generic Node.js** project (library, CLI, or service — not Nest/Next-first apps), fix **all** findings, and prove behavior still works.
+
+`node-doctor` = **Knip** (unused files / exports / dependencies) using [`config/node-doctor.knip.json`](config/node-doctor.knip.json) when the project has no Knip config, **plus** package hygiene checks (`bin` / `main` / `exports` / script paths / `engines.node`).
+
+Do **not** mass-ignore. Prefer root-cause fixes. After every batch of edits, re-verify so implementations, features, and functionalities are not broken.
+
+## Workflow
+
+Copy this checklist and track progress:
+
+```
+Node Doctor Fix Progress:
+- [ ] 1. Confirm Node project + route frameworks elsewhere
+- [ ] 2. Baseline node-doctor scan
+- [ ] 3. Triage findings (priority order)
+- [ ] 4. Fix in batches (explain → edit → verify)
+- [ ] 5. Re-scan until clean (or document intentional leftovers)
+- [ ] 6. Final verification + report
+```
+
+### 1. Confirm Node project + route frameworks elsewhere
+
+From the project root:
+
+1. Confirm `package.json` exists.
+2. If the app is primarily **NestJS** → use `/nestjs-knip-fix` instead.
+3. If the app is primarily **React** → use `/react-doctor-fix` (optionally Knip later).
+4. Detect verification commands:
+
+```bash
+npm test
+npm run typecheck   # or npx tsc --noEmit
+npm run lint
+npm run build
+node ./dist/index.js --help   # CLIs when applicable
+```
+
+### 2. Baseline node-doctor scan
+
+Resolve the skill directory (installed under `.cursor/skills/node-doctor-fix` or this registry path), then:
+
+```bash
+node <skillDir>/scripts/node-doctor.mjs . --json > .node-doctor-baseline.json
+node <skillDir>/scripts/node-doctor.mjs .
+```
+
+Examples:
+
+```bash
+node .cursor/skills/node-doctor-fix/scripts/node-doctor.mjs .
+node skills/node-doctor-fix/scripts/node-doctor.mjs .
+```
+
+Flags:
+
+- `--json` — machine-readable findings
+- `--knip-only` — skip package hygiene
+- `--hygiene-only` — skip Knip
+
+If the project already has `knip.json` / `package.json#knip`, node-doctor uses that for Knip; otherwise it uses the bundled [`config/node-doctor.knip.json`](config/node-doctor.knip.json).
+
+Delete temporary report files before finishing (or keep them untracked).
+
+### 3. Triage findings
+
+Priority:
+
+1. **Broken package entrypoints** — missing `bin` / `main` / `exports` / script paths (hygiene errors)
+2. **Unlisted dependencies** — add real imports to package.json
+3. **Unused dependencies** — remove only when not required by tooling/config plugins
+4. **Unused files** — delete when not dynamically required
+5. **Unused exports / types** — remove or stop exporting
+6. **Hygiene warnings** — e.g. missing `engines.node`
+
+### 4. Fix in batches (explain → edit → verify)
+
+For each batch:
+
+1. **Explain** the finding and why the fix is safe.
+2. **Edit** minimally (`package.json`, exports, delete dead files).
+3. **Verify** with test / typecheck / build / CLI smoke.
+4. On failure: **revert or repair** before continuing.
+
+#### Fix construction rules
+
+- Preserve public package API (`exports`, documented CLI flags, published bin names).
+- Do not remove files loaded dynamically (`fs.readFile`, runtime plugin paths) without proof.
+- Update the lockfile after dependency changes.
+- Do not convert the project into Nest/Next-specific structure.
+
+#### Ignores (last resort)
+
+Prefer fixing. If Knip false-positives remain, add narrow `ignore` / `ignoreDependencies` to the **project** Knip config (create one from the bundled config rather than silencing the tool). Document every ignore.
+
+### 5. Re-scan until clean
+
+```bash
+node <skillDir>/scripts/node-doctor.mjs .
+```
+
+Exit code must be `0` (or only approved documented leftovers remain).
+
+### 6. Final verification + report
+
+```markdown
+## Node doctor fix report
+
+### Scan
+- Baseline: <N findings>
+- Final: <clean | N remaining>
+
+### Fixed
+- <type> — summary
+
+### Ignores / config
+- none | item — reason
+
+### Verification
+- <command> — pass/fail
+```
+
+## Tool reference
+
+| Path | Role |
+|------|------|
+| `scripts/node-doctor.mjs` | CLI analyser |
+| `config/node-doctor.knip.json` | Default Knip config for generic Node |
+
+## Safety
+
+- Do not commit or push unless the user asks.
+- Do not commit secrets.
+- Stop and ask before deleting public API surface or major packages.

package/dist/noah-registry/skills/node-doctor-fix/config/node-doctor.knip.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://unpkg.com/knip@5/schema.json",
+  "entry": [
+    "{index,cli,main,app,server}.{js,cjs,mjs,ts,cts,mts}",
+    "src/{index,cli,main,app,server}.{js,cjs,mjs,ts,cts,mts}",
+    "bin/**/*.{js,cjs,mjs,ts}",
+    "scripts/**/*.{js,cjs,mjs,ts}"
+  ],
+  "project": [
+    "**/*.{js,cjs,mjs,ts,cts,mts}!"
+  ],
+  "ignore": [
+    "**/dist/**",
+    "**/build/**",
+    "**/coverage/**",
+    "**/.next/**",
+    "**/node_modules/**"
+  ],
+  "ignoreBinaries": [
+    "noah-cursor"
+  ]
+}

package/dist/noah-registry/skills/node-doctor-fix/scripts/node-doctor.mjs

@@ -0,0 +1,393 @@
+#!/usr/bin/env node
+/**
+ * node-doctor — analyse a generic Node.js project.
+ *
+ * Combines:
+ *  1) Knip (unused files / exports / dependencies) using the bundled config
+ *  2) Package hygiene checks (bin/main/exports/scripts paths, engines)
+ *
+ * Usage:
+ *   node scripts/node-doctor.mjs [projectDir] [--json] [--knip-only] [--hygiene-only]
+ *
+ * Exit codes: 0 clean, 1 findings, 2 usage/setup error
+ */
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const DEFAULT_KNIP_CONFIG = path.resolve(
+  __dirname,
+  "../config/node-doctor.knip.json",
+);
+
+function parseArgs(argv) {
+  const opts = {
+    dir: process.cwd(),
+    json: false,
+    knipOnly: false,
+    hygieneOnly: false,
+  };
+
+  for (const arg of argv) {
+    if (arg === "--json") opts.json = true;
+    else if (arg === "--knip-only") opts.knipOnly = true;
+    else if (arg === "--hygiene-only") opts.hygieneOnly = true;
+    else if (arg === "--help" || arg === "-h") opts.help = true;
+    else if (arg.startsWith("-")) {
+      throw new Error(`Unknown flag: ${arg}`);
+    } else opts.dir = path.resolve(arg);
+  }
+
+  return opts;
+}
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, "utf8"));
+}
+
+function exists(filePath) {
+  try {
+    fs.accessSync(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isNodeProject(dir) {
+  return exists(path.join(dir, "package.json"));
+}
+
+function looksLikeFrameworkProject(pkg) {
+  const all = {
+    ...pkg.dependencies,
+    ...pkg.devDependencies,
+    ...pkg.peerDependencies,
+  };
+  const keys = Object.keys(all ?? {});
+  return {
+    nest: keys.some((k) => k.startsWith("@nestjs/")),
+    next: keys.includes("next"),
+    react: keys.includes("react") && !keys.includes("next"),
+    laravelHint: false,
+  };
+}
+
+/** Resolve package.json "exports" / "bin" / "main" targets to filesystem paths. */
+function collectPackagePaths(pkg, dir) {
+  const targets = [];
+
+  const add = (rel, kind, label) => {
+    if (!rel || typeof rel !== "string") return;
+    if (rel.startsWith("http:") || rel.startsWith("https:") || rel.startsWith("node:")) {
+      return;
+    }
+    const cleaned = rel.replace(/^\.\//, "");
+    targets.push({ kind, label, rel: cleaned, abs: path.join(dir, cleaned) });
+  };
+
+  if (pkg.main) add(pkg.main, "main", "main");
+  if (pkg.module) add(pkg.module, "module", "module");
+  if (pkg.types) add(pkg.types, "types", "types");
+  if (pkg.typings) add(pkg.typings, "types", "typings");
+
+  if (typeof pkg.bin === "string") add(pkg.bin, "bin", "bin");
+  else if (pkg.bin && typeof pkg.bin === "object") {
+    for (const [name, rel] of Object.entries(pkg.bin)) {
+      add(rel, "bin", `bin.${name}`);
+    }
+  }
+
+  const walkExports = (value, label) => {
+    if (!value) return;
+    if (typeof value === "string") add(value, "exports", label);
+    else if (typeof value === "object") {
+      for (const [k, v] of Object.entries(value)) {
+        walkExports(v, `${label}.${k}`);
+      }
+    }
+  };
+  walkExports(pkg.exports, "exports");
+
+  return targets;
+}
+
+function scriptLocalRefs(script) {
+  if (typeof script !== "string") return [];
+  const refs = [];
+  const patterns = [
+    /\bnode\s+([./][^\s]+)/g,
+    /\bts-node\s+([./][^\s]+)/g,
+    /\btsx\s+([./][^\s]+)/g,
+    /\bsh\s+([./][^\s]+)/g,
+    /\bbash\s+([./][^\s]+)/g,
+  ];
+  for (const re of patterns) {
+    let m;
+    while ((m = re.exec(script)) !== null) {
+      refs.push(m[1]);
+    }
+  }
+  return refs;
+}
+
+function runHygiene(dir, pkg) {
+  const findings = [];
+
+  if (!pkg.name) {
+    findings.push({
+      type: "package-hygiene",
+      severity: "error",
+      message: 'package.json is missing "name"',
+      file: "package.json",
+    });
+  }
+  if (!pkg.version) {
+    findings.push({
+      type: "package-hygiene",
+      severity: "error",
+      message: 'package.json is missing "version"',
+      file: "package.json",
+    });
+  }
+
+  if (!pkg.engines?.node) {
+    findings.push({
+      type: "package-hygiene",
+      severity: "warning",
+      message: 'package.json is missing "engines.node" (recommended for Node libraries/CLIs)',
+      file: "package.json",
+    });
+  }
+
+  for (const target of collectPackagePaths(pkg, dir)) {
+    if (!exists(target.abs)) {
+      findings.push({
+        type: "package-hygiene",
+        severity: "error",
+        message: `${target.label} points to missing file: ${target.rel}`,
+        file: "package.json",
+      });
+    }
+  }
+
+  if (pkg.scripts && typeof pkg.scripts === "object") {
+    for (const [name, script] of Object.entries(pkg.scripts)) {
+      for (const ref of scriptLocalRefs(script)) {
+        const abs = path.resolve(dir, ref);
+        if (!exists(abs)) {
+          findings.push({
+            type: "package-hygiene",
+            severity: "error",
+            message: `scripts.${name} references missing file: ${ref}`,
+            file: "package.json",
+          });
+        }
+      }
+    }
+  }
+
+  return findings;
+}
+
+function runKnip(dir) {
+  if (!exists(DEFAULT_KNIP_CONFIG)) {
+    return {
+      ok: false,
+      findings: [
+        {
+          type: "setup",
+          severity: "error",
+          message: `Bundled Knip config missing: ${DEFAULT_KNIP_CONFIG}`,
+        },
+      ],
+      raw: "",
+    };
+  }
+
+  // Prefer project knip config when present; otherwise use bundled Node defaults.
+  const projectConfigs = ["knip.json", "knip.jsonc", "knip.ts", "knip.config.ts"];
+  const hasProjectConfig = projectConfigs.some((f) => exists(path.join(dir, f))) ||
+    (() => {
+      try {
+        const pkg = readJson(path.join(dir, "package.json"));
+        return Boolean(pkg.knip);
+      } catch {
+        return false;
+      }
+    })();
+
+  const args = ["knip", "--no-progress", "--reporter", "json"];
+  if (!hasProjectConfig) {
+    args.push("--config", DEFAULT_KNIP_CONFIG);
+  }
+
+  const result = spawnSync("npx", args, {
+    cwd: dir,
+    encoding: "utf8",
+    shell: process.platform === "win32",
+    env: process.env,
+  });
+
+  const raw = `${result.stdout ?? ""}${result.stderr ?? ""}`.trim();
+  const findings = [];
+
+  // Knip JSON reporter may print a JSON object or array; also tolerate text fallback.
+  try {
+    const parsed = JSON.parse(result.stdout || "null");
+    if (parsed && typeof parsed === "object") {
+      const pushIssue = (type, items) => {
+        if (!Array.isArray(items)) return;
+        for (const item of items) {
+          const file = item.file ?? item.name ?? item.path ?? undefined;
+          const name = item.name ?? item.symbol ?? item.identifier;
+          findings.push({
+            type,
+            severity: "error",
+            message: name ? `${type}: ${name}` : String(type),
+            file,
+            raw: item,
+          });
+        }
+      };
+
+      // Shape varies by knip version — handle common keys.
+      pushIssue("unused-files", parsed.files);
+      pushIssue("unused-dependencies", parsed.dependencies);
+      pushIssue("unused-devDependencies", parsed.devDependencies);
+      pushIssue("unlisted-dependencies", parsed.unlisted);
+      pushIssue("unused-exports", parsed.exports);
+      pushIssue("unused-types", parsed.types);
+      pushIssue("unused-duplicates", parsed.duplicates);
+      pushIssue("unused-enumMembers", parsed.enumMembers);
+      pushIssue("unused-namespaceMembers", parsed.nsExports ?? parsed.nsTypes);
+      pushIssue("unused-binaries", parsed.binaries);
+
+      if (Array.isArray(parsed.issues)) {
+        for (const issue of parsed.issues) {
+          findings.push({
+            type: issue.type ?? "knip",
+            severity: "error",
+            message: issue.message ?? JSON.stringify(issue),
+            file: issue.file,
+            raw: issue,
+          });
+        }
+      }
+    }
+  } catch {
+    if (result.status && result.status !== 0 && raw) {
+      findings.push({
+        type: "knip",
+        severity: "error",
+        message: "Knip reported issues (see raw output)",
+        raw,
+      });
+    }
+  }
+
+  // If JSON parse yielded nothing but knip failed, surface stdout/stderr.
+  if (findings.length === 0 && result.status && result.status !== 0) {
+    findings.push({
+      type: "knip",
+      severity: "error",
+      message: raw || `knip exited with code ${result.status}`,
+    });
+  }
+
+  return { ok: result.status === 0 && findings.length === 0, findings, raw, status: result.status };
+}
+
+function printHuman(findings, knipRaw) {
+  if (findings.length === 0) {
+    console.log("node-doctor: clean — no findings");
+    return;
+  }
+
+  console.log(`node-doctor: ${findings.length} finding(s)\n`);
+  const byType = new Map();
+  for (const f of findings) {
+    const list = byType.get(f.type) ?? [];
+    list.push(f);
+    byType.set(f.type, list);
+  }
+
+  for (const [type, list] of byType) {
+    console.log(`${type} (${list.length})`);
+    for (const f of list) {
+      const loc = f.file ? ` ${f.file}` : "";
+      console.log(`  - [${f.severity}]${loc} ${f.message}`);
+    }
+    console.log();
+  }
+
+  if (knipRaw && findings.some((f) => f.type === "knip" && f.raw === knipRaw)) {
+    console.log("knip raw output:\n" + knipRaw);
+  }
+}
+
+function main() {
+  let opts;
+  try {
+    opts = parseArgs(process.argv.slice(2));
+  } catch (error) {
+    console.error(String(error instanceof Error ? error.message : error));
+    process.exit(2);
+  }
+
+  if (opts.help) {
+    console.log(`Usage: node-doctor.mjs [projectDir] [--json] [--knip-only] [--hygiene-only]`);
+    process.exit(0);
+  }
+
+  const dir = opts.dir;
+  if (!isNodeProject(dir)) {
+    console.error(`Not a Node.js project (package.json missing): ${dir}`);
+    process.exit(2);
+  }
+
+  const pkg = readJson(path.join(dir, "package.json"));
+  const frameworks = looksLikeFrameworkProject(pkg);
+  if (frameworks.nest) {
+    console.error(
+      "This looks like a NestJS project. Use /nestjs-knip-fix (npx knip) instead of node-doctor.",
+    );
+    process.exit(2);
+  }
+
+  const findings = [];
+  let knipRaw = "";
+
+  if (!opts.hygieneOnly) {
+    const knip = runKnip(dir);
+    knipRaw = knip.raw;
+    findings.push(...knip.findings);
+  }
+
+  if (!opts.knipOnly) {
+    findings.push(...runHygiene(dir, pkg));
+  }
+
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        {
+          tool: "node-doctor",
+          cwd: dir,
+          findingCount: findings.length,
+          findings,
+        },
+        null,
+        2,
+      ),
+    );
+  } else {
+    printHuman(findings, knipRaw);
+  }
+
+  process.exit(findings.length === 0 ? 0 : 1);
+}
+
+main();

package/dist/noah-registry/skills/react-doctor-fix/SKILL.md

@@ -0,0 +1,185 @@
+---
+name: react-doctor-fix
+description: >-
+  Runs react-doctor, constructs fixes for all findings, and verifies that
+  implementations, features, and functionalities are not broken after changes.
+  Use when the user runs /react-doctor-fix, asks to run react-doctor, clean up
+  React Doctor diagnostics, or fix React Doctor findings without regressions.
+disable-model-invocation: true
+---
+
+# /react-doctor-fix
+
+Run **React Doctor**, fix **all** findings, and prove behavior still works.
+
+Do **not** stop after the first category. Do **not** mass-suppress. Prefer root-cause fixes. After every batch of edits, re-verify with project checks so implementations, features, and functionalities are not broken.
+
+## Workflow
+
+Copy this checklist and track progress:
+
+```
+React Doctor Fix Progress:
+- [ ] 1. Confirm React project + available verification commands
+- [ ] 2. Baseline scan (verbose + JSON)
+- [ ] 3. Triage findings (priority order)
+- [ ] 4. Fix in batches (explain → edit → verify)
+- [ ] 5. Re-scan until clean (or document intentional leftovers)
+- [ ] 6. Final verification + report
+```
+
+### 1. Confirm React project + verification commands
+
+From the project root:
+
+1. Confirm this is a React / Next.js / Vite / Remix / Expo (or similar) app — abort with a clear message if not.
+2. Detect how to verify nothing broke. Prefer existing scripts from `package.json` in this order when present:
+
+```bash
+npm test          # or pnpm / yarn / bun equivalent
+npm run typecheck # or tsc --noEmit
+npm run lint
+npm run build
+```
+
+Record the chosen commands before editing. If none exist, use the strongest available subset (at least typecheck or build) and say what you could not run.
+
+Optional monorepo:
+
+```bash
+npx react-doctor@latest -y --verbose --project <name>
+```
+
+### 2. Baseline scan
+
+Always non-interactive for agents:
+
+```bash
+npx react-doctor@latest -y --verbose --no-score
+```
+
+Also capture machine-readable output when practical:
+
+```bash
+npx react-doctor@latest -y --verbose --no-score --json > .react-doctor-baseline.json
+```
+
+If the JSON file would be committed accidentally, delete it before finishing (or keep it untracked). Prefer a temp path when easy.
+
+For branch-scoped cleanup only (when the user asks for changed files / PR noise only):
+
+```bash
+npx react-doctor@latest -y --verbose --no-score --scope changed
+```
+
+Default for this skill is a **full** scan unless the user scopes it.
+
+### 3. Triage findings
+
+Work findings in this priority:
+
+1. **Security**
+2. **Correctness** / broken behavior risks
+3. **State & effects** (derived state in effects, effect loops, missing deps that matter)
+4. **Performance**
+5. **Accessibility**
+6. **Architecture** / dead code / bundle / remaining warnings
+
+Within a priority, fix `error` before `warning`.
+
+For an unclear rule:
+
+```bash
+npx react-doctor@latest rules explain <rule>
+npx react-doctor@latest why path/to/file.tsx:123
+```
+
+Optional per-rule guidance from React Doctor prompts (when helpful):
+
+`https://www.react.doctor/prompts/rules/react-doctor/<rule>.md`
+
+Example: `https://www.react.doctor/prompts/rules/react-doctor/no-derived-state.md`
+
+### 4. Fix in batches (explain → edit → verify)
+
+For each batch (prefer one rule or one tightly related file group):
+
+1. **Explain the fix** briefly: what is wrong, why the change is safe, what behavior must stay the same.
+2. **Edit** the minimum code needed. Match project patterns. Do not drive-by refactors.
+3. **Verify immediately** with the commands from step 1 (at least the fastest relevant ones after each batch; full suite before the final report).
+4. If verification fails: **revert or repair** the fix before continuing. Never leave the tree broken to chase a cleaner doctor score.
+
+#### Fix construction rules
+
+- Preserve public behavior, routes, props contracts, visible UI, and user flows.
+- Prefer derived values during render over syncing state in `useEffect`.
+- Prefer event handlers / key handlers over effect-driven “do X when Y changes” when Y is a user action.
+- Do not remove “unused” exports/files that are part of a public package API, generated barrels, or framework entrypoints without confirming.
+- Do not change dependency versions unless a finding explicitly requires it and the user wants that scope.
+- Keep diffs small and reviewable.
+
+#### Suppressions (last resort only)
+
+Prefer fixing the root cause. Suppress only when:
+
+- the finding is a true false positive for this codebase, **or**
+- a correct fix would be an out-of-scope rewrite the user did not approve
+
+Keep suppressions narrow:
+
+```tsx
+// react-doctor-disable-next-line react-doctor/no-derived-state
+```
+
+Never disable whole categories (`rules category … off`) unless the user explicitly asks.
+
+Document every suppression in the final report with file, rule, and reason.
+
+### 5. Re-scan until clean
+
+After fixes:
+
+```bash
+npx react-doctor@latest -y --verbose --no-score
+```
+
+Repeat triage → fix → verify until:
+
+- the scan reports no remaining findings, **or**
+- only explicitly approved / documented suppressions or deferred items remain
+
+Do not claim “all clear” if the scan still fails.
+
+### 6. Final verification + report
+
+Run the full verification set from step 1 again.
+
+Report in this shape:
+
+```markdown
+## React Doctor fix report
+
+### Scan
+- Baseline: <N findings / score if shown>
+- Final: <clean | N remaining>
+
+### Fixed
+- `rule-id` — file(s) — one-line fix summary
+
+### Suppressions
+- none | `rule-id` @ file:line — reason
+
+### Verification
+- <command> — pass/fail
+- <command> — pass/fail
+
+### Deferred (needs user decision)
+- <finding> — why not fixed
+```
+
+## Safety
+
+- Do not commit or push unless the user asks.
+- Do not use `--force` git commands.
+- Do not run `react-doctor` network-sharing flows that the user declined; `--no-score` avoids score/share API usage.
+- Stop and ask if a “fix” requires deleting substantial features, changing product behavior, or broad API breakage.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "noah-cursor",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Install Noah's reusable Cursor assets (Skills, Rules, Prompts, MCP configs, Presets)",
   "type": "module",
   "bin": {

package/dist/noah-registry/presets/noah-web-stack/preset.json

@@ -1,3 +0,0 @@
-{
-  "description": "Noah fullstack rules — React SPA dashboard, Laravel API, Next and Nuxt marketing"
-}

package/dist/noah-registry/presets/test/preset.json

@@ -1,3 +0,0 @@
-{
-  "description": "Preset metadata — assets are resolved via manifest includes"
-}