oneshot-stack-team 0.1.0

package/README.md

@@ -0,0 +1,45 @@
+# OneShot Team Stack
+
+A team bundle that keeps the stable `oneshot-stack` core unchanged and adds reusable review, testing, and security skills.
+
+## One-command setup
+
+Run this from the root of any Git repository:
+
+```bash
+npx --yes --prefer-online oneshot-stack-team@latest install
+```
+
+The installer adds:
+
+- `.github/agents/oneshot.agent.md`
+- `.github/hooks/scripts/`
+- `.github/skills/code-review/SKILL.md`
+- `.github/skills/testing/SKILL.md`
+- `.github/skills/security-check/SKILL.md`
+- `.vscode/mcp.json`
+
+It uses local Ollama through the core OneShot MCP server. Ollama only prepares repository context and task guidance; Copilot writes the implementation.
+
+## After installation
+
+1. Reload VS Code with `Developer: Reload Window`.
+2. Start a new Copilot Chat session.
+3. Select the `OneShot` custom agent.
+4. Paste a short feature request or a complete Jira ticket.
+
+For implementation, debugging, refactoring, testing, code analysis, and ticket work, OneShot prepares `.oneshot/context.json` and `.oneshot/prompt.md` first. For simple explanations and locating questions, it answers directly without MCP preparation.
+
+## Local model
+
+The team bundle does not install Ollama automatically. Install Ollama once per computer and pull the default model:
+
+```bash
+ollama pull qwen3:8b
+```
+
+The MCP configuration uses `http://127.0.0.1:11434`. The model and all source analysis stay local.
+
+## Notes
+
+The bundle is additive and does not replace the stable `oneshot-stack` package. Existing `.github/copilot-instructions.md`, `.github/agents/oneshot.agent.md`, hooks, and `.vscode/mcp.json` files are preserved by the core installer.

package/bin/oneshot-stack-team.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+import fsSync from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const packageRoot = path.resolve(new URL('..', import.meta.url).pathname);
+const root = process.cwd();
+const command = process.argv[2] || 'install';
+
+function baseInstaller() {
+  const installer = path.join(packageRoot, 'node_modules', 'oneshot-stack', 'bin', 'oneshot-stack.js');
+  const result = spawnSync(process.execPath, [installer, 'install'], { cwd: root, stdio: 'inherit', env: process.env });
+  if (result.status !== 0) throw new Error('Base OneShot installation failed.');
+}
+
+async function installSkills() {
+  const destination = path.join(root, '.github', 'skills');
+  await fs.mkdir(destination, { recursive: true });
+  for (const skill of ['code-review', 'testing', 'security-check']) {
+    const source = path.join(packageRoot, 'config', 'skills', skill, 'SKILL.md');
+    const targetDir = path.join(destination, skill);
+    await fs.mkdir(targetDir, { recursive: true });
+    await fs.copyFile(source, path.join(targetDir, 'SKILL.md'));
+    console.log(`Added ${path.join(destination, skill, 'SKILL.md')}`);
+  }
+}
+
+async function main() {
+  if (command !== 'install') throw new Error('Usage: oneshot-stack-team install');
+  if (!fsSync.existsSync(path.join(root, '.git'))) console.warn('Warning: run this command from the repository root.');
+  baseInstaller();
+  await installSkills();
+  console.log('\nOneShot Team Stack installation complete. Reload VS Code and select OneShot.');
+}
+
+main().catch(error => { console.error(`Error: ${error.message}`); process.exitCode = 1; });

package/config/skills/code-review/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: code-review
+description: Use when reviewing implementation changes for bugs, regressions, security risks, missing tests, and unmet acceptance criteria.
+---
+
+# Code Review
+
+Review the diff before reporting completion.
+
+- Prioritize correctness, regressions, data loss, security, and missing tests.
+- Check every acceptance criterion against concrete implementation evidence.
+- Check error, empty, loading, permission, persistence, and compatibility states where relevant.
+- Report findings first, ordered by severity, with file references.
+- Do not rewrite unrelated code.

package/config/skills/security-check/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: security-check
+description: Use when implementation touches credentials, user data, external services, files, exports, authentication, or network requests.
+---
+
+# Security Check
+
+Inspect the change for accidental exposure and unsafe boundaries.
+
+- Never include secrets, tokens, cookies, or private keys in generated context, logs, exports, or responses.
+- Validate untrusted input at external boundaries.
+- Check authentication and authorization failures.
+- Avoid real network calls in tests.
+- Report residual security assumptions before completion.

package/config/skills/testing/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: testing
+description: Use when adding or reviewing tests for a feature, bug fix, API, UI, persistence, or integration behavior.
+---
+
+# Testing
+
+Create focused tests for each behavioral requirement.
+
+- Cover happy paths, validation failures, empty states, loading states, errors, and permissions where applicable.
+- Test public behavior through the narrowest stable boundary.
+- Keep tests deterministic and isolated; mock external services.
+- Run focused tests first, then the repository test and build commands.
+- Report untested requirements explicitly.

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "oneshot-stack-team",
+  "version": "0.1.0",
+  "description": "Team workflow bundle for OneShot Stack with review, testing, and security skills",
+  "type": "module",
+  "bin": {
+    "oneshot-stack-team": "bin/oneshot-stack-team.js"
+  },
+  "files": ["bin", "config", "README.md", "package.json"],
+  "scripts": {
+    "test": "node --test"
+  },
+  "dependencies": {
+    "oneshot-stack": "0.6.13"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "MIT"
+}