opencode-skills-collection 4.1.15 → 4.1.16

package/bundled-skills/wcag-audit-patterns/resources/implementation-playbook.md

@@ -8,8 +8,8 @@ This file contains detailed patterns, checklists, and code samples referenced by
 
 | Level   | Description            | Required For      |
 | ------- | ---------------------- | ----------------- |
-| **A**   | Minimum accessibility  | Legal baseline    |
-| **AA**  | Standard conformance   | Most regulations  |
+| **A**   | Minimum WCAG conformance | Applicability depends on jurisdiction and policy    |
+| **AA**  | Standard WCAG conformance | Confirm the exact applicable requirement  |
 | **AAA** | Enhanced accessibility | Specialized needs |
 
 ### 2. POUR Principles
@@ -47,7 +47,6 @@ Moderate:
 
 ### Perceivable (Principle 1)
 
-````markdown
 ## 1.1 Text Alternatives
 
 ### 1.1.1 Non-text Content (Level A)
@@ -69,8 +68,6 @@ Check:
 <img src="chart.png" />
 <img src="decorative-line.png" alt="decorative line" />
 ```
-````
-
 ## 1.2 Time-based Media
 
 ### 1.2.1 Audio-only and Video-only (Level A)
@@ -84,9 +81,9 @@ Check:
 - [ ] Captions are accurate and complete
 - [ ] Speaker identification included
 
-### 1.2.3 Audio Description (Level A)
+### 1.2.3 Audio Description or Media Alternative (Level A)
 
-- [ ] Video has audio description for visual content
+- [ ] Prerecorded synchronized media has an appropriate audio description or full text alternative, subject to the criterion’s exceptions
 
 ## 1.3 Adaptable
 
@@ -171,11 +168,8 @@ Tools: WebAIM Contrast Checker, axe DevTools
 - [ ] Letter spacing 0.12x font size
 - [ ] Word spacing 0.16x font size
 
-````
-
 ### Operable (Principle 2)
 
-```markdown
 ## 2.1 Keyboard Accessible
 
 ### 2.1.1 Keyboard (Level A)
@@ -185,11 +179,10 @@ Tools: WebAIM Contrast Checker, axe DevTools
 - [ ] Custom widgets are keyboard operable
 
 Check:
-```javascript
-// Custom button must be keyboard accessible
-<div role="button" tabindex="0"
-     onkeydown="if(event.key === 'Enter' || event.key === ' ') activate()">
-````
+```html
+<!-- Prefer a native button: keyboard activation and role are built in. -->
+<button type="button" onclick="activate()">Open details</button>
+```
 
 ### 2.1.2 No Keyboard Trap (Level A)
 
@@ -285,11 +278,8 @@ Check:
 - [ ] Focused element not fully hidden
 - [ ] Sticky headers don't obscure focus
 
-````
-
 ### Understandable (Principle 3)
 
-```markdown
 ## 3.1 Readable
 
 ### 3.1.1 Language of Page (Level A)
@@ -298,7 +288,7 @@ Check:
 
 ```html
 <html lang="en">
-````
+```
 
 ### 3.1.2 Language of Parts (Level AA)
 
@@ -360,11 +350,8 @@ Check:
 - [ ] Data checked before submission
 - [ ] User can review before submit
 
-````
-
 ### Robust (Principle 4)
 
-```markdown
 ## 4.1 Compatible
 
 ### 4.1.1 Parsing (Level A) - Obsolete in WCAG 2.2
@@ -378,14 +365,10 @@ Check:
 - [ ] State changes announced
 
 ```html
-<!-- Accessible custom checkbox -->
-<div role="checkbox"
-     aria-checked="false"
-     tabindex="0"
-     aria-labelledby="label">
-</div>
-<span id="label">Accept terms</span>
-````
+<!-- Native checkbox includes keyboard handling and checked state. -->
+<input type="checkbox" id="accept-terms" name="accept-terms" />
+<label for="accept-terms">Accept terms</label>
+```
 
 ### 4.1.3 Status Messages (Level AA)
 
@@ -398,8 +381,6 @@ Check:
 <div role="alert" aria-live="assertive">Error: Form submission failed</div>
 ```
 
-````
-
 ## Automated Testing
 
 ```javascript
@@ -432,7 +413,7 @@ test('should have no accessibility violations', async ({ page }) => {
 
   expect(results.violations).toHaveLength(0);
 });
-````
+```
 
 Use CLI tools only if the project already has reviewed, lockfile-pinned installations. Run from that project and replace the example URL with its authorized local/test target. If a binary is absent, report the missing prerequisite; do not download or install a moving package to complete an audit. Browser testing may load third-party resources, so keep real credentials and sensitive records out of test fixtures.
 

package/bundled-skills/web-performance-optimization/SKILL.md

@@ -15,9 +15,9 @@ Read [the detailed guide](references/detailed-guide.md) before executing this sk
 ## When to Use This Skill
 
 - Use when website or app is loading slowly
-- Use when optimizing for Core Web Vitals (LCP, FID, CLS)
+- Use when optimizing for Core Web Vitals (LCP, INP, CLS)
 - Use when reducing JavaScript bundle size
-- Use when improving Time to Interactive (TTI)
+- Use when reducing main-thread blocking and slow interactions (INP)
 - Use when optimizing images and assets
 - Use when implementing caching strategies
 - Use when debugging performance bottlenecks
@@ -32,14 +32,14 @@ Read [the detailed guide](references/detailed-guide.md) before executing this sk
 
 ### Current Metrics (Before Optimization)
 - **LCP (Largest Contentful Paint):** 4.2s ❌ (should be < 2.5s)
-- **FID (First Input Delay):** 180ms ❌ (should be < 100ms)
+- **INP (Interaction to Next Paint):** 350ms ❌ (should be ≤ 200ms)
 - **CLS (Cumulative Layout Shift):** 0.25 ❌ (should be < 0.1)
 - **Lighthouse Score:** 62/100
 
 ### Issues Identified
 
 1. **LCP Issue:** Hero image (2.5MB) loads slowly
-2. **FID Issue:** Large JavaScript bundle (850KB) blocks main thread
+2. **INP Issue:** Large JavaScript bundle (850KB) blocks main thread
 3. **CLS Issue:** Images without dimensions cause layout shifts
 
 ### Optimization Plan
@@ -73,7 +73,7 @@ Read [the detailed guide](references/detailed-guide.md) before executing this sk
 - Use CDN for faster delivery
 - Preload hero image: `<link rel="preload" as="image" href="/hero.avif">`
 
-#### Fix FID (First Input Delay)
+#### Fix INP (Interaction to Next Paint)
 
 **Problem:** 850KB JavaScript bundle blocks main thread
 
@@ -157,7 +157,7 @@ npm install date-fns
 ### Results After Optimization
 
 - **LCP:** 1.8s ✅ (improved by 57%)
-- **FID:** 45ms ✅ (improved by 75%)
+- **INP:** 150ms ✅ (improved by 57%)
 - **CLS:** 0.05 ✅ (improved by 80%)
 - **Lighthouse Score:** 94/100 ✅
 ```
@@ -247,18 +247,18 @@ const AdminPanel = dynamic(() => import('./AdminPanel'), {
 #### 4. Remove Dead Code
 
 \`\`\`javascript
-// Enable tree shaking in webpack.config.js
+// Tree shaking in webpack.config.js: production mode already enables
+// optimization.usedExports and optimization.sideEffects.
+// Do not set optimization.sideEffects to false: that turns the optimization off.
 module.exports = {
-  mode: 'production',
-  optimization: {
-    usedExports: true,
-    sideEffects: false
-  }
+  mode: 'production'
 };
 
-// In package.json
+// In package.json: mark modules as side-effect-free, but list the files
+// that must run when imported (CSS, polyfills). A blanket
+// "sideEffects": false lets the bundler drop `import './styles.css'`.
 {
-  "sideEffects": false
+  "sideEffects": ["*.css", "*.scss", "./src/polyfills.js"]
 }
 \`\`\`
 
@@ -376,7 +376,7 @@ images.forEach(img => {
     alt="Hero image"
     width="1200"
     height="600"
-    loading="lazy"
+    fetchpriority="high"
   >
 </picture>
 \`\`\`

package/bundled-skills/web-performance-optimization/references/detailed-guide.md

@@ -13,7 +13,7 @@ Help developers optimize website and web application performance to improve user
 
 I'll help you establish baseline metrics:
 - Run Lighthouse audits
-- Measure Core Web Vitals (LCP, FID, CLS)
+- Measure Core Web Vitals (LCP, INP, CLS)
 - Check bundle sizes
 - Analyze network waterfall
 - Identify performance bottlenecks
@@ -98,7 +98,7 @@ lighthouse https://yoursite.com --throttling.cpuSlowdownMultiplier=4
 ```
 
 ### Problem: Large JavaScript Bundle
-**Symptoms:** Long Time to Interactive (TTI), high FID
+**Symptoms:** Long main-thread tasks, high INP, high Total Blocking Time (TBT) in Lighthouse
 **Solution:**
 - Analyze bundle with webpack-bundle-analyzer
 - Remove unused dependencies
@@ -116,11 +116,17 @@ npx webpack-bundle-analyzer dist/stats.json
 - Use aspect-ratio CSS property
 - Reserve space with skeleton loaders
 ```css
+/* Keep each image's own ratio; the width/height attributes reserve the space */
 img {
-  aspect-ratio: 16 / 9;
-  width: 100%;
+  max-width: 100%;
   height: auto;
 }
+
+/* Force a ratio only where a fixed frame is intended */
+.hero img {
+  aspect-ratio: 16 / 9;
+  object-fit: cover;
+}
 ```
 
 ### Problem: Slow Server Response Time
@@ -176,10 +182,9 @@ export async function getStaticProps() {
 
 ### Core Web Vitals
 - [ ] LCP < 2.5s
-- [ ] FID < 100ms
+- [ ] INP ≤ 200ms
 - [ ] CLS < 0.1
 - [ ] TTFB < 600ms
-- [ ] TTI < 3.8s
 
 
 ## Performance Tools
@@ -223,4 +228,4 @@ export async function getStaticProps() {
 
 ---
 
-**Pro Tip:** Focus on Core Web Vitals (LCP, FID, CLS) first - they have the biggest impact on user experience and SEO rankings!
+**Pro Tip:** Focus on Core Web Vitals (LCP, INP, CLS) first - they have the biggest impact on user experience and SEO rankings!

package/bundled-skills/web3-testing/SKILL.md

@@ -5,6 +5,22 @@ risk: critical
 source: community
 date_added: "2026-02-27"
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+- `<support-root>/references/hardhat-setup.md`
+- `<support-root>/references/foundry-setup.md`
+- `<support-root>/references/test-patterns.md`
+- `<support-root>/references/mainnet-forking.md`
+- `<support-root>/references/contract-verification.md`
+- `<support-root>/assets/hardhat-config.js`
+- `<support-root>/assets/test-suite.js`
+- `<support-root>/assets/foundry.toml`
+- `<support-root>/scripts/test-contract.sh`
+
+Ask for the original supporting material or an existing installation before using a step that depends on these paths; this catalog does not identify a verified download source for them. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # Web3 Smart Contract Testing
 
@@ -20,7 +36,6 @@ Master comprehensive testing strategies for smart contracts using Hardhat, Found
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Use this skill when
 

package/bundled-skills/workflow-orchestration-patterns/SKILL.md

@@ -25,7 +25,6 @@ Master workflow orchestration architecture with Temporal, covering fundamental d
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## When to Use Workflow Orchestration
 
@@ -220,7 +219,7 @@ For each step:
 
 **Solutions**:
 
-1. **Versioning API**: Use `workflow.get_version()` for safe changes
+1. **Versioning API**: Bind the procedure to the actual SDK language and installed version. Python uses `workflow.patched` / `workflow.deprecate_patch`; other SDKs have different APIs. Replay existing histories before deployment; follow [official Python versioning guidance](https://docs.temporal.io/develop/python/versioning).
 2. **New Workflow Type**: Create new workflow, route new executions to it
 3. **Backward Compatibility**: Ensure old events replay correctly
 

package/bundled-skills/zcode-delegate/SKILL.md

@@ -18,6 +18,10 @@ compatibility: Requires the `zcode` CLI (Z.AI ZCode) with a configured model pro
 metadata:
   version: 0.5.0
 ---
+## Bundled upstream support
+
+Supporting files are included at skill-relative paths. See [UPSTREAM-NOTICE.md](UPSTREAM-NOTICE.md) for their pinned sources, licenses, hashes, and import changes.
+
 # ZCode Delegate
 
 ## When to Use
@@ -169,7 +173,7 @@ Full checklist: [references/review-and-land.md](references/review-and-land.md).
 
 ## Read-only second opinions
 
-The relay doubles as a way to get an adversarial second opinion with no write risk: dispatch
+The relay doubles as a way to get an adversarial second opinion with write detection, not a sandbox: dispatch
 `--read-only` with a brief listing the agreed points, then each contested point with both positions,
 and ask ZCode to defend or concede each. Because plan mode's guarantee is measured rather than
 enforced here, verify `touchedFiles` came back empty instead of assuming no edits.
@@ -196,7 +200,11 @@ correct completion needs going beyond the brief, ask). The full treatment is in
 
 ## Limitations
 
-- Docs-only import — executable `scripts/relay.mjs` not included; see upstream for full runtime. Requires `zcode` CLI, Node 18+, git.
+- `.cmd`/`.bat` shell shims are refused before version probing or dispatch. On Windows select a reviewed ZCode Node CLI entry (`.cjs`/`.mjs`/`.js`) or native executable using `--zcode-path`; arguments are passed directly with shell execution disabled. Local refusal regressions do not prove native Windows execution.
+
+- Runtime helper `scripts/relay.mjs` is bundled from the revision recorded in `UPSTREAM-NOTICE.md`. Requires the corresponding installed and authenticated CLI, Node 18+, and git.
 - Relay never commits — it only returns structured result JSON; you review and land the commit.
 
-> Adapted from [amElnagdy/delegate-skills](https://github.com/amElnagdy/delegate-skills) (MIT) — docs-only, runtime not bundled.
+> Adapted from [amElnagdy/delegate-skills](https://github.com/amElnagdy/delegate-skills) (MIT). The relay runtime and support references are bundled; the authenticated ZCode CLI is not.
+
+Run artifacts use a fresh private temporary directory by default. A supplied `--out-dir` must be a new path; existing directories and links are rejected to preserve prior briefs/results. The directory is owner-only on POSIX; verify equivalent ACLs on Windows.

package/bundled-skills/zcode-delegate/UPSTREAM-LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ahmed Mohammed (amElnagdy)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bundled-skills/zcode-delegate/UPSTREAM-NOTICE.md

@@ -0,0 +1,13 @@
+# Upstream helpers for zcode-delegate
+
+The files listed below were recovered from [amElnagdy/delegate-skills](https://github.com/amElnagdy/delegate-skills) at commit `3aa72d681a79e2a9d09bd9a316353003ae1cb4a7`. The repository ID is `1269124956`.
+
+They retain the upstream **MIT** license reproduced in [UPSTREAM-LICENSE.txt](UPSTREAM-LICENSE.txt). This notice applies to the listed support files; it does not replace the license metadata of other catalog files. Preserve the upstream license and this attribution when redistributing them.
+
+License wording is unchanged; text-only trailing whitespace and EOF blank lines are normalized. Original license: https://github.com/amElnagdy/delegate-skills/blob/3aa72d681a79e2a9d09bd9a316353003ae1cb4a7/LICENSE
+
+| Local file | Original upstream path | Original Git blob SHA | Import changes |
+| --- | --- | --- | --- |
+| `scripts/relay.mjs` | `skills/zcode-delegate/scripts/relay.mjs` | `edd888755afe9c2202443267e6dff09289168b06` | AAS refuses shell shims before version probing/dispatch and requires a reviewed Node CLI entry or native executable; shell execution remains disabled. Import-safe refusal checks support local regression review. Original source remains linked for comparison. |
+
+The relay launches the user-installed, authenticated agent CLI. Write-capable modes can approve child tools automatically; they are not a host sandbox. Invoke only for explicitly authorized delegation, keep credentials out of task briefs, and review the child output and project changes before landing them. This import does not run the CLI.

package/bundled-skills/zcode-delegate/references/dispatch-and-poll.md

@@ -12,8 +12,8 @@ cat brief.txt | node "<skill-dir>/scripts/relay.mjs" --cd /path/to/repo
 ZCode does not install a `zcode` binary on PATH and does not publish one to npm — the CLI ships
 inside the desktop app. The relay resolves it in this order, first hit wins:
 
-1. `zcode` on **PATH** — if you made a shim or alias, this is used.
-2. **`--zcode-path <file>`**, else the **`ZCODE_CLI`** environment variable.
+1. **`--zcode-path <file>`**, else the **`ZCODE_CLI`** environment variable.
+2. `zcode` on **PATH** — an actual executable/shim, not a shell alias.
 3. The installed **app bundle**: `%LOCALAPPDATA%\Programs\ZCode\resources\glm\zcode.cjs` on Windows,
    `/Applications/ZCode.app/…` (and `~/Applications/…`) on macOS. Linux ships an AppImage with no
    fixed install path, so there is nothing to auto-discover there — use option 1 or 2.
@@ -87,8 +87,8 @@ The run is finished when `result.json` exists with a `status` *and* the process
 
 ZCode's `--json` prints a single JSON document at the end rather than a stream of events, and the
 relay parses it tolerantly: the bundled AI SDK sometimes prints a warning banner on stdout ahead of
-the JSON, so leading non-JSON lines are skipped. The raw stdout is preserved at `outputPath` and the
-final report at `finalPath`, so nothing is lost if parsing degrades.
+the JSON, so leading non-JSON lines are skipped. The bounded stdout head is preserved at `outputPath` and the
+final report at `finalPath`, and truncation is reported. Output beyond the relay buffer limit is not retained; do not claim complete raw-stream preservation.
 
 If the document cannot be parsed at all: