opencodekit 0.20.1 → 0.20.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (52) hide show
  1. package/dist/index.js +1 -1
  2. package/dist/template/.opencode/agent/build.md +4 -0
  3. package/dist/template/.opencode/agent/explore.md +4 -0
  4. package/dist/template/.opencode/agent/general.md +4 -0
  5. package/dist/template/.opencode/agent/plan.md +4 -0
  6. package/dist/template/.opencode/agent/review.md +4 -0
  7. package/dist/template/.opencode/agent/scout.md +4 -0
  8. package/dist/template/.opencode/command/create.md +119 -25
  9. package/dist/template/.opencode/command/design.md +1 -2
  10. package/dist/template/.opencode/command/health.md +234 -0
  11. package/dist/template/.opencode/command/init-user.md +15 -0
  12. package/dist/template/.opencode/command/plan.md +3 -4
  13. package/dist/template/.opencode/command/pr.md +13 -0
  14. package/dist/template/.opencode/command/research.md +15 -3
  15. package/dist/template/.opencode/command/review-codebase.md +11 -1
  16. package/dist/template/.opencode/command/ship.md +72 -8
  17. package/dist/template/.opencode/command/status.md +1 -1
  18. package/dist/template/.opencode/command/ui-review.md +0 -1
  19. package/dist/template/.opencode/command/ui-slop-check.md +1 -1
  20. package/dist/template/.opencode/command/verify.md +11 -1
  21. package/dist/template/.opencode/dcp.jsonc +31 -24
  22. package/dist/template/.opencode/memory.db +0 -0
  23. package/dist/template/.opencode/memory.db-shm +0 -0
  24. package/dist/template/.opencode/memory.db-wal +0 -0
  25. package/dist/template/.opencode/opencode.json +1678 -1677
  26. package/dist/template/.opencode/package.json +1 -1
  27. package/dist/template/.opencode/plugin/lib/compile.ts +253 -0
  28. package/dist/template/.opencode/plugin/lib/index-generator.ts +170 -0
  29. package/dist/template/.opencode/plugin/lib/lint.ts +359 -0
  30. package/dist/template/.opencode/plugin/lib/memory-admin-tools.ts +42 -1
  31. package/dist/template/.opencode/plugin/lib/memory-db.ts +7 -0
  32. package/dist/template/.opencode/plugin/lib/memory-helpers.ts +30 -0
  33. package/dist/template/.opencode/plugin/lib/memory-hooks.ts +10 -0
  34. package/dist/template/.opencode/plugin/lib/memory-tools.ts +30 -1
  35. package/dist/template/.opencode/plugin/lib/operation-log.ts +109 -0
  36. package/dist/template/.opencode/plugin/lib/validate.ts +243 -0
  37. package/dist/template/.opencode/skill/design-taste-frontend/SKILL.md +13 -1
  38. package/dist/template/.opencode/skill/figma-go/SKILL.md +1 -1
  39. package/dist/template/.opencode/skill/full-output-enforcement/SKILL.md +13 -0
  40. package/dist/template/.opencode/skill/high-end-visual-design/SKILL.md +13 -0
  41. package/dist/template/.opencode/skill/industrial-brutalist-ui/SKILL.md +13 -0
  42. package/dist/template/.opencode/skill/memory-system/SKILL.md +65 -1
  43. package/dist/template/.opencode/skill/minimalist-ui/SKILL.md +13 -0
  44. package/dist/template/.opencode/skill/redesign-existing-projects/SKILL.md +13 -0
  45. package/dist/template/.opencode/skill/requesting-code-review/SKILL.md +48 -2
  46. package/dist/template/.opencode/skill/requesting-code-review/references/specialist-profiles.md +108 -0
  47. package/dist/template/.opencode/skill/skill-creator/SKILL.md +25 -0
  48. package/dist/template/.opencode/skill/stitch-design-taste/SKILL.md +13 -0
  49. package/dist/template/.opencode/skill/verification-before-completion/SKILL.md +46 -0
  50. package/package.json +1 -1
  51. package/dist/template/.opencode/agent/runner.md +0 -79
  52. package/dist/template/.opencode/command/start.md +0 -156
@@ -0,0 +1,243 @@
1
+ /**
2
+ * Observation Validation Gate
3
+ *
4
+ * Inspired by jumperz's Secondmate Hermes validation:
5
+ * checks for duplicates and contradictions BEFORE storing an observation.
6
+ *
7
+ * Unlike Secondmate's approach (separate LLM model), this uses
8
+ * FTS5 similarity search + heuristic contradiction detection.
9
+ *
10
+ * Returns a validation result that can:
11
+ * - PASS: store normally
12
+ * - WARN: store but flag issues
13
+ * - REJECT: don't store, return reason
14
+ */
15
+
16
+ import type { ObservationInput, ObservationRow } from "./db/types.js";
17
+ import { getMemoryDB } from "./memory-db.js";
18
+ import { hasWord } from "./memory-helpers.js";
19
+ import { appendOperationLog } from "./operation-log.js";
20
+
21
+ // ============================================================================
22
+ // Types
23
+ // ============================================================================
24
+
25
+ export type ValidationVerdict = "pass" | "warn" | "reject";
26
+
27
+ export interface ValidationResult {
28
+ verdict: ValidationVerdict;
29
+ issues: ValidationIssue[];
30
+ /** If a near-duplicate was found, its ID */
31
+ duplicateOf?: number;
32
+ }
33
+
34
+ export interface ValidationIssue {
35
+ type: "duplicate" | "near-duplicate" | "contradiction" | "low-quality";
36
+ severity: "high" | "medium" | "low";
37
+ message: string;
38
+ relatedId?: number;
39
+ }
40
+
41
+ // ============================================================================
42
+ // Validation
43
+ // ============================================================================
44
+
45
+ /**
46
+ * Validate an observation before storing.
47
+ * Returns verdict (pass/warn/reject) with issues.
48
+ */
49
+ export function validateObservation(input: ObservationInput): ValidationResult {
50
+ const issues: ValidationIssue[] = [];
51
+
52
+ // Check 1: Exact title duplicate
53
+ const exactDup = findExactDuplicate(input);
54
+ if (exactDup) {
55
+ // If it's explicitly superseding, that's fine
56
+ if (input.supersedes === exactDup.id) {
57
+ // Intentional supersede — pass
58
+ } else {
59
+ issues.push({
60
+ type: "duplicate",
61
+ severity: "high",
62
+ message: `Exact duplicate of #${exactDup.id}: "${exactDup.title}"`,
63
+ relatedId: exactDup.id,
64
+ });
65
+
66
+ appendOperationLog({
67
+ operation: "observation-duplicate-warning",
68
+ targets: [`#${exactDup.id}`],
69
+ summary: `Duplicate warning: "${input.title}" (matches #${exactDup.id})`,
70
+ });
71
+
72
+ return {
73
+ verdict: "warn",
74
+ issues,
75
+ duplicateOf: exactDup.id,
76
+ };
77
+ }
78
+ }
79
+
80
+ // Check 2: Near-duplicate via FTS5
81
+ const nearDup = findNearDuplicate(input);
82
+ if (nearDup) {
83
+ issues.push({
84
+ type: "near-duplicate",
85
+ severity: "medium",
86
+ message: `Similar to #${nearDup.id}: "${nearDup.title}" (consider superseding)`,
87
+ relatedId: nearDup.id,
88
+ });
89
+ }
90
+
91
+ // Check 3: Contradiction with existing decisions
92
+ if (input.type === "decision") {
93
+ const contradiction = findContradiction(input);
94
+ if (contradiction) {
95
+ issues.push({
96
+ type: "contradiction",
97
+ severity: "medium",
98
+ message: `May contradict #${contradiction.id}: "${contradiction.title}"`,
99
+ relatedId: contradiction.id,
100
+ });
101
+ }
102
+ }
103
+
104
+ // Check 4: Low quality (no narrative, no concepts)
105
+ if (!input.narrative && !input.concepts) {
106
+ issues.push({
107
+ type: "low-quality",
108
+ severity: "low",
109
+ message:
110
+ "Observation has no narrative and no concepts — low knowledge value",
111
+ });
112
+ }
113
+
114
+ // Determine verdict
115
+ const hasHigh = issues.some((i) => i.severity === "high");
116
+ const verdict: ValidationVerdict = hasHigh
117
+ ? "reject"
118
+ : issues.length > 0
119
+ ? "warn"
120
+ : "pass";
121
+
122
+ if (verdict === "pass" || verdict === "warn") {
123
+ appendOperationLog({
124
+ operation: "observation-validated",
125
+ targets: [input.title],
126
+ summary: `Validated [${input.type}] "${input.title}" — ${verdict}${issues.length > 0 ? ` (${issues.length} issues)` : ""}`,
127
+ });
128
+ }
129
+
130
+ return { verdict, issues };
131
+ }
132
+
133
+ // ============================================================================
134
+ // Internal Checks
135
+ // ============================================================================
136
+
137
+ /**
138
+ * Check for exact title match (same type, active).
139
+ */
140
+ function findExactDuplicate(input: ObservationInput): ObservationRow | null {
141
+ const db = getMemoryDB();
142
+ return db
143
+ .query(
144
+ `SELECT * FROM observations
145
+ WHERE type = ? AND LOWER(title) = LOWER(?) AND superseded_by IS NULL
146
+ LIMIT 1`,
147
+ )
148
+ .get(input.type, input.title) as ObservationRow | null;
149
+ }
150
+
151
+ /**
152
+ * Check for near-duplicate via FTS5 title search.
153
+ */
154
+ function findNearDuplicate(input: ObservationInput): ObservationRow | null {
155
+ const db = getMemoryDB();
156
+
157
+ // Build FTS query from title words
158
+ // Strip FTS5 special operators and characters to prevent query syntax errors
159
+ const FTS5_OPERATORS = /\b(AND|OR|NOT|NEAR)\b/gi;
160
+ const words = input.title
161
+ .replace(FTS5_OPERATORS, "")
162
+ .replace(/['"*^+(){}]/g, "")
163
+ .split(/\s+/)
164
+ .filter((w) => w.length > 2)
165
+ .map((w) => `"${w}"*`)
166
+ .join(" AND ");
167
+
168
+ if (!words) return null;
169
+
170
+ try {
171
+ const result = db
172
+ .query(
173
+ `SELECT o.* FROM observations o
174
+ JOIN observations_fts fts ON fts.rowid = o.id
175
+ WHERE observations_fts MATCH ?
176
+ AND o.type = ?
177
+ AND o.superseded_by IS NULL
178
+ AND o.id != COALESCE(?, -1)
179
+ ORDER BY bm25(observations_fts) LIMIT 1`,
180
+ )
181
+ .get(
182
+ words,
183
+ input.type,
184
+ input.supersedes ?? null,
185
+ ) as ObservationRow | null;
186
+
187
+ return result;
188
+ } catch {
189
+ return null;
190
+ }
191
+ }
192
+
193
+ /**
194
+ * Check for contradictions with existing decisions.
195
+ */
196
+ function findContradiction(input: ObservationInput): ObservationRow | null {
197
+ if (!input.concepts || input.concepts.length === 0) return null;
198
+
199
+ const db = getMemoryDB();
200
+
201
+ // Search for decisions with overlapping concepts
202
+ const conceptQuery = input.concepts.map((c) => `"${c}"*`).join(" OR ");
203
+
204
+ try {
205
+ const candidates = db
206
+ .query(
207
+ `SELECT o.* FROM observations o
208
+ JOIN observations_fts fts ON fts.rowid = o.id
209
+ WHERE observations_fts MATCH ?
210
+ AND o.type = 'decision'
211
+ AND o.superseded_by IS NULL
212
+ ORDER BY bm25(observations_fts) LIMIT 5`,
213
+ )
214
+ .all(conceptQuery) as ObservationRow[];
215
+
216
+ // Check for opposing signals
217
+ const inputText = `${input.title} ${input.narrative ?? ""}`.toLowerCase();
218
+ const contradictionPairs = [
219
+ ["use", "don't use"],
220
+ ["enable", "disable"],
221
+ ["add", "remove"],
222
+ ["prefer", "avoid"],
223
+ ["always", "never"],
224
+ ];
225
+
226
+ for (const candidate of candidates) {
227
+ const candidateText =
228
+ `${candidate.title} ${candidate.narrative ?? ""}`.toLowerCase();
229
+ for (const [wordA, wordB] of contradictionPairs) {
230
+ if (
231
+ (hasWord(inputText, wordA) && hasWord(candidateText, wordB)) ||
232
+ (hasWord(inputText, wordB) && hasWord(candidateText, wordA))
233
+ ) {
234
+ return candidate;
235
+ }
236
+ }
237
+ }
238
+ } catch {
239
+ // FTS5 query failed
240
+ }
241
+
242
+ return null;
243
+ }
@@ -1,8 +1,20 @@
1
1
  ---
2
2
  name: design-taste-frontend
3
- description: Use as the BASE aesthetic skill for any web UI to override default LLM design biases. Enforces strict typography, color, spacing, and component architecture rules. Load BEFORE frontend-design when premium visual quality is required.
3
+ description: Use when building any web UI as the BASE aesthetic layer to override default LLM design biases. Enforces strict typography, color, spacing, and component architecture rules. Load BEFORE frontend-design when premium visual quality is required.
4
4
  ---
5
5
 
6
+ ## When to Use
7
+
8
+ - When building any web UI that needs to override default LLM design biases
9
+ - Before loading `frontend-design` skill when premium visual quality is required
10
+ - As the base aesthetic layer for any UI implementation task
11
+
12
+ ## When NOT to Use
13
+
14
+ - When a more specific aesthetic overlay is loaded (high-end-visual-design, minimalist-ui, industrial-brutalist-ui)
15
+ - For non-UI tasks (backend, CLI, data processing)
16
+
17
+
6
18
  # High-Agency Frontend Skill
7
19
 
8
20
  ## 1. ACTIVE BASELINE CONFIGURATION
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: figma-go
3
- description: Use for Figma read/write access WITHOUT an API token, via figma-mcp-go plugin bridge. Prefer over figma skill when no API token is available. MUST load when user needs Figma data and has the desktop plugin installed.
3
+ description: Use when you need Figma read/write access WITHOUT an API token, via figma-mcp-go plugin bridge. Prefer over figma skill when no API token is available. MUST load when user needs Figma data and has the desktop plugin installed.
4
4
  mcp:
5
5
  figma-mcp-go:
6
6
  command: npx
@@ -3,6 +3,19 @@ name: full-output-enforcement
3
3
  description: MUST load when generating complete files, long code blocks, or any output where truncation or placeholder comments like '// ... rest of code' would be harmful. Bans all placeholder patterns and enforces exhaustive, unabridged output.
4
4
  ---
5
5
 
6
+ ## When to Use
7
+
8
+ - When generating complete files, long code blocks, or full configuration outputs
9
+ - When truncation or placeholder comments like `// ... rest of code` would be harmful
10
+ - When the user needs exhaustive, unabridged output
11
+
12
+ ## When NOT to Use
13
+
14
+ - For short code snippets or single-function responses
15
+ - When summarization is explicitly requested
16
+ - For conversational responses that don't involve code generation
17
+
18
+
6
19
  # Full-Output Enforcement
7
20
 
8
21
  ## Baseline
@@ -3,6 +3,19 @@ name: high-end-visual-design
3
3
  description: Use INSTEAD OF design-taste-frontend when user explicitly requests premium, agency-quality, or luxury visual design. Defines exact fonts, spacing, shadows, and animations that make websites feel expensive. Blocks cheap AI defaults.
4
4
  ---
5
5
 
6
+ ## When to Use
7
+
8
+ - When the user explicitly requests premium, agency-quality, or luxury visual design
9
+ - Instead of design-taste-frontend when high-end aesthetics are the priority
10
+ - For landing pages, marketing sites, or portfolio projects that need to feel expensive
11
+
12
+ ## When NOT to Use
13
+
14
+ - For internal tools, admin panels, or dashboards where function > form
15
+ - When minimalist-ui or industrial-brutalist-ui aesthetics are requested instead
16
+ - For rapid prototyping where visual polish is not yet needed
17
+
18
+
6
19
  # Agent Skill: Principal UI/UX Architect & Motion Choreographer (Awwwards-Tier)
7
20
 
8
21
  ## 1. Meta Information & Core Directive
@@ -3,6 +3,19 @@ name: industrial-brutalist-ui
3
3
  description: Use INSTEAD OF design-taste-frontend when user requests brutalist, military-terminal, or raw mechanical aesthetics. Swiss typographic print meets utilitarian color. For data-heavy dashboards or editorial sites needing declassified-blueprint energy.
4
4
  ---
5
5
 
6
+ ## When to Use
7
+
8
+ - When the user requests brutalist, military-terminal, or raw mechanical aesthetics
9
+ - For data-heavy dashboards or editorial sites needing declassified-blueprint energy
10
+ - Instead of design-taste-frontend when utilitarian aesthetics are requested
11
+
12
+ ## When NOT to Use
13
+
14
+ - For consumer-facing marketing or e-commerce sites
15
+ - When clean, minimalist, or luxury aesthetics are requested
16
+ - For accessibility-critical applications where brutalist patterns may reduce readability
17
+
18
+
6
19
  # SKILL: Industrial Brutalism & Tactical Telemetry UI
7
20
 
8
21
  ## 1. Skill Meta
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: memory-system
3
3
  description: Use when persisting learnings, loading previous context, or searching past decisions - covers memory file structure, tools, and when to update each file
4
- version: 1.1.0
4
+ version: 1.2.0
5
5
  tags: [context, workflow]
6
6
  dependencies: []
7
7
  ---
@@ -78,6 +78,70 @@ After creating an observation: `memory-search` with relevant keywords should fin
78
78
  - For ongoing work, append to one handoff file per task/day instead of many tiny files.
79
79
  - Keep observation titles concrete and action-oriented.
80
80
 
81
+ ## Admin Operations
82
+
83
+ The `memory-admin` tool supports these operations:
84
+
85
+ ### Core (existing)
86
+ | Operation | Purpose |
87
+ |---|---|
88
+ | `status` | Storage stats, FTS5 health, pipeline counts |
89
+ | `full` | Full maintenance cycle (archive + checkpoint + vacuum) |
90
+ | `archive` | Archive observations older than N days |
91
+ | `checkpoint` | Checkpoint WAL file |
92
+ | `vacuum` | Vacuum database |
93
+ | `migrate` | Import .opencode/memory/observations/*.md into SQLite |
94
+ | `capture-stats` | Temporal message capture statistics |
95
+ | `distill-now` | Force distillation for current session |
96
+ | `curate-now` | Force curator run |
97
+
98
+ ### Knowledge Intelligence (new in v2.1)
99
+ | Operation | Purpose |
100
+ |---|---|
101
+ | `lint` | Find duplicates, contradictions, stale/orphan observations |
102
+ | `index` | Generate a structured catalog of all observations |
103
+ | `compile` | Build concept-grouped articles from observation clusters |
104
+ | `log` | View the append-only operation audit trail |
105
+
106
+ Examples:
107
+ ```
108
+ memory-admin({ operation: "lint" })
109
+ memory-admin({ operation: "lint", older_than_days: 60 })
110
+ memory-admin({ operation: "index" })
111
+ memory-admin({ operation: "compile" })
112
+ memory-admin({ operation: "log" })
113
+ ```
114
+
115
+ ### Reading Compiled Artifacts
116
+ ```
117
+ memory-read({ file: "index" }) // Full observation catalog
118
+ memory-read({ file: "compiled/auth" }) // Compiled article for "auth" concept
119
+ memory-read({ file: "log" }) // Operation audit trail
120
+ ```
121
+
122
+ ## Validation Gate
123
+
124
+ The `observation` tool now validates before storing:
125
+ - **Exact duplicate** → rejected (returns duplicate ID + supersede hint)
126
+ - **Near-duplicate** → stored with warning
127
+ - **Contradiction** → stored with warning (for decisions sharing concepts)
128
+ - **Low quality** → stored with warning (no narrative + no concepts)
129
+
130
+ To update an existing observation, use `supersedes`:
131
+ ```
132
+ observation({ type: "decision", title: "Use JWT", supersedes: "42", ... })
133
+ ```
134
+
135
+ ## Idle Pipeline
136
+
137
+ During `session.idle`, the memory system automatically runs:
138
+ 1. Distill undistilled messages
139
+ 2. Curate observations from distillations
140
+ 3. Optimize FTS5 index
141
+ 4. Checkpoint WAL if large
142
+ 5. Compile concept articles (max 10)
143
+ 6. Regenerate memory index
144
+
81
145
  ## See Also
82
146
 
83
147
  - `context-management`
@@ -3,6 +3,19 @@ name: minimalist-ui
3
3
  description: Use INSTEAD OF design-taste-frontend when user requests clean, editorial, or minimalist aesthetics. Warm monochrome palette, typographic contrast, flat bento grids, muted pastels. No gradients, no heavy shadows.
4
4
  ---
5
5
 
6
+ ## When to Use
7
+
8
+ - When the user requests clean, editorial, or minimalist aesthetics
9
+ - For content-focused sites, blogs, or documentation pages
10
+ - Instead of design-taste-frontend when warm monochrome and flat layouts are desired
11
+
12
+ ## When NOT to Use
13
+
14
+ - When bold, attention-grabbing, or luxury visual design is requested
15
+ - For data-heavy dashboards that need dense information display
16
+ - When industrial-brutalist-ui or high-end-visual-design is a better fit
17
+
18
+
6
19
  # Protocol: Premium Utilitarian Minimalism UI Architect
7
20
 
8
21
  ## 1. Protocol Overview
@@ -3,6 +3,19 @@ name: redesign-existing-projects
3
3
  description: Use when upgrading an existing website or app's visual design to premium quality. Audits current design, identifies generic AI patterns, applies high-end standards without breaking functionality. MUST load before any design overhaul of existing projects.
4
4
  ---
5
5
 
6
+ ## When to Use
7
+
8
+ - When upgrading an existing website or app's visual design to premium quality
9
+ - Before any design overhaul of existing projects
10
+ - When the current design has been identified as generic, template-looking, or AI-default
11
+
12
+ ## When NOT to Use
13
+
14
+ - For greenfield projects (use frontend-design with an aesthetic overlay instead)
15
+ - When the design is already polished and only minor tweaks are needed
16
+ - For non-visual changes (performance, accessibility-only fixes)
17
+
18
+
6
19
  # Redesign Skill
7
20
 
8
21
  ## How This Works
@@ -1,9 +1,11 @@
1
1
  ---
2
2
  name: requesting-code-review
3
3
  description: Use when completing meaningful implementation work and needing a high-signal review pass before merge or release - dispatches scoped review agents, synthesizes findings, and routes follow-up actions by severity.
4
- version: 1.1.0
4
+ version: 1.2.0
5
5
  tags: [workflow, code-quality, research]
6
6
  dependencies: []
7
+ references:
8
+ - references/specialist-profiles.md
7
9
  ---
8
10
 
9
11
  # Requesting Code Review
@@ -90,7 +92,9 @@ Choose the smallest review depth that still covers the risk.
90
92
 
91
93
  - **targeted**: use 1-2 specific review prompts
92
94
  - **standard**: use security/correctness, tests/types, and completeness
93
- - **full**: use all 5 specialized review prompts
95
+ - **full**: use all 5 specialized review prompts + specialist profiles from [references/specialist-profiles.md](references/specialist-profiles.md)
96
+
97
+ For **standard** and **full** reviews, enhance dispatch prompts with specialist reviewer profiles (security, architecture, performance) and run an adversarial pass on findings. See [references/specialist-profiles.md](references/specialist-profiles.md) for the exact prompt additions and confidence thresholds.
94
98
 
95
99
  Do **not** dispatch 5 reviewers by reflex for every tiny change. That produces noise, not rigor.
96
100
 
@@ -395,3 +399,45 @@ Run `/compound` after resolving review findings to capture:
395
399
  - Newly discovered codebase conventions
396
400
 
397
401
  That turns review from a gate into a feedback loop.
402
+
403
+ ## Autofix Classification
404
+
405
+ Every review finding should include a **fix category** that routes remediation. This prevents the user from manually triaging every finding.
406
+
407
+ | Category | Meaning | Agent Action |
408
+ | -------------- | ------------------------------------------------ | ----------------------------------------- |
409
+ | `safe_auto` | Zero-risk fix (formatting, unused imports, typos) | Fix immediately without asking |
410
+ | `gated_auto` | Likely correct fix, but verify first | Fix and show diff before committing |
411
+ | `manual` | Requires human judgment or architectural decision | Report to user with context, don't touch |
412
+ | `advisory` | Informational only, no action required | Include in report, no remediation needed |
413
+
414
+ ### Reviewer Output Format (Enhanced)
415
+
416
+ Reviewers should return findings in this structure:
417
+
418
+ ```markdown
419
+ ### [SEVERITY]: [Title]
420
+
421
+ - **File:** `path/to/file.ts:123`
422
+ - **Category:** safe_auto | gated_auto | manual | advisory
423
+ - **Issue:** [concrete description of the problem]
424
+ - **Fix:** [specific fix if category is safe_auto or gated_auto]
425
+ ```
426
+
427
+ ### Classification Rules
428
+
429
+ 1. **safe_auto** — formatting, whitespace, unused imports, typo in comments, missing trailing newlines. Must not change behavior.
430
+ 2. **gated_auto** — missing null checks, error handling gaps, type narrowing fixes. Changes behavior but fix is clear and low-risk.
431
+ 3. **manual** — architectural concerns, API design questions, security decisions, breaking changes. Requires human context.
432
+ 4. **advisory** — "consider doing X", performance suggestions without evidence, alternative patterns. No action needed.
433
+
434
+ ### Post-Synthesis Routing
435
+
436
+ After synthesizing all findings:
437
+
438
+ 1. **Apply all `safe_auto` fixes** immediately
439
+ 2. **Show `gated_auto` diffs** to user for approval before applying
440
+ 3. **Present `manual` findings** as a prioritized list for user decision
441
+ 4. **Append `advisory` findings** at the end of the report for reference
442
+
443
+ This routing ensures trivial fixes don't block the review while keeping humans in the loop for judgment calls.
@@ -0,0 +1,108 @@
1
+ # Specialist Reviewer Profiles
2
+
3
+ Use these profiles when dispatching review agents for **standard** or **full** depth reviews. Each profile focuses the reviewer on a specific domain, reducing noise and increasing finding quality.
4
+
5
+ ## Security Reviewer
6
+
7
+ **Focus:** OWASP Top 10, auth/authz, data exposure, injection, secrets
8
+
9
+ **Dispatch prompt addition:**
10
+
11
+ ```
12
+ You are reviewing as a SECURITY SPECIALIST. Focus exclusively on:
13
+
14
+ 1. Authentication/authorization gaps (missing auth checks, privilege escalation)
15
+ 2. Injection vulnerabilities (SQL, XSS, command injection, path traversal)
16
+ 3. Secrets exposure (hardcoded tokens, API keys in source, logged credentials)
17
+ 4. Data validation gaps (missing input sanitization, unsafe deserialization)
18
+ 5. Insecure defaults (permissive CORS, missing rate limiting, debug mode)
19
+
20
+ Ignore: Style, architecture, performance (other reviewers handle those).
21
+
22
+ Confidence threshold: Only report findings with confidence >= 0.60.
23
+ Below 0.60, include in a separate "Low Confidence / Investigate" section.
24
+ ```
25
+
26
+ **When to use:** Always in standard and full reviews. Skip only for purely internal tools with no user input.
27
+
28
+ ---
29
+
30
+ ## Architecture Reviewer
31
+
32
+ **Focus:** Coupling, SOLID principles, API design, dependency direction
33
+
34
+ **Dispatch prompt addition:**
35
+
36
+ ```
37
+ You are reviewing as an ARCHITECTURE SPECIALIST. Focus exclusively on:
38
+
39
+ 1. Coupling violations (circular deps, god modules, leaky abstractions)
40
+ 2. API contract issues (breaking changes, inconsistent error formats, missing versioning)
41
+ 3. Dependency direction violations (inner layers importing outer layers)
42
+ 4. Abstraction misuse (over-engineering, unnecessary indirection, premature abstraction)
43
+ 5. Pattern divergence (new code contradicts established codebase patterns)
44
+
45
+ Rules:
46
+ - Only flag architecture issues that will cause CONCRETE problems (maintenance cost, bugs, scaling)
47
+ - "I would have done it differently" is NOT a finding
48
+ - Preference for existing patterns over theoretically better ones
49
+
50
+ Confidence threshold: Only report findings with confidence >= 0.60.
51
+ ```
52
+
53
+ **When to use:** Full reviews only. Skip for small fixes, config changes, or documentation updates.
54
+
55
+ ---
56
+
57
+ ## Performance Reviewer
58
+
59
+ **Focus:** Runtime efficiency, bundle size, database queries, memory
60
+
61
+ **Dispatch prompt addition:**
62
+
63
+ ```
64
+ You are reviewing as a PERFORMANCE SPECIALIST. Focus exclusively on:
65
+
66
+ 1. N+1 query patterns (loops that make DB/API calls)
67
+ 2. Missing memoization on expensive computations
68
+ 3. Unbounded data loading (no pagination, no limits)
69
+ 4. Bundle size regressions (large imports that could be lazy-loaded)
70
+ 5. Memory leaks (event listeners without cleanup, growing caches)
71
+
72
+ Rules:
73
+ - Only flag issues with MEASURABLE impact (not theoretical)
74
+ - "This could be faster" without evidence is NOT a finding
75
+ - Quantify impact where possible (e.g., "This runs N queries instead of 1")
76
+
77
+ Confidence threshold: Only report findings with confidence >= 0.70.
78
+ Performance findings below 0.70 are usually speculative — suppress them.
79
+ ```
80
+
81
+ **When to use:** Full reviews only, and only when the change touches data-heavy paths, rendering, or database queries.
82
+
83
+ ---
84
+
85
+ ## Adversarial Pass
86
+
87
+ After all specialist reviews complete, run an adversarial pass on the combined findings. This prevents false positives from making it into the final report.
88
+
89
+ **Adversarial prompt:**
90
+
91
+ ```
92
+ Review these findings from specialist reviewers. For EACH finding, challenge it from these angles:
93
+
94
+ 1. **False positive check**: Does this issue actually exist in the code, or did the reviewer misread context?
95
+ 2. **Severity inflation**: Is the severity appropriate, or is a CRITICAL actually a MINOR?
96
+ 3. **Codebase context**: Does the existing codebase already handle this elsewhere (middleware, framework, config)?
97
+ 4. **Cost-benefit**: Is the fix worth the effort, or is this pedantic?
98
+
99
+ For each finding, output:
100
+ - CONFIRMED (keep as-is)
101
+ - DOWNGRADED (reduce severity, explain why)
102
+ - REJECTED (false positive, explain why)
103
+
104
+ Only CONFIRMED and DOWNGRADED findings should appear in the final report.
105
+ Confidence threshold for rejection: >= 0.60 (be sure before removing a finding).
106
+ ```
107
+
108
+ **When to use:** Full reviews with 3+ specialist reviewers. Reduces noise by ~30% based on typical review output.
@@ -154,3 +154,28 @@ Answer these questions:
154
154
  - [ ] **No XML-style tags**
155
155
  - [ ] **SKILL.md under 200 lines**
156
156
  - [ ] **All referenced files exist**
157
+
158
+ ## Recommended Sections for SKILL.md
159
+
160
+ Beyond the required structure, include these sections when applicable:
161
+
162
+ ### `## Gotchas`
163
+
164
+ Every skill should accumulate a Gotchas section over time. This is **failure-driven documentation** — each entry should trace to a specific failure encountered during real use.
165
+
166
+ ```markdown
167
+ ## Gotchas
168
+
169
+ - **[Short description of what went wrong]** — [What the agent did wrong, why, and the fix]. Discovered [date or session reference].
170
+ - **[Another failure]** — [Details]. Discovered [date].
171
+ ```
172
+
173
+ **Rules for Gotchas:**
174
+
175
+ 1. Every entry must trace to an actual failure, not a hypothetical risk
176
+ 2. Include what the agent did, why it failed, and how to avoid it
177
+ 3. New entries are added when a skill causes a failure — the fix PR should include a gotcha entry
178
+ 4. Keep entries concise (1-3 sentences each)
179
+ 5. This section grows over time and is never cleared — it's the skill's scar tissue
180
+
181
+ **Why this matters:** Skills without gotchas are untested skills. A skill with 5 gotchas has been battle-tested through 5 real failures and is structurally better than a pristine skill with zero. When a skill causes a failure, always ask: "Should this become a gotcha entry?"
@@ -3,6 +3,19 @@ name: stitch-design-taste
3
3
  description: Use when generating DESIGN.md files for Google Stitch projects to enforce premium, anti-generic UI standards. Load BEFORE stitch skill when design quality matters. Stitch-specific only — do not use for general web projects.
4
4
  ---
5
5
 
6
+ ## When to Use
7
+
8
+ - When generating DESIGN.md files for Google Stitch projects
9
+ - Before loading the stitch skill when design quality matters
10
+ - When enforcing premium, anti-generic UI standards in Stitch workflows
11
+
12
+ ## When NOT to Use
13
+
14
+ - For general web projects not using Google Stitch
15
+ - When the stitch project already has a satisfactory DESIGN.md
16
+ - For non-UI Stitch operations (data, API, backend)
17
+
18
+
6
19
  # Stitch Design Taste — Semantic Design System Skill
7
20
 
8
21
  ## Overview