reviewer-harness 1.4.2 → 1.6.0

package/README.md

@@ -47,20 +47,23 @@ The harness is **not the AI model** — it is what prepares everything the AI re
 harness.config.json          ← your master spec (ONE file)
         │  validate()        ← quality checks + secret scanning
         ▼
-lib/adapters/*.js            ← adapters: opencode, claude, gemini, cline
+lib/adapters/*.js            ← adapters: opencode, claude, gemini, cline,
+                               freebuff, copilot, antigravity
         │  renderInstructions()
         ▼
 .opencode/instructions.md    ← OpenCode
 CLAUDE.md                    ← Claude Code
 GEMINI.md                    ← Gemini CLI
 .clinerules                  ← Cline
+.agents/skills/<skill>/SKILL.md  ← Freebuff, Antigravity (project skills)
+.github/skills/<skill>/SKILL.md  ← GitHub Copilot CLI (project skills)
 ```
 
 Change the rules in **one** place (`harness.config.json`), and `sync` propagates them to every runtime.
 
 ## Quickstart
 
-You can use reviewer-harness in two ways: **Modular Mode** (zero-install: add individual skills to any project, no setup) or **Full Harness Mode** (one master config synced across all 4 runtimes).
+You can use reviewer-harness in two ways: **Modular Mode** (zero-install: add individual skills to any project, no setup) or **Full Harness Mode** (one master config synced across all 7 runtimes).
 
 ### 1. Modular Skills (zero-install via npx)
 
@@ -77,9 +80,9 @@ npx reviewer-harness skills add no-hallucination
 
 > Prefer a global CLI? Install once with `npm install -g reviewer-harness` and run `reviewer-harness skills add <name>` anywhere.
 
-### 2. Full Harness Synchronization (4 runtimes)
+### 2. Full Harness Synchronization (7 runtimes)
 
-`init` creates your master config, `validate` checks it (including secret scanning), and `sync` generates the native instruction file for every runtime you enable: `.opencode/instructions.md`, `CLAUDE.md`, `GEMINI.md`, and `.clinerules`.
+`init` creates your master config, `validate` checks it (including secret scanning), and `sync` generates the native instruction file for every runtime you enable: `.opencode/instructions.md`, `CLAUDE.md`, `GEMINI.md`, and `.clinerules` — plus Agent Skills bundles (`.agents/skills/<skill>/SKILL.md` for Freebuff and Antigravity, `.github/skills/<skill>/SKILL.md` for GitHub Copilot CLI), so your skills follow you even when you switch CLIs.
 
 ```bash
 # Using npx (zero-install, recommended)
@@ -152,7 +155,7 @@ Guardrails that run before any file is written:
 
 ## This repo governs itself
 
-reviewer-harness eats its own cooking: the instruction files at this repo's root — `.opencode/instructions.md`, `CLAUDE.md`, `GEMINI.md`, `.clinerules` — plus the agents and commands in `.opencode/` and `.claude/` are **generated by reviewer-harness itself** from its own `harness.config.json`. Open this repo in any AI coding tool and the tool follows the harness's own rules while working on the harness. To refresh them after editing the config, just run `node bin/cli.js sync` here.
+reviewer-harness eats its own cooking: the instruction files at this repo's root — `.opencode/instructions.md`, `CLAUDE.md`, `GEMINI.md`, `.clinerules` — plus the agents and commands in `.opencode/` and `.claude/` and the skill bundles in `.agents/skills/` and `.github/skills/` are **generated by reviewer-harness itself** from its own `harness.config.json`. Open this repo in any AI coding tool and the tool follows the harness's own rules while working on the harness. To refresh them after editing the config, just run `node bin/cli.js sync` here.
 
 ## Local Memory (graph-style, Obsidian-ready)
 
@@ -238,7 +241,7 @@ Running from a source checkout instead? The same commands work as `node bin/cli.
 - `lib/memory.js` — local memory: notes vault, graph builder, index generator
 - `lib/skills.js` — skills system: bundled store, install/enable, section rendering
 - `lib/agents.js` / `lib/commands.js` — one source → OpenCode + Claude formats
-- `lib/adapters/` — registry + one adapter per runtime (opencode, claude, gemini, cline)
+- `lib/adapters/` — registry + one adapter per runtime (opencode, claude, gemini, cline, freebuff, copilot, antigravity)
 - `skills/` — bundled skills · `agents/` — bundled sub-agents · `commands/` — bundled slash commands
 
 ## How it was built (the lessons)

package/bin/cli.js

@@ -13,7 +13,7 @@ import { sync, writeSafe } from "../lib/sync.js";
 import { initProject } from "../lib/init.js";
 import { initMemory, buildIndex, readNotes, memoryDir } from "../lib/memory.js";
 import { validateConfig } from "../lib/validate.js";
-import { listBundledSkills, addSkill, removeSkill, loadBundledSkills, skillCommandContent } from "../lib/skills.js";
+import { listBundledSkills, addSkill, removeSkill, loadBundledSkills, skillCommandContent, skillBundleContent } from "../lib/skills.js";
 import { listBundledAgents, addAgent } from "../lib/agents.js";
 import { listBundledCommands, addCommand } from "../lib/commands.js";
 
@@ -45,7 +45,7 @@ Usage (run inside your project):
   reviewer-harness commands list            List bundled slash commands
   reviewer-harness commands add <name>      Install a slash command (OpenCode + Claude)
 
-  reviewer-harness global [--dry-run]       Install EVERY bundled skill as a slash command for ALL projects (global OpenCode + Claude "/" menus)
+  reviewer-harness global [--dry-run]       Install EVERY bundled skill for ALL projects (OpenCode + Claude "/" menus; Freebuff, Copilot CLI, Antigravity skill bundles)
 
   reviewer-harness memory init              Start the local memory (memory/ folder)
   reviewer-harness memory index             Rebuild the memory INDEX.md + graph.json
@@ -62,7 +62,11 @@ function cmdStatus() {
   console.log(`Runtimes:`);
   for (const name of config.runtimes) {
     const adapter = adapters[name];
-    console.log(`  - ${name} → ${adapter ? adapter.targetFile() : "(no adapter!)"}`);
+    const target = !adapter ? "(no adapter!)"
+      : typeof adapter.targetFile === "function" ? adapter.targetFile()
+      : typeof adapter.skillBundleDir === "function" ? `${adapter.skillBundleDir()}/<skill>/SKILL.md`
+      : "(unknown)";
+    console.log(`  - ${name} → ${target}`);
   }
   console.log(`Skills  : ${config.skills?.length ? config.skills.join(", ") : "(none)"}`);
 }
@@ -82,6 +86,17 @@ function cmdSync() {
       }
     } else if (r.skipped) {
       console.log(`- ${r.runtime}: SKIP — ${r.skipped}`);
+    } else if (r.skillBundles) {
+      const files = r.skillBundles;
+      const written = files.filter((f) => f.written).length;
+      const pending = files.filter((f) => f.dryRun && f.changed).length;
+      const unchanged = files.filter((f) => f.unchanged || (f.dryRun && !f.changed)).length;
+      const where = `${r.bundleDir}/<skill>/SKILL.md`;
+      if (dryRun) {
+        console.log(`- ${r.runtime} → ${where}: ${pending} would be written/updated, ${unchanged} unchanged (Agent Skills bundles)`);
+      } else {
+        console.log(`- ${r.runtime} → ${where}: ${written} written ✓, ${unchanged} unchanged`);
+      }
     } else if (r.dryRun) {
       console.log(`- ${r.runtime} → ${r.file}: ${r.changed ? "WOULD WRITE (changes pending)" : "no changes"}`);
     } else if (r.unchanged) {
@@ -213,21 +228,31 @@ function cmdGlobal() {
   const targets = [
     { runtime: "OpenCode", dir: join(homedir(), ".config", "opencode", "commands") },
     { runtime: "Claude", dir: join(homedir(), ".claude", "commands") },
+    // Skill-bundle runtimes (Agent Skills open standard: <skill>/SKILL.md)
+    { runtime: "Freebuff", dir: join(homedir(), ".agents", "skills"), bundle: true },
+    { runtime: "Copilot CLI", dir: join(homedir(), ".copilot", "skills"), bundle: true },
+    { runtime: "Antigravity", dir: join(homedir(), ".gemini", "config", "skills"), bundle: true },
   ];
   if (dryRun) console.log("(dry-run: nothing was written)\n");
-  for (const { runtime, dir } of targets) {
+  for (const { runtime, dir, bundle } of targets) {
     let written = 0, unchanged = 0, pending = 0;
     for (const skill of skills) {
-      const outcome = writeSafe(join(dir, `${skill.name}.md`), skillCommandContent(skill, skills), dryRun);
+      const rel = bundle ? join(skill.name, "SKILL.md") : `${skill.name}.md`;
+      const content = bundle
+        ? skillBundleContent(skill, skills)
+        : skillCommandContent(skill, skills);
+      const outcome = writeSafe(join(dir, rel), content, dryRun);
       if (outcome.written) written++;
       else if (outcome.dryRun && outcome.changed) pending++;
       else unchanged++;
     }
-    if (dryRun) console.log(`- ${runtime} (global): ${pending} would be written/updated, ${unchanged} unchanged → ${dir}`);
-    else console.log(`- ${runtime} (global): ${written} written ✓, ${unchanged} unchanged → ${dir}`);
+    const where = bundle ? `${dir} (<skill>/SKILL.md)` : dir;
+    if (dryRun) console.log(`- ${runtime} (global): ${pending} would be written/updated, ${unchanged} unchanged → ${where}`);
+    else console.log(`- ${runtime} (global): ${written} written ✓, ${unchanged} unchanged → ${where}`);
   }
   console.log(
-    `\nDone: ${skills.map((s) => "/" + s.name).join(", ")} are now in the "/" menu of EVERY project.` +
+    `\nDone: ${skills.map((s) => "/" + s.name).join(", ")} are now available in EVERY project.` +
+      `\n(OpenCode + Claude: "/" menu commands. Freebuff, Copilot CLI, Antigravity: Agent Skills bundles.)` +
       `\n(Per-project rules still come from "sync" inside a project.)`
   );
 }

package/lib/adapters/antigravity.js

@@ -0,0 +1,15 @@
+// lib/adapters/antigravity.js — ADAPTER for Google Antigravity.
+//
+// Antigravity follows the Agent Skills open standard (agentskills.io):
+// workspace skills at `<workspace>/.agents/skills/<name>/SKILL.md`
+// (with backward compatibility for `.agent/skills/`), and global
+// skills at `~/.gemini/config/skills/<name>/SKILL.md`. This adapter
+// covers the workspace side (used by `sync`); the global side is
+// covered by the `global` command.
+//
+// Like Freebuff and Copilot CLI, Antigravity is skills-only here:
+// it exports skillBundleDir() instead of targetFile()/renderInstructions().
+
+export function skillBundleDir() {
+  return ".agents/skills";
+}

package/lib/adapters/copilot.js

@@ -0,0 +1,15 @@
+// lib/adapters/copilot.js — ADAPTER for GitHub Copilot CLI.
+//
+// GitHub Copilot CLI reads Agent Skills (agentskills.io) from skill
+// folders: project skills at `<project>/.github/skills/<name>/SKILL.md`
+// (it also recognizes `.claude/skills/` and `.agents/skills/`), and
+// personal skills at `~/.copilot/skills/<name>/SKILL.md` (or
+// `~/.agents/skills/`). This adapter covers the project side (used by
+// `sync`); the personal side is covered by the `global` command.
+//
+// Like Freebuff and Antigravity, Copilot CLI is skills-only here:
+// it exports skillBundleDir() instead of targetFile()/renderInstructions().
+
+export function skillBundleDir() {
+  return ".github/skills";
+}

package/lib/adapters/freebuff.js

@@ -0,0 +1,16 @@
+// lib/adapters/freebuff.js — ADAPTER for Freebuff (Codebuff platform).
+//
+// Freebuff follows the Agent Skills open standard (agentskills.io):
+// skills are folders containing a SKILL.md with `name` + `description`
+// frontmatter. Personal skills live at `~/.agents/skills/<name>/SKILL.md`;
+// project skills live at `<project>/.agents/skills/<name>/SKILL.md`.
+// This adapter covers the project side (used by `sync`); the personal
+// side is covered by the `global` command.
+//
+// Freebuff has no single instruction file like CLAUDE.md, so this
+// adapter is skills-only: it exports skillBundleDir() instead of
+// targetFile()/renderInstructions().
+
+export function skillBundleDir() {
+  return ".agents/skills";
+}

package/lib/adapters/index.js

@@ -9,7 +9,18 @@ import * as opencode from "./opencode.js";
 import * as claude from "./claude.js";
 import * as gemini from "./gemini.js";
 import * as cline from "./cline.js";
+import * as freebuff from "./freebuff.js";
+import * as copilot from "./copilot.js";
+import * as antigravity from "./antigravity.js";
 
-export const adapters = { opencode, claude, gemini, cline };
+export const adapters = {
+  opencode,
+  claude,
+  gemini,
+  cline,
+  freebuff,
+  copilot,
+  antigravity,
+};
 
 export const supportedRuntimes = Object.keys(adapters);

package/lib/init.js

@@ -11,7 +11,7 @@ const TEMPLATE = {
   version: "1.0.0",
   problem:
     "The problem — an AI with no guardrails: it sometimes breaks existing code it was never asked to touch, and hallucinates — inventing functions, libraries, or output that do not actually exist. These rules are the guardrails against that.",
-  runtimes: ["opencode", "claude", "gemini", "cline"],
+  runtimes: ["opencode", "claude", "gemini", "cline", "freebuff", "copilot", "antigravity"],
   skills: [],
   rules: [
     "Edit surgically: change only the code the task requires — never rewrite a whole file.",

package/lib/skills.js

@@ -168,3 +168,17 @@ export function skillCommandContent(skill, allSkills = []) {
   content += `\nApply this playbook to the following: $ARGUMENTS\n`;
   return content;
 }
+
+// Skill BUNDLE content — the Agent Skills open standard (agentskills.io):
+// one folder per skill, containing a SKILL.md with `name` + `description`
+// frontmatter. Freebuff, GitHub Copilot CLI, and Antigravity all read
+// this format. The body is identical to the slash-command version
+// (companions included) so every runtime enforces the same disciplines;
+// only the frontmatter gains the required `name` field.
+export function skillBundleContent(skill, allSkills = []) {
+  const command = skillCommandContent(skill, allSkills);
+  return command.replace(
+    `---\ndescription: `,
+    `---\nname: ${skill.name}\ndescription: `
+  );
+}

package/lib/sync.js

@@ -27,7 +27,7 @@ import { join, dirname } from "node:path";
 import { loadConfig } from "./config.js";
 import { adapters, supportedRuntimes } from "./adapters/index.js";
 import { validateConfig } from "./validate.js";
-import { loadSkills, skillCommandContent } from "./skills.js";
+import { loadSkills, skillCommandContent, skillBundleContent } from "./skills.js";
 
 // Write one file the safe way. Returns what happened:
 // dry-run → { dryRun: true, changed } · no change → { unchanged: true }
@@ -86,9 +86,26 @@ export function sync({ targetDir, dryRun = false }) {
       continue;
     }
 
-    const rel = adapter.targetFile();
-    const outcome = writeSafe(join(targetDir, rel), adapter.renderInstructions(config), dryRun);
-    results.push({ runtime: name, file: rel, ...outcome });
+    // Instruction-file runtimes (OpenCode, Claude, Gemini, Cline):
+    // one rendered rules file per runtime.
+    if (typeof adapter.targetFile === "function") {
+      const rel = adapter.targetFile();
+      const outcome = writeSafe(join(targetDir, rel), adapter.renderInstructions(config), dryRun);
+      results.push({ runtime: name, file: rel, ...outcome });
+    }
+
+    // Skill-bundle runtimes (Freebuff, Copilot CLI, Antigravity):
+    // one <skill>/SKILL.md per enabled skill, following the Agent
+    // Skills open standard (agentskills.io).
+    if (typeof adapter.skillBundleDir === "function") {
+      const files = [];
+      for (const skill of skills) {
+        const rel = `${adapter.skillBundleDir()}/${skill.name}/SKILL.md`;
+        const content = skillBundleContent(skill, skills);
+        files.push({ file: rel, ...writeSafe(join(targetDir, rel), content, dryRun) });
+      }
+      results.push({ runtime: name, bundleDir: adapter.skillBundleDir(), skillBundles: files });
+    }
   }
 
   // SLASH COMMANDS: one per enabled skill, for the two runtimes whose

package/package.json

@@ -3,7 +3,7 @@
   "bin": {
     "reviewer-harness": "./bin/cli.js"
   },
-  "description": "Your own AI harness \u2014 one master config that syncs guardrail rules, skills, and a local memory to Claude, OpenCode, Gemini, and Cline. No API key, no dependencies.",
+  "description": "Your own AI harness \u2014 one master config that syncs guardrail rules, skills, and a local memory to Claude, OpenCode, Gemini, Cline, Freebuff, Copilot CLI, and Antigravity. No API key, no dependencies.",
   "engines": {
     "node": ">=18"
   },
@@ -14,7 +14,10 @@
     "opencode",
     "claude-code",
     "gemini",
-    "cline"
+    "cline",
+    "freebuff",
+    "copilot-cli",
+    "antigravity"
   ],
   "license": "MIT",
   "name": "reviewer-harness",
@@ -23,7 +26,7 @@
     "url": "https://github.com/xcell321/reviewer-harness.git"
   },
   "type": "module",
-  "version": "1.4.2",
+  "version": "1.6.0",
   "files": [
     "bin",
     "lib",
@@ -31,4 +34,4 @@
     "agents",
     "commands"
   ]
-}
+}

package/skills/api-security.md

@@ -0,0 +1,37 @@
+---
+name: api-security
+description: 12 API security rules — apply to every backend endpoint you build or review. No anonymous backdoors, no leaked secrets.
+---
+
+## Skill: api-security
+
+When to use: building or reviewing any API — REST, GraphQL, or internal endpoints.
+
+Apply these 12 rules to every endpoint. If a rule doesn't apply, say why.
+
+### Authentication & Access
+1. **Authenticate every call.** No anonymous backdoors. Every endpoint requires a valid credential — no "internal" or "debug" routes left open.
+2. **Check object access.** Verify the caller owns the resource: *your* ID, not anyone's ID. Never trust an ID from the request without checking ownership.
+3. **Use least-privilege keys.** Read-only keys where possible. Separate keys per environment. Never reuse an admin key for a client.
+
+### Input & Transport
+4. **Validate input.** Reject what you didn't expect. Whitelist shapes with a schema (e.g. Zod); never trust raw request bodies, query params, or headers.
+5. **HTTPS only.** No plain-text tokens, ever. Redirect HTTP to HTTPS. Set Secure cookies.
+6. **No secrets in URLs.** URLs end up in logs, browser history, and referrer headers. Put tokens in headers, never in query strings or paths.
+
+### Tokens & Sessions
+7. **Short-lived tokens.** Leaks expire fast. Access tokens in minutes, refresh tokens in days — never permanent. Rotate on sensitive actions.
+8. **Rate limit.** Slow down brute force. Throttle auth endpoints aggressively (e.g. 5 attempts/minute); throttle the rest by reasonable use.
+
+### Observability & Hygiene
+9. **Log auth failures.** Spot attacks early. Log failed logins, invalid tokens, and permission denials with IP and timestamp — but never log the secret itself.
+10. **Version your API.** Retire old weak endpoints. Keep `/v1`, `/v2` explicit; deprecate with a sunset date, don't silently change behavior.
+11. **Limit response data.** Send only what's needed. Don't return full user objects, internal IDs, or stack traces to clients. Filter fields per role.
+12. **Inventory endpoints.** You can't guard what you forgot. Keep a list of every route; audit it when adding features. Remove dead endpoints.
+
+### Quick check before shipping
+- [ ] Every route has auth (or a documented reason it doesn't)
+- [ ] IDs in requests are ownership-checked
+- [ ] Inputs are schema-validated
+- [ ] No secrets in URLs or logs
+- [ ] Auth endpoints are rate-limited

package/skills/ux-edge-states.md

@@ -0,0 +1,37 @@
+---
+name: ux-edge-states
+description: 10 UX states beyond the happy path — design every screen for empty, loading, error, offline, and success. The real test is what the UI does when nothing goes right.
+---
+
+## Skill: ux-edge-states
+
+When to use: building or reviewing any screen, page, or component.
+
+Your product works when everything goes right. The real test is what it does when nothing does. Run every screen through these 10 states before calling it done.
+
+### States to design
+1. **Empty state.** What does the screen say before there is any data? Never show a blank page. Explain what's missing and give a clear next action ("No sessions yet — create one").
+2. **Loading state.** Make the wait feel short. Show a skeleton or spinner immediately; never freeze the UI with no feedback. For long waits, show progress.
+3. **Error state.** Say what went wrong *and how to fix it*. "Something went wrong" is not enough. Include the cause and the recovery step ("Connection failed — check the backend is running, then Retry").
+4. **No internet.** Never leave the user staring at a blank screen. Detect offline, show a clear banner, and queue actions for retry when back online.
+5. **Slow network.** Show progress, not a frozen spinner. Use timeouts with friendly messages; allow cancel. Distinguish "loading" from "stuck".
+6. **No search results.** Suggest something instead of a dead end. Show "No results for X" plus alternatives: clear filters, related items, or a create action.
+7. **Permission denied.** Explain why and give a way back. Don't just hide the button — tell the user what permission is missing and how to get it (or who to ask).
+8. **Session expired.** Save their work before logging out. Warn before expiry when possible; preserve form input and drafts across re-auth.
+9. **Form validation.** Flag the mistake the moment it happens, not after submit. Inline errors next to the field; explain the rule ("Password needs 8+ characters").
+10. **Success state.** Confirm it, celebrate it, then show what is next. A toast or checkmark plus the logical next action ("Session created — add your first terminal").
+
+### Quick check before shipping
+- [ ] Empty: screen explains what's missing + next action
+- [ ] Loading: immediate feedback, no frozen UI
+- [ ] Error: cause + recovery step, not just "failed"
+- [ ] Offline/slow: detected and communicated
+- [ ] Validation: inline, immediate, explanatory
+- [ ] Success: confirmed + next step shown
+
+### Anti-patterns
+- Blank screens with no explanation.
+- Generic "Something went wrong" with no recovery path.
+- Spinners that never resolve and can't be cancelled.
+- Losing user input on error, expiry, or navigation.
+- Dead-end "no results" with no suggestions.