showdar-skills 0.2.0

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Showdar Skills contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,322 @@
+# Showdar Skills
+
+[![Node >=20](https://img.shields.io/badge/node-%3E%3D20-339933?logo=node.js&logoColor=white)](https://nodejs.org/)
+[![MIT License](https://img.shields.io/badge/license-MIT-blue?logo=opensourceinitiative&logoColor=white)](./LICENSE)
+[![15 skills](https://img.shields.io/badge/skills-15-6f42c1)](#skill-catalog)
+
+Production-grade software engineering skills for coding agents. Showdar covers
+requirements, planning, design, implementation, debugging, QA, security,
+operations, release readiness, and Git workflows with lightweight intent
+routing and progressive knowledge loading.
+
+> npm publication: prepared for the first release; `showdar-skills@0.2.0` is
+> not published yet.
+
+## Quick start
+
+After the first npm publication, install the CLI globally and add project
+skills explicitly:
+
+```bash
+npm install -g showdar-skills
+cd my-project
+showdar init --ai codex --profile developer
+showdar doctor
+```
+
+The current source-install alternative is:
+
+```bash
+git clone https://github.com/caongocquy/showdar-skills.git
+cd showdar-skills
+npm install -g .
+```
+
+CLI installation and skill installation are separate. Installing the CLI
+globally does not install skills globally; `showdar init` controls the project
+or user scope where skills are copied.
+
+## Why Showdar?
+
+- 15 focused skills for the software lifecycle, instead of one oversized prompt.
+- Native discovery for Codex, OpenCode, and Claude Code.
+- Evidence-first workflows with bounded safety and verification contracts.
+- Searchable data, references, scripts, stack guidance, and examples loaded only
+  when the selected task needs them.
+
+## How it works
+
+```text
+User request
+     |
+     v
+Lightweight discovery metadata
+     |
+     v
+Selected Showdar skill
+     |
+     v
+SKILL.md
+     |
+     +--> data/
+     +--> references/
+     +--> scripts/
+     +--> examples/
+          only when needed
+```
+
+The 15 skills are not eagerly loaded as full prompts. Lightweight descriptions
+help the agent choose a skill, then that skill loads its workflow and deeper
+knowledge progressively.
+
+## Supported agents and destinations
+
+| Agent target | Project scope | Global scope |
+| --- | --- | --- |
+| Codex | `.agents/skills/` | `~/.agents/skills/` |
+| Universal | `.agents/skills/` | `~/.agents/skills/` |
+| OpenCode | `.opencode/skills/` + `.opencode/commands/showdar/` | `~/.config/opencode/skills/` + `~/.config/opencode/commands/showdar/` |
+| Claude Code | `.claude/skills/` | `~/.claude/skills/` |
+
+Codex and Universal intentionally share `.agents/skills/`; `--ai all` avoids
+duplicating that physical destination. OpenCode receives both skills and
+native `/showdar/...` command files.
+
+### Project and global installation
+
+Project scope is the default and writes to the current project:
+
+```bash
+cd my-project
+showdar init --scope project --ai codex --profile developer
+showdar status
+showdar doctor
+```
+
+Global scope does not require a Git repository:
+
+```bash
+showdar init --scope global --ai codex --profile developer
+showdar status --scope global
+showdar doctor --scope global
+```
+
+Global CLI installation is not global skill installation. Project ownership is
+stored in `.showdar.json`; global ownership is stored in `~/.showdar/global.json`.
+Only Showdar-owned paths are refreshed or removed.
+
+## Profiles
+
+Choose a role-specific profile for more precise discovery, or use `full` when
+all capabilities are useful. `full` exposes all 15 skills but still does not
+eagerly load all skill bodies.
+
+| Profile | Skills |
+| --- | ---: |
+| `minimal` | 8 |
+| `developer` | 12 |
+| `backend` | 14 |
+| `qa` | 9 |
+| `product` | 6 |
+| `full` | 15 |
+
+Legacy aliases remain compatible:
+
+```text
+mobile -> developer
+web    -> developer
+```
+
+New manifests store the canonical `developer` profile.
+
+## Skill catalog
+
+All 15 entries remain first-class Showdar skills.
+
+### Analysis and planning
+
+| Skill | Use when |
+| --- | --- |
+| `showdar-understand` | Mapping an unfamiliar repository, architecture, dependencies, or impact before deciding what to change. |
+| `showdar-requirements` | Product or business input needs explicit behavior, rules, acceptance criteria, assumptions, or open decisions. |
+| `showdar-plan` | Agreed behavior needs a bounded implementation plan, change surface, task order, risks, or verification steps. |
+
+### Engineering
+
+| Skill | Use when |
+| --- | --- |
+| `showdar-design` | Product UI needs design direction, UX decisions, responsive layout, accessibility, or visual polish. |
+| `showdar-build` | Implementing or refactoring an agreed application change within existing architecture and contracts. |
+| `showdar-debug` | Observed behavior fails through crashes, regressions, build failures, races, networking, memory, or performance issues. |
+| `showdar-upgrade` | Upgrading dependencies, frameworks, runtimes, or native platforms where compatibility or rollback risk matters. |
+
+### Quality
+
+| Skill | Use when |
+| --- | --- |
+| `showdar-test` | Choosing or implementing automated tests for behavior, regressions, integration, E2E, or coverage. |
+| `showdar-quality` | Planning QA/QC scenarios, risk coverage, regression scope, compatibility checks, or bug-report evidence. |
+| `showdar-review` | Reviewing code or diffs for general correctness, architecture, performance, maintainability, or tests. |
+
+### Security and operations
+
+| Skill | Use when |
+| --- | --- |
+| `showdar-security` | Assessing threat models, attack surfaces, trust boundaries, auth/authz, secrets, exposure, or exploitability. |
+| `showdar-ops` | Inspecting or changing CI/CD, containers, environments, deployment, observability, rollback, or runtime operations. |
+
+### Delivery and recovery
+
+| Skill | Use when |
+| --- | --- |
+| `showdar-ship` | Checking whether a change, artifact, or release is ready for handoff or external release. |
+| `showdar-recover` | Interrupted or partial engineering work must be reconstructed from repository evidence before continuing. |
+| `showdar-git` | Performing local Git inspection, staging, commits, branch integration, conflicts, cleanup, or explicitly requested remote Git actions. |
+
+## Typical software workflow
+
+```text
+Requirements
+    |
+    v
+Plan
+    |
+    +--> Design
+    |
+    v
+Build
+    |
+    +--> Debug
+    +--> Test
+    |
+    v
+Quality
+    |
+    v
+Review / Security
+    |
+    v
+Ship readiness
+    |
+    +--> Ops
+    |
+    v
+Git completion
+```
+
+This is a composition guide, not a mandatory sequence. Choose the skill that
+matches the current intent.
+
+## Usage examples
+
+Codex discovers installed native skills from natural requests or explicit names:
+
+```text
+$showdar-requirements review this ticket for missing rules
+$showdar-plan plan the implementation
+$showdar-debug find the root cause of this crash
+$showdar-quality create regression scenarios
+$showdar-security threat model this auth flow
+$showdar-ops inspect the deployment setup
+$showdar-git commit only the current task changes
+```
+
+OpenCode uses native commands when initialized with `--ai opencode` or
+`--ai all`:
+
+```text
+/showdar/requirements review this ticket for missing rules
+/showdar/debug find the root cause of this crash
+/showdar/security threat model this auth flow
+/showdar/ops inspect the deployment setup
+/showdar/git commit only the current task changes
+```
+
+## Safety boundaries
+
+- `showdar-ship` verifies readiness; it does not automatically deploy or create
+  CI/CD.
+- `showdar-ops` performs operational work when requested. Remote or production
+  mutation requires explicit intent, target, and authorization.
+- `showdar-git` preserves unrelated work and does not imply push, force-push, or
+  destructive cleanup.
+- `showdar-security` performs defensive, evidence-based analysis and never
+  exposes secret values.
+- `showdar-requirements` records assumptions and open decisions instead of
+  inventing stakeholder or business choices.
+
+## CLI reference
+
+```bash
+showdar init [--scope <project|global>] --ai <target> --profile <profile>
+showdar list
+showdar status [--scope <project|global>]
+showdar doctor [--scope <project|global>]
+showdar validate
+showdar remove [--scope <project|global>]
+```
+
+`--ai` accepts `codex`, `opencode`, `claude`, `universal`, or `all`.
+`--scope` defaults to `project`; `--profile` accepts the six canonical profiles
+and the `mobile`/`web` aliases. Run `showdar --help` or a command's `--help`
+for the current options.
+
+`showdar validate` validates the installed Showdar package, not the target
+application. `showdar doctor` checks managed files against ownership hashes;
+`showdar remove` removes only those managed paths and preserves unrelated files.
+
+## Refreshing skills
+
+There is no separate `showdar update` command. Reinstall the CLI, then rerun
+`showdar init` with the same scope, target, and profile:
+
+```bash
+# Future npm install
+npm install -g showdar-skills@latest
+
+# Source development
+npm install -g .
+
+showdar init --scope project --ai codex --profile developer
+```
+
+Initialization is idempotent and refreshes Showdar-owned files. Use
+`showdar remove` for project scope or `showdar remove --scope global` for the
+user installation.
+
+## Maintainer release notes
+
+The first release is manual because the package does not exist on npm yet:
+
+```bash
+npm pack
+npm publish ./showdar-skills-0.2.0.tgz
+```
+
+After the package exists, configure npm Trusted Publishing for the
+`caongocquy/showdar-skills` GitHub Actions workflow named `publish.yml`. The
+workflow runs only for `v*` tags, verifies the tag/package version, uses OIDC
+with provenance, and contains no npm token. It skips an already-published
+version and fails on registry errors other than a real E404. Trusted
+Publishing is not configured yet. The repository's `RELEASING.md` contains
+the maintainer runbook.
+
+## Development
+
+```bash
+npm test
+npm run validate
+npm run check
+npm run smoke
+npm run eval
+npm pack --dry-run
+```
+
+Showdar stays dependency-light and uses Node.js built-ins for its CLI,
+validator, search engine, installer, and tests. Supporting knowledge remains
+in each skill's `data/`, `references/`, `scripts/`, `stacks/`, and `examples/`
+directories so the selected workflow can load it progressively.
+
+## License
+
+MIT

package/bin/showdar.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { homedir } from 'node:os';
+import { readFile } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import { AI_TARGETS, PROFILE_ALIASES, PROFILES, SKILLS, canonicalProfile, isDeprecatedProfile, resolveProfile } from '../src/catalog.js';
+import { globalManifestPath, initGlobal, initProject, inspectGlobal, inspectProject, removeGlobal, removeProject } from '../src/project.js';
+import { validateRepository } from '../src/validate.js';
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const COMMANDS = ['understand', 'plan', 'design', 'build', 'debug', 'test', 'review', 'upgrade', 'ship', 'recover', 'git', 'requirements', 'quality', 'security', 'ops', 'skill'];
+const SCOPES = ['project', 'global'];
+
+function valueAfter(args, flag, fallback) {
+  const i = args.indexOf(flag);
+  if (i === -1) return fallback;
+  if (!args[i + 1] || args[i + 1].startsWith('--')) throw new Error(`${flag} requires a value`);
+  return args[i + 1];
+}
+
+async function packageVersion() {
+  const pkg = JSON.parse(await readFile(path.join(packageRoot, 'package.json'), 'utf8'));
+  return pkg.version;
+}
+
+function scopeAfter(args) {
+  const scope = valueAfter(args, '--scope', 'project');
+  if (!SCOPES.includes(scope)) throw new Error(`Unknown scope "${scope}". Expected project or global.`);
+  return scope;
+}
+
+function printHelp(version, command = null) {
+  const scopeUsage = '[--scope <project|global>]';
+  if (command === 'init') {
+    console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar init ${scopeUsage} [--profile <name>] [--ai <codex|opencode|claude|universal|all>]\n\nDefaults: scope project, profile full, AI target universal.\nProject scope writes native skills and project .showdar.json. Global scope writes verified user skill directories and ~/.showdar/global.json without project files. Codex and universal use .agents/skills in project scope and ~/.agents/skills in global scope; --ai all writes each shared destination once.\n\nProfiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\nAI targets: ${AI_TARGETS.join(', ')}`);
+    return;
+  }
+  if (['status', 'doctor', 'remove'].includes(command)) {
+    console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar ${command} ${scopeUsage}\n\nDefault scope: project. Use --scope global for the user installation.`);
+    return;
+  }
+  console.log(`Showdar Skills ${version}\n\nUsage:\n  showdar init ${scopeUsage} [--profile <name>] [--ai <codex|opencode|claude|universal|all>]\n  showdar status ${scopeUsage}\n  showdar doctor ${scopeUsage}\n  showdar validate\n  showdar list\n  showdar remove ${scopeUsage}\n\nDefaults: scope project, profile full, AI target universal.\nProfiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\nAI targets: ${AI_TARGETS.join(', ')}`);
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const command = args[0] ?? 'help';
+  const projectRoot = process.cwd();
+  const version = await packageVersion();
+
+  if (command === 'help' || command === '--help' || command === '-h') return printHelp(version);
+  if (args.includes('--help') || args.includes('-h')) return printHelp(version, command);
+
+  const scope = ['init', 'status', 'doctor', 'remove'].includes(command) ? scopeAfter(args) : null;
+
+  if (command === 'list') {
+    console.log(`Profiles: ${Object.keys(PROFILES).join(', ')}\nDeprecated aliases: ${Object.entries(PROFILE_ALIASES).map(([alias, target]) => `${alias} -> ${target}`).join(', ')}\n\nSkills:`);
+    for (const skill of SKILLS) console.log(`  ${skill.id}  [${skill.domain}]  ${skill.description}`);
+    return;
+  }
+
+  if (command === 'validate') {
+    const result = await validateRepository(packageRoot);
+    if (result.ok) console.log(`Showdar validation OK (${SKILLS.length} skills).`);
+    else {
+      console.log(`Showdar validation FAILED (${result.errors.length} errors).`);
+      for (const error of result.errors) console.log(`- ${error}`);
+      process.exitCode = 1;
+    }
+    for (const warning of result.warnings) console.log(`warning: ${warning}`);
+    return;
+  }
+
+  if (command === 'init') {
+    if (args.includes('--agent')) throw new Error('--agent is no longer supported in V0.2. Use --ai <codex|opencode|claude|universal|all>.');
+    const requestedProfile = valueAfter(args, '--profile', 'full');
+    const profile = canonicalProfile(requestedProfile);
+    const ai = valueAfter(args, '--ai', 'universal');
+    const skillIds = resolveProfile(requestedProfile);
+    if (isDeprecatedProfile(requestedProfile)) console.warn(`Warning: profile "${requestedProfile}" is deprecated; use "${profile}".`);
+    const commandNames = ai === 'opencode' || ai === 'all' ? COMMANDS : [];
+    const result = scope === 'global'
+      ? await initGlobal({ homeRoot: homedir(), packageRoot, profile, ai, skillIds, commandNames, packageVersion: version })
+      : await initProject({ projectRoot, packageRoot, profile, ai, skillIds, commandNames, packageVersion: version });
+    console.log(`Showdar Skills installed.\nScope: ${scope}\nProfile: ${profile}\nAI: ${ai}\nTargets: ${result.targets.join(', ')}\nSkills: ${result.skills}\nOpenCode commands: ${result.commands}`);
+    if (scope === 'global') console.log(`Manifest: ${globalManifestPath()}`);
+    if (result.targets.includes('codex')) console.log('Codex: invoke skills directly with $showdar-<name> or let native skill discovery route by description.');
+    if (result.targets.includes('opencode')) console.log('OpenCode: use native skill discovery or /showdar/<command>.');
+    return;
+  }
+
+  if (command === 'status' || command === 'doctor') {
+    const result = scope === 'global' ? await inspectGlobal() : await inspectProject(projectRoot);
+    if (!result.installed) {
+      console.log(`Showdar Skills is not installed in the ${scope} scope.`);
+      if (command === 'doctor') process.exitCode = 1;
+      return;
+    }
+    console.log(`Showdar Skills\nScope: ${result.scope}\nProfile: ${result.profile}\nAI: ${result.ai}\nTargets: ${result.targets.join(', ')}\nSkills: ${result.skills}\nCommands: ${result.commands}\nHealth: ${result.healthy ? 'OK' : 'BROKEN'}`);
+    for (const issue of result.issues) console.log(`- ${issue}`);
+    if (command === 'doctor' && !result.healthy) process.exitCode = 1;
+    return;
+  }
+
+  if (command === 'remove') {
+    if (scope === 'global') await removeGlobal();
+    else await removeProject(projectRoot);
+    console.log(`Showdar Skills removed from the ${scope} scope.`);
+    return;
+  }
+
+  throw new Error(`Unknown command "${command}". Run "showdar --help".`);
+}
+
+main().catch((error) => {
+  console.error(`showdar: ${error.message}`);
+  process.exitCode = 1;
+});

package/bundles/bugfix.yaml

@@ -0,0 +1,4 @@
+version: 2
+name: bugfix
+skills: [showdar-understand, showdar-debug, showdar-test, showdar-review]
+flow: "understand only as needed -> debug root cause -> regression proof -> review changed behavior"

package/bundles/design.yaml

@@ -0,0 +1,4 @@
+version: 2
+name: design
+skills: [showdar-design, showdar-build, showdar-test, showdar-review]
+flow: "design direction/system -> stack implementation -> UI verification -> review"

package/bundles/feature.yaml

@@ -0,0 +1,4 @@
+version: 2
+name: feature
+skills: [showdar-understand, showdar-plan, showdar-build, showdar-test, showdar-review]
+flow: "understand -> plan -> build -> test -> review"

package/bundles/release.yaml

@@ -0,0 +1,4 @@
+version: 2
+name: release
+skills: [showdar-review, showdar-ship]
+flow: "pre-release review -> delivery verification -> handoff decision -> optional explicitly requested release execution"

package/bundles/upgrade.yaml

@@ -0,0 +1,4 @@
+version: 2
+name: upgrade
+skills: [showdar-understand, showdar-upgrade, showdar-test, showdar-review, showdar-ship]
+flow: "inventory -> compatibility/migration -> verify -> review -> release readiness"

package/commands/opencode/showdar/build.md

@@ -0,0 +1,6 @@
+---
+description: Implement the smallest coherent production change with Showdar
+---
+Load and follow `showdar-build`. Preserve repository architecture and contracts, keep the change surface bounded, and verify before claiming completion.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/debug.md

@@ -0,0 +1,6 @@
+---
+description: Debug a failure through evidence-first root-cause analysis with Showdar
+---
+Load and follow `showdar-debug`. Gather evidence and test falsifiable hypotheses before modifying production behavior.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/design.md

@@ -0,0 +1,6 @@
+---
+description: Design, implement, review, or polish UI using Showdar design intelligence
+---
+Load and follow `showdar-design`. Detect whether the request is new design, implementation guidance, review, or polish, then use the skill's local data/search and stack guidance selectively.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/git.md

@@ -0,0 +1,6 @@
+---
+description: Complete a local Git workflow safely without inferring push, GitHub, CI/CD, deployment, or release actions
+---
+Load and follow `showdar-git`. Inspect the repository before mutation, separate task-owned and unrelated changes, stage explicit paths, and verify the final Git state. Remote mutations require explicit user intent.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/ops.md

@@ -0,0 +1,7 @@
+---
+description: Handle CI/CD, deployment, containers, observability, and rollback operations
+---
+
+Load and follow `showdar-ops` for the request below. Inspect operational state read-only by default; modify local operational config or execute remote/production actions only when explicitly requested and authorized.
+
+$ARGUMENTS

package/commands/opencode/showdar/plan.md

@@ -0,0 +1,6 @@
+---
+description: Create a bounded executable engineering plan with Showdar
+---
+Load and follow `showdar-plan`. Ground the plan in the current repository, keep non-goals explicit, and include concrete verification.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/quality.md

@@ -0,0 +1,7 @@
+---
+description: Plan QA scenarios, risk coverage, regression scope, and evidence
+---
+
+Load and follow `showdar-quality` for the request below. Plan what should be verified, distinguish planned from executed evidence, and hand automated test implementation to `showdar-test`. Do not claim acceptance without evidence.
+
+$ARGUMENTS

package/commands/opencode/showdar/recover.md

@@ -0,0 +1,6 @@
+---
+description: Recover interrupted work from repository evidence with Showdar
+---
+Load and follow `showdar-recover`. Reconstruct the goal and durable state before editing, preserve unrelated user changes, and identify the safest next action.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/requirements.md

@@ -0,0 +1,7 @@
+---
+description: Analyze requirements, ambiguity, business rules, and acceptance criteria
+---
+
+Load and follow `showdar-requirements` for the request below. Separate supplied facts, repository observations, assumptions, and open decisions. Do not invent stakeholder intent or modify application code by default.
+
+$ARGUMENTS

package/commands/opencode/showdar/review.md

@@ -0,0 +1,6 @@
+---
+description: Review code for general correctness, architecture, performance, maintainability, and tests
+---
+Load and follow `showdar-review`. Focus on general correctness, architecture, performance, maintainability, and tests; use `showdar-security` for security-specific threats, auth, secrets, exposure, or exploitability.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/security.md

@@ -0,0 +1,7 @@
+---
+description: Analyze security posture, threats, auth, secrets, and data exposure
+---
+
+Load and follow `showdar-security` for the request below. Use repository evidence, distinguish confirmed issues from suspected risks, redact sensitive values, and do not perform offensive or destructive actions by default.
+
+$ARGUMENTS

package/commands/opencode/showdar/ship.md

@@ -0,0 +1,6 @@
+---
+description: Verify delivery readiness with Showdar without creating CI or taking unapproved external actions
+---
+Load and follow `showdar-ship` in delivery verification mode. Inspect the diff, run relevant local checks, and report readiness. Existing CI is read-only; do not create or modify `.github/workflows/**`, deploy, publish, submit to a store, or mutate production unless the user explicitly requests that execution scope.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/skill.md

@@ -0,0 +1,6 @@
+---
+description: Invoke a specific Showdar flagship skill explicitly
+---
+Select exactly one requested Showdar skill and follow it: `showdar-understand`, `showdar-plan`, `showdar-design`, `showdar-build`, `showdar-debug`, `showdar-test`, `showdar-review`, `showdar-upgrade`, `showdar-ship`, `showdar-recover`, `showdar-git`, `showdar-requirements`, `showdar-quality`, `showdar-security`, or `showdar-ops`. If the requested name is ambiguous, choose the smallest matching skill from this list and say which one was selected.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/test.md

@@ -0,0 +1,6 @@
+---
+description: Choose and implement the lowest effective test strategy with Showdar
+---
+Load and follow `showdar-test`. Prove behavior at the lowest effective level and avoid fragile mock-heavy coverage.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/understand.md

@@ -0,0 +1,6 @@
+---
+description: Understand repository architecture and task-relevant change surface with Showdar
+---
+Load and follow `showdar-understand`. Analyze the repository or subsystem relevant to this request without implementing changes unless the user explicitly asks to switch workflows.
+
+Request: $ARGUMENTS

package/commands/opencode/showdar/upgrade.md

@@ -0,0 +1,6 @@
+---
+description: Upgrade frameworks, dependencies, runtimes, or platforms safely with Showdar
+---
+Load and follow `showdar-upgrade`. Establish compatibility, breaking changes, migration order, rollback, and affected-platform verification before claiming success.
+
+Request: $ARGUMENTS

package/engine/csv.mjs

@@ -0,0 +1,45 @@
+export function parseCsv(text, { strict = true } = {}) {
+  const rows = [];
+  let row = [];
+  let field = '';
+  let quoted = false;
+  const pushRow = () => {
+    row.push(field);
+    rows.push(row);
+    row = [];
+    field = '';
+  };
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    if (quoted) {
+      if (ch === '"' && text[i + 1] === '"') { field += '"'; i += 1; }
+      else if (ch === '"') quoted = false;
+      else field += ch;
+      continue;
+    }
+    if (ch === '"') quoted = true;
+    else if (ch === ',') { row.push(field); field = ''; }
+    else if (ch === '\n') pushRow();
+    else if (ch !== '\r') field += ch;
+  }
+  if (quoted && strict) throw new Error('unterminated quoted field');
+  if (field.length || row.length) pushRow();
+  const clean = rows.filter((r) => r.some((value) => value.trim() !== ''));
+  if (!clean.length) return [];
+  const headers = clean[0].map((value) => value.trim());
+  if (strict && headers.some((header) => !header)) throw new Error('blank CSV header');
+  if (strict && new Set(headers.map((header) => header.toLowerCase())).size !== headers.length) throw new Error('duplicate CSV header');
+  return clean.slice(1).map((values) => {
+    if (strict && values.length !== headers.length) throw new Error(`CSV column count ${values.length} does not match header count ${headers.length}`);
+    return Object.fromEntries(headers.map((header, index) => [header, values[index] ?? '']));
+  });
+}
+
+export function stringifyCsv(rows, headers = rows.length ? Object.keys(rows[0]) : []) {
+  const escape = (value) => {
+    const raw = String(value ?? '');
+    if (!/[",\n\r]/.test(raw)) return raw;
+    return `"${raw.replaceAll('"', '""')}"`;
+  };
+  return [headers.map(escape).join(','), ...rows.map((row) => headers.map((header) => escape(row[header])).join(','))].join('\n') + '\n';
+}