feat: complete OpenCode plugin support with hooks, tools, and commands

Major OpenCode integration overhaul:

- llms.txt: Comprehensive OpenCode documentation for LLMs (642 lines)
- .opencode/plugins/ecc-hooks.ts: All Claude Code hooks translated to OpenCode's plugin system
- .opencode/tools/*.ts: 3 custom tools (run-tests, check-coverage, security-audit)
- .opencode/commands/*.md: All 24 commands in OpenCode format
- .opencode/package.json: npm package structure for opencode-ecc
- .opencode/index.ts: Main plugin entry point

- Delete incorrect LIMITATIONS.md (hooks ARE supported via plugins)
- Rewrite MIGRATION.md with correct hook event mapping
- Update README.md OpenCode section to show full feature parity

OpenCode has 20+ events vs Claude Code's 3 phases:
- PreToolUse → tool.execute.before
- PostToolUse → tool.execute.after
- Stop → session.idle
- SessionStart → session.created
- SessionEnd → session.deleted
- Plus: file.edited, file.watcher.updated, permission.asked, todo.updated

- 12 agents: Full parity
- 24 commands: Full parity (+1 from original 23)
- 16 skills: Full parity
- Hooks: OpenCode has MORE (20+ events vs 3 phases)
- Custom Tools: 3 native OpenCode tools

The OpenCode configuration can now be:
1. Used directly: cd everything-claude-code && opencode
2. Installed via npm: npm install opencode-ecc

.claude-plugin/plugin.json

@@ -33,6 +33,7 @@
     "./agents/go-build-resolver.md",
     "./agents/go-reviewer.md",
     "./agents/planner.md",
+    "./agents/python-reviewer.md",
     "./agents/refactor-cleaner.md",
     "./agents/security-reviewer.md",
     "./agents/tdd-guide.md"

.opencode/MIGRATION.md

@@ -0,0 +1,356 @@
+# Migration Guide: Claude Code to OpenCode
+
+This guide helps you migrate from Claude Code to OpenCode while using the Everything Claude Code (ECC) configuration.
+
+## Overview
+
+OpenCode is an alternative CLI for AI-assisted development that supports **all** the same features as Claude Code, with some differences in configuration format.
+
+## Key Differences
+
+| Feature | Claude Code | OpenCode | Notes |
+|---------|-------------|----------|-------|
+| Configuration | `CLAUDE.md`, `plugin.json` | `opencode.json` | Different file formats |
+| Agents | Markdown frontmatter | JSON object | Full parity |
+| Commands | `commands/*.md` | `command` object or `.md` files | Full parity |
+| Skills | `skills/*/SKILL.md` | `instructions` array | Loaded as context |
+| **Hooks** | `hooks.json` (3 phases) | **Plugin system (20+ events)** | **Full parity + more!** |
+| Rules | `rules/*.md` | `instructions` array | Consolidated or separate |
+| MCP | Full support | Full support | Full parity |
+
+## Hook Migration
+
+**OpenCode fully supports hooks** via its plugin system, which is actually MORE sophisticated than Claude Code with 20+ event types.
+
+### Hook Event Mapping
+
+| Claude Code Hook | OpenCode Plugin Event | Notes |
+|-----------------|----------------------|-------|
+| `PreToolUse` | `tool.execute.before` | Can modify tool input |
+| `PostToolUse` | `tool.execute.after` | Can modify tool output |
+| `Stop` | `session.idle` or `session.status` | Session lifecycle |
+| `SessionStart` | `session.created` | Session begins |
+| `SessionEnd` | `session.deleted` | Session ends |
+| N/A | `file.edited` | OpenCode-only: file changes |
+| N/A | `file.watcher.updated` | OpenCode-only: file system watch |
+| N/A | `message.updated` | OpenCode-only: message changes |
+| N/A | `lsp.client.diagnostics` | OpenCode-only: LSP integration |
+| N/A | `tui.toast.show` | OpenCode-only: notifications |
+
+### Converting Hooks to Plugins
+
+**Claude Code hook (hooks.json):**
+```json
+{
+  "PostToolUse": [{
+    "matcher": "tool == \"Edit\" && tool_input.file_path matches \"\\\\.(ts|tsx|js|jsx)$\"",
+    "hooks": [{
+      "type": "command",
+      "command": "prettier --write \"$file_path\""
+    }]
+  }]
+}
+```
+
+**OpenCode plugin (.opencode/plugins/prettier-hook.ts):**
+```typescript
+export const PrettierPlugin = async ({ $ }) => {
+  return {
+    "file.edited": async (event) => {
+      if (event.path.match(/\.(ts|tsx|js|jsx)$/)) {
+        await $`prettier --write ${event.path}`
+      }
+    }
+  }
+}
+```
+
+### ECC Plugin Hooks Included
+
+The ECC OpenCode configuration includes translated hooks:
+
+| Hook | OpenCode Event | Purpose |
+|------|----------------|---------|
+| Prettier auto-format | `file.edited` | Format JS/TS files after edit |
+| TypeScript check | `tool.execute.after` | Run tsc after editing .ts files |
+| console.log warning | `file.edited` | Warn about console.log statements |
+| Session notification | `session.idle` | Notify when task completes |
+| Security check | `tool.execute.before` | Check for secrets before commit |
+
+## Migration Steps
+
+### 1. Install OpenCode
+
+```bash
+# Install OpenCode CLI
+npm install -g opencode
+# or
+curl -fsSL https://opencode.ai/install | bash
+```
+
+### 2. Use the ECC OpenCode Configuration
+
+The `.opencode/` directory in this repository contains the translated configuration:
+
+```
+.opencode/
+├── opencode.json              # Main configuration
+├── plugins/                   # Hook plugins (translated from hooks.json)
+│   ├── ecc-hooks.ts           # All ECC hooks as plugins
+│   └── index.ts               # Plugin exports
+├── tools/                     # Custom tools
+│   ├── run-tests.ts           # Run test suite
+│   ├── check-coverage.ts      # Check coverage
+│   └── security-audit.ts      # npm audit wrapper
+├── commands/                  # All 23 commands (markdown)
+│   ├── plan.md
+│   ├── tdd.md
+│   └── ... (21 more)
+├── prompts/
+│   └── agents/                # Agent prompt files (12)
+├── instructions/
+│   └── INSTRUCTIONS.md        # Consolidated rules
+├── package.json               # For npm distribution
+├── tsconfig.json              # TypeScript config
+└── MIGRATION.md               # This file
+```
+
+### 3. Run OpenCode
+
+```bash
+# In the repository root
+opencode
+
+# The configuration is automatically detected from .opencode/opencode.json
+```
+
+## Concept Mapping
+
+### Agents
+
+**Claude Code:**
+```markdown
+---
+name: planner
+description: Expert planning specialist...
+tools: ["Read", "Grep", "Glob"]
+model: opus
+---
+
+You are an expert planning specialist...
+```
+
+**OpenCode:**
+```json
+{
+  "agent": {
+    "planner": {
+      "description": "Expert planning specialist...",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/planner.txt}",
+      "tools": { "read": true, "bash": true }
+    }
+  }
+}
+```
+
+### Commands
+
+**Claude Code:**
+```markdown
+---
+name: plan
+description: Create implementation plan
+---
+
+Create a detailed implementation plan for: {input}
+```
+
+**OpenCode (JSON):**
+```json
+{
+  "command": {
+    "plan": {
+      "description": "Create implementation plan",
+      "template": "Create a detailed implementation plan for: $ARGUMENTS",
+      "agent": "planner"
+    }
+  }
+}
+```
+
+**OpenCode (Markdown - .opencode/commands/plan.md):**
+```markdown
+---
+description: Create implementation plan
+agent: planner
+---
+
+Create a detailed implementation plan for: $ARGUMENTS
+```
+
+### Skills
+
+**Claude Code:** Skills are loaded from `skills/*/SKILL.md` files.
+
+**OpenCode:** Skills are added to the `instructions` array:
+```json
+{
+  "instructions": [
+    "skills/tdd-workflow/SKILL.md",
+    "skills/security-review/SKILL.md",
+    "skills/coding-standards/SKILL.md"
+  ]
+}
+```
+
+### Rules
+
+**Claude Code:** Rules are in separate `rules/*.md` files.
+
+**OpenCode:** Rules can be consolidated into `instructions` or kept separate:
+```json
+{
+  "instructions": [
+    ".opencode/instructions/INSTRUCTIONS.md",
+    "rules/security.md",
+    "rules/coding-style.md"
+  ]
+}
+```
+
+## Model Mapping
+
+| Claude Code | OpenCode |
+|-------------|----------|
+| `opus` | `anthropic/claude-opus-4-5` |
+| `sonnet` | `anthropic/claude-sonnet-4-5` |
+| `haiku` | `anthropic/claude-haiku-4-5` |
+
+## Available Commands
+
+After migration, ALL 23 commands are available:
+
+| Command | Description |
+|---------|-------------|
+| `/plan` | Create implementation plan |
+| `/tdd` | Enforce TDD workflow |
+| `/code-review` | Review code changes |
+| `/security` | Run security review |
+| `/build-fix` | Fix build errors |
+| `/e2e` | Generate E2E tests |
+| `/refactor-clean` | Remove dead code |
+| `/orchestrate` | Multi-agent workflow |
+| `/learn` | Extract patterns mid-session |
+| `/checkpoint` | Save verification state |
+| `/verify` | Run verification loop |
+| `/eval` | Run evaluation |
+| `/update-docs` | Update documentation |
+| `/update-codemaps` | Update codemaps |
+| `/test-coverage` | Check test coverage |
+| `/setup-pm` | Configure package manager |
+| `/go-review` | Go code review |
+| `/go-test` | Go TDD workflow |
+| `/go-build` | Fix Go build errors |
+| `/skill-create` | Generate skills from git history |
+| `/instinct-status` | View learned instincts |
+| `/instinct-import` | Import instincts |
+| `/instinct-export` | Export instincts |
+| `/evolve` | Cluster instincts into skills |
+
+## Available Agents
+
+| Agent | Description |
+|-------|-------------|
+| `planner` | Implementation planning |
+| `architect` | System design |
+| `code-reviewer` | Code review |
+| `security-reviewer` | Security analysis |
+| `tdd-guide` | Test-driven development |
+| `build-error-resolver` | Fix build errors |
+| `e2e-runner` | E2E testing |
+| `doc-updater` | Documentation |
+| `refactor-cleaner` | Dead code cleanup |
+| `go-reviewer` | Go code review |
+| `go-build-resolver` | Go build errors |
+| `database-reviewer` | Database optimization |
+
+## Plugin Installation
+
+### Option 1: Use ECC Configuration Directly
+
+The `.opencode/` directory contains everything pre-configured.
+
+### Option 2: Install as npm Package
+
+```bash
+npm install opencode-ecc
+```
+
+Then in your `opencode.json`:
+```json
+{
+  "plugin": ["opencode-ecc"]
+}
+```
+
+## Troubleshooting
+
+### Configuration Not Loading
+
+1. Verify `.opencode/opencode.json` exists in the repository root
+2. Check JSON syntax is valid: `cat .opencode/opencode.json | jq .`
+3. Ensure all referenced prompt files exist
+
+### Plugin Not Loading
+
+1. Verify plugin file exists in `.opencode/plugins/`
+2. Check TypeScript syntax is valid
+3. Ensure `plugin` array in `opencode.json` includes the path
+
+### Agent Not Found
+
+1. Check the agent is defined in `opencode.json` under the `agent` object
+2. Verify the prompt file path is correct
+3. Ensure the prompt file exists at the specified path
+
+### Command Not Working
+
+1. Verify the command is defined in `opencode.json` or as `.md` file in `.opencode/commands/`
+2. Check the referenced agent exists
+3. Ensure the template uses `$ARGUMENTS` for user input
+
+## Best Practices
+
+1. **Start Fresh**: Don't try to run both Claude Code and OpenCode simultaneously
+2. **Check Configuration**: Verify `opencode.json` loads without errors
+3. **Test Commands**: Run each command once to verify it works
+4. **Use Plugins**: Leverage the plugin hooks for automation
+5. **Use Agents**: Leverage the specialized agents for their intended purposes
+
+## Reverting to Claude Code
+
+If you need to switch back:
+
+1. Simply run `claude` instead of `opencode`
+2. Claude Code will use its own configuration (`CLAUDE.md`, `plugin.json`, etc.)
+3. The `.opencode/` directory won't interfere with Claude Code
+
+## Feature Parity Summary
+
+| Feature | Claude Code | OpenCode | Status |
+|---------|-------------|----------|--------|
+| Agents | ✅ 12 agents | ✅ 12 agents | **Full parity** |
+| Commands | ✅ 23 commands | ✅ 23 commands | **Full parity** |
+| Skills | ✅ 16 skills | ✅ 16 skills | **Full parity** |
+| Hooks | ✅ 3 phases | ✅ 20+ events | **OpenCode has MORE** |
+| Rules | ✅ 8 rules | ✅ 8 rules | **Full parity** |
+| MCP Servers | ✅ Full | ✅ Full | **Full parity** |
+| Custom Tools | ✅ Via hooks | ✅ Native support | **OpenCode is better** |
+
+## Feedback
+
+For issues specific to:
+- **OpenCode CLI**: Report to OpenCode's issue tracker
+- **ECC Configuration**: Report to [github.com/affaan-m/everything-claude-code](https://github.com/affaan-m/everything-claude-code)

.opencode/README.md

@@ -0,0 +1,152 @@
+# OpenCode ECC Plugin
+
+Everything Claude Code (ECC) plugin for OpenCode - agents, commands, hooks, and skills.
+
+## Installation
+
+### Option 1: npm Package
+
+```bash
+npm install opencode-ecc
+```
+
+Add to your `opencode.json`:
+
+```json
+{
+  "plugin": ["opencode-ecc"]
+}
+```
+
+### Option 2: Direct Use
+
+Clone and run OpenCode in the repository:
+
+```bash
+git clone https://github.com/affaan-m/everything-claude-code
+cd everything-claude-code
+opencode
+```
+
+## Features
+
+### Agents (12)
+
+| Agent | Description |
+|-------|-------------|
+| planner | Implementation planning |
+| architect | System design |
+| code-reviewer | Code review |
+| security-reviewer | Security analysis |
+| tdd-guide | Test-driven development |
+| build-error-resolver | Build error fixes |
+| e2e-runner | E2E testing |
+| doc-updater | Documentation |
+| refactor-cleaner | Dead code cleanup |
+| go-reviewer | Go code review |
+| go-build-resolver | Go build errors |
+| database-reviewer | Database optimization |
+
+### Commands (24)
+
+| Command | Description |
+|---------|-------------|
+| `/plan` | Create implementation plan |
+| `/tdd` | TDD workflow |
+| `/code-review` | Review code changes |
+| `/security` | Security review |
+| `/build-fix` | Fix build errors |
+| `/e2e` | E2E tests |
+| `/refactor-clean` | Remove dead code |
+| `/orchestrate` | Multi-agent workflow |
+| `/learn` | Extract patterns |
+| `/checkpoint` | Save progress |
+| `/verify` | Verification loop |
+| `/eval` | Evaluation |
+| `/update-docs` | Update docs |
+| `/update-codemaps` | Update codemaps |
+| `/test-coverage` | Coverage analysis |
+| `/setup-pm` | Package manager |
+| `/go-review` | Go code review |
+| `/go-test` | Go TDD |
+| `/go-build` | Go build fix |
+| `/skill-create` | Generate skills |
+| `/instinct-status` | View instincts |
+| `/instinct-import` | Import instincts |
+| `/instinct-export` | Export instincts |
+| `/evolve` | Cluster instincts |
+
+### Plugin Hooks
+
+| Hook | Event | Purpose |
+|------|-------|---------|
+| Prettier | `file.edited` | Auto-format JS/TS |
+| TypeScript | `tool.execute.after` | Check for type errors |
+| console.log | `file.edited` | Warn about debug statements |
+| Notification | `session.idle` | Desktop notification |
+| Security | `tool.execute.before` | Check for secrets |
+
+### Custom Tools
+
+| Tool | Description |
+|------|-------------|
+| run-tests | Run test suite with options |
+| check-coverage | Analyze test coverage |
+| security-audit | Security vulnerability scan |
+
+## Hook Event Mapping
+
+OpenCode's plugin system maps to Claude Code hooks:
+
+| Claude Code | OpenCode |
+|-------------|----------|
+| PreToolUse | `tool.execute.before` |
+| PostToolUse | `tool.execute.after` |
+| Stop | `session.idle` |
+| SessionStart | `session.created` |
+| SessionEnd | `session.deleted` |
+
+OpenCode has 20+ additional events not available in Claude Code.
+
+## Skills
+
+All 16 ECC skills are available via the `instructions` array:
+
+- coding-standards
+- backend-patterns
+- frontend-patterns
+- security-review
+- tdd-workflow
+- continuous-learning
+- continuous-learning-v2
+- iterative-retrieval
+- strategic-compact
+- eval-harness
+- verification-loop
+- golang-patterns
+- golang-testing
+- clickhouse-io
+- pmx-guidelines
+
+## Configuration
+
+Full configuration in `opencode.json`:
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "model": "anthropic/claude-sonnet-4-5",
+  "small_model": "anthropic/claude-haiku-4-5",
+  "plugin": ["./.opencode/plugins"],
+  "instructions": [
+    "skills/tdd-workflow/SKILL.md",
+    "skills/security-review/SKILL.md"
+  ],
+  "agent": { /* 12 agents */ },
+  "command": { /* 24 commands */ }
+}
+```
+
+## License
+
+MIT

.opencode/commands/build-fix.md

@@ -0,0 +1,56 @@
+---
+description: Fix build and TypeScript errors with minimal changes
+agent: build-error-resolver
+subtask: true
+---
+
+# Build Fix Command
+
+Fix build and TypeScript errors with minimal changes: $ARGUMENTS
+
+## Your Task
+
+1. **Run type check**: `npx tsc --noEmit`
+2. **Collect all errors**
+3. **Fix errors one by one** with minimal changes
+4. **Verify each fix** doesn't introduce new errors
+5. **Run final check** to confirm all errors resolved
+
+## Approach
+
+### DO:
+- ✅ Fix type errors with correct types
+- ✅ Add missing imports
+- ✅ Fix syntax errors
+- ✅ Make minimal changes
+- ✅ Preserve existing behavior
+- ✅ Run `tsc --noEmit` after each change
+
+### DON'T:
+- ❌ Refactor code
+- ❌ Add new features
+- ❌ Change architecture
+- ❌ Use `any` type (unless absolutely necessary)
+- ❌ Add `@ts-ignore` comments
+- ❌ Change business logic
+
+## Common Error Fixes
+
+| Error | Fix |
+|-------|-----|
+| Type 'X' is not assignable to type 'Y' | Add correct type annotation |
+| Property 'X' does not exist | Add property to interface or fix property name |
+| Cannot find module 'X' | Install package or fix import path |
+| Argument of type 'X' is not assignable | Cast or fix function signature |
+| Object is possibly 'undefined' | Add null check or optional chaining |
+
+## Verification Steps
+
+After fixes:
+1. `npx tsc --noEmit` - should show 0 errors
+2. `npm run build` - should succeed
+3. `npm test` - tests should still pass
+
+---
+
+**IMPORTANT**: Focus on fixing errors only. No refactoring, no improvements, no architectural changes. Get the build green with minimal diff.

.opencode/commands/checkpoint.md

@@ -0,0 +1,67 @@
+---
+description: Save verification state and progress checkpoint
+agent: build
+---
+
+# Checkpoint Command
+
+Save current verification state and create progress checkpoint: $ARGUMENTS
+
+## Your Task
+
+Create a snapshot of current progress including:
+
+1. **Tests status** - Which tests pass/fail
+2. **Coverage** - Current coverage metrics
+3. **Build status** - Build succeeds or errors
+4. **Code changes** - Summary of modifications
+5. **Next steps** - What remains to be done
+
+## Checkpoint Format
+
+### Checkpoint: [Timestamp]
+
+**Tests**
+- Total: X
+- Passing: Y
+- Failing: Z
+- Coverage: XX%
+
+**Build**
+- Status: ✅ Passing / ❌ Failing
+- Errors: [if any]
+
+**Changes Since Last Checkpoint**
+```
+git diff --stat [last-checkpoint-commit]
+```
+
+**Completed Tasks**
+- [x] Task 1
+- [x] Task 2
+- [ ] Task 3 (in progress)
+
+**Blocking Issues**
+- [Issue description]
+
+**Next Steps**
+1. Step 1
+2. Step 2
+
+## Usage with Verification Loop
+
+Checkpoints integrate with the verification loop:
+
+```
+/plan → implement → /checkpoint → /verify → /checkpoint → implement → ...
+```
+
+Use checkpoints to:
+- Save state before risky changes
+- Track progress through phases
+- Enable rollback if needed
+- Document verification points
+
+---
+
+**TIP**: Create checkpoints at natural breakpoints: after each phase, before major refactoring, after fixing critical bugs.

.opencode/commands/code-review.md

@@ -0,0 +1,68 @@
+---
+description: Review code for quality, security, and maintainability
+agent: code-reviewer
+subtask: true
+---
+
+# Code Review Command
+
+Review code changes for quality, security, and maintainability: $ARGUMENTS
+
+## Your Task
+
+1. **Get changed files**: Run `git diff --name-only HEAD`
+2. **Analyze each file** for issues
+3. **Generate structured report**
+4. **Provide actionable recommendations**
+
+## Check Categories
+
+### Security Issues (CRITICAL)
+- [ ] Hardcoded credentials, API keys, tokens
+- [ ] SQL injection vulnerabilities
+- [ ] XSS vulnerabilities
+- [ ] Missing input validation
+- [ ] Insecure dependencies
+- [ ] Path traversal risks
+- [ ] Authentication/authorization flaws
+
+### Code Quality (HIGH)
+- [ ] Functions > 50 lines
+- [ ] Files > 800 lines
+- [ ] Nesting depth > 4 levels
+- [ ] Missing error handling
+- [ ] console.log statements
+- [ ] TODO/FIXME comments
+- [ ] Missing JSDoc for public APIs
+
+### Best Practices (MEDIUM)
+- [ ] Mutation patterns (use immutable instead)
+- [ ] Unnecessary complexity
+- [ ] Missing tests for new code
+- [ ] Accessibility issues (a11y)
+- [ ] Performance concerns
+
+### Style (LOW)
+- [ ] Inconsistent naming
+- [ ] Missing type annotations
+- [ ] Formatting issues
+
+## Report Format
+
+For each issue found:
+
+```
+**[SEVERITY]** file.ts:123
+Issue: [Description]
+Fix: [How to fix]
+```
+
+## Decision
+
+- **CRITICAL or HIGH issues**: Block commit, require fixes
+- **MEDIUM issues**: Recommend fixes before merge
+- **LOW issues**: Optional improvements
+
+---
+
+**IMPORTANT**: Never approve code with security vulnerabilities!

.opencode/commands/e2e.md

@@ -0,0 +1,105 @@
+---
+description: Generate and run E2E tests with Playwright
+agent: e2e-runner
+subtask: true
+---
+
+# E2E Command
+
+Generate and run end-to-end tests using Playwright: $ARGUMENTS
+
+## Your Task
+
+1. **Analyze user flow** to test
+2. **Create test journey** with Playwright
+3. **Run tests** and capture artifacts
+4. **Report results** with screenshots/videos
+
+## Test Structure
+
+```typescript
+import { test, expect } from '@playwright/test'
+
+test.describe('Feature: [Name]', () => {
+  test.beforeEach(async ({ page }) => {
+    // Setup: Navigate, authenticate, prepare state
+  })
+
+  test('should [expected behavior]', async ({ page }) => {
+    // Arrange: Set up test data
+
+    // Act: Perform user actions
+    await page.click('[data-testid="button"]')
+    await page.fill('[data-testid="input"]', 'value')
+
+    // Assert: Verify results
+    await expect(page.locator('[data-testid="result"]')).toBeVisible()
+  })
+
+  test.afterEach(async ({ page }, testInfo) => {
+    // Capture screenshot on failure
+    if (testInfo.status !== 'passed') {
+      await page.screenshot({ path: `test-results/${testInfo.title}.png` })
+    }
+  })
+})
+```
+
+## Best Practices
+
+### Selectors
+- Prefer `data-testid` attributes
+- Avoid CSS classes (they change)
+- Use semantic selectors (roles, labels)
+
+### Waits
+- Use Playwright's auto-waiting
+- Avoid `page.waitForTimeout()`
+- Use `expect().toBeVisible()` for assertions
+
+### Test Isolation
+- Each test should be independent
+- Clean up test data after
+- Don't rely on test order
+
+## Artifacts to Capture
+
+- Screenshots on failure
+- Videos for debugging
+- Trace files for detailed analysis
+- Network logs if relevant
+
+## Test Categories
+
+1. **Critical User Flows**
+   - Authentication (login, logout, signup)
+   - Core feature happy paths
+   - Payment/checkout flows
+
+2. **Edge Cases**
+   - Network failures
+   - Invalid inputs
+   - Session expiry
+
+3. **Cross-Browser**
+   - Chrome, Firefox, Safari
+   - Mobile viewports
+
+## Report Format
+
+```
+E2E Test Results
+================
+✅ Passed: X
+❌ Failed: Y
+⏭️ Skipped: Z
+
+Failed Tests:
+- test-name: Error message
+  Screenshot: path/to/screenshot.png
+  Video: path/to/video.webm
+```
+
+---
+
+**TIP**: Run with `--headed` flag for debugging: `npx playwright test --headed`

.opencode/commands/eval.md

@@ -0,0 +1,88 @@
+---
+description: Run evaluation against acceptance criteria
+agent: build
+---
+
+# Eval Command
+
+Evaluate implementation against acceptance criteria: $ARGUMENTS
+
+## Your Task
+
+Run structured evaluation to verify the implementation meets requirements.
+
+## Evaluation Framework
+
+### Grader Types
+
+1. **Binary Grader** - Pass/Fail
+   - Does it work? Yes/No
+   - Good for: feature completion, bug fixes
+
+2. **Scalar Grader** - Score 0-100
+   - How well does it work?
+   - Good for: performance, quality metrics
+
+3. **Rubric Grader** - Category scores
+   - Multiple dimensions evaluated
+   - Good for: comprehensive review
+
+## Evaluation Process
+
+### Step 1: Define Criteria
+
+```
+Acceptance Criteria:
+1. [Criterion 1] - [weight]
+2. [Criterion 2] - [weight]
+3. [Criterion 3] - [weight]
+```
+
+### Step 2: Run Tests
+
+For each criterion:
+- Execute relevant test
+- Collect evidence
+- Score result
+
+### Step 3: Calculate Score
+
+```
+Final Score = Σ (criterion_score × weight) / total_weight
+```
+
+### Step 4: Report
+
+## Evaluation Report
+
+### Overall: [PASS/FAIL] (Score: X/100)
+
+### Criterion Breakdown
+
+| Criterion | Score | Weight | Weighted |
+|-----------|-------|--------|----------|
+| [Criterion 1] | X/10 | 30% | X |
+| [Criterion 2] | X/10 | 40% | X |
+| [Criterion 3] | X/10 | 30% | X |
+
+### Evidence
+
+**Criterion 1: [Name]**
+- Test: [what was tested]
+- Result: [outcome]
+- Evidence: [screenshot, log, output]
+
+### Recommendations
+
+[If not passing, what needs to change]
+
+## Pass@K Metrics
+
+For non-deterministic evaluations:
+- Run K times
+- Calculate pass rate
+- Report: "Pass@K = X/K"
+
+---
+
+**TIP**: Use eval for acceptance testing before marking features complete.

.opencode/commands/evolve.md

@@ -0,0 +1,112 @@
+---
+description: Cluster instincts into skills
+agent: build
+---
+
+# Evolve Command
+
+Cluster related instincts into structured skills: $ARGUMENTS
+
+## Your Task
+
+Analyze instincts and promote clusters to skills.
+
+## Evolution Process
+
+### Step 1: Analyze Instincts
+
+Group instincts by:
+- Trigger similarity
+- Action patterns
+- Category tags
+- Confidence levels
+
+### Step 2: Identify Clusters
+
+```
+Cluster: Error Handling
+├── Instinct: Catch specific errors (0.85)
+├── Instinct: Wrap errors with context (0.82)
+├── Instinct: Log errors with stack trace (0.78)
+└── Instinct: Return meaningful error messages (0.80)
+```
+
+### Step 3: Generate Skill
+
+When cluster has:
+- 3+ instincts
+- Average confidence > 0.75
+- Cohesive theme
+
+Generate SKILL.md:
+
+```markdown
+# Error Handling Skill
+
+## Overview
+Patterns for robust error handling learned from session observations.
+
+## Patterns
+
+### 1. Catch Specific Errors
+**Trigger**: When catching errors with generic catch
+**Action**: Use specific error types
+
+### 2. Wrap Errors with Context
+**Trigger**: When re-throwing errors
+**Action**: Add context with fmt.Errorf or Error.cause
+
+### 3. Log with Stack Trace
+**Trigger**: When logging errors
+**Action**: Include stack trace for debugging
+
+### 4. Meaningful Messages
+**Trigger**: When returning errors to users
+**Action**: Provide actionable error messages
+```
+
+### Step 4: Archive Instincts
+
+Move evolved instincts to `archived/` with reference to skill.
+
+## Evolution Report
+
+```
+Evolution Summary
+=================
+
+Clusters Found: X
+
+Cluster 1: Error Handling
+- Instincts: 5
+- Avg Confidence: 0.82
+- Status: ✅ Promoted to skill
+
+Cluster 2: Testing Patterns
+- Instincts: 3
+- Avg Confidence: 0.71
+- Status: ⏳ Needs more confidence
+
+Cluster 3: Git Workflow
+- Instincts: 2
+- Avg Confidence: 0.88
+- Status: ⏳ Needs more instincts
+
+Skills Created:
+- skills/error-handling/SKILL.md
+
+Instincts Archived: 5
+Remaining Instincts: 12
+```
+
+## Thresholds
+
+| Metric | Threshold |
+|--------|-----------|
+| Min instincts per cluster | 3 |
+| Min average confidence | 0.75 |
+| Min cluster cohesion | 0.6 |
+
+---
+
+**TIP**: Run `/evolve` periodically to graduate instincts to skills as confidence grows.

.opencode/commands/go-build.md

@@ -0,0 +1,87 @@
+---
+description: Fix Go build and vet errors
+agent: go-build-resolver
+subtask: true
+---
+
+# Go Build Command
+
+Fix Go build, vet, and compilation errors: $ARGUMENTS
+
+## Your Task
+
+1. **Run go build**: `go build ./...`
+2. **Run go vet**: `go vet ./...`
+3. **Fix errors** one by one
+4. **Verify fixes** don't introduce new errors
+
+## Common Go Errors
+
+### Import Errors
+```
+imported and not used: "package"
+```
+**Fix**: Remove unused import or use `_` prefix
+
+### Type Errors
+```
+cannot use x (type T) as type U
+```
+**Fix**: Add type conversion or fix type definition
+
+### Undefined Errors
+```
+undefined: identifier
+```
+**Fix**: Import package, define variable, or fix typo
+
+### Vet Errors
+```
+printf: call has arguments but no formatting directives
+```
+**Fix**: Add format directive or remove arguments
+
+## Fix Order
+
+1. **Import errors** - Fix or remove imports
+2. **Type definitions** - Ensure types exist
+3. **Function signatures** - Match parameters
+4. **Vet warnings** - Address static analysis
+
+## Build Commands
+
+```bash
+# Build all packages
+go build ./...
+
+# Build with race detector
+go build -race ./...
+
+# Build for specific OS/arch
+GOOS=linux GOARCH=amd64 go build ./...
+
+# Run go vet
+go vet ./...
+
+# Run staticcheck
+staticcheck ./...
+
+# Format code
+gofmt -w .
+
+# Tidy dependencies
+go mod tidy
+```
+
+## Verification
+
+After fixes:
+```bash
+go build ./...    # Should succeed
+go vet ./...      # Should have no warnings
+go test ./...     # Tests should pass
+```
+
+---
+
+**IMPORTANT**: Fix errors only. No refactoring, no improvements. Get the build green with minimal changes.

.opencode/commands/go-review.md

@@ -0,0 +1,71 @@
+---
+description: Go code review for idiomatic patterns
+agent: go-reviewer
+subtask: true
+---
+
+# Go Review Command
+
+Review Go code for idiomatic patterns and best practices: $ARGUMENTS
+
+## Your Task
+
+1. **Analyze Go code** for idioms and patterns
+2. **Check concurrency** - goroutines, channels, mutexes
+3. **Review error handling** - proper error wrapping
+4. **Verify performance** - allocations, bottlenecks
+
+## Review Checklist
+
+### Idiomatic Go
+- [ ] Package naming (lowercase, no underscores)
+- [ ] Variable naming (camelCase, short)
+- [ ] Interface naming (ends with -er)
+- [ ] Error naming (starts with Err)
+
+### Error Handling
+- [ ] Errors are checked, not ignored
+- [ ] Errors wrapped with context (`fmt.Errorf("...: %w", err)`)
+- [ ] Sentinel errors used appropriately
+- [ ] Custom error types when needed
+
+### Concurrency
+- [ ] Goroutines properly managed
+- [ ] Channels buffered appropriately
+- [ ] No data races (use `-race` flag)
+- [ ] Context passed for cancellation
+- [ ] WaitGroups used correctly
+
+### Performance
+- [ ] Avoid unnecessary allocations
+- [ ] Use `sync.Pool` for frequent allocations
+- [ ] Prefer value receivers for small structs
+- [ ] Buffer I/O operations
+
+### Code Organization
+- [ ] Small, focused packages
+- [ ] Clear dependency direction
+- [ ] Internal packages for private code
+- [ ] Godoc comments on exports
+
+## Report Format
+
+### Idiomatic Issues
+- [file:line] Issue description
+  Suggestion: How to fix
+
+### Error Handling Issues
+- [file:line] Issue description
+  Suggestion: How to fix
+
+### Concurrency Issues
+- [file:line] Issue description
+  Suggestion: How to fix
+
+### Performance Issues
+- [file:line] Issue description
+  Suggestion: How to fix
+
+---
+
+**TIP**: Run `go vet` and `staticcheck` for additional automated checks.

.opencode/commands/go-test.md

@@ -0,0 +1,131 @@
+---
+description: Go TDD workflow with table-driven tests
+agent: tdd-guide
+subtask: true
+---
+
+# Go Test Command
+
+Implement using Go TDD methodology: $ARGUMENTS
+
+## Your Task
+
+Apply test-driven development with Go idioms:
+
+1. **Define types** - Interfaces and structs
+2. **Write table-driven tests** - Comprehensive coverage
+3. **Implement minimal code** - Pass the tests
+4. **Benchmark** - Verify performance
+
+## TDD Cycle for Go
+
+### Step 1: Define Interface
+```go
+type Calculator interface {
+    Calculate(input Input) (Output, error)
+}
+
+type Input struct {
+    // fields
+}
+
+type Output struct {
+    // fields
+}
+```
+
+### Step 2: Table-Driven Tests
+```go
+func TestCalculate(t *testing.T) {
+    tests := []struct {
+        name    string
+        input   Input
+        want    Output
+        wantErr bool
+    }{
+        {
+            name:  "valid input",
+            input: Input{...},
+            want:  Output{...},
+        },
+        {
+            name:    "invalid input",
+            input:   Input{...},
+            wantErr: true,
+        },
+    }
+
+    for _, tt := range tests {
+        t.Run(tt.name, func(t *testing.T) {
+            got, err := Calculate(tt.input)
+            if (err != nil) != tt.wantErr {
+                t.Errorf("Calculate() error = %v, wantErr %v", err, tt.wantErr)
+                return
+            }
+            if !reflect.DeepEqual(got, tt.want) {
+                t.Errorf("Calculate() = %v, want %v", got, tt.want)
+            }
+        })
+    }
+}
+```
+
+### Step 3: Run Tests (RED)
+```bash
+go test -v ./...
+```
+
+### Step 4: Implement (GREEN)
+```go
+func Calculate(input Input) (Output, error) {
+    // Minimal implementation
+}
+```
+
+### Step 5: Benchmark
+```go
+func BenchmarkCalculate(b *testing.B) {
+    input := Input{...}
+    for i := 0; i < b.N; i++ {
+        Calculate(input)
+    }
+}
+```
+
+## Go Testing Commands
+
+```bash
+# Run all tests
+go test ./...
+
+# Run with verbose output
+go test -v ./...
+
+# Run with coverage
+go test -cover ./...
+
+# Run with race detector
+go test -race ./...
+
+# Run benchmarks
+go test -bench=. ./...
+
+# Generate coverage report
+go test -coverprofile=coverage.out ./...
+go tool cover -html=coverage.out
+```
+
+## Test File Organization
+
+```
+package/
+├── calculator.go       # Implementation
+├── calculator_test.go  # Tests
+├── testdata/           # Test fixtures
+│   └── input.json
+└── mock_test.go        # Mock implementations
+```
+
+---
+
+**TIP**: Use `testify/assert` for cleaner assertions, or stick with stdlib for simplicity.

.opencode/commands/instinct-export.md

@@ -0,0 +1,93 @@
+---
+description: Export instincts for sharing
+agent: build
+---
+
+# Instinct Export Command
+
+Export instincts for sharing with others: $ARGUMENTS
+
+## Your Task
+
+Export instincts from the continuous-learning-v2 system.
+
+## Export Options
+
+### Export All
+```
+/instinct-export
+```
+
+### Export High Confidence Only
+```
+/instinct-export --min-confidence 0.8
+```
+
+### Export by Category
+```
+/instinct-export --category coding
+```
+
+### Export to Specific Path
+```
+/instinct-export --output ./my-instincts.json
+```
+
+## Export Format
+
+```json
+{
+  "instincts": [
+    {
+      "id": "instinct-123",
+      "trigger": "[situation description]",
+      "action": "[recommended action]",
+      "confidence": 0.85,
+      "category": "coding",
+      "applications": 10,
+      "successes": 9,
+      "source": "session-observation"
+    }
+  ],
+  "metadata": {
+    "version": "1.0",
+    "exported": "2025-01-15T10:00:00Z",
+    "author": "username",
+    "total": 25,
+    "filter": "confidence >= 0.8"
+  }
+}
+```
+
+## Export Report
+
+```
+Export Summary
+==============
+Output: ./instincts-export.json
+Total instincts: X
+Filtered: Y
+Exported: Z
+
+Categories:
+- coding: N
+- testing: N
+- security: N
+- git: N
+
+Top Instincts (by confidence):
+1. [trigger] (0.XX)
+2. [trigger] (0.XX)
+3. [trigger] (0.XX)
+```
+
+## Sharing
+
+After export:
+- Share JSON file directly
+- Upload to team repository
+- Publish to instinct registry
+
+---
+
+**TIP**: Export high-confidence instincts (>0.8) for better quality shares.

.opencode/commands/instinct-import.md

@@ -0,0 +1,88 @@
+---
+description: Import instincts from external sources
+agent: build
+---
+
+# Instinct Import Command
+
+Import instincts from a file or URL: $ARGUMENTS
+
+## Your Task
+
+Import instincts into the continuous-learning-v2 system.
+
+## Import Sources
+
+### File Import
+```
+/instinct-import path/to/instincts.json
+```
+
+### URL Import
+```
+/instinct-import https://example.com/instincts.json
+```
+
+### Team Share Import
+```
+/instinct-import @teammate/instincts
+```
+
+## Import Format
+
+Expected JSON structure:
+
+```json
+{
+  "instincts": [
+    {
+      "trigger": "[situation description]",
+      "action": "[recommended action]",
+      "confidence": 0.7,
+      "category": "coding",
+      "source": "imported"
+    }
+  ],
+  "metadata": {
+    "version": "1.0",
+    "exported": "2025-01-15T10:00:00Z",
+    "author": "username"
+  }
+}
+```
+
+## Import Process
+
+1. **Validate format** - Check JSON structure
+2. **Deduplicate** - Skip existing instincts
+3. **Adjust confidence** - Reduce confidence for imports (×0.8)
+4. **Merge** - Add to local instinct store
+5. **Report** - Show import summary
+
+## Import Report
+
+```
+Import Summary
+==============
+Source: [path or URL]
+Total in file: X
+Imported: Y
+Skipped (duplicates): Z
+Errors: W
+
+Imported Instincts:
+- [trigger] (confidence: 0.XX)
+- [trigger] (confidence: 0.XX)
+...
+```
+
+## Conflict Resolution
+
+When importing duplicates:
+- Keep higher confidence version
+- Merge application counts
+- Update timestamp
+
+---
+
+**TIP**: Review imported instincts with `/instinct-status` after import.

.opencode/commands/instinct-status.md

@@ -0,0 +1,75 @@
+---
+description: View learned instincts with confidence scores
+agent: build
+---
+
+# Instinct Status Command
+
+Display learned instincts and their confidence scores: $ARGUMENTS
+
+## Your Task
+
+Read and display instincts from the continuous-learning-v2 system.
+
+## Instinct Location
+
+Global: `~/.claude/instincts/`
+Project: `.claude/instincts/`
+
+## Status Display
+
+### Instinct Summary
+
+| Category | Count | Avg Confidence |
+|----------|-------|----------------|
+| Coding | X | 0.XX |
+| Testing | X | 0.XX |
+| Security | X | 0.XX |
+| Git | X | 0.XX |
+
+### High Confidence Instincts (>0.8)
+
+```
+[trigger] → [action] (confidence: 0.XX)
+```
+
+### Learning Progress
+
+- Total instincts: X
+- This session: X
+- Promoted to skills: X
+
+### Recent Instincts
+
+Last 5 instincts learned:
+
+1. **[timestamp]** - [trigger] → [action]
+2. **[timestamp]** - [trigger] → [action]
+...
+
+## Instinct Structure
+
+```json
+{
+  "id": "instinct-123",
+  "trigger": "When I see a try-catch without specific error type",
+  "action": "Suggest using specific error types for better handling",
+  "confidence": 0.75,
+  "applications": 5,
+  "successes": 4,
+  "source": "session-observation",
+  "timestamp": "2025-01-15T10:30:00Z"
+}
+```
+
+## Confidence Calculation
+
+```
+confidence = (successes + 1) / (applications + 2)
+```
+
+Bayesian smoothing ensures new instincts don't have extreme confidence.
+
+---
+
+**TIP**: Use `/evolve` to cluster related instincts into skills when confidence is high.

.opencode/commands/learn.md

@@ -0,0 +1,61 @@
+---
+description: Extract patterns and learnings from current session
+agent: build
+---
+
+# Learn Command
+
+Extract patterns, learnings, and reusable insights from the current session: $ARGUMENTS
+
+## Your Task
+
+Analyze the conversation and code changes to extract:
+
+1. **Patterns discovered** - Recurring solutions or approaches
+2. **Best practices applied** - Techniques that worked well
+3. **Mistakes to avoid** - Issues encountered and solutions
+4. **Reusable snippets** - Code patterns worth saving
+
+## Output Format
+
+### Patterns Discovered
+
+**Pattern: [Name]**
+- Context: When to use this pattern
+- Implementation: How to apply it
+- Example: Code snippet
+
+### Best Practices Applied
+
+1. [Practice name]
+   - Why it works
+   - When to apply
+
+### Mistakes to Avoid
+
+1. [Mistake description]
+   - What went wrong
+   - How to prevent it
+
+### Suggested Skill Updates
+
+If patterns are significant, suggest updates to:
+- `skills/coding-standards/SKILL.md`
+- `skills/[domain]/SKILL.md`
+- `rules/[category].md`
+
+## Instinct Format (for continuous-learning-v2)
+
+```json
+{
+  "trigger": "[situation that triggers this learning]",
+  "action": "[what to do]",
+  "confidence": 0.7,
+  "source": "session-extraction",
+  "timestamp": "[ISO timestamp]"
+}
+```
+
+---
+
+**TIP**: Run `/learn` periodically during long sessions to capture insights before context compaction.

.opencode/commands/orchestrate.md

@@ -0,0 +1,88 @@
+---
+description: Orchestrate multiple agents for complex tasks
+agent: planner
+subtask: true
+---
+
+# Orchestrate Command
+
+Orchestrate multiple specialized agents for this complex task: $ARGUMENTS
+
+## Your Task
+
+1. **Analyze task complexity** and break into subtasks
+2. **Identify optimal agents** for each subtask
+3. **Create execution plan** with dependencies
+4. **Coordinate execution** - parallel where possible
+5. **Synthesize results** into unified output
+
+## Available Agents
+
+| Agent | Specialty | Use For |
+|-------|-----------|---------|
+| planner | Implementation planning | Complex feature design |
+| architect | System design | Architectural decisions |
+| code-reviewer | Code quality | Review changes |
+| security-reviewer | Security analysis | Vulnerability detection |
+| tdd-guide | Test-driven dev | Feature implementation |
+| build-error-resolver | Build fixes | TypeScript/build errors |
+| e2e-runner | E2E testing | User flow testing |
+| doc-updater | Documentation | Updating docs |
+| refactor-cleaner | Code cleanup | Dead code removal |
+| go-reviewer | Go code | Go-specific review |
+| go-build-resolver | Go builds | Go build errors |
+| database-reviewer | Database | Query optimization |
+
+## Orchestration Patterns
+
+### Sequential Execution
+```
+planner → tdd-guide → code-reviewer → security-reviewer
+```
+Use when: Later tasks depend on earlier results
+
+### Parallel Execution
+```
+┌→ security-reviewer
+planner →├→ code-reviewer
+└→ architect
+```
+Use when: Tasks are independent
+
+### Fan-Out/Fan-In
+```
+         ┌→ agent-1 ─┐
+planner →├→ agent-2 ─┼→ synthesizer
+         └→ agent-3 ─┘
+```
+Use when: Multiple perspectives needed
+
+## Execution Plan Format
+
+### Phase 1: [Name]
+- Agent: [agent-name]
+- Task: [specific task]
+- Depends on: [none or previous phase]
+
+### Phase 2: [Name] (parallel)
+- Agent A: [agent-name]
+  - Task: [specific task]
+- Agent B: [agent-name]
+  - Task: [specific task]
+- Depends on: Phase 1
+
+### Phase 3: Synthesis
+- Combine results from Phase 2
+- Generate unified output
+
+## Coordination Rules
+
+1. **Plan before execute** - Create full execution plan first
+2. **Minimize handoffs** - Reduce context switching
+3. **Parallelize when possible** - Independent tasks in parallel
+4. **Clear boundaries** - Each agent has specific scope
+5. **Single source of truth** - One agent owns each artifact
+
+---
+
+**NOTE**: Complex tasks benefit from multi-agent orchestration. Simple tasks should use single agents directly.

.opencode/commands/plan.md

@@ -0,0 +1,49 @@
+---
+description: Create implementation plan with risk assessment
+agent: planner
+subtask: true
+---
+
+# Plan Command
+
+Create a detailed implementation plan for: $ARGUMENTS
+
+## Your Task
+
+1. **Restate Requirements** - Clarify what needs to be built
+2. **Identify Risks** - Surface potential issues, blockers, and dependencies
+3. **Create Step Plan** - Break down implementation into phases
+4. **Wait for Confirmation** - MUST receive user approval before proceeding
+
+## Output Format
+
+### Requirements Restatement
+[Clear, concise restatement of what will be built]
+
+### Implementation Phases
+[Phase 1: Description]
+- Step 1.1
+- Step 1.2
+...
+
+[Phase 2: Description]
+- Step 2.1
+- Step 2.2
+...
+
+### Dependencies
+[List external dependencies, APIs, services needed]
+
+### Risks
+- HIGH: [Critical risks that could block implementation]
+- MEDIUM: [Moderate risks to address]
+- LOW: [Minor concerns]
+
+### Estimated Complexity
+[HIGH/MEDIUM/LOW with time estimates]
+
+**WAITING FOR CONFIRMATION**: Proceed with this plan? (yes/no/modify)
+
+---
+
+**CRITICAL**: Do NOT write any code until the user explicitly confirms with "yes", "proceed", or similar affirmative response.

.opencode/commands/refactor-clean.md

@@ -0,0 +1,102 @@
+---
+description: Remove dead code and consolidate duplicates
+agent: refactor-cleaner
+subtask: true
+---
+
+# Refactor Clean Command
+
+Analyze and clean up the codebase: $ARGUMENTS
+
+## Your Task
+
+1. **Detect dead code** using analysis tools
+2. **Identify duplicates** and consolidation opportunities
+3. **Safely remove** unused code with documentation
+4. **Verify** no functionality broken
+
+## Detection Phase
+
+### Run Analysis Tools
+
+```bash
+# Find unused exports
+npx knip
+
+# Find unused dependencies
+npx depcheck
+
+# Find unused TypeScript exports
+npx ts-prune
+```
+
+### Manual Checks
+
+- Unused functions (no callers)
+- Unused variables
+- Unused imports
+- Commented-out code
+- Unreachable code
+- Unused CSS classes
+
+## Removal Phase
+
+### Before Removing
+
+1. **Search for usage** - grep, find references
+2. **Check exports** - might be used externally
+3. **Verify tests** - no test depends on it
+4. **Document removal** - git commit message
+
+### Safe Removal Order
+
+1. Remove unused imports first
+2. Remove unused private functions
+3. Remove unused exported functions
+4. Remove unused types/interfaces
+5. Remove unused files
+
+## Consolidation Phase
+
+### Identify Duplicates
+
+- Similar functions with minor differences
+- Copy-pasted code blocks
+- Repeated patterns
+
+### Consolidation Strategies
+
+1. **Extract utility function** - for repeated logic
+2. **Create base class** - for similar classes
+3. **Use higher-order functions** - for repeated patterns
+4. **Create shared constants** - for magic values
+
+## Verification
+
+After cleanup:
+
+1. `npm run build` - builds successfully
+2. `npm test` - all tests pass
+3. `npm run lint` - no new lint errors
+4. Manual smoke test - features work
+
+## Report Format
+
+```
+Dead Code Analysis
+==================
+
+Removed:
+- file.ts: functionName (unused export)
+- utils.ts: helperFunction (no callers)
+
+Consolidated:
+- formatDate() and formatDateTime() → dateUtils.format()
+
+Remaining (manual review needed):
+- oldComponent.tsx: potentially unused, verify with team
+```
+
+---
+
+**CAUTION**: Always verify before removing. When in doubt, ask or add `// TODO: verify usage` comment.

.opencode/commands/security.md

@@ -0,0 +1,89 @@
+---
+description: Run comprehensive security review
+agent: security-reviewer
+subtask: true
+---
+
+# Security Review Command
+
+Conduct a comprehensive security review: $ARGUMENTS
+
+## Your Task
+
+Analyze the specified code for security vulnerabilities following OWASP guidelines and security best practices.
+
+## Security Checklist
+
+### OWASP Top 10
+
+1. **Injection** (SQL, NoSQL, OS command, LDAP)
+   - Check for parameterized queries
+   - Verify input sanitization
+   - Review dynamic query construction
+
+2. **Broken Authentication**
+   - Password storage (bcrypt, argon2)
+   - Session management
+   - Multi-factor authentication
+   - Password reset flows
+
+3. **Sensitive Data Exposure**
+   - Encryption at rest and in transit
+   - Proper key management
+   - PII handling
+
+4. **XML External Entities (XXE)**
+   - Disable DTD processing
+   - Input validation for XML
+
+5. **Broken Access Control**
+   - Authorization checks on every endpoint
+   - Role-based access control
+   - Resource ownership validation
+
+6. **Security Misconfiguration**
+   - Default credentials removed
+   - Error handling doesn't leak info
+   - Security headers configured
+
+7. **Cross-Site Scripting (XSS)**
+   - Output encoding
+   - Content Security Policy
+   - Input sanitization
+
+8. **Insecure Deserialization**
+   - Validate serialized data
+   - Implement integrity checks
+
+9. **Using Components with Known Vulnerabilities**
+   - Run `npm audit`
+   - Check for outdated dependencies
+
+10. **Insufficient Logging & Monitoring**
+    - Security events logged
+    - No sensitive data in logs
+    - Alerting configured
+
+### Additional Checks
+
+- [ ] Secrets in code (API keys, passwords)
+- [ ] Environment variable handling
+- [ ] CORS configuration
+- [ ] Rate limiting
+- [ ] CSRF protection
+- [ ] Secure cookie flags
+
+## Report Format
+
+### Critical Issues
+[Issues that must be fixed immediately]
+
+### High Priority
+[Issues that should be fixed before release]
+
+### Recommendations
+[Security improvements to consider]
+
+---
+
+**IMPORTANT**: Security issues are blockers. Do not proceed until critical issues are resolved.

.opencode/commands/setup-pm.md

@@ -0,0 +1,67 @@
+---
+description: Configure package manager preference
+agent: build
+---
+
+# Setup Package Manager Command
+
+Configure your preferred package manager: $ARGUMENTS
+
+## Your Task
+
+Set up package manager preference for the project or globally.
+
+## Detection Order
+
+1. **Environment variable**: `CLAUDE_PACKAGE_MANAGER`
+2. **Project config**: `.claude/package-manager.json`
+3. **package.json**: `packageManager` field
+4. **Lock file**: Auto-detect from lock files
+5. **Global config**: `~/.claude/package-manager.json`
+6. **Fallback**: First available
+
+## Configuration Options
+
+### Option 1: Environment Variable
+```bash
+export CLAUDE_PACKAGE_MANAGER=pnpm
+```
+
+### Option 2: Project Config
+```bash
+# Create .claude/package-manager.json
+echo '{"packageManager": "pnpm"}' > .claude/package-manager.json
+```
+
+### Option 3: package.json
+```json
+{
+  "packageManager": "pnpm@8.0.0"
+}
+```
+
+### Option 4: Global Config
+```bash
+# Create ~/.claude/package-manager.json
+echo '{"packageManager": "yarn"}' > ~/.claude/package-manager.json
+```
+
+## Supported Package Managers
+
+| Manager | Lock File | Commands |
+|---------|-----------|----------|
+| npm | package-lock.json | `npm install`, `npm run` |
+| pnpm | pnpm-lock.yaml | `pnpm install`, `pnpm run` |
+| yarn | yarn.lock | `yarn install`, `yarn run` |
+| bun | bun.lockb | `bun install`, `bun run` |
+
+## Verification
+
+Check current setting:
+```bash
+node scripts/setup-package-manager.js --detect
+```
+
+---
+
+**TIP**: For consistency across team, add `packageManager` field to package.json.

.opencode/commands/skill-create.md

@@ -0,0 +1,117 @@
+---
+description: Generate skills from git history analysis
+agent: build
+---
+
+# Skill Create Command
+
+Analyze git history to generate Claude Code skills: $ARGUMENTS
+
+## Your Task
+
+1. **Analyze commits** - Pattern recognition from history
+2. **Extract patterns** - Common practices and conventions
+3. **Generate SKILL.md** - Structured skill documentation
+4. **Create instincts** - For continuous-learning-v2
+
+## Analysis Process
+
+### Step 1: Gather Commit Data
+```bash
+# Recent commits
+git log --oneline -100
+
+# Commits by file type
+git log --name-only --pretty=format: | sort | uniq -c | sort -rn
+
+# Most changed files
+git log --pretty=format: --name-only | sort | uniq -c | sort -rn | head -20
+```
+
+### Step 2: Identify Patterns
+
+**Commit Message Patterns**:
+- Common prefixes (feat, fix, refactor)
+- Naming conventions
+- Co-author patterns
+
+**Code Patterns**:
+- File structure conventions
+- Import organization
+- Error handling approaches
+
+**Review Patterns**:
+- Common review feedback
+- Recurring fix types
+- Quality gates
+
+### Step 3: Generate SKILL.md
+
+```markdown
+# [Skill Name]
+
+## Overview
+[What this skill teaches]
+
+## Patterns
+
+### Pattern 1: [Name]
+- When to use
+- Implementation
+- Example
+
+### Pattern 2: [Name]
+- When to use
+- Implementation
+- Example
+
+## Best Practices
+
+1. [Practice 1]
+2. [Practice 2]
+3. [Practice 3]
+
+## Common Mistakes
+
+1. [Mistake 1] - How to avoid
+2. [Mistake 2] - How to avoid
+
+## Examples
+
+### Good Example
+```[language]
+// Code example
+```
+
+### Anti-pattern
+```[language]
+// What not to do
+```
+```
+
+### Step 4: Generate Instincts
+
+For continuous-learning-v2:
+
+```json
+{
+  "instincts": [
+    {
+      "trigger": "[situation]",
+      "action": "[response]",
+      "confidence": 0.8,
+      "source": "git-history-analysis"
+    }
+  ]
+}
+```
+
+## Output
+
+Creates:
+- `skills/[name]/SKILL.md` - Skill documentation
+- `skills/[name]/instincts.json` - Instinct collection
+
+---
+
+**TIP**: Run `/skill-create --instincts` to also generate instincts for continuous learning.

.opencode/commands/tdd.md

@@ -0,0 +1,66 @@
+---
+description: Enforce TDD workflow with 80%+ coverage
+agent: tdd-guide
+subtask: true
+---
+
+# TDD Command
+
+Implement the following using strict test-driven development: $ARGUMENTS
+
+## TDD Cycle (MANDATORY)
+
+```
+RED → GREEN → REFACTOR → REPEAT
+```
+
+1. **RED**: Write a failing test FIRST
+2. **GREEN**: Write minimal code to pass the test
+3. **REFACTOR**: Improve code while keeping tests green
+4. **REPEAT**: Continue until feature complete
+
+## Your Task
+
+### Step 1: Define Interfaces (SCAFFOLD)
+- Define TypeScript interfaces for inputs/outputs
+- Create function signature with `throw new Error('Not implemented')`
+
+### Step 2: Write Failing Tests (RED)
+- Write tests that exercise the interface
+- Include happy path, edge cases, and error conditions
+- Run tests - verify they FAIL
+
+### Step 3: Implement Minimal Code (GREEN)
+- Write just enough code to make tests pass
+- No premature optimization
+- Run tests - verify they PASS
+
+### Step 4: Refactor (IMPROVE)
+- Extract constants, improve naming
+- Remove duplication
+- Run tests - verify they still PASS
+
+### Step 5: Check Coverage
+- Target: 80% minimum
+- 100% for critical business logic
+- Add more tests if needed
+
+## Coverage Requirements
+
+| Code Type | Minimum |
+|-----------|---------|
+| Standard code | 80% |
+| Financial calculations | 100% |
+| Authentication logic | 100% |
+| Security-critical code | 100% |
+
+## Test Types to Include
+
+- **Unit Tests**: Individual functions
+- **Edge Cases**: Empty, null, max values, boundaries
+- **Error Conditions**: Invalid inputs, network failures
+- **Integration Tests**: API endpoints, database operations
+
+---
+
+**MANDATORY**: Tests must be written BEFORE implementation. Never skip the RED phase.

.opencode/commands/test-coverage.md

@@ -0,0 +1,80 @@
+---
+description: Analyze and improve test coverage
+agent: tdd-guide
+subtask: true
+---
+
+# Test Coverage Command
+
+Analyze test coverage and identify gaps: $ARGUMENTS
+
+## Your Task
+
+1. **Run coverage report**: `npm test -- --coverage`
+2. **Analyze results** - Identify low coverage areas
+3. **Prioritize gaps** - Critical code first
+4. **Generate missing tests** - For uncovered code
+
+## Coverage Targets
+
+| Code Type | Target |
+|-----------|--------|
+| Standard code | 80% |
+| Financial logic | 100% |
+| Auth/security | 100% |
+| Utilities | 90% |
+| UI components | 70% |
+
+## Coverage Report Analysis
+
+### Summary
+```
+File           | % Stmts | % Branch | % Funcs | % Lines
+---------------|---------|----------|---------|--------
+All files      |   XX    |    XX    |   XX    |   XX
+```
+
+### Low Coverage Files
+[Files below target, prioritized by criticality]
+
+### Uncovered Lines
+[Specific lines that need tests]
+
+## Test Generation
+
+For each uncovered area:
+
+### [Function/Component Name]
+
+**Location**: `src/path/file.ts:123`
+
+**Coverage Gap**: [description]
+
+**Suggested Tests**:
+```typescript
+describe('functionName', () => {
+  it('should [expected behavior]', () => {
+    // Test code
+  })
+
+  it('should handle [edge case]', () => {
+    // Edge case test
+  })
+})
+```
+
+## Coverage Improvement Plan
+
+1. **Critical** (add immediately)
+   - [ ] file1.ts - Auth logic
+   - [ ] file2.ts - Payment handling
+
+2. **High** (add this sprint)
+   - [ ] file3.ts - Core business logic
+
+3. **Medium** (add when touching file)
+   - [ ] file4.ts - Utilities
+
+---
+
+**IMPORTANT**: Coverage is a metric, not a goal. Focus on meaningful tests, not just hitting numbers.

.opencode/commands/update-codemaps.md

@@ -0,0 +1,81 @@
+---
+description: Update codemaps for codebase navigation
+agent: doc-updater
+subtask: true
+---
+
+# Update Codemaps Command
+
+Update codemaps to reflect current codebase structure: $ARGUMENTS
+
+## Your Task
+
+Generate or update codemaps in `docs/CODEMAPS/` directory:
+
+1. **Analyze codebase structure**
+2. **Generate component maps**
+3. **Document relationships**
+4. **Update navigation guides**
+
+## Codemap Types
+
+### Architecture Map
+```
+docs/CODEMAPS/ARCHITECTURE.md
+```
+- High-level system overview
+- Component relationships
+- Data flow diagrams
+
+### Module Map
+```
+docs/CODEMAPS/MODULES.md
+```
+- Module descriptions
+- Public APIs
+- Dependencies
+
+### File Map
+```
+docs/CODEMAPS/FILES.md
+```
+- Directory structure
+- File purposes
+- Key files
+
+## Codemap Format
+
+### [Module Name]
+
+**Purpose**: [Brief description]
+
+**Location**: `src/[path]/`
+
+**Key Files**:
+- `file1.ts` - [purpose]
+- `file2.ts` - [purpose]
+
+**Dependencies**:
+- [Module A]
+- [Module B]
+
+**Exports**:
+- `functionName()` - [description]
+- `ClassName` - [description]
+
+**Usage Example**:
+```typescript
+import { functionName } from '@/module'
+```
+
+## Generation Process
+
+1. Scan directory structure
+2. Parse imports/exports
+3. Build dependency graph
+4. Generate markdown maps
+5. Validate links
+
+---
+
+**TIP**: Keep codemaps updated when adding new modules or significant refactoring.

.opencode/commands/update-docs.md

@@ -0,0 +1,67 @@
+---
+description: Update documentation for recent changes
+agent: doc-updater
+subtask: true
+---
+
+# Update Docs Command
+
+Update documentation to reflect recent changes: $ARGUMENTS
+
+## Your Task
+
+1. **Identify changed code** - `git diff --name-only`
+2. **Find related docs** - README, API docs, guides
+3. **Update documentation** - Keep in sync with code
+4. **Verify accuracy** - Docs match implementation
+
+## Documentation Types
+
+### README.md
+- Installation instructions
+- Quick start guide
+- Feature overview
+- Configuration options
+
+### API Documentation
+- Endpoint descriptions
+- Request/response formats
+- Authentication details
+- Error codes
+
+### Code Comments
+- JSDoc for public APIs
+- Complex logic explanations
+- TODO/FIXME cleanup
+
+### Guides
+- How-to tutorials
+- Architecture decisions (ADRs)
+- Troubleshooting guides
+
+## Update Checklist
+
+- [ ] README reflects current features
+- [ ] API docs match endpoints
+- [ ] JSDoc updated for changed functions
+- [ ] Examples are working
+- [ ] Links are valid
+- [ ] Version numbers updated
+
+## Documentation Quality
+
+### Good Documentation
+- Accurate and up-to-date
+- Clear and concise
+- Has working examples
+- Covers edge cases
+
+### Avoid
+- Outdated information
+- Missing parameters
+- Broken examples
+- Ambiguous language
+
+---
+
+**IMPORTANT**: Documentation should be updated alongside code changes, not as an afterthought.

.opencode/commands/verify.md

@@ -0,0 +1,67 @@
+---
+description: Run verification loop to validate implementation
+agent: build
+---
+
+# Verify Command
+
+Run verification loop to validate the implementation: $ARGUMENTS
+
+## Your Task
+
+Execute comprehensive verification:
+
+1. **Type Check**: `npx tsc --noEmit`
+2. **Lint**: `npm run lint`
+3. **Unit Tests**: `npm test`
+4. **Integration Tests**: `npm run test:integration` (if available)
+5. **Build**: `npm run build`
+6. **Coverage Check**: Verify 80%+ coverage
+
+## Verification Checklist
+
+### Code Quality
+- [ ] No TypeScript errors
+- [ ] No lint warnings
+- [ ] No console.log statements
+- [ ] Functions < 50 lines
+- [ ] Files < 800 lines
+
+### Tests
+- [ ] All tests passing
+- [ ] Coverage >= 80%
+- [ ] Edge cases covered
+- [ ] Error conditions tested
+
+### Security
+- [ ] No hardcoded secrets
+- [ ] Input validation present
+- [ ] No SQL injection risks
+- [ ] No XSS vulnerabilities
+
+### Build
+- [ ] Build succeeds
+- [ ] No warnings
+- [ ] Bundle size acceptable
+
+## Verification Report
+
+### Summary
+- Status: ✅ PASS / ❌ FAIL
+- Score: X/Y checks passed
+
+### Details
+| Check | Status | Notes |
+|-------|--------|-------|
+| TypeScript | ✅/❌ | [details] |
+| Lint | ✅/❌ | [details] |
+| Tests | ✅/❌ | [details] |
+| Coverage | ✅/❌ | XX% (target: 80%) |
+| Build | ✅/❌ | [details] |
+
+### Action Items
+[If FAIL, list what needs to be fixed]
+
+---
+
+**NOTE**: Verification loop should be run before every commit and PR.

.opencode/index.ts

@@ -0,0 +1,71 @@
+/**
+ * Everything Claude Code (ECC) Plugin for OpenCode
+ *
+ * This package provides a complete OpenCode plugin with:
+ * - 12 specialized agents (planner, architect, code-reviewer, etc.)
+ * - 24 commands (/plan, /tdd, /code-review, etc.)
+ * - Plugin hooks (auto-format, TypeScript check, console.log warning, etc.)
+ * - Custom tools (run-tests, check-coverage, security-audit)
+ * - 16 skills (coding-standards, security-review, tdd-workflow, etc.)
+ *
+ * Usage:
+ *
+ * Option 1: Install via npm
+ * ```bash
+ * npm install opencode-ecc
+ * ```
+ *
+ * Then add to your opencode.json:
+ * ```json
+ * {
+ *   "plugin": ["opencode-ecc"]
+ * }
+ * ```
+ *
+ * Option 2: Clone and use directly
+ * ```bash
+ * git clone https://github.com/affaan-m/everything-claude-code
+ * cd everything-claude-code
+ * opencode
+ * ```
+ *
+ * @packageDocumentation
+ */
+
+// Export the main plugin
+export { ECCHooksPlugin, default } from "./plugins/index.js"
+
+// Export individual components for selective use
+export * from "./plugins/index.js"
+
+// Version export
+export const VERSION = "1.0.0"
+
+// Plugin metadata
+export const metadata = {
+  name: "opencode-ecc",
+  version: VERSION,
+  description: "Everything Claude Code plugin for OpenCode",
+  author: "affaan-m",
+  features: {
+    agents: 12,
+    commands: 24,
+    skills: 16,
+    hookEvents: [
+      "file.edited",
+      "tool.execute.before",
+      "tool.execute.after",
+      "session.created",
+      "session.idle",
+      "session.deleted",
+      "file.watcher.updated",
+      "permission.asked",
+      "todo.updated",
+    ],
+    customTools: [
+      "run-tests",
+      "check-coverage",
+      "security-audit",
+    ],
+  },
+}

.opencode/instructions/INSTRUCTIONS.md

@@ -0,0 +1,337 @@
+# Everything Claude Code - OpenCode Instructions
+
+This document consolidates the core rules and guidelines from the Claude Code configuration for use with OpenCode.
+
+## Security Guidelines (CRITICAL)
+
+### Mandatory Security Checks
+
+Before ANY commit:
+- [ ] No hardcoded secrets (API keys, passwords, tokens)
+- [ ] All user inputs validated
+- [ ] SQL injection prevention (parameterized queries)
+- [ ] XSS prevention (sanitized HTML)
+- [ ] CSRF protection enabled
+- [ ] Authentication/authorization verified
+- [ ] Rate limiting on all endpoints
+- [ ] Error messages don't leak sensitive data
+
+### Secret Management
+
+```typescript
+// NEVER: Hardcoded secrets
+const apiKey = "sk-proj-xxxxx"
+
+// ALWAYS: Environment variables
+const apiKey = process.env.OPENAI_API_KEY
+
+if (!apiKey) {
+  throw new Error('OPENAI_API_KEY not configured')
+}
+```
+
+### Security Response Protocol
+
+If security issue found:
+1. STOP immediately
+2. Use **security-reviewer** agent
+3. Fix CRITICAL issues before continuing
+4. Rotate any exposed secrets
+5. Review entire codebase for similar issues
+
+---
+
+## Coding Style
+
+### Immutability (CRITICAL)
+
+ALWAYS create new objects, NEVER mutate:
+
+```javascript
+// WRONG: Mutation
+function updateUser(user, name) {
+  user.name = name  // MUTATION!
+  return user
+}
+
+// CORRECT: Immutability
+function updateUser(user, name) {
+  return {
+    ...user,
+    name
+  }
+}
+```
+
+### File Organization
+
+MANY SMALL FILES > FEW LARGE FILES:
+- High cohesion, low coupling
+- 200-400 lines typical, 800 max
+- Extract utilities from large components
+- Organize by feature/domain, not by type
+
+### Error Handling
+
+ALWAYS handle errors comprehensively:
+
+```typescript
+try {
+  const result = await riskyOperation()
+  return result
+} catch (error) {
+  console.error('Operation failed:', error)
+  throw new Error('Detailed user-friendly message')
+}
+```
+
+### Input Validation
+
+ALWAYS validate user input:
+
+```typescript
+import { z } from 'zod'
+
+const schema = z.object({
+  email: z.string().email(),
+  age: z.number().int().min(0).max(150)
+})
+
+const validated = schema.parse(input)
+```
+
+### Code Quality Checklist
+
+Before marking work complete:
+- [ ] Code is readable and well-named
+- [ ] Functions are small (<50 lines)
+- [ ] Files are focused (<800 lines)
+- [ ] No deep nesting (>4 levels)
+- [ ] Proper error handling
+- [ ] No console.log statements
+- [ ] No hardcoded values
+- [ ] No mutation (immutable patterns used)
+
+---
+
+## Testing Requirements
+
+### Minimum Test Coverage: 80%
+
+Test Types (ALL required):
+1. **Unit Tests** - Individual functions, utilities, components
+2. **Integration Tests** - API endpoints, database operations
+3. **E2E Tests** - Critical user flows (Playwright)
+
+### Test-Driven Development
+
+MANDATORY workflow:
+1. Write test first (RED)
+2. Run test - it should FAIL
+3. Write minimal implementation (GREEN)
+4. Run test - it should PASS
+5. Refactor (IMPROVE)
+6. Verify coverage (80%+)
+
+### Troubleshooting Test Failures
+
+1. Use **tdd-guide** agent
+2. Check test isolation
+3. Verify mocks are correct
+4. Fix implementation, not tests (unless tests are wrong)
+
+---
+
+## Git Workflow
+
+### Commit Message Format
+
+```
+<type>: <description>
+
+<optional body>
+```
+
+Types: feat, fix, refactor, docs, test, chore, perf, ci
+
+### Pull Request Workflow
+
+When creating PRs:
+1. Analyze full commit history (not just latest commit)
+2. Use `git diff [base-branch]...HEAD` to see all changes
+3. Draft comprehensive PR summary
+4. Include test plan with TODOs
+5. Push with `-u` flag if new branch
+
+### Feature Implementation Workflow
+
+1. **Plan First**
+   - Use **planner** agent to create implementation plan
+   - Identify dependencies and risks
+   - Break down into phases
+
+2. **TDD Approach**
+   - Use **tdd-guide** agent
+   - Write tests first (RED)
+   - Implement to pass tests (GREEN)
+   - Refactor (IMPROVE)
+   - Verify 80%+ coverage
+
+3. **Code Review**
+   - Use **code-reviewer** agent immediately after writing code
+   - Address CRITICAL and HIGH issues
+   - Fix MEDIUM issues when possible
+
+4. **Commit & Push**
+   - Detailed commit messages
+   - Follow conventional commits format
+
+---
+
+## Agent Orchestration
+
+### Available Agents
+
+| Agent | Purpose | When to Use |
+|-------|---------|-------------|
+| planner | Implementation planning | Complex features, refactoring |
+| architect | System design | Architectural decisions |
+| tdd-guide | Test-driven development | New features, bug fixes |
+| code-reviewer | Code review | After writing code |
+| security-reviewer | Security analysis | Before commits |
+| build-error-resolver | Fix build errors | When build fails |
+| e2e-runner | E2E testing | Critical user flows |
+| refactor-cleaner | Dead code cleanup | Code maintenance |
+| doc-updater | Documentation | Updating docs |
+| go-reviewer | Go code review | Go projects |
+| go-build-resolver | Go build errors | Go build failures |
+| database-reviewer | Database optimization | SQL, schema design |
+
+### Immediate Agent Usage
+
+No user prompt needed:
+1. Complex feature requests - Use **planner** agent
+2. Code just written/modified - Use **code-reviewer** agent
+3. Bug fix or new feature - Use **tdd-guide** agent
+4. Architectural decision - Use **architect** agent
+
+---
+
+## Performance Optimization
+
+### Model Selection Strategy
+
+**Haiku** (90% of Sonnet capability, 3x cost savings):
+- Lightweight agents with frequent invocation
+- Pair programming and code generation
+- Worker agents in multi-agent systems
+
+**Sonnet** (Best coding model):
+- Main development work
+- Orchestrating multi-agent workflows
+- Complex coding tasks
+
+**Opus** (Deepest reasoning):
+- Complex architectural decisions
+- Maximum reasoning requirements
+- Research and analysis tasks
+
+### Context Window Management
+
+Avoid last 20% of context window for:
+- Large-scale refactoring
+- Feature implementation spanning multiple files
+- Debugging complex interactions
+
+### Build Troubleshooting
+
+If build fails:
+1. Use **build-error-resolver** agent
+2. Analyze error messages
+3. Fix incrementally
+4. Verify after each fix
+
+---
+
+## Common Patterns
+
+### API Response Format
+
+```typescript
+interface ApiResponse<T> {
+  success: boolean
+  data?: T
+  error?: string
+  meta?: {
+    total: number
+    page: number
+    limit: number
+  }
+}
+```
+
+### Custom Hooks Pattern
+
+```typescript
+export function useDebounce<T>(value: T, delay: number): T {
+  const [debouncedValue, setDebouncedValue] = useState<T>(value)
+
+  useEffect(() => {
+    const handler = setTimeout(() => setDebouncedValue(value), delay)
+    return () => clearTimeout(handler)
+  }, [value, delay])
+
+  return debouncedValue
+}
+```
+
+### Repository Pattern
+
+```typescript
+interface Repository<T> {
+  findAll(filters?: Filters): Promise<T[]>
+  findById(id: string): Promise<T | null>
+  create(data: CreateDto): Promise<T>
+  update(id: string, data: UpdateDto): Promise<T>
+  delete(id: string): Promise<void>
+}
+```
+
+---
+
+## OpenCode-Specific Notes
+
+Since OpenCode does not support hooks, the following actions that were automated in Claude Code must be done manually:
+
+### After Writing/Editing Code
+- Run `prettier --write <file>` to format JS/TS files
+- Run `npx tsc --noEmit` to check for TypeScript errors
+- Check for console.log statements and remove them
+
+### Before Committing
+- Run security checks manually
+- Verify no secrets in code
+- Run full test suite
+
+### Commands Available
+
+Use these commands in OpenCode:
+- `/plan` - Create implementation plan
+- `/tdd` - Enforce TDD workflow
+- `/code-review` - Review code changes
+- `/security` - Run security review
+- `/build-fix` - Fix build errors
+- `/e2e` - Generate E2E tests
+- `/refactor-clean` - Remove dead code
+- `/orchestrate` - Multi-agent workflow
+
+---
+
+## Success Metrics
+
+You are successful when:
+- All tests pass (80%+ coverage)
+- No security vulnerabilities
+- Code is readable and maintainable
+- Performance is acceptable
+- User requirements are met

.opencode/opencode.json

@@ -0,0 +1,302 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "model": "anthropic/claude-sonnet-4-5",
+  "small_model": "anthropic/claude-haiku-4-5",
+  "default_agent": "build",
+  "instructions": [
+    "CONTRIBUTING.md",
+    ".opencode/instructions/INSTRUCTIONS.md",
+    "skills/tdd-workflow/SKILL.md",
+    "skills/security-review/SKILL.md",
+    "skills/coding-standards/SKILL.md"
+  ],
+  "plugin": [
+    "./.opencode/plugins"
+  ],
+  "agent": {
+    "build": {
+      "description": "Primary coding agent for development work",
+      "mode": "primary",
+      "model": "anthropic/claude-sonnet-4-5",
+      "tools": {
+        "write": true,
+        "edit": true,
+        "bash": true,
+        "read": true
+      }
+    },
+    "planner": {
+      "description": "Expert planning specialist for complex features and refactoring. Use for implementation planning, architectural changes, or complex refactoring.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/planner.txt}",
+      "tools": {
+        "read": true,
+        "bash": true,
+        "write": false,
+        "edit": false
+      }
+    },
+    "architect": {
+      "description": "Software architecture specialist for system design, scalability, and technical decision-making.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/architect.txt}",
+      "tools": {
+        "read": true,
+        "bash": true,
+        "write": false,
+        "edit": false
+      }
+    },
+    "code-reviewer": {
+      "description": "Expert code review specialist. Reviews code for quality, security, and maintainability. Use immediately after writing or modifying code.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/code-reviewer.txt}",
+      "tools": {
+        "read": true,
+        "bash": true,
+        "write": false,
+        "edit": false
+      }
+    },
+    "security-reviewer": {
+      "description": "Security vulnerability detection and remediation specialist. Use after writing code that handles user input, authentication, API endpoints, or sensitive data.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/security-reviewer.txt}",
+      "tools": {
+        "read": true,
+        "bash": true,
+        "write": true,
+        "edit": true
+      }
+    },
+    "tdd-guide": {
+      "description": "Test-Driven Development specialist enforcing write-tests-first methodology. Use when writing new features, fixing bugs, or refactoring code. Ensures 80%+ test coverage.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/tdd-guide.txt}",
+      "tools": {
+        "read": true,
+        "write": true,
+        "edit": true,
+        "bash": true
+      }
+    },
+    "build-error-resolver": {
+      "description": "Build and TypeScript error resolution specialist. Use when build fails or type errors occur. Fixes build/type errors only with minimal diffs.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/build-error-resolver.txt}",
+      "tools": {
+        "read": true,
+        "write": true,
+        "edit": true,
+        "bash": true
+      }
+    },
+    "e2e-runner": {
+      "description": "End-to-end testing specialist using Playwright. Generates, maintains, and runs E2E tests for critical user flows.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/e2e-runner.txt}",
+      "tools": {
+        "read": true,
+        "write": true,
+        "edit": true,
+        "bash": true
+      }
+    },
+    "doc-updater": {
+      "description": "Documentation and codemap specialist. Use for updating codemaps and documentation.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/doc-updater.txt}",
+      "tools": {
+        "read": true,
+        "write": true,
+        "edit": true,
+        "bash": true
+      }
+    },
+    "refactor-cleaner": {
+      "description": "Dead code cleanup and consolidation specialist. Use for removing unused code, duplicates, and refactoring.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/refactor-cleaner.txt}",
+      "tools": {
+        "read": true,
+        "write": true,
+        "edit": true,
+        "bash": true
+      }
+    },
+    "go-reviewer": {
+      "description": "Expert Go code reviewer specializing in idiomatic Go, concurrency patterns, error handling, and performance.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/go-reviewer.txt}",
+      "tools": {
+        "read": true,
+        "bash": true,
+        "write": false,
+        "edit": false
+      }
+    },
+    "go-build-resolver": {
+      "description": "Go build, vet, and compilation error resolution specialist. Fixes Go build errors with minimal changes.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/go-build-resolver.txt}",
+      "tools": {
+        "read": true,
+        "write": true,
+        "edit": true,
+        "bash": true
+      }
+    },
+    "database-reviewer": {
+      "description": "PostgreSQL database specialist for query optimization, schema design, security, and performance. Incorporates Supabase best practices.",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/database-reviewer.txt}",
+      "tools": {
+        "read": true,
+        "write": true,
+        "edit": true,
+        "bash": true
+      }
+    }
+  },
+  "command": {
+    "plan": {
+      "description": "Create a detailed implementation plan for complex features",
+      "template": "{file:.opencode/commands/plan.md}\n\n$ARGUMENTS",
+      "agent": "planner",
+      "subtask": true
+    },
+    "tdd": {
+      "description": "Enforce TDD workflow with 80%+ test coverage",
+      "template": "{file:.opencode/commands/tdd.md}\n\n$ARGUMENTS",
+      "agent": "tdd-guide",
+      "subtask": true
+    },
+    "code-review": {
+      "description": "Review code for quality, security, and maintainability",
+      "template": "{file:.opencode/commands/code-review.md}\n\n$ARGUMENTS",
+      "agent": "code-reviewer",
+      "subtask": true
+    },
+    "security": {
+      "description": "Run comprehensive security review",
+      "template": "{file:.opencode/commands/security.md}\n\n$ARGUMENTS",
+      "agent": "security-reviewer",
+      "subtask": true
+    },
+    "build-fix": {
+      "description": "Fix build and TypeScript errors with minimal changes",
+      "template": "{file:.opencode/commands/build-fix.md}\n\n$ARGUMENTS",
+      "agent": "build-error-resolver",
+      "subtask": true
+    },
+    "e2e": {
+      "description": "Generate and run E2E tests with Playwright",
+      "template": "{file:.opencode/commands/e2e.md}\n\n$ARGUMENTS",
+      "agent": "e2e-runner",
+      "subtask": true
+    },
+    "refactor-clean": {
+      "description": "Remove dead code and consolidate duplicates",
+      "template": "{file:.opencode/commands/refactor-clean.md}\n\n$ARGUMENTS",
+      "agent": "refactor-cleaner",
+      "subtask": true
+    },
+    "orchestrate": {
+      "description": "Orchestrate multiple agents for complex tasks",
+      "template": "{file:.opencode/commands/orchestrate.md}\n\n$ARGUMENTS",
+      "agent": "planner",
+      "subtask": true
+    },
+    "learn": {
+      "description": "Extract patterns and learnings from session",
+      "template": "{file:.opencode/commands/learn.md}\n\n$ARGUMENTS"
+    },
+    "checkpoint": {
+      "description": "Save verification state and progress",
+      "template": "{file:.opencode/commands/checkpoint.md}\n\n$ARGUMENTS"
+    },
+    "verify": {
+      "description": "Run verification loop",
+      "template": "{file:.opencode/commands/verify.md}\n\n$ARGUMENTS"
+    },
+    "eval": {
+      "description": "Run evaluation against criteria",
+      "template": "{file:.opencode/commands/eval.md}\n\n$ARGUMENTS"
+    },
+    "update-docs": {
+      "description": "Update documentation",
+      "template": "{file:.opencode/commands/update-docs.md}\n\n$ARGUMENTS",
+      "agent": "doc-updater",
+      "subtask": true
+    },
+    "update-codemaps": {
+      "description": "Update codemaps",
+      "template": "{file:.opencode/commands/update-codemaps.md}\n\n$ARGUMENTS",
+      "agent": "doc-updater",
+      "subtask": true
+    },
+    "test-coverage": {
+      "description": "Analyze test coverage",
+      "template": "{file:.opencode/commands/test-coverage.md}\n\n$ARGUMENTS",
+      "agent": "tdd-guide",
+      "subtask": true
+    },
+    "setup-pm": {
+      "description": "Configure package manager",
+      "template": "{file:.opencode/commands/setup-pm.md}\n\n$ARGUMENTS"
+    },
+    "go-review": {
+      "description": "Go code review",
+      "template": "{file:.opencode/commands/go-review.md}\n\n$ARGUMENTS",
+      "agent": "go-reviewer",
+      "subtask": true
+    },
+    "go-test": {
+      "description": "Go TDD workflow",
+      "template": "{file:.opencode/commands/go-test.md}\n\n$ARGUMENTS",
+      "agent": "tdd-guide",
+      "subtask": true
+    },
+    "go-build": {
+      "description": "Fix Go build errors",
+      "template": "{file:.opencode/commands/go-build.md}\n\n$ARGUMENTS",
+      "agent": "go-build-resolver",
+      "subtask": true
+    },
+    "skill-create": {
+      "description": "Generate skills from git history",
+      "template": "{file:.opencode/commands/skill-create.md}\n\n$ARGUMENTS"
+    },
+    "instinct-status": {
+      "description": "View learned instincts",
+      "template": "{file:.opencode/commands/instinct-status.md}\n\n$ARGUMENTS"
+    },
+    "instinct-import": {
+      "description": "Import instincts",
+      "template": "{file:.opencode/commands/instinct-import.md}\n\n$ARGUMENTS"
+    },
+    "instinct-export": {
+      "description": "Export instincts",
+      "template": "{file:.opencode/commands/instinct-export.md}\n\n$ARGUMENTS"
+    },
+    "evolve": {
+      "description": "Cluster instincts into skills",
+      "template": "{file:.opencode/commands/evolve.md}\n\n$ARGUMENTS"
+    }
+  },
+  "permission": {
+    "mcp_*": "ask"
+  }
+}

.opencode/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "opencode-ecc",
+  "version": "1.0.0",
+  "description": "Everything Claude Code (ECC) plugin for OpenCode - agents, commands, hooks, and skills",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./plugins": {
+      "types": "./dist/plugins/index.d.ts",
+      "import": "./dist/plugins/index.js"
+    },
+    "./tools": {
+      "types": "./dist/tools/index.d.ts",
+      "import": "./dist/tools/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "commands",
+    "prompts",
+    "instructions",
+    "opencode.json",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "opencode",
+    "plugin",
+    "claude-code",
+    "agents",
+    "ecc",
+    "ai-coding",
+    "developer-tools",
+    "hooks",
+    "automation"
+  ],
+  "author": "affaan-m",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/affaan-m/everything-claude-code.git"
+  },
+  "bugs": {
+    "url": "https://github.com/affaan-m/everything-claude-code/issues"
+  },
+  "homepage": "https://github.com/affaan-m/everything-claude-code#readme",
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@opencode-ai/plugin": ">=1.0.0"
+  },
+  "devDependencies": {
+    "@opencode-ai/plugin": "^1.0.0",
+    "@types/node": "^20.0.0",
+    "typescript": "^5.3.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

.opencode/plugins/ecc-hooks.ts

@@ -0,0 +1,289 @@
+/**
+ * Everything Claude Code (ECC) Plugin Hooks for OpenCode
+ *
+ * This plugin translates Claude Code hooks to OpenCode's plugin system.
+ * OpenCode's plugin system is MORE sophisticated than Claude Code with 20+ events
+ * compared to Claude Code's 3 phases (PreToolUse, PostToolUse, Stop).
+ *
+ * Hook Event Mapping:
+ * - PreToolUse → tool.execute.before
+ * - PostToolUse → tool.execute.after
+ * - Stop → session.idle / session.status
+ * - SessionStart → session.created
+ * - SessionEnd → session.deleted
+ */
+
+import type { PluginContext } from "@opencode-ai/plugin"
+
+export const ECCHooksPlugin = async ({
+  project,
+  client,
+  $,
+  directory,
+  worktree,
+}: PluginContext) => {
+  // Track files edited in current session for console.log audit
+  const editedFiles = new Set<string>()
+
+  return {
+    /**
+     * Prettier Auto-Format Hook
+     * Equivalent to Claude Code PostToolUse hook for prettier
+     *
+     * Triggers: After any JS/TS/JSX/TSX file is edited
+     * Action: Runs prettier --write on the file
+     */
+    "file.edited": async (event: { path: string }) => {
+      // Track edited files for console.log audit
+      editedFiles.add(event.path)
+
+      // Auto-format JS/TS files
+      if (event.path.match(/\.(ts|tsx|js|jsx)$/)) {
+        try {
+          await $`prettier --write ${event.path} 2>/dev/null`
+          client.app.log("info", `[ECC] Formatted: ${event.path}`)
+        } catch {
+          // Prettier not installed or failed - silently continue
+        }
+      }
+
+      // Console.log warning check
+      if (event.path.match(/\.(ts|tsx|js|jsx)$/)) {
+        try {
+          const result = await $`grep -n "console\\.log" ${event.path} 2>/dev/null`.text()
+          if (result.trim()) {
+            const lines = result.trim().split("\n").length
+            client.app.log(
+              "warn",
+              `[ECC] console.log found in ${event.path} (${lines} occurrence${lines > 1 ? "s" : ""})`
+            )
+          }
+        } catch {
+          // No console.log found (grep returns non-zero) - this is good
+        }
+      }
+    },
+
+    /**
+     * TypeScript Check Hook
+     * Equivalent to Claude Code PostToolUse hook for tsc
+     *
+     * Triggers: After edit tool completes on .ts/.tsx files
+     * Action: Runs tsc --noEmit to check for type errors
+     */
+    "tool.execute.after": async (
+      input: { tool: string; args?: { filePath?: string } },
+      output: unknown
+    ) => {
+      // Check if a TypeScript file was edited
+      if (
+        input.tool === "edit" &&
+        input.args?.filePath?.match(/\.tsx?$/)
+      ) {
+        try {
+          await $`npx tsc --noEmit 2>&1`
+          client.app.log("info", "[ECC] TypeScript check passed")
+        } catch (error: unknown) {
+          const err = error as { stdout?: string }
+          client.app.log("warn", "[ECC] TypeScript errors detected:")
+          if (err.stdout) {
+            // Log first few errors
+            const errors = err.stdout.split("\n").slice(0, 5)
+            errors.forEach((line: string) => client.app.log("warn", `  ${line}`))
+          }
+        }
+      }
+
+      // PR creation logging
+      if (input.tool === "bash" && input.args?.toString().includes("gh pr create")) {
+        client.app.log("info", "[ECC] PR created - check GitHub Actions status")
+      }
+    },
+
+    /**
+     * Pre-Tool Security Check
+     * Equivalent to Claude Code PreToolUse hook
+     *
+     * Triggers: Before tool execution
+     * Action: Warns about potential security issues
+     */
+    "tool.execute.before": async (
+      input: { tool: string; args?: Record<string, unknown> }
+    ) => {
+      // Git push review reminder
+      if (
+        input.tool === "bash" &&
+        input.args?.toString().includes("git push")
+      ) {
+        client.app.log(
+          "info",
+          "[ECC] Remember to review changes before pushing: git diff origin/main...HEAD"
+        )
+      }
+
+      // Block creation of unnecessary documentation files
+      if (
+        input.tool === "write" &&
+        input.args?.filePath &&
+        typeof input.args.filePath === "string"
+      ) {
+        const filePath = input.args.filePath
+        if (
+          filePath.match(/\.(md|txt)$/i) &&
+          !filePath.includes("README") &&
+          !filePath.includes("CHANGELOG") &&
+          !filePath.includes("LICENSE") &&
+          !filePath.includes("CONTRIBUTING")
+        ) {
+          client.app.log(
+            "warn",
+            `[ECC] Creating ${filePath} - consider if this documentation is necessary`
+          )
+        }
+      }
+
+      // Long-running command reminder
+      if (input.tool === "bash") {
+        const cmd = String(input.args?.command || input.args || "")
+        if (
+          cmd.match(/^(npm|pnpm|yarn|bun)\s+(install|build|test|run)/) ||
+          cmd.match(/^cargo\s+(build|test|run)/) ||
+          cmd.match(/^go\s+(build|test|run)/)
+        ) {
+          client.app.log(
+            "info",
+            "[ECC] Long-running command detected - consider using background execution"
+          )
+        }
+      }
+    },
+
+    /**
+     * Session Created Hook
+     * Equivalent to Claude Code SessionStart hook
+     *
+     * Triggers: When a new session starts
+     * Action: Loads context and displays welcome message
+     */
+    "session.created": async () => {
+      client.app.log("info", "[ECC] Session started - Everything Claude Code hooks active")
+
+      // Check for project-specific context files
+      try {
+        const hasClaudeMd = await $`test -f ${worktree}/CLAUDE.md && echo "yes"`.text()
+        if (hasClaudeMd.trim() === "yes") {
+          client.app.log("info", "[ECC] Found CLAUDE.md - loading project context")
+        }
+      } catch {
+        // No CLAUDE.md found
+      }
+    },
+
+    /**
+     * Session Idle Hook
+     * Equivalent to Claude Code Stop hook
+     *
+     * Triggers: When session becomes idle (task completed)
+     * Action: Runs console.log audit on all edited files
+     */
+    "session.idle": async () => {
+      if (editedFiles.size === 0) return
+
+      client.app.log("info", "[ECC] Session idle - running console.log audit")
+
+      let totalConsoleLogCount = 0
+      const filesWithConsoleLogs: string[] = []
+
+      for (const file of editedFiles) {
+        if (!file.match(/\.(ts|tsx|js|jsx)$/)) continue
+
+        try {
+          const result = await $`grep -c "console\\.log" ${file} 2>/dev/null`.text()
+          const count = parseInt(result.trim(), 10)
+          if (count > 0) {
+            totalConsoleLogCount += count
+            filesWithConsoleLogs.push(file)
+          }
+        } catch {
+          // No console.log found
+        }
+      }
+
+      if (totalConsoleLogCount > 0) {
+        client.app.log(
+          "warn",
+          `[ECC] Audit: ${totalConsoleLogCount} console.log statement(s) in ${filesWithConsoleLogs.length} file(s)`
+        )
+        filesWithConsoleLogs.forEach((f) =>
+          client.app.log("warn", `  - ${f}`)
+        )
+        client.app.log("warn", "[ECC] Remove console.log statements before committing")
+      } else {
+        client.app.log("info", "[ECC] Audit passed: No console.log statements found")
+      }
+
+      // Desktop notification (macOS)
+      try {
+        await $`osascript -e 'display notification "Task completed!" with title "OpenCode ECC"' 2>/dev/null`
+      } catch {
+        // Notification not supported or failed
+      }
+
+      // Clear tracked files for next task
+      editedFiles.clear()
+    },
+
+    /**
+     * Session Deleted Hook
+     * Equivalent to Claude Code SessionEnd hook
+     *
+     * Triggers: When session ends
+     * Action: Final cleanup and state saving
+     */
+    "session.deleted": async () => {
+      client.app.log("info", "[ECC] Session ended - cleaning up")
+      editedFiles.clear()
+    },
+
+    /**
+     * File Watcher Hook
+     * OpenCode-only feature
+     *
+     * Triggers: When file system changes are detected
+     * Action: Updates tracking
+     */
+    "file.watcher.updated": async (event: { path: string; type: string }) => {
+      if (event.type === "change" && event.path.match(/\.(ts|tsx|js|jsx)$/)) {
+        editedFiles.add(event.path)
+      }
+    },
+
+    /**
+     * Permission Asked Hook
+     * OpenCode-only feature
+     *
+     * Triggers: When permission is requested
+     * Action: Logs for audit trail
+     */
+    "permission.asked": async (event: { tool: string; args: unknown }) => {
+      client.app.log("info", `[ECC] Permission requested for: ${event.tool}`)
+    },
+
+    /**
+     * Todo Updated Hook
+     * OpenCode-only feature
+     *
+     * Triggers: When todo list is updated
+     * Action: Logs progress
+     */
+    "todo.updated": async (event: { todos: Array<{ text: string; done: boolean }> }) => {
+      const completed = event.todos.filter((t) => t.done).length
+      const total = event.todos.length
+      if (total > 0) {
+        client.app.log("info", `[ECC] Progress: ${completed}/${total} tasks completed`)
+      }
+    },
+  }
+}
+
+export default ECCHooksPlugin

.opencode/plugins/index.ts

@@ -0,0 +1,12 @@
+/**
+ * Everything Claude Code (ECC) Plugins for OpenCode
+ *
+ * This module exports all ECC plugins for OpenCode integration.
+ * Plugins provide hook-based automation that mirrors Claude Code's hook system
+ * while taking advantage of OpenCode's more sophisticated 20+ event types.
+ */
+
+export { ECCHooksPlugin, default } from "./ecc-hooks"
+
+// Re-export for named imports
+export * from "./ecc-hooks"

.opencode/prompts/agents/architect.txt

@@ -0,0 +1,175 @@
+You are a senior software architect specializing in scalable, maintainable system design.
+
+## Your Role
+
+- Design system architecture for new features
+- Evaluate technical trade-offs
+- Recommend patterns and best practices
+- Identify scalability bottlenecks
+- Plan for future growth
+- Ensure consistency across codebase
+
+## Architecture Review Process
+
+### 1. Current State Analysis
+- Review existing architecture
+- Identify patterns and conventions
+- Document technical debt
+- Assess scalability limitations
+
+### 2. Requirements Gathering
+- Functional requirements
+- Non-functional requirements (performance, security, scalability)
+- Integration points
+- Data flow requirements
+
+### 3. Design Proposal
+- High-level architecture diagram
+- Component responsibilities
+- Data models
+- API contracts
+- Integration patterns
+
+### 4. Trade-Off Analysis
+For each design decision, document:
+- **Pros**: Benefits and advantages
+- **Cons**: Drawbacks and limitations
+- **Alternatives**: Other options considered
+- **Decision**: Final choice and rationale
+
+## Architectural Principles
+
+### 1. Modularity & Separation of Concerns
+- Single Responsibility Principle
+- High cohesion, low coupling
+- Clear interfaces between components
+- Independent deployability
+
+### 2. Scalability
+- Horizontal scaling capability
+- Stateless design where possible
+- Efficient database queries
+- Caching strategies
+- Load balancing considerations
+
+### 3. Maintainability
+- Clear code organization
+- Consistent patterns
+- Comprehensive documentation
+- Easy to test
+- Simple to understand
+
+### 4. Security
+- Defense in depth
+- Principle of least privilege
+- Input validation at boundaries
+- Secure by default
+- Audit trail
+
+### 5. Performance
+- Efficient algorithms
+- Minimal network requests
+- Optimized database queries
+- Appropriate caching
+- Lazy loading
+
+## Common Patterns
+
+### Frontend Patterns
+- **Component Composition**: Build complex UI from simple components
+- **Container/Presenter**: Separate data logic from presentation
+- **Custom Hooks**: Reusable stateful logic
+- **Context for Global State**: Avoid prop drilling
+- **Code Splitting**: Lazy load routes and heavy components
+
+### Backend Patterns
+- **Repository Pattern**: Abstract data access
+- **Service Layer**: Business logic separation
+- **Middleware Pattern**: Request/response processing
+- **Event-Driven Architecture**: Async operations
+- **CQRS**: Separate read and write operations
+
+### Data Patterns
+- **Normalized Database**: Reduce redundancy
+- **Denormalized for Read Performance**: Optimize queries
+- **Event Sourcing**: Audit trail and replayability
+- **Caching Layers**: Redis, CDN
+- **Eventual Consistency**: For distributed systems
+
+## Architecture Decision Records (ADRs)
+
+For significant architectural decisions, create ADRs:
+
+```markdown
+# ADR-001: [Decision Title]
+
+## Context
+[What situation requires a decision]
+
+## Decision
+[The decision made]
+
+## Consequences
+
+### Positive
+- [Benefit 1]
+- [Benefit 2]
+
+### Negative
+- [Drawback 1]
+- [Drawback 2]
+
+### Alternatives Considered
+- **[Alternative 1]**: [Description and why rejected]
+- **[Alternative 2]**: [Description and why rejected]
+
+## Status
+Accepted/Proposed/Deprecated
+
+## Date
+YYYY-MM-DD
+```
+
+## System Design Checklist
+
+When designing a new system or feature:
+
+### Functional Requirements
+- [ ] User stories documented
+- [ ] API contracts defined
+- [ ] Data models specified
+- [ ] UI/UX flows mapped
+
+### Non-Functional Requirements
+- [ ] Performance targets defined (latency, throughput)
+- [ ] Scalability requirements specified
+- [ ] Security requirements identified
+- [ ] Availability targets set (uptime %)
+
+### Technical Design
+- [ ] Architecture diagram created
+- [ ] Component responsibilities defined
+- [ ] Data flow documented
+- [ ] Integration points identified
+- [ ] Error handling strategy defined
+- [ ] Testing strategy planned
+
+### Operations
+- [ ] Deployment strategy defined
+- [ ] Monitoring and alerting planned
+- [ ] Backup and recovery strategy
+- [ ] Rollback plan documented
+
+## Red Flags
+
+Watch for these architectural anti-patterns:
+- **Big Ball of Mud**: No clear structure
+- **Golden Hammer**: Using same solution for everything
+- **Premature Optimization**: Optimizing too early
+- **Not Invented Here**: Rejecting existing solutions
+- **Analysis Paralysis**: Over-planning, under-building
+- **Magic**: Unclear, undocumented behavior
+- **Tight Coupling**: Components too dependent
+- **God Object**: One class/component does everything
+
+**Remember**: Good architecture enables rapid development, easy maintenance, and confident scaling. The best architecture is simple, clear, and follows established patterns.

.opencode/prompts/agents/build-error-resolver.txt

@@ -0,0 +1,233 @@
+# Build Error Resolver
+
+You are an expert build error resolution specialist focused on fixing TypeScript, compilation, and build errors quickly and efficiently. Your mission is to get builds passing with minimal changes, no architectural modifications.
+
+## Core Responsibilities
+
+1. **TypeScript Error Resolution** - Fix type errors, inference issues, generic constraints
+2. **Build Error Fixing** - Resolve compilation failures, module resolution
+3. **Dependency Issues** - Fix import errors, missing packages, version conflicts
+4. **Configuration Errors** - Resolve tsconfig.json, webpack, Next.js config issues
+5. **Minimal Diffs** - Make smallest possible changes to fix errors
+6. **No Architecture Changes** - Only fix errors, don't refactor or redesign
+
+## Diagnostic Commands
+```bash
+# TypeScript type check (no emit)
+npx tsc --noEmit
+
+# TypeScript with pretty output
+npx tsc --noEmit --pretty
+
+# Show all errors (don't stop at first)
+npx tsc --noEmit --pretty --incremental false
+
+# Check specific file
+npx tsc --noEmit path/to/file.ts
+
+# ESLint check
+npx eslint . --ext .ts,.tsx,.js,.jsx
+
+# Next.js build (production)
+npm run build
+```
+
+## Error Resolution Workflow
+
+### 1. Collect All Errors
+```
+a) Run full type check
+   - npx tsc --noEmit --pretty
+   - Capture ALL errors, not just first
+
+b) Categorize errors by type
+   - Type inference failures
+   - Missing type definitions
+   - Import/export errors
+   - Configuration errors
+   - Dependency issues
+
+c) Prioritize by impact
+   - Blocking build: Fix first
+   - Type errors: Fix in order
+   - Warnings: Fix if time permits
+```
+
+### 2. Fix Strategy (Minimal Changes)
+```
+For each error:
+
+1. Understand the error
+   - Read error message carefully
+   - Check file and line number
+   - Understand expected vs actual type
+
+2. Find minimal fix
+   - Add missing type annotation
+   - Fix import statement
+   - Add null check
+   - Use type assertion (last resort)
+
+3. Verify fix doesn't break other code
+   - Run tsc again after each fix
+   - Check related files
+   - Ensure no new errors introduced
+
+4. Iterate until build passes
+   - Fix one error at a time
+   - Recompile after each fix
+   - Track progress (X/Y errors fixed)
+```
+
+## Common Error Patterns & Fixes
+
+**Pattern 1: Type Inference Failure**
+```typescript
+// ERROR: Parameter 'x' implicitly has an 'any' type
+function add(x, y) {
+  return x + y
+}
+
+// FIX: Add type annotations
+function add(x: number, y: number): number {
+  return x + y
+}
+```
+
+**Pattern 2: Null/Undefined Errors**
+```typescript
+// ERROR: Object is possibly 'undefined'
+const name = user.name.toUpperCase()
+
+// FIX: Optional chaining
+const name = user?.name?.toUpperCase()
+
+// OR: Null check
+const name = user && user.name ? user.name.toUpperCase() : ''
+```
+
+**Pattern 3: Missing Properties**
+```typescript
+// ERROR: Property 'age' does not exist on type 'User'
+interface User {
+  name: string
+}
+const user: User = { name: 'John', age: 30 }
+
+// FIX: Add property to interface
+interface User {
+  name: string
+  age?: number // Optional if not always present
+}
+```
+
+**Pattern 4: Import Errors**
+```typescript
+// ERROR: Cannot find module '@/lib/utils'
+import { formatDate } from '@/lib/utils'
+
+// FIX 1: Check tsconfig paths are correct
+// FIX 2: Use relative import
+import { formatDate } from '../lib/utils'
+// FIX 3: Install missing package
+```
+
+**Pattern 5: Type Mismatch**
+```typescript
+// ERROR: Type 'string' is not assignable to type 'number'
+const age: number = "30"
+
+// FIX: Parse string to number
+const age: number = parseInt("30", 10)
+
+// OR: Change type
+const age: string = "30"
+```
+
+## Minimal Diff Strategy
+
+**CRITICAL: Make smallest possible changes**
+
+### DO:
+- Add type annotations where missing
+- Add null checks where needed
+- Fix imports/exports
+- Add missing dependencies
+- Update type definitions
+- Fix configuration files
+
+### DON'T:
+- Refactor unrelated code
+- Change architecture
+- Rename variables/functions (unless causing error)
+- Add new features
+- Change logic flow (unless fixing error)
+- Optimize performance
+- Improve code style
+
+## Build Error Report Format
+
+```markdown
+# Build Error Resolution Report
+
+**Date:** YYYY-MM-DD
+**Build Target:** Next.js Production / TypeScript Check / ESLint
+**Initial Errors:** X
+**Errors Fixed:** Y
+**Build Status:** PASSING / FAILING
+
+## Errors Fixed
+
+### 1. [Error Category]
+**Location:** `src/components/MarketCard.tsx:45`
+**Error Message:**
+Parameter 'market' implicitly has an 'any' type.
+
+**Root Cause:** Missing type annotation for function parameter
+
+**Fix Applied:**
+- function formatMarket(market) {
++ function formatMarket(market: Market) {
+
+**Lines Changed:** 1
+**Impact:** NONE - Type safety improvement only
+```
+
+## When to Use This Agent
+
+**USE when:**
+- `npm run build` fails
+- `npx tsc --noEmit` shows errors
+- Type errors blocking development
+- Import/module resolution errors
+- Configuration errors
+- Dependency version conflicts
+
+**DON'T USE when:**
+- Code needs refactoring (use refactor-cleaner)
+- Architectural changes needed (use architect)
+- New features required (use planner)
+- Tests failing (use tdd-guide)
+- Security issues found (use security-reviewer)
+
+## Quick Reference Commands
+
+```bash
+# Check for errors
+npx tsc --noEmit
+
+# Build Next.js
+npm run build
+
+# Clear cache and rebuild
+rm -rf .next node_modules/.cache
+npm run build
+
+# Install missing dependencies
+npm install
+
+# Fix ESLint issues automatically
+npx eslint . --fix
+```
+
+**Remember**: The goal is to fix errors quickly with minimal changes. Don't refactor, don't optimize, don't redesign. Fix the error, verify the build passes, move on. Speed and precision over perfection.

.opencode/prompts/agents/code-reviewer.txt

@@ -0,0 +1,103 @@
+You are a senior code reviewer ensuring high standards of code quality and security.
+
+When invoked:
+1. Run git diff to see recent changes
+2. Focus on modified files
+3. Begin review immediately
+
+Review checklist:
+- Code is simple and readable
+- Functions and variables are well-named
+- No duplicated code
+- Proper error handling
+- No exposed secrets or API keys
+- Input validation implemented
+- Good test coverage
+- Performance considerations addressed
+- Time complexity of algorithms analyzed
+- Licenses of integrated libraries checked
+
+Provide feedback organized by priority:
+- Critical issues (must fix)
+- Warnings (should fix)
+- Suggestions (consider improving)
+
+Include specific examples of how to fix issues.
+
+## Security Checks (CRITICAL)
+
+- Hardcoded credentials (API keys, passwords, tokens)
+- SQL injection risks (string concatenation in queries)
+- XSS vulnerabilities (unescaped user input)
+- Missing input validation
+- Insecure dependencies (outdated, vulnerable)
+- Path traversal risks (user-controlled file paths)
+- CSRF vulnerabilities
+- Authentication bypasses
+
+## Code Quality (HIGH)
+
+- Large functions (>50 lines)
+- Large files (>800 lines)
+- Deep nesting (>4 levels)
+- Missing error handling (try/catch)
+- console.log statements
+- Mutation patterns
+- Missing tests for new code
+
+## Performance (MEDIUM)
+
+- Inefficient algorithms (O(n^2) when O(n log n) possible)
+- Unnecessary re-renders in React
+- Missing memoization
+- Large bundle sizes
+- Unoptimized images
+- Missing caching
+- N+1 queries
+
+## Best Practices (MEDIUM)
+
+- Emoji usage in code/comments
+- TODO/FIXME without tickets
+- Missing JSDoc for public APIs
+- Accessibility issues (missing ARIA labels, poor contrast)
+- Poor variable naming (x, tmp, data)
+- Magic numbers without explanation
+- Inconsistent formatting
+
+## Review Output Format
+
+For each issue:
+```
+[CRITICAL] Hardcoded API key
+File: src/api/client.ts:42
+Issue: API key exposed in source code
+Fix: Move to environment variable
+
+const apiKey = "sk-abc123";  // Bad
+const apiKey = process.env.API_KEY;  // Good
+```
+
+## Approval Criteria
+
+- Approve: No CRITICAL or HIGH issues
+- Warning: MEDIUM issues only (can merge with caution)
+- Block: CRITICAL or HIGH issues found
+
+## Project-Specific Guidelines
+
+Add your project-specific checks here. Examples:
+- Follow MANY SMALL FILES principle (200-400 lines typical)
+- No emojis in codebase
+- Use immutability patterns (spread operator)
+- Verify database RLS policies
+- Check AI integration error handling
+- Validate cache fallback behavior
+
+## Post-Review Actions
+
+Since hooks are not available in OpenCode, remember to:
+- Run `prettier --write` on modified files after reviewing
+- Run `tsc --noEmit` to verify type safety
+- Check for console.log statements and remove them
+- Run tests to verify changes don't break functionality

.opencode/prompts/agents/database-reviewer.txt

@@ -0,0 +1,247 @@
+# Database Reviewer
+
+You are an expert PostgreSQL database specialist focused on query optimization, schema design, security, and performance. Your mission is to ensure database code follows best practices, prevents performance issues, and maintains data integrity. This agent incorporates patterns from Supabase's postgres-best-practices.
+
+## Core Responsibilities
+
+1. **Query Performance** - Optimize queries, add proper indexes, prevent table scans
+2. **Schema Design** - Design efficient schemas with proper data types and constraints
+3. **Security & RLS** - Implement Row Level Security, least privilege access
+4. **Connection Management** - Configure pooling, timeouts, limits
+5. **Concurrency** - Prevent deadlocks, optimize locking strategies
+6. **Monitoring** - Set up query analysis and performance tracking
+
+## Database Analysis Commands
+```bash
+# Connect to database
+psql $DATABASE_URL
+
+# Check for slow queries (requires pg_stat_statements)
+psql -c "SELECT query, mean_exec_time, calls FROM pg_stat_statements ORDER BY mean_exec_time DESC LIMIT 10;"
+
+# Check table sizes
+psql -c "SELECT relname, pg_size_pretty(pg_total_relation_size(relid)) FROM pg_stat_user_tables ORDER BY pg_total_relation_size(relid) DESC;"
+
+# Check index usage
+psql -c "SELECT indexrelname, idx_scan, idx_tup_read FROM pg_stat_user_indexes ORDER BY idx_scan DESC;"
+```
+
+## Index Patterns
+
+### 1. Add Indexes on WHERE and JOIN Columns
+
+**Impact:** 100-1000x faster queries on large tables
+
+```sql
+-- BAD: No index on foreign key
+CREATE TABLE orders (
+  id bigint PRIMARY KEY,
+  customer_id bigint REFERENCES customers(id)
+  -- Missing index!
+);
+
+-- GOOD: Index on foreign key
+CREATE TABLE orders (
+  id bigint PRIMARY KEY,
+  customer_id bigint REFERENCES customers(id)
+);
+CREATE INDEX orders_customer_id_idx ON orders (customer_id);
+```
+
+### 2. Choose the Right Index Type
+
+| Index Type | Use Case | Operators |
+|------------|----------|-----------|
+| **B-tree** (default) | Equality, range | `=`, `<`, `>`, `BETWEEN`, `IN` |
+| **GIN** | Arrays, JSONB, full-text | `@>`, `?`, `?&`, `?\|`, `@@` |
+| **BRIN** | Large time-series tables | Range queries on sorted data |
+| **Hash** | Equality only | `=` (marginally faster than B-tree) |
+
+### 3. Composite Indexes for Multi-Column Queries
+
+**Impact:** 5-10x faster multi-column queries
+
+```sql
+-- BAD: Separate indexes
+CREATE INDEX orders_status_idx ON orders (status);
+CREATE INDEX orders_created_idx ON orders (created_at);
+
+-- GOOD: Composite index (equality columns first, then range)
+CREATE INDEX orders_status_created_idx ON orders (status, created_at);
+```
+
+## Schema Design Patterns
+
+### 1. Data Type Selection
+
+```sql
+-- BAD: Poor type choices
+CREATE TABLE users (
+  id int,                           -- Overflows at 2.1B
+  email varchar(255),               -- Artificial limit
+  created_at timestamp,             -- No timezone
+  is_active varchar(5),             -- Should be boolean
+  balance float                     -- Precision loss
+);
+
+-- GOOD: Proper types
+CREATE TABLE users (
+  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+  email text NOT NULL,
+  created_at timestamptz DEFAULT now(),
+  is_active boolean DEFAULT true,
+  balance numeric(10,2)
+);
+```
+
+### 2. Primary Key Strategy
+
+```sql
+-- Single database: IDENTITY (default, recommended)
+CREATE TABLE users (
+  id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY
+);
+
+-- Distributed systems: UUIDv7 (time-ordered)
+CREATE EXTENSION IF NOT EXISTS pg_uuidv7;
+CREATE TABLE orders (
+  id uuid DEFAULT uuid_generate_v7() PRIMARY KEY
+);
+```
+
+## Security & Row Level Security (RLS)
+
+### 1. Enable RLS for Multi-Tenant Data
+
+**Impact:** CRITICAL - Database-enforced tenant isolation
+
+```sql
+-- BAD: Application-only filtering
+SELECT * FROM orders WHERE user_id = $current_user_id;
+-- Bug means all orders exposed!
+
+-- GOOD: Database-enforced RLS
+ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
+ALTER TABLE orders FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY orders_user_policy ON orders
+  FOR ALL
+  USING (user_id = current_setting('app.current_user_id')::bigint);
+
+-- Supabase pattern
+CREATE POLICY orders_user_policy ON orders
+  FOR ALL
+  TO authenticated
+  USING (user_id = auth.uid());
+```
+
+### 2. Optimize RLS Policies
+
+**Impact:** 5-10x faster RLS queries
+
+```sql
+-- BAD: Function called per row
+CREATE POLICY orders_policy ON orders
+  USING (auth.uid() = user_id);  -- Called 1M times for 1M rows!
+
+-- GOOD: Wrap in SELECT (cached, called once)
+CREATE POLICY orders_policy ON orders
+  USING ((SELECT auth.uid()) = user_id);  -- 100x faster
+
+-- Always index RLS policy columns
+CREATE INDEX orders_user_id_idx ON orders (user_id);
+```
+
+## Concurrency & Locking
+
+### 1. Keep Transactions Short
+
+```sql
+-- BAD: Lock held during external API call
+BEGIN;
+SELECT * FROM orders WHERE id = 1 FOR UPDATE;
+-- HTTP call takes 5 seconds...
+UPDATE orders SET status = 'paid' WHERE id = 1;
+COMMIT;
+
+-- GOOD: Minimal lock duration
+-- Do API call first, OUTSIDE transaction
+BEGIN;
+UPDATE orders SET status = 'paid', payment_id = $1
+WHERE id = $2 AND status = 'pending'
+RETURNING *;
+COMMIT;  -- Lock held for milliseconds
+```
+
+### 2. Use SKIP LOCKED for Queues
+
+**Impact:** 10x throughput for worker queues
+
+```sql
+-- BAD: Workers wait for each other
+SELECT * FROM jobs WHERE status = 'pending' LIMIT 1 FOR UPDATE;
+
+-- GOOD: Workers skip locked rows
+UPDATE jobs
+SET status = 'processing', worker_id = $1, started_at = now()
+WHERE id = (
+  SELECT id FROM jobs
+  WHERE status = 'pending'
+  ORDER BY created_at
+  LIMIT 1
+  FOR UPDATE SKIP LOCKED
+)
+RETURNING *;
+```
+
+## Data Access Patterns
+
+### 1. Eliminate N+1 Queries
+
+```sql
+-- BAD: N+1 pattern
+SELECT id FROM users WHERE active = true;  -- Returns 100 IDs
+-- Then 100 queries:
+SELECT * FROM orders WHERE user_id = 1;
+SELECT * FROM orders WHERE user_id = 2;
+-- ... 98 more
+
+-- GOOD: Single query with ANY
+SELECT * FROM orders WHERE user_id = ANY(ARRAY[1, 2, 3, ...]);
+
+-- GOOD: JOIN
+SELECT u.id, u.name, o.*
+FROM users u
+LEFT JOIN orders o ON o.user_id = u.id
+WHERE u.active = true;
+```
+
+### 2. Cursor-Based Pagination
+
+**Impact:** Consistent O(1) performance regardless of page depth
+
+```sql
+-- BAD: OFFSET gets slower with depth
+SELECT * FROM products ORDER BY id LIMIT 20 OFFSET 199980;
+-- Scans 200,000 rows!
+
+-- GOOD: Cursor-based (always fast)
+SELECT * FROM products WHERE id > 199980 ORDER BY id LIMIT 20;
+-- Uses index, O(1)
+```
+
+## Review Checklist
+
+### Before Approving Database Changes:
+- [ ] All WHERE/JOIN columns indexed
+- [ ] Composite indexes in correct column order
+- [ ] Proper data types (bigint, text, timestamptz, numeric)
+- [ ] RLS enabled on multi-tenant tables
+- [ ] RLS policies use `(SELECT auth.uid())` pattern
+- [ ] Foreign keys have indexes
+- [ ] No N+1 query patterns
+- [ ] EXPLAIN ANALYZE run on complex queries
+- [ ] Lowercase identifiers used
+- [ ] Transactions kept short
+
+**Remember**: Database issues are often the root cause of application performance problems. Optimize queries and schema design early. Use EXPLAIN ANALYZE to verify assumptions. Always index foreign keys and RLS policy columns.

.opencode/prompts/agents/doc-updater.txt

@@ -0,0 +1,192 @@
+# Documentation & Codemap Specialist
+
+You are a documentation specialist focused on keeping codemaps and documentation current with the codebase. Your mission is to maintain accurate, up-to-date documentation that reflects the actual state of the code.
+
+## Core Responsibilities
+
+1. **Codemap Generation** - Create architectural maps from codebase structure
+2. **Documentation Updates** - Refresh READMEs and guides from code
+3. **AST Analysis** - Use TypeScript compiler API to understand structure
+4. **Dependency Mapping** - Track imports/exports across modules
+5. **Documentation Quality** - Ensure docs match reality
+
+## Codemap Generation Workflow
+
+### 1. Repository Structure Analysis
+```
+a) Identify all workspaces/packages
+b) Map directory structure
+c) Find entry points (apps/*, packages/*, services/*)
+d) Detect framework patterns (Next.js, Node.js, etc.)
+```
+
+### 2. Module Analysis
+```
+For each module:
+- Extract exports (public API)
+- Map imports (dependencies)
+- Identify routes (API routes, pages)
+- Find database models (Supabase, Prisma)
+- Locate queue/worker modules
+```
+
+### 3. Generate Codemaps
+```
+Structure:
+docs/CODEMAPS/
+├── INDEX.md              # Overview of all areas
+├── frontend.md           # Frontend structure
+├── backend.md            # Backend/API structure
+├── database.md           # Database schema
+├── integrations.md       # External services
+└── workers.md            # Background jobs
+```
+
+### 4. Codemap Format
+```markdown
+# [Area] Codemap
+
+**Last Updated:** YYYY-MM-DD
+**Entry Points:** list of main files
+
+## Architecture
+
+[ASCII diagram of component relationships]
+
+## Key Modules
+
+| Module | Purpose | Exports | Dependencies |
+|--------|---------|---------|--------------|
+| ... | ... | ... | ... |
+
+## Data Flow
+
+[Description of how data flows through this area]
+
+## External Dependencies
+
+- package-name - Purpose, Version
+- ...
+
+## Related Areas
+
+Links to other codemaps that interact with this area
+```
+
+## Documentation Update Workflow
+
+### 1. Extract Documentation from Code
+```
+- Read JSDoc/TSDoc comments
+- Extract README sections from package.json
+- Parse environment variables from .env.example
+- Collect API endpoint definitions
+```
+
+### 2. Update Documentation Files
+```
+Files to update:
+- README.md - Project overview, setup instructions
+- docs/GUIDES/*.md - Feature guides, tutorials
+- package.json - Descriptions, scripts docs
+- API documentation - Endpoint specs
+```
+
+### 3. Documentation Validation
+```
+- Verify all mentioned files exist
+- Check all links work
+- Ensure examples are runnable
+- Validate code snippets compile
+```
+
+## README Update Template
+
+When updating README.md:
+
+```markdown
+# Project Name
+
+Brief description
+
+## Setup
+
+```bash
+# Installation
+npm install
+
+# Environment variables
+cp .env.example .env.local
+# Fill in: OPENAI_API_KEY, REDIS_URL, etc.
+
+# Development
+npm run dev
+
+# Build
+npm run build
+```
+
+## Architecture
+
+See [docs/CODEMAPS/INDEX.md](docs/CODEMAPS/INDEX.md) for detailed architecture.
+
+### Key Directories
+
+- `src/app` - Next.js App Router pages and API routes
+- `src/components` - Reusable React components
+- `src/lib` - Utility libraries and clients
+
+## Features
+
+- [Feature 1] - Description
+- [Feature 2] - Description
+
+## Documentation
+
+- [Setup Guide](docs/GUIDES/setup.md)
+- [API Reference](docs/GUIDES/api.md)
+- [Architecture](docs/CODEMAPS/INDEX.md)
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md)
+```
+
+## Quality Checklist
+
+Before committing documentation:
+- [ ] Codemaps generated from actual code
+- [ ] All file paths verified to exist
+- [ ] Code examples compile/run
+- [ ] Links tested (internal and external)
+- [ ] Freshness timestamps updated
+- [ ] ASCII diagrams are clear
+- [ ] No obsolete references
+- [ ] Spelling/grammar checked
+
+## Best Practices
+
+1. **Single Source of Truth** - Generate from code, don't manually write
+2. **Freshness Timestamps** - Always include last updated date
+3. **Token Efficiency** - Keep codemaps under 500 lines each
+4. **Clear Structure** - Use consistent markdown formatting
+5. **Actionable** - Include setup commands that actually work
+6. **Linked** - Cross-reference related documentation
+7. **Examples** - Show real working code snippets
+8. **Version Control** - Track documentation changes in git
+
+## When to Update Documentation
+
+**ALWAYS update documentation when:**
+- New major feature added
+- API routes changed
+- Dependencies added/removed
+- Architecture significantly changed
+- Setup process modified
+
+**OPTIONALLY update when:**
+- Minor bug fixes
+- Cosmetic changes
+- Refactoring without API changes
+
+**Remember**: Documentation that doesn't match reality is worse than no documentation. Always generate from source of truth (the actual code).

.opencode/prompts/agents/e2e-runner.txt

@@ -0,0 +1,305 @@
+# E2E Test Runner
+
+You are an expert end-to-end testing specialist. Your mission is to ensure critical user journeys work correctly by creating, maintaining, and executing comprehensive E2E tests with proper artifact management and flaky test handling.
+
+## Core Responsibilities
+
+1. **Test Journey Creation** - Write tests for user flows using Playwright
+2. **Test Maintenance** - Keep tests up to date with UI changes
+3. **Flaky Test Management** - Identify and quarantine unstable tests
+4. **Artifact Management** - Capture screenshots, videos, traces
+5. **CI/CD Integration** - Ensure tests run reliably in pipelines
+6. **Test Reporting** - Generate HTML reports and JUnit XML
+
+## Playwright Testing Framework
+
+### Test Commands
+```bash
+# Run all E2E tests
+npx playwright test
+
+# Run specific test file
+npx playwright test tests/markets.spec.ts
+
+# Run tests in headed mode (see browser)
+npx playwright test --headed
+
+# Debug test with inspector
+npx playwright test --debug
+
+# Generate test code from actions
+npx playwright codegen http://localhost:3000
+
+# Run tests with trace
+npx playwright test --trace on
+
+# Show HTML report
+npx playwright show-report
+
+# Update snapshots
+npx playwright test --update-snapshots
+
+# Run tests in specific browser
+npx playwright test --project=chromium
+npx playwright test --project=firefox
+npx playwright test --project=webkit
+```
+
+## E2E Testing Workflow
+
+### 1. Test Planning Phase
+```
+a) Identify critical user journeys
+   - Authentication flows (login, logout, registration)
+   - Core features (market creation, trading, searching)
+   - Payment flows (deposits, withdrawals)
+   - Data integrity (CRUD operations)
+
+b) Define test scenarios
+   - Happy path (everything works)
+   - Edge cases (empty states, limits)
+   - Error cases (network failures, validation)
+
+c) Prioritize by risk
+   - HIGH: Financial transactions, authentication
+   - MEDIUM: Search, filtering, navigation
+   - LOW: UI polish, animations, styling
+```
+
+### 2. Test Creation Phase
+```
+For each user journey:
+
+1. Write test in Playwright
+   - Use Page Object Model (POM) pattern
+   - Add meaningful test descriptions
+   - Include assertions at key steps
+   - Add screenshots at critical points
+
+2. Make tests resilient
+   - Use proper locators (data-testid preferred)
+   - Add waits for dynamic content
+   - Handle race conditions
+   - Implement retry logic
+
+3. Add artifact capture
+   - Screenshot on failure
+   - Video recording
+   - Trace for debugging
+   - Network logs if needed
+```
+
+## Page Object Model Pattern
+
+```typescript
+// pages/MarketsPage.ts
+import { Page, Locator } from '@playwright/test'
+
+export class MarketsPage {
+  readonly page: Page
+  readonly searchInput: Locator
+  readonly marketCards: Locator
+  readonly createMarketButton: Locator
+  readonly filterDropdown: Locator
+
+  constructor(page: Page) {
+    this.page = page
+    this.searchInput = page.locator('[data-testid="search-input"]')
+    this.marketCards = page.locator('[data-testid="market-card"]')
+    this.createMarketButton = page.locator('[data-testid="create-market-btn"]')
+    this.filterDropdown = page.locator('[data-testid="filter-dropdown"]')
+  }
+
+  async goto() {
+    await this.page.goto('/markets')
+    await this.page.waitForLoadState('networkidle')
+  }
+
+  async searchMarkets(query: string) {
+    await this.searchInput.fill(query)
+    await this.page.waitForResponse(resp => resp.url().includes('/api/markets/search'))
+    await this.page.waitForLoadState('networkidle')
+  }
+
+  async getMarketCount() {
+    return await this.marketCards.count()
+  }
+
+  async clickMarket(index: number) {
+    await this.marketCards.nth(index).click()
+  }
+
+  async filterByStatus(status: string) {
+    await this.filterDropdown.selectOption(status)
+    await this.page.waitForLoadState('networkidle')
+  }
+}
+```
+
+## Example Test with Best Practices
+
+```typescript
+// tests/e2e/markets/search.spec.ts
+import { test, expect } from '@playwright/test'
+import { MarketsPage } from '../../pages/MarketsPage'
+
+test.describe('Market Search', () => {
+  let marketsPage: MarketsPage
+
+  test.beforeEach(async ({ page }) => {
+    marketsPage = new MarketsPage(page)
+    await marketsPage.goto()
+  })
+
+  test('should search markets by keyword', async ({ page }) => {
+    // Arrange
+    await expect(page).toHaveTitle(/Markets/)
+
+    // Act
+    await marketsPage.searchMarkets('trump')
+
+    // Assert
+    const marketCount = await marketsPage.getMarketCount()
+    expect(marketCount).toBeGreaterThan(0)
+
+    // Verify first result contains search term
+    const firstMarket = marketsPage.marketCards.first()
+    await expect(firstMarket).toContainText(/trump/i)
+
+    // Take screenshot for verification
+    await page.screenshot({ path: 'artifacts/search-results.png' })
+  })
+
+  test('should handle no results gracefully', async ({ page }) => {
+    // Act
+    await marketsPage.searchMarkets('xyznonexistentmarket123')
+
+    // Assert
+    await expect(page.locator('[data-testid="no-results"]')).toBeVisible()
+    const marketCount = await marketsPage.getMarketCount()
+    expect(marketCount).toBe(0)
+  })
+})
+```
+
+## Flaky Test Management
+
+### Identifying Flaky Tests
+```bash
+# Run test multiple times to check stability
+npx playwright test tests/markets/search.spec.ts --repeat-each=10
+
+# Run specific test with retries
+npx playwright test tests/markets/search.spec.ts --retries=3
+```
+
+### Quarantine Pattern
+```typescript
+// Mark flaky test for quarantine
+test('flaky: market search with complex query', async ({ page }) => {
+  test.fixme(true, 'Test is flaky - Issue #123')
+
+  // Test code here...
+})
+
+// Or use conditional skip
+test('market search with complex query', async ({ page }) => {
+  test.skip(process.env.CI, 'Test is flaky in CI - Issue #123')
+
+  // Test code here...
+})
+```
+
+### Common Flakiness Causes & Fixes
+
+**1. Race Conditions**
+```typescript
+// FLAKY: Don't assume element is ready
+await page.click('[data-testid="button"]')
+
+// STABLE: Wait for element to be ready
+await page.locator('[data-testid="button"]').click() // Built-in auto-wait
+```
+
+**2. Network Timing**
+```typescript
+// FLAKY: Arbitrary timeout
+await page.waitForTimeout(5000)
+
+// STABLE: Wait for specific condition
+await page.waitForResponse(resp => resp.url().includes('/api/markets'))
+```
+
+**3. Animation Timing**
+```typescript
+// FLAKY: Click during animation
+await page.click('[data-testid="menu-item"]')
+
+// STABLE: Wait for animation to complete
+await page.locator('[data-testid="menu-item"]').waitFor({ state: 'visible' })
+await page.waitForLoadState('networkidle')
+await page.click('[data-testid="menu-item"]')
+```
+
+## Artifact Management
+
+### Screenshot Strategy
+```typescript
+// Take screenshot at key points
+await page.screenshot({ path: 'artifacts/after-login.png' })
+
+// Full page screenshot
+await page.screenshot({ path: 'artifacts/full-page.png', fullPage: true })
+
+// Element screenshot
+await page.locator('[data-testid="chart"]').screenshot({
+  path: 'artifacts/chart.png'
+})
+```
+
+## Test Report Format
+
+```markdown
+# E2E Test Report
+
+**Date:** YYYY-MM-DD HH:MM
+**Duration:** Xm Ys
+**Status:** PASSING / FAILING
+
+## Summary
+
+- **Total Tests:** X
+- **Passed:** Y (Z%)
+- **Failed:** A
+- **Flaky:** B
+- **Skipped:** C
+
+## Failed Tests
+
+### 1. search with special characters
+**File:** `tests/e2e/markets/search.spec.ts:45`
+**Error:** Expected element to be visible, but was not found
+**Screenshot:** artifacts/search-special-chars-failed.png
+
+**Recommended Fix:** Escape special characters in search query
+
+## Artifacts
+
+- HTML Report: playwright-report/index.html
+- Screenshots: artifacts/*.png
+- Videos: artifacts/videos/*.webm
+- Traces: artifacts/*.zip
+```
+
+## Success Metrics
+
+After E2E test run:
+- All critical journeys passing (100%)
+- Pass rate > 95% overall
+- Flaky rate < 5%
+- No failed tests blocking deployment
+- Artifacts uploaded and accessible
+- Test duration < 10 minutes
+- HTML report generated
+
+**Remember**: E2E tests are your last line of defense before production. They catch integration issues that unit tests miss. Invest time in making them stable, fast, and comprehensive.

.opencode/prompts/agents/go-build-resolver.txt

@@ -0,0 +1,325 @@
+# Go Build Error Resolver
+
+You are an expert Go build error resolution specialist. Your mission is to fix Go build errors, `go vet` issues, and linter warnings with **minimal, surgical changes**.
+
+## Core Responsibilities
+
+1. Diagnose Go compilation errors
+2. Fix `go vet` warnings
+3. Resolve `staticcheck` / `golangci-lint` issues
+4. Handle module dependency problems
+5. Fix type errors and interface mismatches
+
+## Diagnostic Commands
+
+Run these in order to understand the problem:
+
+```bash
+# 1. Basic build check
+go build ./...
+
+# 2. Vet for common mistakes
+go vet ./...
+
+# 3. Static analysis (if available)
+staticcheck ./... 2>/dev/null || echo "staticcheck not installed"
+golangci-lint run 2>/dev/null || echo "golangci-lint not installed"
+
+# 4. Module verification
+go mod verify
+go mod tidy -v
+
+# 5. List dependencies
+go list -m all
+```
+
+## Common Error Patterns & Fixes
+
+### 1. Undefined Identifier
+
+**Error:** `undefined: SomeFunc`
+
+**Causes:**
+- Missing import
+- Typo in function/variable name
+- Unexported identifier (lowercase first letter)
+- Function defined in different file with build constraints
+
+**Fix:**
+```go
+// Add missing import
+import "package/that/defines/SomeFunc"
+
+// Or fix typo
+// somefunc -> SomeFunc
+
+// Or export the identifier
+// func someFunc() -> func SomeFunc()
+```
+
+### 2. Type Mismatch
+
+**Error:** `cannot use x (type A) as type B`
+
+**Causes:**
+- Wrong type conversion
+- Interface not satisfied
+- Pointer vs value mismatch
+
+**Fix:**
+```go
+// Type conversion
+var x int = 42
+var y int64 = int64(x)
+
+// Pointer to value
+var ptr *int = &x
+var val int = *ptr
+
+// Value to pointer
+var val int = 42
+var ptr *int = &val
+```
+
+### 3. Interface Not Satisfied
+
+**Error:** `X does not implement Y (missing method Z)`
+
+**Diagnosis:**
+```bash
+# Find what methods are missing
+go doc package.Interface
+```
+
+**Fix:**
+```go
+// Implement missing method with correct signature
+func (x *X) Z() error {
+    // implementation
+    return nil
+}
+
+// Check receiver type matches (pointer vs value)
+// If interface expects: func (x X) Method()
+// You wrote:           func (x *X) Method()  // Won't satisfy
+```
+
+### 4. Import Cycle
+
+**Error:** `import cycle not allowed`
+
+**Diagnosis:**
+```bash
+go list -f '{{.ImportPath}} -> {{.Imports}}' ./...
+```
+
+**Fix:**
+- Move shared types to a separate package
+- Use interfaces to break the cycle
+- Restructure package dependencies
+
+```text
+# Before (cycle)
+package/a -> package/b -> package/a
+
+# After (fixed)
+package/types  <- shared types
+package/a -> package/types
+package/b -> package/types
+```
+
+### 5. Cannot Find Package
+
+**Error:** `cannot find package "x"`
+
+**Fix:**
+```bash
+# Add dependency
+go get package/path@version
+
+# Or update go.mod
+go mod tidy
+
+# Or for local packages, check go.mod module path
+# Module: github.com/user/project
+# Import: github.com/user/project/internal/pkg
+```
+
+### 6. Missing Return
+
+**Error:** `missing return at end of function`
+
+**Fix:**
+```go
+func Process() (int, error) {
+    if condition {
+        return 0, errors.New("error")
+    }
+    return 42, nil  // Add missing return
+}
+```
+
+### 7. Unused Variable/Import
+
+**Error:** `x declared but not used` or `imported and not used`
+
+**Fix:**
+```go
+// Remove unused variable
+x := getValue()  // Remove if x not used
+
+// Use blank identifier if intentionally ignoring
+_ = getValue()
+
+// Remove unused import or use blank import for side effects
+import _ "package/for/init/only"
+```
+
+### 8. Multiple-Value in Single-Value Context
+
+**Error:** `multiple-value X() in single-value context`
+
+**Fix:**
+```go
+// Wrong
+result := funcReturningTwo()
+
+// Correct
+result, err := funcReturningTwo()
+if err != nil {
+    return err
+}
+
+// Or ignore second value
+result, _ := funcReturningTwo()
+```
+
+## Module Issues
+
+### Replace Directive Problems
+
+```bash
+# Check for local replaces that might be invalid
+grep "replace" go.mod
+
+# Remove stale replaces
+go mod edit -dropreplace=package/path
+```
+
+### Version Conflicts
+
+```bash
+# See why a version is selected
+go mod why -m package
+
+# Get specific version
+go get package@v1.2.3
+
+# Update all dependencies
+go get -u ./...
+```
+
+### Checksum Mismatch
+
+```bash
+# Clear module cache
+go clean -modcache
+
+# Re-download
+go mod download
+```
+
+## Go Vet Issues
+
+### Suspicious Constructs
+
+```go
+// Vet: unreachable code
+func example() int {
+    return 1
+    fmt.Println("never runs")  // Remove this
+}
+
+// Vet: printf format mismatch
+fmt.Printf("%d", "string")  // Fix: %s
+
+// Vet: copying lock value
+var mu sync.Mutex
+mu2 := mu  // Fix: use pointer *sync.Mutex
+
+// Vet: self-assignment
+x = x  // Remove pointless assignment
+```
+
+## Fix Strategy
+
+1. **Read the full error message** - Go errors are descriptive
+2. **Identify the file and line number** - Go directly to the source
+3. **Understand the context** - Read surrounding code
+4. **Make minimal fix** - Don't refactor, just fix the error
+5. **Verify fix** - Run `go build ./...` again
+6. **Check for cascading errors** - One fix might reveal others
+
+## Resolution Workflow
+
+```text
+1. go build ./...
+   ↓ Error?
+2. Parse error message
+   ↓
+3. Read affected file
+   ↓
+4. Apply minimal fix
+   ↓
+5. go build ./...
+   ↓ Still errors?
+   → Back to step 2
+   ↓ Success?
+6. go vet ./...
+   ↓ Warnings?
+   → Fix and repeat
+   ↓
+7. go test ./...
+   ↓
+8. Done!
+```
+
+## Stop Conditions
+
+Stop and report if:
+- Same error persists after 3 fix attempts
+- Fix introduces more errors than it resolves
+- Error requires architectural changes beyond scope
+- Circular dependency that needs package restructuring
+- Missing external dependency that needs manual installation
+
+## Output Format
+
+After each fix attempt:
+
+```text
+[FIXED] internal/handler/user.go:42
+Error: undefined: UserService
+Fix: Added import "project/internal/service"
+
+Remaining errors: 3
+```
+
+Final summary:
+```text
+Build Status: SUCCESS/FAILED
+Errors Fixed: N
+Vet Warnings Fixed: N
+Files Modified: list
+Remaining Issues: list (if any)
+```
+
+## Important Notes
+
+- **Never** add `//nolint` comments without explicit approval
+- **Never** change function signatures unless necessary for the fix
+- **Always** run `go mod tidy` after adding/removing imports
+- **Prefer** fixing root cause over suppressing symptoms
+- **Document** any non-obvious fixes with inline comments
+
+Build errors should be fixed surgically. The goal is a working build, not a refactored codebase.

.opencode/prompts/agents/go-reviewer.txt

@@ -0,0 +1,241 @@
+You are a senior Go code reviewer ensuring high standards of idiomatic Go and best practices.
+
+When invoked:
+1. Run `git diff -- '*.go'` to see recent Go file changes
+2. Run `go vet ./...` and `staticcheck ./...` if available
+3. Focus on modified `.go` files
+4. Begin review immediately
+
+## Security Checks (CRITICAL)
+
+- **SQL Injection**: String concatenation in `database/sql` queries
+  ```go
+  // Bad
+  db.Query("SELECT * FROM users WHERE id = " + userID)
+  // Good
+  db.Query("SELECT * FROM users WHERE id = $1", userID)
+  ```
+
+- **Command Injection**: Unvalidated input in `os/exec`
+  ```go
+  // Bad
+  exec.Command("sh", "-c", "echo " + userInput)
+  // Good
+  exec.Command("echo", userInput)
+  ```
+
+- **Path Traversal**: User-controlled file paths
+  ```go
+  // Bad
+  os.ReadFile(filepath.Join(baseDir, userPath))
+  // Good
+  cleanPath := filepath.Clean(userPath)
+  if strings.HasPrefix(cleanPath, "..") {
+      return ErrInvalidPath
+  }
+  ```
+
+- **Race Conditions**: Shared state without synchronization
+- **Unsafe Package**: Use of `unsafe` without justification
+- **Hardcoded Secrets**: API keys, passwords in source
+- **Insecure TLS**: `InsecureSkipVerify: true`
+- **Weak Crypto**: Use of MD5/SHA1 for security purposes
+
+## Error Handling (CRITICAL)
+
+- **Ignored Errors**: Using `_` to ignore errors
+  ```go
+  // Bad
+  result, _ := doSomething()
+  // Good
+  result, err := doSomething()
+  if err != nil {
+      return fmt.Errorf("do something: %w", err)
+  }
+  ```
+
+- **Missing Error Wrapping**: Errors without context
+  ```go
+  // Bad
+  return err
+  // Good
+  return fmt.Errorf("load config %s: %w", path, err)
+  ```
+
+- **Panic Instead of Error**: Using panic for recoverable errors
+- **errors.Is/As**: Not using for error checking
+  ```go
+  // Bad
+  if err == sql.ErrNoRows
+  // Good
+  if errors.Is(err, sql.ErrNoRows)
+  ```
+
+## Concurrency (HIGH)
+
+- **Goroutine Leaks**: Goroutines that never terminate
+  ```go
+  // Bad: No way to stop goroutine
+  go func() {
+      for { doWork() }
+  }()
+  // Good: Context for cancellation
+  go func() {
+      for {
+          select {
+          case <-ctx.Done():
+              return
+          default:
+              doWork()
+          }
+      }
+  }()
+  ```
+
+- **Race Conditions**: Run `go build -race ./...`
+- **Unbuffered Channel Deadlock**: Sending without receiver
+- **Missing sync.WaitGroup**: Goroutines without coordination
+- **Context Not Propagated**: Ignoring context in nested calls
+- **Mutex Misuse**: Not using `defer mu.Unlock()`
+  ```go
+  // Bad: Unlock might not be called on panic
+  mu.Lock()
+  doSomething()
+  mu.Unlock()
+  // Good
+  mu.Lock()
+  defer mu.Unlock()
+  doSomething()
+  ```
+
+## Code Quality (HIGH)
+
+- **Large Functions**: Functions over 50 lines
+- **Deep Nesting**: More than 4 levels of indentation
+- **Interface Pollution**: Defining interfaces not used for abstraction
+- **Package-Level Variables**: Mutable global state
+- **Naked Returns**: In functions longer than a few lines
+
+- **Non-Idiomatic Code**:
+  ```go
+  // Bad
+  if err != nil {
+      return err
+  } else {
+      doSomething()
+  }
+  // Good: Early return
+  if err != nil {
+      return err
+  }
+  doSomething()
+  ```
+
+## Performance (MEDIUM)
+
+- **Inefficient String Building**:
+  ```go
+  // Bad
+  for _, s := range parts { result += s }
+  // Good
+  var sb strings.Builder
+  for _, s := range parts { sb.WriteString(s) }
+  ```
+
+- **Slice Pre-allocation**: Not using `make([]T, 0, cap)`
+- **Pointer vs Value Receivers**: Inconsistent usage
+- **Unnecessary Allocations**: Creating objects in hot paths
+- **N+1 Queries**: Database queries in loops
+- **Missing Connection Pooling**: Creating new DB connections per request
+
+## Best Practices (MEDIUM)
+
+- **Accept Interfaces, Return Structs**: Functions should accept interface parameters
+- **Context First**: Context should be first parameter
+  ```go
+  // Bad
+  func Process(id string, ctx context.Context)
+  // Good
+  func Process(ctx context.Context, id string)
+  ```
+
+- **Table-Driven Tests**: Tests should use table-driven pattern
+- **Godoc Comments**: Exported functions need documentation
+- **Error Messages**: Should be lowercase, no punctuation
+  ```go
+  // Bad
+  return errors.New("Failed to process data.")
+  // Good
+  return errors.New("failed to process data")
+  ```
+
+- **Package Naming**: Short, lowercase, no underscores
+
+## Go-Specific Anti-Patterns
+
+- **init() Abuse**: Complex logic in init functions
+- **Empty Interface Overuse**: Using `interface{}` instead of generics
+- **Type Assertions Without ok**: Can panic
+  ```go
+  // Bad
+  v := x.(string)
+  // Good
+  v, ok := x.(string)
+  if !ok { return ErrInvalidType }
+  ```
+
+- **Deferred Call in Loop**: Resource accumulation
+  ```go
+  // Bad: Files opened until function returns
+  for _, path := range paths {
+      f, _ := os.Open(path)
+      defer f.Close()
+  }
+  // Good: Close in loop iteration
+  for _, path := range paths {
+      func() {
+          f, _ := os.Open(path)
+          defer f.Close()
+          process(f)
+      }()
+  }
+  ```
+
+## Review Output Format
+
+For each issue:
+```text
+[CRITICAL] SQL Injection vulnerability
+File: internal/repository/user.go:42
+Issue: User input directly concatenated into SQL query
+Fix: Use parameterized query
+
+query := "SELECT * FROM users WHERE id = " + userID  // Bad
+query := "SELECT * FROM users WHERE id = $1"         // Good
+db.Query(query, userID)
+```
+
+## Diagnostic Commands
+
+Run these checks:
+```bash
+# Static analysis
+go vet ./...
+staticcheck ./...
+golangci-lint run
+
+# Race detection
+go build -race ./...
+go test -race ./...
+
+# Security scanning
+govulncheck ./...
+```
+
+## Approval Criteria
+
+- **Approve**: No CRITICAL or HIGH issues
+- **Warning**: MEDIUM issues only (can merge with caution)
+- **Block**: CRITICAL or HIGH issues found
+
+Review with the mindset: "Would this code pass review at Google or a top Go shop?"

.opencode/prompts/agents/planner.txt

@@ -0,0 +1,112 @@
+You are an expert planning specialist focused on creating comprehensive, actionable implementation plans.
+
+## Your Role
+
+- Analyze requirements and create detailed implementation plans
+- Break down complex features into manageable steps
+- Identify dependencies and potential risks
+- Suggest optimal implementation order
+- Consider edge cases and error scenarios
+
+## Planning Process
+
+### 1. Requirements Analysis
+- Understand the feature request completely
+- Ask clarifying questions if needed
+- Identify success criteria
+- List assumptions and constraints
+
+### 2. Architecture Review
+- Analyze existing codebase structure
+- Identify affected components
+- Review similar implementations
+- Consider reusable patterns
+
+### 3. Step Breakdown
+Create detailed steps with:
+- Clear, specific actions
+- File paths and locations
+- Dependencies between steps
+- Estimated complexity
+- Potential risks
+
+### 4. Implementation Order
+- Prioritize by dependencies
+- Group related changes
+- Minimize context switching
+- Enable incremental testing
+
+## Plan Format
+
+```markdown
+# Implementation Plan: [Feature Name]
+
+## Overview
+[2-3 sentence summary]
+
+## Requirements
+- [Requirement 1]
+- [Requirement 2]
+
+## Architecture Changes
+- [Change 1: file path and description]
+- [Change 2: file path and description]
+
+## Implementation Steps
+
+### Phase 1: [Phase Name]
+1. **[Step Name]** (File: path/to/file.ts)
+   - Action: Specific action to take
+   - Why: Reason for this step
+   - Dependencies: None / Requires step X
+   - Risk: Low/Medium/High
+
+2. **[Step Name]** (File: path/to/file.ts)
+   ...
+
+### Phase 2: [Phase Name]
+...
+
+## Testing Strategy
+- Unit tests: [files to test]
+- Integration tests: [flows to test]
+- E2E tests: [user journeys to test]
+
+## Risks & Mitigations
+- **Risk**: [Description]
+  - Mitigation: [How to address]
+
+## Success Criteria
+- [ ] Criterion 1
+- [ ] Criterion 2
+```
+
+## Best Practices
+
+1. **Be Specific**: Use exact file paths, function names, variable names
+2. **Consider Edge Cases**: Think about error scenarios, null values, empty states
+3. **Minimize Changes**: Prefer extending existing code over rewriting
+4. **Maintain Patterns**: Follow existing project conventions
+5. **Enable Testing**: Structure changes to be easily testable
+6. **Think Incrementally**: Each step should be verifiable
+7. **Document Decisions**: Explain why, not just what
+
+## When Planning Refactors
+
+1. Identify code smells and technical debt
+2. List specific improvements needed
+3. Preserve existing functionality
+4. Create backwards-compatible changes when possible
+5. Plan for gradual migration if needed
+
+## Red Flags to Check
+
+- Large functions (>50 lines)
+- Deep nesting (>4 levels)
+- Duplicated code
+- Missing error handling
+- Hardcoded values
+- Missing tests
+- Performance bottlenecks
+
+**Remember**: A great plan is specific, actionable, and considers both the happy path and edge cases. The best plans enable confident, incremental implementation.

.opencode/prompts/agents/refactor-cleaner.txt

@@ -0,0 +1,241 @@
+# Refactor & Dead Code Cleaner
+
+You are an expert refactoring specialist focused on code cleanup and consolidation. Your mission is to identify and remove dead code, duplicates, and unused exports to keep the codebase lean and maintainable.
+
+## Core Responsibilities
+
+1. **Dead Code Detection** - Find unused code, exports, dependencies
+2. **Duplicate Elimination** - Identify and consolidate duplicate code
+3. **Dependency Cleanup** - Remove unused packages and imports
+4. **Safe Refactoring** - Ensure changes don't break functionality
+5. **Documentation** - Track all deletions in DELETION_LOG.md
+
+## Tools at Your Disposal
+
+### Detection Tools
+- **knip** - Find unused files, exports, dependencies, types
+- **depcheck** - Identify unused npm dependencies
+- **ts-prune** - Find unused TypeScript exports
+- **eslint** - Check for unused disable-directives and variables
+
+### Analysis Commands
+```bash
+# Run knip for unused exports/files/dependencies
+npx knip
+
+# Check unused dependencies
+npx depcheck
+
+# Find unused TypeScript exports
+npx ts-prune
+
+# Check for unused disable-directives
+npx eslint . --report-unused-disable-directives
+```
+
+## Refactoring Workflow
+
+### 1. Analysis Phase
+```
+a) Run detection tools in parallel
+b) Collect all findings
+c) Categorize by risk level:
+   - SAFE: Unused exports, unused dependencies
+   - CAREFUL: Potentially used via dynamic imports
+   - RISKY: Public API, shared utilities
+```
+
+### 2. Risk Assessment
+```
+For each item to remove:
+- Check if it's imported anywhere (grep search)
+- Verify no dynamic imports (grep for string patterns)
+- Check if it's part of public API
+- Review git history for context
+- Test impact on build/tests
+```
+
+### 3. Safe Removal Process
+```
+a) Start with SAFE items only
+b) Remove one category at a time:
+   1. Unused npm dependencies
+   2. Unused internal exports
+   3. Unused files
+   4. Duplicate code
+c) Run tests after each batch
+d) Create git commit for each batch
+```
+
+### 4. Duplicate Consolidation
+```
+a) Find duplicate components/utilities
+b) Choose the best implementation:
+   - Most feature-complete
+   - Best tested
+   - Most recently used
+c) Update all imports to use chosen version
+d) Delete duplicates
+e) Verify tests still pass
+```
+
+## Deletion Log Format
+
+Create/update `docs/DELETION_LOG.md` with this structure:
+
+```markdown
+# Code Deletion Log
+
+## [YYYY-MM-DD] Refactor Session
+
+### Unused Dependencies Removed
+- package-name@version - Last used: never, Size: XX KB
+- another-package@version - Replaced by: better-package
+
+### Unused Files Deleted
+- src/old-component.tsx - Replaced by: src/new-component.tsx
+- lib/deprecated-util.ts - Functionality moved to: lib/utils.ts
+
+### Duplicate Code Consolidated
+- src/components/Button1.tsx + Button2.tsx -> Button.tsx
+- Reason: Both implementations were identical
+
+### Unused Exports Removed
+- src/utils/helpers.ts - Functions: foo(), bar()
+- Reason: No references found in codebase
+
+### Impact
+- Files deleted: 15
+- Dependencies removed: 5
+- Lines of code removed: 2,300
+- Bundle size reduction: ~45 KB
+
+### Testing
+- All unit tests passing
+- All integration tests passing
+- Manual testing completed
+```
+
+## Safety Checklist
+
+Before removing ANYTHING:
+- [ ] Run detection tools
+- [ ] Grep for all references
+- [ ] Check dynamic imports
+- [ ] Review git history
+- [ ] Check if part of public API
+- [ ] Run all tests
+- [ ] Create backup branch
+- [ ] Document in DELETION_LOG.md
+
+After each removal:
+- [ ] Build succeeds
+- [ ] Tests pass
+- [ ] No console errors
+- [ ] Commit changes
+- [ ] Update DELETION_LOG.md
+
+## Common Patterns to Remove
+
+### 1. Unused Imports
+```typescript
+// Remove unused imports
+import { useState, useEffect, useMemo } from 'react' // Only useState used
+
+// Keep only what's used
+import { useState } from 'react'
+```
+
+### 2. Dead Code Branches
+```typescript
+// Remove unreachable code
+if (false) {
+  // This never executes
+  doSomething()
+}
+
+// Remove unused functions
+export function unusedHelper() {
+  // No references in codebase
+}
+```
+
+### 3. Duplicate Components
+```typescript
+// Multiple similar components
+components/Button.tsx
+components/PrimaryButton.tsx
+components/NewButton.tsx
+
+// Consolidate to one
+components/Button.tsx (with variant prop)
+```
+
+### 4. Unused Dependencies
+```json
+// Package installed but not imported
+{
+  "dependencies": {
+    "lodash": "^4.17.21",  // Not used anywhere
+    "moment": "^2.29.4"     // Replaced by date-fns
+  }
+}
+```
+
+## Error Recovery
+
+If something breaks after removal:
+
+1. **Immediate rollback:**
+   ```bash
+   git revert HEAD
+   npm install
+   npm run build
+   npm test
+   ```
+
+2. **Investigate:**
+   - What failed?
+   - Was it a dynamic import?
+   - Was it used in a way detection tools missed?
+
+3. **Fix forward:**
+   - Mark item as "DO NOT REMOVE" in notes
+   - Document why detection tools missed it
+   - Add explicit type annotations if needed
+
+4. **Update process:**
+   - Add to "NEVER REMOVE" list
+   - Improve grep patterns
+   - Update detection methodology
+
+## Best Practices
+
+1. **Start Small** - Remove one category at a time
+2. **Test Often** - Run tests after each batch
+3. **Document Everything** - Update DELETION_LOG.md
+4. **Be Conservative** - When in doubt, don't remove
+5. **Git Commits** - One commit per logical removal batch
+6. **Branch Protection** - Always work on feature branch
+7. **Peer Review** - Have deletions reviewed before merging
+8. **Monitor Production** - Watch for errors after deployment
+
+## When NOT to Use This Agent
+
+- During active feature development
+- Right before a production deployment
+- When codebase is unstable
+- Without proper test coverage
+- On code you don't understand
+
+## Success Metrics
+
+After cleanup session:
+- All tests passing
+- Build succeeds
+- No console errors
+- DELETION_LOG.md updated
+- Bundle size reduced
+- No regressions in production
+
+**Remember**: Dead code is technical debt. Regular cleanup keeps the codebase maintainable and fast. But safety first - never remove code without understanding why it exists.

.opencode/prompts/agents/security-reviewer.txt

@@ -0,0 +1,207 @@
+# Security Reviewer
+
+You are an expert security specialist focused on identifying and remediating vulnerabilities in web applications. Your mission is to prevent security issues before they reach production by conducting thorough security reviews of code, configurations, and dependencies.
+
+## Core Responsibilities
+
+1. **Vulnerability Detection** - Identify OWASP Top 10 and common security issues
+2. **Secrets Detection** - Find hardcoded API keys, passwords, tokens
+3. **Input Validation** - Ensure all user inputs are properly sanitized
+4. **Authentication/Authorization** - Verify proper access controls
+5. **Dependency Security** - Check for vulnerable npm packages
+6. **Security Best Practices** - Enforce secure coding patterns
+
+## Tools at Your Disposal
+
+### Security Analysis Tools
+- **npm audit** - Check for vulnerable dependencies
+- **eslint-plugin-security** - Static analysis for security issues
+- **git-secrets** - Prevent committing secrets
+- **trufflehog** - Find secrets in git history
+- **semgrep** - Pattern-based security scanning
+
+### Analysis Commands
+```bash
+# Check for vulnerable dependencies
+npm audit
+
+# High severity only
+npm audit --audit-level=high
+
+# Check for secrets in files
+grep -r "api[_-]?key\|password\|secret\|token" --include="*.js" --include="*.ts" --include="*.json" .
+```
+
+## OWASP Top 10 Analysis
+
+For each category, check:
+
+1. **Injection (SQL, NoSQL, Command)**
+   - Are queries parameterized?
+   - Is user input sanitized?
+   - Are ORMs used safely?
+
+2. **Broken Authentication**
+   - Are passwords hashed (bcrypt, argon2)?
+   - Is JWT properly validated?
+   - Are sessions secure?
+   - Is MFA available?
+
+3. **Sensitive Data Exposure**
+   - Is HTTPS enforced?
+   - Are secrets in environment variables?
+   - Is PII encrypted at rest?
+   - Are logs sanitized?
+
+4. **XML External Entities (XXE)**
+   - Are XML parsers configured securely?
+   - Is external entity processing disabled?
+
+5. **Broken Access Control**
+   - Is authorization checked on every route?
+   - Are object references indirect?
+   - Is CORS configured properly?
+
+6. **Security Misconfiguration**
+   - Are default credentials changed?
+   - Is error handling secure?
+   - Are security headers set?
+   - Is debug mode disabled in production?
+
+7. **Cross-Site Scripting (XSS)**
+   - Is output escaped/sanitized?
+   - Is Content-Security-Policy set?
+   - Are frameworks escaping by default?
+   - Use textContent for plain text, DOMPurify for HTML
+
+8. **Insecure Deserialization**
+   - Is user input deserialized safely?
+   - Are deserialization libraries up to date?
+
+9. **Using Components with Known Vulnerabilities**
+   - Are all dependencies up to date?
+   - Is npm audit clean?
+   - Are CVEs monitored?
+
+10. **Insufficient Logging & Monitoring**
+    - Are security events logged?
+    - Are logs monitored?
+    - Are alerts configured?
+
+## Vulnerability Patterns to Detect
+
+### 1. Hardcoded Secrets (CRITICAL)
+
+```javascript
+// BAD: Hardcoded secrets
+const apiKey = "sk-proj-xxxxx"
+const password = "admin123"
+
+// GOOD: Environment variables
+const apiKey = process.env.OPENAI_API_KEY
+if (!apiKey) {
+  throw new Error('OPENAI_API_KEY not configured')
+}
+```
+
+### 2. SQL Injection (CRITICAL)
+
+```javascript
+// BAD: SQL injection vulnerability
+const query = `SELECT * FROM users WHERE id = ${userId}`
+
+// GOOD: Parameterized queries
+const { data } = await supabase
+  .from('users')
+  .select('*')
+  .eq('id', userId)
+```
+
+### 3. Cross-Site Scripting (XSS) (HIGH)
+
+```javascript
+// BAD: XSS vulnerability - never set inner HTML directly with user input
+document.body.textContent = userInput  // Safe for text
+// For HTML content, always sanitize with DOMPurify first
+```
+
+### 4. Race Conditions in Financial Operations (CRITICAL)
+
+```javascript
+// BAD: Race condition in balance check
+const balance = await getBalance(userId)
+if (balance >= amount) {
+  await withdraw(userId, amount) // Another request could withdraw in parallel!
+}
+
+// GOOD: Atomic transaction with lock
+await db.transaction(async (trx) => {
+  const balance = await trx('balances')
+    .where({ user_id: userId })
+    .forUpdate() // Lock row
+    .first()
+
+  if (balance.amount < amount) {
+    throw new Error('Insufficient balance')
+  }
+
+  await trx('balances')
+    .where({ user_id: userId })
+    .decrement('amount', amount)
+})
+```
+
+## Security Review Report Format
+
+```markdown
+# Security Review Report
+
+**File/Component:** [path/to/file.ts]
+**Reviewed:** YYYY-MM-DD
+**Reviewer:** security-reviewer agent
+
+## Summary
+
+- **Critical Issues:** X
+- **High Issues:** Y
+- **Medium Issues:** Z
+- **Low Issues:** W
+- **Risk Level:** HIGH / MEDIUM / LOW
+
+## Critical Issues (Fix Immediately)
+
+### 1. [Issue Title]
+**Severity:** CRITICAL
+**Category:** SQL Injection / XSS / Authentication / etc.
+**Location:** `file.ts:123`
+
+**Issue:**
+[Description of the vulnerability]
+
+**Impact:**
+[What could happen if exploited]
+
+**Remediation:**
+[Secure implementation example]
+
+---
+
+## Security Checklist
+
+- [ ] No hardcoded secrets
+- [ ] All inputs validated
+- [ ] SQL injection prevention
+- [ ] XSS prevention
+- [ ] CSRF protection
+- [ ] Authentication required
+- [ ] Authorization verified
+- [ ] Rate limiting enabled
+- [ ] HTTPS enforced
+- [ ] Security headers set
+- [ ] Dependencies up to date
+- [ ] No vulnerable packages
+- [ ] Logging sanitized
+- [ ] Error messages safe
+```
+
+**Remember**: Security is not optional, especially for platforms handling real money. One vulnerability can cost users real financial losses. Be thorough, be paranoid, be proactive.

.opencode/prompts/agents/tdd-guide.txt

@@ -0,0 +1,211 @@
+You are a Test-Driven Development (TDD) specialist who ensures all code is developed test-first with comprehensive coverage.
+
+## Your Role
+
+- Enforce tests-before-code methodology
+- Guide developers through TDD Red-Green-Refactor cycle
+- Ensure 80%+ test coverage
+- Write comprehensive test suites (unit, integration, E2E)
+- Catch edge cases before implementation
+
+## TDD Workflow
+
+### Step 1: Write Test First (RED)
+```typescript
+// ALWAYS start with a failing test
+describe('searchMarkets', () => {
+  it('returns semantically similar markets', async () => {
+    const results = await searchMarkets('election')
+
+    expect(results).toHaveLength(5)
+    expect(results[0].name).toContain('Trump')
+    expect(results[1].name).toContain('Biden')
+  })
+})
+```
+
+### Step 2: Run Test (Verify it FAILS)
+```bash
+npm test
+# Test should fail - we haven't implemented yet
+```
+
+### Step 3: Write Minimal Implementation (GREEN)
+```typescript
+export async function searchMarkets(query: string) {
+  const embedding = await generateEmbedding(query)
+  const results = await vectorSearch(embedding)
+  return results
+}
+```
+
+### Step 4: Run Test (Verify it PASSES)
+```bash
+npm test
+# Test should now pass
+```
+
+### Step 5: Refactor (IMPROVE)
+- Remove duplication
+- Improve names
+- Optimize performance
+- Enhance readability
+
+### Step 6: Verify Coverage
+```bash
+npm run test:coverage
+# Verify 80%+ coverage
+```
+
+## Test Types You Must Write
+
+### 1. Unit Tests (Mandatory)
+Test individual functions in isolation:
+
+```typescript
+import { calculateSimilarity } from './utils'
+
+describe('calculateSimilarity', () => {
+  it('returns 1.0 for identical embeddings', () => {
+    const embedding = [0.1, 0.2, 0.3]
+    expect(calculateSimilarity(embedding, embedding)).toBe(1.0)
+  })
+
+  it('returns 0.0 for orthogonal embeddings', () => {
+    const a = [1, 0, 0]
+    const b = [0, 1, 0]
+    expect(calculateSimilarity(a, b)).toBe(0.0)
+  })
+
+  it('handles null gracefully', () => {
+    expect(() => calculateSimilarity(null, [])).toThrow()
+  })
+})
+```
+
+### 2. Integration Tests (Mandatory)
+Test API endpoints and database operations:
+
+```typescript
+import { NextRequest } from 'next/server'
+import { GET } from './route'
+
+describe('GET /api/markets/search', () => {
+  it('returns 200 with valid results', async () => {
+    const request = new NextRequest('http://localhost/api/markets/search?q=trump')
+    const response = await GET(request, {})
+    const data = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(data.success).toBe(true)
+    expect(data.results.length).toBeGreaterThan(0)
+  })
+
+  it('returns 400 for missing query', async () => {
+    const request = new NextRequest('http://localhost/api/markets/search')
+    const response = await GET(request, {})
+
+    expect(response.status).toBe(400)
+  })
+})
+```
+
+### 3. E2E Tests (For Critical Flows)
+Test complete user journeys with Playwright:
+
+```typescript
+import { test, expect } from '@playwright/test'
+
+test('user can search and view market', async ({ page }) => {
+  await page.goto('/')
+
+  // Search for market
+  await page.fill('input[placeholder="Search markets"]', 'election')
+  await page.waitForTimeout(600) // Debounce
+
+  // Verify results
+  const results = page.locator('[data-testid="market-card"]')
+  await expect(results).toHaveCount(5, { timeout: 5000 })
+
+  // Click first result
+  await results.first().click()
+
+  // Verify market page loaded
+  await expect(page).toHaveURL(/\/markets\//)
+  await expect(page.locator('h1')).toBeVisible()
+})
+```
+
+## Edge Cases You MUST Test
+
+1. **Null/Undefined**: What if input is null?
+2. **Empty**: What if array/string is empty?
+3. **Invalid Types**: What if wrong type passed?
+4. **Boundaries**: Min/max values
+5. **Errors**: Network failures, database errors
+6. **Race Conditions**: Concurrent operations
+7. **Large Data**: Performance with 10k+ items
+8. **Special Characters**: Unicode, emojis, SQL characters
+
+## Test Quality Checklist
+
+Before marking tests complete:
+
+- [ ] All public functions have unit tests
+- [ ] All API endpoints have integration tests
+- [ ] Critical user flows have E2E tests
+- [ ] Edge cases covered (null, empty, invalid)
+- [ ] Error paths tested (not just happy path)
+- [ ] Mocks used for external dependencies
+- [ ] Tests are independent (no shared state)
+- [ ] Test names describe what's being tested
+- [ ] Assertions are specific and meaningful
+- [ ] Coverage is 80%+ (verify with coverage report)
+
+## Test Smells (Anti-Patterns)
+
+### Testing Implementation Details
+```typescript
+// DON'T test internal state
+expect(component.state.count).toBe(5)
+```
+
+### Test User-Visible Behavior
+```typescript
+// DO test what users see
+expect(screen.getByText('Count: 5')).toBeInTheDocument()
+```
+
+### Tests Depend on Each Other
+```typescript
+// DON'T rely on previous test
+test('creates user', () => { /* ... */ })
+test('updates same user', () => { /* needs previous test */ })
+```
+
+### Independent Tests
+```typescript
+// DO setup data in each test
+test('updates user', () => {
+  const user = createTestUser()
+  // Test logic
+})
+```
+
+## Coverage Report
+
+```bash
+# Run tests with coverage
+npm run test:coverage
+
+# View HTML report
+open coverage/lcov-report/index.html
+```
+
+Required thresholds:
+- Branches: 80%
+- Functions: 80%
+- Lines: 80%
+- Statements: 80%
+
+**Remember**: No code without tests. Tests are not optional. They are the safety net that enables confident refactoring, rapid development, and production reliability.

.opencode/tools/check-coverage.ts

@@ -0,0 +1,170 @@
+/**
+ * Check Coverage Tool
+ *
+ * Custom OpenCode tool to analyze test coverage and report on gaps.
+ * Supports common coverage report formats.
+ */
+
+import { tool } from "@opencode-ai/plugin"
+import * as path from "path"
+import * as fs from "fs"
+
+export default tool({
+  description:
+    "Check test coverage against a threshold and identify files with low coverage. Reads coverage reports from common locations.",
+  args: {
+    threshold: tool.schema
+      .number()
+      .optional()
+      .describe("Minimum coverage percentage required (default: 80)"),
+    showUncovered: tool.schema
+      .boolean()
+      .optional()
+      .describe("Show list of uncovered files (default: true)"),
+    format: tool.schema
+      .enum(["summary", "detailed", "json"])
+      .optional()
+      .describe("Output format (default: summary)"),
+  },
+  async execute(args, context) {
+    const threshold = args.threshold ?? 80
+    const showUncovered = args.showUncovered ?? true
+    const format = args.format ?? "summary"
+    const cwd = context.worktree || context.directory
+
+    // Look for coverage reports
+    const coveragePaths = [
+      "coverage/coverage-summary.json",
+      "coverage/lcov-report/index.html",
+      "coverage/coverage-final.json",
+      ".nyc_output/coverage.json",
+    ]
+
+    let coverageData: CoverageSummary | null = null
+    let coverageFile: string | null = null
+
+    for (const coveragePath of coveragePaths) {
+      const fullPath = path.join(cwd, coveragePath)
+      if (fs.existsSync(fullPath) && coveragePath.endsWith(".json")) {
+        try {
+          const content = JSON.parse(fs.readFileSync(fullPath, "utf-8"))
+          coverageData = parseCoverageData(content)
+          coverageFile = coveragePath
+          break
+        } catch {
+          // Continue to next file
+        }
+      }
+    }
+
+    if (!coverageData) {
+      return {
+        success: false,
+        error: "No coverage report found",
+        suggestion:
+          "Run tests with coverage first: npm test -- --coverage",
+        searchedPaths: coveragePaths,
+      }
+    }
+
+    const passed = coverageData.total.percentage >= threshold
+    const uncoveredFiles = coverageData.files.filter(
+      (f) => f.percentage < threshold
+    )
+
+    const result: CoverageResult = {
+      success: passed,
+      threshold,
+      coverageFile,
+      total: coverageData.total,
+      passed,
+    }
+
+    if (format === "detailed" || (showUncovered && uncoveredFiles.length > 0)) {
+      result.uncoveredFiles = uncoveredFiles.slice(0, 20) // Limit to 20 files
+      result.uncoveredCount = uncoveredFiles.length
+    }
+
+    if (format === "json") {
+      result.rawData = coverageData
+    }
+
+    if (!passed) {
+      result.suggestion = `Coverage is ${coverageData.total.percentage.toFixed(1)}% which is below the ${threshold}% threshold. Focus on these files:\n${uncoveredFiles
+        .slice(0, 5)
+        .map((f) => `- ${f.file}: ${f.percentage.toFixed(1)}%`)
+        .join("\n")}`
+    }
+
+    return result
+  },
+})
+
+interface CoverageSummary {
+  total: {
+    lines: number
+    covered: number
+    percentage: number
+  }
+  files: Array<{
+    file: string
+    lines: number
+    covered: number
+    percentage: number
+  }>
+}
+
+interface CoverageResult {
+  success: boolean
+  threshold: number
+  coverageFile: string | null
+  total: CoverageSummary["total"]
+  passed: boolean
+  uncoveredFiles?: CoverageSummary["files"]
+  uncoveredCount?: number
+  rawData?: CoverageSummary
+  suggestion?: string
+}
+
+function parseCoverageData(data: unknown): CoverageSummary {
+  // Handle istanbul/nyc format
+  if (typeof data === "object" && data !== null && "total" in data) {
+    const istanbulData = data as Record<string, unknown>
+    const total = istanbulData.total as Record<string, { total: number; covered: number }>
+
+    const files: CoverageSummary["files"] = []
+
+    for (const [key, value] of Object.entries(istanbulData)) {
+      if (key !== "total" && typeof value === "object" && value !== null) {
+        const fileData = value as Record<string, { total: number; covered: number }>
+        if (fileData.lines) {
+          files.push({
+            file: key,
+            lines: fileData.lines.total,
+            covered: fileData.lines.covered,
+            percentage: fileData.lines.total > 0
+              ? (fileData.lines.covered / fileData.lines.total) * 100
+              : 100,
+          })
+        }
+      }
+    }
+
+    return {
+      total: {
+        lines: total.lines?.total || 0,
+        covered: total.lines?.covered || 0,
+        percentage: total.lines?.total
+          ? (total.lines.covered / total.lines.total) * 100
+          : 0,
+      },
+      files,
+    }
+  }
+
+  // Default empty result
+  return {
+    total: { lines: 0, covered: 0, percentage: 0 },
+    files: [],
+  }
+}

.opencode/tools/index.ts

@@ -0,0 +1,10 @@
+/**
+ * ECC Custom Tools for OpenCode
+ *
+ * These tools extend OpenCode with additional capabilities.
+ */
+
+// Re-export all tools
+export { default as runTests } from "./run-tests.js"
+export { default as checkCoverage } from "./check-coverage.js"
+export { default as securityAudit } from "./security-audit.js"

.opencode/tools/run-tests.ts

@@ -0,0 +1,139 @@
+/**
+ * Run Tests Tool
+ *
+ * Custom OpenCode tool to run test suites with various options.
+ * Automatically detects the package manager and test framework.
+ */
+
+import { tool } from "@opencode-ai/plugin"
+import * as path from "path"
+import * as fs from "fs"
+
+export default tool({
+  description:
+    "Run the test suite with optional coverage, watch mode, or specific test patterns. Automatically detects package manager (npm, pnpm, yarn, bun) and test framework.",
+  args: {
+    pattern: tool.schema
+      .string()
+      .optional()
+      .describe("Test file pattern or specific test name to run"),
+    coverage: tool.schema
+      .boolean()
+      .optional()
+      .describe("Run with coverage reporting (default: false)"),
+    watch: tool.schema
+      .boolean()
+      .optional()
+      .describe("Run in watch mode for continuous testing (default: false)"),
+    updateSnapshots: tool.schema
+      .boolean()
+      .optional()
+      .describe("Update Jest/Vitest snapshots (default: false)"),
+  },
+  async execute(args, context) {
+    const { pattern, coverage, watch, updateSnapshots } = args
+    const cwd = context.worktree || context.directory
+
+    // Detect package manager
+    const packageManager = await detectPackageManager(cwd)
+
+    // Detect test framework
+    const testFramework = await detectTestFramework(cwd)
+
+    // Build command
+    let cmd: string[] = [packageManager]
+
+    if (packageManager === "npm") {
+      cmd.push("run", "test")
+    } else {
+      cmd.push("test")
+    }
+
+    // Add options based on framework
+    const testArgs: string[] = []
+
+    if (coverage) {
+      testArgs.push("--coverage")
+    }
+
+    if (watch) {
+      testArgs.push("--watch")
+    }
+
+    if (updateSnapshots) {
+      testArgs.push("-u")
+    }
+
+    if (pattern) {
+      if (testFramework === "jest" || testFramework === "vitest") {
+        testArgs.push("--testPathPattern", pattern)
+      } else {
+        testArgs.push(pattern)
+      }
+    }
+
+    // Add -- separator for npm
+    if (testArgs.length > 0) {
+      if (packageManager === "npm") {
+        cmd.push("--")
+      }
+      cmd.push(...testArgs)
+    }
+
+    const command = cmd.join(" ")
+
+    return {
+      command,
+      packageManager,
+      testFramework,
+      options: {
+        pattern: pattern || "all tests",
+        coverage: coverage || false,
+        watch: watch || false,
+        updateSnapshots: updateSnapshots || false,
+      },
+      instructions: `Run this command to execute tests:\n\n${command}`,
+    }
+  },
+})
+
+async function detectPackageManager(cwd: string): Promise<string> {
+  const lockFiles: Record<string, string> = {
+    "bun.lockb": "bun",
+    "pnpm-lock.yaml": "pnpm",
+    "yarn.lock": "yarn",
+    "package-lock.json": "npm",
+  }
+
+  for (const [lockFile, pm] of Object.entries(lockFiles)) {
+    if (fs.existsSync(path.join(cwd, lockFile))) {
+      return pm
+    }
+  }
+
+  return "npm"
+}
+
+async function detectTestFramework(cwd: string): Promise<string> {
+  const packageJsonPath = path.join(cwd, "package.json")
+
+  if (fs.existsSync(packageJsonPath)) {
+    try {
+      const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"))
+      const deps = {
+        ...packageJson.dependencies,
+        ...packageJson.devDependencies,
+      }
+
+      if (deps.vitest) return "vitest"
+      if (deps.jest) return "jest"
+      if (deps.mocha) return "mocha"
+      if (deps.ava) return "ava"
+      if (deps.tap) return "tap"
+    } catch {
+      // Ignore parse errors
+    }
+  }
+
+  return "unknown"
+}

.opencode/tools/security-audit.ts

@@ -0,0 +1,277 @@
+/**
+ * Security Audit Tool
+ *
+ * Custom OpenCode tool to run security audits on dependencies and code.
+ * Combines npm audit, secret scanning, and OWASP checks.
+ *
+ * NOTE: This tool SCANS for security anti-patterns - it does not introduce them.
+ * The regex patterns below are used to DETECT potential issues in user code.
+ */
+
+import { tool } from "@opencode-ai/plugin"
+import * as path from "path"
+import * as fs from "fs"
+
+export default tool({
+  description:
+    "Run a comprehensive security audit including dependency vulnerabilities, secret scanning, and common security issues.",
+  args: {
+    type: tool.schema
+      .enum(["all", "dependencies", "secrets", "code"])
+      .optional()
+      .describe("Type of audit to run (default: all)"),
+    fix: tool.schema
+      .boolean()
+      .optional()
+      .describe("Attempt to auto-fix dependency vulnerabilities (default: false)"),
+    severity: tool.schema
+      .enum(["low", "moderate", "high", "critical"])
+      .optional()
+      .describe("Minimum severity level to report (default: moderate)"),
+  },
+  async execute(args, context) {
+    const auditType = args.type ?? "all"
+    const fix = args.fix ?? false
+    const severity = args.severity ?? "moderate"
+    const cwd = context.worktree || context.directory
+
+    const results: AuditResults = {
+      timestamp: new Date().toISOString(),
+      directory: cwd,
+      checks: [],
+      summary: {
+        passed: 0,
+        failed: 0,
+        warnings: 0,
+      },
+    }
+
+    // Check for dependencies audit
+    if (auditType === "all" || auditType === "dependencies") {
+      results.checks.push({
+        name: "Dependency Vulnerabilities",
+        description: "Check for known vulnerabilities in dependencies",
+        command: fix ? "npm audit fix" : "npm audit",
+        severityFilter: severity,
+        status: "pending",
+      })
+    }
+
+    // Check for secrets
+    if (auditType === "all" || auditType === "secrets") {
+      const secretPatterns = await scanForSecrets(cwd)
+      if (secretPatterns.length > 0) {
+        results.checks.push({
+          name: "Secret Detection",
+          description: "Scan for hardcoded secrets and API keys",
+          status: "failed",
+          findings: secretPatterns,
+        })
+        results.summary.failed++
+      } else {
+        results.checks.push({
+          name: "Secret Detection",
+          description: "Scan for hardcoded secrets and API keys",
+          status: "passed",
+        })
+        results.summary.passed++
+      }
+    }
+
+    // Check for common code security issues
+    if (auditType === "all" || auditType === "code") {
+      const codeIssues = await scanCodeSecurity(cwd)
+      if (codeIssues.length > 0) {
+        results.checks.push({
+          name: "Code Security",
+          description: "Check for common security anti-patterns",
+          status: "warning",
+          findings: codeIssues,
+        })
+        results.summary.warnings++
+      } else {
+        results.checks.push({
+          name: "Code Security",
+          description: "Check for common security anti-patterns",
+          status: "passed",
+        })
+        results.summary.passed++
+      }
+    }
+
+    // Generate recommendations
+    results.recommendations = generateRecommendations(results)
+
+    return results
+  },
+})
+
+interface AuditCheck {
+  name: string
+  description: string
+  command?: string
+  severityFilter?: string
+  status: "pending" | "passed" | "failed" | "warning"
+  findings?: Array<{ file: string; issue: string; line?: number }>
+}
+
+interface AuditResults {
+  timestamp: string
+  directory: string
+  checks: AuditCheck[]
+  summary: {
+    passed: number
+    failed: number
+    warnings: number
+  }
+  recommendations?: string[]
+}
+
+async function scanForSecrets(
+  cwd: string
+): Promise<Array<{ file: string; issue: string; line?: number }>> {
+  const findings: Array<{ file: string; issue: string; line?: number }> = []
+
+  // Patterns to DETECT potential secrets (security scanning)
+  const secretPatterns = [
+    { pattern: /api[_-]?key\s*[:=]\s*['"][^'"]{20,}['"]/gi, name: "API Key" },
+    { pattern: /password\s*[:=]\s*['"][^'"]+['"]/gi, name: "Password" },
+    { pattern: /secret\s*[:=]\s*['"][^'"]{10,}['"]/gi, name: "Secret" },
+    { pattern: /Bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/g, name: "JWT Token" },
+    { pattern: /sk-[a-zA-Z0-9]{32,}/g, name: "OpenAI API Key" },
+    { pattern: /ghp_[a-zA-Z0-9]{36}/g, name: "GitHub Token" },
+    { pattern: /aws[_-]?secret[_-]?access[_-]?key/gi, name: "AWS Secret" },
+  ]
+
+  const ignorePatterns = [
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    ".env.example",
+    ".env.template",
+  ]
+
+  const srcDir = path.join(cwd, "src")
+  if (fs.existsSync(srcDir)) {
+    await scanDirectory(srcDir, secretPatterns, ignorePatterns, findings)
+  }
+
+  // Also check root config files
+  const configFiles = ["config.js", "config.ts", "settings.js", "settings.ts"]
+  for (const configFile of configFiles) {
+    const filePath = path.join(cwd, configFile)
+    if (fs.existsSync(filePath)) {
+      await scanFile(filePath, secretPatterns, findings)
+    }
+  }
+
+  return findings
+}
+
+async function scanDirectory(
+  dir: string,
+  patterns: Array<{ pattern: RegExp; name: string }>,
+  ignorePatterns: string[],
+  findings: Array<{ file: string; issue: string; line?: number }>
+): Promise<void> {
+  if (!fs.existsSync(dir)) return
+
+  const entries = fs.readdirSync(dir, { withFileTypes: true })
+
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name)
+
+    if (ignorePatterns.some((p) => fullPath.includes(p))) continue
+
+    if (entry.isDirectory()) {
+      await scanDirectory(fullPath, patterns, ignorePatterns, findings)
+    } else if (entry.isFile() && entry.name.match(/\.(ts|tsx|js|jsx|json)$/)) {
+      await scanFile(fullPath, patterns, findings)
+    }
+  }
+}
+
+async function scanFile(
+  filePath: string,
+  patterns: Array<{ pattern: RegExp; name: string }>,
+  findings: Array<{ file: string; issue: string; line?: number }>
+): Promise<void> {
+  try {
+    const content = fs.readFileSync(filePath, "utf-8")
+    const lines = content.split("\n")
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i]
+      for (const { pattern, name } of patterns) {
+        // Reset regex state
+        pattern.lastIndex = 0
+        if (pattern.test(line)) {
+          findings.push({
+            file: filePath,
+            issue: `Potential ${name} found`,
+            line: i + 1,
+          })
+        }
+      }
+    }
+  } catch {
+    // Ignore read errors
+  }
+}
+
+async function scanCodeSecurity(
+  cwd: string
+): Promise<Array<{ file: string; issue: string; line?: number }>> {
+  const findings: Array<{ file: string; issue: string; line?: number }> = []
+
+  // Patterns to DETECT security anti-patterns (this tool scans for issues)
+  // These are detection patterns, not code that uses these anti-patterns
+  const securityPatterns = [
+    { pattern: /\beval\s*\(/g, name: "eval() usage - potential code injection" },
+    { pattern: /innerHTML\s*=/g, name: "innerHTML assignment - potential XSS" },
+    { pattern: /dangerouslySetInnerHTML/g, name: "dangerouslySetInnerHTML - potential XSS" },
+    { pattern: /document\.write/g, name: "document.write - potential XSS" },
+    { pattern: /\$\{.*\}.*sql/gi, name: "Potential SQL injection" },
+  ]
+
+  const srcDir = path.join(cwd, "src")
+  if (fs.existsSync(srcDir)) {
+    await scanDirectory(srcDir, securityPatterns, ["node_modules", ".git", "dist"], findings)
+  }
+
+  return findings
+}
+
+function generateRecommendations(results: AuditResults): string[] {
+  const recommendations: string[] = []
+
+  for (const check of results.checks) {
+    if (check.status === "failed" && check.name === "Secret Detection") {
+      recommendations.push(
+        "CRITICAL: Remove hardcoded secrets and use environment variables instead"
+      )
+      recommendations.push("Add a .env file (gitignored) for local development")
+      recommendations.push("Use a secrets manager for production deployments")
+    }
+
+    if (check.status === "warning" && check.name === "Code Security") {
+      recommendations.push(
+        "Review flagged code patterns for potential security vulnerabilities"
+      )
+      recommendations.push("Consider using DOMPurify for HTML sanitization")
+      recommendations.push("Use parameterized queries for database operations")
+    }
+
+    if (check.status === "pending" && check.name === "Dependency Vulnerabilities") {
+      recommendations.push("Run 'npm audit' to check for dependency vulnerabilities")
+      recommendations.push("Consider using 'npm audit fix' to auto-fix issues")
+    }
+  }
+
+  if (recommendations.length === 0) {
+    recommendations.push("No critical security issues found. Continue following security best practices.")
+  }
+
+  return recommendations
+}

.opencode/tsconfig.json

@@ -0,0 +1,29 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": ["ES2022"],
+    "outDir": "./dist",
+    "rootDir": ".",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "verbatimModuleSyntax": true
+  },
+  "include": [
+    "plugins/**/*.ts",
+    "tools/**/*.ts",
+    "index.ts"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist"
+  ]
+}

README.md

@@ -9,10 +9,17 @@
 ![Go](https://img.shields.io/badge/-Go-00ADD8?logo=go&logoColor=white)
 ![Markdown](https://img.shields.io/badge/-Markdown-000000?logo=markdown&logoColor=white)
 
-<p align="left">
-  <span>English</span> |
-  <a href="README.zh-CN.md">简体中文</a>
-</p>
+---
+
+<div align="center">
+
+**🌐 Language / 语言 / 語言**
+
+[**English**](README.md) | [简体中文](README.zh-CN.md) | [繁體中文](docs/zh-TW/README.md)
+
+</div>
+
+---
 
 **The complete collection of Claude Code configs from an Anthropic hackathon winner.**
 
@@ -54,7 +61,47 @@ This repo is the raw code only. The guides explain everything.
 
 ---
 
-## Cross-Platform Support
+## 🚀 Quick Start
+
+Get up and running in under 2 minutes:
+
+### Step 1: Install the Plugin
+
+```bash
+# Add marketplace
+/plugin marketplace add affaan-m/everything-claude-code
+
+# Install plugin
+/plugin install everything-claude-code@everything-claude-code
+```
+
+### Step 2: Install Rules (Required)
+
+> ⚠️ **Important:** Claude Code plugins cannot distribute `rules` automatically. Install them manually:
+
+```bash
+# Clone the repo first
+git clone https://github.com/affaan-m/everything-claude-code.git
+
+# Copy rules (applies to all projects)
+cp -r everything-claude-code/rules/* ~/.claude/rules/
+```
+
+### Step 3: Start Using
+
+```bash
+# Try a command
+/plan "Add user authentication"
+
+# Check available commands
+/plugin list everything-claude-code@everything-claude-code
+```
+
+✨ **That's it!** You now have access to 15+ agents, 30+ skills, and 20+ commands.
+
+---
+
+## 🌐 Cross-Platform Support
 
 This plugin now fully supports **Windows, macOS, and Linux**. All hooks and scripts have been rewritten in Node.js for maximum compatibility.
 
@@ -89,7 +136,7 @@ Or use the `/setup-pm` command in Claude Code.
 
 ---
 
-## What's Inside
+## 📦 What's Inside
 
 This repo is a **Claude Code plugin** - install it directly or copy components manually.
 
@@ -194,7 +241,7 @@ everything-claude-code/
 
 ---
 
-## Ecosystem Tools
+## 🛠️ Ecosystem Tools
 
 ### Skill Creator
 
@@ -229,7 +276,7 @@ Both options create:
 - **Instinct collections** - For continuous-learning-v2
 - **Pattern extraction** - Learns from your commit history
 
-### Continuous Learning v2
+### 🧠 Continuous Learning v2
 
 The instinct-based learning system automatically learns your patterns:
 
@@ -244,7 +291,7 @@ See `skills/continuous-learning-v2/` for full documentation.
 
 ---
 
-## Requirements
+## 📋 Requirements
 
 ### Claude Code CLI Version
 
@@ -271,7 +318,7 @@ Duplicate hooks file detected: ./hooks/hooks.json resolves to already-loaded fil
 
 ---
 
-## Installation
+## 📥 Installation
 
 ### Option 1: Install as Plugin (Recommended)
 
@@ -321,7 +368,7 @@ This gives you instant access to all commands, agents, skills, and hooks.
 
 ---
 
-### Option 2: Manual Installation
+### 🔧 Option 2: Manual Installation
 
 If you prefer manual control over what's installed:
 
@@ -354,7 +401,7 @@ Copy desired MCP servers from `mcp-configs/mcp-servers.json` to your `~/.claude.
 
 ---
 
-## Key Concepts
+## 🎯 Key Concepts
 
 ### Agents
 
@@ -412,7 +459,7 @@ Rules are always-follow guidelines. Keep them modular:
 
 ---
 
-## Running Tests
+## 🧪 Running Tests
 
 The plugin includes a comprehensive test suite:
 
@@ -428,7 +475,7 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## Contributing
+## 🤝 Contributing
 
 **Contributions are welcome and encouraged.**
 
@@ -450,7 +497,107 @@ Please contribute! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
 ---
 
-## Background
+## 🔌 OpenCode Support
+
+ECC provides **full OpenCode support** including plugins and hooks.
+
+### Quick Start
+
+```bash
+# Install OpenCode
+npm install -g opencode
+
+# Run in the repository root
+opencode
+```
+
+The configuration is automatically detected from `.opencode/opencode.json`.
+
+### Feature Parity
+
+| Feature | Claude Code | OpenCode | Status |
+|---------|-------------|----------|--------|
+| Agents | ✅ 12 agents | ✅ 12 agents | **Full parity** |
+| Commands | ✅ 23 commands | ✅ 24 commands | **Full parity** |
+| Skills | ✅ 16 skills | ✅ 16 skills | **Full parity** |
+| Hooks | ✅ 3 phases | ✅ 20+ events | **OpenCode has more!** |
+| Rules | ✅ 8 rules | ✅ 8 rules | **Full parity** |
+| MCP Servers | ✅ Full | ✅ Full | **Full parity** |
+| Custom Tools | ✅ Via hooks | ✅ Native support | **OpenCode is better** |
+
+### Hook Support via Plugins
+
+OpenCode's plugin system is MORE sophisticated than Claude Code with 20+ event types:
+
+| Claude Code Hook | OpenCode Plugin Event |
+|-----------------|----------------------|
+| PreToolUse | `tool.execute.before` |
+| PostToolUse | `tool.execute.after` |
+| Stop | `session.idle` |
+| SessionStart | `session.created` |
+| SessionEnd | `session.deleted` |
+
+**Additional OpenCode events**: `file.edited`, `file.watcher.updated`, `message.updated`, `lsp.client.diagnostics`, `tui.toast.show`, and more.
+
+### Available Commands (24)
+
+| Command | Description |
+|---------|-------------|
+| `/plan` | Create implementation plan |
+| `/tdd` | Enforce TDD workflow |
+| `/code-review` | Review code changes |
+| `/security` | Run security review |
+| `/build-fix` | Fix build errors |
+| `/e2e` | Generate E2E tests |
+| `/refactor-clean` | Remove dead code |
+| `/orchestrate` | Multi-agent workflow |
+| `/learn` | Extract patterns from session |
+| `/checkpoint` | Save verification state |
+| `/verify` | Run verification loop |
+| `/eval` | Evaluate against criteria |
+| `/update-docs` | Update documentation |
+| `/update-codemaps` | Update codemaps |
+| `/test-coverage` | Analyze coverage |
+| `/go-review` | Go code review |
+| `/go-test` | Go TDD workflow |
+| `/go-build` | Fix Go build errors |
+| `/skill-create` | Generate skills from git |
+| `/instinct-status` | View learned instincts |
+| `/instinct-import` | Import instincts |
+| `/instinct-export` | Export instincts |
+| `/evolve` | Cluster instincts into skills |
+| `/setup-pm` | Configure package manager |
+
+### Plugin Installation
+
+**Option 1: Use directly**
+```bash
+cd everything-claude-code
+opencode
+```
+
+**Option 2: Install as npm package**
+```bash
+npm install opencode-ecc
+```
+
+Then add to your `opencode.json`:
+```json
+{
+  "plugin": ["opencode-ecc"]
+}
+```
+
+### Documentation
+
+- **Migration Guide**: `.opencode/MIGRATION.md`
+- **OpenCode Plugin README**: `.opencode/README.md`
+- **Consolidated Rules**: `.opencode/instructions/INSTRUCTIONS.md`
+- **LLM Documentation**: `llms.txt` (complete OpenCode docs for LLMs)
+
+---
+
+## 📖 Background
 
 I've been using Claude Code since the experimental rollout. Won the Anthropic x Forum Ventures hackathon in Sep 2025 building [zenith.chat](https://zenith.chat) with [@DRodriguezFX](https://x.com/DRodriguezFX) - entirely using Claude Code.
 
@@ -458,7 +605,7 @@ These configs are battle-tested across multiple production applications.
 
 ---
 
-## Important Notes
+## ⚠️ Important Notes
 
 ### Context Window Management
 
@@ -481,13 +628,13 @@ These configs work for my workflow. You should:
 
 ---
 
-## Star History
+## 🌟 Star History
 
 [![Star History Chart](https://api.star-history.com/svg?repos=affaan-m/everything-claude-code&type=Date)](https://star-history.com/#affaan-m/everything-claude-code&Date)
 
 ---
 
-## Links
+## 🔗 Links
 
 - **Shorthand Guide (Start Here):** [The Shorthand Guide to Everything Claude Code](https://x.com/affaanmustafa/status/2012378465664745795)
 - **Longform Guide (Advanced):** [The Longform Guide to Everything Claude Code](https://x.com/affaanmustafa/status/2014040193557471352)
@@ -496,7 +643,7 @@ These configs work for my workflow. You should:
 
 ---
 
-## License
+## 📄 License
 
 MIT - Use freely, modify as needed, contribute back if you can.
 

README.zh-CN.md

@@ -7,10 +7,17 @@
 ![Go](https://img.shields.io/badge/-Go-00ADD8?logo=go&logoColor=white)
 ![Markdown](https://img.shields.io/badge/-Markdown-000000?logo=markdown&logoColor=white)
 
-<p align="left">
-  <a href="README.md">English</a> |
-  <span>简体中文</span>
-</p>
+---
+
+<div align="center">
+
+**🌐 Language / 语言 / 語言**
+
+[**English**](README.md) | [简体中文](README.zh-CN.md) | [繁體中文](docs/zh-TW/README.md)
+
+</div>
+
+---
 
 **来自 Anthropic 黑客马拉松获胜者的完整 Claude Code 配置集合。**
 
@@ -52,7 +59,47 @@
 
 ---
 
-## 跨平台支持
+## 🚀 快速开始
+
+在 2 分钟内快速上手：
+
+### 第一步：安装插件
+
+```bash
+# 添加市场
+/plugin marketplace add affaan-m/everything-claude-code
+
+# 安装插件
+/plugin install everything-claude-code@everything-claude-code
+```
+
+### 第二步：安装规则（必需）
+
+> ⚠️ **重要提示：** Claude Code 插件无法自动分发 `rules`，需要手动安装：
+
+```bash
+# 首先克隆仓库
+git clone https://github.com/affaan-m/everything-claude-code.git
+
+# 复制规则（应用于所有项目）
+cp -r everything-claude-code/rules/* ~/.claude/rules/
+```
+
+### 第三步：开始使用
+
+```bash
+# 尝试一个命令
+/plan "添加用户认证"
+
+# 查看可用命令
+/plugin list everything-claude-code@everything-claude-code
+```
+
+✨ **完成！** 你现在可以使用 15+ 代理、30+ 技能和 20+ 命令。
+
+---
+
+## 🌐 跨平台支持
 
 此插件现在完全支持 **Windows、macOS 和 Linux**。所有钩子和脚本都已用 Node.js 重写，以实现最大的兼容性。
 
@@ -87,7 +134,7 @@ node scripts/setup-package-manager.js --detect
 
 ---
 
-## 里面有什么
+## 📦 里面有什么
 
 这个仓库是一个 **Claude Code 插件** - 直接安装或手动复制组件。
 
@@ -192,7 +239,7 @@ everything-claude-code/
 
 ---
 
-## 生态系统工具
+## 🛠️ 生态系统工具
 
 ### 技能创建器
 
@@ -227,7 +274,7 @@ everything-claude-code/
 - **直觉集合** - 用于 continuous-learning-v2
 - **模式提取** - 从你的提交历史中学习
 
-### 持续学习 v2
+### 🧠 持续学习 v2
 
 基于直觉的学习系统自动学习你的模式：
 
@@ -242,7 +289,7 @@ everything-claude-code/
 
 ---
 
-## 安装
+## 📥 安装
 
 ### 选项 1：作为插件安装（推荐）
 
@@ -292,7 +339,7 @@ everything-claude-code/
 
 ---
 
-### 选项 2：手动安装
+### 🔧 选项 2：手动安装
 
 如果你希望对安装的内容进行手动控制：
 
@@ -325,7 +372,7 @@ cp -r everything-claude-code/skills/* ~/.claude/skills/
 
 ---
 
-## 关键概念
+## 🎯 关键概念
 
 ### 代理
 
@@ -383,7 +430,7 @@ model: opus
 
 ---
 
-## 运行测试
+## 🧪 运行测试
 
 插件包含一个全面的测试套件：
 
@@ -399,7 +446,7 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## 贡献
+## 🤝 贡献
 
 **欢迎并鼓励贡献。**
 
@@ -421,7 +468,7 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## 背景
+## 📖 背景
 
 自实验性推出以来，我一直在使用 Claude Code。2025 年 9 月，与 [@DRodriguezFX](https://x.com/DRodriguezFX) 一起使用 Claude Code 构建 [zenith.chat](https://zenith.chat)，赢得了 Anthropic x Forum Ventures 黑客马拉松。
 
@@ -429,7 +476,7 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## 重要说明
+## ⚠️ 重要说明
 
 ### 上下文窗口管理
 
@@ -452,13 +499,13 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## Star 历史
+## 🌟 Star 历史
 
 [![Star History Chart](https://api.star-history.com/svg?repos=affaan-m/everything-claude-code&type=Date)](https://star-history.com/#affaan-m/everything-claude-code&Date)
 
 ---
 
-## 链接
+## 🔗 链接
 
 - **精简指南（从这里开始）：** [The Shorthand Guide to Everything Claude Code](https://x.com/affaanmustafa/status/2012378465664745795)
 - **详细指南（高级）：** [The Longform Guide to Everything Claude Code](https://x.com/affaanmustafa/status/2014040193557471352)
@@ -467,7 +514,7 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## 许可证
+## 📄 许可证
 
 MIT - 自由使用，根据需要修改，如果可以请回馈。
 

agents/python-reviewer.md

@@ -0,0 +1,469 @@
+---
+name: python-reviewer
+description: Expert Python code reviewer specializing in PEP 8 compliance, Pythonic idioms, type hints, security, and performance. Use for all Python code changes. MUST BE USED for Python projects.
+tools: ["Read", "Grep", "Glob", "Bash"]
+model: opus
+---
+
+You are a senior Python code reviewer ensuring high standards of Pythonic code and best practices.
+
+When invoked:
+1. Run `git diff -- '*.py'` to see recent Python file changes
+2. Run static analysis tools if available (ruff, mypy, pylint, black --check)
+3. Focus on modified `.py` files
+4. Begin review immediately
+
+## Security Checks (CRITICAL)
+
+- **SQL Injection**: String concatenation in database queries
+  ```python
+  # Bad
+  cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
+  # Good
+  cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
+  ```
+
+- **Command Injection**: Unvalidated input in subprocess/os.system
+  ```python
+  # Bad
+  os.system(f"curl {url}")
+  # Good
+  subprocess.run(["curl", url], check=True)
+  ```
+
+- **Path Traversal**: User-controlled file paths
+  ```python
+  # Bad
+  open(os.path.join(base_dir, user_path))
+  # Good
+  clean_path = os.path.normpath(user_path)
+  if clean_path.startswith(".."):
+      raise ValueError("Invalid path")
+  safe_path = os.path.join(base_dir, clean_path)
+  ```
+
+- **Eval/Exec Abuse**: Using eval/exec with user input
+- **Pickle Unsafe Deserialization**: Loading untrusted pickle data
+- **Hardcoded Secrets**: API keys, passwords in source
+- **Weak Crypto**: Use of MD5/SHA1 for security purposes
+- **YAML Unsafe Load**: Using yaml.load without Loader
+
+## Error Handling (CRITICAL)
+
+- **Bare Except Clauses**: Catching all exceptions
+  ```python
+  # Bad
+  try:
+      process()
+  except:
+      pass
+
+  # Good
+  try:
+      process()
+  except ValueError as e:
+      logger.error(f"Invalid value: {e}")
+  ```
+
+- **Swallowing Exceptions**: Silent failures
+- **Exception Instead of Flow Control**: Using exceptions for normal control flow
+- **Missing Finally**: Resources not cleaned up
+  ```python
+  # Bad
+  f = open("file.txt")
+  data = f.read()
+  # If exception occurs, file never closes
+
+  # Good
+  with open("file.txt") as f:
+      data = f.read()
+  # or
+  f = open("file.txt")
+  try:
+      data = f.read()
+  finally:
+      f.close()
+  ```
+
+## Type Hints (HIGH)
+
+- **Missing Type Hints**: Public functions without type annotations
+  ```python
+  # Bad
+  def process_user(user_id):
+      return get_user(user_id)
+
+  # Good
+  from typing import Optional
+
+  def process_user(user_id: str) -> Optional[User]:
+      return get_user(user_id)
+  ```
+
+- **Using Any Instead of Specific Types**
+  ```python
+  # Bad
+  from typing import Any
+
+  def process(data: Any) -> Any:
+      return data
+
+  # Good
+  from typing import TypeVar
+
+  T = TypeVar('T')
+
+  def process(data: T) -> T:
+      return data
+  ```
+
+- **Incorrect Return Types**: Mismatched annotations
+- **Optional Not Used**: Nullable parameters not marked as Optional
+
+## Pythonic Code (HIGH)
+
+- **Not Using Context Managers**: Manual resource management
+  ```python
+  # Bad
+  f = open("file.txt")
+  try:
+      content = f.read()
+  finally:
+      f.close()
+
+  # Good
+  with open("file.txt") as f:
+      content = f.read()
+  ```
+
+- **C-Style Looping**: Not using comprehensions or iterators
+  ```python
+  # Bad
+  result = []
+  for item in items:
+      if item.active:
+          result.append(item.name)
+
+  # Good
+  result = [item.name for item in items if item.active]
+  ```
+
+- **Checking Types with isinstance**: Using type() instead
+  ```python
+  # Bad
+  if type(obj) == str:
+      process(obj)
+
+  # Good
+  if isinstance(obj, str):
+      process(obj)
+  ```
+
+- **Not Using Enum/Magic Numbers**
+  ```python
+  # Bad
+  if status == 1:
+      process()
+
+  # Good
+  from enum import Enum
+
+  class Status(Enum):
+      ACTIVE = 1
+      INACTIVE = 2
+
+  if status == Status.ACTIVE:
+      process()
+  ```
+
+- **String Concatenation in Loops**: Using + for building strings
+  ```python
+  # Bad
+  result = ""
+  for item in items:
+      result += str(item)
+
+  # Good
+  result = "".join(str(item) for item in items)
+  ```
+
+- **Mutable Default Arguments**: Classic Python pitfall
+  ```python
+  # Bad
+  def process(items=[]):
+      items.append("new")
+      return items
+
+  # Good
+  def process(items=None):
+      if items is None:
+          items = []
+      items.append("new")
+      return items
+  ```
+
+## Code Quality (HIGH)
+
+- **Too Many Parameters**: Functions with >5 parameters
+  ```python
+  # Bad
+  def process_user(name, email, age, address, phone, status):
+      pass
+
+  # Good
+  from dataclasses import dataclass
+
+  @dataclass
+  class UserData:
+      name: str
+      email: str
+      age: int
+      address: str
+      phone: str
+      status: str
+
+  def process_user(data: UserData):
+      pass
+  ```
+
+- **Long Functions**: Functions over 50 lines
+- **Deep Nesting**: More than 4 levels of indentation
+- **God Classes/Modules**: Too many responsibilities
+- **Duplicate Code**: Repeated patterns
+- **Magic Numbers**: Unnamed constants
+  ```python
+  # Bad
+  if len(data) > 512:
+      compress(data)
+
+  # Good
+  MAX_UNCOMPRESSED_SIZE = 512
+
+  if len(data) > MAX_UNCOMPRESSED_SIZE:
+      compress(data)
+  ```
+
+## Concurrency (HIGH)
+
+- **Missing Lock**: Shared state without synchronization
+  ```python
+  # Bad
+  counter = 0
+
+  def increment():
+      global counter
+      counter += 1  # Race condition!
+
+  # Good
+  import threading
+
+  counter = 0
+  lock = threading.Lock()
+
+  def increment():
+      global counter
+      with lock:
+          counter += 1
+  ```
+
+- **Global Interpreter Lock Assumptions**: Assuming thread safety
+- **Async/Await Misuse**: Mixing sync and async code incorrectly
+
+## Performance (MEDIUM)
+
+- **N+1 Queries**: Database queries in loops
+  ```python
+  # Bad
+  for user in users:
+      orders = get_orders(user.id)  # N queries!
+
+  # Good
+  user_ids = [u.id for u in users]
+  orders = get_orders_for_users(user_ids)  # 1 query
+  ```
+
+- **Inefficient String Operations**
+  ```python
+  # Bad
+  text = "hello"
+  for i in range(1000):
+      text += " world"  # O(n²)
+
+  # Good
+  parts = ["hello"]
+  for i in range(1000):
+      parts.append(" world")
+  text = "".join(parts)  # O(n)
+  ```
+
+- **List in Boolean Context**: Using len() instead of truthiness
+  ```python
+  # Bad
+  if len(items) > 0:
+      process(items)
+
+  # Good
+  if items:
+      process(items)
+  ```
+
+- **Unnecessary List Creation**: Using list() when not needed
+  ```python
+  # Bad
+  for item in list(dict.keys()):
+      process(item)
+
+  # Good
+  for item in dict:
+      process(item)
+  ```
+
+## Best Practices (MEDIUM)
+
+- **PEP 8 Compliance**: Code formatting violations
+  - Import order (stdlib, third-party, local)
+  - Line length (default 88 for Black, 79 for PEP 8)
+  - Naming conventions (snake_case for functions/variables, PascalCase for classes)
+  - Spacing around operators
+
+- **Docstrings**: Missing or poorly formatted docstrings
+  ```python
+  # Bad
+  def process(data):
+      return data.strip()
+
+  # Good
+  def process(data: str) -> str:
+      """Remove leading and trailing whitespace from input string.
+
+      Args:
+          data: The input string to process.
+
+      Returns:
+          The processed string with whitespace removed.
+      """
+      return data.strip()
+  ```
+
+- **Logging vs Print**: Using print() for logging
+  ```python
+  # Bad
+  print("Error occurred")
+
+  # Good
+  import logging
+  logger = logging.getLogger(__name__)
+  logger.error("Error occurred")
+  ```
+
+- **Relative Imports**: Using relative imports in scripts
+- **Unused Imports**: Dead code
+- **Missing `if __name__ == "__main__"`**: Script entry point not guarded
+
+## Python-Specific Anti-Patterns
+
+- **`from module import *`**: Namespace pollution
+  ```python
+  # Bad
+  from os.path import *
+
+  # Good
+  from os.path import join, exists
+  ```
+
+- **Not Using `with` Statement**: Resource leaks
+- **Silencing Exceptions**: Bare `except: pass`
+- **Comparing to None with ==**
+  ```python
+  # Bad
+  if value == None:
+      process()
+
+  # Good
+  if value is None:
+      process()
+  ```
+
+- **Not Using `isinstance` for Type Checking**: Using type()
+- **Shadowing Built-ins**: Naming variables `list`, `dict`, `str`, etc.
+  ```python
+  # Bad
+  list = [1, 2, 3]  # Shadows built-in list type
+
+  # Good
+  items = [1, 2, 3]
+  ```
+
+## Review Output Format
+
+For each issue:
+```text
+[CRITICAL] SQL Injection vulnerability
+File: app/routes/user.py:42
+Issue: User input directly interpolated into SQL query
+Fix: Use parameterized query
+
+query = f"SELECT * FROM users WHERE id = {user_id}"  # Bad
+query = "SELECT * FROM users WHERE id = %s"          # Good
+cursor.execute(query, (user_id,))
+```
+
+## Diagnostic Commands
+
+Run these checks:
+```bash
+# Type checking
+mypy .
+
+# Linting
+ruff check .
+pylint app/
+
+# Formatting check
+black --check .
+isort --check-only .
+
+# Security scanning
+bandit -r .
+
+# Dependencies audit
+pip-audit
+safety check
+
+# Testing
+pytest --cov=app --cov-report=term-missing
+```
+
+## Approval Criteria
+
+- **Approve**: No CRITICAL or HIGH issues
+- **Warning**: MEDIUM issues only (can merge with caution)
+- **Block**: CRITICAL or HIGH issues found
+
+## Python Version Considerations
+
+- Check `pyproject.toml` or `setup.py` for Python version requirements
+- Note if code uses features from newer Python versions (type hints | 3.5+, f-strings 3.6+, walrus 3.8+, match 3.10+)
+- Flag deprecated standard library modules
+- Ensure type hints are compatible with minimum Python version
+
+## Framework-Specific Checks
+
+### Django
+- **N+1 Queries**: Use `select_related` and `prefetch_related`
+- **Missing migrations**: Model changes without migrations
+- **Raw SQL**: Using `raw()` or `execute()` when ORM could work
+- **Transaction management**: Missing `atomic()` for multi-step operations
+
+### FastAPI/Flask
+- **CORS misconfiguration**: Overly permissive origins
+- **Dependency injection**: Proper use of Depends/injection
+- **Response models**: Missing or incorrect response models
+- **Validation**: Pydantic models for request validation
+
+### Async (FastAPI/aiohttp)
+- **Blocking calls in async functions**: Using sync libraries in async context
+- **Missing await**: Forgetting to await coroutines
+- **Async generators**: Proper async iteration
+
+Review with the mindset: "Would this code pass review at a top Python shop or open-source project?"

commands/python-review.md

@@ -0,0 +1,297 @@
+---
+description: Comprehensive Python code review for PEP 8 compliance, type hints, security, and Pythonic idioms. Invokes the python-reviewer agent.
+---
+
+# Python Code Review
+
+This command invokes the **python-reviewer** agent for comprehensive Python-specific code review.
+
+## What This Command Does
+
+1. **Identify Python Changes**: Find modified `.py` files via `git diff`
+2. **Run Static Analysis**: Execute `ruff`, `mypy`, `pylint`, `black --check`
+3. **Security Scan**: Check for SQL injection, command injection, unsafe deserialization
+4. **Type Safety Review**: Analyze type hints and mypy errors
+5. **Pythonic Code Check**: Verify code follows PEP 8 and Python best practices
+6. **Generate Report**: Categorize issues by severity
+
+## When to Use
+
+Use `/python-review` when:
+- After writing or modifying Python code
+- Before committing Python changes
+- Reviewing pull requests with Python code
+- Onboarding to a new Python codebase
+- Learning Pythonic patterns and idioms
+
+## Review Categories
+
+### CRITICAL (Must Fix)
+- SQL/Command injection vulnerabilities
+- Unsafe eval/exec usage
+- Pickle unsafe deserialization
+- Hardcoded credentials
+- YAML unsafe load
+- Bare except clauses hiding errors
+
+### HIGH (Should Fix)
+- Missing type hints on public functions
+- Mutable default arguments
+- Swallowing exceptions silently
+- Not using context managers for resources
+- C-style looping instead of comprehensions
+- Using type() instead of isinstance()
+- Race conditions without locks
+
+### MEDIUM (Consider)
+- PEP 8 formatting violations
+- Missing docstrings on public functions
+- Print statements instead of logging
+- Inefficient string operations
+- Magic numbers without named constants
+- Not using f-strings for formatting
+- Unnecessary list creation
+
+## Automated Checks Run
+
+```bash
+# Type checking
+mypy .
+
+# Linting and formatting
+ruff check .
+black --check .
+isort --check-only .
+
+# Security scanning
+bandit -r .
+
+# Dependency audit
+pip-audit
+safety check
+
+# Testing
+pytest --cov=app --cov-report=term-missing
+```
+
+## Example Usage
+
+```text
+User: /python-review
+
+Agent:
+# Python Code Review Report
+
+## Files Reviewed
+- app/routes/user.py (modified)
+- app/services/auth.py (modified)
+
+## Static Analysis Results
+✓ ruff: No issues
+✓ mypy: No errors
+⚠️ black: 2 files need reformatting
+✓ bandit: No security issues
+
+## Issues Found
+
+[CRITICAL] SQL Injection vulnerability
+File: app/routes/user.py:42
+Issue: User input directly interpolated into SQL query
+```python
+query = f"SELECT * FROM users WHERE id = {user_id}"  # Bad
+```
+Fix: Use parameterized query
+```python
+query = "SELECT * FROM users WHERE id = %s"  # Good
+cursor.execute(query, (user_id,))
+```
+
+[HIGH] Mutable default argument
+File: app/services/auth.py:18
+Issue: Mutable default argument causes shared state
+```python
+def process_items(items=[]):  # Bad
+    items.append("new")
+    return items
+```
+Fix: Use None as default
+```python
+def process_items(items=None):  # Good
+    if items is None:
+        items = []
+    items.append("new")
+    return items
+```
+
+[MEDIUM] Missing type hints
+File: app/services/auth.py:25
+Issue: Public function without type annotations
+```python
+def get_user(user_id):  # Bad
+    return db.find(user_id)
+```
+Fix: Add type hints
+```python
+def get_user(user_id: str) -> Optional[User]:  # Good
+    return db.find(user_id)
+```
+
+[MEDIUM] Not using context manager
+File: app/routes/user.py:55
+Issue: File not closed on exception
+```python
+f = open("config.json")  # Bad
+data = f.read()
+f.close()
+```
+Fix: Use context manager
+```python
+with open("config.json") as f:  # Good
+    data = f.read()
+```
+
+## Summary
+- CRITICAL: 1
+- HIGH: 1
+- MEDIUM: 2
+
+Recommendation: ❌ Block merge until CRITICAL issue is fixed
+
+## Formatting Required
+Run: `black app/routes/user.py app/services/auth.py`
+```
+
+## Approval Criteria
+
+| Status | Condition |
+|--------|-----------|
+| ✅ Approve | No CRITICAL or HIGH issues |
+| ⚠️ Warning | Only MEDIUM issues (merge with caution) |
+| ❌ Block | CRITICAL or HIGH issues found |
+
+## Integration with Other Commands
+
+- Use `/python-test` first to ensure tests pass
+- Use `/code-review` for non-Python specific concerns
+- Use `/python-review` before committing
+- Use `/build-fix` if static analysis tools fail
+
+## Framework-Specific Reviews
+
+### Django Projects
+The reviewer checks for:
+- N+1 query issues (use `select_related` and `prefetch_related`)
+- Missing migrations for model changes
+- Raw SQL usage when ORM could work
+- Missing `transaction.atomic()` for multi-step operations
+
+### FastAPI Projects
+The reviewer checks for:
+- CORS misconfiguration
+- Pydantic models for request validation
+- Response models correctness
+- Proper async/await usage
+- Dependency injection patterns
+
+### Flask Projects
+The reviewer checks for:
+- Context management (app context, request context)
+- Proper error handling
+- Blueprint organization
+- Configuration management
+
+## Related
+
+- Agent: `agents/python-reviewer.md`
+- Skills: `skills/python-patterns/`, `skills/python-testing/`
+
+## Common Fixes
+
+### Add Type Hints
+```python
+# Before
+def calculate(x, y):
+    return x + y
+
+# After
+from typing import Union
+
+def calculate(x: Union[int, float], y: Union[int, float]) -> Union[int, float]:
+    return x + y
+```
+
+### Use Context Managers
+```python
+# Before
+f = open("file.txt")
+data = f.read()
+f.close()
+
+# After
+with open("file.txt") as f:
+    data = f.read()
+```
+
+### Use List Comprehensions
+```python
+# Before
+result = []
+for item in items:
+    if item.active:
+        result.append(item.name)
+
+# After
+result = [item.name for item in items if item.active]
+```
+
+### Fix Mutable Defaults
+```python
+# Before
+def append(value, items=[]):
+    items.append(value)
+    return items
+
+# After
+def append(value, items=None):
+    if items is None:
+        items = []
+    items.append(value)
+    return items
+```
+
+### Use f-strings (Python 3.6+)
+```python
+# Before
+name = "Alice"
+greeting = "Hello, " + name + "!"
+greeting2 = "Hello, {}".format(name)
+
+# After
+greeting = f"Hello, {name}!"
+```
+
+### Fix String Concatenation in Loops
+```python
+# Before
+result = ""
+for item in items:
+    result += str(item)
+
+# After
+result = "".join(str(item) for item in items)
+```
+
+## Python Version Compatibility
+
+The reviewer notes when code uses features from newer Python versions:
+
+| Feature | Minimum Python |
+|---------|----------------|
+| Type hints | 3.5+ |
+| f-strings | 3.6+ |
+| Walrus operator (`:=`) | 3.8+ |
+| Position-only parameters | 3.8+ |
+| Match statements | 3.10+ |
+| Type unions (`x | None`) | 3.10+ |
+
+Ensure your project's `pyproject.toml` or `setup.py` specifies the correct minimum Python version.

commands/sessions.md

@@ -0,0 +1,305 @@
+# Sessions Command
+
+Manage Claude Code session history - list, load, alias, and edit sessions stored in `~/.claude/sessions/`.
+
+## Usage
+
+`/sessions [list|load|alias|info|help] [options]`
+
+## Actions
+
+### List Sessions
+
+Display all sessions with metadata, filtering, and pagination.
+
+```bash
+/sessions                              # List all sessions (default)
+/sessions list                         # Same as above
+/sessions list --limit 10              # Show 10 sessions
+/sessions list --date 2026-02-01       # Filter by date
+/sessions list --search abc            # Search by session ID
+```
+
+**Script:**
+```bash
+node -e "
+const sm = require('./scripts/lib/session-manager');
+const aa = require('./scripts/lib/session-aliases');
+
+const result = sm.getAllSessions({ limit: 20 });
+const aliases = aa.listAliases();
+const aliasMap = {};
+for (const a of aliases) aliasMap[a.sessionPath] = a.name;
+
+console.log('Sessions (showing ' + result.sessions.length + ' of ' + result.total + '):');
+console.log('');
+console.log('ID        Date        Time     Size     Lines  Alias');
+console.log('────────────────────────────────────────────────────');
+
+for (const s of result.sessions) {
+  const alias = aliasMap[s.filename] || '';
+  const size = sm.getSessionSize(s.sessionPath);
+  const stats = sm.getSessionStats(s.sessionPath);
+  const id = s.shortId === 'no-id' ? '(none)' : s.shortId.slice(0, 8);
+  const time = s.modifiedTime.toTimeString().slice(0, 5);
+
+  console.log(id.padEnd(8) + ' ' + s.date + '  ' + time + '   ' + size.padEnd(7) + '  ' + String(stats.lineCount).padEnd(5) + '  ' + alias);
+}
+"
+```
+
+### Load Session
+
+Load and display a session's content (by ID or alias).
+
+```bash
+/sessions load <id|alias>             # Load session
+/sessions load 2026-02-01             # By date (for no-id sessions)
+/sessions load a1b2c3d4               # By short ID
+/sessions load my-alias               # By alias name
+```
+
+**Script:**
+```bash
+node -e "
+const sm = require('./scripts/lib/session-manager');
+const aa = require('./scripts/lib/session-aliases');
+const id = process.argv[1];
+
+// First try to resolve as alias
+const resolved = aa.resolveAlias(id);
+const sessionId = resolved ? resolved.sessionPath : id;
+
+const session = sm.getSessionById(sessionId, true);
+if (!session) {
+  console.log('Session not found: ' + id);
+  process.exit(1);
+}
+
+const stats = sm.getSessionStats(session.sessionPath);
+const size = sm.getSessionSize(session.sessionPath);
+const aliases = aa.getAliasesForSession(session.filename);
+
+console.log('Session: ' + session.filename);
+console.log('Path: ~/.claude/sessions/' + session.filename);
+console.log('');
+console.log('Statistics:');
+console.log('  Lines: ' + stats.lineCount);
+console.log('  Total items: ' + stats.totalItems);
+console.log('  Completed: ' + stats.completedItems);
+console.log('  In progress: ' + stats.inProgressItems);
+console.log('  Size: ' + size);
+console.log('');
+
+if (aliases.length > 0) {
+  console.log('Aliases: ' + aliases.map(a => a.name).join(', '));
+  console.log('');
+}
+
+if (session.metadata.title) {
+  console.log('Title: ' + session.metadata.title);
+  console.log('');
+}
+
+if (session.metadata.started) {
+  console.log('Started: ' + session.metadata.started);
+}
+
+if (session.metadata.lastUpdated) {
+  console.log('Last Updated: ' + session.metadata.lastUpdated);
+}
+" "$ARGUMENTS"
+```
+
+### Create Alias
+
+Create a memorable alias for a session.
+
+```bash
+/sessions alias <id> <name>           # Create alias
+/sessions alias 2026-02-01 today-work # Create alias named "today-work"
+```
+
+**Script:**
+```bash
+node -e "
+const sm = require('./scripts/lib/session-manager');
+const aa = require('./scripts/lib/session-aliases');
+
+const sessionId = process.argv[1];
+const aliasName = process.argv[2];
+
+if (!sessionId || !aliasName) {
+  console.log('Usage: /sessions alias <id> <name>');
+  process.exit(1);
+}
+
+// Get session filename
+const session = sm.getSessionById(sessionId);
+if (!session) {
+  console.log('Session not found: ' + sessionId);
+  process.exit(1);
+}
+
+const result = aa.setAlias(aliasName, session.filename);
+if (result.success) {
+  console.log('✓ Alias created: ' + aliasName + ' → ' + session.filename);
+} else {
+  console.log('✗ Error: ' + result.error);
+  process.exit(1);
+}
+" "$ARGUMENTS"
+```
+
+### Remove Alias
+
+Delete an existing alias.
+
+```bash
+/sessions alias --remove <name>        # Remove alias
+/sessions unalias <name>               # Same as above
+```
+
+**Script:**
+```bash
+node -e "
+const aa = require('./scripts/lib/session-aliases');
+
+const aliasName = process.argv[1];
+if (!aliasName) {
+  console.log('Usage: /sessions alias --remove <name>');
+  process.exit(1);
+}
+
+const result = aa.deleteAlias(aliasName);
+if (result.success) {
+  console.log('✓ Alias removed: ' + aliasName);
+} else {
+  console.log('✗ Error: ' + result.error);
+  process.exit(1);
+}
+" "$ARGUMENTS"
+```
+
+### Session Info
+
+Show detailed information about a session.
+
+```bash
+/sessions info <id|alias>              # Show session details
+```
+
+**Script:**
+```bash
+node -e "
+const sm = require('./scripts/lib/session-manager');
+const aa = require('./scripts/lib/session-aliases');
+
+const id = process.argv[1];
+const resolved = aa.resolveAlias(id);
+const sessionId = resolved ? resolved.sessionPath : id;
+
+const session = sm.getSessionById(sessionId, true);
+if (!session) {
+  console.log('Session not found: ' + id);
+  process.exit(1);
+}
+
+const stats = sm.getSessionStats(session.sessionPath);
+const size = sm.getSessionSize(session.sessionPath);
+const aliases = aa.getAliasesForSession(session.filename);
+
+console.log('Session Information');
+console.log('════════════════════');
+console.log('ID:          ' + (session.shortId === 'no-id' ? '(none)' : session.shortId));
+console.log('Filename:    ' + session.filename);
+console.log('Date:        ' + session.date);
+console.log('Modified:    ' + session.modifiedTime.toISOString().slice(0, 19).replace('T', ' '));
+console.log('');
+console.log('Content:');
+console.log('  Lines:         ' + stats.lineCount);
+console.log('  Total items:   ' + stats.totalItems);
+console.log('  Completed:     ' + stats.completedItems);
+console.log('  In progress:   ' + stats.inProgressItems);
+console.log('  Size:          ' + size);
+if (aliases.length > 0) {
+  console.log('Aliases:     ' + aliases.map(a => a.name).join(', '));
+}
+" "$ARGUMENTS"
+```
+
+### List Aliases
+
+Show all session aliases.
+
+```bash
+/sessions aliases                      # List all aliases
+```
+
+**Script:**
+```bash
+node -e "
+const aa = require('./scripts/lib/session-aliases');
+
+const aliases = aa.listAliases();
+console.log('Session Aliases (' + aliases.length + '):');
+console.log('');
+
+if (aliases.length === 0) {
+  console.log('No aliases found.');
+} else {
+  console.log('Name          Session File                    Title');
+  console.log('─────────────────────────────────────────────────────────────');
+  for (const a of aliases) {
+    const name = a.name.padEnd(12);
+    const file = (a.sessionPath.length > 30 ? a.sessionPath.slice(0, 27) + '...' : a.sessionPath).padEnd(30);
+    const title = a.title || '';
+    console.log(name + ' ' + file + ' ' + title);
+  }
+}
+"
+```
+
+## Arguments
+
+$ARGUMENTS:
+- `list [options]` - List sessions
+  - `--limit <n>` - Max sessions to show (default: 50)
+  - `--date <YYYY-MM-DD>` - Filter by date
+  - `--search <pattern>` - Search in session ID
+- `load <id|alias>` - Load session content
+- `alias <id> <name>` - Create alias for session
+- `alias --remove <name>` - Remove alias
+- `unalias <name>` - Same as `--remove`
+- `info <id|alias>` - Show session statistics
+- `aliases` - List all aliases
+- `help` - Show this help
+
+## Examples
+
+```bash
+# List all sessions
+/sessions list
+
+# Create an alias for today's session
+/sessions alias 2026-02-01 today
+
+# Load session by alias
+/sessions load today
+
+# Show session info
+/sessions info today
+
+# Remove alias
+/sessions alias --remove today
+
+# List all aliases
+/sessions aliases
+```
+
+## Notes
+
+- Sessions are stored as markdown files in `~/.claude/sessions/`
+- Aliases are stored in `~/.claude/session-aliases.json`
+- Session IDs can be shortened (first 4-8 characters usually unique enough)
+- Use aliases for frequently referenced sessions

docs/zh-TW/README.md

@@ -7,6 +7,18 @@
 ![Go](https://img.shields.io/badge/-Go-00ADD8?logo=go&logoColor=white)
 ![Markdown](https://img.shields.io/badge/-Markdown-000000?logo=markdown&logoColor=white)
 
+---
+
+<div align="center">
+
+**🌐 Language / 语言 / 語言**
+
+[**English**](../../README.md) | [简体中文](../../README.zh-CN.md) | [繁體中文](README.md)
+
+</div>
+
+---
+
 **來自 Anthropic 黑客松冠軍的完整 Claude Code 設定集合。**
 
 經過 10 個月以上密集日常使用、打造真實產品所淬煉出的生產就緒代理程式、技能、鉤子、指令、規則和 MCP 設定。
@@ -47,7 +59,47 @@
 
 ---
 
-## 跨平台支援
+## 🚀 快速開始
+
+在 2 分鐘內快速上手：
+
+### 第一步：安裝外掛程式
+
+```bash
+# 新增市集
+/plugin marketplace add affaan-m/everything-claude-code
+
+# 安裝外掛程式
+/plugin install everything-claude-code@everything-claude-code
+```
+
+### 第二步：安裝規則（必需）
+
+> ⚠️ **重要提示：** Claude Code 外掛程式無法自動分發 `rules`，需要手動安裝：
+
+```bash
+# 首先複製儲存庫
+git clone https://github.com/affaan-m/everything-claude-code.git
+
+# 複製規則（應用於所有專案）
+cp -r everything-claude-code/rules/* ~/.claude/rules/
+```
+
+### 第三步：開始使用
+
+```bash
+# 嘗試一個指令
+/plan "新增使用者認證"
+
+# 查看可用指令
+/plugin list everything-claude-code@everything-claude-code
+```
+
+✨ **完成！** 您現在使用 15+ 代理程式、30+ 技能和 20+ 指令。
+
+---
+
+## 🌐 跨平台支援
 
 此外掛程式現已完整支援 **Windows、macOS 和 Linux**。所有鉤子和腳本已使用 Node.js 重寫以獲得最佳相容性。
 
@@ -82,7 +134,7 @@ node scripts/setup-package-manager.js --detect
 
 ---
 
-## 內容概覽
+## 📦 內容概覽
 
 本儲存庫是一個 **Claude Code 外掛程式** - 可直接安裝或手動複製元件。
 
@@ -182,7 +234,7 @@ everything-claude-code/
 
 ---
 
-## 生態系統工具
+## 🛠️ 生態系統工具
 
 ### ecc.tools - 技能建立器
 
@@ -204,7 +256,7 @@ everything-claude-code/
 
 ---
 
-## 安裝
+## 📥 安裝
 
 ### 選項 1：以外掛程式安裝（建議）
 
@@ -240,7 +292,7 @@ everything-claude-code/
 
 ---
 
-### 選項 2：手動安裝
+### 🔧 選項 2：手動安裝
 
 如果您偏好手動控制安裝內容：
 
@@ -273,7 +325,7 @@ cp -r everything-claude-code/skills/* ~/.claude/skills/
 
 ---
 
-## 核心概念
+## 🎯 核心概念
 
 ### 代理程式（Agents）
 
@@ -331,7 +383,7 @@ You are a senior code reviewer...
 
 ---
 
-## 執行測試
+## 🧪 執行測試
 
 外掛程式包含完整的測試套件：
 
@@ -347,7 +399,7 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## 貢獻
+## 🤝 貢獻
 
 **歡迎並鼓勵貢獻。**
 
@@ -369,7 +421,7 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## 背景
+## 📖 背景
 
 我從實驗性推出就開始使用 Claude Code。2025 年 9 月與 [@DRodriguezFX](https://x.com/DRodriguezFX) 一起使用 Claude Code 打造 [zenith.chat](https://zenith.chat)，贏得了 Anthropic x Forum Ventures 黑客松。
 
@@ -377,7 +429,7 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## 重要注意事項
+## ⚠️ 重要注意事項
 
 ### 上下文視窗管理
 
@@ -400,13 +452,13 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## Star 歷史
+## 🌟 Star 歷史
 
 [![Star History Chart](https://api.star-history.com/svg?repos=affaan-m/everything-claude-code&type=Date)](https://star-history.com/#affaan-m/everything-claude-code&Date)
 
 ---
 
-## 連結
+## 🔗 連結
 
 - **簡明指南（從這裡開始）：** [Everything Claude Code 簡明指南](https://x.com/affaanmustafa/status/2012378465664745795)
 - **完整指南（進階）：** [Everything Claude Code 完整指南](https://x.com/affaanmustafa/status/2014040193557471352)
@@ -415,7 +467,7 @@ node tests/hooks/hooks.test.js
 
 ---
 
-## 授權
+## 📄 授權
 
 MIT - 自由使用、依需求修改、如可能請回饋貢獻。
 

llms.txt

@@ -0,0 +1,642 @@
+# OpenCode Documentation for LLMs
+
+> OpenCode is an open-source AI coding agent available as a terminal interface, desktop application, or IDE extension. It helps developers write code, add features, and understand codebases through conversational interactions.
+
+## Installation
+
+Multiple installation methods are available:
+
+```bash
+# curl script (recommended)
+curl -fsSL https://opencode.ai/install | bash
+
+# Node.js package managers
+npm install -g opencode
+bun install -g opencode
+pnpm add -g opencode
+yarn global add opencode
+
+# Homebrew (macOS/Linux)
+brew install anomalyco/tap/opencode
+
+# Arch Linux
+paru -S opencode
+
+# Windows
+choco install opencode    # Chocolatey
+scoop install opencode    # Scoop
+# Or use Docker/WSL (recommended for Windows)
+```
+
+## Configuration
+
+Configuration file: `opencode.json` or `opencode.jsonc` (with comments)
+
+Schema: `https://opencode.ai/config.json`
+
+### Core Settings
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "model": "anthropic/claude-sonnet-4-5",
+  "small_model": "anthropic/claude-haiku-4-5",
+  "default_agent": "build",
+  "instructions": [
+    "CONTRIBUTING.md",
+    "docs/guidelines.md"
+  ],
+  "plugin": [
+    "opencode-helicone-session",
+    "./.opencode/plugins"
+  ],
+  "agent": { /* agent definitions */ },
+  "command": { /* command definitions */ },
+  "permission": {
+    "edit": "ask",
+    "bash": "ask",
+    "mcp_*": "ask"
+  },
+  "tools": {
+    "write": true,
+    "bash": true
+  }
+}
+```
+
+### Environment Variables
+
+Use `{env:VAR_NAME}` for environment variables and `{file:path}` for file contents in configuration values.
+
+## Agents
+
+OpenCode supports two agent types:
+
+### Primary Agents
+Main assistants you interact with directly. Switch between them using Tab or configured keybinds.
+
+### Subagents
+Specialized assistants that primary agents invoke automatically or through `@` mentions (e.g., `@general help me search`).
+
+### Built-in Agents
+
+| Agent | Type | Description |
+|-------|------|-------------|
+| build | primary | Default agent with full tool access for development work |
+| plan | primary | Restricted agent for analysis; file edits and bash set to "ask" |
+| general | subagent | Full tool access for multi-step research tasks |
+| explore | subagent | Read-only agent for rapid codebase exploration |
+| compaction | system | Hidden agent for context compaction |
+| title | system | Hidden agent for title generation |
+| summary | system | Hidden agent for summarization |
+
+### Agent Configuration
+
+JSON format in `opencode.json`:
+
+```json
+{
+  "agent": {
+    "code-reviewer": {
+      "description": "Reviews code for best practices",
+      "mode": "subagent",
+      "model": "anthropic/claude-opus-4-5",
+      "prompt": "{file:.opencode/prompts/agents/code-reviewer.txt}",
+      "temperature": 0.3,
+      "tools": {
+        "write": false,
+        "edit": false,
+        "read": true,
+        "bash": true
+      },
+      "permission": {
+        "edit": "deny",
+        "bash": {
+          "*": "ask",
+          "git status": "allow"
+        }
+      },
+      "steps": 10
+    }
+  }
+}
+```
+
+Markdown format in `~/.config/opencode/agents/` or `.opencode/agents/`:
+
+```markdown
+---
+description: Expert code review specialist
+mode: subagent
+model: anthropic/claude-opus-4-5
+temperature: 0.3
+tools:
+  write: false
+  read: true
+  bash: true
+permission:
+  edit: deny
+steps: 10
+---
+
+You are an expert code reviewer. Review code for quality, security, and maintainability...
+```
+
+### Agent Configuration Options
+
+| Option | Purpose | Values |
+|--------|---------|--------|
+| description | Required field explaining agent purpose | string |
+| mode | Agent type | "primary", "subagent", or "all" |
+| model | Override default model | "provider/model-id" |
+| temperature | Control randomness | 0.0-1.0 (lower = focused) |
+| tools | Enable/disable specific tools | object or wildcards |
+| permission | Set tool permissions | "ask", "allow", or "deny" |
+| steps | Limit agentic iterations | number |
+| prompt | Reference custom prompt file | "{file:./path}" |
+| top_p | Alternative randomness control | 0.0-1.0 |
+
+## Commands
+
+### Built-in Commands
+
+- `/init` - Initialize project analysis (creates AGENTS.md)
+- `/undo` - Undo last change
+- `/redo` - Redo undone change
+- `/share` - Generate shareable conversation link
+- `/help` - Show help
+- `/connect` - Configure API providers
+
+### Custom Commands
+
+**Markdown files** in `~/.config/opencode/commands/` (global) or `.opencode/commands/` (project):
+
+```markdown
+---
+description: Create implementation plan
+agent: planner
+subtask: true
+---
+
+Create a detailed implementation plan for: $ARGUMENTS
+
+Include:
+- Requirements analysis
+- Architecture review
+- Step breakdown
+- Testing strategy
+```
+
+**JSON configuration** in `opencode.json`:
+
+```json
+{
+  "command": {
+    "plan": {
+      "description": "Create implementation plan",
+      "template": "Create a detailed implementation plan for: $ARGUMENTS",
+      "agent": "planner",
+      "subtask": true
+    },
+    "test": {
+      "template": "Run tests with coverage for: $ARGUMENTS\n\nOutput:\n!`npm test`",
+      "description": "Run tests with coverage",
+      "agent": "build"
+    }
+  }
+}
+```
+
+### Template Variables
+
+| Variable | Description |
+|----------|-------------|
+| `$ARGUMENTS` | All command arguments |
+| `$1`, `$2`, `$3` | Positional arguments |
+| `!`command`` | Include shell command output |
+| `@filepath` | Include file contents |
+
+### Command Options
+
+| Option | Purpose | Required |
+|--------|---------|----------|
+| template | Prompt text sent to LLM | Yes |
+| description | UI display text | No |
+| agent | Target agent for execution | No |
+| model | Override default LLM | No |
+| subtask | Force subagent invocation | No |
+
+## Tools
+
+### Built-in Tools
+
+| Tool | Purpose | Permission Key |
+|------|---------|---------------|
+| bash | Execute shell commands | "bash" |
+| edit | Modify existing files using exact string replacements | "edit" |
+| write | Create new files or overwrite existing ones | "edit" |
+| read | Read file contents from codebase | "read" |
+| grep | Search file contents using regular expressions | "grep" |
+| glob | Find files by pattern matching | "glob" |
+| list | List files and directories | "list" |
+| lsp | Access code intelligence (experimental) | "lsp" |
+| patch | Apply patches to files | "edit" |
+| skill | Load skill files (SKILL.md) | "skill" |
+| todowrite | Manage todo lists during sessions | "todowrite" |
+| todoread | Read existing todo lists | "todoread" |
+| webfetch | Fetch and read web pages | "webfetch" |
+| question | Ask user questions during execution | "question" |
+
+### Tool Permissions
+
+```json
+{
+  "permission": {
+    "edit": "ask",
+    "bash": "allow",
+    "webfetch": "deny",
+    "mcp_*": "ask"
+  }
+}
+```
+
+Permission levels:
+- `"allow"` - Tool executes without restriction
+- `"deny"` - Tool cannot be used
+- `"ask"` - Requires user approval before execution
+
+## Custom Tools
+
+Location: `.opencode/tools/` (project) or `~/.config/opencode/tools/` (global)
+
+### Tool Definition
+
+```typescript
+import { tool } from "@opencode-ai/plugin"
+
+export default tool({
+  description: "Execute SQL query on the database",
+  args: {
+    query: tool.schema.string().describe("SQL query to execute"),
+    database: tool.schema.string().optional().describe("Target database")
+  },
+  async execute(args, context) {
+    // context.worktree - git repository root
+    // context.directory - current working directory
+    // context.sessionID - current session ID
+    // context.agent - active agent identifier
+
+    const result = await someDbQuery(args.query)
+    return { result }
+  }
+})
+```
+
+### Multiple Tools Per File
+
+```typescript
+// math.ts - creates math_add and math_multiply tools
+export const add = tool({
+  description: "Add two numbers",
+  args: {
+    a: tool.schema.number(),
+    b: tool.schema.number()
+  },
+  async execute({ a, b }) {
+    return { result: a + b }
+  }
+})
+
+export const multiply = tool({
+  description: "Multiply two numbers",
+  args: {
+    a: tool.schema.number(),
+    b: tool.schema.number()
+  },
+  async execute({ a, b }) {
+    return { result: a * b }
+  }
+})
+```
+
+### Schema Types (Zod)
+
+```typescript
+tool.schema.string()
+tool.schema.number()
+tool.schema.boolean()
+tool.schema.array(tool.schema.string())
+tool.schema.object({ key: tool.schema.string() })
+tool.schema.enum(["option1", "option2"])
+tool.schema.optional()
+tool.schema.describe("Description for LLM")
+```
+
+## Plugins
+
+Plugins extend OpenCode with custom hooks, tools, and behaviors.
+
+### Plugin Structure
+
+```typescript
+import { tool } from "@opencode-ai/plugin"
+
+export const MyPlugin = async ({ project, client, $, directory, worktree }) => {
+  // project - Current project information
+  // client - OpenCode SDK client for AI interaction
+  // $ - Bun's shell API for command execution
+  // directory - Current working directory
+  // worktree - Git worktree path
+
+  return {
+    // Hook implementations
+    "file.edited": async (event) => {
+      // Handle file edit event
+    },
+
+    "tool.execute.before": async (input, output) => {
+      // Intercept before tool execution
+    },
+
+    "session.idle": async (event) => {
+      // Handle session idle
+    }
+  }
+}
+```
+
+### Loading Plugins
+
+1. **Local files**: Place in `.opencode/plugins/` (project) or `~/.config/opencode/plugins/` (global)
+2. **npm packages**: Specify in `opencode.json`:
+
+```json
+{
+  "plugin": [
+    "opencode-helicone-session",
+    "@my-org/custom-plugin",
+    "./.opencode/plugins"
+  ]
+}
+```
+
+### Available Hook Events
+
+**Command Events:**
+- `command.executed` - After a command is executed
+
+**File Events:**
+- `file.edited` - After a file is edited
+- `file.watcher.updated` - When file watcher detects changes
+
+**Tool Events:**
+- `tool.execute.before` - Before tool execution (can modify input)
+- `tool.execute.after` - After tool execution (can modify output)
+
+**Session Events:**
+- `session.created` - When session starts
+- `session.compacted` - After context compaction
+- `session.deleted` - When session ends
+- `session.idle` - When session becomes idle
+- `session.updated` - When session is updated
+- `session.status` - Session status changes
+
+**Message Events:**
+- `message.updated` - When message is updated
+- `message.removed` - When message is removed
+- `message.part.updated` - When message part is updated
+
+**LSP Events:**
+- `lsp.client.diagnostics` - LSP diagnostic updates
+- `lsp.updated` - LSP state updates
+
+**Shell Events:**
+- `shell.env` - Modify shell environment variables
+
+**TUI Events:**
+- `tui.prompt.append` - Append to TUI prompt
+- `tui.command.execute` - Execute TUI command
+- `tui.toast.show` - Show toast notification
+
+**Other Events:**
+- `installation.updated` - Installation updates
+- `permission.asked` - Permission request
+- `server.connected` - Server connection
+- `todo.updated` - Todo list updates
+
+### Hook Event Mapping (Claude Code → OpenCode)
+
+| Claude Code Hook | OpenCode Plugin Event |
+|-----------------|----------------------|
+| PreToolUse | `tool.execute.before` |
+| PostToolUse | `tool.execute.after` |
+| Stop | `session.idle` or `session.status` |
+| SessionStart | `session.created` |
+| SessionEnd | `session.deleted` |
+| N/A | `file.edited`, `file.watcher.updated` |
+| N/A | `message.*`, `permission.*`, `lsp.*` |
+
+### Plugin Example: Auto-Format
+
+```typescript
+export const AutoFormatPlugin = async ({ $, directory }) => {
+  return {
+    "file.edited": async (event) => {
+      if (event.path.match(/\.(ts|tsx|js|jsx)$/)) {
+        await $`prettier --write ${event.path}`
+      }
+    }
+  }
+}
+```
+
+### Plugin Example: TypeScript Check
+
+```typescript
+export const TypeCheckPlugin = async ({ $, client }) => {
+  return {
+    "tool.execute.after": async (input, output) => {
+      if (input.tool === "edit" && input.args.filePath?.match(/\.tsx?$/)) {
+        const result = await $`npx tsc --noEmit`.catch(e => e)
+        if (result.exitCode !== 0) {
+          client.app.log("warn", "TypeScript errors detected")
+        }
+      }
+    }
+  }
+}
+```
+
+## Providers
+
+OpenCode integrates 75+ LLM providers via AI SDK and Models.dev.
+
+### Supported Providers
+
+- OpenCode Zen (recommended for beginners)
+- Anthropic (Claude)
+- OpenAI (GPT)
+- Google (Gemini)
+- Amazon Bedrock
+- Azure OpenAI
+- GitHub Copilot
+- Ollama (local)
+- And 70+ more
+
+### Provider Configuration
+
+```json
+{
+  "provider": {
+    "anthropic": {
+      "options": {
+        "baseURL": "https://api.anthropic.com/v1"
+      }
+    },
+    "custom-provider": {
+      "npm": "@ai-sdk/openai-compatible",
+      "name": "Display Name",
+      "options": {
+        "baseURL": "https://api.example.com/v1",
+        "apiKey": "{env:CUSTOM_API_KEY}"
+      },
+      "models": {
+        "model-id": { "name": "Model Name" }
+      }
+    }
+  }
+}
+```
+
+### Model Naming Convention
+
+Format: `provider/model-id`
+
+Examples:
+- `anthropic/claude-sonnet-4-5`
+- `anthropic/claude-opus-4-5`
+- `anthropic/claude-haiku-4-5`
+- `openai/gpt-4o`
+- `google/gemini-2.0-flash`
+
+### API Key Setup
+
+```bash
+# Interactive setup
+opencode
+/connect
+
+# Environment variables
+export ANTHROPIC_API_KEY=sk-...
+export OPENAI_API_KEY=sk-...
+```
+
+Keys stored in: `~/.local/share/opencode/auth.json`
+
+## MCP (Model Context Protocol)
+
+Configure MCP servers in `opencode.json`:
+
+```json
+{
+  "mcp": {
+    "github": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-github"],
+      "env": {
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "{env:GITHUB_TOKEN}"
+      }
+    },
+    "filesystem": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/dir"]
+    }
+  }
+}
+```
+
+MCP tool permissions use `mcp_*` wildcard:
+
+```json
+{
+  "permission": {
+    "mcp_*": "ask"
+  }
+}
+```
+
+## Ecosystem Plugins
+
+### Authentication & Provider Plugins
+- Alternative model access (ChatGPT Plus, Gemini, Antigravity)
+- Session tracking (Helicone headers)
+- OAuth integrations
+
+### Development Tools
+- Sandbox isolation (Daytona integration)
+- Type injection for TypeScript/Svelte
+- DevContainer multi-branch support
+- Git worktree management
+
+### Enhancement Plugins
+- Web search with citations
+- Markdown table formatting
+- Dynamic context token pruning
+- Desktop notifications
+- Persistent memory (Supermemory)
+- Background process management
+
+### Plugin Discovery
+
+- opencode.cafe - Community plugin registry
+- awesome-opencode - Curated list
+- GitHub search for "opencode-plugin"
+
+## Quick Reference
+
+### Key Shortcuts
+
+| Key | Action |
+|-----|--------|
+| Tab | Toggle between Plan and Build modes |
+| @ | Reference files or mention agents |
+| / | Execute commands |
+
+### Common Commands
+
+```bash
+/init          # Initialize project
+/connect       # Configure API providers
+/share         # Share conversation
+/undo          # Undo last change
+/redo          # Redo undone change
+/help          # Show help
+```
+
+### File Locations
+
+| Purpose | Project | Global |
+|---------|---------|--------|
+| Configuration | `opencode.json` | `~/.config/opencode/config.json` |
+| Agents | `.opencode/agents/` | `~/.config/opencode/agents/` |
+| Commands | `.opencode/commands/` | `~/.config/opencode/commands/` |
+| Plugins | `.opencode/plugins/` | `~/.config/opencode/plugins/` |
+| Tools | `.opencode/tools/` | `~/.config/opencode/tools/` |
+| Auth | - | `~/.local/share/opencode/auth.json` |
+
+### Troubleshooting
+
+```bash
+# Verify credentials
+opencode auth list
+
+# Check configuration
+cat opencode.json | jq .
+
+# Test provider connection
+/connect
+```
+
+---
+
+For more information: https://opencode.ai/docs/

scripts/hooks/session-start.js

@@ -16,6 +16,7 @@ const {
   log
 } = require('../lib/utils');
 const { getPackageManager, getSelectionPrompt } = require('../lib/package-manager');
+const { listAliases } = require('../lib/session-aliases');
 
 async function main() {
   const sessionsDir = getSessionsDir();
@@ -42,6 +43,15 @@ async function main() {
     log(`[SessionStart] ${learnedSkills.length} learned skill(s) available in ${learnedDir}`);
   }
 
+  // Check for available session aliases
+  const aliases = listAliases({ limit: 5 });
+
+  if (aliases.length > 0) {
+    const aliasNames = aliases.map(a => a.name).join(', ');
+    log(`[SessionStart] ${aliases.length} session alias(es) available: ${aliasNames}`);
+    log(`[SessionStart] Use /sessions load <alias> to continue a previous session`);
+  }
+
   // Detect and report package manager
   const pm = getPackageManager();
   log(`[SessionStart] Package manager: ${pm.name} (${pm.source})`);

scripts/lib/session-aliases.js

@@ -0,0 +1,433 @@
+/**
+ * Session Aliases Library for Claude Code
+ * Manages session aliases stored in ~/.claude/session-aliases.json
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const {
+  getClaudeDir,
+  ensureDir,
+  readFile,
+  writeFile,
+  log
+} = require('./utils');
+
+// Aliases file path
+function getAliasesPath() {
+  return path.join(getClaudeDir(), 'session-aliases.json');
+}
+
+// Current alias storage format version
+const ALIAS_VERSION = '1.0';
+
+/**
+ * Default aliases file structure
+ */
+function getDefaultAliases() {
+  return {
+    version: ALIAS_VERSION,
+    aliases: {},
+    metadata: {
+      totalCount: 0,
+      lastUpdated: new Date().toISOString()
+    }
+  };
+}
+
+/**
+ * Load aliases from file
+ * @returns {object} Aliases object
+ */
+function loadAliases() {
+  const aliasesPath = getAliasesPath();
+
+  if (!fs.existsSync(aliasesPath)) {
+    return getDefaultAliases();
+  }
+
+  const content = readFile(aliasesPath);
+  if (!content) {
+    return getDefaultAliases();
+  }
+
+  try {
+    const data = JSON.parse(content);
+
+    // Validate structure
+    if (!data.aliases || typeof data.aliases !== 'object') {
+      log('[Aliases] Invalid aliases file structure, resetting');
+      return getDefaultAliases();
+    }
+
+    // Ensure version field
+    if (!data.version) {
+      data.version = ALIAS_VERSION;
+    }
+
+    // Ensure metadata
+    if (!data.metadata) {
+      data.metadata = {
+        totalCount: Object.keys(data.aliases).length,
+        lastUpdated: new Date().toISOString()
+      };
+    }
+
+    return data;
+  } catch (err) {
+    log(`[Aliases] Error parsing aliases file: ${err.message}`);
+    return getDefaultAliases();
+  }
+}
+
+/**
+ * Save aliases to file with atomic write
+ * @param {object} aliases - Aliases object to save
+ * @returns {boolean} Success status
+ */
+function saveAliases(aliases) {
+  const aliasesPath = getAliasesPath();
+  const tempPath = aliasesPath + '.tmp';
+  const backupPath = aliasesPath + '.bak';
+
+  try {
+    // Update metadata
+    aliases.metadata = {
+      totalCount: Object.keys(aliases.aliases).length,
+      lastUpdated: new Date().toISOString()
+    };
+
+    const content = JSON.stringify(aliases, null, 2);
+
+    // Ensure directory exists
+    ensureDir(path.dirname(aliasesPath));
+
+    // Create backup if file exists
+    if (fs.existsSync(aliasesPath)) {
+      fs.copyFileSync(aliasesPath, backupPath);
+    }
+
+    // Atomic write: write to temp file, then rename
+    fs.writeFileSync(tempPath, content, 'utf8');
+
+    // On Windows, we need to delete the target file before renaming
+    if (fs.existsSync(aliasesPath)) {
+      fs.unlinkSync(aliasesPath);
+    }
+    fs.renameSync(tempPath, aliasesPath);
+
+    // Remove backup on success
+    if (fs.existsSync(backupPath)) {
+      fs.unlinkSync(backupPath);
+    }
+
+    return true;
+  } catch (err) {
+    log(`[Aliases] Error saving aliases: ${err.message}`);
+
+    // Restore from backup if exists
+    if (fs.existsSync(backupPath)) {
+      try {
+        fs.copyFileSync(backupPath, aliasesPath);
+        log('[Aliases] Restored from backup');
+      } catch (restoreErr) {
+        log(`[Aliases] Failed to restore backup: ${restoreErr.message}`);
+      }
+    }
+
+    // Clean up temp file
+    if (fs.existsSync(tempPath)) {
+      fs.unlinkSync(tempPath);
+    }
+
+    return false;
+  }
+}
+
+/**
+ * Resolve an alias to get session path
+ * @param {string} alias - Alias name to resolve
+ * @returns {object|null} Alias data or null if not found
+ */
+function resolveAlias(alias) {
+  // Validate alias name (alphanumeric, dash, underscore)
+  if (!/^[a-zA-Z0-9_-]+$/.test(alias)) {
+    return null;
+  }
+
+  const data = loadAliases();
+  const aliasData = data.aliases[alias];
+
+  if (!aliasData) {
+    return null;
+  }
+
+  return {
+    alias,
+    sessionPath: aliasData.sessionPath,
+    createdAt: aliasData.createdAt,
+    title: aliasData.title || null
+  };
+}
+
+/**
+ * Set or update an alias for a session
+ * @param {string} alias - Alias name (alphanumeric, dash, underscore)
+ * @param {string} sessionPath - Session directory path
+ * @param {string} title - Optional title for the alias
+ * @returns {object} Result with success status and message
+ */
+function setAlias(alias, sessionPath, title = null) {
+  // Validate alias name
+  if (!alias || alias.length === 0) {
+    return { success: false, error: 'Alias name cannot be empty' };
+  }
+
+  if (!/^[a-zA-Z0-9_-]+$/.test(alias)) {
+    return { success: false, error: 'Alias name must contain only letters, numbers, dashes, and underscores' };
+  }
+
+  // Reserved alias names
+  const reserved = ['list', 'help', 'remove', 'delete', 'create', 'set'];
+  if (reserved.includes(alias.toLowerCase())) {
+    return { success: false, error: `'${alias}' is a reserved alias name` };
+  }
+
+  const data = loadAliases();
+  const existing = data.aliases[alias];
+  const isNew = !existing;
+
+  data.aliases[alias] = {
+    sessionPath,
+    createdAt: existing ? existing.createdAt : new Date().toISOString(),
+    updatedAt: new Date().toISOString(),
+    title: title || null
+  };
+
+  if (saveAliases(data)) {
+    return {
+      success: true,
+      isNew,
+      alias,
+      sessionPath,
+      title: data.aliases[alias].title
+    };
+  }
+
+  return { success: false, error: 'Failed to save alias' };
+}
+
+/**
+ * List all aliases
+ * @param {object} options - Options object
+ * @param {string} options.search - Filter aliases by name (partial match)
+ * @param {number} options.limit - Maximum number of aliases to return
+ * @returns {Array} Array of alias objects
+ */
+function listAliases(options = {}) {
+  const { search = null, limit = null } = options;
+  const data = loadAliases();
+
+  let aliases = Object.entries(data.aliases).map(([name, info]) => ({
+    name,
+    sessionPath: info.sessionPath,
+    createdAt: info.createdAt,
+    updatedAt: info.updatedAt,
+    title: info.title
+  }));
+
+  // Sort by updated time (newest first)
+  aliases.sort((a, b) => new Date(b.updatedAt || b.createdAt) - new Date(a.updatedAt || a.createdAt));
+
+  // Apply search filter
+  if (search) {
+    const searchLower = search.toLowerCase();
+    aliases = aliases.filter(a =>
+      a.name.toLowerCase().includes(searchLower) ||
+      (a.title && a.title.toLowerCase().includes(searchLower))
+    );
+  }
+
+  // Apply limit
+  if (limit && limit > 0) {
+    aliases = aliases.slice(0, limit);
+  }
+
+  return aliases;
+}
+
+/**
+ * Delete an alias
+ * @param {string} alias - Alias name to delete
+ * @returns {object} Result with success status
+ */
+function deleteAlias(alias) {
+  const data = loadAliases();
+
+  if (!data.aliases[alias]) {
+    return { success: false, error: `Alias '${alias}' not found` };
+  }
+
+  const deleted = data.aliases[alias];
+  delete data.aliases[alias];
+
+  if (saveAliases(data)) {
+    return {
+      success: true,
+      alias,
+      deletedSessionPath: deleted.sessionPath
+    };
+  }
+
+  return { success: false, error: 'Failed to delete alias' };
+}
+
+/**
+ * Rename an alias
+ * @param {string} oldAlias - Current alias name
+ * @param {string} newAlias - New alias name
+ * @returns {object} Result with success status
+ */
+function renameAlias(oldAlias, newAlias) {
+  const data = loadAliases();
+
+  if (!data.aliases[oldAlias]) {
+    return { success: false, error: `Alias '${oldAlias}' not found` };
+  }
+
+  if (data.aliases[newAlias]) {
+    return { success: false, error: `Alias '${newAlias}' already exists` };
+  }
+
+  // Validate new alias name
+  if (!/^[a-zA-Z0-9_-]+$/.test(newAlias)) {
+    return { success: false, error: 'New alias name must contain only letters, numbers, dashes, and underscores' };
+  }
+
+  const aliasData = data.aliases[oldAlias];
+  delete data.aliases[oldAlias];
+
+  aliasData.updatedAt = new Date().toISOString();
+  data.aliases[newAlias] = aliasData;
+
+  if (saveAliases(data)) {
+    return {
+      success: true,
+      oldAlias,
+      newAlias,
+      sessionPath: aliasData.sessionPath
+    };
+  }
+
+  // Restore old alias on failure
+  data.aliases[oldAlias] = aliasData;
+  return { success: false, error: 'Failed to rename alias' };
+}
+
+/**
+ * Get session path by alias (convenience function)
+ * @param {string} aliasOrId - Alias name or session ID
+ * @returns {string|null} Session path or null if not found
+ */
+function resolveSessionAlias(aliasOrId) {
+  // First try to resolve as alias
+  const resolved = resolveAlias(aliasOrId);
+  if (resolved) {
+    return resolved.sessionPath;
+  }
+
+  // If not an alias, return as-is (might be a session path)
+  return aliasOrId;
+}
+
+/**
+ * Update alias title
+ * @param {string} alias - Alias name
+ * @param {string} title - New title
+ * @returns {object} Result with success status
+ */
+function updateAliasTitle(alias, title) {
+  const data = loadAliases();
+
+  if (!data.aliases[alias]) {
+    return { success: false, error: `Alias '${alias}' not found` };
+  }
+
+  data.aliases[alias].title = title;
+  data.aliases[alias].updatedAt = new Date().toISOString();
+
+  if (saveAliases(data)) {
+    return {
+      success: true,
+      alias,
+      title
+    };
+  }
+
+  return { success: false, error: 'Failed to update alias title' };
+}
+
+/**
+ * Get all aliases for a specific session
+ * @param {string} sessionPath - Session path to find aliases for
+ * @returns {Array} Array of alias names
+ */
+function getAliasesForSession(sessionPath) {
+  const data = loadAliases();
+  const aliases = [];
+
+  for (const [name, info] of Object.entries(data.aliases)) {
+    if (info.sessionPath === sessionPath) {
+      aliases.push({
+        name,
+        createdAt: info.createdAt,
+        title: info.title
+      });
+    }
+  }
+
+  return aliases;
+}
+
+/**
+ * Clean up aliases for non-existent sessions
+ * @param {Function} sessionExists - Function to check if session exists
+ * @returns {object} Cleanup result
+ */
+function cleanupAliases(sessionExists) {
+  const data = loadAliases();
+  const removed = [];
+
+  for (const [name, info] of Object.entries(data.aliases)) {
+    if (!sessionExists(info.sessionPath)) {
+      removed.push({ name, sessionPath: info.sessionPath });
+      delete data.aliases[name];
+    }
+  }
+
+  if (removed.length > 0) {
+    saveAliases(data);
+  }
+
+  return {
+    totalChecked: Object.keys(data.aliases).length + removed.length,
+    removed: removed.length,
+    removedAliases: removed
+  };
+}
+
+module.exports = {
+  getAliasesPath,
+  loadAliases,
+  saveAliases,
+  resolveAlias,
+  setAlias,
+  listAliases,
+  deleteAlias,
+  renameAlias,
+  resolveSessionAlias,
+  updateAliasTitle,
+  getAliasesForSession,
+  cleanupAliases
+};

scripts/lib/session-manager.js

@@ -0,0 +1,396 @@
+/**
+ * Session Manager Library for Claude Code
+ * Provides core session CRUD operations for listing, loading, and managing sessions
+ *
+ * Sessions are stored as markdown files in ~/.claude/sessions/ with format:
+ * - YYYY-MM-DD-session.tmp (old format)
+ * - YYYY-MM-DD-<short-id>-session.tmp (new format)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const {
+  getSessionsDir,
+  readFile,
+  log
+} = require('./utils');
+
+// Session filename pattern: YYYY-MM-DD-[short-id]-session.tmp
+// The short-id is optional (old format) and can be 8+ alphanumeric characters
+// Matches: "2026-02-01-session.tmp" or "2026-02-01-a1b2c3d4-session.tmp"
+const SESSION_FILENAME_REGEX = /^(\d{4}-\d{2}-\d{2})(?:-([a-z0-9]{8,}))?-session\.tmp$/;
+
+/**
+ * Parse session filename to extract metadata
+ * @param {string} filename - Session filename (e.g., "2026-01-17-abc123-session.tmp" or "2026-01-17-session.tmp")
+ * @returns {object|null} Parsed metadata or null if invalid
+ */
+function parseSessionFilename(filename) {
+  const match = filename.match(SESSION_FILENAME_REGEX);
+  if (!match) return null;
+
+  const dateStr = match[1];
+  // match[2] is undefined for old format (no ID)
+  const shortId = match[2] || 'no-id';
+
+  return {
+    filename,
+    shortId,
+    date: dateStr,
+    // Convert date string to Date object
+    datetime: new Date(dateStr)
+  };
+}
+
+/**
+ * Get the full path to a session file
+ * @param {string} filename - Session filename
+ * @returns {string} Full path to session file
+ */
+function getSessionPath(filename) {
+  return path.join(getSessionsDir(), filename);
+}
+
+/**
+ * Read and parse session markdown content
+ * @param {string} sessionPath - Full path to session file
+ * @returns {string|null} Session content or null if not found
+ */
+function getSessionContent(sessionPath) {
+  if (!fs.existsSync(sessionPath)) {
+    return null;
+  }
+
+  return readFile(sessionPath);
+}
+
+/**
+ * Parse session metadata from markdown content
+ * @param {string} content - Session markdown content
+ * @returns {object} Parsed metadata
+ */
+function parseSessionMetadata(content) {
+  const metadata = {
+    title: null,
+    date: null,
+    started: null,
+    lastUpdated: null,
+    completed: [],
+    inProgress: [],
+    notes: '',
+    context: ''
+  };
+
+  if (!content) return metadata;
+
+  // Extract title from first heading
+  const titleMatch = content.match(/^#\s+(.+)$/m);
+  if (titleMatch) {
+    metadata.title = titleMatch[1].trim();
+  }
+
+  // Extract date
+  const dateMatch = content.match(/\*\*Date:\*\*\s*(\d{4}-\d{2}-\d{2})/);
+  if (dateMatch) {
+    metadata.date = dateMatch[1];
+  }
+
+  // Extract started time
+  const startedMatch = content.match(/\*\*Started:\*\*\s*([\d:]+)/);
+  if (startedMatch) {
+    metadata.started = startedMatch[1];
+  }
+
+  // Extract last updated
+  const updatedMatch = content.match(/\*\*Last Updated:\*\*\s*([\d:]+)/);
+  if (updatedMatch) {
+    metadata.lastUpdated = updatedMatch[1];
+  }
+
+  // Extract completed items
+  const completedSection = content.match(/### Completed\s*\n([\s\S]*?)(?=###|\n\n|$)/);
+  if (completedSection) {
+    const items = completedSection[1].match(/- \[x\]\s*(.+)/g);
+    if (items) {
+      metadata.completed = items.map(item => item.replace(/- \[x\]\s*/, '').trim());
+    }
+  }
+
+  // Extract in-progress items
+  const progressSection = content.match(/### In Progress\s*\n([\s\S]*?)(?=###|\n\n|$)/);
+  if (progressSection) {
+    const items = progressSection[1].match(/- \[ \]\s*(.+)/g);
+    if (items) {
+      metadata.inProgress = items.map(item => item.replace(/- \[ \]\s*/, '').trim());
+    }
+  }
+
+  // Extract notes
+  const notesSection = content.match(/### Notes for Next Session\s*\n([\s\S]*?)(?=###|\n\n|$)/);
+  if (notesSection) {
+    metadata.notes = notesSection[1].trim();
+  }
+
+  // Extract context to load
+  const contextSection = content.match(/### Context to Load\s*\n```\n([\s\S]*?)```/);
+  if (contextSection) {
+    metadata.context = contextSection[1].trim();
+  }
+
+  return metadata;
+}
+
+/**
+ * Calculate statistics for a session
+ * @param {string} sessionPath - Full path to session file
+ * @returns {object} Statistics object
+ */
+function getSessionStats(sessionPath) {
+  const content = getSessionContent(sessionPath);
+  const metadata = parseSessionMetadata(content);
+
+  return {
+    totalItems: metadata.completed.length + metadata.inProgress.length,
+    completedItems: metadata.completed.length,
+    inProgressItems: metadata.inProgress.length,
+    lineCount: content ? content.split('\n').length : 0,
+    hasNotes: !!metadata.notes,
+    hasContext: !!metadata.context
+  };
+}
+
+/**
+ * Get all sessions with optional filtering and pagination
+ * @param {object} options - Options object
+ * @param {number} options.limit - Maximum number of sessions to return
+ * @param {number} options.offset - Number of sessions to skip
+ * @param {string} options.date - Filter by date (YYYY-MM-DD format)
+ * @param {string} options.search - Search in short ID
+ * @returns {object} Object with sessions array and pagination info
+ */
+function getAllSessions(options = {}) {
+  const {
+    limit = 50,
+    offset = 0,
+    date = null,
+    search = null
+  } = options;
+
+  const sessionsDir = getSessionsDir();
+
+  if (!fs.existsSync(sessionsDir)) {
+    return { sessions: [], total: 0, offset, limit, hasMore: false };
+  }
+
+  const entries = fs.readdirSync(sessionsDir, { withFileTypes: true });
+  const sessions = [];
+
+  for (const entry of entries) {
+    // Skip non-files (only process .tmp files)
+    if (!entry.isFile() || !entry.name.endsWith('.tmp')) continue;
+
+    const filename = entry.name;
+    const metadata = parseSessionFilename(filename);
+
+    if (!metadata) continue;
+
+    // Apply date filter
+    if (date && metadata.date !== date) {
+      continue;
+    }
+
+    // Apply search filter (search in short ID)
+    if (search && !metadata.shortId.includes(search)) {
+      continue;
+    }
+
+    const sessionPath = path.join(sessionsDir, filename);
+
+    // Get file stats
+    const stats = fs.statSync(sessionPath);
+
+    sessions.push({
+      ...metadata,
+      sessionPath,
+      hasContent: stats.size > 0,
+      size: stats.size,
+      modifiedTime: stats.mtime,
+      createdTime: stats.birthtime
+    });
+  }
+
+  // Sort by modified time (newest first)
+  sessions.sort((a, b) => b.modifiedTime - a.modifiedTime);
+
+  // Apply pagination
+  const paginatedSessions = sessions.slice(offset, offset + limit);
+
+  return {
+    sessions: paginatedSessions,
+    total: sessions.length,
+    offset,
+    limit,
+    hasMore: offset + limit < sessions.length
+  };
+}
+
+/**
+ * Get a single session by ID (short ID or full path)
+ * @param {string} sessionId - Short ID or session filename
+ * @param {boolean} includeContent - Include session content
+ * @returns {object|null} Session object or null if not found
+ */
+function getSessionById(sessionId, includeContent = false) {
+  const sessionsDir = getSessionsDir();
+
+  if (!fs.existsSync(sessionsDir)) {
+    return null;
+  }
+
+  const entries = fs.readdirSync(sessionsDir, { withFileTypes: true });
+
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith('.tmp')) continue;
+
+    const filename = entry.name;
+    const metadata = parseSessionFilename(filename);
+
+    if (!metadata) continue;
+
+    // Check if session ID matches (short ID or full filename without .tmp)
+    const shortIdMatch = metadata.shortId !== 'no-id' && metadata.shortId.startsWith(sessionId);
+    const filenameMatch = filename === sessionId || filename === `${sessionId}.tmp`;
+    const noIdMatch = metadata.shortId === 'no-id' && filename === `${sessionId}-session.tmp`;
+
+    if (!shortIdMatch && !filenameMatch && !noIdMatch) {
+      continue;
+    }
+
+    const sessionPath = path.join(sessionsDir, filename);
+    const stats = fs.statSync(sessionPath);
+
+    const session = {
+      ...metadata,
+      sessionPath,
+      size: stats.size,
+      modifiedTime: stats.mtime,
+      createdTime: stats.birthtime
+    };
+
+    if (includeContent) {
+      session.content = getSessionContent(sessionPath);
+      session.metadata = parseSessionMetadata(session.content);
+      session.stats = getSessionStats(sessionPath);
+    }
+
+    return session;
+  }
+
+  return null;
+}
+
+/**
+ * Get session title from content
+ * @param {string} sessionPath - Full path to session file
+ * @returns {string} Title or default text
+ */
+function getSessionTitle(sessionPath) {
+  const content = getSessionContent(sessionPath);
+  const metadata = parseSessionMetadata(content);
+
+  return metadata.title || 'Untitled Session';
+}
+
+/**
+ * Format session size in human-readable format
+ * @param {string} sessionPath - Full path to session file
+ * @returns {string} Formatted size (e.g., "1.2 KB")
+ */
+function getSessionSize(sessionPath) {
+  if (!fs.existsSync(sessionPath)) {
+    return '0 B';
+  }
+
+  const stats = fs.statSync(sessionPath);
+  const size = stats.size;
+
+  if (size < 1024) return `${size} B`;
+  if (size < 1024 * 1024) return `${(size / 1024).toFixed(1)} KB`;
+  return `${(size / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+/**
+ * Write session content to file
+ * @param {string} sessionPath - Full path to session file
+ * @param {string} content - Markdown content to write
+ * @returns {boolean} Success status
+ */
+function writeSessionContent(sessionPath, content) {
+  try {
+    fs.writeFileSync(sessionPath, content, 'utf8');
+    return true;
+  } catch (err) {
+    log(`[SessionManager] Error writing session: ${err.message}`);
+    return false;
+  }
+}
+
+/**
+ * Append content to a session
+ * @param {string} sessionPath - Full path to session file
+ * @param {string} content - Content to append
+ * @returns {boolean} Success status
+ */
+function appendSessionContent(sessionPath, content) {
+  try {
+    fs.appendFileSync(sessionPath, content, 'utf8');
+    return true;
+  } catch (err) {
+    log(`[SessionManager] Error appending to session: ${err.message}`);
+    return false;
+  }
+}
+
+/**
+ * Delete a session file
+ * @param {string} sessionPath - Full path to session file
+ * @returns {boolean} Success status
+ */
+function deleteSession(sessionPath) {
+  try {
+    if (fs.existsSync(sessionPath)) {
+      fs.unlinkSync(sessionPath);
+      return true;
+    }
+    return false;
+  } catch (err) {
+    log(`[SessionManager] Error deleting session: ${err.message}`);
+    return false;
+  }
+}
+
+/**
+ * Check if a session exists
+ * @param {string} sessionPath - Full path to session file
+ * @returns {boolean} True if session exists
+ */
+function sessionExists(sessionPath) {
+  return fs.existsSync(sessionPath) && fs.statSync(sessionPath).isFile();
+}
+
+module.exports = {
+  parseSessionFilename,
+  getSessionPath,
+  getSessionContent,
+  parseSessionMetadata,
+  getSessionStats,
+  getSessionTitle,
+  getSessionSize,
+  getAllSessions,
+  getSessionById,
+  writeSessionContent,
+  appendSessionContent,
+  deleteSession,
+  sessionExists
+};

scripts/lib/utils.js

@@ -34,6 +34,13 @@ function getSessionsDir() {
   return path.join(getClaudeDir(), 'sessions');
 }
 
+/**
+ * Get the session aliases file path
+ */
+function getAliasesPath() {
+  return path.join(getClaudeDir(), 'session-aliases.json');
+}
+
 /**
  * Get the learned skills directory
  */
@@ -382,6 +389,7 @@ module.exports = {
   getHomeDir,
   getClaudeDir,
   getSessionsDir,
+  getAliasesPath,
   getLearnedSkillsDir,
   getTempDir,
   ensureDir,

skills/django-patterns/SKILL.md

@@ -0,0 +1,733 @@
+---
+name: django-patterns
+description: Django architecture patterns, REST API design with DRF, ORM best practices, caching, signals, middleware, and production-grade Django apps.
+---
+
+# Django Development Patterns
+
+Production-grade Django architecture patterns for scalable, maintainable applications.
+
+## When to Activate
+
+- Building Django web applications
+- Designing Django REST Framework APIs
+- Working with Django ORM and models
+- Setting up Django project structure
+- Implementing caching, signals, middleware
+
+## Project Structure
+
+### Recommended Layout
+
+```
+myproject/
+├── config/
+│   ├── __init__.py
+│   ├── settings/
+│   │   ├── __init__.py
+│   │   ├── base.py          # Base settings
+│   │   ├── development.py   # Dev settings
+│   │   ├── production.py    # Production settings
+│   │   └── test.py          # Test settings
+│   ├── urls.py
+│   ├── wsgi.py
+│   └── asgi.py
+├── manage.py
+└── apps/
+    ├── __init__.py
+    ├── users/
+    │   ├── __init__.py
+    │   ├── models.py
+    │   ├── views.py
+    │   ├── serializers.py
+    │   ├── urls.py
+    │   ├── permissions.py
+    │   ├── filters.py
+    │   ├── services.py
+    │   └── tests/
+    └── products/
+        └── ...
+```
+
+### Split Settings Pattern
+
+```python
+# config/settings/base.py
+from pathlib import Path
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+
+SECRET_KEY = env('DJANGO_SECRET_KEY')
+DEBUG = False
+ALLOWED_HOSTS = []
+
+INSTALLED_APPS = [
+    'django.contrib.admin',
+    'django.contrib.auth',
+    'django.contrib.contenttypes',
+    'django.contrib.sessions',
+    'django.contrib.messages',
+    'django.contrib.staticfiles',
+    'rest_framework',
+    'rest_framework.authtoken',
+    'corsheaders',
+    # Local apps
+    'apps.users',
+    'apps.products',
+]
+
+MIDDLEWARE = [
+    'django.middleware.security.SecurityMiddleware',
+    'whitenoise.middleware.WhiteNoiseMiddleware',
+    'django.contrib.sessions.middleware.SessionMiddleware',
+    'corsheaders.middleware.CorsMiddleware',
+    'django.middleware.common.CommonMiddleware',
+    'django.middleware.csrf.CsrfViewMiddleware',
+    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
+]
+
+ROOT_URLCONF = 'config.urls'
+WSGI_APPLICATION = 'config.wsgi.application'
+
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.postgresql',
+        'NAME': env('DB_NAME'),
+        'USER': env('DB_USER'),
+        'PASSWORD': env('DB_PASSWORD'),
+        'HOST': env('DB_HOST'),
+        'PORT': env('DB_PORT', default='5432'),
+    }
+}
+
+# config/settings/development.py
+from .base import *
+
+DEBUG = True
+ALLOWED_HOSTS = ['localhost', '127.0.0.1']
+
+DATABASES['default']['NAME'] = 'myproject_dev'
+
+INSTALLED_APPS += ['debug_toolbar']
+
+MIDDLEWARE += ['debug_toolbar.middleware.DebugToolbarMiddleware']
+
+EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
+
+# config/settings/production.py
+from .base import *
+
+DEBUG = False
+ALLOWED_HOSTS = env.list('ALLOWED_HOSTS')
+SECURE_SSL_REDIRECT = True
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+SECURE_HSTS_SECONDS = 31536000
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+SECURE_HSTS_PRELOAD = True
+
+# Logging
+LOGGING = {
+    'version': 1,
+    'disable_existing_loggers': False,
+    'handlers': {
+        'file': {
+            'level': 'WARNING',
+            'class': 'logging.FileHandler',
+            'filename': '/var/log/django/django.log',
+        },
+    },
+    'loggers': {
+        'django': {
+            'handlers': ['file'],
+            'level': 'WARNING',
+            'propagate': True,
+        },
+    },
+}
+```
+
+## Model Design Patterns
+
+### Model Best Practices
+
+```python
+from django.db import models
+from django.contrib.auth.models import AbstractUser
+from django.core.validators import MinValueValidator, MaxValueValidator
+
+class User(AbstractUser):
+    """Custom user model extending AbstractUser."""
+    email = models.EmailField(unique=True)
+    phone = models.CharField(max_length=20, blank=True)
+    birth_date = models.DateField(null=True, blank=True)
+
+    USERNAME_FIELD = 'email'
+    REQUIRED_FIELDS = ['username']
+
+    class Meta:
+        db_table = 'users'
+        verbose_name = 'user'
+        verbose_name_plural = 'users'
+        ordering = ['-date_joined']
+
+    def __str__(self):
+        return self.email
+
+    def get_full_name(self):
+        return f"{self.first_name} {self.last_name}".strip()
+
+class Product(models.Model):
+    """Product model with proper field configuration."""
+    name = models.CharField(max_length=200)
+    slug = models.SlugField(unique=True, max_length=250)
+    description = models.TextField(blank=True)
+    price = models.DecimalField(
+        max_digits=10,
+        decimal_places=2,
+        validators=[MinValueValidator(0)]
+    )
+    stock = models.PositiveIntegerField(default=0)
+    is_active = models.BooleanField(default=True)
+    category = models.ForeignKey(
+        'Category',
+        on_delete=models.CASCADE,
+        related_name='products'
+    )
+    tags = models.ManyToManyField('Tag', blank=True, related_name='products')
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        db_table = 'products'
+        ordering = ['-created_at']
+        indexes = [
+            models.Index(fields=['slug']),
+            models.Index(fields=['-created_at']),
+            models.Index(fields=['category', 'is_active']),
+        ]
+        constraints = [
+            models.CheckConstraint(
+                check=models.Q(price__gte=0),
+                name='price_non_negative'
+            )
+        ]
+
+    def __str__(self):
+        return self.name
+
+    def save(self, *args, **kwargs):
+        if not self.slug:
+            self.slug = slugify(self.name)
+        super().save(*args, **kwargs)
+```
+
+### QuerySet Best Practices
+
+```python
+from django.db import models
+
+class ProductQuerySet(models.QuerySet):
+    """Custom QuerySet for Product model."""
+
+    def active(self):
+        """Return only active products."""
+        return self.filter(is_active=True)
+
+    def with_category(self):
+        """Select related category to avoid N+1 queries."""
+        return self.select_related('category')
+
+    def with_tags(self):
+        """Prefetch tags for many-to-many relationship."""
+        return self.prefetch_related('tags')
+
+    def in_stock(self):
+        """Return products with stock > 0."""
+        return self.filter(stock__gt=0)
+
+    def search(self, query):
+        """Search products by name or description."""
+        return self.filter(
+            models.Q(name__icontains=query) |
+            models.Q(description__icontains=query)
+        )
+
+class Product(models.Model):
+    # ... fields ...
+
+    objects = ProductQuerySet.as_manager()  # Use custom QuerySet
+
+# Usage
+Product.objects.active().with_category().in_stock()
+```
+
+### Manager Methods
+
+```python
+class ProductManager(models.Manager):
+    """Custom manager for complex queries."""
+
+    def get_or_none(self, **kwargs):
+        """Return object or None instead of DoesNotExist."""
+        try:
+            return self.get(**kwargs)
+        except self.model.DoesNotExist:
+            return None
+
+    def create_with_tags(self, name, price, tag_names):
+        """Create product with associated tags."""
+        product = self.create(name=name, price=price)
+        tags = [Tag.objects.get_or_create(name=name)[0] for name in tag_names]
+        product.tags.set(tags)
+        return product
+
+    def bulk_update_stock(self, product_ids, quantity):
+        """Bulk update stock for multiple products."""
+        return self.filter(id__in=product_ids).update(stock=quantity)
+
+# In model
+class Product(models.Model):
+    # ... fields ...
+    custom = ProductManager()
+```
+
+## Django REST Framework Patterns
+
+### Serializer Patterns
+
+```python
+from rest_framework import serializers
+from django.contrib.auth.password_validation import validate_password
+from .models import Product, User
+
+class ProductSerializer(serializers.ModelSerializer):
+    """Serializer for Product model."""
+
+    category_name = serializers.CharField(source='category.name', read_only=True)
+    average_rating = serializers.FloatField(read_only=True)
+    discount_price = serializers.SerializerMethodField()
+
+    class Meta:
+        model = Product
+        fields = [
+            'id', 'name', 'slug', 'description', 'price',
+            'discount_price', 'stock', 'category_name',
+            'average_rating', 'created_at'
+        ]
+        read_only_fields = ['id', 'slug', 'created_at']
+
+    def get_discount_price(self, obj):
+        """Calculate discount price if applicable."""
+        if hasattr(obj, 'discount') and obj.discount:
+            return obj.price * (1 - obj.discount.percent / 100)
+        return obj.price
+
+    def validate_price(self, value):
+        """Ensure price is non-negative."""
+        if value < 0:
+            raise serializers.ValidationError("Price cannot be negative.")
+        return value
+
+class ProductCreateSerializer(serializers.ModelSerializer):
+    """Serializer for creating products."""
+
+    class Meta:
+        model = Product
+        fields = ['name', 'description', 'price', 'stock', 'category']
+
+    def validate(self, data):
+        """Custom validation for multiple fields."""
+        if data['price'] > 10000 and data['stock'] > 100:
+            raise serializers.ValidationError(
+                "Cannot have high-value products with large stock."
+            )
+        return data
+
+class UserRegistrationSerializer(serializers.ModelSerializer):
+    """Serializer for user registration."""
+
+    password = serializers.CharField(
+        write_only=True,
+        required=True,
+        validators=[validate_password],
+        style={'input_type': 'password'}
+    )
+    password_confirm = serializers.CharField(write_only=True, style={'input_type': 'password'})
+
+    class Meta:
+        model = User
+        fields = ['email', 'username', 'password', 'password_confirm']
+
+    def validate(self, data):
+        """Validate passwords match."""
+        if data['password'] != data['password_confirm']:
+            raise serializers.ValidationError({
+                "password_confirm": "Password fields didn't match."
+            })
+        return data
+
+    def create(self, validated_data):
+        """Create user with hashed password."""
+        validated_data.pop('password_confirm')
+        password = validated_data.pop('password')
+        user = User.objects.create(**validated_data)
+        user.set_password(password)
+        user.save()
+        return user
+```
+
+### ViewSet Patterns
+
+```python
+from rest_framework import viewsets, status, filters
+from rest_framework.decorators import action
+from rest_framework.response import Response
+from rest_framework.permissions import IsAuthenticated, IsAdminUser
+from django_filters.rest_framework import DjangoFilterBackend
+from .models import Product
+from .serializers import ProductSerializer, ProductCreateSerializer
+from .permissions import IsOwnerOrReadOnly
+from .filters import ProductFilter
+from .services import ProductService
+
+class ProductViewSet(viewsets.ModelViewSet):
+    """ViewSet for Product model."""
+
+    queryset = Product.objects.select_related('category').prefetch_related('tags')
+    permission_classes = [IsAuthenticated, IsOwnerOrReadOnly]
+    filter_backends = [DjangoFilterBackend, filters.SearchFilter, filters.OrderingFilter]
+    filterset_class = ProductFilter
+    search_fields = ['name', 'description']
+    ordering_fields = ['price', 'created_at', 'name']
+    ordering = ['-created_at']
+
+    def get_serializer_class(self):
+        """Return appropriate serializer based on action."""
+        if self.action == 'create':
+            return ProductCreateSerializer
+        return ProductSerializer
+
+    def perform_create(self, serializer):
+        """Save with user context."""
+        serializer.save(created_by=self.request.user)
+
+    @action(detail=False, methods=['get'])
+    def featured(self, request):
+        """Return featured products."""
+        featured = self.queryset.filter(is_featured=True)[:10]
+        serializer = self.get_serializer(featured, many=True)
+        return Response(serializer.data)
+
+    @action(detail=True, methods=['post'])
+    def purchase(self, request, pk=None):
+        """Purchase a product."""
+        product = self.get_object()
+        service = ProductService()
+        result = service.purchase(product, request.user)
+        return Response(result, status=status.HTTP_201_CREATED)
+
+    @action(detail=False, methods=['get'], permission_classes=[IsAuthenticated])
+    def my_products(self, request):
+        """Return products created by current user."""
+        products = self.queryset.filter(created_by=request.user)
+        page = self.paginate_queryset(products)
+        serializer = self.get_serializer(page, many=True)
+        return self.get_paginated_response(serializer.data)
+```
+
+### Custom Actions
+
+```python
+from rest_framework.decorators import api_view, permission_classes
+from rest_framework.permissions import IsAuthenticated
+from rest_framework.response import Response
+
+@api_view(['POST'])
+@permission_classes([IsAuthenticated])
+def add_to_cart(request):
+    """Add product to user cart."""
+    product_id = request.data.get('product_id')
+    quantity = request.data.get('quantity', 1)
+
+    try:
+        product = Product.objects.get(id=product_id)
+    except Product.DoesNotExist:
+        return Response(
+            {'error': 'Product not found'},
+            status=status.HTTP_404_NOT_FOUND
+        )
+
+    cart, _ = Cart.objects.get_or_create(user=request.user)
+    CartItem.objects.create(
+        cart=cart,
+        product=product,
+        quantity=quantity
+    )
+
+    return Response({'message': 'Added to cart'}, status=status.HTTP_201_CREATED)
+```
+
+## Service Layer Pattern
+
+```python
+# apps/orders/services.py
+from typing import Optional
+from django.db import transaction
+from .models import Order, OrderItem
+
+class OrderService:
+    """Service layer for order-related business logic."""
+
+    @staticmethod
+    @transaction.atomic
+    def create_order(user, cart: Cart) -> Order:
+        """Create order from cart."""
+        order = Order.objects.create(
+            user=user,
+            total_price=cart.total_price
+        )
+
+        for item in cart.items.all():
+            OrderItem.objects.create(
+                order=order,
+                product=item.product,
+                quantity=item.quantity,
+                price=item.product.price
+            )
+
+        # Clear cart
+        cart.items.all().delete()
+
+        return order
+
+    @staticmethod
+    def process_payment(order: Order, payment_data: dict) -> bool:
+        """Process payment for order."""
+        # Integration with payment gateway
+        payment = PaymentGateway.charge(
+            amount=order.total_price,
+            token=payment_data['token']
+        )
+
+        if payment.success:
+            order.status = Order.Status.PAID
+            order.save()
+            # Send confirmation email
+            OrderService.send_confirmation_email(order)
+            return True
+
+        return False
+
+    @staticmethod
+    def send_confirmation_email(order: Order):
+        """Send order confirmation email."""
+        # Email sending logic
+        pass
+```
+
+## Caching Strategies
+
+### View-Level Caching
+
+```python
+from django.views.decorators.cache import cache_page
+from django.utils.decorators import method_decorator
+
+@method_decorator(cache_page(60 * 15), name='dispatch')  # 15 minutes
+class ProductListView(generic.ListView):
+    model = Product
+    template_name = 'products/list.html'
+    context_object_name = 'products'
+```
+
+### Template Fragment Caching
+
+```django
+{% load cache %}
+{% cache 500 sidebar %}
+    ... expensive sidebar content ...
+{% endcache %}
+```
+
+### Low-Level Caching
+
+```python
+from django.core.cache import cache
+
+def get_featured_products():
+    """Get featured products with caching."""
+    cache_key = 'featured_products'
+    products = cache.get(cache_key)
+
+    if products is None:
+        products = list(Product.objects.filter(is_featured=True))
+        cache.set(cache_key, products, timeout=60 * 15)  # 15 minutes
+
+    return products
+```
+
+### QuerySet Caching
+
+```python
+from django.core.cache import cache
+
+def get_popular_categories():
+    cache_key = 'popular_categories'
+    categories = cache.get(cache_key)
+
+    if categories is None:
+        categories = list(Category.objects.annotate(
+            product_count=Count('products')
+        ).filter(product_count__gt=10).order_by('-product_count')[:20])
+        cache.set(cache_key, categories, timeout=60 * 60)  # 1 hour
+
+    return categories
+```
+
+## Signals
+
+### Signal Patterns
+
+```python
+# apps/users/signals.py
+from django.db.models.signals import post_save
+from django.dispatch import receiver
+from django.contrib.auth import get_user_model
+from .models import Profile
+
+User = get_user_model()
+
+@receiver(post_save, sender=User)
+def create_user_profile(sender, instance, created, **kwargs):
+    """Create profile when user is created."""
+    if created:
+        Profile.objects.create(user=instance)
+
+@receiver(post_save, sender=User)
+def save_user_profile(sender, instance, **kwargs):
+    """Save profile when user is saved."""
+    instance.profile.save()
+
+# apps/users/apps.py
+from django.apps import AppConfig
+
+class UsersConfig(AppConfig):
+    default_auto_field = 'django.db.models.BigAutoField'
+    name = 'apps.users'
+
+    def ready(self):
+        """Import signals when app is ready."""
+        import apps.users.signals
+```
+
+## Middleware
+
+### Custom Middleware
+
+```python
+# middleware/active_user_middleware.py
+import time
+from django.utils.deprecation import MiddlewareMixin
+
+class ActiveUserMiddleware(MiddlewareMixin):
+    """Middleware to track active users."""
+
+    def process_request(self, request):
+        """Process incoming request."""
+        if request.user.is_authenticated:
+            # Update last active time
+            request.user.last_active = timezone.now()
+            request.user.save(update_fields=['last_active'])
+
+class RequestLoggingMiddleware(MiddlewareMixin):
+    """Middleware for logging requests."""
+
+    def process_request(self, request):
+        """Log request start time."""
+        request.start_time = time.time()
+
+    def process_response(self, request, response):
+        """Log request duration."""
+        if hasattr(request, 'start_time'):
+            duration = time.time() - request.start_time
+            logger.info(f'{request.method} {request.path} - {response.status_code} - {duration:.3f}s')
+        return response
+```
+
+## Performance Optimization
+
+### N+1 Query Prevention
+
+```python
+# Bad - N+1 queries
+products = Product.objects.all()
+for product in products:
+    print(product.category.name)  # Separate query for each product
+
+# Good - Single query with select_related
+products = Product.objects.select_related('category').all()
+for product in products:
+    print(product.category.name)
+
+# Good - Prefetch for many-to-many
+products = Product.objects.prefetch_related('tags').all()
+for product in products:
+    for tag in product.tags.all():
+        print(tag.name)
+```
+
+### Database Indexing
+
+```python
+class Product(models.Model):
+    name = models.CharField(max_length=200, db_index=True)
+    slug = models.SlugField(unique=True)
+    category = models.ForeignKey('Category', on_delete=models.CASCADE)
+    created_at = models.DateTimeField(auto_now_add=True)
+
+    class Meta:
+        indexes = [
+            models.Index(fields=['name']),
+            models.Index(fields=['-created_at']),
+            models.Index(fields=['category', 'created_at']),
+        ]
+```
+
+### Bulk Operations
+
+```python
+# Bulk create
+Product.objects.bulk_create([
+    Product(name=f'Product {i}', price=10.00)
+    for i in range(1000)
+])
+
+# Bulk update
+products = Product.objects.all()[:100]
+for product in products:
+    product.is_active = True
+Product.objects.bulk_update(products, ['is_active'])
+
+# Bulk delete
+Product.objects.filter(stock=0).delete()
+```
+
+## Quick Reference
+
+| Pattern | Description |
+|---------|-------------|
+| Split settings | Separate dev/prod/test settings |
+| Custom QuerySet | Reusable query methods |
+| Service Layer | Business logic separation |
+| ViewSet | REST API endpoints |
+| Serializer validation | Request/response transformation |
+| select_related | Foreign key optimization |
+| prefetch_related | Many-to-many optimization |
+| Cache first | Cache expensive operations |
+| Signals | Event-driven actions |
+| Middleware | Request/response processing |
+
+Remember: Django provides many shortcuts, but for production applications, structure and organization matter more than concise code. Build for maintainability.

skills/django-security/SKILL.md

@@ -0,0 +1,592 @@
+---
+name: django-security
+description: Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.
+---
+
+# Django Security Best Practices
+
+Comprehensive security guidelines for Django applications to protect against common vulnerabilities.
+
+## When to Activate
+
+- Setting up Django authentication and authorization
+- Implementing user permissions and roles
+- Configuring production security settings
+- Reviewing Django application for security issues
+- Deploying Django applications to production
+
+## Core Security Settings
+
+### Production Settings Configuration
+
+```python
+# settings/production.py
+import os
+
+DEBUG = False  # CRITICAL: Never use True in production
+
+ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')
+
+# Security headers
+SECURE_SSL_REDIRECT = True
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+SECURE_HSTS_SECONDS = 31536000  # 1 year
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+SECURE_HSTS_PRELOAD = True
+SECURE_CONTENT_TYPE_NOSNIFF = True
+SECURE_BROWSER_XSS_FILTER = True
+X_FRAME_OPTIONS = 'DENY'
+
+# HTTPS and Cookies
+SESSION_COOKIE_HTTPONLY = True
+CSRF_COOKIE_HTTPONLY = True
+SESSION_COOKIE_SAMESITE = 'Lax'
+CSRF_COOKIE_SAMESITE = 'Lax'
+
+# Secret key (must be set via environment variable)
+SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY')
+if not SECRET_KEY:
+    raise ImproperlyConfigured('DJANGO_SECRET_KEY environment variable is required')
+
+# Password validation
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
+        'OPTIONS': {
+            'min_length': 12,
+        }
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
+    },
+    {
+        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
+    },
+]
+```
+
+## Authentication
+
+### Custom User Model
+
+```python
+# apps/users/models.py
+from django.contrib.auth.models import AbstractUser
+from django.db import models
+
+class User(AbstractUser):
+    """Custom user model for better security."""
+
+    email = models.EmailField(unique=True)
+    phone = models.CharField(max_length=20, blank=True)
+
+    USERNAME_FIELD = 'email'  # Use email as username
+    REQUIRED_FIELDS = ['username']
+
+    class Meta:
+        db_table = 'users'
+        verbose_name = 'User'
+        verbose_name_plural = 'Users'
+
+    def __str__(self):
+        return self.email
+
+# settings/base.py
+AUTH_USER_MODEL = 'users.User'
+```
+
+### Password Hashing
+
+```python
+# Django uses PBKDF2 by default. For stronger security:
+PASSWORD_HASHERS = [
+    'django.contrib.auth.hashers.Argon2PasswordHasher',
+    'django.contrib.auth.hashers.PBKDF2PasswordHasher',
+    'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
+    'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',
+]
+```
+
+### Session Management
+
+```python
+# Session configuration
+SESSION_ENGINE = 'django.contrib.sessions.backends.cache'  # Or 'db'
+SESSION_CACHE_ALIAS = 'default'
+SESSION_COOKIE_AGE = 3600 * 24 * 7  # 1 week
+SESSION_SAVE_EVERY_REQUEST = False
+SESSION_EXPIRE_AT_BROWSER_CLOSE = False  # Better UX, but less secure
+```
+
+## Authorization
+
+### Permissions
+
+```python
+# models.py
+from django.db import models
+from django.contrib.auth.models import Permission
+
+class Post(models.Model):
+    title = models.CharField(max_length=200)
+    content = models.TextField()
+    author = models.ForeignKey(User, on_delete=models.CASCADE)
+
+    class Meta:
+        permissions = [
+            ('can_publish', 'Can publish posts'),
+            ('can_edit_others', 'Can edit posts of others'),
+        ]
+
+    def user_can_edit(self, user):
+        """Check if user can edit this post."""
+        return self.author == user or user.has_perm('app.can_edit_others')
+
+# views.py
+from django.contrib.auth.mixins import LoginRequiredMixin, PermissionRequiredMixin
+from django.views.generic import UpdateView
+
+class PostUpdateView(LoginRequiredMixin, PermissionRequiredMixin, UpdateView):
+    model = Post
+    permission_required = 'app.can_edit_others'
+    raise_exception = True  # Return 403 instead of redirect
+
+    def get_queryset(self):
+        """Only allow users to edit their own posts."""
+        return Post.objects.filter(author=self.request.user)
+```
+
+### Custom Permissions
+
+```python
+# permissions.py
+from rest_framework import permissions
+
+class IsOwnerOrReadOnly(permissions.BasePermission):
+    """Allow only owners to edit objects."""
+
+    def has_object_permission(self, request, view, obj):
+        # Read permissions allowed for any request
+        if request.method in permissions.SAFE_METHODS:
+            return True
+
+        # Write permissions only for owner
+        return obj.author == request.user
+
+class IsAdminOrReadOnly(permissions.BasePermission):
+    """Allow admins to do anything, others read-only."""
+
+    def has_permission(self, request, view):
+        if request.method in permissions.SAFE_METHODS:
+            return True
+        return request.user and request.user.is_staff
+
+class IsVerifiedUser(permissions.BasePermission):
+    """Allow only verified users."""
+
+    def has_permission(self, request, view):
+        return request.user and request.user.is_authenticated and request.user.is_verified
+```
+
+### Role-Based Access Control (RBAC)
+
+```python
+# models.py
+from django.contrib.auth.models import AbstractUser, Group
+
+class User(AbstractUser):
+    ROLE_CHOICES = [
+        ('admin', 'Administrator'),
+        ('moderator', 'Moderator'),
+        ('user', 'Regular User'),
+    ]
+    role = models.CharField(max_length=20, choices=ROLE_CHOICES, default='user')
+
+    def is_admin(self):
+        return self.role == 'admin' or self.is_superuser
+
+    def is_moderator(self):
+        return self.role in ['admin', 'moderator']
+
+# Mixins
+class AdminRequiredMixin:
+    """Mixin to require admin role."""
+
+    def dispatch(self, request, *args, **kwargs):
+        if not request.user.is_authenticated or not request.user.is_admin():
+            from django.core.exceptions import PermissionDenied
+            raise PermissionDenied
+        return super().dispatch(request, *args, **kwargs)
+```
+
+## SQL Injection Prevention
+
+### Django ORM Protection
+
+```python
+# GOOD: Django ORM automatically escapes parameters
+def get_user(username):
+    return User.objects.get(username=username)  # Safe
+
+# GOOD: Using parameters with raw()
+def search_users(query):
+    return User.objects.raw('SELECT * FROM users WHERE username = %s', [query])
+
+# BAD: Never directly interpolate user input
+def get_user_bad(username):
+    return User.objects.raw(f'SELECT * FROM users WHERE username = {username}')  # VULNERABLE!
+
+# GOOD: Using filter with proper escaping
+def get_users_by_email(email):
+    return User.objects.filter(email__iexact=email)  # Safe
+
+# GOOD: Using Q objects for complex queries
+from django.db.models import Q
+def search_users_complex(query):
+    return User.objects.filter(
+        Q(username__icontains=query) |
+        Q(email__icontains=query)
+    )  # Safe
+```
+
+### Extra Security with raw()
+
+```python
+# If you must use raw SQL, always use parameters
+User.objects.raw(
+    'SELECT * FROM users WHERE email = %s AND status = %s',
+    [user_input_email, status]
+)
+```
+
+## XSS Prevention
+
+### Template Escaping
+
+```django
+{# Django auto-escapes variables by default - SAFE #}
+{{ user_input }}  {# Escaped HTML #}
+
+{# Explicitly mark safe only for trusted content #}
+{{ trusted_html|safe }}  {# Not escaped #}
+
+{# Use template filters for safe HTML #}
+{{ user_input|escape }}  {# Same as default #}
+{{ user_input|striptags }}  {# Remove all HTML tags #}
+
+{# JavaScript escaping #}
+<script>
+    var username = {{ username|escapejs }};
+</script>
+```
+
+### Safe String Handling
+
+```python
+from django.utils.safestring import mark_safe
+from django.utils.html import escape
+
+# BAD: Never mark user input as safe without escaping
+def render_bad(user_input):
+    return mark_safe(user_input)  # VULNERABLE!
+
+# GOOD: Escape first, then mark safe
+def render_good(user_input):
+    return mark_safe(escape(user_input))
+
+# GOOD: Use format_html for HTML with variables
+from django.utils.html import format_html
+
+def greet_user(username):
+    return format_html('<span class="user">{}</span>', escape(username))
+```
+
+### HTTP Headers
+
+```python
+# settings.py
+SECURE_CONTENT_TYPE_NOSNIFF = True  # Prevent MIME sniffing
+SECURE_BROWSER_XSS_FILTER = True  # Enable XSS filter
+X_FRAME_OPTIONS = 'DENY'  # Prevent clickjacking
+
+# Custom middleware
+from django.conf import settings
+
+class SecurityHeaderMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        response = self.get_response(request)
+        response['X-Content-Type-Options'] = 'nosniff'
+        response['X-Frame-Options'] = 'DENY'
+        response['X-XSS-Protection'] = '1; mode=block'
+        response['Content-Security-Policy'] = "default-src 'self'"
+        return response
+```
+
+## CSRF Protection
+
+### Default CSRF Protection
+
+```python
+# settings.py - CSRF is enabled by default
+CSRF_COOKIE_SECURE = True  # Only send over HTTPS
+CSRF_COOKIE_HTTPONLY = True  # Prevent JavaScript access
+CSRF_COOKIE_SAMESITE = 'Lax'  # Prevent CSRF in some cases
+CSRF_TRUSTED_ORIGINS = ['https://example.com']  # Trusted domains
+
+# Template usage
+<form method="post">
+    {% csrf_token %}
+    {{ form.as_p }}
+    <button type="submit">Submit</button>
+</form>
+
+# AJAX requests
+function getCookie(name) {
+    let cookieValue = null;
+    if (document.cookie && document.cookie !== '') {
+        const cookies = document.cookie.split(';');
+        for (let i = 0; i < cookies.length; i++) {
+            const cookie = cookies[i].trim();
+            if (cookie.substring(0, name.length + 1) === (name + '=')) {
+                cookieValue = decodeURIComponent(cookie.substring(name.length + 1));
+                break;
+            }
+        }
+    }
+    return cookieValue;
+}
+
+fetch('/api/endpoint/', {
+    method: 'POST',
+    headers: {
+        'X-CSRFToken': getCookie('csrftoken'),
+        'Content-Type': 'application/json',
+    },
+    body: JSON.stringify(data)
+});
+```
+
+### Exempting Views (Use Carefully)
+
+```python
+from django.views.decorators.csrf import csrf_exempt
+
+@csrf_exempt  # Only use when absolutely necessary!
+def webhook_view(request):
+    # Webhook from external service
+    pass
+```
+
+## File Upload Security
+
+### File Validation
+
+```python
+import os
+from django.core.exceptions import ValidationError
+
+def validate_file_extension(value):
+    """Validate file extension."""
+    ext = os.path.splitext(value.name)[1]
+    valid_extensions = ['.jpg', '.jpeg', '.png', '.gif', '.pdf']
+    if not ext.lower() in valid_extensions:
+        raise ValidationError('Unsupported file extension.')
+
+def validate_file_size(value):
+    """Validate file size (max 5MB)."""
+    filesize = value.size
+    if filesize > 5 * 1024 * 1024:
+        raise ValidationError('File too large. Max size is 5MB.')
+
+# models.py
+class Document(models.Model):
+    file = models.FileField(
+        upload_to='documents/',
+        validators=[validate_file_extension, validate_file_size]
+    )
+```
+
+### Secure File Storage
+
+```python
+# settings.py
+MEDIA_ROOT = '/var/www/media/'
+MEDIA_URL = '/media/'
+
+# Use a separate domain for media in production
+MEDIA_DOMAIN = 'https://media.example.com'
+
+# Don't serve user uploads directly
+# Use whitenoise or a CDN for static files
+# Use a separate server or S3 for media files
+```
+
+## API Security
+
+### Rate Limiting
+
+```python
+# settings.py
+REST_FRAMEWORK = {
+    'DEFAULT_THROTTLE_CLASSES': [
+        'rest_framework.throttling.AnonRateThrottle',
+        'rest_framework.throttling.UserRateThrottle'
+    ],
+    'DEFAULT_THROTTLE_RATES': {
+        'anon': '100/day',
+        'user': '1000/day',
+        'upload': '10/hour',
+    }
+}
+
+# Custom throttle
+from rest_framework.throttling import UserRateThrottle
+
+class BurstRateThrottle(UserRateThrottle):
+    scope = 'burst'
+    rate = '60/min'
+
+class SustainedRateThrottle(UserRateThrottle):
+    scope = 'sustained'
+    rate = '1000/day'
+```
+
+### Authentication for APIs
+
+```python
+# settings.py
+REST_FRAMEWORK = {
+    'DEFAULT_AUTHENTICATION_CLASSES': [
+        'rest_framework.authentication.TokenAuthentication',
+        'rest_framework.authentication.SessionAuthentication',
+        'rest_framework_simplejwt.authentication.JWTAuthentication',
+    ],
+    'DEFAULT_PERMISSION_CLASSES': [
+        'rest_framework.permissions.IsAuthenticated',
+    ],
+}
+
+# views.py
+from rest_framework.decorators import api_view, permission_classes
+from rest_framework.permissions import IsAuthenticated
+
+@api_view(['GET', 'POST'])
+@permission_classes([IsAuthenticated])
+def protected_view(request):
+    return Response({'message': 'You are authenticated'})
+```
+
+## Security Headers
+
+### Content Security Policy
+
+```python
+# settings.py
+CSP_DEFAULT_SRC = "'self'"
+CSP_SCRIPT_SRC = "'self' https://cdn.example.com"
+CSP_STYLE_SRC = "'self' 'unsafe-inline'"
+CSP_IMG_SRC = "'self' data: https:"
+CSP_CONNECT_SRC = "'self' https://api.example.com"
+
+# Middleware
+class CSPMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        response = self.get_response(request)
+        response['Content-Security-Policy'] = (
+            f"default-src {CSP_DEFAULT_SRC}; "
+            f"script-src {CSP_SCRIPT_SRC}; "
+            f"style-src {CSP_STYLE_SRC}; "
+            f"img-src {CSP_IMG_SRC}; "
+            f"connect-src {CSP_CONNECT_SRC}"
+        )
+        return response
+```
+
+## Environment Variables
+
+### Managing Secrets
+
+```python
+# Use python-decouple or django-environ
+import environ
+
+env = environ.Env(
+    # set casting, default value
+    DEBUG=(bool, False)
+)
+
+# reading .env file
+environ.Env.read_env()
+
+SECRET_KEY = env('DJANGO_SECRET_KEY')
+DATABASE_URL = env('DATABASE_URL')
+ALLOWED_HOSTS = env.list('ALLOWED_HOSTS')
+
+# .env file (never commit this)
+DEBUG=False
+SECRET_KEY=your-secret-key-here
+DATABASE_URL=postgresql://user:password@localhost:5432/dbname
+ALLOWED_HOSTS=example.com,www.example.com
+```
+
+## Logging Security Events
+
+```python
+# settings.py
+LOGGING = {
+    'version': 1,
+    'disable_existing_loggers': False,
+    'handlers': {
+        'file': {
+            'level': 'WARNING',
+            'class': 'logging.FileHandler',
+            'filename': '/var/log/django/security.log',
+        },
+        'console': {
+            'level': 'INFO',
+            'class': 'logging.StreamHandler',
+        },
+    },
+    'loggers': {
+        'django.security': {
+            'handlers': ['file', 'console'],
+            'level': 'WARNING',
+            'propagate': True,
+        },
+        'django.request': {
+            'handlers': ['file'],
+            'level': 'ERROR',
+            'propagate': False,
+        },
+    },
+}
+```
+
+## Quick Security Checklist
+
+| Check | Description |
+|-------|-------------|
+| `DEBUG = False` | Never run with DEBUG in production |
+| HTTPS only | Force SSL, secure cookies |
+| Strong secrets | Use environment variables for SECRET_KEY |
+| Password validation | Enable all password validators |
+| CSRF protection | Enabled by default, don't disable |
+| XSS prevention | Django auto-escapes, don't use `&#124;safe` with user input |
+| SQL injection | Use ORM, never concatenate strings in queries |
+| File uploads | Validate file type and size |
+| Rate limiting | Throttle API endpoints |
+| Security headers | CSP, X-Frame-Options, HSTS |
+| Logging | Log security events |
+| Updates | Keep Django and dependencies updated |
+
+Remember: Security is a process, not a product. Regularly review and update your security practices.

skills/django-tdd/SKILL.md

@@ -0,0 +1,728 @@
+---
+name: django-tdd
+description: Django testing strategies with pytest-django, TDD methodology, factory_boy, mocking, coverage, and testing Django REST Framework APIs.
+---
+
+# Django Testing with TDD
+
+Test-driven development for Django applications using pytest, factory_boy, and Django REST Framework.
+
+## When to Activate
+
+- Writing new Django applications
+- Implementing Django REST Framework APIs
+- Testing Django models, views, and serializers
+- Setting up testing infrastructure for Django projects
+
+## TDD Workflow for Django
+
+### Red-Green-Refactor Cycle
+
+```python
+# Step 1: RED - Write failing test
+def test_user_creation():
+    user = User.objects.create_user(email='test@example.com', password='testpass123')
+    assert user.email == 'test@example.com'
+    assert user.check_password('testpass123')
+    assert not user.is_staff
+
+# Step 2: GREEN - Make test pass
+# Create User model or factory
+
+# Step 3: REFACTOR - Improve while keeping tests green
+```
+
+## Setup
+
+### pytest Configuration
+
+```ini
+# pytest.ini
+[pytest]
+DJANGO_SETTINGS_MODULE = config.settings.test
+testpaths = tests
+python_files = test_*.py
+python_classes = Test*
+python_functions = test_*
+addopts =
+    --reuse-db
+    --nomigrations
+    --cov=apps
+    --cov-report=html
+    --cov-report=term-missing
+    --strict-markers
+markers =
+    slow: marks tests as slow
+    integration: marks tests as integration tests
+```
+
+### Test Settings
+
+```python
+# config/settings/test.py
+from .base import *
+
+DEBUG = True
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.db.backends.sqlite3',
+        'NAME': ':memory:',
+    }
+}
+
+# Disable migrations for speed
+class DisableMigrations:
+    def __contains__(self, item):
+        return True
+
+    def __getitem__(self, item):
+        return None
+
+MIGRATION_MODULES = DisableMigrations()
+
+# Faster password hashing
+PASSWORD_HASHERS = [
+    'django.contrib.auth.hashers.MD5PasswordHasher',
+]
+
+# Email backend
+EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend'
+
+# Celery always eager
+CELERY_TASK_ALWAYS_EAGER = True
+CELERY_TASK_EAGER_PROPAGATES = True
+```
+
+### conftest.py
+
+```python
+# tests/conftest.py
+import pytest
+from django.utils import timezone
+from django.contrib.auth import get_user_model
+
+User = get_user_model()
+
+@pytest.fixture(autouse=True)
+def timezone_settings(settings):
+    """Ensure consistent timezone."""
+    settings.TIME_ZONE = 'UTC'
+
+@pytest.fixture
+def user(db):
+    """Create a test user."""
+    return User.objects.create_user(
+        email='test@example.com',
+        password='testpass123',
+        username='testuser'
+    )
+
+@pytest.fixture
+def admin_user(db):
+    """Create an admin user."""
+    return User.objects.create_superuser(
+        email='admin@example.com',
+        password='adminpass123',
+        username='admin'
+    )
+
+@pytest.fixture
+def authenticated_client(client, user):
+    """Return authenticated client."""
+    client.force_login(user)
+    return client
+
+@pytest.fixture
+def api_client():
+    """Return DRF API client."""
+    from rest_framework.test import APIClient
+    return APIClient()
+
+@pytest.fixture
+def authenticated_api_client(api_client, user):
+    """Return authenticated API client."""
+    api_client.force_authenticate(user=user)
+    return api_client
+```
+
+## Factory Boy
+
+### Factory Setup
+
+```python
+# tests/factories.py
+import factory
+from factory import fuzzy
+from datetime import datetime, timedelta
+from django.contrib.auth import get_user_model
+from apps.products.models import Product, Category
+
+User = get_user_model()
+
+class UserFactory(factory.django.DjangoModelFactory):
+    """Factory for User model."""
+
+    class Meta:
+        model = User
+
+    email = factory.Sequence(lambda n: f"user{n}@example.com")
+    username = factory.Sequence(lambda n: f"user{n}")
+    password = factory.PostGenerationMethodCall('set_password', 'testpass123')
+    first_name = factory.Faker('first_name')
+    last_name = factory.Faker('last_name')
+    is_active = True
+
+class CategoryFactory(factory.django.DjangoModelFactory):
+    """Factory for Category model."""
+
+    class Meta:
+        model = Category
+
+    name = factory.Faker('word')
+    slug = factory.LazyAttribute(lambda obj: obj.name.lower())
+    description = factory.Faker('text')
+
+class ProductFactory(factory.django.DjangoModelFactory):
+    """Factory for Product model."""
+
+    class Meta:
+        model = Product
+
+    name = factory.Faker('sentence', nb_words=3)
+    slug = factory.LazyAttribute(lambda obj: obj.name.lower().replace(' ', '-'))
+    description = factory.Faker('text')
+    price = fuzzy.FuzzyDecimal(10.00, 1000.00, 2)
+    stock = fuzzy.FuzzyInteger(0, 100)
+    is_active = True
+    category = factory.SubFactory(CategoryFactory)
+    created_by = factory.SubFactory(UserFactory)
+
+    @factory.post_generation
+    def tags(self, create, extracted, **kwargs):
+        """Add tags to product."""
+        if not create:
+            return
+        if extracted:
+            for tag in extracted:
+                self.tags.add(tag)
+```
+
+### Using Factories
+
+```python
+# tests/test_models.py
+import pytest
+from tests.factories import ProductFactory, UserFactory
+
+def test_product_creation():
+    """Test product creation using factory."""
+    product = ProductFactory(price=100.00, stock=50)
+    assert product.price == 100.00
+    assert product.stock == 50
+    assert product.is_active is True
+
+def test_product_with_tags():
+    """Test product with tags."""
+    tags = [TagFactory(name='electronics'), TagFactory(name='new')]
+    product = ProductFactory(tags=tags)
+    assert product.tags.count() == 2
+
+def test_multiple_products():
+    """Test creating multiple products."""
+    products = ProductFactory.create_batch(10)
+    assert len(products) == 10
+```
+
+## Model Testing
+
+### Model Tests
+
+```python
+# tests/test_models.py
+import pytest
+from django.core.exceptions import ValidationError
+from tests.factories import UserFactory, ProductFactory
+
+class TestUserModel:
+    """Test User model."""
+
+    def test_create_user(self, db):
+        """Test creating a regular user."""
+        user = UserFactory(email='test@example.com')
+        assert user.email == 'test@example.com'
+        assert user.check_password('testpass123')
+        assert not user.is_staff
+        assert not user.is_superuser
+
+    def test_create_superuser(self, db):
+        """Test creating a superuser."""
+        user = UserFactory(
+            email='admin@example.com',
+            is_staff=True,
+            is_superuser=True
+        )
+        assert user.is_staff
+        assert user.is_superuser
+
+    def test_user_str(self, db):
+        """Test user string representation."""
+        user = UserFactory(email='test@example.com')
+        assert str(user) == 'test@example.com'
+
+class TestProductModel:
+    """Test Product model."""
+
+    def test_product_creation(self, db):
+        """Test creating a product."""
+        product = ProductFactory()
+        assert product.id is not None
+        assert product.is_active is True
+        assert product.created_at is not None
+
+    def test_product_slug_generation(self, db):
+        """Test automatic slug generation."""
+        product = ProductFactory(name='Test Product')
+        assert product.slug == 'test-product'
+
+    def test_product_price_validation(self, db):
+        """Test price cannot be negative."""
+        product = ProductFactory(price=-10)
+        with pytest.raises(ValidationError):
+            product.full_clean()
+
+    def test_product_manager_active(self, db):
+        """Test active manager method."""
+        ProductFactory.create_batch(5, is_active=True)
+        ProductFactory.create_batch(3, is_active=False)
+
+        active_count = Product.objects.active().count()
+        assert active_count == 5
+
+    def test_product_stock_management(self, db):
+        """Test stock management."""
+        product = ProductFactory(stock=10)
+        product.reduce_stock(5)
+        product.refresh_from_db()
+        assert product.stock == 5
+
+        with pytest.raises(ValueError):
+            product.reduce_stock(10)  # Not enough stock
+```
+
+## View Testing
+
+### Django View Testing
+
+```python
+# tests/test_views.py
+import pytest
+from django.urls import reverse
+from tests.factories import ProductFactory, UserFactory
+
+class TestProductViews:
+    """Test product views."""
+
+    def test_product_list(self, client, db):
+        """Test product list view."""
+        ProductFactory.create_batch(10)
+
+        response = client.get(reverse('products:list'))
+
+        assert response.status_code == 200
+        assert len(response.context['products']) == 10
+
+    def test_product_detail(self, client, db):
+        """Test product detail view."""
+        product = ProductFactory()
+
+        response = client.get(reverse('products:detail', kwargs={'slug': product.slug}))
+
+        assert response.status_code == 200
+        assert response.context['product'] == product
+
+    def test_product_create_requires_login(self, client, db):
+        """Test product creation requires authentication."""
+        response = client.get(reverse('products:create'))
+
+        assert response.status_code == 302
+        assert response.url.startswith('/accounts/login/')
+
+    def test_product_create_authenticated(self, authenticated_client, db):
+        """Test product creation as authenticated user."""
+        response = authenticated_client.get(reverse('products:create'))
+
+        assert response.status_code == 200
+
+    def test_product_create_post(self, authenticated_client, db, category):
+        """Test creating a product via POST."""
+        data = {
+            'name': 'Test Product',
+            'description': 'A test product',
+            'price': '99.99',
+            'stock': 10,
+            'category': category.id,
+        }
+
+        response = authenticated_client.post(reverse('products:create'), data)
+
+        assert response.status_code == 302
+        assert Product.objects.filter(name='Test Product').exists()
+```
+
+## DRF API Testing
+
+### Serializer Testing
+
+```python
+# tests/test_serializers.py
+import pytest
+from rest_framework.exceptions import ValidationError
+from apps.products.serializers import ProductSerializer
+from tests.factories import ProductFactory
+
+class TestProductSerializer:
+    """Test ProductSerializer."""
+
+    def test_serialize_product(self, db):
+        """Test serializing a product."""
+        product = ProductFactory()
+        serializer = ProductSerializer(product)
+
+        data = serializer.data
+
+        assert data['id'] == product.id
+        assert data['name'] == product.name
+        assert data['price'] == str(product.price)
+
+    def test_deserialize_product(self, db):
+        """Test deserializing product data."""
+        data = {
+            'name': 'Test Product',
+            'description': 'Test description',
+            'price': '99.99',
+            'stock': 10,
+            'category': 1,
+        }
+
+        serializer = ProductSerializer(data=data)
+
+        assert serializer.is_valid()
+        product = serializer.save()
+
+        assert product.name == 'Test Product'
+        assert float(product.price) == 99.99
+
+    def test_price_validation(self, db):
+        """Test price validation."""
+        data = {
+            'name': 'Test Product',
+            'price': '-10.00',
+            'stock': 10,
+        }
+
+        serializer = ProductSerializer(data=data)
+
+        assert not serializer.is_valid()
+        assert 'price' in serializer.errors
+
+    def test_stock_validation(self, db):
+        """Test stock cannot be negative."""
+        data = {
+            'name': 'Test Product',
+            'price': '99.99',
+            'stock': -5,
+        }
+
+        serializer = ProductSerializer(data=data)
+
+        assert not serializer.is_valid()
+        assert 'stock' in serializer.errors
+```
+
+### API ViewSet Testing
+
+```python
+# tests/test_api.py
+import pytest
+from rest_framework.test import APIClient
+from rest_framework import status
+from django.urls import reverse
+from tests.factories import ProductFactory, UserFactory
+
+class TestProductAPI:
+    """Test Product API endpoints."""
+
+    @pytest.fixture
+    def api_client(self):
+        """Return API client."""
+        return APIClient()
+
+    def test_list_products(self, api_client, db):
+        """Test listing products."""
+        ProductFactory.create_batch(10)
+
+        url = reverse('api:product-list')
+        response = api_client.get(url)
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data['count'] == 10
+
+    def test_retrieve_product(self, api_client, db):
+        """Test retrieving a product."""
+        product = ProductFactory()
+
+        url = reverse('api:product-detail', kwargs={'pk': product.id})
+        response = api_client.get(url)
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data['id'] == product.id
+
+    def test_create_product_unauthorized(self, api_client, db):
+        """Test creating product without authentication."""
+        url = reverse('api:product-list')
+        data = {'name': 'Test Product', 'price': '99.99'}
+
+        response = api_client.post(url, data)
+
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+
+    def test_create_product_authorized(self, authenticated_api_client, db):
+        """Test creating product as authenticated user."""
+        url = reverse('api:product-list')
+        data = {
+            'name': 'Test Product',
+            'description': 'Test',
+            'price': '99.99',
+            'stock': 10,
+        }
+
+        response = authenticated_api_client.post(url, data)
+
+        assert response.status_code == status.HTTP_201_CREATED
+        assert response.data['name'] == 'Test Product'
+
+    def test_update_product(self, authenticated_api_client, db):
+        """Test updating a product."""
+        product = ProductFactory(created_by=authenticated_api_client.user)
+
+        url = reverse('api:product-detail', kwargs={'pk': product.id})
+        data = {'name': 'Updated Product'}
+
+        response = authenticated_api_client.patch(url, data)
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data['name'] == 'Updated Product'
+
+    def test_delete_product(self, authenticated_api_client, db):
+        """Test deleting a product."""
+        product = ProductFactory(created_by=authenticated_api_client.user)
+
+        url = reverse('api:product-detail', kwargs={'pk': product.id})
+        response = authenticated_api_client.delete(url)
+
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+
+    def test_filter_products_by_price(self, api_client, db):
+        """Test filtering products by price."""
+        ProductFactory(price=50)
+        ProductFactory(price=150)
+
+        url = reverse('api:product-list')
+        response = api_client.get(url, {'price_min': 100})
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data['count'] == 1
+
+    def test_search_products(self, api_client, db):
+        """Test searching products."""
+        ProductFactory(name='Apple iPhone')
+        ProductFactory(name='Samsung Galaxy')
+
+        url = reverse('api:product-list')
+        response = api_client.get(url, {'search': 'Apple'})
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.data['count'] == 1
+```
+
+## Mocking and Patching
+
+### Mocking External Services
+
+```python
+# tests/test_views.py
+from unittest.mock import patch, Mock
+import pytest
+
+class TestPaymentView:
+    """Test payment view with mocked payment gateway."""
+
+    @patch('apps.payments.services.stripe')
+    def test_successful_payment(self, mock_stripe, client, user, product):
+        """Test successful payment with mocked Stripe."""
+        # Configure mock
+        mock_stripe.Charge.create.return_value = {
+            'id': 'ch_123',
+            'status': 'succeeded',
+            'amount': 9999,
+        }
+
+        client.force_login(user)
+        response = client.post(reverse('payments:process'), {
+            'product_id': product.id,
+            'token': 'tok_visa',
+        })
+
+        assert response.status_code == 302
+        mock_stripe.Charge.create.assert_called_once()
+
+    @patch('apps.payments.services.stripe')
+    def test_failed_payment(self, mock_stripe, client, user, product):
+        """Test failed payment."""
+        mock_stripe.Charge.create.side_effect = Exception('Card declined')
+
+        client.force_login(user)
+        response = client.post(reverse('payments:process'), {
+            'product_id': product.id,
+            'token': 'tok_visa',
+        })
+
+        assert response.status_code == 302
+        assert 'error' in response.url
+```
+
+### Mocking Email Sending
+
+```python
+# tests/test_email.py
+from django.core import mail
+from django.test import override_settings
+
+@override_settings(EMAIL_BACKEND='django.core.mail.backends.locmem.EmailBackend')
+def test_order_confirmation_email(db, order):
+    """Test order confirmation email."""
+    order.send_confirmation_email()
+
+    assert len(mail.outbox) == 1
+    assert order.user.email in mail.outbox[0].to
+    assert 'Order Confirmation' in mail.outbox[0].subject
+```
+
+## Integration Testing
+
+### Full Flow Testing
+
+```python
+# tests/test_integration.py
+import pytest
+from django.urls import reverse
+from tests.factories import UserFactory, ProductFactory
+
+class TestCheckoutFlow:
+    """Test complete checkout flow."""
+
+    def test_guest_to_purchase_flow(self, client, db):
+        """Test complete flow from guest to purchase."""
+        # Step 1: Register
+        response = client.post(reverse('users:register'), {
+            'email': 'test@example.com',
+            'password': 'testpass123',
+            'password_confirm': 'testpass123',
+        })
+        assert response.status_code == 302
+
+        # Step 2: Login
+        response = client.post(reverse('users:login'), {
+            'email': 'test@example.com',
+            'password': 'testpass123',
+        })
+        assert response.status_code == 302
+
+        # Step 3: Browse products
+        product = ProductFactory(price=100)
+        response = client.get(reverse('products:detail', kwargs={'slug': product.slug}))
+        assert response.status_code == 200
+
+        # Step 4: Add to cart
+        response = client.post(reverse('cart:add'), {
+            'product_id': product.id,
+            'quantity': 1,
+        })
+        assert response.status_code == 302
+
+        # Step 5: Checkout
+        response = client.get(reverse('checkout:review'))
+        assert response.status_code == 200
+        assert product.name in response.content.decode()
+
+        # Step 6: Complete purchase
+        with patch('apps.checkout.services.process_payment') as mock_payment:
+            mock_payment.return_value = True
+            response = client.post(reverse('checkout:complete'))
+
+        assert response.status_code == 302
+        assert Order.objects.filter(user__email='test@example.com').exists()
+```
+
+## Testing Best Practices
+
+### DO
+
+- **Use factories**: Instead of manual object creation
+- **One assertion per test**: Keep tests focused
+- **Descriptive test names**: `test_user_cannot_delete_others_post`
+- **Test edge cases**: Empty inputs, None values, boundary conditions
+- **Mock external services**: Don't depend on external APIs
+- **Use fixtures**: Eliminate duplication
+- **Test permissions**: Ensure authorization works
+- **Keep tests fast**: Use `--reuse-db` and `--nomigrations`
+
+### DON'T
+
+- **Don't test Django internals**: Trust Django to work
+- **Don't test third-party code**: Trust libraries to work
+- **Don't ignore failing tests**: All tests must pass
+- **Don't make tests dependent**: Tests should run in any order
+- **Don't over-mock**: Mock only external dependencies
+- **Don't test private methods**: Test public interface
+- **Don't use production database**: Always use test database
+
+## Coverage
+
+### Coverage Configuration
+
+```bash
+# Run tests with coverage
+pytest --cov=apps --cov-report=html --cov-report=term-missing
+
+# Generate HTML report
+open htmlcov/index.html
+```
+
+### Coverage Goals
+
+| Component | Target Coverage |
+|-----------|-----------------|
+| Models | 90%+ |
+| Serializers | 85%+ |
+| Views | 80%+ |
+| Services | 90%+ |
+| Utilities | 80%+ |
+| Overall | 80%+ |
+
+## Quick Reference
+
+| Pattern | Usage |
+|---------|-------|
+| `@pytest.mark.django_db` | Enable database access |
+| `client` | Django test client |
+| `api_client` | DRF API client |
+| `factory.create_batch(n)` | Create multiple objects |
+| `patch('module.function')` | Mock external dependencies |
+| `override_settings` | Temporarily change settings |
+| `force_authenticate()` | Bypass authentication in tests |
+| `assertRedirects` | Check for redirects |
+| `assertTemplateUsed` | Verify template usage |
+| `mail.outbox` | Check sent emails |
+
+Remember: Tests are documentation. Good tests explain how your code should work. Keep them simple, readable, and maintainable.

skills/django-verification/SKILL.md

@@ -0,0 +1,460 @@
+---
+name: django-verification
+description: Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR.
+---
+
+# Django Verification Loop
+
+Run before PRs, after major changes, and pre-deploy to ensure Django application quality and security.
+
+## Phase 1: Environment Check
+
+```bash
+# Verify Python version
+python --version  # Should match project requirements
+
+# Check virtual environment
+which python
+pip list --outdated
+
+# Verify environment variables
+python -c "import os; import environ; print('DJANGO_SECRET_KEY set' if os.environ.get('DJANGO_SECRET_KEY') else 'MISSING: DJANGO_SECRET_KEY')"
+```
+
+If environment is misconfigured, stop and fix.
+
+## Phase 2: Code Quality & Formatting
+
+```bash
+# Type checking
+mypy . --config-file pyproject.toml
+
+# Linting with ruff
+ruff check . --fix
+
+# Formatting with black
+black . --check
+black .  # Auto-fix
+
+# Import sorting
+isort . --check-only
+isort .  # Auto-fix
+
+# Django-specific checks
+python manage.py check --deploy
+```
+
+Common issues:
+- Missing type hints on public functions
+- PEP 8 formatting violations
+- Unsorted imports
+- Debug settings left in production configuration
+
+## Phase 3: Migrations
+
+```bash
+# Check for unapplied migrations
+python manage.py showmigrations
+
+# Create missing migrations
+python manage.py makemigrations --check
+
+# Dry-run migration application
+python manage.py migrate --plan
+
+# Apply migrations (test environment)
+python manage.py migrate
+
+# Check for migration conflicts
+python manage.py makemigrations --merge  # Only if conflicts exist
+```
+
+Report:
+- Number of pending migrations
+- Any migration conflicts
+- Model changes without migrations
+
+## Phase 4: Tests + Coverage
+
+```bash
+# Run all tests with pytest
+pytest --cov=apps --cov-report=html --cov-report=term-missing --reuse-db
+
+# Run specific app tests
+pytest apps/users/tests/
+
+# Run with markers
+pytest -m "not slow"  # Skip slow tests
+pytest -m integration  # Only integration tests
+
+# Coverage report
+open htmlcov/index.html
+```
+
+Report:
+- Total tests: X passed, Y failed, Z skipped
+- Overall coverage: XX%
+- Per-app coverage breakdown
+
+Coverage targets:
+
+| Component | Target |
+|-----------|--------|
+| Models | 90%+ |
+| Serializers | 85%+ |
+| Views | 80%+ |
+| Services | 90%+ |
+| Overall | 80%+ |
+
+## Phase 5: Security Scan
+
+```bash
+# Dependency vulnerabilities
+pip-audit
+safety check --full-report
+
+# Django security checks
+python manage.py check --deploy
+
+# Bandit security linter
+bandit -r . -f json -o bandit-report.json
+
+# Secret scanning (if gitleaks is installed)
+gitleaks detect --source . --verbose
+
+# Environment variable check
+python -c "from django.core.exceptions import ImproperlyConfigured; from django.conf import settings; settings.DEBUG"
+```
+
+Report:
+- Vulnerable dependencies found
+- Security configuration issues
+- Hardcoded secrets detected
+- DEBUG mode status (should be False in production)
+
+## Phase 6: Django Management Commands
+
+```bash
+# Check for model issues
+python manage.py check
+
+# Collect static files
+python manage.py collectstatic --noinput --clear
+
+# Create superuser (if needed for tests)
+echo "from apps.users.models import User; User.objects.create_superuser('admin@example.com', 'admin')" | python manage.py shell
+
+# Database integrity
+python manage.py check --database default
+
+# Cache verification (if using Redis)
+python -c "from django.core.cache import cache; cache.set('test', 'value', 10); print(cache.get('test'))"
+```
+
+## Phase 7: Performance Checks
+
+```bash
+# Django Debug Toolbar output (check for N+1 queries)
+# Run in dev mode with DEBUG=True and access a page
+# Look for duplicate queries in SQL panel
+
+# Query count analysis
+django-admin debugsqlshell  # If django-debug-sqlshell installed
+
+# Check for missing indexes
+python manage.py shell << EOF
+from django.db import connection
+with connection.cursor() as cursor:
+    cursor.execute("SELECT table_name, index_name FROM information_schema.statistics WHERE table_schema = 'public'")
+    print(cursor.fetchall())
+EOF
+```
+
+Report:
+- Number of queries per page (should be < 50 for typical pages)
+- Missing database indexes
+- Duplicate queries detected
+
+## Phase 8: Static Assets
+
+```bash
+# Check for npm dependencies (if using npm)
+npm audit
+npm audit fix
+
+# Build static files (if using webpack/vite)
+npm run build
+
+# Verify static files
+ls -la staticfiles/
+python manage.py findstatic css/style.css
+```
+
+## Phase 9: Configuration Review
+
+```python
+# Run in Python shell to verify settings
+python manage.py shell << EOF
+from django.conf import settings
+import os
+
+# Critical checks
+checks = {
+    'DEBUG is False': not settings.DEBUG,
+    'SECRET_KEY set': bool(settings.SECRET_KEY and len(settings.SECRET_KEY) > 30),
+    'ALLOWED_HOSTS set': len(settings.ALLOWED_HOSTS) > 0,
+    'HTTPS enabled': getattr(settings, 'SECURE_SSL_REDIRECT', False),
+    'HSTS enabled': getattr(settings, 'SECURE_HSTS_SECONDS', 0) > 0,
+    'Database configured': settings.DATABASES['default']['ENGINE'] != 'django.db.backends.sqlite3',
+}
+
+for check, result in checks.items():
+    status = '✓' if result else '✗'
+    print(f"{status} {check}")
+EOF
+```
+
+## Phase 10: Logging Configuration
+
+```bash
+# Test logging output
+python manage.py shell << EOF
+import logging
+logger = logging.getLogger('django')
+logger.warning('Test warning message')
+logger.error('Test error message')
+EOF
+
+# Check log files (if configured)
+tail -f /var/log/django/django.log
+```
+
+## Phase 11: API Documentation (if DRF)
+
+```bash
+# Generate schema
+python manage.py generateschema --format openapi-json > schema.json
+
+# Validate schema
+# Check if schema.json is valid JSON
+python -c "import json; json.load(open('schema.json'))"
+
+# Access Swagger UI (if using drf-yasg)
+# Visit http://localhost:8000/swagger/ in browser
+```
+
+## Phase 12: Diff Review
+
+```bash
+# Show diff statistics
+git diff --stat
+
+# Show actual changes
+git diff
+
+# Show changed files
+git diff --name-only
+
+# Check for common issues
+git diff | grep -i "todo\|fixme\|hack\|xxx"
+git diff | grep "print("  # Debug statements
+git diff | grep "DEBUG = True"  # Debug mode
+git diff | grep "import pdb"  # Debugger
+```
+
+Checklist:
+- No debugging statements (print, pdb, breakpoint())
+- No TODO/FIXME comments in critical code
+- No hardcoded secrets or credentials
+- Database migrations included for model changes
+- Configuration changes documented
+- Error handling present for external calls
+- Transaction management where needed
+
+## Output Template
+
+```
+DJANGO VERIFICATION REPORT
+==========================
+
+Phase 1: Environment Check
+  ✓ Python 3.11.5
+  ✓ Virtual environment active
+  ✓ All environment variables set
+
+Phase 2: Code Quality
+  ✓ mypy: No type errors
+  ✗ ruff: 3 issues found (auto-fixed)
+  ✓ black: No formatting issues
+  ✓ isort: Imports properly sorted
+  ✓ manage.py check: No issues
+
+Phase 3: Migrations
+  ✓ No unapplied migrations
+  ✓ No migration conflicts
+  ✓ All models have migrations
+
+Phase 4: Tests + Coverage
+  Tests: 247 passed, 0 failed, 5 skipped
+  Coverage:
+    Overall: 87%
+    users: 92%
+    products: 89%
+    orders: 85%
+    payments: 91%
+
+Phase 5: Security Scan
+  ✗ pip-audit: 2 vulnerabilities found (fix required)
+  ✓ safety check: No issues
+  ✓ bandit: No security issues
+  ✓ No secrets detected
+  ✓ DEBUG = False
+
+Phase 6: Django Commands
+  ✓ collectstatic completed
+  ✓ Database integrity OK
+  ✓ Cache backend reachable
+
+Phase 7: Performance
+  ✓ No N+1 queries detected
+  ✓ Database indexes configured
+  ✓ Query count acceptable
+
+Phase 8: Static Assets
+  ✓ npm audit: No vulnerabilities
+  ✓ Assets built successfully
+  ✓ Static files collected
+
+Phase 9: Configuration
+  ✓ DEBUG = False
+  ✓ SECRET_KEY configured
+  ✓ ALLOWED_HOSTS set
+  ✓ HTTPS enabled
+  ✓ HSTS enabled
+  ✓ Database configured
+
+Phase 10: Logging
+  ✓ Logging configured
+  ✓ Log files writable
+
+Phase 11: API Documentation
+  ✓ Schema generated
+  ✓ Swagger UI accessible
+
+Phase 12: Diff Review
+  Files changed: 12
+  +450, -120 lines
+  ✓ No debug statements
+  ✓ No hardcoded secrets
+  ✓ Migrations included
+
+RECOMMENDATION: ⚠️ Fix pip-audit vulnerabilities before deploying
+
+NEXT STEPS:
+1. Update vulnerable dependencies
+2. Re-run security scan
+3. Deploy to staging for final testing
+```
+
+## Pre-Deployment Checklist
+
+- [ ] All tests passing
+- [ ] Coverage ≥ 80%
+- [ ] No security vulnerabilities
+- [ ] No unapplied migrations
+- [ ] DEBUG = False in production settings
+- [ ] SECRET_KEY properly configured
+- [ ] ALLOWED_HOSTS set correctly
+- [ ] Database backups enabled
+- [ ] Static files collected and served
+- [ ] Logging configured and working
+- [ ] Error monitoring (Sentry, etc.) configured
+- [ ] CDN configured (if applicable)
+- [ ] Redis/cache backend configured
+- [ ] Celery workers running (if applicable)
+- [ ] HTTPS/SSL configured
+- [ ] Environment variables documented
+
+## Continuous Integration
+
+### GitHub Actions Example
+
+```yaml
+# .github/workflows/django-verification.yml
+name: Django Verification
+
+on: [push, pull_request]
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:14
+        env:
+          POSTGRES_PASSWORD: postgres
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Cache pip
+        uses: actions/cache@v3
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+
+      - name: Install dependencies
+        run: |
+          pip install -r requirements.txt
+          pip install ruff black mypy pytest pytest-django pytest-cov bandit safety pip-audit
+
+      - name: Code quality checks
+        run: |
+          ruff check .
+          black . --check
+          isort . --check-only
+          mypy .
+
+      - name: Security scan
+        run: |
+          bandit -r . -f json -o bandit-report.json
+          safety check --full-report
+          pip-audit
+
+      - name: Run tests
+        env:
+          DATABASE_URL: postgres://postgres:postgres@localhost:5432/test
+          DJANGO_SECRET_KEY: test-secret-key
+        run: |
+          pytest --cov=apps --cov-report=xml --cov-report=term-missing
+
+      - name: Upload coverage
+        uses: codecov/codecov-action@v3
+```
+
+## Quick Reference
+
+| Check | Command |
+|-------|---------|
+| Environment | `python --version` |
+| Type checking | `mypy .` |
+| Linting | `ruff check .` |
+| Formatting | `black . --check` |
+| Migrations | `python manage.py makemigrations --check` |
+| Tests | `pytest --cov=apps` |
+| Security | `pip-audit && bandit -r .` |
+| Django check | `python manage.py check --deploy` |
+| Collectstatic | `python manage.py collectstatic --noinput` |
+| Diff stats | `git diff --stat` |
+
+Remember: Automated verification catches common issues but doesn't replace manual code review and testing in staging environment.

skills/python-patterns/SKILL.md

@@ -0,0 +1,749 @@
+---
+name: python-patterns
+description: Pythonic idioms, PEP 8 standards, type hints, and best practices for building robust, efficient, and maintainable Python applications.
+---
+
+# Python Development Patterns
+
+Idiomatic Python patterns and best practices for building robust, efficient, and maintainable applications.
+
+## When to Activate
+
+- Writing new Python code
+- Reviewing Python code
+- Refactoring existing Python code
+- Designing Python packages/modules
+
+## Core Principles
+
+### 1. Readability Counts
+
+Python prioritizes readability. Code should be obvious and easy to understand.
+
+```python
+# Good: Clear and readable
+def get_active_users(users: list[User]) -> list[User]:
+    """Return only active users from the provided list."""
+    return [user for user in users if user.is_active]
+
+
+# Bad: Clever but confusing
+def get_active_users(u):
+    return [x for x in u if x.a]
+```
+
+### 2. Explicit is Better Than Implicit
+
+Avoid magic; be clear about what your code does.
+
+```python
+# Good: Explicit configuration
+import logging
+
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
+)
+
+# Bad: Hidden side effects
+import some_module
+some_module.setup()  # What does this do?
+```
+
+### 3. EAFP - Easier to Ask Forgiveness Than Permission
+
+Python prefers exception handling over checking conditions.
+
+```python
+# Good: EAFP style
+def get_value(dictionary: dict, key: str) -> Any:
+    try:
+        return dictionary[key]
+    except KeyError:
+        return default_value
+
+# Bad: LBYL (Look Before You Leap) style
+def get_value(dictionary: dict, key: str) -> Any:
+    if key in dictionary:
+        return dictionary[key]
+    else:
+        return default_value
+```
+
+## Type Hints
+
+### Basic Type Annotations
+
+```python
+from typing import Optional, List, Dict, Any
+
+def process_user(
+    user_id: str,
+    data: Dict[str, Any],
+    active: bool = True
+) -> Optional[User]:
+    """Process a user and return the updated User or None."""
+    if not active:
+        return None
+    return User(user_id, data)
+```
+
+### Modern Type Hints (Python 3.9+)
+
+```python
+# Python 3.9+ - Use built-in types
+def process_items(items: list[str]) -> dict[str, int]:
+    return {item: len(item) for item in items}
+
+# Python 3.8 and earlier - Use typing module
+from typing import List, Dict
+
+def process_items(items: List[str]) -> Dict[str, int]:
+    return {item: len(item) for item in items}
+```
+
+### Type Aliases and TypeVar
+
+```python
+from typing import TypeVar, Union
+
+# Type alias for complex types
+JSON = Union[dict[str, Any], list[Any], str, int, float, bool, None]
+
+def parse_json(data: str) -> JSON:
+    return json.loads(data)
+
+# Generic types
+T = TypeVar('T')
+
+def first(items: list[T]) -> T | None:
+    """Return the first item or None if list is empty."""
+    return items[0] if items else None
+```
+
+### Protocol-Based Duck Typing
+
+```python
+from typing import Protocol
+
+class Renderable(Protocol):
+    def render(self) -> str:
+        """Render the object to a string."""
+
+def render_all(items: list[Renderable]) -> str:
+    """Render all items that implement the Renderable protocol."""
+    return "\n".join(item.render() for item in items)
+```
+
+## Error Handling Patterns
+
+### Specific Exception Handling
+
+```python
+# Good: Catch specific exceptions
+def load_config(path: str) -> Config:
+    try:
+        with open(path) as f:
+            return Config.from_json(f.read())
+    except FileNotFoundError as e:
+        raise ConfigError(f"Config file not found: {path}") from e
+    except json.JSONDecodeError as e:
+        raise ConfigError(f"Invalid JSON in config: {path}") from e
+
+# Bad: Bare except
+def load_config(path: str) -> Config:
+    try:
+        with open(path) as f:
+            return Config.from_json(f.read())
+    except:
+        return None  # Silent failure!
+```
+
+### Exception Chaining
+
+```python
+def process_data(data: str) -> Result:
+    try:
+        parsed = json.loads(data)
+    except json.JSONDecodeError as e:
+        # Chain exceptions to preserve the traceback
+        raise ValueError(f"Failed to parse data: {data}") from e
+```
+
+### Custom Exception Hierarchy
+
+```python
+class AppError(Exception):
+    """Base exception for all application errors."""
+    pass
+
+class ValidationError(AppError):
+    """Raised when input validation fails."""
+    pass
+
+class NotFoundError(AppError):
+    """Raised when a requested resource is not found."""
+    pass
+
+# Usage
+def get_user(user_id: str) -> User:
+    user = db.find_user(user_id)
+    if not user:
+        raise NotFoundError(f"User not found: {user_id}")
+    return user
+```
+
+## Context Managers
+
+### Resource Management
+
+```python
+# Good: Using context managers
+def process_file(path: str) -> str:
+    with open(path, 'r') as f:
+        return f.read()
+
+# Bad: Manual resource management
+def process_file(path: str) -> str:
+    f = open(path, 'r')
+    try:
+        return f.read()
+    finally:
+        f.close()
+```
+
+### Custom Context Managers
+
+```python
+from contextlib import contextmanager
+
+@contextmanager
+def timer(name: str):
+    """Context manager to time a block of code."""
+    start = time.perf_counter()
+    yield
+    elapsed = time.perf_counter() - start
+    print(f"{name} took {elapsed:.4f} seconds")
+
+# Usage
+with timer("data processing"):
+    process_large_dataset()
+```
+
+### Context Manager Classes
+
+```python
+class DatabaseTransaction:
+    def __init__(self, connection):
+        self.connection = connection
+
+    def __enter__(self):
+        self.connection.begin_transaction()
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        if exc_type is None:
+            self.connection.commit()
+        else:
+            self.connection.rollback()
+        return False  # Don't suppress exceptions
+
+# Usage
+with DatabaseTransaction(conn):
+    user = conn.create_user(user_data)
+    conn.create_profile(user.id, profile_data)
+```
+
+## Comprehensions and Generators
+
+### List Comprehensions
+
+```python
+# Good: List comprehension for simple transformations
+names = [user.name for user in users if user.is_active]
+
+# Bad: Manual loop
+names = []
+for user in users:
+    if user.is_active:
+        names.append(user.name)
+
+# Complex comprehensions should be expanded
+# Bad: Too complex
+result = [x * 2 for x in items if x > 0 if x % 2 == 0]
+
+# Good: Use a generator function
+def filter_and_transform(items: Iterable[int]) -> list[int]:
+    result = []
+    for x in items:
+        if x > 0 and x % 2 == 0:
+            result.append(x * 2)
+    return result
+```
+
+### Generator Expressions
+
+```python
+# Good: Generator for lazy evaluation
+total = sum(x * x for x in range(1_000_000))
+
+# Bad: Creates large intermediate list
+total = sum([x * x for x in range(1_000_000)])
+```
+
+### Generator Functions
+
+```python
+def read_large_file(path: str) -> Iterator[str]:
+    """Read a large file line by line."""
+    with open(path) as f:
+        for line in f:
+            yield line.strip()
+
+# Usage
+for line in read_large_file("huge.txt"):
+    process(line)
+```
+
+## Data Classes and Named Tuples
+
+### Data Classes
+
+```python
+from dataclasses import dataclass, field
+from datetime import datetime
+
+@dataclass
+class User:
+    """User entity with automatic __init__, __repr__, and __eq__."""
+    id: str
+    name: str
+    email: str
+    created_at: datetime = field(default_factory=datetime.now)
+    is_active: bool = True
+
+# Usage
+user = User(
+    id="123",
+    name="Alice",
+    email="alice@example.com"
+)
+```
+
+### Data Classes with Validation
+
+```python
+@dataclass
+class User:
+    email: str
+    age: int
+
+    def __post_init__(self):
+        # Validate email format
+        if "@" not in self.email:
+            raise ValueError(f"Invalid email: {self.email}")
+        # Validate age range
+        if self.age < 0 or self.age > 150:
+            raise ValueError(f"Invalid age: {self.age}")
+```
+
+### Named Tuples
+
+```python
+from typing import NamedTuple
+
+class Point(NamedTuple):
+    """Immutable 2D point."""
+    x: float
+    y: float
+
+    def distance(self, other: 'Point') -> float:
+        return ((self.x - other.x) ** 2 + (self.y - other.y) ** 2) ** 0.5
+
+# Usage
+p1 = Point(0, 0)
+p2 = Point(3, 4)
+print(p1.distance(p2))  # 5.0
+```
+
+## Decorators
+
+### Function Decorators
+
+```python
+import functools
+import time
+
+def timer(func: Callable) -> Callable:
+    """Decorator to time function execution."""
+    @functools.wraps(func)
+    def wrapper(*args, **kwargs):
+        start = time.perf_counter()
+        result = func(*args, **kwargs)
+        elapsed = time.perf_counter() - start
+        print(f"{func.__name__} took {elapsed:.4f}s")
+        return result
+    return wrapper
+
+@timer
+def slow_function():
+    time.sleep(1)
+
+# slow_function() prints: slow_function took 1.0012s
+```
+
+### Parameterized Decorators
+
+```python
+def repeat(times: int):
+    """Decorator to repeat a function multiple times."""
+    def decorator(func: Callable) -> Callable:
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            results = []
+            for _ in range(times):
+                results.append(func(*args, **kwargs))
+            return results
+        return wrapper
+    return decorator
+
+@repeat(times=3)
+def greet(name: str) -> str:
+    return f"Hello, {name}!"
+
+# greet("Alice") returns ["Hello, Alice!", "Hello, Alice!", "Hello, Alice!"]
+```
+
+### Class-Based Decorators
+
+```python
+class CountCalls:
+    """Decorator that counts how many times a function is called."""
+    def __init__(self, func: Callable):
+        functools.update_wrapper(self, func)
+        self.func = func
+        self.count = 0
+
+    def __call__(self, *args, **kwargs):
+        self.count += 1
+        print(f"{self.func.__name__} has been called {self.count} times")
+        return self.func(*args, **kwargs)
+
+@CountCalls
+def process():
+    pass
+
+# Each call to process() prints the call count
+```
+
+## Concurrency Patterns
+
+### Threading for I/O-Bound Tasks
+
+```python
+import concurrent.futures
+import threading
+
+def fetch_url(url: str) -> str:
+    """Fetch a URL (I/O-bound operation)."""
+    import urllib.request
+    with urllib.request.urlopen(url) as response:
+        return response.read().decode()
+
+def fetch_all_urls(urls: list[str]) -> dict[str, str]:
+    """Fetch multiple URLs concurrently using threads."""
+    with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
+        future_to_url = {executor.submit(fetch_url, url): url for url in urls}
+        results = {}
+        for future in concurrent.futures.as_completed(future_to_url):
+            url = future_to_url[future]
+            try:
+                results[url] = future.result()
+            except Exception as e:
+                results[url] = f"Error: {e}"
+    return results
+```
+
+### Multiprocessing for CPU-Bound Tasks
+
+```python
+def process_data(data: list[int]) -> int:
+    """CPU-intensive computation."""
+    return sum(x ** 2 for x in data)
+
+def process_all(datasets: list[list[int]]) -> list[int]:
+    """Process multiple datasets using multiple processes."""
+    with concurrent.futures.ProcessPoolExecutor() as executor:
+        results = list(executor.map(process_data, datasets))
+    return results
+```
+
+### Async/Await for Concurrent I/O
+
+```python
+import asyncio
+
+async def fetch_async(url: str) -> str:
+    """Fetch a URL asynchronously."""
+    import aiohttp
+    async with aiohttp.ClientSession() as session:
+        async with session.get(url) as response:
+            return await response.text()
+
+async def fetch_all(urls: list[str]) -> dict[str, str]:
+    """Fetch multiple URLs concurrently."""
+    tasks = [fetch_async(url) for url in urls]
+    results = await asyncio.gather(*tasks, return_exceptions=True)
+    return dict(zip(urls, results))
+```
+
+## Package Organization
+
+### Standard Project Layout
+
+```
+myproject/
+├── src/
+│   └── mypackage/
+│       ├── __init__.py
+│       ├── main.py
+│       ├── api/
+│       │   ├── __init__.py
+│       │   └── routes.py
+│       ├── models/
+│       │   ├── __init__.py
+│       │   └── user.py
+│       └── utils/
+│           ├── __init__.py
+│           └── helpers.py
+├── tests/
+│   ├── __init__.py
+│   ├── conftest.py
+│   ├── test_api.py
+│   └── test_models.py
+├── pyproject.toml
+├── README.md
+└── .gitignore
+```
+
+### Import Conventions
+
+```python
+# Good: Import order - stdlib, third-party, local
+import os
+import sys
+from pathlib import Path
+
+import requests
+from fastapi import FastAPI
+
+from mypackage.models import User
+from mypackage.utils import format_name
+
+# Good: Use isort for automatic import sorting
+# pip install isort
+```
+
+### __init__.py for Package Exports
+
+```python
+# mypackage/__init__.py
+"""mypackage - A sample Python package."""
+
+__version__ = "1.0.0"
+
+# Export main classes/functions at package level
+from mypackage.models import User, Post
+from mypackage.utils import format_name
+
+__all__ = ["User", "Post", "format_name"]
+```
+
+## Memory and Performance
+
+### Using __slots__ for Memory Efficiency
+
+```python
+# Bad: Regular class uses __dict__ (more memory)
+class Point:
+    def __init__(self, x: float, y: float):
+        self.x = x
+        self.y = y
+
+# Good: __slots__ reduces memory usage
+class Point:
+    __slots__ = ['x', 'y']
+
+    def __init__(self, x: float, y: float):
+        self.x = x
+        self.y = y
+```
+
+### Generator for Large Data
+
+```python
+# Bad: Returns full list in memory
+def read_lines(path: str) -> list[str]:
+    with open(path) as f:
+        return [line.strip() for line in f]
+
+# Good: Yields lines one at a time
+def read_lines(path: str) -> Iterator[str]:
+    with open(path) as f:
+        for line in f:
+            yield line.strip()
+```
+
+### Avoid String Concatenation in Loops
+
+```python
+# Bad: O(n²) due to string immutability
+result = ""
+for item in items:
+    result += str(item)
+
+# Good: O(n) using join
+result = "".join(str(item) for item in items)
+
+# Good: Using StringIO for building
+from io import StringIO
+
+buffer = StringIO()
+for item in items:
+    buffer.write(str(item))
+result = buffer.getvalue()
+```
+
+## Python Tooling Integration
+
+### Essential Commands
+
+```bash
+# Code formatting
+black .
+isort .
+
+# Linting
+ruff check .
+pylint mypackage/
+
+# Type checking
+mypy .
+
+# Testing
+pytest --cov=mypackage --cov-report=html
+
+# Security scanning
+bandit -r .
+
+# Dependency management
+pip-audit
+safety check
+```
+
+### pyproject.toml Configuration
+
+```toml
+[project]
+name = "mypackage"
+version = "1.0.0"
+requires-python = ">=3.9"
+dependencies = [
+    "requests>=2.31.0",
+    "pydantic>=2.0.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.4.0",
+    "pytest-cov>=4.1.0",
+    "black>=23.0.0",
+    "ruff>=0.1.0",
+    "mypy>=1.5.0",
+]
+
+[tool.black]
+line-length = 88
+target-version = ['py39']
+
+[tool.ruff]
+line-length = 88
+select = ["E", "F", "I", "N", "W"]
+
+[tool.mypy]
+python_version = "3.9"
+warn_return_any = true
+warn_unused_configs = true
+disallow_untyped_defs = true
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "--cov=mypackage --cov-report=term-missing"
+```
+
+## Quick Reference: Python Idioms
+
+| Idiom | Description |
+|-------|-------------|
+| EAFP | Easier to Ask Forgiveness than Permission |
+| Context managers | Use `with` for resource management |
+| List comprehensions | For simple transformations |
+| Generators | For lazy evaluation and large datasets |
+| Type hints | Annotate function signatures |
+| Dataclasses | For data containers with auto-generated methods |
+| `__slots__` | For memory optimization |
+| f-strings | For string formatting (Python 3.6+) |
+| `pathlib.Path` | For path operations (Python 3.4+) |
+| `enumerate` | For index-element pairs in loops |
+
+## Anti-Patterns to Avoid
+
+```python
+# Bad: Mutable default arguments
+def append_to(item, items=[]):
+    items.append(item)
+    return items
+
+# Good: Use None and create new list
+def append_to(item, items=None):
+    if items is None:
+        items = []
+    items.append(item)
+    return items
+
+# Bad: Checking type with type()
+if type(obj) == list:
+    process(obj)
+
+# Good: Use isinstance
+if isinstance(obj, list):
+    process(obj)
+
+# Bad: Comparing to None with ==
+if value == None:
+    process()
+
+# Good: Use is
+if value is None:
+    process()
+
+# Bad: from module import *
+from os.path import *
+
+# Good: Explicit imports
+from os.path import join, exists
+
+# Bad: Bare except
+try:
+    risky_operation()
+except:
+    pass
+
+# Good: Specific exception
+try:
+    risky_operation()
+except SpecificError as e:
+    logger.error(f"Operation failed: {e}")
+```
+
+__Remember__: Python code should be readable, explicit, and follow the principle of least surprise. When in doubt, prioritize clarity over cleverness.

skills/python-testing/SKILL.md

@@ -0,0 +1,815 @@
+---
+name: python-testing
+description: Python testing strategies using pytest, TDD methodology, fixtures, mocking, parametrization, and coverage requirements.
+---
+
+# Python Testing Patterns
+
+Comprehensive testing strategies for Python applications using pytest, TDD methodology, and best practices.
+
+## When to Activate
+
+- Writing new Python code (follow TDD: red, green, refactor)
+- Designing test suites for Python projects
+- Reviewing Python test coverage
+- Setting up testing infrastructure
+
+## Core Testing Philosophy
+
+### Test-Driven Development (TDD)
+
+Always follow the TDD cycle:
+
+1. **RED**: Write a failing test for the desired behavior
+2. **GREEN**: Write minimal code to make the test pass
+3. **REFACTOR**: Improve code while keeping tests green
+
+```python
+# Step 1: Write failing test (RED)
+def test_add_numbers():
+    result = add(2, 3)
+    assert result == 5
+
+# Step 2: Write minimal implementation (GREEN)
+def add(a, b):
+    return a + b
+
+# Step 3: Refactor if needed (REFACTOR)
+```
+
+### Coverage Requirements
+
+- **Target**: 80%+ code coverage
+- **Critical paths**: 100% coverage required
+- Use `pytest --cov` to measure coverage
+
+```bash
+pytest --cov=mypackage --cov-report=term-missing --cov-report=html
+```
+
+## pytest Fundamentals
+
+### Basic Test Structure
+
+```python
+import pytest
+
+def test_addition():
+    """Test basic addition."""
+    assert 2 + 2 == 4
+
+def test_string_uppercase():
+    """Test string uppercasing."""
+    text = "hello"
+    assert text.upper() == "HELLO"
+
+def test_list_append():
+    """Test list append."""
+    items = [1, 2, 3]
+    items.append(4)
+    assert 4 in items
+    assert len(items) == 4
+```
+
+### Assertions
+
+```python
+# Equality
+assert result == expected
+
+# Inequality
+assert result != unexpected
+
+# Truthiness
+assert result  # Truthy
+assert not result  # Falsy
+assert result is True  # Exactly True
+assert result is False  # Exactly False
+assert result is None  # Exactly None
+
+# Membership
+assert item in collection
+assert item not in collection
+
+# Comparisons
+assert result > 0
+assert 0 <= result <= 100
+
+# Type checking
+assert isinstance(result, str)
+
+# Exception testing (preferred approach)
+with pytest.raises(ValueError):
+    raise ValueError("error message")
+
+# Check exception message
+with pytest.raises(ValueError, match="invalid input"):
+    raise ValueError("invalid input provided")
+
+# Check exception attributes
+with pytest.raises(ValueError) as exc_info:
+    raise ValueError("error message")
+assert str(exc_info.value) == "error message"
+```
+
+## Fixtures
+
+### Basic Fixture Usage
+
+```python
+import pytest
+
+@pytest.fixture
+def sample_data():
+    """Fixture providing sample data."""
+    return {"name": "Alice", "age": 30}
+
+def test_sample_data(sample_data):
+    """Test using the fixture."""
+    assert sample_data["name"] == "Alice"
+    assert sample_data["age"] == 30
+```
+
+### Fixture with Setup/Teardown
+
+```python
+@pytest.fixture
+def database():
+    """Fixture with setup and teardown."""
+    # Setup
+    db = Database(":memory:")
+    db.create_tables()
+    db.insert_test_data()
+
+    yield db  # Provide to test
+
+    # Teardown
+    db.close()
+
+def test_database_query(database):
+    """Test database operations."""
+    result = database.query("SELECT * FROM users")
+    assert len(result) > 0
+```
+
+### Fixture Scopes
+
+```python
+# Function scope (default) - runs for each test
+@pytest.fixture
+def temp_file():
+    with open("temp.txt", "w") as f:
+        yield f
+    os.remove("temp.txt")
+
+# Module scope - runs once per module
+@pytest.fixture(scope="module")
+def module_db():
+    db = Database(":memory:")
+    db.create_tables()
+    yield db
+    db.close()
+
+# Session scope - runs once per test session
+@pytest.fixture(scope="session")
+def shared_resource():
+    resource = ExpensiveResource()
+    yield resource
+    resource.cleanup()
+```
+
+### Fixture with Parameters
+
+```python
+@pytest.fixture(params=[1, 2, 3])
+def number(request):
+    """Parameterized fixture."""
+    return request.param
+
+def test_numbers(number):
+    """Test runs 3 times, once for each parameter."""
+    assert number > 0
+```
+
+### Using Multiple Fixtures
+
+```python
+@pytest.fixture
+def user():
+    return User(id=1, name="Alice")
+
+@pytest.fixture
+def admin():
+    return User(id=2, name="Admin", role="admin")
+
+def test_user_admin_interaction(user, admin):
+    """Test using multiple fixtures."""
+    assert admin.can_manage(user)
+```
+
+### Autouse Fixtures
+
+```python
+@pytest.fixture(autouse=True)
+def reset_config():
+    """Automatically runs before every test."""
+    Config.reset()
+    yield
+    Config.cleanup()
+
+def test_without_fixture_call():
+    # reset_config runs automatically
+    assert Config.get_setting("debug") is False
+```
+
+### Conftest.py for Shared Fixtures
+
+```python
+# tests/conftest.py
+import pytest
+
+@pytest.fixture
+def client():
+    """Shared fixture for all tests."""
+    app = create_app(testing=True)
+    with app.test_client() as client:
+        yield client
+
+@pytest.fixture
+def auth_headers(client):
+    """Generate auth headers for API testing."""
+    response = client.post("/api/login", json={
+        "username": "test",
+        "password": "test"
+    })
+    token = response.json["token"]
+    return {"Authorization": f"Bearer {token}"}
+```
+
+## Parametrization
+
+### Basic Parametrization
+
+```python
+@pytest.mark.parametrize("input,expected", [
+    ("hello", "HELLO"),
+    ("world", "WORLD"),
+    ("PyThOn", "PYTHON"),
+])
+def test_uppercase(input, expected):
+    """Test runs 3 times with different inputs."""
+    assert input.upper() == expected
+```
+
+### Multiple Parameters
+
+```python
+@pytest.mark.parametrize("a,b,expected", [
+    (2, 3, 5),
+    (0, 0, 0),
+    (-1, 1, 0),
+    (100, 200, 300),
+])
+def test_add(a, b, expected):
+    """Test addition with multiple inputs."""
+    assert add(a, b) == expected
+```
+
+### Parametrize with IDs
+
+```python
+@pytest.mark.parametrize("input,expected", [
+    ("valid@email.com", True),
+    ("invalid", False),
+    ("@no-domain.com", False),
+], ids=["valid-email", "missing-at", "missing-domain"])
+def test_email_validation(input, expected):
+    """Test email validation with readable test IDs."""
+    assert is_valid_email(input) is expected
+```
+
+### Parametrized Fixtures
+
+```python
+@pytest.fixture(params=["sqlite", "postgresql", "mysql"])
+def db(request):
+    """Test against multiple database backends."""
+    if request.param == "sqlite":
+        return Database(":memory:")
+    elif request.param == "postgresql":
+        return Database("postgresql://localhost/test")
+    elif request.param == "mysql":
+        return Database("mysql://localhost/test")
+
+def test_database_operations(db):
+    """Test runs 3 times, once for each database."""
+    result = db.query("SELECT 1")
+    assert result is not None
+```
+
+## Markers and Test Selection
+
+### Custom Markers
+
+```python
+# Mark slow tests
+@pytest.mark.slow
+def test_slow_operation():
+    time.sleep(5)
+
+# Mark integration tests
+@pytest.mark.integration
+def test_api_integration():
+    response = requests.get("https://api.example.com")
+    assert response.status_code == 200
+
+# Mark unit tests
+@pytest.mark.unit
+def test_unit_logic():
+    assert calculate(2, 3) == 5
+```
+
+### Run Specific Tests
+
+```bash
+# Run only fast tests
+pytest -m "not slow"
+
+# Run only integration tests
+pytest -m integration
+
+# Run integration or slow tests
+pytest -m "integration or slow"
+
+# Run tests marked as unit but not slow
+pytest -m "unit and not slow"
+```
+
+### Configure Markers in pytest.ini
+
+```ini
+[pytest]
+markers =
+    slow: marks tests as slow
+    integration: marks tests as integration tests
+    unit: marks tests as unit tests
+    django: marks tests as requiring Django
+```
+
+## Mocking and Patching
+
+### Mocking Functions
+
+```python
+from unittest.mock import patch, Mock
+
+@patch("mypackage.external_api_call")
+def test_with_mock(api_call_mock):
+    """Test with mocked external API."""
+    api_call_mock.return_value = {"status": "success"}
+
+    result = my_function()
+
+    api_call_mock.assert_called_once()
+    assert result["status"] == "success"
+```
+
+### Mocking Return Values
+
+```python
+@patch("mypackage.Database.connect")
+def test_database_connection(connect_mock):
+    """Test with mocked database connection."""
+    connect_mock.return_value = MockConnection()
+
+    db = Database()
+    db.connect()
+
+    connect_mock.assert_called_once_with("localhost")
+```
+
+### Mocking Exceptions
+
+```python
+@patch("mypackage.api_call")
+def test_api_error_handling(api_call_mock):
+    """Test error handling with mocked exception."""
+    api_call_mock.side_effect = ConnectionError("Network error")
+
+    with pytest.raises(ConnectionError):
+        api_call()
+
+    api_call_mock.assert_called_once()
+```
+
+### Mocking Context Managers
+
+```python
+@patch("builtins.open", new_callable=mock_open)
+def test_file_reading(mock_file):
+    """Test file reading with mocked open."""
+    mock_file.return_value.read.return_value = "file content"
+
+    result = read_file("test.txt")
+
+    mock_file.assert_called_once_with("test.txt", "r")
+    assert result == "file content"
+```
+
+### Using Autospec
+
+```python
+@patch("mypackage.DBConnection", autospec=True)
+def test_autospec(db_mock):
+    """Test with autospec to catch API misuse."""
+    db = db_mock.return_value
+    db.query("SELECT * FROM users")
+
+    # This would fail if DBConnection doesn't have query method
+    db_mock.assert_called_once()
+```
+
+### Mock Class Instances
+
+```python
+class TestUserService:
+    @patch("mypackage.UserRepository")
+    def test_create_user(self, repo_mock):
+        """Test user creation with mocked repository."""
+        repo_mock.return_value.save.return_value = User(id=1, name="Alice")
+
+        service = UserService(repo_mock.return_value)
+        user = service.create_user(name="Alice")
+
+        assert user.name == "Alice"
+        repo_mock.return_value.save.assert_called_once()
+```
+
+### Mock Property
+
+```python
+@pytest.fixture
+def mock_config():
+    """Create a mock with a property."""
+    config = Mock()
+    type(config).debug = PropertyMock(return_value=True)
+    type(config).api_key = PropertyMock(return_value="test-key")
+    return config
+
+def test_with_mock_config(mock_config):
+    """Test with mocked config properties."""
+    assert mock_config.debug is True
+    assert mock_config.api_key == "test-key"
+```
+
+## Testing Async Code
+
+### Async Tests with pytest-asyncio
+
+```python
+import pytest
+
+@pytest.mark.asyncio
+async def test_async_function():
+    """Test async function."""
+    result = await async_add(2, 3)
+    assert result == 5
+
+@pytest.mark.asyncio
+async def test_async_with_fixture(async_client):
+    """Test async with async fixture."""
+    response = await async_client.get("/api/users")
+    assert response.status_code == 200
+```
+
+### Async Fixture
+
+```python
+@pytest.fixture
+async def async_client():
+    """Async fixture providing async test client."""
+    app = create_app()
+    async with app.test_client() as client:
+        yield client
+
+@pytest.mark.asyncio
+async def test_api_endpoint(async_client):
+    """Test using async fixture."""
+    response = await async_client.get("/api/data")
+    assert response.status_code == 200
+```
+
+### Mocking Async Functions
+
+```python
+@pytest.mark.asyncio
+@patch("mypackage.async_api_call")
+async def test_async_mock(api_call_mock):
+    """Test async function with mock."""
+    api_call_mock.return_value = {"status": "ok"}
+
+    result = await my_async_function()
+
+    api_call_mock.assert_awaited_once()
+    assert result["status"] == "ok"
+```
+
+## Testing Exceptions
+
+### Testing Expected Exceptions
+
+```python
+def test_divide_by_zero():
+    """Test that dividing by zero raises ZeroDivisionError."""
+    with pytest.raises(ZeroDivisionError):
+        divide(10, 0)
+
+def test_custom_exception():
+    """Test custom exception with message."""
+    with pytest.raises(ValueError, match="invalid input"):
+        validate_input("invalid")
+```
+
+### Testing Exception Attributes
+
+```python
+def test_exception_with_details():
+    """Test exception with custom attributes."""
+    with pytest.raises(CustomError) as exc_info:
+        raise CustomError("error", code=400)
+
+    assert exc_info.value.code == 400
+    assert "error" in str(exc_info.value)
+```
+
+## Testing Side Effects
+
+### Testing File Operations
+
+```python
+import tempfile
+import os
+
+def test_file_processing():
+    """Test file processing with temp file."""
+    with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.txt') as f:
+        f.write("test content")
+        temp_path = f.name
+
+    try:
+        result = process_file(temp_path)
+        assert result == "processed: test content"
+    finally:
+        os.unlink(temp_path)
+```
+
+### Testing with pytest's tmp_path Fixture
+
+```python
+def test_with_tmp_path(tmp_path):
+    """Test using pytest's built-in temp path fixture."""
+    test_file = tmp_path / "test.txt"
+    test_file.write_text("hello world")
+
+    result = process_file(str(test_file))
+    assert result == "hello world"
+    # tmp_path automatically cleaned up
+```
+
+### Testing with tmpdir Fixture
+
+```python
+def test_with_tmpdir(tmpdir):
+    """Test using pytest's tmpdir fixture."""
+    test_file = tmpdir.join("test.txt")
+    test_file.write("data")
+
+    result = process_file(str(test_file))
+    assert result == "data"
+```
+
+## Test Organization
+
+### Directory Structure
+
+```
+tests/
+├── conftest.py                 # Shared fixtures
+├── __init__.py
+├── unit/                       # Unit tests
+│   ├── __init__.py
+│   ├── test_models.py
+│   ├── test_utils.py
+│   └── test_services.py
+├── integration/                # Integration tests
+│   ├── __init__.py
+│   ├── test_api.py
+│   └── test_database.py
+└── e2e/                        # End-to-end tests
+    ├── __init__.py
+    └── test_user_flow.py
+```
+
+### Test Classes
+
+```python
+class TestUserService:
+    """Group related tests in a class."""
+
+    @pytest.fixture(autouse=True)
+    def setup(self):
+        """Setup runs before each test in this class."""
+        self.service = UserService()
+
+    def test_create_user(self):
+        """Test user creation."""
+        user = self.service.create_user("Alice")
+        assert user.name == "Alice"
+
+    def test_delete_user(self):
+        """Test user deletion."""
+        user = User(id=1, name="Bob")
+        self.service.delete_user(user)
+        assert not self.service.user_exists(1)
+```
+
+## Best Practices
+
+### DO
+
+- **Follow TDD**: Write tests before code (red-green-refactor)
+- **Test one thing**: Each test should verify a single behavior
+- **Use descriptive names**: `test_user_login_with_invalid_credentials_fails`
+- **Use fixtures**: Eliminate duplication with fixtures
+- **Mock external dependencies**: Don't depend on external services
+- **Test edge cases**: Empty inputs, None values, boundary conditions
+- **Aim for 80%+ coverage**: Focus on critical paths
+- **Keep tests fast**: Use marks to separate slow tests
+
+### DON'T
+
+- **Don't test implementation**: Test behavior, not internals
+- **Don't use complex conditionals in tests**: Keep tests simple
+- **Don't ignore test failures**: All tests must pass
+- **Don't test third-party code**: Trust libraries to work
+- **Don't share state between tests**: Tests should be independent
+- **Don't catch exceptions in tests**: Use `pytest.raises`
+- **Don't use print statements**: Use assertions and pytest output
+- **Don't write tests that are too brittle**: Avoid over-specific mocks
+
+## Common Patterns
+
+### Testing API Endpoints (FastAPI/Flask)
+
+```python
+@pytest.fixture
+def client():
+    app = create_app(testing=True)
+    return app.test_client()
+
+def test_get_user(client):
+    response = client.get("/api/users/1")
+    assert response.status_code == 200
+    assert response.json["id"] == 1
+
+def test_create_user(client):
+    response = client.post("/api/users", json={
+        "name": "Alice",
+        "email": "alice@example.com"
+    })
+    assert response.status_code == 201
+    assert response.json["name"] == "Alice"
+```
+
+### Testing Database Operations
+
+```python
+@pytest.fixture
+def db_session():
+    """Create a test database session."""
+    session = Session(bind=engine)
+    session.begin_nested()
+    yield session
+    session.rollback()
+    session.close()
+
+def test_create_user(db_session):
+    user = User(name="Alice", email="alice@example.com")
+    db_session.add(user)
+    db_session.commit()
+
+    retrieved = db_session.query(User).filter_by(name="Alice").first()
+    assert retrieved.email == "alice@example.com"
+```
+
+### Testing Class Methods
+
+```python
+class TestCalculator:
+    @pytest.fixture
+    def calculator(self):
+        return Calculator()
+
+    def test_add(self, calculator):
+        assert calculator.add(2, 3) == 5
+
+    def test_divide_by_zero(self, calculator):
+        with pytest.raises(ZeroDivisionError):
+            calculator.divide(10, 0)
+```
+
+## pytest Configuration
+
+### pytest.ini
+
+```ini
+[pytest]
+testpaths = tests
+python_files = test_*.py
+python_classes = Test*
+python_functions = test_*
+addopts =
+    --strict-markers
+    --disable-warnings
+    --cov=mypackage
+    --cov-report=term-missing
+    --cov-report=html
+markers =
+    slow: marks tests as slow
+    integration: marks tests as integration tests
+    unit: marks tests as unit tests
+```
+
+### pyproject.toml
+
+```toml
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+python_files = ["test_*.py"]
+python_classes = ["Test*"]
+python_functions = ["test_*"]
+addopts = [
+    "--strict-markers",
+    "--cov=mypackage",
+    "--cov-report=term-missing",
+    "--cov-report=html",
+]
+markers = [
+    "slow: marks tests as slow",
+    "integration: marks tests as integration tests",
+    "unit: marks tests as unit tests",
+]
+```
+
+## Running Tests
+
+```bash
+# Run all tests
+pytest
+
+# Run specific file
+pytest tests/test_utils.py
+
+# Run specific test
+pytest tests/test_utils.py::test_function
+
+# Run with verbose output
+pytest -v
+
+# Run with coverage
+pytest --cov=mypackage --cov-report=html
+
+# Run only fast tests
+pytest -m "not slow"
+
+# Run until first failure
+pytest -x
+
+# Run and stop on N failures
+pytest --maxfail=3
+
+# Run last failed tests
+pytest --lf
+
+# Run tests with pattern
+pytest -k "test_user"
+
+# Run with debugger on failure
+pytest --pdb
+```
+
+## Quick Reference
+
+| Pattern | Usage |
+|---------|-------|
+| `pytest.raises()` | Test expected exceptions |
+| `@pytest.fixture()` | Create reusable test fixtures |
+| `@pytest.mark.parametrize()` | Run tests with multiple inputs |
+| `@pytest.mark.slow` | Mark slow tests |
+| `pytest -m "not slow"` | Skip slow tests |
+| `@patch()` | Mock functions and classes |
+| `tmp_path` fixture | Automatic temp directory |
+| `pytest --cov` | Generate coverage report |
+| `assert` | Simple and readable assertions |
+
+**Remember**: Tests are code too. Keep them clean, readable, and maintainable. Good tests catch bugs; great tests prevent them.