addyosmani/agent-skills

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 199   return res.status(422).json({ error: 'idempotency key reused with a different payload' });
+ 199   return res.status(422).json({
+ 200     error: { code: 'IDEMPOTENCY_KEY_REUSED', message: 'Idempotency key reused with a different payload' },
+ 201   });

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

+ 139 
+ 140 After a viewport or font change, measure layout only after fonts and resize observers have settled.

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 187 Lint failure → Agent runs `npm run lint --fix` and commits
+ 187 Lint failure → Agent runs `npm run lint -- --fix` and commits
+ 266         env:
+ 267           VERSION: ${{ inputs.version }}
- 267           # Deploy the specified previous version
- 268           npx vercel rollback ${{ inputs.version }}
+ 269           # Deploy the specified previous version. Pass the input through env,
+ 270           # never interpolate it into the script (shell injection).
+ 271           npx vercel rollback "$VERSION"
- 316 │   └── Use actions/cache or setup-node cache option for node_modules
+ 319 │   └── Use the setup-node cache option (or actions/cache) for the package manager cache, not node_modules

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

+ 180 
+ 181 Before reporting a finding, check it against the callers, guards and tests that reach the changed code, and drop it if they rule it out. Label defects that already exist in the base separately from regressions this change introduces. Zero findings is a valid result; do not invent one.

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 3 description: Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity.
+ 3 description: Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity. Use when asked to simplify, clean up, or reduce the nesting of a function or module that already works, even when the code is pasted inline and nothing else needs to change.

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 116 | Secrets | No secrets in source | `gitleaks detect --redact` | every edit |
+ 116 | Secrets | No secrets in source | `gitleaks dir . --redact` | every edit |
- 118 | Security: code | No high findings | `semgrep scan --config p/default` | CI |
+ 118 | Security: code | Nothing at high or above | `npm run check:security` | CI |
- 120 | Accessibility | Zero critical or serious | `axe $PREVIEW_URL --tags wcag2a,wcag2aa,wcag21aa` | preview deploy |
+ 120 | Accessibility | Zero critical or serious | `npm run check:a11y` | preview deploy |
- 151 | Coverage (JS) | your test runner | already there | `vitest run --coverage` (or `jest --coverage`) | coverage of changed lines |
+ 151 | Coverage (JS) | your test runner | Vitest: `npm i -D @vitest/coverage-v8`; Jest: already there | `vitest run --coverage` (or `jest --coverage`) | coverage of changed lines |
- 153 | Security: code | Semgrep | `pipx install semgrep` | `semgrep scan --config p/default --config p/owasp-top-ten` | any high finding |
- 154 | Security: secrets | gitleaks | `brew install gitleaks` | `gitleaks detect --redact --no-banner` | any finding |
+ 153 | Security: code | Semgrep | `pipx install semgrep` | `npm run check:security` (below) | high or critical, including legacy `ERROR` |
+ 154 | Security: secrets | gitleaks | `brew install gitleaks` | `gitleaks dir . --redact --no-banner` | any finding |
- 158 | Accessibility | axe-core | `npm i -D @axe-core/cli` | `axe $URL --tags wcag2a,wcag2aa,wcag21aa` | zero critical or serious |
+ 158 | Accessibility | axe-core | `npm i -D @axe-core/cli` | `npm run check:a11y` (below) | zero critical or serious |
+ 170 `semgrep scan` and `axe` can exit 0 on findings; copy [scripts/quality-gate.mjs](scripts/quality-gate.mjs) into the project's `scripts/` directory to enforce these thresholds.
+ 171 Keep the scanner before `&&` so a failed scan stops the command.
+ 172 
- 175     "check:fast": "tsc --noEmit && eslint . && gitleaks detect --redact --no-banner",
+ 178     "check:fast": "tsc --noEmit && eslint . && gitleaks dir . --redact --no-banner",
- 177     "check:full": "npm run check:task && semgrep scan --config p/default && osv-scanner scan source -r ."
+ 180     "check:security": "semgrep scan --config p/default --strict --json > semgrep-results.json && node scripts/quality-gate.mjs semgrep semgrep-results.json",
+ 181     "check:a11y": "axe \"$PREVIEW_URL\" --tags wcag2a,wcag2aa,wcag21aa --stdout > axe-results.json && node scripts/quality-gate.mjs axe axe-results.json",
+ 182     "check:full": "npm run check:task && npm run check:security && osv-scanner scan source -r ."
- 182 That mapping matters more than the tools. `check:fast` is what runs after an edit, `check:task` when the agent thinks it's done, `check:full` in CI.
+ 187 That mapping matters more than the tools. `check:fast` is what runs after an edit, `check:task` when the agent thinks it's done, `check:full` in CI. Run `check:a11y` after the preview is reachable, with `PREVIEW_URL` set (the example uses POSIX shell syntax).
+ 188 
+ 189 Before calling any row enforced, run its actual CI command against a known violation and a clean control. Confirm that the violation fails, the control passes, and scanner errors fail too. For a severity threshold, also confirm a below-threshold finding passes. Apply this to every dimension, including coverage and Lighthouse: generating a report alone does not enforce the number in `CONSTRAINTS.md`.
+ 310 - [ ] Each enforced command fails on a deliberate violation and scanner error, passes a clean control, and preserves the agreed severity threshold

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 53 - Lint: `npm run lint --fix`
+ 53 - Lint: `npm run lint -- --fix`
- 202 **Start trimming at 75% capacity, not 100%.** By the time the window is genuinely full, the model's attention is already fragmented across too many signals. The 75% threshold gives room to compress gracefully rather than cut desperately mid-task.
+ 202 **Compact well before the host's limit; the threshold varies by host.** By the time the window is genuinely full, the model's attention is already fragmented across too many signals. The margin gives room to compress gracefully rather than cut desperately mid-task.
- 324 | Context cliff | Waiting until the window is full before managing it — attention fragments and output quality drops abruptly at the limit | Start trimming at 75% capacity; compress rather than cut |
+ 324 | Context cliff | Waiting until the window is full before managing it — attention fragments and output quality drops abruptly at the limit | Compact well before the host's limit; compress rather than cut |

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 84 npm test -- --testPathPattern="specific-file" --runInBand
+ 84 npm test -- specific-file --runInBand

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

+ 148 
+ 149   // Translate the new shape back into what old consumers expect
+ 150   private toOldFormat(task: Task): OldTask {
+ 151     return { id: Number(task.id), title: task.title, done: task.status === 'done' };
+ 152   }
- 160   return new LegacyTaskService();
+ 165   return new OldTaskService();

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 114 // Rate limit uses a sliding window — reset counter at window boundary,
- 115 // not on a fixed schedule, to prevent burst attacks at window edges
+ 114 // Rate limit uses a fixed window that opens on the first request after the
+ 115 // previous one expires, not on a clock schedule. Known gap: a client can spend
+ 116 // the full limit just before a reset and again just after (2x in a moment)

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

+ 84 
+ 85 Strip reasoning, not evidence: if a caller, guard or test contradicts the claim, include it in the unit.

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 82   const { tasks, isLoading, error, refetch } = useTasks();
+ 82   const { tasks, isLoading, error, refetch, toggleTask, deleteTask } = useTasks();
- 88   return <TaskList tasks={tasks} />;
+ 88   return <TaskList tasks={tasks} onToggle={toggleTask} onDelete={deleteTask} />;
- 92 export function TaskList({ tasks }: { tasks: Task[] }) {
+ 92 export function TaskList({ tasks, onToggle, onDelete }: { tasks: Task[] } & Pick<TaskItemProps, 'onToggle' | 'onDelete'>) {
- 95       {tasks.map(task => <TaskItem key={task.id} task={task} />)}
+ 95       {tasks.map(task => <TaskItem key={task.id} task={task} onToggle={onToggle} onDelete={onDelete} />)}
- 237 function TaskList({ tasks }: { tasks: Task[] }) {
+ 237 function TaskList({ tasks, onCreateTask }: { tasks: Task[]; onCreateTask: () => void }) {
- 275     <div className="space-y-3" aria-busy="true" aria-label="Loading tasks">
+ 275     <div className="space-y-3" role="status" aria-busy="true" aria-label="Loading tasks">

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 3 description: Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, splitting uncommitted work in a messy working tree into clean atomic commits, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple parallel streams. Use when cutting a release, choosing a semantic version bump, tagging, or writing a changelog.
+ 3 description: Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, splitting uncommitted work in a messy working tree into clean atomic commits, opening or reviewing a pull request (PR), pushing to a remote, or when you need to organize work across multiple parallel streams. Use when cutting a release, choosing a semantic version bump, tagging, or writing a changelog. Use when asked to write a commit message or a changelog entry for a change, or to split a change into commits, even when the diff is pasted inline and the message seems easy to write from it.
- 219 # 2. Ensure no secrets
- 220 git diff --staged | grep -i "password\|secret\|api_key\|token"
+ 219 # 2. Ensure no secrets (lists matching file names only — any output means review them)
+ 220 git diff --staged -i -G'password|secret|api_key|token' --name-only

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 31 # Optional: Initialize the ideas directory
- 32 bash skills/idea-refine/scripts/idea-refine.sh
+ 31 # Optional. Run from the project root so this creates ./docs/ideas.
+ 32 # <skill-dir> is the directory that contains this SKILL.md
+ 33 # (for example .agents/skills/idea-refine or .cursor/skills/idea-refine).
+ 34 bash <skill-dir>/scripts/idea-refine.sh

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 208 # Lighthouse CI
- 209 npx lhci autorun
+ 208 # Lighthouse CI. The CLI package is @lhci/cli; unscoped `lhci` on npm is not it.
+ 209 npx --package=@lhci/cli lhci autorun

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 3 description: Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.
+ 3 description: Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data, manages user sessions or session cookies, or interacts with third-party services. Use when auditing dependencies for known vulnerabilities, triaging package-manager audit findings, or assessing supply-chain risk in a new package. Use when personal data or privacy compliance (GDPR, CCPA) is involved.

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 192 class ErrorBoundary extends React.Component {
+ 192 class ErrorBoundary extends React.Component<React.PropsWithChildren> {

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 161 "useTransition now supports async functions [...] to handle
- 162 pending states automatically"
+ 161 "In React 19, we're adding support for using async functions in
+ 162 transitions to handle pending states, errors, forms, and optimistic
+ 163 updates automatically."

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

- 92    Lint: npm run lint --fix
+ 92    Lint: npm run lint -- --fix

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

+ 248 For crash or rollback behavior, exercise the real boundary: an injected exception is not process termination, and a mocked transaction call is not a database rollback.
+ 249 

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub

Before Network or broad shell → After Network or broad shell

aeac41d4d005 → 301b02b12bff

Compare on GitHub

Before Not checked yet → After Network or broad shell

First observation → aeac41d4d005

No earlier version was observed for comparison.

Compare on GitHub