Skip to content

Commit 1154574

Browse files
defujdefuj
committed
feat: Enhance agent workflows with delegation tiers and shared artifacts
- Added Delegation Tiers (Fast/Normal/Full) to classify UI tasks by complexity, improving efficiency. - Introduced Shared Artifacts Pattern for agents to utilize file-based contracts, reducing token waste. - Implemented Loop Prevention Skill for smart stuck detection in agent pipelines, escalating only when necessary. - Established Code Quality Gates with mandatory verification checklists before marking tasks as verified. - Fixed broken handoff chain in UI pipeline, ensuring proper routing of tasks between Designer and Frontend. - Resolved infinite fail loop in UI pipeline by implementing smart stuck detection. - Updated permissions to allow agents to run verification commands. - Enhanced prompts for IT Leader, Frontend, and Designer to reflect new workflows and quality standards. chore: Update version to 1.3.14 in migration files and package.json
1 parent 79ff74a commit 1154574

14 files changed

Lines changed: 651 additions & 143 deletions

File tree

‎.opencode/commands/code-review.md‎

Lines changed: 92 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,98 @@
1-
# Code Review
1+
| ---
2+
| description: "Run comprehensive code review with automated verification: typecheck, lint, security scan, and quality gate. Usage: /code-review [scope]"
3+
| ---
24

3-
Comprehensive security and quality review of uncommitted changes:
5+
# Code Review Command
46

5-
1. Get changed files: git diff --name-only HEAD
7+
Comprehensive code review of uncommitted changes with **automated verification**.
68

7-
2. For each changed file, check for:
9+
## Protocol
810

9-
**Security Issues (CRITICAL):**
11+
1. **Get changed files**: `git diff --name-only HEAD`
12+
2. **Detect stack** from file extensions and project structure
13+
3. **Run stack-appropriate verification** (see Verification by Stack)
14+
4. **Review each changed file** for issues
15+
5. **Generate report** with severity levels
16+
6. **Block if CRITICAL/HIGH issues found**
17+
18+
## Verification by Stack
19+
20+
After reviewing, RUN the appropriate verification command:
21+
22+
| Stack | Verification Command | What It Catches |
23+
|-------|--------------------|-----------------|
24+
| Nuxt/Vue | `npx nuxi typecheck` | TS errors, type mismatches, unused imports |
25+
| React/Next.js | `npx tsc --noEmit` | TS errors, type mismatches |
26+
| Node.js | `npx tsc --noEmit` | TS errors, type mismatches |
27+
| Flutter/Dart | `flutter analyze` | Lint errors, type issues, unused imports |
28+
| Python | `ruff check .` | PEP 8, lint errors, unused imports |
29+
| Go | `go vet ./...` | Suspicious constructs, bugs |
30+
| Rust | `cargo check` + `cargo clippy` | Compilation + lint |
31+
32+
## Issue Severity Levels
33+
34+
### CRITICAL (Block commit)
1035
- Hardcoded credentials, API keys, tokens
11-
- SQL injection vulnerabilities
12-
- XSS vulnerabilities
13-
- Missing input validation
14-
- Insecure dependencies
15-
- Path traversal risks
16-
17-
**Code Quality (HIGH):**
18-
- Functions > 50 lines
19-
- Files > 800 lines
36+
- SQL injection vulnerabilities (raw queries without parameterization)
37+
- XSS vulnerabilities (unsanitized user output in HTML)
38+
- Missing authentication on protected endpoints
39+
- Path traversal risks (user-controlled file paths)
40+
- Insecure deserialization
41+
- Command injection (user input in exec/shell commands)
42+
43+
### HIGH (Must fix before commit)
44+
- Functions > 50 lines without clear reason
45+
- Files > 400 lines
2046
- Nesting depth > 4 levels
21-
- Missing error handling
22-
- console.log statements
23-
- TODO/FIXME comments
24-
- Missing JSDoc for public APIs
25-
26-
**Best Practices (MEDIUM):**
27-
- Mutation patterns (use immutable instead)
28-
- Emoji usage in code/comments
29-
- Missing tests for new code
30-
- Accessibility issues (a11y)
31-
32-
3. Generate report with:
33-
- Severity: CRITICAL, HIGH, MEDIUM, LOW
34-
- File location and line numbers
35-
- Issue description
36-
- Suggested fix
37-
38-
4. Block commit if CRITICAL or HIGH issues found
39-
40-
Never approve code with security vulnerabilities!
47+
- Missing error handling on I/O or network calls
48+
- console.log / print statements in production code
49+
- Unused imports or variables
50+
- TODO/FIXME comments in committed code
51+
- Missing input validation on API endpoints
52+
53+
### MEDIUM (Fix when possible)
54+
- Mutation patterns where immutable would work
55+
- Missing loading/error/empty states
56+
- Hardcoded strings that should be constants/i18n keys
57+
- Missing TypeScript types or `any` usage without justification
58+
- Accessibility issues (missing alt text, poor contrast, missing labels)
59+
- Missing tests for new/changed code
60+
61+
### LOW (Note, non-blocking)
62+
- Minor formatting inconsistencies
63+
- Variable names could be more descriptive
64+
- Comments could be clearer
65+
- Minor duplication
66+
67+
## Report Format
68+
69+
```markdown
70+
## Code Review Report
71+
72+
### Scope
73+
{files reviewed}
74+
75+
### Verification
76+
- TypeCheck: ✅ PASS / ❌ FAIL
77+
- Lint: ✅ PASS / ❌ FAIL / ⚠️ N/A
78+
- Tests: ✅ PASS / ❌ FAIL / ⚠️ N/A
79+
80+
### Findings
81+
82+
| Severity | File | Line | Issue | Suggested Fix |
83+
|----------|------|------|-------|---------------|
84+
| HIGH | src/file.ts | 42 | Missing input validation | Add Zod schema |
85+
| MEDIUM | src/file.ts | 15 | Unused import 'foo' | Remove import |
86+
...
87+
88+
### Verdict
89+
✅ APPROVED (no CRITICAL/HIGH issues)
90+
❌ BLOCKED ({N} CRITICAL/HIGH issues found)
91+
```
92+
93+
## Enforcement
94+
95+
- **BLOCK** commit if CRITICAL or HIGH issues found
96+
- **FLAG** MEDIUM issues with suggested fixes
97+
- **REPORT** LOW issues as notes
98+
- Never approve code with security vulnerabilities

‎.opencode/instructions/INSTRUCTIONS.md‎

Lines changed: 106 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -43,78 +43,130 @@ If security issue found:
4343

4444
---
4545

46-
## Coding Style
46+
## DELEGATION TIERS (Hemat Token, Gak Semua Full Pipeline)
4747

48-
### Immutability (CRITICAL)
48+
Tidak semua UI task perlu 3-phase pipeline. Gunakan tier yang tepat:
4949

50-
ALWAYS create new objects, NEVER mutate:
50+
| Tier | Flow | Cocok Untuk |
51+
|------|------|-------------|
52+
| **Fast** 🏃 | Leader → @frontend langsung | Typo, spacing, warna, icon swap |
53+
| **Normal** ⚡ | Leader → @frontend + referensi DESIGN.md | Minor UI change (1-3 komponen) |
54+
| **Full** 🏗️ | Leader → @designer → Leader → @frontend → Leader → @designer QA | New feature, redesign, design system |
5155

52-
```javascript
53-
// WRONG: Mutation
54-
function updateUser(user, name) {
55-
user.name = name; // MUTATION!
56-
return user;
57-
}
56+
## SHARED ARTIFACTS PATTERN (Critical — Hemat Ratusan Token)
5857

59-
// CORRECT: Immutability
60-
function updateUser(user, name) {
61-
return {
62-
...user,
63-
name,
64-
};
65-
}
66-
```
58+
**Jangan forward data besar di pesan delegasi.** Gunakan file sebagai shared contract:
6759

68-
### File Organization
60+
| Artifact | Isi | Ditulis Oleh | Dibaca Oleh |
61+
|----------|-----|-------------|-------------|
62+
| `DESIGN.md` | Design tokens, direction | @designer | @frontend |
63+
| `./specs/{feature}.md` | Per-component specs | @designer | @frontend |
64+
| `./api-contract.md` | API contract | @leader/@node-developer | @frontend |
65+
| Source code | Implementasi | @frontend | @designer (QA) |
6966

70-
MANY SMALL FILES > FEW LARGE FILES:
67+
**Aturan**:
68+
1. Designer: Simpan specs ke DESIGN.md + ./specs/, return ringkasan ke Leader
69+
2. Leader: Delegasi dengan referensi file, bukan kutip isi specs
70+
3. Frontend: Baca DESIGN.md + specs/ langsung dari file
71+
4. Semua agent: Jangan minta Leader forwarding data — baca langsung dari file
7172

72-
- High cohesion, low coupling
73-
- 200-400 lines typical, 800 max
74-
- Extract utilities from large components
75-
- Organize by feature/domain, not by type
73+
### Prinsip: Deteksi Stuck, Bukan Batasi Iterasi
7674

77-
### Error Handling
75+
Task besar MEMBUTUHKAN banyak iterasi. Jangan batasi jumlah iterasi — batasi hanya ketika **tidak ada progress**.
7876

79-
ALWAYS handle errors comprehensively:
77+
### Stuck Detection: Same-Result Rule
8078

81-
```typescript
82-
try {
83-
const result = await riskyOperation();
84-
return result;
85-
} catch (error) {
86-
console.error('Operation failed:', error);
87-
throw new Error('Detailed user-friendly message');
88-
}
89-
```
79+
Jika agent menerima **hasil/output yang SAMA PERSIS** dari subagent 2 kali berturut-turut:
80+
1. STOP re-delegating (subagent stuck, ngulang hasil sama)
81+
2. Dokumentasikan apa yang sama
82+
3. Eskalasi ke user
9083

91-
### Input Validation
84+
### Kapan BUKAN Stuck (LANJUTKAN)
9285

93-
ALWAYS validate user input:
86+
- Subagent menghasilkan kode berbeda setiap kali → ✅ progress
87+
- Bug fix butuh banyak percobaan dengan pendekatan berbeda → ✅ progress
88+
- Task besar dengan banyak delegasi → ✅ progress
89+
- Pipeline UI bolak-balik Phase 2↔Phase 3 dengan perbaikan nyata → ✅ progress
9490

95-
```typescript
96-
import { z } from 'zod';
91+
---
9792

98-
const schema = z.object({
99-
email: z.string().email(),
100-
age: z.number().int().min(0).max(150),
101-
});
93+
## Quality Gate Checklist (ALL AGENTS — MANDATORY)
10294

103-
const validated = schema.parse(input);
104-
```
95+
Before ANY agent marks work as `verified`, this checklist MUST pass:
96+
97+
### Mandatory Checks
98+
99+
- [ ] **Type check passes** (run `npx tsc --noEmit`, `dart analyze`, or equivalent)
100+
- [ ] **No console.log/print() statements** in changed files
101+
- [ ] **No unused imports** in changed files
102+
- [ ] **Loading/error/empty states handled** for all data-dependent components
103+
- [ ] **No hardcoded values** that should be config/props/constants
104+
- [ ] **Immutability preserved** — no mutation of objects/arrays
105+
- [ ] **Error handling in place** — try/catch or proper error boundaries
106+
- [ ] **Verification status reported**: `verified` / `partially_verified` / `not_verified`
105107

106-
### Code Quality Checklist
108+
### Verification Commands by Stack
107109

108-
Before marking work complete:
110+
| Stack | Minimum Verification | Full Verification |
111+
|-------|-------------------|-------------------|
112+
| **Nuxt/Vue** | `npx nuxi typecheck` | `npx nuxi typecheck` + `npm run lint` + `npm run build` |
113+
| **React/Next.js** | `npx tsc --noEmit` | `npx tsc --noEmit` + `npm run lint` + `npm run build` |
114+
| **Flutter/Dart** | `flutter analyze` | `flutter analyze` + `flutter test` |
115+
| **Node.js** | `npx tsc --noEmit` | `npx tsc --noEmit` + `npm run test` |
116+
| **Angular** | `ng lint` | `ng lint` + `ng test --watch=false` + `ng build` |
117+
| **Python** | `ruff check .` or `pylint` | `ruff check .` + `mypy .` + `pytest` |
118+
| **Rust** | `cargo check` | `cargo check` + `cargo clippy` + `cargo test` |
119+
| **Go** | `go build ./...` | `go build ./...` + `go vet ./...` + `go test ./...` |
120+
| **Java/Spring** | `mvn compile` or `gradle build` | `mvn verify` or `gradle check` |
121+
122+
### Quality Enforcement Rules
123+
124+
1. **Must run minimum verification** before reporting `verified`
125+
2. **If verification fails**, fix errors before reporting
126+
3. **If verification cannot run** (missing config/tools), report as `partially_verified` with exact commands for manual verification
127+
4. **Never skip verification** just because it's "a small change"
128+
5. **Code review gate**: For medium+ changes, delegasikan ke `@code-reviewer` atau `@reviewer` sebelum final delivery
129+
130+
---
109131

110-
- [ ] Code is readable and well-named
111-
- [ ] Functions are small (<50 lines)
112-
- [ ] Files are focused (<800 lines)
113-
- [ ] No deep nesting (>4 levels)
114-
- [ ] Proper error handling
115-
- [ ] No console.log statements
116-
- [ ] No hardcoded values
117-
- [ ] No mutation (immutable patterns used)
132+
## UNIFIED CODING STANDARDS (ALL STACKS)
133+
134+
### Core Rules (Always Apply)
135+
136+
1. **Immutability**: ALWAYS create new objects, NEVER mutate
137+
2. **Small files**: 200-400 lines typical, 800 max
138+
3. **Small functions**: < 50 lines per function
139+
4. **No deep nesting**: Max 4 levels of indentation
140+
5. **Error handling**: Every operation that can fail MUST have error handling
141+
6. **Input validation**: ALL user inputs validated (Zod, Joi, or equivalent)
142+
7. **No hardcoded secrets**: Always use environment variables
143+
8. **No console.log in production**: Search and remove before marking done
144+
145+
### Framework-Specific Rules
146+
147+
#### Nuxt/Vue
148+
- Use `<script setup lang="ts">` always
149+
- Use `useApi` composable for all API calls
150+
- Prefer Nuxt UI components over custom HTML
151+
- App directory structure (Nuxt 4)
152+
153+
#### React/Next.js
154+
- Use TypeScript `interface` for props
155+
- Server Components by default, `'use client'` only when needed
156+
- Use shadcn/ui components over custom implementations
157+
- App Router structure
158+
159+
#### Flutter/Dart
160+
- Use `final` by default, `var` only when type is obvious
161+
- Follow Clean Architecture (data/domain/presentation)
162+
- Prefer Riverpod or Bloc for state management
163+
- Use GoRouter for navigation
164+
165+
#### Node.js/Express
166+
- `*.dto.ts`, `*.controller.ts`, `*.route.ts`, `*.middleware.ts` naming convention
167+
- Use Prisma for database access
168+
- JWT for authentication, stored in httpOnly cookies
169+
- Zod or Joi for input validation
118170

119171
---
120172

‎.opencode/prompts/agents/flutter-developer.md‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -189,11 +189,37 @@ Never create commits, PRs, or push unless explicitly asked. Before commit/PR, su
189189
- Certificate pinning with Dio
190190
- Follow OWASP Mobile Security best practices
191191

192-
## Definition of Done
193-
194-
- **Tiny** (single file): Minimal diff, existing pattern preserved, verification status reported
195-
- **Small** (1-3 files): Edge states handled (loading/error/empty), `flutter analyze` passed
196-
- **Medium+** (cross-file): Clear notes, risk list, validation performed
192+
## Code Quality Standards (ENFORCED)
193+
194+
| Check | Requirement | Verification Command |
195+
|-------|------------|---------------------|
196+
| **Type safety** | Always typed. No `dynamic` unless explicitly justified. | `dart analyze` |
197+
| **Immutability** | Use `final` for all variables unless mutation required. Prefer immutable collections. | — |
198+
| **No print/debugPrint** | Remove before completing task | `grep -rn "print(\|debugPrint(" lib/` |
199+
| **Error states** | Every screen handles: loading, error, empty, success states | — |
200+
| **Clean Architecture** | data/domain/presentation layers separated. Repository pattern for data access. | — |
201+
| **File size** | Keep widgets under 300 lines. Extract reusable widgets. | `wc -l lib/presentation/**/*.dart` |
202+
| **No unused imports** | Clean up all unused imports | `dart analyze` detects unused |
203+
204+
### Verification Commands (MANDATORY — run at least one before marking done)
205+
206+
| Size | Verification Required |
207+
|------|----------------------|
208+
| Tiny (1 file, <20 lines) | `dart analyze` OR `flutter analyze` |
209+
| Small (1-3 files) | `flutter analyze` and fix all warnings |
210+
| Medium (3-10 files) | `flutter analyze` + `flutter test` |
211+
| Large (10+ files) | Full: `flutter analyze` + `flutter test` + `flutter build apk --debug` |
212+
213+
### Quality Gate Before "Verified"
214+
215+
Before marking any task as `verified`, you MUST:
216+
1. **Run static analysis** — `flutter analyze` (or `dart analyze`) and fix all errors & warnings
217+
2. **Check for print() statements** — search and remove all `print()` / `debugPrint()` calls
218+
3. **Verify error/loading/empty states** — ensure every data-dependent widget handles all states
219+
4. **Check null safety** — ensure no nullable types where null shouldn't be possible
220+
5. **Report** the verification results in your output
221+
222+
If `flutter analyze` shows errors, fix them **before** reporting. Only escalate if the fix requires architecture changes outside scope.
197223

198224
## Skills
199225

0 commit comments

Comments
 (0)