opencode-public

Use when auditing, reviewing, or modifying web applications where untrusted data crosses trust boundaries — including request handlers, parsers, renderers, document importers, file uploads, redirects, API endpoints, webhooks, and multi-step feature chains. Also use when reviewing framework defaults, content-type handling, or feature composition that could chain into vulnerabilities.

Use when deploying containers, managing routes, configuring services, or operating any application with the Gordon CLI. Use when the user mentions gordon, push-to-deploy, or self-hosted container deployment.

Use when building or updating Astro sites, components, content-driven pages, islands, content collections, view transitions, or Astro server features such as SSR, actions, API routes, middleware, and adapters.

Use when running CodeRabbit CLI code reviews, reviewing uncommitted or committed changes, comparing branches, or authenticating with CodeRabbit. Triggers on "code review", "cr review", "coderabbit", "review my changes", "review this branch".

Use when asked for a deep code review, thorough review, security audit, full review of changes, or pre-merge review. Triggers on "deep review", "thorough review", "audit my code", "review for security", "check for bugs", "review before merge".

Use when writing, reviewing, or debugging Drizzle ORM code — schema definitions, queries, mutations, relations, migrations, transactions, or any project using drizzle-orm with PostgreSQL, MySQL, SQLite, Turso, Neon, D1, or other supported databases

Use when building distinctive, production-grade frontend interfaces — components, pages, or full applications. Guides bold aesthetic direction and real working code with exceptional design quality.

Debug Go programs and tests with Delve from the terminal. Use when stepping through failing tests, setting breakpoints, inspecting variables, tracing goroutines or deadlocks, attaching to a running Go process, examining a core dump, or diagnosing race conditions and state changes in any Go repository.

Generate mocks for Go interfaces using mockery v3. Use when creating mocks, configuring .mockery.yaml, setting up mock generation for interfaces in Go projects, writing tests with mockery-generated mocks and testify (EXPECT, mock.Anything, RunAndReturn), or migrating from mockery v2 to v3. Not for gomock, counterfeiter, or hand-written mocks.

Use when scanning a repo for hexagonal architecture violations, reviewing code placement across layers, auditing dependency direction, or checking port hygiene. Triggers on "hex arch", "ports and adapters", "clean architecture layers", "domain imports infrastructure", "business logic in adapter", "wrong layer", "missing port".

Use when writing, reviewing, or debugging htmx code -- building hypermedia-driven UIs with hx-get, hx-post, hx-swap, hx-trigger, hx-target, hx-boost, hx-partial, hx-status, hx-action, morph swaps, SSE, WebSockets, htmx events, htmx extensions, or any project using htmx attributes. Covers htmx 4.x API.

Use for interface design -- dashboards, admin panels, SaaS apps, tools, settings pages, data interfaces. NOT for marketing design (landing pages, marketing sites, campaigns).

Use when adding, using, or customizing shadcn-svelte components in a Svelte or SvelteKit project, or when you need to look up component APIs, install commands, or underlying package docs for bits-ui, formsnap, paneforge, vaul-svelte, embla-carousel, or svelte-sonner.

Review changed code for reuse, quality, and efficiency, then fix any issues found. Launches three parallel review agents covering code reuse, code quality, and efficiency.

Use when writing, reviewing, or refactoring Svelte 5 components or SvelteKit apps that use runes, shared state, file-based routing, load functions, remote functions, forms, hooks, navigation, or environment modules.