botcore

Guides dependency evaluation, selection, and lifecycle management for software projects. Covers package health assessment (OpenSSF Scorecard, maintenance signals, popularity metrics), vendoring vs forking decisions, major version upgrade strategies, automated update tooling (Dependabot, Renovate), supply chain security (SLSA, Sigstore, SBOM, provenance), monorepo dependency patterns, and agentic workflows for dependency operations. Use when evaluating new packages, adding dependencies, upgrading major versions, configuring automated updates, auditing dependency health, making vendor-or-fork decisions, or securing the software supply chain. Triggers: dependency, package, npm install, pip install, cargo add, upgrade, update, vendoring, fork, supply chain, SBOM, SLSA, Dependabot, Renovate, lockfile, vulnerability, dependency health, monorepo dependencies.

Dev environment hygiene for agentic development. Prevents global package pollution, version drift, PATH entropy, and lockfile conflicts across Python, Node.js, and system tooling. Covers installation best practices, audit workflows, cleanup playbooks, and cross-platform patterns (Windows + macOS). Use when installing packages, configuring MCP servers, setting up toolchains, debugging import/resolution errors, or cleaning up polluted environments.

Botcore system architecture — component topology, data flow, security boundaries, and extension points. Covers core package structure, plugin registry flow, MCP server factory, agent orchestrator, memory subsystem, connector middleware stack, and cross-cutting concerns (audit, auth, config). Use when understanding how components connect, tracing request flow, planning new plugins or connectors, debugging integration issues, or reviewing architecture decisions. Triggers: architecture, component, data flow, request flow, middleware, plugin registry, MCP factory, orchestrator topology, connector stack, system diagram, how does botcore work.

Core design principles and architectural tenets for the botcore ecosystem. Covers the foundational decisions that shape all implementation: CommandResult contract, opt-in composability, connector boundaries, meta-tool token efficiency, scoped memory, constrained agency, and plugin protocol. Use when making implementation decisions, reviewing designs for consistency, evaluating trade-offs, or onboarding to the project philosophy. Triggers: principles, design philosophy, why, trade-off, decision, architecture decision, CommandResult, connector boundary, composability, constrained agency.

Create, maintain, and validate agent skills following the Agent Skills open standard (agentskills.io). Covers SKILL.md format, frontmatter fields (open standard + Claude Code extensions), progressive disclosure, hooks, resource scripts, naming conventions, routing tables, and automated quality checks. Use when creating new skills, auditing existing skills, fixing lint errors, adding hooks to skills, or writing resource scripts for deterministic offloading. Triggers: create skill, new skill, skill lint, audit skills, SKILL.md, hooks, resource scripts, progressive disclosure, Agent Skills, open standard, skill architecture, deterministic offloading.

Provides comprehensive accessibility review, guidance, and implementation patterns for WCAG 2.1+ AA compliance. Covers keyboard navigation, ARIA roles and states, screen reader support, assistive technology analysis, compliance frameworks (Section 508, ADA, EN 301 549, EAA, ACA, CVAA), UX component patterns, and accessible content authoring. Use when building interactive components, auditing UI for accessibility, implementing focus management, reviewing designs or specs against WCAG, mapping issues to compliance frameworks, or creating accessibility checklists. Triggers: accessibility, a11y, WCAG, ARIA, keyboard navigation, screen reader, assistive technology, focus management, inclusive design, compliance, Section 508, ADA.

Guides configuration of botcore agent teams in botcore.toml. Covers AgentConfig fields (name, role, model, skills, connectors, connector_commands, memory_scope, permissions, system_prompt, is_lead), AgentsPluginConfig (default_model, max_agents), permission profiles, system prompt authoring, MCP tool access, connector command resolution, and multi-agent team composition patterns. Use when creating agent teams, writing agent configs, authoring system prompts, setting permissions, or debugging agent configuration issues.

Provides API design guidance for REST, GraphQL, and gRPC services covering naming conventions, resource modeling, versioning strategies, error handling (RFC 9457), pagination patterns, OpenAPI 3.1 specification authoring, security (OAuth 2.1, rate limiting), and agent-friendly design patterns including MCP tool integration. Use when designing new APIs, reviewing API contracts, choosing between REST/GraphQL/gRPC, implementing error handling or pagination, writing OpenAPI specs, or making APIs consumable by AI agents. Triggers: API design, REST, GraphQL, gRPC, OpenAPI, error handling, pagination, versioning, API security, agent-friendly API, MCP tools, API-first.

Guides authentication and authorization design for web applications, APIs, and AI agent systems. Covers OAuth 2.1, OIDC, passkeys/WebAuthn, RBAC/ABAC/ReBAC, Cedar policy language, session management (JWT vs server sessions), multi-tenant patterns, zero trust continuous verification, MCP server auth, and agentic identity with machine-to-machine delegation. Use when designing login flows, implementing authorization, adding passkeys, configuring SSO, building multi-tenant auth, securing MCP servers, or managing AI agent credentials. Triggers: authentication, authorization, OAuth, OIDC, passkey, WebAuthn, RBAC, ABAC, session, JWT, token, multi-tenant, SSO, MFA, zero trust, MCP auth, agent identity, delegation.

Guides configuration of botcore projects via botcore.toml or pyproject.toml. Covers BotCoreConfig model, SkillsConfig, PackageOverrideConfig, EnvConfig, language detection and tool defaults, per-package overrides, precedence rules, plugin config validation, and common misconfiguration pitfalls. Use when setting up a new botcore project, configuring thresholds, adding per-package overrides, troubleshooting config-related silent failures, or understanding the config loading flow. Triggers: config, configuration, botcore.toml, pyproject.toml, BotCoreConfig, thresholds, language detection, tool defaults, per-package, SkillsConfig.

Guides browser automation via botcore's CDP (Chrome DevTools Protocol) command suite. Covers session management (launch/attach/close), navigation and waiting, element interaction (click/type/fill/drag), DOM inspection with Shadow DOM traversal, diagnostics (screenshot/console/network/eval), form filling, multi-page management, and device emulation. Use when automating browsers, scraping web pages, testing web UIs, filling forms, taking screenshots, debugging frontend issues, or working with Shadow DOM components. Triggers: CDP, browser, Chrome, Chromium, automation, screenshot, click, fill form, Shadow DOM, console log, navigate, scrape, headless.

Guides caching strategy selection and implementation across the full stack including HTTP caching, application-level caching (Redis, in-memory), frontend data caching (SWR, TanStack Query), LLM response caching (prompt caching, semantic caching), database query caching, cache invalidation patterns, and distributed cache architectures. Covers cache-aside, read-through, write-through, write-behind patterns, eviction policies (LRU/LFU), and agentic workflow caching considerations. Use when adding caching to an application, choosing a caching strategy, debugging stale data, optimizing API response times, reducing LLM costs, or designing distributed cache topologies. Triggers: cache, caching, Redis, CDN, TTL, cache invalidation, stale data, Cache-Control, ETag, SWR, TanStack Query, prompt caching, semantic cache, LRU, write-through, cache-aside, materialized view.

Performs research-grounded code, spec, and proposal reviews using the Fresh Agent pattern and Generator-Critic loop. Covers codebase verification, API validation, spec density analysis, structured checklists across code quality, security, testing, performance, and documentation, and structured feedback output with BLOCKER/IMPROVEMENT/PRAISE classification. Use when reviewing PRs, proposals, specs, or any code artifact.

Enforces language-specific coding conventions for Python, TypeScript, HTML, and CSS. Covers style rules, naming conventions, type safety, error handling, security practices, and performance patterns. Use when writing new code, reviewing pull requests, refactoring existing code, or applying linting and formatting rules. Triggers: code review, coding standards, Python style, TypeScript conventions, ESLint, Prettier, formatting, linting, BEM, PEP 8, type hints, error handling, security, performance, naming conventions.

Run quality gates, clean up temp files, update docs, and commit changes. Two modes: quick (automated checks + commit) and full (checks + cleanup + docs gate + self-review + commit). Delegates to commit-writer for message generation. Use when ready to finalize and commit changes.

Generates clear, consistent commit messages following Conventional Commits format with project-appropriate scopes and changelog-friendly structure. Covers commit types, scope selection, subject/body/footer rules, breaking changes, multi-package commits, and anti-pattern avoidance. Use when writing commits, reviewing staged changes, generating commit messages, or enforcing commit conventions. Triggers: commit, commit message, write commit, generate commit, staged changes, conventional commits, git commit, changelog.

Guides Playwright E2E testing, visual regression screenshots, Shadow DOM querying, and axe-core accessibility checks for web components. Covers test file structure, baseline management, WCAG 2.2 AA assertions, keyboard navigation, design token verification, and the build-test-verify loop. Use when writing component tests, debugging visual regressions, setting up accessibility checks, or querying Shadow DOM elements. Triggers: playwright, e2e, visual test, component test, screenshot, axe, accessibility test, shadow dom, wcag, visual regression.

Provides guidance on concurrency and async patterns for TypeScript and Python applications. Covers structured concurrency, parallel execution, race condition prevention, backpressure, rate limiting, event loop internals, database locking strategies, and agent-safe concurrent operations. Use when implementing async workflows, parallelizing tasks, preventing race conditions, managing connection pools, rate-limiting API calls, or building concurrent agentic pipelines. Triggers: concurrency, async, parallel, race condition, deadlock, semaphore, mutex, backpressure, rate limit, event loop, worker threads, asyncio, TaskGroup, Promise.all, connection pool, optimistic locking.

Guides UX writing for user-facing interface text. Covers UI labels, button text, error messages, empty states, tooltips, dialog copy, headings, capitalization rules, voice and tone, and product terminology. Use when writing or reviewing any user-facing text in a prototype or production UI, crafting error messages, defining empty state copy, choosing button labels, or enforcing consistent terminology. Triggers: content design, UX writing, UI text, error message, button label, empty state, tooltip, dialog text, capitalization, terminology, microcopy, voice and tone.

Identifies and remediates AI-generated text patterns including lexical signatures, syntactic rigidity, and structural tells that flag content as machine-written. Covers vocabulary replacement, sentence variation, specificity injection, and voice transformation across all content types. Use when reviewing content for authenticity, improving AI drafts, eliminating robotic writing patterns, or auditing text before publishing. Triggers: humanize, AI detection, sounds like AI, robotic writing, AI tells, machine-written, synthetic text, ai content, ai patterns, writing style.

Tracks cutting-edge CSS features, CSSWG specifications, and browser support status. Covers emerging layout primitives (Grid Lanes, Gap Decorations, Anchor Positioning), new selectors and scoping mechanisms, adoption tiers, and progressive enhancement strategies. Use when evaluating new CSS capabilities for production readiness, planning layout strategies with emerging specs, checking browser support for modern CSS, or reviewing CSSWG decisions that affect component architecture. Triggers: modern css, new css, css features, csswg, grid lanes, masonry, gap decorations, anchor positioning, css nesting, container queries, scope, css frontier, emerging css, flex-wrap balance, view transitions, starting-style.

Guides database schema design, migration strategies, query optimization, ORM patterns, and data validation for relational, document, and graph databases. Covers normalization, indexing, event sourcing, CQRS, and boundary validation with agent-friendly modeling practices. Use when designing new schemas, planning migrations, optimizing queries, choosing between database paradigms, or setting up data validation. Triggers: schema, database, migration, model, ORM, Prisma, Drizzle, index, query optimization, normalization, event sourcing, CQRS, validation, Zod, Pydantic.

Guides dependency evaluation, selection, and lifecycle management for software projects. Covers package health assessment (OpenSSF Scorecard, maintenance signals, popularity metrics), vendoring vs forking decisions, major version upgrade strategies, automated update tooling (Dependabot, Renovate), supply chain security (SLSA, Sigstore, SBOM, provenance), monorepo dependency patterns, and agentic workflows for dependency operations. Use when evaluating new packages, adding dependencies, upgrading major versions, configuring automated updates, auditing dependency health, making vendor-or-fork decisions, or securing the software supply chain. Triggers: dependency, package, npm install, pip install, cargo add, upgrade, update, vendoring, fork, supply chain, SBOM, SLSA, Dependabot, Renovate, lockfile, vulnerability, dependency health, monorepo dependencies.

Guides containerization, CI/CD pipeline setup, and production deployment. Covers Dockerfile best practices, GitHub Actions workflows, secret management, health checks, resource limits, environment parity, and rollback strategies. Use when building Docker images, configuring pipelines, preparing deployments, or reviewing infrastructure code. Triggers: Docker, CI/CD, deployment, Kubernetes, pipeline, container, GitHub Actions, infrastructure, deploy.

Guides the Figma design-to-code workflow using MCP integration, token extraction, and structured implementation. Covers Figma MCP setup, authentication, URL parsing, design context retrieval, token translation from Tailwind/Figma output to CSS custom properties, icon identification, asset management, and Code Connect mapping. Use when implementing a design from Figma, setting up the Figma MCP server, extracting design specs, translating design tokens, or converting React/Tailwind output to web components. Triggers: figma, design, design-to-code, implement design, figma link, screenshot, mcp, design tokens, figma mcp.

Guides usage of botcore's development commands for linting, testing, building, quality gates, and static analysis. Covers dev_lint/dev_test/dev_build (language-aware dispatch), quality checks (file size, coverage, dependency staleness), static analysis (dead code, circular imports, unused deps, dependency graphs), portability checks, and skill linting. Use when running dev checks, understanding quality thresholds, diagnosing lint or test failures, analyzing code quality, or checking cross-platform portability. Triggers: dev lint, dev test, dev build, coverage, file size, dead code, circular imports, unused deps, dependency graph, portability, skill lint.

Dev environment hygiene for agentic development. Prevents global package pollution, version drift, PATH entropy, and lockfile conflicts across Python, Node.js, and system tooling. Covers installation best practices, audit workflows, cleanup playbooks, and cross-platform patterns (Windows + macOS). Use when installing packages, configuring MCP servers, setting up toolchains, debugging import/resolution errors, or cleaning up polluted environments.

Manages documentation architecture, review, staleness detection, and maintenance policy across project repositories. Covers README, AGENTS.md, CLAUDE.md, CHANGELOG, ROADMAP, doc sites, and skill indexing. Use when creating docs, reviewing documentation structure, auditing for staleness, updating changelogs, maintaining roadmaps, or enforcing documentation standards. Triggers: docs, documentation, readme, changelog, roadmap, agents.md, claude.md, doc site, docsify, update docs, sync docs, documentation audit, docs review.

Run a documentation update pass across CHANGELOG, AGENTS.md, README.md, and skill files. Ensures docs reflect current code state with proper changelog formatting, semver alignment, and version-tag consistency. Standalone skill — invoke directly, not only as part of commit.

Detects code duplication using hybrid analysis combining algorithmic (JSCPD) and semantic (AI) techniques. Covers Type-1 through Type-4 clone detection, safe refactoring workflows, and duplication prevention strategies. Use when scanning for copy-paste code, reducing code bloat, consolidating duplicate utilities, or improving DRY compliance. Triggers: duplicates, duplication, copy paste, code clone, DRY, refactor.

Provides error handling patterns and recovery strategies for TypeScript and Python applications. Covers custom error hierarchies, Result/Either types (neverthrow, Effect), discriminated union errors, retry with exponential backoff and circuit breakers, RFC 9457 structured API error responses, exception groups, error observability, and agent-safe error recovery with graceful degradation. Use when designing error handling strategies, implementing Result types, adding retry logic, building error hierarchies, creating structured API errors, or making agent workflows resilient. Triggers: error handling, Result type, Either, neverthrow, Effect, retry, circuit breaker, backoff, error hierarchy, RFC 9457, error recovery, exception, try-catch, error boundary, structured errors, error logging.

Guides implementation and lifecycle management of feature flag systems with reactive stores, declarative gating elements, and handler delegation patterns. Covers flag definition schemas (types, expiry, dependencies, exclusions), flag store singletons, declarative frontend gating via custom elements, backend handler delegation for command variants, naming conventions, lifecycle management (creation, validation, cleanup), and hygiene compliance checks. Use when adding feature flags, gating UI components, swapping backend implementations behind flags, managing flag lifecycle, or auditing stale flags. Triggers: flag, feature flag, toggle, gate, feature toggle, variant, flag store, flag hygiene, kill switch.

Orchestrates git workflows including branching strategies, release management, conflict resolution, changelog generation, and multi-agent parallel development. Covers trunk-based development, GitHub Flow, stacked PRs, conventional commits, semantic versioning, git worktrees, monorepo strategies, and git hooks automation. Use when choosing branching strategies, setting up release pipelines, resolving merge conflicts, configuring git hooks, managing changelogs, coordinating parallel agent work with worktrees, or adopting monorepo patterns. Triggers: git workflow, branching strategy, release management, merge conflict, changelog, git hooks, worktree, monorepo, semantic versioning, trunk-based, GitHub Flow, stacked PRs, git automation, parallel development.

Create a hotfix branch from the latest release tag, apply a minimal targeted fix, verify with quality gates, and fast-track through commit and PR. Enforces scope discipline — hotfixes are minimal fixes only, no refactoring or features. Delegates to commit and pr for the landing steps. Use for emergency or urgent production fixes.

Guides implementation of internationalization and localization in web applications. Covers string externalization, pluralization, date/number/currency formatting, RTL layout support, translation file structure, translation workflows, and library selection across JavaScript, React, Vue, and Python ecosystems. Use when adding multi-language support, preparing for international markets, handling RTL layouts, formatting locale-sensitive data, externalizing hardcoded strings, or setting up translation pipelines. Triggers: i18n, internationalization, l10n, localization, translations, RTL, locale, language, multi-language, right-to-left, Intl, pluralization, translation files, react-intl, i18next, vue-i18n, gettext, string externalization.

Performs OSS license compliance audits, dependency license analysis, and SBOM generation. Covers license categorization (permissive, copyleft, public domain), compatibility matrices, per-ecosystem audit tooling (Node.js, Python, Go), CI/CD license gate integration, required attribution files, and red-flag detection. Use when adding dependencies, auditing existing licenses, checking compatibility, generating SBOMs, preparing for release, or setting up license enforcement in CI. Triggers: license, licensing, OSS compliance, SBOM, GPL, MIT, Apache, copyleft, dependency audit, license check, attribution, SPDX, CycloneDX, bill of materials.

Guides integration of LLMs into applications with production-grade patterns. Covers prompt engineering, structured outputs, tool use, RAG pipelines, embeddings, agentic patterns, evaluation, cost optimization, and guardrails for both TypeScript and Python. Use when building AI-powered features, integrating Claude or OpenAI APIs, designing RAG systems, implementing agents, optimizing LLM costs, or adding safety guardrails. Triggers: LLM, AI integration, prompt engineering, RAG, embeddings, tool use, structured output, agent, eval, guardrails, Claude API, OpenAI.

Guides construction of MCP servers using FastMCP 2.x with emphasis on token budget management, tool consolidation, output truncation, and the execute pattern for Opus compatibility. Covers async subprocess patterns, safe output limits, and action-based tool design. Use when creating MCP servers, debugging tool overload or context overflow, optimizing token usage, fixing Opus silent failures, or consolidating tools. Triggers: MCP, FastMCP, tool schema, token limit, context overflow, MCP server, execute pattern, tool consolidation.

Guides orchestration of system migrations, framework upgrades, dependency version bumps, database schema evolution, and codemod generation with safe incremental transformation patterns. Covers strangler fig, expand-contract, parallel run, dual-write verification, feature-flag-gated rollouts, AST-based codemods (jscodeshift, ts-morph, libcst), and agentic migration workflows where AI agents discover, transform, verify, and land changes at scale. Use when upgrading frameworks, migrating APIs, evolving database schemas, generating codemods, planning incremental migrations, or orchestrating large-scale automated refactors. Triggers: migrate, migration, upgrade, codemod, schema evolution, strangler fig, expand-contract, version bump, framework upgrade, dependency upgrade, database migration.

Guides implementation of structured logging, metrics collection, and distributed tracing for production services. Covers the three pillars of observability (logs, metrics, traces), OpenTelemetry integration, correlation ID propagation, alerting thresholds, and common anti-patterns. Use when adding monitoring to a service, debugging production issues, improving error visibility, setting up alerting, or instrumenting business metrics. Triggers: observability, logging, metrics, tracing, monitoring, OpenTelemetry, alerts, instrumentation, structured logs, correlation ID.