nervepack-content-example

How to add real images and icons to a project by pulling them from a source — stock photos via a provider API (Pexels default, Unsplash swap) behind one swappable constant, and icons via Iconify/astro-icon (Lucide) — with a dormant-safe fetch-script pattern, Astro src/assets optimization, and an images[] content field. Use when a site/blog needs real photos or proper SVG icons instead of emoji/gradient placeholders, or when wiring per-post imagery.

Defensive patterns for Chrome MV3 content scripts that have to survive host-app surprises — extension reloads orphaning the chrome.* namespace, host frameworks recycling DOM elements between component instances. Use when writing or debugging any content script that injects into a third-party page or holds long-lived observers/listeners.

Rules for organizing assets in a Chrome MV3 extension repo and the Chrome Web Store submission asset checklist. Use when adding icons or promo art, packaging a build for upload, or auditing whether a repo is ready for store submission.

Gotchas for driving the `claude` CLI headlessly (`-p`/`--print`) from shell scripts, hooks, and crons, AND for writing Claude Code lifecycle hooks safely. Pass the prompt via stdin — the variadic `--allowedTools <tools...>` silently eats a trailing positional prompt and aborts the CLI. SessionStart fires repeatedly (startup/resume/clear/compact) so guard GUI/side-effects to once-per-boot or they can loop. Use when writing or debugging any script, SessionStart/SessionEnd/PreCompact/UserPromptSubmit hook, or cron wrapper (nervepack's own episodic capture/maintain/evaluator/recall hooks and the dashboard-launch hook all rely on this).

Framework-level UI implementation gotchas (Preact/React and similar) that bite repeatedly — focusing/selecting dynamically-mounted inputs, making inline-edit commit exactly once, and silencing ResizeObserver loop warnings. Use when building editable/inline-rename fields, doing focus management, wiring a ResizeObserver, or debugging "the input won't focus", "typing doesn't replace the text", "it saved twice / didn't save", or "ResizeObserver loop completed with undelivered notifications", or a CSS bar/progress "fill" that renders invisibly because an inline element ignores width/height.

Gotchas when committing/inspecting changes with git via a shell (esp. the Bash tool) that lead to wrong commits or wrong conclusions. Chiefly — a file MOVE split across two commits is NOT detected as a rename, so a `D old/path` in `git status` can be a move (content still exists elsewhere), not a deletion; and backticks/`$(...)` inside a double-quoted `git commit -m "..."` trigger shell command substitution and silently mangle the message. Use before writing a commit message that says "deleted/removed/retired", before `git add -A` in a dirty/reorg tree, or when a commit message came out garbled.

Gotchas for authoring portable Mermaid diagrams that render correctly on GitHub and in editor/VSCode previews — not just in an online validator. Use when writing or embedding a Mermaid diagram in Markdown, or debugging one that renders as raw text, shows literal `&entity;` codes in labels, or fails to draw on GitHub/VSCode even though mermaid.live says it's valid.

Gotchas when parsing/ingesting Markdown that was EXPORTED from a rich editor (Google Docs, Confluence, Notion, Word→MD) rather than hand-written. Chiefly: the exporter backslash-escapes Markdown special chars, so a regex that matches before unescaping silently truncates names and collapses distinct entities. Use when writing a parser or ingestion adapter over human-authored `.md` docs (data-model docs, wiki exports, spec dumps) — especially if some tables/sections come out empty or duplicated.

Methodical source-to-sink security audit for code changes — enumerate sources and sinks, verify escapers/validators still guard every sink, classify trust boundaries (attacker vs operator vs victim), then adversarially refute each candidate finding. Use when reviewing or auditing a diff or codebase for security (XSS/DOM, injection, SSRF, path traversal, credential handling, info disclosure), or when a task says "security review", "audit", "is this safe", or "check for vulnerabilities".

Testing-quality and CI gotchas for bash/Python + GitHub Actions projects (nervepack-style — stdlib tests, a discovery runner, a PII/secret gate). Use when writing or reviewing regression tests, wiring or debugging a CI workflow, a CI job that hangs or fails only in CI, deciding what a happy/failure test must assert, or before merging an agent-built branch. Complements [[np-kb-coding-rules]] (every script has a test; no LLM attribution).

A generic starter ruleset applied to every project — think before coding, simplicity first, surgical changes, goal-driven execution, no destructive data changes, native-tools-by-default, lock down anything you expose, skill/checklist-first on review tasks, audit consumers after moving a path. Use when writing, editing, or reviewing any code unless the project's own instructions override. Starting point — adapt or extend it for your own conventions.

TEMPLATE — copy into your content overlay and rename. Records your machine/environment choices (editor extensions, CLI tools, plugin stack, shell config) so a fresh box reproduces your setup and the agent knows what's installed. Use when bringing up a new machine or hitting a missing-tool error.

TEMPLATE — copy into your content overlay and rename to np-kb-<yourname>. Captures your project's visual identity (colors, type, spacing, components) so the agent defaults to your system instead of inventing values. Use when making any UI/design decision.

TEMPLATE — copy into your content overlay and rename. Points the agent at a piece of infrastructure you own (a site, a server, a self-hosted service) — where the repo is, the stack at a glance, how to reach it, which creds/profile to use. Use when working on that system so the agent doesn't rediscover it each time.