deadlock-mod-manager

Version Bump

Generate a changeset file describing the current PR's changes. Use when asked to "create a changeset", "add a changeset", "/changeset", or after implementing a feature/fix that needs a changelog entry. Produces a randomly named `.changeset/*.md` file with affected packages, bump type, and an 80-character-max user-facing summary.

Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

Find deepening opportunities in a codebase, informed by the architecture docs in apps/docs/content/docs/developer-docs/. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more testable and AI-navigable.

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.

Split React/TSX files containing multiple inlined components into separate single-responsibility files. Use when asked to "split components", "extract components", "single responsibility", "clean up component file", "too many components in one file", "component slop", or when running deslop/cleanup on React code.

Analyze code for useEffect anti-patterns per react.dev and optionally apply fixes

Enforce VPK manifest updates whenever VPK files are created, moved, renamed, enabled, disabled, or deleted. Use when modifying VPK-related Rust code, touching vpk_manager, manager.rs, mods.rs, profiles.rs, or any code that mutates the addons directory. Prevents state drift between on-disk VPKs and the .dmm.json manifest.

Fetches forum suggestion threads from the Deadlock Mod Manager Discord via the user-discord-mcp, classifies each as MOD/SKIN_REQUEST, MOD_MANAGER_FEATURE, or OTHER, writes one markdown file per thread under .suggestions/ with author metadata, and applies the processed forum tag. Use when the user runs a suggestion sweep, "process Discord suggestions", "export suggestions from Discord", "tag processed suggestions", or when integrating the Discord MCP with the suggestions backlog workflow.

Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Use when asked to "simplify code", "clean up code", "refactor for clarity", "improve readability", or review recently modified code for elegance. Focuses on project-specific best practices.

Commit Staged Changes

Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.

Update the Deadlock Mod Manager server browser implementation to match the latest Deadworks Relay Mesh Protocol v1 spec at ../deadworks-relay/spec/PROTOCOL.md. Use when the user asks to "sync server browser with relay spec", "update relay protocol", "match deadworks-relay spec", "update required_mods schema", "regenerate relay types", or when changes land in ../deadworks-relay that affect protocol shapes (registration, heartbeat, list/get servers, gossip, auth challenge, relays.json).

Remove AI code slop

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

Fix PR Comments

Git Conventions: Guidelines for commit messages, branch naming, and version control practices

Logging best practices focused on wide events (canonical log lines) for powerful debugging and analytics

Fetch source code for npm, PyPI, or crates.io packages and GitHub/GitLab repos to provide AI agents with implementation context beyond types and docs. Use when needing to understand how a library works internally, debug dependency issues, or explore package implementations.

Fetch the latest default branch and rebase the current branch on top of it, resolving any merge conflicts automatically. Use when asked to "rebase", "rebase on main", "update branch with main", "sync with main", "rebase onto latest", or "/rebase".

Use when commits on a feature branch are messy, out of logical order, mix unrelated changes, or need restructuring before a PR - also triggered by "clean up history", "reorganize commits", "recompose branch", "make commits logical", or similar

Security code review for Tauri/Rust/TypeScript desktop apps and Hono/oRPC APIs. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", or review code for injection, XSS, IPC abuse, path traversal, or authentication issues. Provides confidence-based reporting tuned to the Deadlock Mod Manager stack.

Create new agent skills following the Agent Skills specification. Use when asked to "create a skill", "add a new skill", "write a skill", "make a skill", "build a skill", or scaffold a new skill with SKILL.md. Guides through requirements, planning, writing, registration, and verification.

Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.

React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.

Manage git worktrees using wtx CLI for parallel development workflows on Windows. Use when asked to "create a worktree", "add a worktree", "switch worktree", "remove worktree", "list worktrees", "clean worktrees", "wtx", or set up parallel development branches.