Playbook

Create an agent team to review and fix issues in the auth module. Spawn three teammates:
- A security reviewer focused on vulnerabilities in src/auth/
- A fixer that implements the security reviewer's recommendations
- A verifier that runs the test suite and validates fixes don't break anything
 
The fixer should wait until the security reviewer completes their review.
The verifier should wait until the fixer completes their fixes.

---
name: security-reviewer
description: Reviews code for security vulnerabilities. Use proactively after code changes touching auth, sessions, or tokens.
tools: Read, Grep, Glob, Bash
model: opus
memory: project
---
 
You are a senior security engineer reviewing code for vulnerabilities.
 
Focus areas:
- Authentication and authorization flaws
- Injection vulnerabilities (SQL, XSS, command injection)
- Token handling and session management
- Input validation and sanitization
- Secrets exposure
 
Rate each finding as Critical, High, Medium, or Low.
Always reference specific file paths and line numbers.
 
Update your agent memory with patterns you discover in this codebase.

{
  "hooks": {
    "TaskCompleted": [
      {
        "hooks": [
          {
            "type": "command",
            "command": "bash -c 'INPUT=$(cat); SUBJECT=$(echo \"$INPUT\" | jq -r \".task_subject\"); if echo \"$SUBJECT\" | grep -qi \"fix\"; then npm test 2>/dev/null || (echo \"Tests must pass before marking fix tasks complete\" >&2 && exit 2); fi; exit 0'"
          }
        ]
      }
    ]
  }
}

Create an agent team to fix all failing tests. Run the full suite first, then:
- Spawn one teammate per failing test file
- Each teammate should diagnose and fix their assigned test
- Use worktrees so teammates don't conflict
 
Use Sonnet for each teammate to keep costs down.

---
name: test-fixer
description: Diagnoses and fixes failing tests
tools: Read, Grep, Glob, Bash, Edit, Write
model: sonnet
isolation: worktree
---
 
You are a test debugging specialist.
 
Workflow:
1. Run the specific test file you've been assigned
2. Read the error output carefully
3. Trace the failure to the source code
4. Fix the root cause (prefer fixing the code over fixing the test)
5. Run the test again to verify the fix
6. If the fix touches shared code, run the full suite to check for regressions
 
Never modify test expectations to make tests pass unless the old expectation was genuinely wrong.

Create an agent team for implementing the new caching layer:
 
1. Spawn a researcher to investigate our current data access patterns,
   identify hot paths, and recommend a caching strategy. Require plan
   approval before they write any implementation notes.
 
2. After the researcher completes, spawn an implementer to build the
   caching layer following the researcher's recommendations.
 
3. After the implementer completes, spawn a verifier to:
   - Run the full test suite
   - Run benchmarks comparing before/after performance
   - Review the implementation for cache invalidation correctness
 
Use Opus for the researcher, Sonnet for the implementer and verifier.

---
name: refactor-module
description: Orchestrate a multi-agent refactoring of a module
disable-model-invocation: true
allowed-tools: Bash(git *) Bash(npm test *)
---
 
Refactor the module at $ARGUMENTS using an agent team:
 
1. Create an agent team with three teammates:
 
   **Analyst** (Opus, plan mode):
   - Map all usages of the module across the codebase
   - Identify the public API surface vs internal implementation
   - Document all integration points and consumers
   - Produce a refactoring plan with specific file-by-file changes
   - Require plan approval before proceeding
 
   **Implementer** (Sonnet):
   - Wait for the analyst's plan to be approved
   - Execute the refactoring plan file by file
   - Maintain backward compatibility for the public API
   - Add deprecation warnings where APIs change
 
   **Regression Checker** (Sonnet):
   - Wait for the implementer to complete
   - Run the full test suite
   - Run type checking
   - Verify no new linting errors
   - Check that all deprecated API usages have migration paths
   - Report any regressions found

Create an agent team to document the API module at src/api/:
 
- Reader: use the Explore agent type. Scan all API endpoints, extract
  request/response schemas, identify authentication requirements, and
  list all error codes. Write findings to a scratch file.
 
- Writer: wait for the reader. Take the reader's findings and generate
  JSDoc comments for all exported functions, plus a README.md for the
  api/ directory. Follow our existing documentation style.
 
- Reviewer: wait for the writer. Review all generated documentation
  against the actual code. Flag any inaccuracies, missing parameters,
  or incorrect return types. Send corrections back to the writer.

Users report the app exits after one message instead of staying connected.
Spawn 5 agent teammates to investigate different hypotheses. Have them talk
to each other to try to disprove each other's theories, like a scientific
debate. Update the findings doc with whatever consensus emerges.

# Control costs with model selection
---
name: quick-researcher
model: haiku
---