chore(deps): replace cursor-rules with laravel-agent-skills

[pekral]

Co se mění

Projekt přechází z balíčku pekral/cursor-rules na agentic-vibes/laravel-agent-skills.

chore(deps): výměna balíčku

• require-dev i allow-plugins: pekral/cursor-rules → agentic-vibes/laravel-agent-skills
• build skript: vendor/bin/cursor-rules install --force --editor=claude → vendor/bin/agent-skills install --force — nový balíček cílí výhradně na Claude Code, přepínač --editor už nemá
• přidán repositories VCS záznam — balíček není publikovaný na Packagistu
• odstraněny zbytky Cursoru: pravidlo .cursor/* v .gitignore a zmínka .cursor/ v CLAUDE.md

ci: autentizace Composeru

Repozitář agentic-vibes/laravel-agent-skills je privátní a leží v jiné organizaci, takže GITHUB_TOKEN tohoto repa na něj nedosáhne. Oba workflow dostaly job-level COMPOSER_AUTH se secretem AGENTIC_VIBES_TOKEN — token se tak nezapisuje na disk runneru.

Blokující předpoklad

Important

Secret AGENTIC_VIBES_TOKEN v repu zatím neexistuje (gh secret list je prázdný). Dokud nevznikne, composer install v CI selže na nedostupném privátním balíčku.

gh secret set AGENTIC_VIBES_TOKEN --repo pekral/phpcs-rules

PAT potřebuje read přístup k organizaci agentic-vibes.

Dopad na skills

Instalace proběhla a je ověřená: 6 agentů, 12 kategorií rules (soubory 1:1 shodné s předchozí instalací), 49 skills.

Skills ubylo z 61 na 49 — nechybí zaviněním této změny, nový balíček je odstranil záměrně (changelog, issue #6 „Removed 13 unused Agent skills", plus record-project-memory):

article-writing, automation-audit-ops, autonomous-loops, autoresolve-oldest-github-issue, benchmark, benchmark-optimization-loop, blueprint, composer-update, penetration-tester, production-audit, record-project-memory, refresh-claude-md, slack-messaging, test-like-human

Naopak přibylo _shared a laravel-authorization-review.

Jak to otestovat

composer install
composer build

composer build musí projít s exit 0 — lokálně ověřeno, včetně nového kroku vendor/bin/agent-skills install --force (251 souborů). Zkontroluj, že .claude/ obsahuje agents/ (6), rules/ (12 kategorií) a skills/ (49).

Testy

no — změna se dotýká pouze konfigurace balíčků a CI, žádný aplikační kód nemá nové chování k pokrytí. Stávající sada (10 testů) prochází beze změny.

Poznámka mimo rozsah

Stejný .cursor/ řádek zůstává v CLAUDE.md uvnitř balíčku agentic-vibes/laravel-agent-skills — každý nový projekt ho zdědí. Patří to opravit upstream, ne tady.

[pekral]

Code Review

Status: needs-fix
Counts: Critical 1 · Moderate 1 · Minor 1 · Refactoring 0
Last updated: 2026-07-26T07:15:36Z
Issue tracker summary: no linked issue — issue summary skipped

---

Technical Review

Findings

🔴 Critical 1. CI is red on every run until AGENTIC_VIBES_TOKEN exists

• Location: .github/workflows/ci.yml:13
• Rule: @rules/git/general.mdc#Merging
• Impact: composer install cannot resolve the new dependency, so the whole check suite fails. This is not confined to this PR — once merged, every push and pull request against master goes red until the secret is created, because the dependency moved from a public Packagist package to a private cross-org repository.
• Faulty Example: run 30192362195 on head 27fb674:

  COMPOSER_AUTH: {"github-oauth":{"github.com":""}}
  Failed to clone the git@github.com:agentic-vibes/laravel-agent-skills.git repository
  remote: Repository not found.
  fatal: Authentication failed for 'https://github.com/agentic-vibes/laravel-agent-skills.git/'
  

  gh secret list --repo pekral/phpcs-rules returns nothing, so the expression expands to an empty token.
• Expected behavior: the Checks (PHP 8.5) job completes with conclusion == "success" on the head commit.
• Test hint: re-run the CI workflow on this branch and assert the Install dependencies step exits 0.
• Suggested fix: the fix is an out-of-band repository setting, not a diff change — create the secret with a PAT holding read access to the agentic-vibes organisation:

  gh secret set AGENTIC_VIBES_TOKEN --repo pekral/phpcs-rules

  Publishing the package (Packagist or Private Packagist) is the alternative; it would also let the repositories block be dropped. Note that forked pull requests never receive repository secrets, so a fork-based contribution will keep failing on this step regardless.

🟠 Moderate 1. Private-repo PAT is exposed to every step in the job, including third-party actions

• Location: .github/workflows/composer-update.yml:16, .github/workflows/ci.yml:13
• Rule: @rules/security/backend.md#Malicious Code & Supply-Chain Indicators (issue #549)
• Impact: env declared at job level is injected into the environment of every step, not just the Composer ones. In composer-update.yml that includes shivammathur/setup-php@v2, actions/cache@v4 and peter-evans/create-pull-request@v6 — three third-party actions pinned to mutable major tags. A compromised or retagged release of any of them can read the PAT straight out of the environment and gain read access to the private agentic-vibes organisation. Only two steps in that workflow actually talk to the private repository.
• Faulty Example:

  jobs:
    update:
      env:
        COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.AGENTIC_VIBES_TOKEN }}"}}'
      steps:
        - uses: peter-evans/create-pull-request@v6   # receives the PAT it never needs

• Expected behavior: COMPOSER_AUTH is present only in the environment of the steps that invoke Composer against the private repository; every other step's environment does not contain the token.
• Test hint: inspect the rendered workflow logs — the env: group printed above each step must show COMPOSER_AUTH on the Composer steps only.
• Suggested fix: scope it per step (ci.yml needs it on Install dependencies alone; composer-update.yml on Install dependencies and Update composer dependencies):

        - name: Install dependencies
          run: composer install --prefer-dist --no-progress --no-suggest
          env:
            COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.AGENTIC_VIBES_TOKEN }}"}}'

🟡 Minor 1. Dropping the .cursor/* ignore rule exposes local Cursor artifacts

• Location: .gitignore:3 (removed line)
• Note: the rule cost nothing while it was there, and anyone still opening this repo in Cursor will now see .cursor/ show up as untracked and can commit it by accident; the new package dropping Cursor support does not stop the editor from writing that directory.

---

Functional Review

All stated assignment requirements are satisfied — the package is swapped in require-dev, allow-plugins and the build script, the Cursor leftovers are gone, and vendor/bin/agent-skills install --force reproduces the .claude/ tree (6 agents, 12 rule categories byte-identical to the previous install, 49 skills).

One deviation is recorded rather than raised as a gap: 14 skills present under pekral/cursor-rules do not exist in the new package (article-writing, automation-audit-ops, autonomous-loops, autoresolve-oldest-github-issue, benchmark, benchmark-optimization-loop, blueprint, composer-update, penetration-tester, production-audit, record-project-memory, refresh-claude-md, slack-messaging, test-like-human). They were removed upstream on purpose (changelog, issue #6), so full parity is not reachable from this repository — it would need those skills restored in agentic-vibes/laravel-agent-skills. The author was informed of the list and chose to proceed.

---

Summary: 1 Critical · 1 Moderate · 1 Minor · 0 Refactoring · assignment conformance: no linked issue · no linked issue — issue summary skipped

[pekral]

Code Review

Status: needs-fix
Counts: Critical 1 · Moderate 0 · Minor 1 · Refactoring 0
Last updated: 2026-07-26T07:19:09Z
Issue tracker summary: no linked issue — issue summary skipped

---

Technical Review

Findings

🔴 Critical 1. CI is red on every run until AGENTIC_VIBES_TOKEN exists

• Location: .github/workflows/ci.yml:16
• Rule: @rules/git/general.mdc#Merging
• Impact: composer install cannot resolve the new dependency, so the whole check suite fails. This is not confined to this PR — once merged, every push and pull request against master goes red until the secret is created, because the dependency moved from a public Packagist package to a private cross-org repository.
• Faulty Example: run 30192518586 on head b6ee7ee — the same failure as on 27fb674:

  COMPOSER_AUTH: {"github-oauth":{"github.com":""}}
  remote: Repository not found.
  fatal: Authentication failed for 'https://github.com/agentic-vibes/laravel-agent-skills.git/'
  

  gh secret list --repo pekral/phpcs-rules returns nothing, so the expression expands to an empty token.
• Expected behavior: the Checks (PHP 8.5) job completes with conclusion == "success" on the head commit.
• Test hint: re-run the CI workflow on this branch and assert the Install dependencies step exits 0.
• Suggested fix: the fix is an out-of-band repository setting, not a diff change — create the secret with a PAT holding read access to the agentic-vibes organisation:

  gh secret set AGENTIC_VIBES_TOKEN --repo pekral/phpcs-rules

  Publishing the package (Packagist or Private Packagist) is the alternative; it would also let the repositories block be dropped. Note that forked pull requests never receive repository secrets, so a fork-based contribution will keep failing on this step regardless.

🟡 Minor 1. Dropping the .cursor/* ignore rule exposes local Cursor artifacts

• Location: .gitignore:3 (removed line)
• Note: deferred with a recorded reason — removing every Cursor trace was an explicit part of the assignment, and the author confirmed it. Anyone still opening this repo in Cursor will see .cursor/ as untracked; restoring the single ignore line later costs nothing.

---

Functional Review

All stated assignment requirements are satisfied — the package is swapped in require-dev, allow-plugins and the build script, the Cursor leftovers are gone, and vendor/bin/agent-skills install --force reproduces the .claude/ tree (6 agents, 12 rule categories byte-identical to the previous install, 49 skills).

One deviation is recorded rather than raised as a gap: 14 skills present under pekral/cursor-rules do not exist in the new package (article-writing, automation-audit-ops, autonomous-loops, autoresolve-oldest-github-issue, benchmark, benchmark-optimization-loop, blueprint, composer-update, penetration-tester, production-audit, record-project-memory, refresh-claude-md, slack-messaging, test-like-human). They were removed upstream on purpose (changelog, issue #6), so full parity is not reachable from this repository — it would need those skills restored in agentic-vibes/laravel-agent-skills. The author was informed of the list and chose to proceed.

Resolved since the previous run

🟠 Moderate 1 — private-repo PAT exposed to every step in the job — fixed in b6ee7ee. COMPOSER_AUTH now sits on Install dependencies (ci.yml) and on Install dependencies / Update composer dependencies (composer-update.yml); no job-level declaration remains, so setup-php, cache and create-pull-request no longer receive the token.

---

Summary: 1 Critical · 0 Moderate · 1 Minor · 0 Refactoring · assignment conformance: no linked issue · no linked issue — issue summary skipped