Platform capabilities

Auto-generated. Do not edit by hand. Run pnpm capabilities or commit any artifact change — scripts/build-capability-index.mjs regenerates this file.

Every entry below comes from the tags + description fields of an actual artifact. To add or change something here, edit the artifact itself, not this file.

Total: 136 artifacts — 27 agents · 35 skills · 35 commands · 26 hooks · 13 policies.

🪝 For hooks — grouped by when they fire — see the Hooks reference. 📐 For the team rules every session follows, see Team rules.

By use case

Authoring platform content authoring

• /breakdown (Command) — Break a feature / ClickUp parent task / design doc into one or more GitHub issues with the BeWith 6-section template + AI-assigned labels. Thin wrapper around the breakdown skill.
• /decision (Command) — Record a discussion that reached decisions as a durable ADR or Decision log entry, then offer to break its action items into tasks. Thin wrapper around the decision-record skill.
• /insight (Command) — Capture a "what's missing / what we could change" POC observation into docs/insights/ — fast, separate from proposals. Thin wrapper around the insight skill; the 2-3 day review promotes agreed insights to a proposal/ADR/task.
• /new-artifact (Command) — Start authoring a new platform artifact — agent, skill, command, rule, hook, or policy. Wraps the new-artifact skill.
• /normalize (Command) — R&D-side fallback that turns a raw product exploration (spec + mockup + remarks + ClickUp link) into the canonical PRD when the Cowork normalizer was skipped. Thin wrapper over the prd-writer agent; the resulting PRD is a draft the product owner must review and own.
• /plan-feature (Command) — Drive the architect to turn a PRD into a complete, reviewable Design Doc — researches the codebase and writes the full doc (TL;DR, API/schema/components, task breakdown with effort sizes), iterating on open questions. Not a skeleton.
• /propose (Command) — Propose a feature / infrastructure / process idea — drafts a markdown file under docs/proposals/ for the team to triage.
• /share-rule (Command) — Propose a generic insight as a team rule — opens a PR on bewith-docs for team discussion.
• brainstorm-spec (Skill) — For an ad-hoc dev task with no PRD — brainstorm the approach, converge on a short written spec, and get explicit approval BEFORE writing code. A lightweight design-before-code gate. Triggers on "let's design this", "how should I approach", "brainstorm this".
• breakdown (Skill) — Break a feature / ClickUp parent task / design doc into one or more GitHub issues with the BeWith 6-section template + AI-assigned effort/urgency/domain labels. Triggers on phrases like "break down this task", "create issues for this design", "פצל את המשימה הזאת ל-issues".
• cto-review (Skill) — Opens a CTO-review ticket in a dedicated ClickUp list, carrying the full handoff package (problem, UI composition, design reference, acceptance criteria, links). Title convention [Feature name] informative title, tag cto review. Runs at the end of the product flow or manually off-flow.
• decision-record (Skill) — Capture a discussion that reached decisions into a durable record — an ADR (technical) or a decision log entry (product/business) — then offer to break its action items into tasks via /breakdown. Worktree-isolated. Triggers on "record this decision", "תעד את ההחלטה".
• design-an-interface (Skill) — Turn a screen/feature requirement into a concrete UI composition from the design system — which COMPONENTS.md components, layout, states, and tokens — the machine-consumable design reference when there's no Figma (Path B). Flags gaps as /add-component; never invents components or raw hex.
• draft-proposal (Skill) — Turn a feature / infrastructure / process idea into a markdown file under docs/proposals/ in bewith-docs. Worktree-isolated, safe across concurrent sessions. Invoked by /propose or by Claude after the developer confirms.
• i18next-translation (Skill) — Find hardcoded user-facing strings, replace them with t() calls, and add the keys to both he/en locale files. Use when translating components, internationalizing text, or converting hardcoded strings. Owned by i18n-localization; used by frontend-developer.
• incident-report (Skill) — Render a finished incident / investigation into a browser-viewable RTL-Hebrew HTML report artifact (via the Artifact tool) — root cause, evidence, impact, timeline, fix. Use after investigating, not for finding bugs (see identify-bug).
• insight (Skill) — Capture a what's-missing / could-change POC observation into docs/insights/ — fast, separate from proposals. Worktree-isolated. Invoked by /insight or when the developer voices a gap or possible change during the build. Does NOT create a proposal; the 2-3 day review promotes agreed insights.
• mermaid-diagrams (Skill) — Create version-controllable software diagrams with Mermaid's text syntax — flowcharts, sequence, class, ERD, C4/architecture, state. Use when documenting architecture, a data model, an API/auth flow, or a DB schema, or any "diagram / visualize / map out the flow" request.
• new-artifact (Skill) — Create or update a platform artifact (agent, skill, command, rule, hook, policy) in bewith-docs. Walks the artifact-types decision tree, audits for duplication, drafts file(s), opens a PR. Triggers on phrases like "create an agent", "add a skill", "צריך command".
• postman-endpoint (Skill) — Save an added or changed HTTP endpoint in the organization R&D Postman workspace with a sample request and a saved response example, at the end of development. The Definition-of-Done step for API work — keeps the collection an accurate, runnable contract. Never commits secrets.
• prd-writer (Agent) — Produces Product Requirements Documents that R&D reads. Use proactively when a product owner describes a feature intent that needs capturing as a PRD at docs/prds/. Fills the PRD template, anchors UI to the design-system catalog, self-checks Definition of Ready, hands to gatekeeper.
• propose-team-rule (Skill) — Turn a generic insight into a reviewable PR on bewith-docs for team discussion. Worktree-isolated, safe across concurrent sessions. Invoked by /share-rule or by Claude after the developer confirms. Never auto-invoke without explicit approval — each PR consumes review attention.
• team-rule-prompt (Hook) — SessionStart hook. Injects the team-rule discrimination guidance into Claude's additionalContext so it knows when to propose a team rule vs. save a personal memory.

Automation automation

• /claude-init (Command) — Migrate an existing bewith-dev repo onto the platform — scaffold CLAUDE.md + the CI caller, retire legacy .cursor rules (archive then rewrite repo-specific ones into CLAUDE.md), verify the plugin + git hooks load. Worktree-isolated; prepares a reviewable branch, never merges.
• /infra (Command) — Report this machine's bewith infrastructure — node/npm/CLI/plugin versions + health (GH_TOKEN, git hooks). Runs bewith doctor and relays it, with the one-line fix for anything missing.
• address-review (Skill) — Pull all PR review comments (any reviewer, human or bot), classify each as convergent (a fix) or divergent (a design disagreement), apply convergent ones after sign-off, escalate divergent ones to the author as questions. The single path for responding to a PR review; wires /continue step 11.
• approve-safe-bash (Hook) — PreToolUse hook for Bash. Auto-approves (permissionDecision allow) a SINGLE, metacharacter-free command whose program+args match safe-envelope.json; stays silent (normal prompt) on anything else. Never denies. Ships dry-run by default until a follow-up flips it live.
• block-dangerous-bash (Hook) — PreToolUse hook for Bash. Reads tool call from stdin, blocks commands matching patterns in dangerous-patterns.json. Prevents accidental destructive shell calls.
• block-dangerous-git (Hook) — PreToolUse hook for Bash. Blocks dangerous git operations (force-push to shared branches, hard reset, etc.) before they execute.
• block-edit-on-master (Hook) — PreToolUse hook for Edit/Write/NotebookEdit. Blocks file edits when HEAD is on master/main, forcing the developer to a feature branch first.
• branch-intent-warn (Hook) — PreToolUse hook for Edit/Write/NotebookEdit. WARNS (never blocks) when a write lands in a repo's primary worktree on a branch that contradicts the session's recorded task branch (active-context.json). Complements block-edit-on-master, which hard-blocks shared branches. Fail-open.
• capability-trace (Hook) — PostToolUse + UserPromptSubmit trace hook. Records which capabilities a turn selected — agents (Task), skills (Skill), and platform artifacts/files touched (Edit/Write) — to a per-session append-only trace that the statusLine and /sessions read. Deterministic, fail-open, never blocks.
• claude-init (Skill) — Initialize an existing bewith-dev repo onto the platform — scaffold CLAUDE.md + the CI caller, retire legacy .cursor rules (archive, then rewrite repo-specific ones into CLAUDE.md), verify the plugin + git hooks load. Worktree-isolated; prepares a reviewable branch, never merges.
• favorite-session (Skill) — Favorite/pin a Claude Code session so you can find and reopen it later. Pins the current session (by $CLAUDE_CODE_SESSION_ID) to a private GitHub gist so favorites follow you across machines; lists, opens, and removes them. Invoked by /favorite, /favorites, /open-favorite, /unfavorite.
• git-hooks-sync (Hook) — SessionStart hook. Points the machine-global git core.hooksPath at the plugin's CURRENT git-hooks/ (self-healing across always-latest updates). Safe-by-default — no-op on non-bewith repos, never clobbers a custom hooksPath.
• notify-attention (Hook) — Notification hook. When a session needs the developer, pushes a one-line alert (ntfy.sh / Slack / macOS fallback) with surface·branch·cwd·reason + a claude --resume <id> hint, and records wait_state so /sessions shows which session is blocked. Debounced, fail-open.
• prefer-infra-mcp (Hook) — PreToolUse hook for Bash. On a raw host DB/cache CLI (mysql/psql/mongo/mongosh/redis-cli) at a command position, returns permissionDecision "ask" pointing to the matching infra-MCP tool. Never blocks; never fires on docker exec, node scripts, or the CLI used as an argument.
• safety-snapshot (Hook) — PreToolUse hook for Edit/Write. Before each edit, captures a non-destructive snapshot of the full working tree to refs/bewith-safety/, so uncommitted code an edit might clobber is recoverable via /restore. Debounced, auto-pruned, fail-open — never blocks or touches your tree.
• session-drift-check (Hook) — UserPromptSubmit hook. On each message, detects whether the world drifted since this session's baseline — origin/master advanced or the branch HEAD moved — and injects a one-shot reminder to re-verify context before acting. Never blocks.
• session-end (Hook) — SessionEnd hook. Marks this session "ended" with its end reason (clear/logout/exit/other) in the registry, so /sessions and the menu bar show it closed rather than just aging into "stale". Fail-open, never blocks.
• session-guard (Hook) — PreToolUse hook for Edit/Write/NotebookEdit. Records this session's heartbeat + touched file, then checks the local registry — WARNS if another live session touched the same file, BLOCKS only when another owns the same branch+working-dir, with guidance to continue safely. Fail-open.
• session-register (Hook) — SessionStart hook. Registers this session in a local per-machine registry with its branch, cwd, git baseline and a heartbeat — the basis for same-machine concurrent-session awareness. Archives stale entries (never deletes); never blocks.
• session-stop (Hook) — Stop hook. Marks this session "idle" (finished its turn, awaiting your input) in the registry, so /sessions and the menu bar tell a working session apart from one that's done. Bumps the heartbeat; clears any wait_state. Fail-open, never blocks.
• sessions-view (Skill) — Read the local per-machine session registry and render a cross-session mission-control view — branch, cwd, files, age, live/stale, collisions, and which sessions are waiting on the developer. Optionally launches a self-refreshing HTML dashboard. Read-only; invoked by /sessions.
• state-sync (Skill) — Keeps a task's state mirrored across both trackers — writes the AI Context block to the GitHub Issue and a condensed mirror to the ClickUp ai_context field, and maintains the bidirectional link so any session knows which ClickUp task an Issue belongs to. Runs at checkpoints; never gated.

Backend backend

• /sentinel-check (Command) — Triage a production/staging signal for BeWith — verify, locate, classify, recommend (read-only, returns one JSON verdict).
• ai-llm (Agent) — LLM + agent authority — provider integration (Bedrock/Anthropic/OpenAI), prompt engineering, multi-agent orchestration (Strands), token/cost. Use proactively for any LLM call, prompt, agent, or AI feature. Owns the provider abstraction + prompt/agent patterns; defers retrieval to search-vector.
• api-contract-change (Policy) — Fires when an external API contract (OpenAPI, Zod schemas in contracts/, NestJS controllers) changes. Routes through contract-diff + downstream-consumer checks.
• async-messaging (Agent) — The async + messaging authority — SQS, internal @MessagePattern RPC, cron, event-driven flows. Use proactively when work adds/changes a queue consumer, an RPC topic, a cron job, or off-request-path processing. Owns idempotency, at-least-once + DLQ, ordering; implementers wire the handlers.
• auth-security (Agent) — The auth + security authority for bewith-dev (Cognito passwordless, JWT, RBAC, OWASP). Use proactively — MANDATORY — on any change touching authentication, authorization, tokens, sessions, permissions, or secrets. Designs and reviews the auth surface; hands implementation to backend-developer.
• auth-touch (Policy) — Fires on any change to authentication, token handling, or RBAC. Always requires a second pair of eyes — no auth change ships without human review.
• backend-developer (Agent) — NestJS implementer for bewith-dev backend-services. Use proactively for backend feature work — controllers/services/repositories in the existing pattern, tested in chunks, following the eslint-plugin rules. Defers data, contracts, auth, messaging, payments, search, AI, and obs to their owners.
• contracts-schema (Agent) — FE↔BE + inter-service contract authority. Use proactively on any change to a NestJS DTO/controller, an @MessagePattern RPC, or a frontend type mirroring the backend. Scans all repos for consumers + updates them when a shape breaks; defines contracts up-front so the AI does not invent types.
• database (Agent) — The DBA for bewith-dev. Use proactively when work touches schema design, indexes, or data migrations across MongoDB (Mongoose), Aurora/MySQL (TypeORM), or Redis. Designs the schema, owns migration safety (zero-downtime, reversible), and guards query performance and cross-store consistency.
• integrations (Agent) — 3rd-party integration authority — inbound/outbound webhooks, CRM sync (Monday.com), external connectors (Meta/WhatsApp BSP). Use proactively when work adds/changes a webhook, a CRM/3rd-party sync, or a connector. Owns webhook auth + idempotency + mapping; defers delivery, PII, contract.
• legacy-php-change (Policy) — Fires on any change to the legacy Yii2 codebase. Enforces small scoped changes, blocks aggressive refactors, escalates auth/payment paths to mandatory human review.
• legacy-php-guide (Agent) — Yii2 / legacy-PHP maintainer (superco-consumer, superco-management BE) — a DEPRECATION TARGET. Use proactively for bug fixes / small safe changes. Smallest-safe-change, no new features (new work → NestJS / React-in-iframe); auth + payment paths require explicit human review.
• local-stack-up (Skill) — Bring the local BeWith stack up and confirm it is healthy — sandbox infra (Mongo/MySQL/Redis/LocalStack) plus the NestJS services (headless "Debug-Watch All Services") — then optionally exercise a change end-to-end. Idempotent; the hands-on counterpart to /verify.
• notifications (Agent) — Multi-channel notification authority — email (SES), SMS (Nexmo/Smsim), WhatsApp (Meta), in-app (Bulldog), OTP, campaigns. Use proactively when work sends/changes a user-facing message, a channel, a campaign, or OTP delivery. Owns routing, retries/status, dedupe, opt-out; rides async-messaging.
• obs-logs (Skill) — Search and analyze production logs — Grafana (Loki + CloudWatch) is the working backend, Datadog EU is legacy fallback. Use to check logs, investigate a production error, analyze volume/patterns, or debug from logs. Called by observability + identify-bug.
• observability (Agent) — Vendor-neutral observability for bewith-dev — logs, metrics, traces, dashboards, alerts. Use proactively when code adds/changes logging or instrumentation, a service needs monitoring, or for the post-deploy watch. Defines what to emit; implementers add the lines. Datadog is being phased out.
• payment-change (Policy) — Fires on any change to a payment provider, charge, refund, or withdrawal flow. Loads the payments agent (mandatory) and requires human review for live money flows — money bugs are not fix-forward.
• payments (Agent) — The payments authority for bewith-dev (Stripe + Payme). Use proactively — MANDATORY — on any change touching charges, refunds, withdrawals, providers, or money flows. Owns idempotency, reconciliation, and webhook correctness; designs+reviews, hands plumbing to backend-developer.
• permissions-demo-tokens (Skill) — Find example users with a specific permission role (super-admin, organization-admin, community-admin, leader) in the local backend SQL DB and generate JWT tokens for them via the sandbox token CLI. Use to get demo users + JWTs to test permission levels locally. Called by auth-security.
• pii-data-change (Policy) — Fires when a change collects, stores, exports, logs, or shares personal data. Loads privacy-compliance to check minimization, lawful basis, retention, user-rights cascade, and no-PII-in-logs/3rd-party.
• postman-endpoint (Skill) — Save an added or changed HTTP endpoint in the organization R&D Postman workspace with a sample request and a saved response example, at the end of development. The Definition-of-Done step for API work — keeps the collection an accurate, runnable contract. Never commits secrets.
• search-vector (Agent) — Search + vector authority — OpenSearch full-text and vector search, Voyage embeddings, index mappings, the retrieval half of RAG. Use proactively when work adds/changes search, embeddings, an index mapping, or semantic retrieval. Owns relevance + index design; ai-llm consumes the context.
• sentinel-triage (Skill) — Triage a production/staging signal for BeWith — verify, locate, classify, recommend; returns one JSON verdict. Read-only. Triggers on /sentinel-check, "triage this error", "is this a real bug", or investigating a prod/staging signal.
• systematic-debugging (Skill) — A 4-phase active-fix loop — reproduce, isolate, hypothesize+instrument, fix+verify — with a hard stop after 3 failed attempts. Instruments at the gateway/RPC/service/Mongo boundaries. Triggers on "debug this", "why is this failing", "help me fix this bug".
• test-driven-development (Skill) — Drive a change test-first — a failing test, then minimum code to pass, then refactor. Adapted to the bewith Jest/NestJS stack. The Iron Law — no production code before a failing test. Triggers on "TDD this", "test first", "drive this test-first".

Code review code-review

• /address-review (Command) — Pull all PR review comments (any reviewer), classify each as convergent (a fix) or divergent (a design disagreement), apply convergent ones after sign-off, and escalate divergent ones back to you as questions. Thin wrapper around the address-review skill.
• /design-review (Command) — Review the UI-design half of the handoff — that a Design Doc or UI implementation anchors to the design system (components from COMPONENTS.md, tokens not hex, Code Connect mappings, gaps filed as /add-component) and passes a11y. Invokes design-system + a11y-review + gatekeeper Mode B.
• /pr-review (Command) — Run a structured pre-merge review on a PR. Invokes code-reviewer over the ten-point checklist (architecture, tests, contracts, secrets, backward-compat, PR size, auth, deps, CLAUDE.md, overengineering) and routes domain-specific findings to the owning specialist.
• a11y-review (Skill) — On-demand accessibility audit of UI code against WCAG 2.1 AA + RTL/Hebrew. Audits React/Next/MUI components, reports P1/P2/P3 findings with cite + before/after fix. Use for an a11y review / accessibility pass; called by frontend-developer and design-system.
• address-review (Skill) — Pull all PR review comments (any reviewer, human or bot), classify each as convergent (a fix) or divergent (a design disagreement), apply convergent ones after sign-off, escalate divergent ones to the author as questions. The single path for responding to a PR review; wires /continue step 11.
• api-contract-change (Policy) — Fires when an external API contract (OpenAPI, Zod schemas in contracts/, NestJS controllers) changes. Routes through contract-diff + downstream-consumer checks.
• auth-touch (Policy) — Fires on any change to authentication, token handling, or RBAC. Always requires a second pair of eyes — no auth change ships without human review.
• code-reviewer (Agent) — Pre-PR code review for bewith-dev. Use proactively before a PR is ready-for-review — runs the ten-point checklist (architecture, tests, contracts, secrets, backward-compat, PR size, auth, deps, CLAUDE.md, overengineering). Loaded at step 10 of /continue and on /pr-review.
• feature-needs-design (Policy) — Fires when a PR adds a new endpoint (new feature surface, not a field change). Demands the architect agent and an approved design doc linked before merge, so a reviewer co-signs the approach before the code exists.
• frontend-i18n (Policy) — Fires when translation keys or i18n config are touched. Enforces English + Hebrew parity and RTL-safe UI flagging.
• identify-bug (Skill) — Identify and document a bug from inputs (description, logs, screenshots, JAM links, a ClickUp task) for someone else to fix — without implementing the fix unless asked. Gathers inputs, traces the flow, finds root cause, writes a structured understanding doc. Called by qa-engineer.
• large-refactor (Policy) — Fires when a PR touches more than 20 files. Demands architect + code-reviewer agents and a design-review bridge before merge.
• legacy-php-change (Policy) — Fires on any change to the legacy Yii2 codebase. Enforces small scoped changes, blocks aggressive refactors, escalates auth/payment paths to mandatory human review.
• payment-change (Policy) — Fires on any change to a payment provider, charge, refund, or withdrawal flow. Loads the payments agent (mandatory) and requires human review for live money flows — money bugs are not fix-forward.
• pii-data-change (Policy) — Fires when a change collects, stores, exports, logs, or shares personal data. Loads privacy-compliance to check minimization, lawful basis, retention, user-rights cascade, and no-PII-in-logs/3rd-party.
• scalability-reviewer (Agent) — Scale-audit authority for bewith-dev — will this hold at production data volume? Use proactively on any migration, schema, aggregation, or change that reads/writes a collection. Catches unbounded queries, full-collection loads, non-batched backfills, and N+1 before they ship.
• scale-review (Policy) — Fires when a migration, schema, or aggregation pipeline changes. Forces a scalability audit — production-volume estimate, bounded queries, batched backfills — the "does it scale" check schema-migration leaves open.
• schema-migration (Policy) — Fires when a migration file is added or modified. Demands dry-run against a prod-shaped sandbox, data-loss static analysis, and an index-size review.
• test-driven-development (Skill) — Drive a change test-first — a failing test, then minimum code to pass, then refactor. Adapted to the bewith Jest/NestJS stack. The Iron Law — no production code before a failing test. Triggers on "TDD this", "test first", "drive this test-first".

Data & schemas data

• ai-llm (Agent) — LLM + agent authority — provider integration (Bedrock/Anthropic/OpenAI), prompt engineering, multi-agent orchestration (Strands), token/cost. Use proactively for any LLM call, prompt, agent, or AI feature. Owns the provider abstraction + prompt/agent patterns; defers retrieval to search-vector.
• database (Agent) — The DBA for bewith-dev. Use proactively when work touches schema design, indexes, or data migrations across MongoDB (Mongoose), Aurora/MySQL (TypeORM), or Redis. Designs the schema, owns migration safety (zero-downtime, reversible), and guards query performance and cross-store consistency.
• scalability-reviewer (Agent) — Scale-audit authority for bewith-dev — will this hold at production data volume? Use proactively on any migration, schema, aggregation, or change that reads/writes a collection. Catches unbounded queries, full-collection loads, non-batched backfills, and N+1 before they ship.
• scale-review (Policy) — Fires when a migration, schema, or aggregation pipeline changes. Forces a scalability audit — production-volume estimate, bounded queries, batched backfills — the "does it scale" check schema-migration leaves open.
• schema-migration (Policy) — Fires when a migration file is added or modified. Demands dry-run against a prod-shaped sandbox, data-loss static analysis, and an index-size review.
• search-vector (Agent) — Search + vector authority — OpenSearch full-text and vector search, Voyage embeddings, index mappings, the retrieval half of RAG. Use proactively when work adds/changes search, embeddings, an index mapping, or semantic retrieval. Owns relevance + index design; ai-llm consumes the context.

Discovery & navigation discovery

• /daily-summary (Command) — Produce a ready-to-post summary from mirrored task state. Default — a standup digest of the actor's work (shipped/in-review/in-progress/stuck). Pass a task/CU-id for a single-task progress summary. Pass --since 30d/--month/--year for a period accomplishments digest (for a 1:1).
• /help-me (Command) — Show every platform capability (agents, skills, commands, hooks, policies) — like --help for a CLI. With arguments, filters to the ones matching the developer's intent.
• /lang (Command) — View or set your conversation language (English or Hebrew). Shortcut over the unified settings — the conversation may be in your language, but all written artifacts stay English regardless. Invoked via /lang.
• /next-task (Command) — Rank my open ClickUp tasks + assigned GitHub Issues by priority → urgency → effort and recommend what to start next. Pass --fits-in Nm/Nh/Nd for "I have X time, what fits?". Read-only; ranking computed in a script. Offers to hand the pick to /continue.
• /role (Command) — View or change your role (dev or product). Role controls which capabilities the platform surfaces in offers and /help-me. Thin wrapper around the role skill.
• /sentinel-check (Command) — Triage a production/staging signal for BeWith — verify, locate, classify, recommend (read-only, returns one JSON verdict).
• /settings (Command) — View or change your BeWith developer settings (conversation language, role, default language, notifications, docs path) from one place. Thin wrapper around the settings skill.
• architect (Agent) — System-design authority for bewith-dev. Use proactively for changes touching microservice boundaries, the Mongo/Aurora/Redis split, the Yii2 boundary, cross-service contracts, or scoped >20 files. Writes design docs; escalates to ADR for precedent-setting decisions.
• brainstorm-spec (Skill) — For an ad-hoc dev task with no PRD — brainstorm the approach, converge on a short written spec, and get explicit approval BEFORE writing code. A lightweight design-before-code gate. Triggers on "let's design this", "how should I approach", "brainstorm this".
• capability-awareness (Hook) — SessionStart hook. Teaches Claude to surface existing capabilities for free-language intent (instead of silently doing the work), and to escalate to a concrete /new-artifact recommendation when the same uncovered task recurs.
• capability-trace (Hook) — PostToolUse + UserPromptSubmit trace hook. Records which capabilities a turn selected — agents (Task), skills (Skill), and platform artifacts/files touched (Edit/Write) — to a per-session append-only trace that the statusLine and /sessions read. Deterministic, fail-open, never blocks.
• conversation-language (Hook) — SessionStart hook. Reads the developer's conversation-language preference (~/.bewith/config.json, resolved via bewith-config.sh) and injects a directive to converse in that language — while keeping ALL written artifacts in English regardless. Mirrors the role hook. Fail-open.
• insight (Skill) — Capture a what's-missing / could-change POC observation into docs/insights/ — fast, separate from proposals. Worktree-isolated. Invoked by /insight or when the developer voices a gap or possible change during the build. Does NOT create a proposal; the 2-3 day review promotes agreed insights.
• mcp-availability-check (Hook) — SessionStart hook. Surveys MCP servers declared in .mcp.json + settings.json, reports which are reachable. Never blocks — informational.
• mermaid-diagrams (Skill) — Create version-controllable software diagrams with Mermaid's text syntax — flowcharts, sequence, class, ERD, C4/architecture, state. Use when documenting architecture, a data model, an API/auth flow, or a DB schema, or any "diagram / visualize / map out the flow" request.
• next-task (Skill) — Rank my open ClickUp tasks + assigned GitHub Issues by priority → urgency → effort and recommend what to start next; --fits-in Nm/Nh/Nd filters to what fits a time box. Read-only; the ranking is computed in a script, not by the model. Invoked by /next-task.
• prd-writer (Agent) — Produces Product Requirements Documents that R&D reads. Use proactively when a product owner describes a feature intent that needs capturing as a PRD at docs/prds/. Fills the PRD template, anchors UI to the design-system catalog, self-checks Definition of Ready, hands to gatekeeper.
• product-manager (Agent) — Product-judgment authority — is this worth building, business/ICP-aligned, what's the priority. Use proactively when product intent is unclear, features compete, or a PRD needs a product (not mechanical) read. Owns the AI-consumable PRD→Design Doc chain; distinct from gatekeeper.
• role (Skill) — View or change your role (dev or product). Role controls which capabilities the capability-awareness hook and /help-me surface to you — dev role sees dev-tagged artifacts, product role sees product-tagged artifacts, both see "both"-tagged ones. Invoked via /role. Default role is dev.
• sentinel-triage (Skill) — Triage a production/staging signal for BeWith — verify, locate, classify, recommend; returns one JSON verdict. Read-only. Triggers on /sentinel-check, "triage this error", "is this a real bug", or investigating a prod/staging signal.
• settings (Skill) — View or change your BeWith developer settings (conversation language, role, default language, notifications, docs path) from one place. Backed by ~/.bewith/config.json — works in chat as a table plus set, opens a local HTML page, and mirrors the SwiftBar menu. Invoked via /settings.
• systematic-debugging (Skill) — A 4-phase active-fix loop — reproduce, isolate, hypothesize+instrument, fix+verify — with a hard stop after 3 failed attempts. Instruments at the gateway/RPC/service/Mongo boundaries. Triggers on "debug this", "why is this failing", "help me fix this bug".

efficiency efficiency

• delegate-heavy-context (Skill) — Decide when and how to push token-heavy operations into a subagent (or use cheaper tool alternatives) so only a short verdict returns to the main thread. Implements the subagent-as-context-firewall lever from context-and-cost-economy.md.
• playwright-snapshot-warn (Hook) — PreToolUse hook on mcp__playwright__browser_snapshot. Emits an "ask" permissionDecision nudging toward browser_evaluate / browser_network_requests or wrapping the session in a subagent. Never blocks; fail-open.

Frontend frontend

• /design-review (Command) — Review the UI-design half of the handoff — that a Design Doc or UI implementation anchors to the design system (components from COMPONENTS.md, tokens not hex, Code Connect mappings, gaps filed as /add-component) and passes a11y. Invokes design-system + a11y-review + gatekeeper Mode B.
• a11y-review (Skill) — On-demand accessibility audit of UI code against WCAG 2.1 AA + RTL/Hebrew. Audits React/Next/MUI components, reports P1/P2/P3 findings with cite + before/after fix. Use for an a11y review / accessibility pass; called by frontend-developer and design-system.
• contracts-schema (Agent) — FE↔BE + inter-service contract authority. Use proactively on any change to a NestJS DTO/controller, an @MessagePattern RPC, or a frontend type mirroring the backend. Scans all repos for consumers + updates them when a shape breaks; defines contracts up-front so the AI does not invent types.
• design-an-interface (Skill) — Turn a screen/feature requirement into a concrete UI composition from the design system — which COMPONENTS.md components, layout, states, and tokens — the machine-consumable design reference when there's no Figma (Path B). Flags gaps as /add-component; never invents components or raw hex.
• design-system (Agent) — Owns @bewith-dev/design-system — the component library, tokens, Storybook, RTL/theme, and the COMPONENTS.md catalog that every web frontend (and PRD §7.2) anchors to. Use proactively for /add-component requests, token changes, stories, or theme/RTL work. The shared UI source of truth.
• frontend-angular (Agent) — The Angular 8 maintainer for superco-management — a DEPRECATION TARGET. Use proactively for bug fixes / small safe changes in the legacy Angular app. Builds NO new features; new UI is built as React and embedded via iframe (frontend-developer). Smallest-safe-change only.
• frontend-developer (Agent) — React + Next.js implementer for bewith-dev web frontends. Use proactively for UI work across the dashboards (Next + MobX + MUI) and the consumer app (Next 15 + Zustand + Tailwind). Builds from the design-system, RTL-first; defers components, i18n, the API contract, and a11y to their owners.
• frontend-i18n (Policy) — Fires when translation keys or i18n config are touched. Enforces English + Hebrew parity and RTL-safe UI flagging.
• i18n-localization (Agent) — i18n + RTL authority for bewith-dev frontends — i18next / next-i18next / next-intl, Hebrew/English locale files, key conventions, RTL correctness. Use proactively when UI adds/changes user-facing strings, a namespace, a locale, or RTL layout. Owns the conventions; frontend-developer applies them.
• i18next-translation (Skill) — Find hardcoded user-facing strings, replace them with t() calls, and add the keys to both he/en locale files. Use when translating components, internationalizing text, or converting hardcoded strings. Owned by i18n-localization; used by frontend-developer.
• mobile-developer (Agent) — Flutter/Dart implementer for the bewith-dev mobile apps (leaders-app, consumer-mobile). Use proactively for mobile feature work — screens, state, API integration, push, localization, release. Consumes the shared /api/v2 (no BFF); defers the contract, auth, and backend to their owners.

Governance & standards governance

• /claude-init (Command) — Migrate an existing bewith-dev repo onto the platform — scaffold CLAUDE.md + the CI caller, retire legacy .cursor rules (archive then rewrite repo-specific ones into CLAUDE.md), verify the plugin + git hooks load. Worktree-isolated; prepares a reviewable branch, never merges.
• /continue (Command) — The thirteen-step loop — the platform's operational heart. /continue runs it step-by-step (pauses between steps by default); /continue-yolo runs it autonomously. Steps are addressable — /continue <n> (single step), /continue from <n> (from there onward).
• /continue-yolo (Command) — The thirteen-step loop run autonomously — /continue without the between-step pauses. Same steps, policies, and Hard Floor; stops only at the step-6 plan pause and hard gates. Use /continue to supervise step by step instead.
• /cto-review (Command) — Open a CTO-review ticket in the dedicated ClickUp "CTO Review" list, carrying the full handoff package. Title "[Feature name] informative title", tag "cto review". Runs automatically at the end of the product flow via /handoff, or manually on any task that did not come through the flow.
• /done (Command) — Definition-of-Done gate before a task moves to Done. Invokes process-guardian to confirm CU-id linkage, green verification, no secrets, design-review sign-off, and a clean deploy window — blocks the close if anything fails.
• /end-session (Command) — Walk through end-of-session wrap-up — inventory PRs touched, scan memory for stale references, and update memory entries before closing. Thin wrapper around the end-session skill.
• /handoff (Command) — Validate and execute the Product→R&D handoff at the PRD level. Runs gatekeeper Mode A (Definition of Ready), confirms the PRD is AI-consumable (UI anchored to COMPONENTS.md, copy as text, design reference is code not pixels), flips status to ready-for-rd, and hands to /plan-feature.
• /lang (Command) — View or set your conversation language (English or Hebrew). Shortcut over the unified settings — the conversation may be in your language, but all written artifacts stay English regardless. Invoked via /lang.
• /new-artifact (Command) — Start authoring a new platform artifact — agent, skill, command, rule, hook, or policy. Wraps the new-artifact skill.
• /propose (Command) — Propose a feature / infrastructure / process idea — drafts a markdown file under docs/proposals/ for the team to triage.
• /role (Command) — View or change your role (dev or product). Role controls which capabilities the platform surfaces in offers and /help-me. Thin wrapper around the role skill.
• /settings (Command) — View or change your BeWith developer settings (conversation language, role, default language, notifications, docs path) from one place. Thin wrapper around the settings skill.
• /share-rule (Command) — Propose a generic insight as a team rule — opens a PR on bewith-docs for team discussion.
• agent-guard (Skill) — Enforces the required_agents declared by matched policies at runtime. Run at step 5 of /continue and as a self-check before any Edit/Write, to verify the right expert agents are in context for the files touched. Matches policies by triggered_by globs; blocks until every missing agent is loaded.
• architect (Agent) — System-design authority for bewith-dev. Use proactively for changes touching microservice boundaries, the Mongo/Aurora/Redis split, the Yii2 boundary, cross-service contracts, or scoped >20 files. Writes design docs; escalates to ADR for precedent-setting decisions.
• capability-awareness (Hook) — SessionStart hook. Teaches Claude to surface existing capabilities for free-language intent (instead of silently doing the work), and to escalate to a concrete /new-artifact recommendation when the same uncovered task recurs.
• claude-init (Skill) — Initialize an existing bewith-dev repo onto the platform — scaffold CLAUDE.md + the CI caller, retire legacy .cursor rules (archive, then rewrite repo-specific ones into CLAUDE.md), verify the plugin + git hooks load. Worktree-isolated; prepares a reviewable branch, never merges.
• conversation-language (Hook) — SessionStart hook. Reads the developer's conversation-language preference (~/.bewith/config.json, resolved via bewith-config.sh) and injects a directive to converse in that language — while keeping ALL written artifacts in English regardless. Mirrors the role hook. Fail-open.
• cross-repo-impact (Policy) — Fires when a file in this PR is also being modified in another open PR across the bewith-dev org. Surfaces overlap before merge conflicts surface in production.
• cto-review (Skill) — Opens a CTO-review ticket in a dedicated ClickUp list, carrying the full handoff package (problem, UI composition, design reference, acceptance criteria, links). Title convention [Feature name] informative title, tag cto review. Runs at the end of the product flow or manually off-flow.
• draft-proposal (Skill) — Turn a feature / infrastructure / process idea into a markdown file under docs/proposals/ in bewith-docs. Worktree-isolated, safe across concurrent sessions. Invoked by /propose or by Claude after the developer confirms.
• end-session (Skill) — Walks Claude through a session wrap-up — lists PRs touched, scans memory for stale references, and writes or confirms memory entries before the session closes. Invoked manually via /end-session, or by Claude when the developer signals closure ("done", "thanks", "סיימנו").
• feature-needs-design (Policy) — Fires when a PR adds a new endpoint (new feature surface, not a field change). Demands the architect agent and an approved design doc linked before merge, so a reviewer co-signs the approach before the code exists.
• gatekeeper (Agent) — Readiness gate for planning artifacts. Use proactively before a PRD moves draft to ready-for-rd, or a Design Doc moves draft to approved. Independently validates each against its template and checklist, blocking the transition on any P0 gap. The pre-build twin of process-guardian.
• launch-checklist (Skill) — Feature-level release-readiness before shipping a whole feature to production — flag + kill-switch, staged rollout, rollback plan, release notes/version, monitoring + post-deploy watch, comms, success metrics. Broader than the per-PR DoD. Produces a checklist; gates nothing automatically.
• new-artifact (Skill) — Create or update a platform artifact (agent, skill, command, rule, hook, policy) in bewith-docs. Walks the artifact-types decision tree, audits for duplication, drafts file(s), opens a PR. Triggers on phrases like "create an agent", "add a skill", "צריך command".
• onboard-offer (Hook) — SessionStart hook. The first time a developer opens an un-initialized bewith-dev repo, offers /claude-init (scaffold CLAUDE.md + CI, reviewable PR, never merges). No-op on non-bewith repos, the platform repo, already-initialized repos, and after offering once per clone.
• post-pr-create-memory-nudge (Hook) — PostToolUse hook for Bash. When gh pr create succeeds, emits a one-line nudge reminding Claude to check whether MEMORY.md references the work the new PR captures. High-signal moment; never blocks.
• privacy-compliance (Agent) — Privacy + data-protection authority — GDPR + Israeli privacy law, PII classification, consent, retention, user rights. Use proactively when a change collects, stores, exports, logs, or shares personal data, or adds a data flow. Advises on the legal/data duty; does not implement.
• process-guardian (Agent) — Definition-of-Done gate. Use proactively before closing tasks, marking PRs ready-for-review, or moving to Done. Verifies DoD (CU-id, lint/test/typecheck/build, no secrets, design-review); blocks if anything fails. Loaded at /done, step 13 of /continue, and by every Hard-Floor policy.
• product-manager (Agent) — Product-judgment authority — is this worth building, business/ICP-aligned, what's the priority. Use proactively when product intent is unclear, features compete, or a PRD needs a product (not mechanical) read. Owns the AI-consumable PRD→Design Doc chain; distinct from gatekeeper.
• propose-team-rule (Skill) — Turn a generic insight into a reviewable PR on bewith-docs for team discussion. Worktree-isolated, safe across concurrent sessions. Invoked by /share-rule or by Claude after the developer confirms. Never auto-invoke without explicit approval — each PR consumes review attention.
• role (Skill) — View or change your role (dev or product). Role controls which capabilities the capability-awareness hook and /help-me surface to you — dev role sees dev-tagged artifacts, product role sees product-tagged artifacts, both see "both"-tagged ones. Invoked via /role. Default role is dev.
• session-state-awareness (Hook) — SessionStart hook. Teaches Claude to verify checkable references in memory (PRs, branches, files, tasks) before acting on them, and surfaces sibling git worktrees on the cwd repo so the session knows concurrent work is in flight.
• settings (Skill) — View or change your BeWith developer settings (conversation language, role, default language, notifications, docs path) from one place. Backed by ~/.bewith/config.json — works in chat as a table plus set, opens a local HTML page, and mirrors the SwiftBar menu. Invoked via /settings.
• state-sync (Skill) — Keeps a task's state mirrored across both trackers — writes the AI Context block to the GitHub Issue and a condensed mirror to the ClickUp ai_context field, and maintains the bidirectional link so any session knows which ClickUp task an Issue belongs to. Runs at checkpoints; never gated.
• team-rule-prompt (Hook) — SessionStart hook. Injects the team-rule discrimination guidance into Claude's additionalContext so it knows when to propose a team rule vs. save a personal memory.
• team-rules-inject (Hook) — SessionStart hook. Injects the ACCEPTED team rules (.claude/rules/team/*.md) from the plugin so they apply in EVERY repo — not just inside bewith-docs, where Claude Code auto-loads .claude/rules/ natively. Closes the consumer gap left by the repo-relative @-imports.
• worktree-mutation-warn (Hook) — PreToolUse hook for Bash. Soft warning when Claude attempts a git mutation on the primary worktree of a repo that has sibling worktrees — a likely concurrent-session collision. Warns to stderr; never blocks.

Infrastructure & deployment infra

• /sentinel-check (Command) — Triage a production/staging signal for BeWith — verify, locate, classify, recommend (read-only, returns one JSON verdict).
• devops-infra (Agent) — Infra + delivery authority for bewith-dev — EKS (primary) via Terraform/Pulumi/Helm/ArgoCD, ECS (secondary) via CDK, GitHub Actions CI/CD, base images, Secrets Manager, multi-region. Use proactively for IaC, deploy pipelines, cluster/service config, env vars, secrets, or the shared CI workflow.
• git-hooks-sync (Hook) — SessionStart hook. Points the machine-global git core.hooksPath at the plugin's CURRENT git-hooks/ (self-healing across always-latest updates). Safe-by-default — no-op on non-bewith repos, never clobbers a custom hooksPath.
• local-stack-up (Skill) — Bring the local BeWith stack up and confirm it is healthy — sandbox infra (Mongo/MySQL/Redis/LocalStack) plus the NestJS services (headless "Debug-Watch All Services") — then optionally exercise a change end-to-end. Idempotent; the hands-on counterpart to /verify.
• obs-logs (Skill) — Search and analyze production logs — Grafana (Loki + CloudWatch) is the working backend, Datadog EU is legacy fallback. Use to check logs, investigate a production error, analyze volume/patterns, or debug from logs. Called by observability + identify-bug.
• observability (Agent) — Vendor-neutral observability for bewith-dev — logs, metrics, traces, dashboards, alerts. Use proactively when code adds/changes logging or instrumentation, a service needs monitoring, or for the post-deploy watch. Defines what to emit; implementers add the lines. Datadog is being phased out.
• production-deploy (Policy) — Fires when a production deploy is requested (region-prod-semver tag). Hard Floor — the AI cannot ship to prod without an explicit human approval.
• secret-rotation (Policy) — Fires when a secret-bearing file or a rotation tool is invoked. Hard Floor — invalidating running sessions across services demands explicit human coordination.
• sentinel-triage (Skill) — Triage a production/staging signal for BeWith — verify, locate, classify, recommend; returns one JSON verdict. Read-only. Triggers on /sentinel-check, "triage this error", "is this a real bug", or investigating a prod/staging signal.
• watch-deploy (Skill) — After a merge, watch the deployment to its target environment and the observability stack for a defined window before the task closes. Confirms the deploy succeeded and telemetry is clean (vendor-neutral); on a regression it flags an incident instead of closing the task.

User-invoked manual

• /address-review (Command) — Pull all PR review comments (any reviewer), classify each as convergent (a fix) or divergent (a design disagreement), apply convergent ones after sign-off, and escalate divergent ones back to you as questions. Thin wrapper around the address-review skill.
• /breakdown (Command) — Break a feature / ClickUp parent task / design doc into one or more GitHub issues with the BeWith 6-section template + AI-assigned labels. Thin wrapper around the breakdown skill.
• /continue (Command) — The thirteen-step loop — the platform's operational heart. /continue runs it step-by-step (pauses between steps by default); /continue-yolo runs it autonomously. Steps are addressable — /continue <n> (single step), /continue from <n> (from there onward).
• /continue-yolo (Command) — The thirteen-step loop run autonomously — /continue without the between-step pauses. Same steps, policies, and Hard Floor; stops only at the step-6 plan pause and hard gates. Use /continue to supervise step by step instead.
• /cto-review (Command) — Open a CTO-review ticket in the dedicated ClickUp "CTO Review" list, carrying the full handoff package. Title "[Feature name] informative title", tag "cto review". Runs automatically at the end of the product flow via /handoff, or manually on any task that did not come through the flow.
• /daily-summary (Command) — Produce a ready-to-post summary from mirrored task state. Default — a standup digest of the actor's work (shipped/in-review/in-progress/stuck). Pass a task/CU-id for a single-task progress summary. Pass --since 30d/--month/--year for a period accomplishments digest (for a 1:1).
• /decision (Command) — Record a discussion that reached decisions as a durable ADR or Decision log entry, then offer to break its action items into tasks. Thin wrapper around the decision-record skill.
• /design-review (Command) — Review the UI-design half of the handoff — that a Design Doc or UI implementation anchors to the design system (components from COMPONENTS.md, tokens not hex, Code Connect mappings, gaps filed as /add-component) and passes a11y. Invokes design-system + a11y-review + gatekeeper Mode B.
• /done (Command) — Definition-of-Done gate before a task moves to Done. Invokes process-guardian to confirm CU-id linkage, green verification, no secrets, design-review sign-off, and a clean deploy window — blocks the close if anything fails.
• /end-session (Command) — Walk through end-of-session wrap-up — inventory PRs touched, scan memory for stale references, and update memory entries before closing. Thin wrapper around the end-session skill.
• /favorite (Command) — Favorite (pin) the current Claude Code session so you can reopen it later, across machines. Optional label. Stored in your private GitHub gist via the favorite-session skill.
• /favorites (Command) — List all your favorited Claude Code sessions and how to reopen each — across machines, from your private GitHub gist. Read-only; pair with /open-favorite to reopen one.
• /handoff (Command) — Validate and execute the Product→R&D handoff at the PRD level. Runs gatekeeper Mode A (Definition of Ready), confirms the PRD is AI-consumable (UI anchored to COMPONENTS.md, copy as text, design reference is code not pixels), flips status to ready-for-rd, and hands to /plan-feature.
• /help-me (Command) — Show every platform capability (agents, skills, commands, hooks, policies) — like --help for a CLI. With arguments, filters to the ones matching the developer's intent.
• /insight (Command) — Capture a "what's missing / what we could change" POC observation into docs/insights/ — fast, separate from proposals. Thin wrapper around the insight skill; the 2-3 day review promotes agreed insights to a proposal/ADR/task.
• /lang (Command) — View or set your conversation language (English or Hebrew). Shortcut over the unified settings — the conversation may be in your language, but all written artifacts stay English regardless. Invoked via /lang.
• /new-artifact (Command) — Start authoring a new platform artifact — agent, skill, command, rule, hook, or policy. Wraps the new-artifact skill.
• /next-task (Command) — Rank my open ClickUp tasks + assigned GitHub Issues by priority → urgency → effort and recommend what to start next. Pass --fits-in Nm/Nh/Nd for "I have X time, what fits?". Read-only; ranking computed in a script. Offers to hand the pick to /continue.
• /normalize (Command) — R&D-side fallback that turns a raw product exploration (spec + mockup + remarks + ClickUp link) into the canonical PRD when the Cowork normalizer was skipped. Thin wrapper over the prd-writer agent; the resulting PRD is a draft the product owner must review and own.
• /open-favorite (Command) — Reopen one favorited Claude Code session by id or label. On macOS opens a new Terminal running claude --resume in the right directory; otherwise prints the command. Uses the favorite-session skill.
• /plan-feature (Command) — Drive the architect to turn a PRD into a complete, reviewable Design Doc — researches the codebase and writes the full doc (TL;DR, API/schema/components, task breakdown with effort sizes), iterating on open questions. Not a skeleton.
• /pr-review (Command) — Run a structured pre-merge review on a PR. Invokes code-reviewer over the ten-point checklist (architecture, tests, contracts, secrets, backward-compat, PR size, auth, deps, CLAUDE.md, overengineering) and routes domain-specific findings to the owning specialist.
• /pre-planning (Command) — Review and update story points for your open tasks in a ClickUp sprint before a planning session. Resolves the sprint list + the Story-points field by name (no hardcoded ids), walks each assigned open task one at a time, and ends with a total. Read-then-update; never bulk-edits silently.
• /propose (Command) — Propose a feature / infrastructure / process idea — drafts a markdown file under docs/proposals/ for the team to triage.
• /restore (Command) — Recover code that was lost or clobbered — from the automatic bewith-safety snapshots first, then git's own nets (reflog, stash, dangling blobs). Thin wrapper around the restore-code skill; always shows a diff and confirms before writing, and the restore itself is reversible.
• /role (Command) — View or change your role (dev or product). Role controls which capabilities the platform surfaces in offers and /help-me. Thin wrapper around the role skill.
• /sentinel-check (Command) — Triage a production/staging signal for BeWith — verify, locate, classify, recommend (read-only, returns one JSON verdict).
• /sessions (Command) — Show every concurrent Claude session on this machine — surface, branch, cwd, files touched, age, live/stale, branch+dir collisions, and which sessions are waiting on me. Read-only situational awareness across sessions; opens a live HTML dashboard on request.
• /settings (Command) — View or change your BeWith developer settings (conversation language, role, default language, notifications, docs path) from one place. Thin wrapper around the settings skill.
• /share-rule (Command) — Propose a generic insight as a team rule — opens a PR on bewith-docs for team discussion.
• /status (Command) — Show my open work grouped by urgency — ClickUp tasks and GitHub Issues/PRs assigned to me, with state, blockers, and the suggested next action for each. A read-only situational snapshot, no mutations.
• /unfavorite (Command) — Remove a favorited Claude Code session (un-favorite). Defaults to the current session, or pass an id/label. Updates your private GitHub gist via the favorite-session skill.
• /verify (Command) — Run the repo's full local verification — lint + typecheck + tests + build (+ contract checks where they apply). The /continue step-9 gate as a standalone command; fixes small in-scope failures, escalates the rest.
• a11y-review (Skill) — On-demand accessibility audit of UI code against WCAG 2.1 AA + RTL/Hebrew. Audits React/Next/MUI components, reports P1/P2/P3 findings with cite + before/after fix. Use for an a11y review / accessibility pass; called by frontend-developer and design-system.
• architect (Agent) — System-design authority for bewith-dev. Use proactively for changes touching microservice boundaries, the Mongo/Aurora/Redis split, the Yii2 boundary, cross-service contracts, or scoped >20 files. Writes design docs; escalates to ADR for precedent-setting decisions.
• breakdown (Skill) — Break a feature / ClickUp parent task / design doc into one or more GitHub issues with the BeWith 6-section template + AI-assigned effort/urgency/domain labels. Triggers on phrases like "break down this task", "create issues for this design", "פצל את המשימה הזאת ל-issues".
• decision-record (Skill) — Capture a discussion that reached decisions into a durable record — an ADR (technical) or a decision log entry (product/business) — then offer to break its action items into tasks via /breakdown. Worktree-isolated. Triggers on "record this decision", "תעד את ההחלטה".
• draft-proposal (Skill) — Turn a feature / infrastructure / process idea into a markdown file under docs/proposals/ in bewith-docs. Worktree-isolated, safe across concurrent sessions. Invoked by /propose or by Claude after the developer confirms.
• end-session (Skill) — Walks Claude through a session wrap-up — lists PRs touched, scans memory for stale references, and writes or confirms memory entries before the session closes. Invoked manually via /end-session, or by Claude when the developer signals closure ("done", "thanks", "סיימנו").
• i18next-translation (Skill) — Find hardcoded user-facing strings, replace them with t() calls, and add the keys to both he/en locale files. Use when translating components, internationalizing text, or converting hardcoded strings. Owned by i18n-localization; used by frontend-developer.
• identify-bug (Skill) — Identify and document a bug from inputs (description, logs, screenshots, JAM links, a ClickUp task) for someone else to fix — without implementing the fix unless asked. Gathers inputs, traces the flow, finds root cause, writes a structured understanding doc. Called by qa-engineer.
• incident-report (Skill) — Render a finished incident / investigation into a browser-viewable RTL-Hebrew HTML report artifact (via the Artifact tool) — root cause, evidence, impact, timeline, fix. Use after investigating, not for finding bugs (see identify-bug).
• insight (Skill) — Capture a what's-missing / could-change POC observation into docs/insights/ — fast, separate from proposals. Worktree-isolated. Invoked by /insight or when the developer voices a gap or possible change during the build. Does NOT create a proposal; the 2-3 day review promotes agreed insights.
• new-artifact (Skill) — Create or update a platform artifact (agent, skill, command, rule, hook, policy) in bewith-docs. Walks the artifact-types decision tree, audits for duplication, drafts file(s), opens a PR. Triggers on phrases like "create an agent", "add a skill", "צריך command".
• next-task (Skill) — Rank my open ClickUp tasks + assigned GitHub Issues by priority → urgency → effort and recommend what to start next; --fits-in Nm/Nh/Nd filters to what fits a time box. Read-only; the ranking is computed in a script, not by the model. Invoked by /next-task.
• obs-logs (Skill) — Search and analyze production logs — Grafana (Loki + CloudWatch) is the working backend, Datadog EU is legacy fallback. Use to check logs, investigate a production error, analyze volume/patterns, or debug from logs. Called by observability + identify-bug.
• permissions-demo-tokens (Skill) — Find example users with a specific permission role (super-admin, organization-admin, community-admin, leader) in the local backend SQL DB and generate JWT tokens for them via the sandbox token CLI. Use to get demo users + JWTs to test permission levels locally. Called by auth-security.
• prd-writer (Agent) — Produces Product Requirements Documents that R&D reads. Use proactively when a product owner describes a feature intent that needs capturing as a PRD at docs/prds/. Fills the PRD template, anchors UI to the design-system catalog, self-checks Definition of Ready, hands to gatekeeper.
• propose-team-rule (Skill) — Turn a generic insight into a reviewable PR on bewith-docs for team discussion. Worktree-isolated, safe across concurrent sessions. Invoked by /share-rule or by Claude after the developer confirms. Never auto-invoke without explicit approval — each PR consumes review attention.
• restore-code (Skill) — Recover lost or clobbered code from the automatic safety snapshots — falls back to git reflog/stash/dangling blobs. Triggered by /restore, free language ("I lost code"), or proactively when Claude detects dropped code. Diffs and confirms before writing; reversible.
• role (Skill) — View or change your role (dev or product). Role controls which capabilities the capability-awareness hook and /help-me surface to you — dev role sees dev-tagged artifacts, product role sees product-tagged artifacts, both see "both"-tagged ones. Invoked via /role. Default role is dev.
• sentinel-triage (Skill) — Triage a production/staging signal for BeWith — verify, locate, classify, recommend; returns one JSON verdict. Read-only. Triggers on /sentinel-check, "triage this error", "is this a real bug", or investigating a prod/staging signal.
• settings (Skill) — View or change your BeWith developer settings (conversation language, role, default language, notifications, docs path) from one place. Backed by ~/.bewith/config.json — works in chat as a table plus set, opens a local HTML page, and mirrors the SwiftBar menu. Invoked via /settings.

Fires around PRs pr-time

• api-contract-change (Policy) — Fires when an external API contract (OpenAPI, Zod schemas in contracts/, NestJS controllers) changes. Routes through contract-diff + downstream-consumer checks.
• auth-touch (Policy) — Fires on any change to authentication, token handling, or RBAC. Always requires a second pair of eyes — no auth change ships without human review.
• code-reviewer (Agent) — Pre-PR code review for bewith-dev. Use proactively before a PR is ready-for-review — runs the ten-point checklist (architecture, tests, contracts, secrets, backward-compat, PR size, auth, deps, CLAUDE.md, overengineering). Loaded at step 10 of /continue and on /pr-review.
• cross-repo-impact (Policy) — Fires when a file in this PR is also being modified in another open PR across the bewith-dev org. Surfaces overlap before merge conflicts surface in production.
• feature-needs-design (Policy) — Fires when a PR adds a new endpoint (new feature surface, not a field change). Demands the architect agent and an approved design doc linked before merge, so a reviewer co-signs the approach before the code exists.
• frontend-i18n (Policy) — Fires when translation keys or i18n config are touched. Enforces English + Hebrew parity and RTL-safe UI flagging.
• large-refactor (Policy) — Fires when a PR touches more than 20 files. Demands architect + code-reviewer agents and a design-review bridge before merge.
• legacy-php-change (Policy) — Fires on any change to the legacy Yii2 codebase. Enforces small scoped changes, blocks aggressive refactors, escalates auth/payment paths to mandatory human review.
• payment-change (Policy) — Fires on any change to a payment provider, charge, refund, or withdrawal flow. Loads the payments agent (mandatory) and requires human review for live money flows — money bugs are not fix-forward.
• pii-data-change (Policy) — Fires when a change collects, stores, exports, logs, or shares personal data. Loads privacy-compliance to check minimization, lawful basis, retention, user-rights cascade, and no-PII-in-logs/3rd-party.
• scalability-reviewer (Agent) — Scale-audit authority for bewith-dev — will this hold at production data volume? Use proactively on any migration, schema, aggregation, or change that reads/writes a collection. Catches unbounded queries, full-collection loads, non-batched backfills, and N+1 before they ship.
• scale-review (Policy) — Fires when a migration, schema, or aggregation pipeline changes. Forces a scalability audit — production-volume estimate, bounded queries, batched backfills — the "does it scale" check schema-migration leaves open.
• schema-migration (Policy) — Fires when a migration file is added or modified. Demands dry-run against a prod-shaped sandbox, data-loss static analysis, and an index-size review.

Safety & guardrails safety

• /done (Command) — Definition-of-Done gate before a task moves to Done. Invokes process-guardian to confirm CU-id linkage, green verification, no secrets, design-review sign-off, and a clean deploy window — blocks the close if anything fails.
• /restore (Command) — Recover code that was lost or clobbered — from the automatic bewith-safety snapshots first, then git's own nets (reflog, stash, dangling blobs). Thin wrapper around the restore-code skill; always shows a diff and confirms before writing, and the restore itself is reversible.
• /sessions (Command) — Show every concurrent Claude session on this machine — surface, branch, cwd, files touched, age, live/stale, branch+dir collisions, and which sessions are waiting on me. Read-only situational awareness across sessions; opens a live HTML dashboard on request.
• /verify (Command) — Run the repo's full local verification — lint + typecheck + tests + build (+ contract checks where they apply). The /continue step-9 gate as a standalone command; fixes small in-scope failures, escalates the rest.
• active-context-validate (Hook) — Validates the local AI Context cache (parses .claude/session/active-context.json, checks fields, verifies branch). Warns on mismatch, never blocks.
• agent-guard (Skill) — Enforces the required_agents declared by matched policies at runtime. Run at step 5 of /continue and as a self-check before any Edit/Write, to verify the right expert agents are in context for the files touched. Matches policies by triggered_by globs; blocks until every missing agent is loaded.
• approve-safe-bash (Hook) — PreToolUse hook for Bash. Auto-approves (permissionDecision allow) a SINGLE, metacharacter-free command whose program+args match safe-envelope.json; stays silent (normal prompt) on anything else. Never denies. Ships dry-run by default until a follow-up flips it live.
• block-dangerous-bash (Hook) — PreToolUse hook for Bash. Reads tool call from stdin, blocks commands matching patterns in dangerous-patterns.json. Prevents accidental destructive shell calls.
• block-dangerous-git (Hook) — PreToolUse hook for Bash. Blocks dangerous git operations (force-push to shared branches, hard reset, etc.) before they execute.
• block-edit-on-master (Hook) — PreToolUse hook for Edit/Write/NotebookEdit. Blocks file edits when HEAD is on master/main, forcing the developer to a feature branch first.
• branch-intent-warn (Hook) — PreToolUse hook for Edit/Write/NotebookEdit. WARNS (never blocks) when a write lands in a repo's primary worktree on a branch that contradicts the session's recorded task branch (active-context.json). Complements block-edit-on-master, which hard-blocks shared branches. Fail-open.
• code-reviewer (Agent) — Pre-PR code review for bewith-dev. Use proactively before a PR is ready-for-review — runs the ten-point checklist (architecture, tests, contracts, secrets, backward-compat, PR size, auth, deps, CLAUDE.md, overengineering). Loaded at step 10 of /continue and on /pr-review.
• gatekeeper (Agent) — Readiness gate for planning artifacts. Use proactively before a PRD moves draft to ready-for-rd, or a Design Doc moves draft to approved. Independently validates each against its template and checklist, blocking the transition on any P0 gap. The pre-build twin of process-guardian.
• large-refactor (Policy) — Fires when a PR touches more than 20 files. Demands architect + code-reviewer agents and a design-review bridge before merge.
• legacy-php-change (Policy) — Fires on any change to the legacy Yii2 codebase. Enforces small scoped changes, blocks aggressive refactors, escalates auth/payment paths to mandatory human review.
• notify-attention (Hook) — Notification hook. When a session needs the developer, pushes a one-line alert (ntfy.sh / Slack / macOS fallback) with surface·branch·cwd·reason + a claude --resume <id> hint, and records wait_state so /sessions shows which session is blocked. Debounced, fail-open.
• playwright-snapshot-warn (Hook) — PreToolUse hook on mcp__playwright__browser_snapshot. Emits an "ask" permissionDecision nudging toward browser_evaluate / browser_network_requests or wrapping the session in a subagent. Never blocks; fail-open.
• prefer-infra-mcp (Hook) — PreToolUse hook for Bash. On a raw host DB/cache CLI (mysql/psql/mongo/mongosh/redis-cli) at a command position, returns permissionDecision "ask" pointing to the matching infra-MCP tool. Never blocks; never fires on docker exec, node scripts, or the CLI used as an argument.
• process-guardian (Agent) — Definition-of-Done gate. Use proactively before closing tasks, marking PRs ready-for-review, or moving to Done. Verifies DoD (CU-id, lint/test/typecheck/build, no secrets, design-review); blocks if anything fails. Loaded at /done, step 13 of /continue, and by every Hard-Floor policy.
• production-deploy (Policy) — Fires when a production deploy is requested (region-prod-semver tag). Hard Floor — the AI cannot ship to prod without an explicit human approval.
• qa-engineer (Agent) — Testing authority across ALL levels (unit, integration, e2e) on the real stack — Jest, supertest, mongodb-memory-server / Testcontainers, Playwright. Use proactively when behavior changes, coverage is questioned, or tests are flaky. Implementers write unit tests; qa owns strategy + integration/e2e.
• restore-code (Skill) — Recover lost or clobbered code from the automatic safety snapshots — falls back to git reflog/stash/dangling blobs. Triggered by /restore, free language ("I lost code"), or proactively when Claude detects dropped code. Diffs and confirms before writing; reversible.
• safety-snapshot (Hook) — PreToolUse hook for Edit/Write. Before each edit, captures a non-destructive snapshot of the full working tree to refs/bewith-safety/, so uncommitted code an edit might clobber is recoverable via /restore. Debounced, auto-pruned, fail-open — never blocks or touches your tree.
• scalability-reviewer (Agent) — Scale-audit authority for bewith-dev — will this hold at production data volume? Use proactively on any migration, schema, aggregation, or change that reads/writes a collection. Catches unbounded queries, full-collection loads, non-batched backfills, and N+1 before they ship.
• scale-review (Policy) — Fires when a migration, schema, or aggregation pipeline changes. Forces a scalability audit — production-volume estimate, bounded queries, batched backfills — the "does it scale" check schema-migration leaves open.
• schema-migration (Policy) — Fires when a migration file is added or modified. Demands dry-run against a prod-shaped sandbox, data-loss static analysis, and an index-size review.
• secret-rotation (Policy) — Fires when a secret-bearing file or a rotation tool is invoked. Hard Floor — invalidating running sessions across services demands explicit human coordination.
• session-drift-check (Hook) — UserPromptSubmit hook. On each message, detects whether the world drifted since this session's baseline — origin/master advanced or the branch HEAD moved — and injects a one-shot reminder to re-verify context before acting. Never blocks.
• session-end (Hook) — SessionEnd hook. Marks this session "ended" with its end reason (clear/logout/exit/other) in the registry, so /sessions and the menu bar show it closed rather than just aging into "stale". Fail-open, never blocks.
• session-guard (Hook) — PreToolUse hook for Edit/Write/NotebookEdit. Records this session's heartbeat + touched file, then checks the local registry — WARNS if another live session touched the same file, BLOCKS only when another owns the same branch+working-dir, with guidance to continue safely. Fail-open.
• session-register (Hook) — SessionStart hook. Registers this session in a local per-machine registry with its branch, cwd, git baseline and a heartbeat — the basis for same-machine concurrent-session awareness. Archives stale entries (never deletes); never blocks.
• session-state-awareness (Hook) — SessionStart hook. Teaches Claude to verify checkable references in memory (PRs, branches, files, tasks) before acting on them, and surfaces sibling git worktrees on the cwd repo so the session knows concurrent work is in flight.
• session-stop (Hook) — Stop hook. Marks this session "idle" (finished its turn, awaiting your input) in the registry, so /sessions and the menu bar tell a working session apart from one that's done. Bumps the heartbeat; clears any wait_state. Fail-open, never blocks.
• sessions-view (Skill) — Read the local per-machine session registry and render a cross-session mission-control view — branch, cwd, files, age, live/stale, collisions, and which sessions are waiting on the developer. Optionally launches a self-refreshing HTML dashboard. Read-only; invoked by /sessions.
• watch-deploy (Skill) — After a merge, watch the deployment to its target environment and the observability stack for a defined window before the task closes. Confirms the deploy succeeded and telemetry is clean (vendor-neutral); on a regression it flags an incident instead of closing the task.
• worktree-mutation-warn (Hook) — PreToolUse hook for Bash. Soft warning when Claude attempts a git mutation on the primary worktree of a repo that has sibling worktrees — a likely concurrent-session collision. Warns to stderr; never blocks.

Security security

• auth-security (Agent) — The auth + security authority for bewith-dev (Cognito passwordless, JWT, RBAC, OWASP). Use proactively — MANDATORY — on any change touching authentication, authorization, tokens, sessions, permissions, or secrets. Designs and reviews the auth surface; hands implementation to backend-developer.
• auth-touch (Policy) — Fires on any change to authentication, token handling, or RBAC. Always requires a second pair of eyes — no auth change ships without human review.
• payment-change (Policy) — Fires on any change to a payment provider, charge, refund, or withdrawal flow. Loads the payments agent (mandatory) and requires human review for live money flows — money bugs are not fix-forward.
• payments (Agent) — The payments authority for bewith-dev (Stripe + Payme). Use proactively — MANDATORY — on any change touching charges, refunds, withdrawals, providers, or money flows. Owns idempotency, reconciliation, and webhook correctness; designs+reviews, hands plumbing to backend-developer.
• permissions-demo-tokens (Skill) — Find example users with a specific permission role (super-admin, organization-admin, community-admin, leader) in the local backend SQL DB and generate JWT tokens for them via the sandbox token CLI. Use to get demo users + JWTs to test permission levels locally. Called by auth-security.
• pii-data-change (Policy) — Fires when a change collects, stores, exports, logs, or shares personal data. Loads privacy-compliance to check minimization, lawful basis, retention, user-rights cascade, and no-PII-in-logs/3rd-party.
• privacy-compliance (Agent) — Privacy + data-protection authority — GDPR + Israeli privacy law, PII classification, consent, retention, user rights. Use proactively when a change collects, stores, exports, logs, or shares personal data, or adds a data flow. Advises on the legal/data duty; does not implement.
• production-deploy (Policy) — Fires when a production deploy is requested (region-prod-semver tag). Hard Floor — the AI cannot ship to prod without an explicit human approval.
• secret-rotation (Policy) — Fires when a secret-bearing file or a rotation tool is invoked. Hard Floor — invalidating running sessions across services demands explicit human coordination.

Fires on session start session-start

• active-context-validate (Hook) — Validates the local AI Context cache (parses .claude/session/active-context.json, checks fields, verifies branch). Warns on mismatch, never blocks.
• capability-awareness (Hook) — SessionStart hook. Teaches Claude to surface existing capabilities for free-language intent (instead of silently doing the work), and to escalate to a concrete /new-artifact recommendation when the same uncovered task recurs.
• conversation-language (Hook) — SessionStart hook. Reads the developer's conversation-language preference (~/.bewith/config.json, resolved via bewith-config.sh) and injects a directive to converse in that language — while keeping ALL written artifacts in English regardless. Mirrors the role hook. Fail-open.
• git-hooks-sync (Hook) — SessionStart hook. Points the machine-global git core.hooksPath at the plugin's CURRENT git-hooks/ (self-healing across always-latest updates). Safe-by-default — no-op on non-bewith repos, never clobbers a custom hooksPath.
• mcp-availability-check (Hook) — SessionStart hook. Surveys MCP servers declared in .mcp.json + settings.json, reports which are reachable. Never blocks — informational.
• onboard-offer (Hook) — SessionStart hook. The first time a developer opens an un-initialized bewith-dev repo, offers /claude-init (scaffold CLAUDE.md + CI, reviewable PR, never merges). No-op on non-bewith repos, the platform repo, already-initialized repos, and after offering once per clone.
• session-register (Hook) — SessionStart hook. Registers this session in a local per-machine registry with its branch, cwd, git baseline and a heartbeat — the basis for same-machine concurrent-session awareness. Archives stale entries (never deletes); never blocks.
• session-state-awareness (Hook) — SessionStart hook. Teaches Claude to verify checkable references in memory (PRs, branches, files, tasks) before acting on them, and surfaces sibling git worktrees on the cwd repo so the session knows concurrent work is in flight.
• team-rule-prompt (Hook) — SessionStart hook. Injects the team-rule discrimination guidance into Claude's additionalContext so it knows when to propose a team rule vs. save a personal memory.
• team-rules-inject (Hook) — SessionStart hook. Injects the ACCEPTED team rules (.claude/rules/team/*.md) from the plugin so they apply in EVERY repo — not just inside bewith-docs, where Claude Code auto-loads .claude/rules/ natively. Closes the consumer gap left by the repo-relative @-imports.

Fires before tool use tool-time

• approve-safe-bash (Hook) — PreToolUse hook for Bash. Auto-approves (permissionDecision allow) a SINGLE, metacharacter-free command whose program+args match safe-envelope.json; stays silent (normal prompt) on anything else. Never denies. Ships dry-run by default until a follow-up flips it live.
• block-dangerous-bash (Hook) — PreToolUse hook for Bash. Reads tool call from stdin, blocks commands matching patterns in dangerous-patterns.json. Prevents accidental destructive shell calls.
• block-dangerous-git (Hook) — PreToolUse hook for Bash. Blocks dangerous git operations (force-push to shared branches, hard reset, etc.) before they execute.
• block-edit-on-master (Hook) — PreToolUse hook for Edit/Write/NotebookEdit. Blocks file edits when HEAD is on master/main, forcing the developer to a feature branch first.
• branch-intent-warn (Hook) — PreToolUse hook for Edit/Write/NotebookEdit. WARNS (never blocks) when a write lands in a repo's primary worktree on a branch that contradicts the session's recorded task branch (active-context.json). Complements block-edit-on-master, which hard-blocks shared branches. Fail-open.
• capability-trace (Hook) — PostToolUse + UserPromptSubmit trace hook. Records which capabilities a turn selected — agents (Task), skills (Skill), and platform artifacts/files touched (Edit/Write) — to a per-session append-only trace that the statusLine and /sessions read. Deterministic, fail-open, never blocks.
• delegate-heavy-context (Skill) — Decide when and how to push token-heavy operations into a subagent (or use cheaper tool alternatives) so only a short verdict returns to the main thread. Implements the subagent-as-context-firewall lever from context-and-cost-economy.md.
• playwright-snapshot-warn (Hook) — PreToolUse hook on mcp__playwright__browser_snapshot. Emits an "ask" permissionDecision nudging toward browser_evaluate / browser_network_requests or wrapping the session in a subagent. Never blocks; fail-open.
• post-pr-create-memory-nudge (Hook) — PostToolUse hook for Bash. When gh pr create succeeds, emits a one-line nudge reminding Claude to check whether MEMORY.md references the work the new PR captures. High-signal moment; never blocks.
• prefer-infra-mcp (Hook) — PreToolUse hook for Bash. On a raw host DB/cache CLI (mysql/psql/mongo/mongosh/redis-cli) at a command position, returns permissionDecision "ask" pointing to the matching infra-MCP tool. Never blocks; never fires on docker exec, node scripts, or the CLI used as an argument.
• safety-snapshot (Hook) — PreToolUse hook for Edit/Write. Before each edit, captures a non-destructive snapshot of the full working tree to refs/bewith-safety/, so uncommitted code an edit might clobber is recoverable via /restore. Debounced, auto-pruned, fail-open — never blocks or touches your tree.
• session-guard (Hook) — PreToolUse hook for Edit/Write/NotebookEdit. Records this session's heartbeat + touched file, then checks the local registry — WARNS if another live session touched the same file, BLOCKS only when another owns the same branch+working-dir, with guidance to continue safely. Fail-open.
• worktree-mutation-warn (Hook) — PreToolUse hook for Bash. Soft warning when Claude attempts a git mutation on the primary worktree of a repo that has sibling worktrees — a likely concurrent-session collision. Warns to stderr; never blocks.

Workflow & process workflow

• /address-review (Command) — Pull all PR review comments (any reviewer), classify each as convergent (a fix) or divergent (a design disagreement), apply convergent ones after sign-off, and escalate divergent ones back to you as questions. Thin wrapper around the address-review skill.
• /breakdown (Command) — Break a feature / ClickUp parent task / design doc into one or more GitHub issues with the BeWith 6-section template + AI-assigned labels. Thin wrapper around the breakdown skill.
• /claude-init (Command) — Migrate an existing bewith-dev repo onto the platform — scaffold CLAUDE.md + the CI caller, retire legacy .cursor rules (archive then rewrite repo-specific ones into CLAUDE.md), verify the plugin + git hooks load. Worktree-isolated; prepares a reviewable branch, never merges.
• /continue (Command) — The thirteen-step loop — the platform's operational heart. /continue runs it step-by-step (pauses between steps by default); /continue-yolo runs it autonomously. Steps are addressable — /continue <n> (single step), /continue from <n> (from there onward).
• /continue-yolo (Command) — The thirteen-step loop run autonomously — /continue without the between-step pauses. Same steps, policies, and Hard Floor; stops only at the step-6 plan pause and hard gates. Use /continue to supervise step by step instead.
• /cto-review (Command) — Open a CTO-review ticket in the dedicated ClickUp "CTO Review" list, carrying the full handoff package. Title "[Feature name] informative title", tag "cto review". Runs automatically at the end of the product flow via /handoff, or manually on any task that did not come through the flow.
• /daily-summary (Command) — Produce a ready-to-post summary from mirrored task state. Default — a standup digest of the actor's work (shipped/in-review/in-progress/stuck). Pass a task/CU-id for a single-task progress summary. Pass --since 30d/--month/--year for a period accomplishments digest (for a 1:1).
• /decision (Command) — Record a discussion that reached decisions as a durable ADR or Decision log entry, then offer to break its action items into tasks. Thin wrapper around the decision-record skill.
• /design-review (Command) — Review the UI-design half of the handoff — that a Design Doc or UI implementation anchors to the design system (components from COMPONENTS.md, tokens not hex, Code Connect mappings, gaps filed as /add-component) and passes a11y. Invokes design-system + a11y-review + gatekeeper Mode B.
• /done (Command) — Definition-of-Done gate before a task moves to Done. Invokes process-guardian to confirm CU-id linkage, green verification, no secrets, design-review sign-off, and a clean deploy window — blocks the close if anything fails.
• /end-session (Command) — Walk through end-of-session wrap-up — inventory PRs touched, scan memory for stale references, and update memory entries before closing. Thin wrapper around the end-session skill.
• /favorite (Command) — Favorite (pin) the current Claude Code session so you can reopen it later, across machines. Optional label. Stored in your private GitHub gist via the favorite-session skill.
• /favorites (Command) — List all your favorited Claude Code sessions and how to reopen each — across machines, from your private GitHub gist. Read-only; pair with /open-favorite to reopen one.
• /handoff (Command) — Validate and execute the Product→R&D handoff at the PRD level. Runs gatekeeper Mode A (Definition of Ready), confirms the PRD is AI-consumable (UI anchored to COMPONENTS.md, copy as text, design reference is code not pixels), flips status to ready-for-rd, and hands to /plan-feature.
• /infra (Command) — Report this machine's bewith infrastructure — node/npm/CLI/plugin versions + health (GH_TOKEN, git hooks). Runs bewith doctor and relays it, with the one-line fix for anything missing.
• /insight (Command) — Capture a "what's missing / what we could change" POC observation into docs/insights/ — fast, separate from proposals. Thin wrapper around the insight skill; the 2-3 day review promotes agreed insights to a proposal/ADR/task.
• /next-task (Command) — Rank my open ClickUp tasks + assigned GitHub Issues by priority → urgency → effort and recommend what to start next. Pass --fits-in Nm/Nh/Nd for "I have X time, what fits?". Read-only; ranking computed in a script. Offers to hand the pick to /continue.
• /normalize (Command) — R&D-side fallback that turns a raw product exploration (spec + mockup + remarks + ClickUp link) into the canonical PRD when the Cowork normalizer was skipped. Thin wrapper over the prd-writer agent; the resulting PRD is a draft the product owner must review and own.
• /open-favorite (Command) — Reopen one favorited Claude Code session by id or label. On macOS opens a new Terminal running claude --resume in the right directory; otherwise prints the command. Uses the favorite-session skill.
• /plan-feature (Command) — Drive the architect to turn a PRD into a complete, reviewable Design Doc — researches the codebase and writes the full doc (TL;DR, API/schema/components, task breakdown with effort sizes), iterating on open questions. Not a skeleton.
• /pr-review (Command) — Run a structured pre-merge review on a PR. Invokes code-reviewer over the ten-point checklist (architecture, tests, contracts, secrets, backward-compat, PR size, auth, deps, CLAUDE.md, overengineering) and routes domain-specific findings to the owning specialist.
• /pre-planning (Command) — Review and update story points for your open tasks in a ClickUp sprint before a planning session. Resolves the sprint list + the Story-points field by name (no hardcoded ids), walks each assigned open task one at a time, and ends with a total. Read-then-update; never bulk-edits silently.
• /sessions (Command) — Show every concurrent Claude session on this machine — surface, branch, cwd, files touched, age, live/stale, branch+dir collisions, and which sessions are waiting on me. Read-only situational awareness across sessions; opens a live HTML dashboard on request.
• /status (Command) — Show my open work grouped by urgency — ClickUp tasks and GitHub Issues/PRs assigned to me, with state, blockers, and the suggested next action for each. A read-only situational snapshot, no mutations.
• /unfavorite (Command) — Remove a favorited Claude Code session (un-favorite). Defaults to the current session, or pass an id/label. Updates your private GitHub gist via the favorite-session skill.
• /verify (Command) — Run the repo's full local verification — lint + typecheck + tests + build (+ contract checks where they apply). The /continue step-9 gate as a standalone command; fixes small in-scope failures, escalates the rest.
• active-context-validate (Hook) — Validates the local AI Context cache (parses .claude/session/active-context.json, checks fields, verifies branch). Warns on mismatch, never blocks.
• address-review (Skill) — Pull all PR review comments (any reviewer, human or bot), classify each as convergent (a fix) or divergent (a design disagreement), apply convergent ones after sign-off, escalate divergent ones to the author as questions. The single path for responding to a PR review; wires /continue step 11.
• agent-guard (Skill) — Enforces the required_agents declared by matched policies at runtime. Run at step 5 of /continue and as a self-check before any Edit/Write, to verify the right expert agents are in context for the files touched. Matches policies by triggered_by globs; blocks until every missing agent is loaded.
• ai-llm (Agent) — LLM + agent authority — provider integration (Bedrock/Anthropic/OpenAI), prompt engineering, multi-agent orchestration (Strands), token/cost. Use proactively for any LLM call, prompt, agent, or AI feature. Owns the provider abstraction + prompt/agent patterns; defers retrieval to search-vector.
• architect (Agent) — System-design authority for bewith-dev. Use proactively for changes touching microservice boundaries, the Mongo/Aurora/Redis split, the Yii2 boundary, cross-service contracts, or scoped >20 files. Writes design docs; escalates to ADR for precedent-setting decisions.
• async-messaging (Agent) — The async + messaging authority — SQS, internal @MessagePattern RPC, cron, event-driven flows. Use proactively when work adds/changes a queue consumer, an RPC topic, a cron job, or off-request-path processing. Owns idempotency, at-least-once + DLQ, ordering; implementers wire the handlers.
• auth-security (Agent) — The auth + security authority for bewith-dev (Cognito passwordless, JWT, RBAC, OWASP). Use proactively — MANDATORY — on any change touching authentication, authorization, tokens, sessions, permissions, or secrets. Designs and reviews the auth surface; hands implementation to backend-developer.
• backend-developer (Agent) — NestJS implementer for bewith-dev backend-services. Use proactively for backend feature work — controllers/services/repositories in the existing pattern, tested in chunks, following the eslint-plugin rules. Defers data, contracts, auth, messaging, payments, search, AI, and obs to their owners.
• brainstorm-spec (Skill) — For an ad-hoc dev task with no PRD — brainstorm the approach, converge on a short written spec, and get explicit approval BEFORE writing code. A lightweight design-before-code gate. Triggers on "let's design this", "how should I approach", "brainstorm this".
• breakdown (Skill) — Break a feature / ClickUp parent task / design doc into one or more GitHub issues with the BeWith 6-section template + AI-assigned effort/urgency/domain labels. Triggers on phrases like "break down this task", "create issues for this design", "פצל את המשימה הזאת ל-issues".
• claude-init (Skill) — Initialize an existing bewith-dev repo onto the platform — scaffold CLAUDE.md + the CI caller, retire legacy .cursor rules (archive, then rewrite repo-specific ones into CLAUDE.md), verify the plugin + git hooks load. Worktree-isolated; prepares a reviewable branch, never merges.
• contracts-schema (Agent) — FE↔BE + inter-service contract authority. Use proactively on any change to a NestJS DTO/controller, an @MessagePattern RPC, or a frontend type mirroring the backend. Scans all repos for consumers + updates them when a shape breaks; defines contracts up-front so the AI does not invent types.
• cross-repo-impact (Policy) — Fires when a file in this PR is also being modified in another open PR across the bewith-dev org. Surfaces overlap before merge conflicts surface in production.
• cto-review (Skill) — Opens a CTO-review ticket in a dedicated ClickUp list, carrying the full handoff package (problem, UI composition, design reference, acceptance criteria, links). Title convention [Feature name] informative title, tag cto review. Runs at the end of the product flow or manually off-flow.
• database (Agent) — The DBA for bewith-dev. Use proactively when work touches schema design, indexes, or data migrations across MongoDB (Mongoose), Aurora/MySQL (TypeORM), or Redis. Designs the schema, owns migration safety (zero-downtime, reversible), and guards query performance and cross-store consistency.
• decision-record (Skill) — Capture a discussion that reached decisions into a durable record — an ADR (technical) or a decision log entry (product/business) — then offer to break its action items into tasks via /breakdown. Worktree-isolated. Triggers on "record this decision", "תעד את ההחלטה".
• delegate-heavy-context (Skill) — Decide when and how to push token-heavy operations into a subagent (or use cheaper tool alternatives) so only a short verdict returns to the main thread. Implements the subagent-as-context-firewall lever from context-and-cost-economy.md.
• design-an-interface (Skill) — Turn a screen/feature requirement into a concrete UI composition from the design system — which COMPONENTS.md components, layout, states, and tokens — the machine-consumable design reference when there's no Figma (Path B). Flags gaps as /add-component; never invents components or raw hex.
• design-system (Agent) — Owns @bewith-dev/design-system — the component library, tokens, Storybook, RTL/theme, and the COMPONENTS.md catalog that every web frontend (and PRD §7.2) anchors to. Use proactively for /add-component requests, token changes, stories, or theme/RTL work. The shared UI source of truth.
• devops-infra (Agent) — Infra + delivery authority for bewith-dev — EKS (primary) via Terraform/Pulumi/Helm/ArgoCD, ECS (secondary) via CDK, GitHub Actions CI/CD, base images, Secrets Manager, multi-region. Use proactively for IaC, deploy pipelines, cluster/service config, env vars, secrets, or the shared CI workflow.
• end-session (Skill) — Walks Claude through a session wrap-up — lists PRs touched, scans memory for stale references, and writes or confirms memory entries before the session closes. Invoked manually via /end-session, or by Claude when the developer signals closure ("done", "thanks", "סיימנו").
• favorite-session (Skill) — Favorite/pin a Claude Code session so you can find and reopen it later. Pins the current session (by $CLAUDE_CODE_SESSION_ID) to a private GitHub gist so favorites follow you across machines; lists, opens, and removes them. Invoked by /favorite, /favorites, /open-favorite, /unfavorite.
• frontend-angular (Agent) — The Angular 8 maintainer for superco-management — a DEPRECATION TARGET. Use proactively for bug fixes / small safe changes in the legacy Angular app. Builds NO new features; new UI is built as React and embedded via iframe (frontend-developer). Smallest-safe-change only.
• frontend-developer (Agent) — React + Next.js implementer for bewith-dev web frontends. Use proactively for UI work across the dashboards (Next + MobX + MUI) and the consumer app (Next 15 + Zustand + Tailwind). Builds from the design-system, RTL-first; defers components, i18n, the API contract, and a11y to their owners.
• gatekeeper (Agent) — Readiness gate for planning artifacts. Use proactively before a PRD moves draft to ready-for-rd, or a Design Doc moves draft to approved. Independently validates each against its template and checklist, blocking the transition on any P0 gap. The pre-build twin of process-guardian.
• i18n-localization (Agent) — i18n + RTL authority for bewith-dev frontends — i18next / next-i18next / next-intl, Hebrew/English locale files, key conventions, RTL correctness. Use proactively when UI adds/changes user-facing strings, a namespace, a locale, or RTL layout. Owns the conventions; frontend-developer applies them.
• identify-bug (Skill) — Identify and document a bug from inputs (description, logs, screenshots, JAM links, a ClickUp task) for someone else to fix — without implementing the fix unless asked. Gathers inputs, traces the flow, finds root cause, writes a structured understanding doc. Called by qa-engineer.
• incident-report (Skill) — Render a finished incident / investigation into a browser-viewable RTL-Hebrew HTML report artifact (via the Artifact tool) — root cause, evidence, impact, timeline, fix. Use after investigating, not for finding bugs (see identify-bug).
• insight (Skill) — Capture a what's-missing / could-change POC observation into docs/insights/ — fast, separate from proposals. Worktree-isolated. Invoked by /insight or when the developer voices a gap or possible change during the build. Does NOT create a proposal; the 2-3 day review promotes agreed insights.
• integrations (Agent) — 3rd-party integration authority — inbound/outbound webhooks, CRM sync (Monday.com), external connectors (Meta/WhatsApp BSP). Use proactively when work adds/changes a webhook, a CRM/3rd-party sync, or a connector. Owns webhook auth + idempotency + mapping; defers delivery, PII, contract.
• launch-checklist (Skill) — Feature-level release-readiness before shipping a whole feature to production — flag + kill-switch, staged rollout, rollback plan, release notes/version, monitoring + post-deploy watch, comms, success metrics. Broader than the per-PR DoD. Produces a checklist; gates nothing automatically.
• legacy-php-guide (Agent) — Yii2 / legacy-PHP maintainer (superco-consumer, superco-management BE) — a DEPRECATION TARGET. Use proactively for bug fixes / small safe changes. Smallest-safe-change, no new features (new work → NestJS / React-in-iframe); auth + payment paths require explicit human review.
• local-stack-up (Skill) — Bring the local BeWith stack up and confirm it is healthy — sandbox infra (Mongo/MySQL/Redis/LocalStack) plus the NestJS services (headless "Debug-Watch All Services") — then optionally exercise a change end-to-end. Idempotent; the hands-on counterpart to /verify.
• mermaid-diagrams (Skill) — Create version-controllable software diagrams with Mermaid's text syntax — flowcharts, sequence, class, ERD, C4/architecture, state. Use when documenting architecture, a data model, an API/auth flow, or a DB schema, or any "diagram / visualize / map out the flow" request.
• mobile-developer (Agent) — Flutter/Dart implementer for the bewith-dev mobile apps (leaders-app, consumer-mobile). Use proactively for mobile feature work — screens, state, API integration, push, localization, release. Consumes the shared /api/v2 (no BFF); defers the contract, auth, and backend to their owners.
• next-task (Skill) — Rank my open ClickUp tasks + assigned GitHub Issues by priority → urgency → effort and recommend what to start next; --fits-in Nm/Nh/Nd filters to what fits a time box. Read-only; the ranking is computed in a script, not by the model. Invoked by /next-task.
• notifications (Agent) — Multi-channel notification authority — email (SES), SMS (Nexmo/Smsim), WhatsApp (Meta), in-app (Bulldog), OTP, campaigns. Use proactively when work sends/changes a user-facing message, a channel, a campaign, or OTP delivery. Owns routing, retries/status, dedupe, opt-out; rides async-messaging.
• observability (Agent) — Vendor-neutral observability for bewith-dev — logs, metrics, traces, dashboards, alerts. Use proactively when code adds/changes logging or instrumentation, a service needs monitoring, or for the post-deploy watch. Defines what to emit; implementers add the lines. Datadog is being phased out.
• payments (Agent) — The payments authority for bewith-dev (Stripe + Payme). Use proactively — MANDATORY — on any change touching charges, refunds, withdrawals, providers, or money flows. Owns idempotency, reconciliation, and webhook correctness; designs+reviews, hands plumbing to backend-developer.
• post-pr-create-memory-nudge (Hook) — PostToolUse hook for Bash. When gh pr create succeeds, emits a one-line nudge reminding Claude to check whether MEMORY.md references the work the new PR captures. High-signal moment; never blocks.
• postman-endpoint (Skill) — Save an added or changed HTTP endpoint in the organization R&D Postman workspace with a sample request and a saved response example, at the end of development. The Definition-of-Done step for API work — keeps the collection an accurate, runnable contract. Never commits secrets.
• prd-writer (Agent) — Produces Product Requirements Documents that R&D reads. Use proactively when a product owner describes a feature intent that needs capturing as a PRD at docs/prds/. Fills the PRD template, anchors UI to the design-system catalog, self-checks Definition of Ready, hands to gatekeeper.
• privacy-compliance (Agent) — Privacy + data-protection authority — GDPR + Israeli privacy law, PII classification, consent, retention, user rights. Use proactively when a change collects, stores, exports, logs, or shares personal data, or adds a data flow. Advises on the legal/data duty; does not implement.
• process-guardian (Agent) — Definition-of-Done gate. Use proactively before closing tasks, marking PRs ready-for-review, or moving to Done. Verifies DoD (CU-id, lint/test/typecheck/build, no secrets, design-review); blocks if anything fails. Loaded at /done, step 13 of /continue, and by every Hard-Floor policy.
• product-manager (Agent) — Product-judgment authority — is this worth building, business/ICP-aligned, what's the priority. Use proactively when product intent is unclear, features compete, or a PRD needs a product (not mechanical) read. Owns the AI-consumable PRD→Design Doc chain; distinct from gatekeeper.
• qa-engineer (Agent) — Testing authority across ALL levels (unit, integration, e2e) on the real stack — Jest, supertest, mongodb-memory-server / Testcontainers, Playwright. Use proactively when behavior changes, coverage is questioned, or tests are flaky. Implementers write unit tests; qa owns strategy + integration/e2e.
• restore-code (Skill) — Recover lost or clobbered code from the automatic safety snapshots — falls back to git reflog/stash/dangling blobs. Triggered by /restore, free language ("I lost code"), or proactively when Claude detects dropped code. Diffs and confirms before writing; reversible.
• search-vector (Agent) — Search + vector authority — OpenSearch full-text and vector search, Voyage embeddings, index mappings, the retrieval half of RAG. Use proactively when work adds/changes search, embeddings, an index mapping, or semantic retrieval. Owns relevance + index design; ai-llm consumes the context.
• sessions-view (Skill) — Read the local per-machine session registry and render a cross-session mission-control view — branch, cwd, files, age, live/stale, collisions, and which sessions are waiting on the developer. Optionally launches a self-refreshing HTML dashboard. Read-only; invoked by /sessions.
• state-sync (Skill) — Keeps a task's state mirrored across both trackers — writes the AI Context block to the GitHub Issue and a condensed mirror to the ClickUp ai_context field, and maintains the bidirectional link so any session knows which ClickUp task an Issue belongs to. Runs at checkpoints; never gated.
• systematic-debugging (Skill) — A 4-phase active-fix loop — reproduce, isolate, hypothesize+instrument, fix+verify — with a hard stop after 3 failed attempts. Instruments at the gateway/RPC/service/Mongo boundaries. Triggers on "debug this", "why is this failing", "help me fix this bug".
• test-driven-development (Skill) — Drive a change test-first — a failing test, then minimum code to pass, then refactor. Adapted to the bewith Jest/NestJS stack. The Iron Law — no production code before a failing test. Triggers on "TDD this", "test first", "drive this test-first".
• watch-deploy (Skill) — After a merge, watch the deployment to its target environment and the observability stack for a defined window before the task closes. Confirms the deploy succeeded and telemetry is clean (vendor-neutral); on a regression it flags an incident instead of closing the task.

Alphabetical index

Name	Kind	Tags	Description
/address-review	Command	workflow code-review manual	Pull all PR review comments (any reviewer), classify each as convergent (a fix) or divergent (a design disagreement), apply convergent ones after sign-off, and escalate divergent ones back to you as questions. Thin wrapper around the address-review skill.
/breakdown	Command	workflow authoring manual	Break a feature / ClickUp parent task / design doc into one or more GitHub issues with the BeWith 6-section template + AI-assigned labels. Thin wrapper around the breakdown skill.
/claude-init	Command	workflow governance automation	Migrate an existing bewith-dev repo onto the platform — scaffold CLAUDE.md + the CI caller, retire legacy .cursor rules (archive then rewrite repo-specific ones into CLAUDE.md), verify the plugin + git hooks load. Worktree-isolated; prepares a reviewable branch, never merges.
/continue	Command	workflow governance manual	The thirteen-step loop — the platform's operational heart. /continue runs it step-by-step (pauses between steps by default); /continue-yolo runs it autonomously. Steps are addressable — /continue <n> (single step), /continue from <n> (from there onward).
/continue-yolo	Command	workflow governance manual	The thirteen-step loop run autonomously — /continue without the between-step pauses. Same steps, policies, and Hard Floor; stops only at the step-6 plan pause and hard gates. Use /continue to supervise step by step instead.
/cto-review	Command	workflow governance manual	Open a CTO-review ticket in the dedicated ClickUp "CTO Review" list, carrying the full handoff package. Title "[Feature name] informative title", tag "cto review". Runs automatically at the end of the product flow via /handoff, or manually on any task that did not come through the flow.
/daily-summary	Command	workflow discovery manual	Produce a ready-to-post summary from mirrored task state. Default — a standup digest of the actor's work (shipped/in-review/in-progress/stuck). Pass a task/CU-id for a single-task progress summary. Pass --since 30d/--month/--year for a period accomplishments digest (for a 1:1).
/decision	Command	workflow authoring manual	Record a discussion that reached decisions as a durable ADR or Decision log entry, then offer to break its action items into tasks. Thin wrapper around the decision-record skill.
/design-review	Command	workflow code-review frontend manual	Review the UI-design half of the handoff — that a Design Doc or UI implementation anchors to the design system (components from COMPONENTS.md, tokens not hex, Code Connect mappings, gaps filed as /add-component) and passes a11y. Invokes design-system + a11y-review + gatekeeper Mode B.
/done	Command	workflow governance safety manual	Definition-of-Done gate before a task moves to Done. Invokes process-guardian to confirm CU-id linkage, green verification, no secrets, design-review sign-off, and a clean deploy window — blocks the close if anything fails.
/end-session	Command	workflow governance manual	Walk through end-of-session wrap-up — inventory PRs touched, scan memory for stale references, and update memory entries before closing. Thin wrapper around the end-session skill.
/favorite	Command	workflow manual	Favorite (pin) the current Claude Code session so you can reopen it later, across machines. Optional label. Stored in your private GitHub gist via the favorite-session skill.
/favorites	Command	workflow manual	List all your favorited Claude Code sessions and how to reopen each — across machines, from your private GitHub gist. Read-only; pair with /open-favorite to reopen one.
/handoff	Command	workflow governance manual	Validate and execute the Product→R&D handoff at the PRD level. Runs gatekeeper Mode A (Definition of Ready), confirms the PRD is AI-consumable (UI anchored to COMPONENTS.md, copy as text, design reference is code not pixels), flips status to ready-for-rd, and hands to /plan-feature.
/help-me	Command	discovery manual	Show every platform capability (agents, skills, commands, hooks, policies) — like --help for a CLI. With arguments, filters to the ones matching the developer's intent.
/infra	Command	workflow automation	Report this machine's bewith infrastructure — node/npm/CLI/plugin versions + health (GH_TOKEN, git hooks). Runs bewith doctor and relays it, with the one-line fix for anything missing.
/insight	Command	workflow authoring manual	Capture a "what's missing / what we could change" POC observation into docs/insights/ — fast, separate from proposals. Thin wrapper around the insight skill; the 2-3 day review promotes agreed insights to a proposal/ADR/task.
/lang	Command	discovery governance manual	View or set your conversation language (English or Hebrew). Shortcut over the unified settings — the conversation may be in your language, but all written artifacts stay English regardless. Invoked via /lang.
/new-artifact	Command	authoring governance manual	Start authoring a new platform artifact — agent, skill, command, rule, hook, or policy. Wraps the new-artifact skill.
/next-task	Command	workflow discovery manual	Rank my open ClickUp tasks + assigned GitHub Issues by priority → urgency → effort and recommend what to start next. Pass --fits-in Nm/Nh/Nd for "I have X time, what fits?". Read-only; ranking computed in a script. Offers to hand the pick to /continue.
/normalize	Command	authoring workflow manual	R&D-side fallback that turns a raw product exploration (spec + mockup + remarks + ClickUp link) into the canonical PRD when the Cowork normalizer was skipped. Thin wrapper over the prd-writer agent; the resulting PRD is a draft the product owner must review and own.
/open-favorite	Command	workflow manual	Reopen one favorited Claude Code session by id or label. On macOS opens a new Terminal running claude --resume in the right directory; otherwise prints the command. Uses the favorite-session skill.
/plan-feature	Command	workflow authoring manual	Drive the architect to turn a PRD into a complete, reviewable Design Doc — researches the codebase and writes the full doc (TL;DR, API/schema/components, task breakdown with effort sizes), iterating on open questions. Not a skeleton.
/pr-review	Command	workflow code-review manual	Run a structured pre-merge review on a PR. Invokes code-reviewer over the ten-point checklist (architecture, tests, contracts, secrets, backward-compat, PR size, auth, deps, CLAUDE.md, overengineering) and routes domain-specific findings to the owning specialist.
/pre-planning	Command	workflow manual	Review and update story points for your open tasks in a ClickUp sprint before a planning session. Resolves the sprint list + the Story-points field by name (no hardcoded ids), walks each assigned open task one at a time, and ends with a total. Read-then-update; never bulk-edits silently.
/propose	Command	authoring governance manual	Propose a feature / infrastructure / process idea — drafts a markdown file under docs/proposals/ for the team to triage.
/restore	Command	safety manual	Recover code that was lost or clobbered — from the automatic bewith-safety snapshots first, then git's own nets (reflog, stash, dangling blobs). Thin wrapper around the restore-code skill; always shows a diff and confirms before writing, and the restore itself is reversible.
/role	Command	discovery governance manual	View or change your role (dev or product). Role controls which capabilities the platform surfaces in offers and /help-me. Thin wrapper around the role skill.
/sentinel-check	Command	infra backend discovery manual	Triage a production/staging signal for BeWith — verify, locate, classify, recommend (read-only, returns one JSON verdict).
/sessions	Command	workflow safety manual	Show every concurrent Claude session on this machine — surface, branch, cwd, files touched, age, live/stale, branch+dir collisions, and which sessions are waiting on me. Read-only situational awareness across sessions; opens a live HTML dashboard on request.
/settings	Command	discovery governance manual	View or change your BeWith developer settings (conversation language, role, default language, notifications, docs path) from one place. Thin wrapper around the settings skill.
/share-rule	Command	authoring governance manual	Propose a generic insight as a team rule — opens a PR on bewith-docs for team discussion.
/status	Command	workflow manual	Show my open work grouped by urgency — ClickUp tasks and GitHub Issues/PRs assigned to me, with state, blockers, and the suggested next action for each. A read-only situational snapshot, no mutations.
/unfavorite	Command	workflow manual	Remove a favorited Claude Code session (un-favorite). Defaults to the current session, or pass an id/label. Updates your private GitHub gist via the favorite-session skill.
/verify	Command	workflow safety manual	Run the repo's full local verification — lint + typecheck + tests + build (+ contract checks where they apply). The /continue step-9 gate as a standalone command; fixes small in-scope failures, escalates the rest.
a11y-review	Skill	frontend code-review manual	On-demand accessibility audit of UI code against WCAG 2.1 AA + RTL/Hebrew. Audits React/Next/MUI components, reports P1/P2/P3 findings with cite + before/after fix. Use for an a11y review / accessibility pass; called by frontend-developer and design-system.
active-context-validate	Hook	safety session-start workflow	Validates the local AI Context cache (parses .claude/session/active-context.json, checks fields, verifies branch). Warns on mismatch, never blocks.
address-review	Skill	code-review workflow automation	Pull all PR review comments (any reviewer, human or bot), classify each as convergent (a fix) or divergent (a design disagreement), apply convergent ones after sign-off, escalate divergent ones to the author as questions. The single path for responding to a PR review; wires /continue step 11.
agent-guard	Skill	governance safety workflow	Enforces the required_agents declared by matched policies at runtime. Run at step 5 of /continue and as a self-check before any Edit/Write, to verify the right expert agents are in context for the files touched. Matches policies by triggered_by globs; blocks until every missing agent is loaded.
ai-llm	Agent	backend data workflow	LLM + agent authority — provider integration (Bedrock/Anthropic/OpenAI), prompt engineering, multi-agent orchestration (Strands), token/cost. Use proactively for any LLM call, prompt, agent, or AI feature. Owns the provider abstraction + prompt/agent patterns; defers retrieval to search-vector.
api-contract-change	Policy	backend code-review pr-time	Fires when an external API contract (OpenAPI, Zod schemas in contracts/, NestJS controllers) changes. Routes through contract-diff + downstream-consumer checks.
approve-safe-bash	Hook	safety tool-time automation	PreToolUse hook for Bash. Auto-approves (permissionDecision allow) a SINGLE, metacharacter-free command whose program+args match safe-envelope.json; stays silent (normal prompt) on anything else. Never denies. Ships dry-run by default until a follow-up flips it live.
architect	Agent	governance workflow discovery manual	System-design authority for bewith-dev. Use proactively for changes touching microservice boundaries, the Mongo/Aurora/Redis split, the Yii2 boundary, cross-service contracts, or scoped >20 files. Writes design docs; escalates to ADR for precedent-setting decisions.
async-messaging	Agent	backend workflow	The async + messaging authority — SQS, internal @MessagePattern RPC, cron, event-driven flows. Use proactively when work adds/changes a queue consumer, an RPC topic, a cron job, or off-request-path processing. Owns idempotency, at-least-once + DLQ, ordering; implementers wire the handlers.
auth-security	Agent	security backend workflow	The auth + security authority for bewith-dev (Cognito passwordless, JWT, RBAC, OWASP). Use proactively — MANDATORY — on any change touching authentication, authorization, tokens, sessions, permissions, or secrets. Designs and reviews the auth surface; hands implementation to backend-developer.
auth-touch	Policy	backend security code-review pr-time	Fires on any change to authentication, token handling, or RBAC. Always requires a second pair of eyes — no auth change ships without human review.
backend-developer	Agent	backend workflow	NestJS implementer for bewith-dev backend-services. Use proactively for backend feature work — controllers/services/repositories in the existing pattern, tested in chunks, following the eslint-plugin rules. Defers data, contracts, auth, messaging, payments, search, AI, and obs to their owners.
block-dangerous-bash	Hook	safety tool-time automation	PreToolUse hook for Bash. Reads tool call from stdin, blocks commands matching patterns in dangerous-patterns.json. Prevents accidental destructive shell calls.
block-dangerous-git	Hook	safety tool-time automation	PreToolUse hook for Bash. Blocks dangerous git operations (force-push to shared branches, hard reset, etc.) before they execute.
block-edit-on-master	Hook	safety tool-time automation	PreToolUse hook for Edit/Write/NotebookEdit. Blocks file edits when HEAD is on master/main, forcing the developer to a feature branch first.
brainstorm-spec	Skill	workflow authoring discovery	For an ad-hoc dev task with no PRD — brainstorm the approach, converge on a short written spec, and get explicit approval BEFORE writing code. A lightweight design-before-code gate. Triggers on "let's design this", "how should I approach", "brainstorm this".
branch-intent-warn	Hook	safety tool-time automation	PreToolUse hook for Edit/Write/NotebookEdit. WARNS (never blocks) when a write lands in a repo's primary worktree on a branch that contradicts the session's recorded task branch (active-context.json). Complements block-edit-on-master, which hard-blocks shared branches. Fail-open.
breakdown	Skill	workflow authoring manual	Break a feature / ClickUp parent task / design doc into one or more GitHub issues with the BeWith 6-section template + AI-assigned effort/urgency/domain labels. Triggers on phrases like "break down this task", "create issues for this design", "פצל את המשימה הזאת ל-issues".
capability-awareness	Hook	discovery session-start governance	SessionStart hook. Teaches Claude to surface existing capabilities for free-language intent (instead of silently doing the work), and to escalate to a concrete /new-artifact recommendation when the same uncovered task recurs.
capability-trace	Hook	discovery automation tool-time	PostToolUse + UserPromptSubmit trace hook. Records which capabilities a turn selected — agents (Task), skills (Skill), and platform artifacts/files touched (Edit/Write) — to a per-session append-only trace that the statusLine and /sessions read. Deterministic, fail-open, never blocks.
claude-init	Skill	workflow governance automation	Initialize an existing bewith-dev repo onto the platform — scaffold CLAUDE.md + the CI caller, retire legacy .cursor rules (archive, then rewrite repo-specific ones into CLAUDE.md), verify the plugin + git hooks load. Worktree-isolated; prepares a reviewable branch, never merges.
code-reviewer	Agent	code-review safety pr-time	Pre-PR code review for bewith-dev. Use proactively before a PR is ready-for-review — runs the ten-point checklist (architecture, tests, contracts, secrets, backward-compat, PR size, auth, deps, CLAUDE.md, overengineering). Loaded at step 10 of /continue and on /pr-review.
contracts-schema	Agent	backend frontend workflow	FE↔BE + inter-service contract authority. Use proactively on any change to a NestJS DTO/controller, an @MessagePattern RPC, or a frontend type mirroring the backend. Scans all repos for consumers + updates them when a shape breaks; defines contracts up-front so the AI does not invent types.
conversation-language	Hook	discovery session-start governance	SessionStart hook. Reads the developer's conversation-language preference (~/.bewith/config.json, resolved via bewith-config.sh) and injects a directive to converse in that language — while keeping ALL written artifacts in English regardless. Mirrors the role hook. Fail-open.
cross-repo-impact	Policy	governance workflow pr-time	Fires when a file in this PR is also being modified in another open PR across the bewith-dev org. Surfaces overlap before merge conflicts surface in production.
cto-review	Skill	workflow governance authoring	Opens a CTO-review ticket in a dedicated ClickUp list, carrying the full handoff package (problem, UI composition, design reference, acceptance criteria, links). Title convention [Feature name] informative title, tag cto review. Runs at the end of the product flow or manually off-flow.
database	Agent	data backend workflow	The DBA for bewith-dev. Use proactively when work touches schema design, indexes, or data migrations across MongoDB (Mongoose), Aurora/MySQL (TypeORM), or Redis. Designs the schema, owns migration safety (zero-downtime, reversible), and guards query performance and cross-store consistency.
decision-record	Skill	workflow authoring manual	Capture a discussion that reached decisions into a durable record — an ADR (technical) or a decision log entry (product/business) — then offer to break its action items into tasks via /breakdown. Worktree-isolated. Triggers on "record this decision", "תעד את ההחלטה".
delegate-heavy-context	Skill	workflow tool-time efficiency	Decide when and how to push token-heavy operations into a subagent (or use cheaper tool alternatives) so only a short verdict returns to the main thread. Implements the subagent-as-context-firewall lever from context-and-cost-economy.md.
design-an-interface	Skill	frontend authoring workflow	Turn a screen/feature requirement into a concrete UI composition from the design system — which COMPONENTS.md components, layout, states, and tokens — the machine-consumable design reference when there's no Figma (Path B). Flags gaps as /add-component; never invents components or raw hex.
design-system	Agent	frontend workflow	Owns @bewith-dev/design-system — the component library, tokens, Storybook, RTL/theme, and the COMPONENTS.md catalog that every web frontend (and PRD §7.2) anchors to. Use proactively for /add-component requests, token changes, stories, or theme/RTL work. The shared UI source of truth.
devops-infra	Agent	infra workflow	Infra + delivery authority for bewith-dev — EKS (primary) via Terraform/Pulumi/Helm/ArgoCD, ECS (secondary) via CDK, GitHub Actions CI/CD, base images, Secrets Manager, multi-region. Use proactively for IaC, deploy pipelines, cluster/service config, env vars, secrets, or the shared CI workflow.
draft-proposal	Skill	authoring governance manual	Turn a feature / infrastructure / process idea into a markdown file under docs/proposals/ in bewith-docs. Worktree-isolated, safe across concurrent sessions. Invoked by /propose or by Claude after the developer confirms.
end-session	Skill	workflow governance manual	Walks Claude through a session wrap-up — lists PRs touched, scans memory for stale references, and writes or confirms memory entries before the session closes. Invoked manually via /end-session, or by Claude when the developer signals closure ("done", "thanks", "סיימנו").
favorite-session	Skill	workflow automation	Favorite/pin a Claude Code session so you can find and reopen it later. Pins the current session (by $CLAUDE_CODE_SESSION_ID) to a private GitHub gist so favorites follow you across machines; lists, opens, and removes them. Invoked by /favorite, /favorites, /open-favorite, /unfavorite.
feature-needs-design	Policy	code-review governance pr-time	Fires when a PR adds a new endpoint (new feature surface, not a field change). Demands the architect agent and an approved design doc linked before merge, so a reviewer co-signs the approach before the code exists.
frontend-angular	Agent	frontend workflow	The Angular 8 maintainer for superco-management — a DEPRECATION TARGET. Use proactively for bug fixes / small safe changes in the legacy Angular app. Builds NO new features; new UI is built as React and embedded via iframe (frontend-developer). Smallest-safe-change only.
frontend-developer	Agent	frontend workflow	React + Next.js implementer for bewith-dev web frontends. Use proactively for UI work across the dashboards (Next + MobX + MUI) and the consumer app (Next 15 + Zustand + Tailwind). Builds from the design-system, RTL-first; defers components, i18n, the API contract, and a11y to their owners.
frontend-i18n	Policy	frontend code-review pr-time	Fires when translation keys or i18n config are touched. Enforces English + Hebrew parity and RTL-safe UI flagging.
gatekeeper	Agent	governance safety workflow	Readiness gate for planning artifacts. Use proactively before a PRD moves draft to ready-for-rd, or a Design Doc moves draft to approved. Independently validates each against its template and checklist, blocking the transition on any P0 gap. The pre-build twin of process-guardian.
git-hooks-sync	Hook	automation session-start infra	SessionStart hook. Points the machine-global git core.hooksPath at the plugin's CURRENT git-hooks/ (self-healing across always-latest updates). Safe-by-default — no-op on non-bewith repos, never clobbers a custom hooksPath.
i18n-localization	Agent	frontend workflow	i18n + RTL authority for bewith-dev frontends — i18next / next-i18next / next-intl, Hebrew/English locale files, key conventions, RTL correctness. Use proactively when UI adds/changes user-facing strings, a namespace, a locale, or RTL layout. Owns the conventions; frontend-developer applies them.
i18next-translation	Skill	frontend authoring manual	Find hardcoded user-facing strings, replace them with t() calls, and add the keys to both he/en locale files. Use when translating components, internationalizing text, or converting hardcoded strings. Owned by i18n-localization; used by frontend-developer.
identify-bug	Skill	workflow code-review manual	Identify and document a bug from inputs (description, logs, screenshots, JAM links, a ClickUp task) for someone else to fix — without implementing the fix unless asked. Gathers inputs, traces the flow, finds root cause, writes a structured understanding doc. Called by qa-engineer.
incident-report	Skill	workflow authoring manual	Render a finished incident / investigation into a browser-viewable RTL-Hebrew HTML report artifact (via the Artifact tool) — root cause, evidence, impact, timeline, fix. Use after investigating, not for finding bugs (see identify-bug).
insight	Skill	workflow authoring discovery manual	Capture a what's-missing / could-change POC observation into docs/insights/ — fast, separate from proposals. Worktree-isolated. Invoked by /insight or when the developer voices a gap or possible change during the build. Does NOT create a proposal; the 2-3 day review promotes agreed insights.
integrations	Agent	backend workflow	3rd-party integration authority — inbound/outbound webhooks, CRM sync (Monday.com), external connectors (Meta/WhatsApp BSP). Use proactively when work adds/changes a webhook, a CRM/3rd-party sync, or a connector. Owns webhook auth + idempotency + mapping; defers delivery, PII, contract.
large-refactor	Policy	code-review safety pr-time	Fires when a PR touches more than 20 files. Demands architect + code-reviewer agents and a design-review bridge before merge.
launch-checklist	Skill	workflow governance	Feature-level release-readiness before shipping a whole feature to production — flag + kill-switch, staged rollout, rollback plan, release notes/version, monitoring + post-deploy watch, comms, success metrics. Broader than the per-PR DoD. Produces a checklist; gates nothing automatically.
legacy-php-change	Policy	backend safety code-review pr-time	Fires on any change to the legacy Yii2 codebase. Enforces small scoped changes, blocks aggressive refactors, escalates auth/payment paths to mandatory human review.
legacy-php-guide	Agent	backend workflow	Yii2 / legacy-PHP maintainer (superco-consumer, superco-management BE) — a DEPRECATION TARGET. Use proactively for bug fixes / small safe changes. Smallest-safe-change, no new features (new work → NestJS / React-in-iframe); auth + payment paths require explicit human review.
local-stack-up	Skill	workflow backend infra	Bring the local BeWith stack up and confirm it is healthy — sandbox infra (Mongo/MySQL/Redis/LocalStack) plus the NestJS services (headless "Debug-Watch All Services") — then optionally exercise a change end-to-end. Idempotent; the hands-on counterpart to /verify.
mcp-availability-check	Hook	discovery session-start	SessionStart hook. Surveys MCP servers declared in .mcp.json + settings.json, reports which are reachable. Never blocks — informational.
mermaid-diagrams	Skill	authoring discovery workflow	Create version-controllable software diagrams with Mermaid's text syntax — flowcharts, sequence, class, ERD, C4/architecture, state. Use when documenting architecture, a data model, an API/auth flow, or a DB schema, or any "diagram / visualize / map out the flow" request.
mobile-developer	Agent	frontend workflow	Flutter/Dart implementer for the bewith-dev mobile apps (leaders-app, consumer-mobile). Use proactively for mobile feature work — screens, state, API integration, push, localization, release. Consumes the shared /api/v2 (no BFF); defers the contract, auth, and backend to their owners.
new-artifact	Skill	authoring governance manual	Create or update a platform artifact (agent, skill, command, rule, hook, policy) in bewith-docs. Walks the artifact-types decision tree, audits for duplication, drafts file(s), opens a PR. Triggers on phrases like "create an agent", "add a skill", "צריך command".
next-task	Skill	workflow discovery manual	Rank my open ClickUp tasks + assigned GitHub Issues by priority → urgency → effort and recommend what to start next; --fits-in Nm/Nh/Nd filters to what fits a time box. Read-only; the ranking is computed in a script, not by the model. Invoked by /next-task.
notifications	Agent	backend workflow	Multi-channel notification authority — email (SES), SMS (Nexmo/Smsim), WhatsApp (Meta), in-app (Bulldog), OTP, campaigns. Use proactively when work sends/changes a user-facing message, a channel, a campaign, or OTP delivery. Owns routing, retries/status, dedupe, opt-out; rides async-messaging.
notify-attention	Hook	safety automation	Notification hook. When a session needs the developer, pushes a one-line alert (ntfy.sh / Slack / macOS fallback) with surface·branch·cwd·reason + a claude --resume <id> hint, and records wait_state so /sessions shows which session is blocked. Debounced, fail-open.
obs-logs	Skill	infra backend manual	Search and analyze production logs — Grafana (Loki + CloudWatch) is the working backend, Datadog EU is legacy fallback. Use to check logs, investigate a production error, analyze volume/patterns, or debug from logs. Called by observability + identify-bug.
observability	Agent	infra backend workflow	Vendor-neutral observability for bewith-dev — logs, metrics, traces, dashboards, alerts. Use proactively when code adds/changes logging or instrumentation, a service needs monitoring, or for the post-deploy watch. Defines what to emit; implementers add the lines. Datadog is being phased out.
onboard-offer	Hook	governance session-start	SessionStart hook. The first time a developer opens an un-initialized bewith-dev repo, offers /claude-init (scaffold CLAUDE.md + CI, reviewable PR, never merges). No-op on non-bewith repos, the platform repo, already-initialized repos, and after offering once per clone.
payment-change	Policy	backend security code-review pr-time	Fires on any change to a payment provider, charge, refund, or withdrawal flow. Loads the payments agent (mandatory) and requires human review for live money flows — money bugs are not fix-forward.
payments	Agent	backend security workflow	The payments authority for bewith-dev (Stripe + Payme). Use proactively — MANDATORY — on any change touching charges, refunds, withdrawals, providers, or money flows. Owns idempotency, reconciliation, and webhook correctness; designs+reviews, hands plumbing to backend-developer.
permissions-demo-tokens	Skill	backend security manual	Find example users with a specific permission role (super-admin, organization-admin, community-admin, leader) in the local backend SQL DB and generate JWT tokens for them via the sandbox token CLI. Use to get demo users + JWTs to test permission levels locally. Called by auth-security.
pii-data-change	Policy	backend security code-review pr-time	Fires when a change collects, stores, exports, logs, or shares personal data. Loads privacy-compliance to check minimization, lawful basis, retention, user-rights cascade, and no-PII-in-logs/3rd-party.
playwright-snapshot-warn	Hook	safety tool-time efficiency	PreToolUse hook on mcp__playwright__browser_snapshot. Emits an "ask" permissionDecision nudging toward browser_evaluate / browser_network_requests or wrapping the session in a subagent. Never blocks; fail-open.
post-pr-create-memory-nudge	Hook	governance tool-time workflow	PostToolUse hook for Bash. When gh pr create succeeds, emits a one-line nudge reminding Claude to check whether MEMORY.md references the work the new PR captures. High-signal moment; never blocks.
postman-endpoint	Skill	backend workflow authoring	Save an added or changed HTTP endpoint in the organization R&D Postman workspace with a sample request and a saved response example, at the end of development. The Definition-of-Done step for API work — keeps the collection an accurate, runnable contract. Never commits secrets.
prd-writer	Agent	authoring workflow discovery manual	Produces Product Requirements Documents that R&D reads. Use proactively when a product owner describes a feature intent that needs capturing as a PRD at docs/prds/. Fills the PRD template, anchors UI to the design-system catalog, self-checks Definition of Ready, hands to gatekeeper.
prefer-infra-mcp	Hook	safety tool-time automation	PreToolUse hook for Bash. On a raw host DB/cache CLI (mysql/psql/mongo/mongosh/redis-cli) at a command position, returns permissionDecision "ask" pointing to the matching infra-MCP tool. Never blocks; never fires on docker exec, node scripts, or the CLI used as an argument.
privacy-compliance	Agent	security governance workflow	Privacy + data-protection authority — GDPR + Israeli privacy law, PII classification, consent, retention, user rights. Use proactively when a change collects, stores, exports, logs, or shares personal data, or adds a data flow. Advises on the legal/data duty; does not implement.
process-guardian	Agent	workflow safety governance	Definition-of-Done gate. Use proactively before closing tasks, marking PRs ready-for-review, or moving to Done. Verifies DoD (CU-id, lint/test/typecheck/build, no secrets, design-review); blocks if anything fails. Loaded at /done, step 13 of /continue, and by every Hard-Floor policy.
product-manager	Agent	workflow governance discovery	Product-judgment authority — is this worth building, business/ICP-aligned, what's the priority. Use proactively when product intent is unclear, features compete, or a PRD needs a product (not mechanical) read. Owns the AI-consumable PRD→Design Doc chain; distinct from gatekeeper.
production-deploy	Policy	infra security safety	Fires when a production deploy is requested (region-prod-semver tag). Hard Floor — the AI cannot ship to prod without an explicit human approval.
propose-team-rule	Skill	authoring governance manual	Turn a generic insight into a reviewable PR on bewith-docs for team discussion. Worktree-isolated, safe across concurrent sessions. Invoked by /share-rule or by Claude after the developer confirms. Never auto-invoke without explicit approval — each PR consumes review attention.
qa-engineer	Agent	safety workflow	Testing authority across ALL levels (unit, integration, e2e) on the real stack — Jest, supertest, mongodb-memory-server / Testcontainers, Playwright. Use proactively when behavior changes, coverage is questioned, or tests are flaky. Implementers write unit tests; qa owns strategy + integration/e2e.
restore-code	Skill	safety workflow manual	Recover lost or clobbered code from the automatic safety snapshots — falls back to git reflog/stash/dangling blobs. Triggered by /restore, free language ("I lost code"), or proactively when Claude detects dropped code. Diffs and confirms before writing; reversible.
role	Skill	discovery governance manual	View or change your role (dev or product). Role controls which capabilities the capability-awareness hook and /help-me surface to you — dev role sees dev-tagged artifacts, product role sees product-tagged artifacts, both see "both"-tagged ones. Invoked via /role. Default role is dev.
safety-snapshot	Hook	safety tool-time automation	PreToolUse hook for Edit/Write. Before each edit, captures a non-destructive snapshot of the full working tree to refs/bewith-safety/, so uncommitted code an edit might clobber is recoverable via /restore. Debounced, auto-pruned, fail-open — never blocks or touches your tree.
scalability-reviewer	Agent	data code-review safety pr-time	Scale-audit authority for bewith-dev — will this hold at production data volume? Use proactively on any migration, schema, aggregation, or change that reads/writes a collection. Catches unbounded queries, full-collection loads, non-batched backfills, and N+1 before they ship.
scale-review	Policy	data safety code-review pr-time	Fires when a migration, schema, or aggregation pipeline changes. Forces a scalability audit — production-volume estimate, bounded queries, batched backfills — the "does it scale" check schema-migration leaves open.
schema-migration	Policy	data safety code-review pr-time	Fires when a migration file is added or modified. Demands dry-run against a prod-shaped sandbox, data-loss static analysis, and an index-size review.
search-vector	Agent	backend data workflow	Search + vector authority — OpenSearch full-text and vector search, Voyage embeddings, index mappings, the retrieval half of RAG. Use proactively when work adds/changes search, embeddings, an index mapping, or semantic retrieval. Owns relevance + index design; ai-llm consumes the context.
secret-rotation	Policy	security safety infra	Fires when a secret-bearing file or a rotation tool is invoked. Hard Floor — invalidating running sessions across services demands explicit human coordination.
sentinel-triage	Skill	infra backend discovery manual	Triage a production/staging signal for BeWith — verify, locate, classify, recommend; returns one JSON verdict. Read-only. Triggers on /sentinel-check, "triage this error", "is this a real bug", or investigating a prod/staging signal.
session-drift-check	Hook	safety automation	UserPromptSubmit hook. On each message, detects whether the world drifted since this session's baseline — origin/master advanced or the branch HEAD moved — and injects a one-shot reminder to re-verify context before acting. Never blocks.
session-end	Hook	safety automation	SessionEnd hook. Marks this session "ended" with its end reason (clear/logout/exit/other) in the registry, so /sessions and the menu bar show it closed rather than just aging into "stale". Fail-open, never blocks.
session-guard	Hook	safety tool-time automation	PreToolUse hook for Edit/Write/NotebookEdit. Records this session's heartbeat + touched file, then checks the local registry — WARNS if another live session touched the same file, BLOCKS only when another owns the same branch+working-dir, with guidance to continue safely. Fail-open.
session-register	Hook	safety session-start automation	SessionStart hook. Registers this session in a local per-machine registry with its branch, cwd, git baseline and a heartbeat — the basis for same-machine concurrent-session awareness. Archives stale entries (never deletes); never blocks.
session-state-awareness	Hook	safety session-start governance	SessionStart hook. Teaches Claude to verify checkable references in memory (PRs, branches, files, tasks) before acting on them, and surfaces sibling git worktrees on the cwd repo so the session knows concurrent work is in flight.
session-stop	Hook	safety automation	Stop hook. Marks this session "idle" (finished its turn, awaiting your input) in the registry, so /sessions and the menu bar tell a working session apart from one that's done. Bumps the heartbeat; clears any wait_state. Fail-open, never blocks.
sessions-view	Skill	workflow safety automation	Read the local per-machine session registry and render a cross-session mission-control view — branch, cwd, files, age, live/stale, collisions, and which sessions are waiting on the developer. Optionally launches a self-refreshing HTML dashboard. Read-only; invoked by /sessions.
settings	Skill	discovery governance manual	View or change your BeWith developer settings (conversation language, role, default language, notifications, docs path) from one place. Backed by ~/.bewith/config.json — works in chat as a table plus set, opens a local HTML page, and mirrors the SwiftBar menu. Invoked via /settings.
state-sync	Skill	workflow governance automation	Keeps a task's state mirrored across both trackers — writes the AI Context block to the GitHub Issue and a condensed mirror to the ClickUp ai_context field, and maintains the bidirectional link so any session knows which ClickUp task an Issue belongs to. Runs at checkpoints; never gated.
systematic-debugging	Skill	workflow backend discovery	A 4-phase active-fix loop — reproduce, isolate, hypothesize+instrument, fix+verify — with a hard stop after 3 failed attempts. Instruments at the gateway/RPC/service/Mongo boundaries. Triggers on "debug this", "why is this failing", "help me fix this bug".
team-rule-prompt	Hook	governance session-start authoring	SessionStart hook. Injects the team-rule discrimination guidance into Claude's additionalContext so it knows when to propose a team rule vs. save a personal memory.
team-rules-inject	Hook	governance session-start	SessionStart hook. Injects the ACCEPTED team rules (.claude/rules/team/*.md) from the plugin so they apply in EVERY repo — not just inside bewith-docs, where Claude Code auto-loads .claude/rules/ natively. Closes the consumer gap left by the repo-relative @-imports.
test-driven-development	Skill	workflow code-review backend	Drive a change test-first — a failing test, then minimum code to pass, then refactor. Adapted to the bewith Jest/NestJS stack. The Iron Law — no production code before a failing test. Triggers on "TDD this", "test first", "drive this test-first".
watch-deploy	Skill	infra workflow safety	After a merge, watch the deployment to its target environment and the observability stack for a defined window before the task closes. Confirms the deploy succeeded and telemetry is clean (vendor-neutral); on a regression it flags an incident instead of closing the task.
worktree-mutation-warn	Hook	safety tool-time governance	PreToolUse hook for Bash. Soft warning when Claude attempts a git mutation on the primary worktree of a repo that has sibling worktrees — a likely concurrent-session collision. Warns to stderr; never blocks.