Migrate to Kiro steering configuration

.gitignore

@@ -21,9 +21,6 @@ Thumbs.db
 # Node
 node_modules/
 
-# Personal configs (if any)
+# Personal configs
 personal/
 private/
-
-# Session templates (not committed)
-examples/sessions/*.tmp

.kiro/hooks/console-log-warning.json

@@ -0,0 +1,13 @@
+{
+  "name": "Console.log Warning",
+  "version": "1.0.0",
+  "description": "Warns about console.log statements in edited JS/TS files - these should be removed before committing",
+  "when": {
+    "type": "fileEdited",
+    "patterns": ["*.ts", "*.tsx", "*.js", "*.jsx"]
+  },
+  "then": {
+    "type": "runCommand",
+    "command": "grep -n 'console\\.log' \"$KIRO_FILE_PATH\" && echo '[WARNING] Remove console.log statements before committing' || true"
+  }
+}

.kiro/hooks/git-push-review.json

@@ -0,0 +1,13 @@
+{
+  "name": "Git Push Review Reminder",
+  "version": "1.0.0",
+  "description": "Before executing shell commands that involve git push, remind to review changes first",
+  "when": {
+    "type": "preToolUse",
+    "toolTypes": ["shell"]
+  },
+  "then": {
+    "type": "askAgent",
+    "prompt": "If this shell command involves 'git push', ensure you have: 1) Reviewed the diff with git diff, 2) Confirmed all tests pass, 3) Verified no console.log or hardcoded secrets in the diff, 4) Used a feature branch (not main/master). If the command is not git-related, proceed normally."
+  }
+}

.kiro/hooks/post-task-verify.json

@@ -0,0 +1,12 @@
+{
+  "name": "Post-Task Verification",
+  "version": "1.0.0",
+  "description": "After completing a spec task, run build and type checking to verify nothing is broken",
+  "when": {
+    "type": "postTaskExecution"
+  },
+  "then": {
+    "type": "runCommand",
+    "command": "npx tsc --noEmit 2>&1 | tail -20"
+  }
+}

.kiro/hooks/prettier-format.json

@@ -0,0 +1,13 @@
+{
+  "name": "Auto-format with Prettier",
+  "version": "1.0.0",
+  "description": "Automatically formats JS/TS files with Prettier after they are edited",
+  "when": {
+    "type": "fileEdited",
+    "patterns": ["*.ts", "*.tsx", "*.js", "*.jsx"]
+  },
+  "then": {
+    "type": "runCommand",
+    "command": "npx prettier --write \"$KIRO_FILE_PATH\""
+  }
+}

.kiro/hooks/review-write-operations.json

@@ -0,0 +1,13 @@
+{
+  "name": "Review Write Operations",
+  "version": "1.0.0",
+  "description": "Before any write operation, verify it follows coding standards: immutability, proper error handling, no hardcoded secrets, and appropriate file size",
+  "when": {
+    "type": "preToolUse",
+    "toolTypes": ["write"]
+  },
+  "then": {
+    "type": "askAgent",
+    "prompt": "Before writing this file, verify: 1) No hardcoded secrets or API keys, 2) Immutable patterns used (no mutation), 3) Proper error handling with try/catch, 4) File will remain under 800 lines, 5) No console.log statements in production code. If any violation is found, mention it before proceeding."
+  }
+}

.kiro/hooks/security-check-on-api.json

@@ -0,0 +1,13 @@
+{
+  "name": "Security Check on API Files",
+  "version": "1.0.0",
+  "description": "When API route files are created, remind the agent to verify security best practices",
+  "when": {
+    "type": "fileCreated",
+    "patterns": ["**/api/**", "**/routes/**", "**/middleware/**"]
+  },
+  "then": {
+    "type": "askAgent",
+    "prompt": "A new API/route/middleware file was created. Verify it includes: 1) Input validation (preferably with Zod), 2) Proper authentication/authorization checks, 3) Rate limiting consideration, 4) No sensitive data in error responses, 5) Parameterized queries if database access is involved."
+  }
+}

.kiro/hooks/typescript-check.json

@@ -0,0 +1,13 @@
+{
+  "name": "TypeScript Check",
+  "version": "1.0.0",
+  "description": "Runs TypeScript type checking after editing .ts/.tsx files to catch type errors early",
+  "when": {
+    "type": "fileEdited",
+    "patterns": ["*.ts", "*.tsx"]
+  },
+  "then": {
+    "type": "runCommand",
+    "command": "npx tsc --noEmit --pretty 2>&1 | head -50"
+  }
+}

.kiro/settings/mcp.json

@@ -0,0 +1,46 @@
+{
+  "mcpServers": {
+    "github": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-github"],
+      "env": {
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_PAT_HERE"
+      },
+      "disabled": true,
+      "autoApprove": []
+    },
+    "firecrawl": {
+      "command": "npx",
+      "args": ["-y", "firecrawl-mcp"],
+      "env": {
+        "FIRECRAWL_API_KEY": "YOUR_FIRECRAWL_KEY_HERE"
+      },
+      "disabled": true,
+      "autoApprove": []
+    },
+    "supabase": {
+      "command": "npx",
+      "args": ["-y", "@supabase/mcp-server-supabase@latest", "--project-ref=YOUR_PROJECT_REF"],
+      "disabled": true,
+      "autoApprove": []
+    },
+    "memory": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-memory"],
+      "disabled": true,
+      "autoApprove": []
+    },
+    "sequential-thinking": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-sequential-thinking"],
+      "disabled": true,
+      "autoApprove": []
+    },
+    "context7": {
+      "command": "npx",
+      "args": ["-y", "@context7/mcp-server"],
+      "disabled": true,
+      "autoApprove": []
+    }
+  }
+}

.kiro/steering/agents-orchestration.md

@@ -0,0 +1,37 @@
+---
+inclusion: always
+---
+
+# Agent Orchestration Guidelines
+
+## When to Delegate to Sub-Agents
+
+Use sub-agents for independent, parallelizable work:
+- Security analysis of specific files
+- Performance review of specific modules
+- Type checking isolated components
+- Documentation generation for separate areas
+
+## Multi-Perspective Analysis
+
+For complex problems, consider multiple perspectives:
+- Factual accuracy review
+- Senior engineer review (architecture)
+- Security expert review (vulnerabilities)
+- Consistency review (patterns match codebase)
+
+## Feature Implementation Workflow
+
+For complex features, follow this sequence:
+1. **Plan** - Break down into phases with dependencies and risks
+2. **Implement** - TDD approach (tests first, then code)
+3. **Review** - Code quality and security review
+4. **Verify** - Build, type-check, lint, test suite
+
+## When to Plan vs Act
+
+- Simple bug fixes: Act immediately
+- Single-file changes: Act immediately
+- Multi-file features: Plan first
+- Architectural changes: Plan first, get confirmation
+- Refactoring: Plan first, identify risk level

.kiro/steering/code-review.md

@@ -0,0 +1,61 @@
+---
+inclusion: manual
+---
+
+# Code Review Checklist
+
+When reviewing code (triggered by user asking for a code review):
+
+## Security Checks (CRITICAL)
+
+- Hardcoded credentials (API keys, passwords, tokens)
+- SQL injection risks (string concatenation in queries)
+- XSS vulnerabilities (unescaped user input)
+- Missing input validation
+- Insecure dependencies (outdated, vulnerable)
+- Path traversal risks (user-controlled file paths)
+- CSRF vulnerabilities
+- Authentication bypasses
+
+## Code Quality (HIGH)
+
+- Large functions (>50 lines)
+- Large files (>800 lines)
+- Deep nesting (>4 levels)
+- Missing error handling (try/catch)
+- console.log statements
+- Mutation patterns
+- Missing tests for new code
+
+## Performance (MEDIUM)
+
+- Inefficient algorithms (O(n²) when O(n log n) possible)
+- Unnecessary re-renders in React
+- Missing memoization
+- Large bundle sizes
+- N+1 queries
+
+## Best Practices (MEDIUM)
+
+- TODO/FIXME without tickets
+- Missing JSDoc for public APIs
+- Accessibility issues (missing ARIA labels)
+- Poor variable naming (x, tmp, data)
+- Magic numbers without explanation
+- Inconsistent formatting
+
+## Review Output Format
+
+For each issue found:
+```
+[SEVERITY] Issue Title
+File: path/to/file.ts:line
+Issue: Description
+Fix: Suggested remediation
+```
+
+## Approval Criteria
+
+- Approve: No CRITICAL or HIGH issues
+- Warning: MEDIUM issues only (can merge with caution)
+- Block: CRITICAL or HIGH issues found

rules/coding-style.md → .kiro/steering/coding-style.md

@@ -1,4 +1,8 @@
-# Coding Style
+---
+inclusion: always
+---
+
+# Coding Style Guidelines
 
 ## Immutability (CRITICAL)
 

.kiro/steering/git-workflow.md

@@ -0,0 +1,38 @@
+---
+inclusion: always
+---
+
+# Git Workflow
+
+## Commit Message Format
+
+```
+<type>: <description>
+
+<optional body>
+```
+
+Types: feat, fix, refactor, docs, test, chore, perf, ci
+
+## Pull Request Workflow
+
+When creating PRs:
+1. Analyze full commit history (not just latest commit)
+2. Use `git diff [base-branch]...HEAD` to see all changes
+3. Draft comprehensive PR summary
+4. Include test plan
+5. Push with `-u` flag if new branch
+
+## Feature Implementation Workflow
+
+1. **Plan First** - Create implementation plan for complex features
+2. **TDD Approach** - Write tests first, implement to pass, refactor
+3. **Code Review** - Review immediately after writing code
+4. **Commit & Push** - Detailed commit messages, conventional commits
+
+## Branch Strategy
+
+- Never commit directly to main/master
+- Use feature branches: `feat/feature-name`, `fix/bug-description`
+- PRs require passing CI before merge
+- Keep PRs focused and atomic