tour-dev-toolkit

Code review agent that checks diffs against tour-expense-tracker CLAUDE.md rules. Dispatched by smart-commit or manually. Verifies multi-tenancy, financial safety, input validation, audit logging, and coding standards.

Reviews code changes for modifications to financial-sensitive files and calculations. Flags changes to expense logic, currency conversion, pricing, invoicing, and payment flows that require careful review per CLAUDE.md safety rules.

Impact analyzer that maps dependency chains from shared modules to show what breaks when they change. Traces imports, classifies by portal, identifies test coverage gaps, and produces runnable test commands.

Migration planner that validates Prisma schema changes before they're applied. Checks new models for organization_id, indexes, and cascade behavior. Flags breaking changes like type narrowing and required fields without defaults.

Audits server actions and API routes for Prisma queries missing organization_id filtering. Enforces multi-tenant data isolation — every query must scope by organization_id either directly or via a parent relation.

Performance auditor that detects query anti-patterns through static analysis — N+1 queries, unbounded findMany, over-fetching on large models, sequential queries that could use include, and unindexed filters.

Validates that Prisma select, where, and _count field names in TypeScript source match the actual schema.prisma model definitions. Run after editing files with Prisma queries to catch mismatched field names before build.

Security scanner that audits server actions and API routes for auth gaps, missing organization_id scoping, and IDOR vulnerabilities. Accepts optional path argument to narrow scope.

Test fixer agent that diagnoses and fixes failing vitest tests. Distinguishes stale expectations from regressions. Refuses to auto-fix financial calculation logic.

This skill should be used when the user asks to "debug a production issue", "trace an error", "investigate a bug", "why is X broken", "500 error on", or needs systematic debugging across the multi-portal architecture.

This skill should be used when the user asks to "scaffold an action", "create a server action", "generate action file", "new action for", or needs a new server action file following project conventions.

This skill should be used when the user asks to "scaffold a route", "create an API route", "generate route handler", "new API endpoint", or needs a new API route handler following project conventions.

This skill should be used when the user asks to "scaffold a test", "create a test file", "generate tests for", "add tests to", or needs a vitest test file following project conventions.

This skill should be used when the user asks to "smart commit", "commit my changes", "commit and push", "commit and create PR", "push changes", or wants a streamlined commit workflow with safety checks.

This skill should be used when the user asks to "sync openapi", "update API docs", "check API spec", "verify openapi", "API documentation out of date", or needs to verify the OpenAPI specification matches actual routes.

3 hooks across 2 events