Claude Skills by tools-only

The following cheatsheet provides production-grade guidelines for building optimized and [secure Node.js Docker](https://snyk.io/blog/10-best-practices-to-containerize-nodejs-web-applications-with-docker/). You’ll find it helpful regardless of the Node.js application you aim to build. This article will be helpful for you if: - your aim is to build a frontend application using server-side rendering (SSR) Node.js capabilities for React. - you’re looking for advice on how to properly build a Nod...

The following cheatsheet provides production-grade guidelines for building optimized and [secure Node.js Docker](https://snyk.io/blog/10-best-practices-to-containerize-nodejs-web-applications-with-docker/). You’ll find it helpful regardless of the Node.js application you aim to build. This article will be helpful for you if: - your aim is to build a frontend application using server-side rendering (SSR) Node.js capabilities for React. - you’re looking for advice on how to properly build a Nod...

<!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

<!-- Threat Modeling Skill | Version 3.0.2 (20260204a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

This document outlines common security vulnerabilities found in automotive security and provides examples of how attackers can exploit these vulnerabilities.

This document outlines common security vulnerabilities found in automotive security and provides examples of how attackers can exploit these vulnerabilities.

Mobile application development presents certain security challenges that are unique compared to web applications and other forms of software. This cheat sheet provides guidance on security considerations for mobile app development. It is not a comprehensive guide by any means, but rather a starting point for developers to consider security in their mobile app development.

Mobile application development presents certain security challenges that are unique compared to web applications and other forms of software. This cheat sheet provides guidance on security considerations for mobile app development. It is not a comprehensive guide by any means, but rather a starting point for developers to consider security in their mobile app development.

<!-- Threat Modeling Skill | Version 3.0.2 (20260204a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

<!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

<!-- Threat Modeling Skill | Version 3.0.2 (20260204a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

<!-- Threat Modeling Skill | Version 3.0.3 (20260209a) | https://github.com/fr33d3m0n/threat-modeling | License: BSD-3-Clause -->

Update docs/codebase-map modules impacted by Phase 1 changes (core-state, core-agents/streaming).

The new usage tracker accessed `cached_tokens` directly on provider usage objects, which caused an AttributeError for providers that omit that field. We now normalize usage objects at the boundary and default missing fields to 0, matching the old behavior.

User hits ESC to abort mid-request. All subsequent requests in that conversation hang forever (timeout after 120s). Issue persists even after reloading the session.

The debug logs now show: ``` [DEBUG] pydantic-ai ctx.messages count=56 [DEBUG] ctx.messages[0] type=ModelRequest [DEBUG] Stream init: ... ctx_messages=56 ctx_messages_type=list ```

After using `/resume` to load a session that contains tool calls, subsequent requests hang indefinitely (timeout after 30s stream watchdog, then 120s global timeout). Fresh sessions work fine. Sessions without tool calls resume fine.

Messages are only saved after successful completion of the agent loop. Any error, abort, or cancellation causes ALL messages to be lost, even if the conversation ran for many iterations.

Bugs, smells, issues dumped here as encountered. Raw is fine. A skill will organize this into proper kb entries later. Format: `[date] [type] description` Types: bug, smell, pattern, lesson, antipattern --- [2026-01-07] [lesson] When there's a type mismatch between A and B, fix where A or B is defined, not every place that uses them. Don't scatter changes across 5+ files when one line at the source fixes everything. [2026-01-08] [pattern] Local mode config: `docs/configuration/tunacode.local....

Bugs, smells, issues dumped here as encountered. Raw is fine. A skill will organize this into proper kb entries later. Format: `[date] [type] description` Types: bug, smell, pattern, lesson, antipattern --- [2026-01-07] [lesson] When there's a type mismatch between A and B, fix where A or B is defined, not every place that uses them. Don't scatter changes across 5+ files when one line at the source fixes everything. [2026-01-08] [pattern] Local mode config: `docs/configuration/tunacode.local....

`list_dir` raised `FileNotFoundError` on non-existent directories, which `@base_tool` wrapped as `ToolExecutionError`. Since `ToolExecutionError` is in `NON_RETRYABLE_ERRORS`, the agent halted instead of letting the LLM self-correct with a valid path.

PR #244 centralized panel width calculations into a single module (`panel_widths.py`) and removed redundant width logic from 9+ tool renderers. This refactoring applies Gate 5 (Indirection Requires Verification) by replacing `expand=True` indirection with explicit `width=` parameters.

When a user aborted mid-tool-call (Ctrl+C or tool denial), the conversation history was left with a `ModelResponse` containing tool calls but no corresponding `ToolReturn` messages. The next API request failed because the provider expected tool returns for pending calls.

Fixed a bug where `retry-prompt` parts were left orphaned in message history after their corresponding `tool-call` parts were pruned during dangling tool call cleanup. The fix generalizes the filter to remove ANY part with a `tool_call_id` matching a dangling ID, not just `tool-call` parts.

Boundary contracts between UI, core, and tools are partially implicit: several callbacks and tool entry points are typed as `Any` or use broad protocols, so the contract is not enforced by typing or tests. This makes boundary drift harder to detect and allows accidental coupling across layers.

Moved the app-level ESC cancellation cascade into a dedicated `ui/esc` module and delegated `action_cancel_request()` to an explicit handler. This isolates ESC logic from app internals and makes the dependency inputs explicit.

Reduced redundant token estimation in tool-output pruning while preserving pruning behavior. The pruning loop in `prune_old_tool_outputs()` was estimating token counts twice for pruned parts and recalculating placeholder tokens for every mutation. - Added `PRUNE_PLACEHOLDER_TOKENS` to cache placeholder token counts. - Introduced `get_part_content_text()` to normalize part content before estimation/pruning. - Passed precomputed token counts into `prune_part_content()` to avoid re-estimation. -...

Removed the temporary `tunacode.cli` package shim so the only supported CLI entrypoint is `tunacode.ui.main`, aligning code and docs on a single import path.

The agent run flow no longer recomputes token totals by iterating over message history. This removes the slow heuristic `update_token_count` path in favor of usage totals as the canonical source for token display.

Removed the unused ToolBuffer shim from the agent loop and strengthened the system prompt to demand batched read-only tool calls during discovery, aligning the runtime with actual parallel tool execution capabilities.

The resource bar now reads token totals from accumulated usage metrics rather than heuristic message counts, keeping the UI aligned with provider-reported usage.

Tool calls with leading/trailing whitespace in `tool_name` failed to dispatch (e.g., " glob"), resulting in unknown-tool errors instead of retries. We now normalize tool names before registration and dispatch to avoid whitespace-induced failures.

from tunacode.tools.authorization import ToolHandler __all__ = ["ToolHandler"] from tunacode.tools.authorization.handler import ToolHandler # Direct import ``` The `__all__` export suggests `ToolHandler` should be imported via `tunacode.core`, but nothing actually uses it that way.

Removed global mutable cache state from the user configuration module. The previous implementation used module-level `_config_fingerprint` and `_config_cache` variables for a fast-path optimization that was likely premature for configuration file handling.

The canonical token total for UI display is the accumulated pydantic-ai usage totals (prompt + completion) from `usage.session_total_usage`, not heuristic message counting. This aligns the UI with billed API usage and avoids slow per-message estimation.

When extracting changes from a messy PR, I blindly copied a fix to `retry.py` without questioning whether it was needed.

grep -n "_gitignore_patterns" src/tunacode/tools/glob.py ``` If all references are writes, it's dead.

| Phase | Status | Branch | |-------|--------|--------| | P1 (Messaging) | ✓ Complete | `types-architect` | | P2 (Tooling) | ✓ Complete | `types-architect` |

These are another layer to prevent slop, not pre-commit hooks.

These are another layer to prevent slop, not pre-commit hooks.

**Generated:** 2026-01-04 **Project:** TunaCode - TUI Code Agent **Source Directory:** src/tunacode/ **Version:** 0.1.20 **Python Version:** 3.11-3.13 ---

**Status**: Draft **Created**: 2026-01-25 **Branch**: `claude/refactor-tunacode-architecture-Ox6gl` ---

**Status**: Draft **Created**: 2026-01-25 **Branch**: `claude/refactor-tunacode-architecture-Ox6gl` ---

This document traces message handling from entry to exit, documenting the single source of truth pattern.

The Tunacode TUI (Terminal User Interface) is built upon a strong design philosophy heavily inspired by the classic **NeXTSTEP** operating system. This is not merely an aesthetic choice, but a functional one aimed at maximizing user clarity and control.

**Date:** 2025-12-06 **Scope:** UI / Tooling **Status:** Canonical

**Date:** 2026-01-07 **Scope:** UI / Renderers **Status:** Canonical

Removed direct dependencies on `pydantic-ai` from the `src/tunacode/tools/` directory (specifically `ModelRetry`). Tools now raise a domain-specific `ToolRetryError`, which is intercepted by the tool decorator and translated to `ModelRetry` for the framework. Previously, 8 tool files imported `ModelRetry` from `pydantic_ai.exceptions`. This coupled the business logic of the tools directly to the specific agent framework we are using. - **Added `ToolRetryError`** to `src/tunacode/exceptions.py...

**Date:** 2026-01-27 **Branch:** lsp-index-cleanup **Start commit:** b4e34261 **End commit:** 690c4760

**Remove the planning feature entirely from tunacode.** The feature (a read-only mode restricting agent to information gathering before code modifications) is not actively used and adds maintenance burden across 9 layers.