From bc68f3bb0f75dd756f15d4358ba0c8229e287c8d Mon Sep 17 00:00:00 2001
From: C-Valen <charlie.valen@gmail.com>
Date: Fri, 19 Sep 2025 15:22:13 +0200
Subject: [PATCH 1/7] =?UTF-8?q?=F0=9F=94=A7=20AI=20assist=20guidelines=20s?=
 =?UTF-8?q?etup?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .cursor/rules    |  20 +++++++
 AI_GUIDELINES.md | 153 +++++++++++++++++++++++++++++++++++++++++++++++
 CLAUDE.md        |  26 ++++++++
 3 files changed, 199 insertions(+)
 create mode 100644 .cursor/rules
 create mode 100644 AI_GUIDELINES.md
 create mode 100644 CLAUDE.md

diff --git a/.cursor/rules b/.cursor/rules
new file mode 100644
index 000000000..1fd5dc457
--- /dev/null
+++ b/.cursor/rules
@@ -0,0 +1,20 @@
+# OSIM Project - Cursor AI Configuration
+
+This project uses unified AI assistant guidelines. Please refer to the comprehensive guidelines in:
+
+**[AI_GUIDELINES.md](./AI_GUIDELINES.md)**
+
+The AI_GUIDELINES.md file contains all the detailed information about:
+- Project overview and tech stack
+- Code style and standards
+- Vue.js specific guidelines
+- File organization patterns
+- API and data handling approaches
+- Testing guidelines
+- Development workflow
+- Security considerations
+- Common patterns and best practices
+- Available commands and tools
+- AI assistant preferences and specific notes
+
+Please follow all guidelines specified in that file when assisting with this project.
diff --git a/AI_GUIDELINES.md b/AI_GUIDELINES.md
new file mode 100644
index 000000000..1632e4093
--- /dev/null
+++ b/AI_GUIDELINES.md
@@ -0,0 +1,153 @@
+# OSIM Project - AI Assistant Guidelines
+
+## Project Overview
+This is OSIM (Open Security Issue Management), a Vue.js 3 + TypeScript incident response web application. The project uses modern development tools including Vite, Pinia for state management, Vue Router, and comprehensive testing with Vitest.
+
+## Tech Stack Context
+- **Frontend**: Vue 3 with Composition API, TypeScript, Vite
+- **State Management**: Pinia
+- **Routing**: Vue Router 4
+- **Styling**: Bootstrap 5, SCSS, PostCSS with Stylelint
+- **Testing**: Vitest (unit), Vue Test Utils, MSW for API mocking, Behave (E2E)
+- **Linting**: ESLint with extensive configuration and multiple plugins, Stylelint
+- **Build**: Vite with custom configuration for proxies and SSL
+- **Authentication**: JWT token-based authentication
+- **API Integration**: OpenAPI client generation for type-safe API calls
+- **Development Server**: HTTPS-enabled with hot reload and proxy support
+
+## Code Style & Standards
+- Follow the existing ESLint configuration (eslint.config.mjs) with comprehensive plugin setup
+- Use TypeScript strict mode enabled throughout the project
+- Prefer Composition API over Options API for Vue components
+- Use single quotes for strings, trailing commas
+- 2-space indentation, 120 character line limit
+- Import organization: builtin → external → internal → Vue-specific
+- Vue component structure: `<script>`, `<template>`, `<style>`
+- Comprehensive linting includes: TypeScript, Vue, imports, styling, unicorn, perfectionist
+- Source maps enabled for debugging support
+
+## Vue.js Specific Guidelines
+- Use `<script setup>` syntax for new components
+- Follow Vue 3 Composition API patterns
+- Use defineProps, defineEmits, defineModel macros appropriately
+- Prefer reactive() and ref() over Options API data
+- Use computed() for derived state
+- Implement proper TypeScript interfaces for props and emits
+- Follow the multi-word component naming convention (exceptions: Modal, Tabs, Toast, Login, Navbar, Settings)
+
+## File Organization
+- Components: `/src/components/` - Reusable UI components
+- Views: `/src/views/` - Page-level components
+- Widgets: `/src/widgets/` - Complex reusable components
+- Composables: `/src/composables/` - Reusable composition functions
+- Stores: `/src/stores/` - Pinia stores for state management
+- Services: `/src/services/` - API and external service integrations
+- Types: `/src/types/` - TypeScript type definitions
+- Utils: `/src/utils/` - Utility functions
+- Constants: `/src/constants/` - Application constants
+
+## API & Data Handling
+- Use the generated OpenAPI clients from `/src/generated-client/`
+- Mock APIs using MSW in `/src/mock-server/`
+- Handle authentication with JWT tokens
+- Use Pinia stores for complex state management
+- Implement proper error handling and loading states
+
+## Testing Guidelines
+- Write unit tests using Vitest and Vue Test Utils
+- Place test files adjacent to source files with `.spec.ts` extension
+- Use MSW for API mocking in tests
+- Test Vue components with proper setup and teardown
+- Follow the existing test patterns in `src/__tests__/`
+- E2E tests use Python/Behave - maintain feature files in `/features/`
+
+## Development Workflow
+- Use `yarn dev` for development with hot reload and tests
+- Use `yarn build` for production builds
+- Run `yarn lint` before committing (includes both ESLint and Stylelint)
+- Use `yarn type-check` for TypeScript validation
+- Use `yarn coverage` to generate test coverage reports
+- Use `yarn vibe-check` to analyze bundle size and dependencies
+- Docker containerization available with proper entrypoints
+- HTTPS enabled in development server for realistic testing
+- Source maps generated for debugging in both development and production
+
+## Security Considerations
+- This is a security-focused application for incident response
+- Be mindful of sensitive data handling
+- Follow secure coding practices
+- Validate and sanitize user inputs
+- Use proper authentication and authorization patterns
+
+## Common Patterns
+- Use Zod for runtime type validation
+- Implement proper loading and error states in components
+- Use Bootstrap classes for consistent styling
+- Follow the existing patterns for forms, modals, and data tables
+- Use Vue directives appropriately (custom directives in `/src/directives/`)
+
+## When Making Changes
+- Always check existing similar implementations first
+- Follow the established patterns and conventions
+- Update tests when modifying functionality
+- Consider accessibility (a11y) requirements
+- Test across different screen sizes (responsive design)
+- Validate TypeScript types and ESLint rules pass
+
+## Helpful Commands
+
+### Development
+- `yarn dev` - Start development server with hot reload and tests
+- `yarn dev-server` - Start development server only (without tests)
+
+### Build & Type Checking
+- `yarn build` - Build for production
+- `yarn type-check` - Run TypeScript type checking
+- `yarn preview` - Preview production build
+
+### Testing
+- `yarn test:unit` - Run unit tests with watch mode
+- `yarn test:unit:nowatch` - Run unit tests once
+- `yarn test:e2e` - Run end-to-end tests (Behave/Python)
+- `yarn coverage` - Run tests with coverage report
+
+### Linting & Formatting
+- `yarn lint` - Run all linting (ESLint + Stylelint)
+- `yarn lint-ts-vue` - Run ESLint on TypeScript and Vue files
+- `yarn lint-style` - Run Stylelint on CSS/SCSS/Vue files
+- `yarn lint-fix` - Auto-fix ESLint issues
+
+### Other
+- `yarn vibe-check` - Analyze bundle size with visualizer
+
+## AI Assistant Preferences
+- Prioritize type safety and use proper TypeScript types
+- Suggest Vue 3 Composition API patterns
+- Follow the existing code style and ESLint rules
+- Consider performance implications (Vue reactivity, bundle size)
+- Suggest proper error handling and user experience improvements
+- Reference existing patterns in the codebase when possible
+- Always consider the security context of this application
+
+## AI-Specific Notes
+
+### For Code Generation
+- Generate code that can be run immediately
+- Add all necessary import statements and dependencies
+- Follow the project's existing patterns and conventions
+- Ensure TypeScript types are properly defined
+- Include proper error handling and loading states
+
+### For Code Reviews
+- Check adherence to ESLint rules and TypeScript standards
+- Verify Vue 3 Composition API best practices
+- Ensure security considerations are addressed
+- Validate test coverage for new functionality
+- Check accessibility (a11y) compliance
+
+### For Refactoring
+- Maintain existing functionality while improving code quality
+- Update related tests when modifying code
+- Consider breaking changes and migration paths
+- Follow the established file organization patterns
+- Ensure backward compatibility where appropriate
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 000000000..8ca7c0e3f
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,26 @@
+# OSIM - Open Security Issue Management
+
+This project uses unified AI assistant guidelines. Please refer to the comprehensive guidelines in:
+
+**[AI_GUIDELINES.md](./AI_GUIDELINES.md)**
+
+The AI_GUIDELINES.md file contains all the detailed information about:
+- Project overview and tech stack
+- Code style and standards
+- Vue.js specific guidelines
+- File organization patterns
+- API and data handling approaches
+- Testing guidelines
+- Development workflow
+- Security considerations
+- Common patterns and best practices
+- Available commands and tools
+- AI assistant preferences and specific notes
+
+Please follow all guidelines specified in that file when assisting with this project.
+
+# important-instruction-reminders
+Do what has been asked; nothing more, nothing less.
+NEVER create files unless they're absolutely necessary for achieving your goal.
+ALWAYS prefer editing an existing file to creating a new one.
+NEVER proactively create documentation files (*.md) or README files. Only create documentation files if explicitly requested by the User.
\ No newline at end of file

From 663b9fce224aff4de8e4aae0eb7d81a3584dfca0 Mon Sep 17 00:00:00 2001
From: C-Valen <charlie.valen@gmail.com>
Date: Thu, 16 Apr 2026 16:04:02 +0200
Subject: [PATCH 2/7] =?UTF-8?q?=F0=9F=94=A7=20slim=20down=20AI=20guideline?=
 =?UTF-8?q?s=20and=20remove=20wrong-format=20cursor=20rules=20file?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .cursor/rules    |  20 -----
 AI_GUIDELINES.md | 212 +++++++++++++----------------------------------
 CLAUDE.md        |  32 ++-----
 3 files changed, 68 insertions(+), 196 deletions(-)
 delete mode 100644 .cursor/rules

diff --git a/.cursor/rules b/.cursor/rules
deleted file mode 100644
index 1fd5dc457..000000000
--- a/.cursor/rules
+++ /dev/null
@@ -1,20 +0,0 @@
-# OSIM Project - Cursor AI Configuration
-
-This project uses unified AI assistant guidelines. Please refer to the comprehensive guidelines in:
-
-**[AI_GUIDELINES.md](./AI_GUIDELINES.md)**
-
-The AI_GUIDELINES.md file contains all the detailed information about:
-- Project overview and tech stack
-- Code style and standards
-- Vue.js specific guidelines
-- File organization patterns
-- API and data handling approaches
-- Testing guidelines
-- Development workflow
-- Security considerations
-- Common patterns and best practices
-- Available commands and tools
-- AI assistant preferences and specific notes
-
-Please follow all guidelines specified in that file when assisting with this project.
diff --git a/AI_GUIDELINES.md b/AI_GUIDELINES.md
index 1632e4093..4137cd311 100644
--- a/AI_GUIDELINES.md
+++ b/AI_GUIDELINES.md
@@ -1,153 +1,59 @@
-# OSIM Project - AI Assistant Guidelines
-
-## Project Overview
-This is OSIM (Open Security Issue Management), a Vue.js 3 + TypeScript incident response web application. The project uses modern development tools including Vite, Pinia for state management, Vue Router, and comprehensive testing with Vitest.
-
-## Tech Stack Context
-- **Frontend**: Vue 3 with Composition API, TypeScript, Vite
-- **State Management**: Pinia
-- **Routing**: Vue Router 4
-- **Styling**: Bootstrap 5, SCSS, PostCSS with Stylelint
-- **Testing**: Vitest (unit), Vue Test Utils, MSW for API mocking, Behave (E2E)
-- **Linting**: ESLint with extensive configuration and multiple plugins, Stylelint
-- **Build**: Vite with custom configuration for proxies and SSL
-- **Authentication**: JWT token-based authentication
-- **API Integration**: OpenAPI client generation for type-safe API calls
-- **Development Server**: HTTPS-enabled with hot reload and proxy support
-
-## Code Style & Standards
-- Follow the existing ESLint configuration (eslint.config.mjs) with comprehensive plugin setup
-- Use TypeScript strict mode enabled throughout the project
-- Prefer Composition API over Options API for Vue components
-- Use single quotes for strings, trailing commas
-- 2-space indentation, 120 character line limit
-- Import organization: builtin → external → internal → Vue-specific
-- Vue component structure: `<script>`, `<template>`, `<style>`
-- Comprehensive linting includes: TypeScript, Vue, imports, styling, unicorn, perfectionist
-- Source maps enabled for debugging support
-
-## Vue.js Specific Guidelines
-- Use `<script setup>` syntax for new components
-- Follow Vue 3 Composition API patterns
-- Use defineProps, defineEmits, defineModel macros appropriately
-- Prefer reactive() and ref() over Options API data
-- Use computed() for derived state
-- Implement proper TypeScript interfaces for props and emits
-- Follow the multi-word component naming convention (exceptions: Modal, Tabs, Toast, Login, Navbar, Settings)
-
-## File Organization
-- Components: `/src/components/` - Reusable UI components
-- Views: `/src/views/` - Page-level components
-- Widgets: `/src/widgets/` - Complex reusable components
-- Composables: `/src/composables/` - Reusable composition functions
-- Stores: `/src/stores/` - Pinia stores for state management
-- Services: `/src/services/` - API and external service integrations
-- Types: `/src/types/` - TypeScript type definitions
-- Utils: `/src/utils/` - Utility functions
-- Constants: `/src/constants/` - Application constants
-
-## API & Data Handling
-- Use the generated OpenAPI clients from `/src/generated-client/`
-- Mock APIs using MSW in `/src/mock-server/`
-- Handle authentication with JWT tokens
-- Use Pinia stores for complex state management
-- Implement proper error handling and loading states
-
-## Testing Guidelines
-- Write unit tests using Vitest and Vue Test Utils
-- Place test files adjacent to source files with `.spec.ts` extension
-- Use MSW for API mocking in tests
-- Test Vue components with proper setup and teardown
-- Follow the existing test patterns in `src/__tests__/`
-- E2E tests use Python/Behave - maintain feature files in `/features/`
-
-## Development Workflow
-- Use `yarn dev` for development with hot reload and tests
-- Use `yarn build` for production builds
-- Run `yarn lint` before committing (includes both ESLint and Stylelint)
-- Use `yarn type-check` for TypeScript validation
-- Use `yarn coverage` to generate test coverage reports
-- Use `yarn vibe-check` to analyze bundle size and dependencies
-- Docker containerization available with proper entrypoints
-- HTTPS enabled in development server for realistic testing
-- Source maps generated for debugging in both development and production
-
-## Security Considerations
-- This is a security-focused application for incident response
-- Be mindful of sensitive data handling
-- Follow secure coding practices
-- Validate and sanitize user inputs
-- Use proper authentication and authorization patterns
-
-## Common Patterns
-- Use Zod for runtime type validation
-- Implement proper loading and error states in components
-- Use Bootstrap classes for consistent styling
-- Follow the existing patterns for forms, modals, and data tables
-- Use Vue directives appropriately (custom directives in `/src/directives/`)
-
-## When Making Changes
-- Always check existing similar implementations first
-- Follow the established patterns and conventions
-- Update tests when modifying functionality
-- Consider accessibility (a11y) requirements
-- Test across different screen sizes (responsive design)
-- Validate TypeScript types and ESLint rules pass
-
-## Helpful Commands
-
-### Development
-- `yarn dev` - Start development server with hot reload and tests
-- `yarn dev-server` - Start development server only (without tests)
-
-### Build & Type Checking
-- `yarn build` - Build for production
-- `yarn type-check` - Run TypeScript type checking
-- `yarn preview` - Preview production build
-
-### Testing
-- `yarn test:unit` - Run unit tests with watch mode
-- `yarn test:unit:nowatch` - Run unit tests once
-- `yarn test:e2e` - Run end-to-end tests (Behave/Python)
-- `yarn coverage` - Run tests with coverage report
-
-### Linting & Formatting
-- `yarn lint` - Run all linting (ESLint + Stylelint)
-- `yarn lint-ts-vue` - Run ESLint on TypeScript and Vue files
-- `yarn lint-style` - Run Stylelint on CSS/SCSS/Vue files
-- `yarn lint-fix` - Auto-fix ESLint issues
-
-### Other
-- `yarn vibe-check` - Analyze bundle size with visualizer
-
-## AI Assistant Preferences
-- Prioritize type safety and use proper TypeScript types
-- Suggest Vue 3 Composition API patterns
-- Follow the existing code style and ESLint rules
-- Consider performance implications (Vue reactivity, bundle size)
-- Suggest proper error handling and user experience improvements
-- Reference existing patterns in the codebase when possible
-- Always consider the security context of this application
-
-## AI-Specific Notes
-
-### For Code Generation
-- Generate code that can be run immediately
-- Add all necessary import statements and dependencies
-- Follow the project's existing patterns and conventions
-- Ensure TypeScript types are properly defined
-- Include proper error handling and loading states
-
-### For Code Reviews
-- Check adherence to ESLint rules and TypeScript standards
-- Verify Vue 3 Composition API best practices
-- Ensure security considerations are addressed
-- Validate test coverage for new functionality
-- Check accessibility (a11y) compliance
-
-### For Refactoring
-- Maintain existing functionality while improving code quality
-- Update related tests when modifying code
-- Consider breaking changes and migration paths
-- Follow the established file organization patterns
-- Ensure backward compatibility where appropriate
+# OSIM — AI Assistant Guidelines
+
+OSIM is a Vue 3 + TypeScript security advisory management frontend for OSIDB.
+
+## Tech Stack
+
+- Vue 3 (Composition API, `<script setup>`), TypeScript strict mode
+- Pinia (state), Vue Router 4, Bootstrap 5
+- Vitest + Vue Test Utils (unit), Playwright (E2E in `osim-ui-tests`)
+- OpenAPI-generated client (`src/generated/`), Zod for runtime validation
+- ESLint + Stylelint, Vite
+
+## File Layout
+
+```
+src/
+  components/   # UI components (directory-based, co-located spec files)
+  composables/  # use*() hooks — reactive state + actions
+  services/     # API calls via generated client only
+  stores/       # Pinia stores
+  types/        # Zod schemas + inferred TS types (zod*.ts)
+  generated/    # OpenAPI client — never edit manually
+  widgets/      # Complex reusable components
+```
+
+## Core Conventions
+
+- `<script setup lang="ts">` — always
+- `defineProps<T>()` / `defineEmits<{}>()` — explicit types, no `PropType`
+- API calls only through generated OpenAPI client — no hand-rolled fetch
+- Zod schemas in `src/types/zod*.ts` for all API response types
+- `v-html` requires `sanitize-html` preprocessing — no exceptions
+- No `any` — use `unknown` + type narrowing
+
+## Development Commands
+
+```bash
+yarn dev             # dev server (HTTPS, hot reload)
+yarn lint            # ESLint + Stylelint
+yarn type-check      # TypeScript validation
+yarn test:unit       # Vitest unit tests
+yarn vibe-check      # lint + type-check + tests (pre-PR gate)
+yarn generate-openapi-client  # regenerate API client
+```
+
+## Security Notes
+
+This application handles security advisories and vulnerability data.
+- Sanitize all user-generated HTML before rendering
+- Validate user inputs before use
+- Never expose credentials, tokens, or internal hostnames in code
+- Auth is JWT-based; token handling is in `src/stores/`
+
+## AI Workflow Notes
+
+- Implement first — do not auto-run lint/tests after changes
+- Only run validation when explicitly asked
+- Search existing implementations before generating new ones
+- Follow established patterns in composables and services
diff --git a/CLAUDE.md b/CLAUDE.md
index 8ca7c0e3f..06b4e08cd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,26 +1,12 @@
-# OSIM - Open Security Issue Management
+# OSIM — Claude Guidelines
 
-This project uses unified AI assistant guidelines. Please refer to the comprehensive guidelines in:
+Refer to [AI_GUIDELINES.md](./AI_GUIDELINES.md) for full project context.
 
-**[AI_GUIDELINES.md](./AI_GUIDELINES.md)**
+## Key reminders
 
-The AI_GUIDELINES.md file contains all the detailed information about:
-- Project overview and tech stack
-- Code style and standards
-- Vue.js specific guidelines
-- File organization patterns
-- API and data handling approaches
-- Testing guidelines
-- Development workflow
-- Security considerations
-- Common patterns and best practices
-- Available commands and tools
-- AI assistant preferences and specific notes
-
-Please follow all guidelines specified in that file when assisting with this project.
-
-# important-instruction-reminders
-Do what has been asked; nothing more, nothing less.
-NEVER create files unless they're absolutely necessary for achieving your goal.
-ALWAYS prefer editing an existing file to creating a new one.
-NEVER proactively create documentation files (*.md) or README files. Only create documentation files if explicitly requested by the User.
\ No newline at end of file
+- Do what has been asked; nothing more, nothing less
+- Never create files unless strictly necessary — prefer editing existing ones
+- Never proactively create documentation unless explicitly requested
+- Implement first — do not auto-run lint, type-check, or tests after changes; wait until asked
+- Always use the generated OpenAPI client (`src/generated/`) for API calls
+- `v-html` requires `sanitize-html` — no exceptions

From bc59df4219600fa4f9affda6e9ca737e28cf7285 Mon Sep 17 00:00:00 2001
From: C-Valen <charlie.valen@gmail.com>
Date: Thu, 16 Apr 2026 16:07:47 +0200
Subject: [PATCH 3/7] =?UTF-8?q?=F0=9F=93=9D=20document=20local=20Cursor=20?=
 =?UTF-8?q?agents=20and=20rules=20in=20AI=20guidelines?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 AI_GUIDELINES.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/AI_GUIDELINES.md b/AI_GUIDELINES.md
index 4137cd311..0f9dcd4e4 100644
--- a/AI_GUIDELINES.md
+++ b/AI_GUIDELINES.md
@@ -57,3 +57,18 @@ This application handles security advisories and vulnerability data.
 - Only run validation when explicitly asked
 - Search existing implementations before generating new ones
 - Follow established patterns in composables and services
+
+## Local Cursor Config (`.cursor/`)
+
+A richer local-only Cursor config lives at `.cursor/` (excluded from git via `.git/info/exclude` — persists across all branches).
+
+**Rules** (auto-applied by file type):
+- `rules/vue-typescript.mdc` — Vue 3 composition, Zod, security patterns (`*.vue`, `*.ts`)
+- `rules/git-workflow.mdc` — gitmoji commits, branch naming (always)
+
+**Agents** (invoke by description or `@name`):
+- `code-reviewer` — structured Vue/TS diff review, no auto-validation
+- `feature-scaffolder` — generates component + composable + service + Zod type from description
+- `pr-description` — concise PR summary from `git diff main...HEAD`
+
+See `.cursor/README.md` for usage examples and the full SDLC workflow.

From 0f4f0f44b6e6aac788e97e1e7489cafbf987f622 Mon Sep 17 00:00:00 2001
From: C-Valen <charlie.valen@gmail.com>
Date: Thu, 16 Apr 2026 16:10:41 +0200
Subject: [PATCH 4/7] =?UTF-8?q?=E2=9C=A8=20add=20Cursor=20rules=20and=20ag?=
 =?UTF-8?q?ents=20for=20team=20agentic=20workflow?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .cursor/agents/code-reviewer.md      | 43 +++++++++++++++++++++++++
 .cursor/agents/feature-scaffolder.md | 48 ++++++++++++++++++++++++++++
 .cursor/agents/pr-description.md     | 35 ++++++++++++++++++++
 .cursor/rules/git-workflow.mdc       | 35 ++++++++++++++++++++
 .cursor/rules/vue-typescript.mdc     | 37 +++++++++++++++++++++
 5 files changed, 198 insertions(+)
 create mode 100644 .cursor/agents/code-reviewer.md
 create mode 100644 .cursor/agents/feature-scaffolder.md
 create mode 100644 .cursor/agents/pr-description.md
 create mode 100644 .cursor/rules/git-workflow.mdc
 create mode 100644 .cursor/rules/vue-typescript.mdc

diff --git a/.cursor/agents/code-reviewer.md b/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..0597b9ea6
--- /dev/null
+++ b/.cursor/agents/code-reviewer.md
@@ -0,0 +1,43 @@
+---
+name: code-reviewer
+description: Vue 3 / TypeScript code review specialist for osim. Proactively reviews code for quality, security, type safety, and osim conventions. Use after writing or modifying Vue components, composables, services, or TypeScript files.
+---
+
+You are a senior code reviewer for the osim frontend — a Vue 3 + TypeScript security advisory management tool.
+
+## When invoked
+
+1. Run `git diff HEAD` to see recent changes
+2. Focus review on modified `.vue`, `.ts` files
+3. **Do NOT run** `yarn type-check`, `yarn lint`, or tests — only run these when the user explicitly asks
+
+## Review checklist
+
+**TypeScript safety**
+- No `any`; proper use of `unknown` + type guards
+- Zod schemas used for API response validation (`ZodFlaw*` types)
+- Generated OpenAPI client used — no hand-rolled fetch calls
+
+**Vue 3 patterns**
+- `<script setup lang="ts">` with typed `defineProps`/`defineEmits`
+- Logic extracted into composables when reused across >1 component
+- No direct DOM manipulation — use template refs + Vue reactivity
+
+**Security**
+- `v-html` only with `sanitize-html`-processed content
+- User inputs validated before use
+- No secrets, tokens, or credentials in code
+
+**Code quality**
+- Functions are focused and <40 lines
+- Error states handled (not swallowed)
+- Loading states reflected in UI
+
+## Output format
+
+Organize feedback as:
+- 🔴 **Critical** — must fix before merge
+- 🟡 **Suggestion** — should address
+- 🟢 **Minor** — optional improvement
+
+Include specific file + line reference and a concrete fix for each 🔴 item.
diff --git a/.cursor/agents/feature-scaffolder.md b/.cursor/agents/feature-scaffolder.md
new file mode 100644
index 000000000..ecbfbb603
--- /dev/null
+++ b/.cursor/agents/feature-scaffolder.md
@@ -0,0 +1,48 @@
+---
+name: feature-scaffolder
+description: Scaffolds new osim features following existing patterns. Use when creating a new Vue component, composable, service, or full feature (component + composable + service + types). Reads existing similar files to match conventions before generating code.
+---
+
+You are a feature scaffolding specialist for the osim Vue 3 frontend.
+
+## When invoked
+
+1. Ask the user: what feature are they building? (component name, data model, API endpoint)
+2. Find 2-3 similar existing files for reference:
+   - Similar component in `src/components/`
+   - Related service in `src/services/`
+   - Related Zod type in `src/types/`
+3. Read those files to extract naming conventions, import patterns, and structure
+4. Generate the scaffolding following those exact patterns
+
+## Scaffold structure for a typical feature
+
+```
+src/
+  components/<FeatureName>/
+    <FeatureName>.vue          # main component (script setup)
+    <FeatureName>.spec.ts      # unit test skeleton
+  composables/
+    use<FeatureName>Model.ts   # reactive state + actions
+  services/
+    <FeatureName>Service.ts    # API calls via generated client
+  types/
+    zod<FeatureName>.ts        # Zod schema + inferred TS type
+```
+
+## Key conventions to match
+
+- Import paths use `@/` alias
+- Services use the generated OpenAPI client from `@/generated/`
+- Composables return `{ data, isLoading, error, actions }` pattern
+- Zod schemas live in `@/types/zod*.ts`
+- Component props are strictly typed with `defineProps<T>()`
+
+## Output
+
+Generate each file with full content. After scaffolding, tell the user:
+1. Which files were created
+2. Which existing files need to import/register the new component
+3. Wait for user confirmation before running any checks
+
+**Do NOT automatically run** `yarn type-check`, `yarn lint`, or tests. The user will explicitly ask when ready for post-implementation validation.
diff --git a/.cursor/agents/pr-description.md b/.cursor/agents/pr-description.md
new file mode 100644
index 000000000..e4f5a0259
--- /dev/null
+++ b/.cursor/agents/pr-description.md
@@ -0,0 +1,35 @@
+---
+name: pr-description
+description: Generates a concise pull request description for osim based on branch changes. Use when opening a PR, writing a PR description, or summarizing what a branch does. Analyzes git diff vs main to produce a minimal summary, changes list, and optional considerations.
+---
+
+You are a PR description writer for the osim frontend. Be extremely concise — no filler, no narration.
+
+## When invoked
+
+1. Run `git log main...HEAD --oneline` to see commits
+2. Run `git diff main...HEAD --stat` to see changed files
+3. Run `git diff main...HEAD` for content (skim — don't read everything)
+4. Produce the PR description
+
+## Output format
+
+```
+## Summary
+One sentence. What this PR does and why.
+
+## Changes
+- <file or area>: <what changed> (1 line max per item)
+- ...
+
+## Considerations
+- <only if there's something the reviewer must know: breaking change, migration step, env var, flag, risk>
+```
+
+## Rules
+
+- Summary: max 1 sentence, no "This PR..."
+- Changes: bullet per logical change, not per file. High-level. Max 6 bullets.
+- Considerations: omit section entirely if nothing noteworthy
+- No markdown headers beyond the 3 above
+- No emojis unless a gitmoji fits naturally in a bullet
diff --git a/.cursor/rules/git-workflow.mdc b/.cursor/rules/git-workflow.mdc
new file mode 100644
index 000000000..ae963b161
--- /dev/null
+++ b/.cursor/rules/git-workflow.mdc
@@ -0,0 +1,35 @@
+---
+description: Git commit and branch conventions for osim
+alwaysApply: true
+---
+
+# Git Workflow
+
+## Branch Naming
+`feature/`, `fix/`, `refactor/`, `docs/` + short kebab-case description
+e.g. `feature/flaw-comment-pagination`, `fix/cvss-score-display`
+
+## Commit Messages
+Format: `<gitmoji> <short imperative sentence>`
+
+| Type | Gitmoji |
+|------|---------|
+| New feature | ✨ |
+| Bug fix | 🐛 |
+| Refactor | ♻️ |
+| Tests | ✅ |
+| Docs | 📝 |
+| Chore/deps | 🔧 |
+| Security | 🔒 |
+| Performance | ⚡ |
+| Types | 🏷️ |
+
+Examples:
+- `✨ add pagination to flaw comment list`
+- `🐛 fix CVSS score not updating on NVD import`
+- `♻️ extract comment parsing into useFlawComments composable`
+
+## PR Standards
+- Group related commits; minimize count before push
+- Run `yarn vibe-check` before opening PR
+- Reference issue/ticket in PR description
diff --git a/.cursor/rules/vue-typescript.mdc b/.cursor/rules/vue-typescript.mdc
new file mode 100644
index 000000000..8a017308e
--- /dev/null
+++ b/.cursor/rules/vue-typescript.mdc
@@ -0,0 +1,37 @@
+---
+description: Vue 3 + TypeScript standards for osim frontend
+globs: **/*.vue,**/*.ts
+alwaysApply: false
+---
+
+# Vue 3 + TypeScript Standards
+
+## Components
+- Use `<script setup lang="ts">` with Composition API
+- Composition over inheritance; extract reusable logic into `use*` composables
+- Props via `defineProps<T>()` with explicit types — no `PropType` workarounds
+- Emit via `defineEmits<{ eventName: [payload: Type] }>()`
+
+## TypeScript
+- No `any`; prefer `unknown` + type narrowing
+- Validate API responses against Zod schemas (`ZodFlaw*` types in `@/types/zodFlaw`)
+- Use generated OpenAPI client from `@/generated/` — never hand-roll API calls
+- Run `yarn type-check` before committing
+
+## Services & State
+- API calls belong in `@/services/*Service.ts`, not in components
+- Global state in Pinia stores (`@/stores/`); local state with `ref`/`computed`
+- `osimRuntime` store for environment/backend config
+
+## Security
+- Sanitize HTML before rendering with `sanitize-html` (see `CommentList.vue`)
+- Never use `v-html` without sanitization — add `eslint-disable` comment only with sanitized input
+- Validate and encode all user-supplied URL parameters
+
+## Scripts (run only when user asks)
+- `yarn lint` — ESLint check
+- `yarn type-check` — TS type validation
+- `yarn test:unit` — Vitest unit tests
+- `yarn vibe-check` — combined lint + type-check + tests
+
+**Never auto-run these after implementation.** Wait for explicit user confirmation before triggering any validation pipeline.

From e13d7067326d542c4cac86553c1bccf698fec347 Mon Sep 17 00:00:00 2001
From: C-Valen <charlie.valen@gmail.com>
Date: Thu, 16 Apr 2026 16:14:59 +0200
Subject: [PATCH 5/7] =?UTF-8?q?=F0=9F=93=9D=20add=20cursor=20onboarding=20?=
 =?UTF-8?q?guide=20and=20usage=20README?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .cursor/ONBOARDING.md |  98 +++++++++++++++++++++++++++++++++++
 .cursor/README.md     | 117 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 215 insertions(+)
 create mode 100644 .cursor/ONBOARDING.md
 create mode 100644 .cursor/README.md

diff --git a/.cursor/ONBOARDING.md b/.cursor/ONBOARDING.md
new file mode 100644
index 000000000..b9da963c7
--- /dev/null
+++ b/.cursor/ONBOARDING.md
@@ -0,0 +1,98 @@
+# OSIM Onboarding Guide
+
+## 1. Understand the ecosystem
+- **OSIM** is the Vue 3 frontend (Incident Response Web UI) backed by **OSIDB** (the REST API).
+- Two repos to know: `osim` (frontend) and `osim-ui-tests` (Playwright E2E tests).
+- Read [`docs/overview.md`](../docs/overview.md) for architecture, directory layout, and core patterns.
+
+---
+
+## 2. Local setup
+- Install deps: `yarn`
+- Configure `public/runtime.json` pointing to local or staging OSIDB (see `docs/overview.md` → *Local Configuration*).
+- Auth modes: `kerberos` for stage/prod, `credentials` for local OSIDB instances.
+- Run dev server: `yarn dev`
+
+---
+
+## 3. Source structure
+
+| Dir | What lives there |
+|---|---|
+| `src/components/` | Reusable Vue components |
+| `src/views/` | Route-mounted pages (`*View.vue`) |
+| `src/composables/` | `use*` hooks for shared logic |
+| `src/services/` | API/data access (`*Service.ts`) |
+| `src/stores/` | Pinia cross-component state |
+| `src/types/` | Zod schemas + TypeScript types |
+| `src/generated-client/` | Auto-generated OSIDB API client |
+
+---
+
+## 4. Core coding conventions
+- Always use `<script setup lang="ts">` (Vue 3 Composition API).
+- All env vars are prefixed `OSIM_`.
+- API calls go through services, not directly in components.
+- Use Pinia only when state needs to be shared across siblings.
+- Schema validation uses **Zod** — `src/types/zodFlaw.ts` is the main reference.
+- Prefer nesting `<input>` inside `<label>` over `id`/`for` pairs.
+
+---
+
+## 5. Development workflow (feature end-to-end)
+
+```
+SCAFFOLD  → create component + composable + service + Zod type
+ITERATE   → edit freely
+REVIEW    → yarn vibe-check  (lint + type-check + unit tests)
+COMMIT    → gitmoji + short imperative message (e.g. ✨ add flaw priority filter)
+E2E TEST  → write spec in osim-ui-tests workspace
+```
+
+---
+
+## 6. Key commands
+
+```bash
+yarn dev                        # dev server
+yarn vibe-check                 # lint + type-check + tests (required before PR)
+yarn lint                       # ESLint only
+yarn type-check                 # TypeScript only
+yarn test:unit                  # Vitest unit tests
+yarn generate-openapi-client    # regenerate API client from openapi-osidb.yml
+```
+
+---
+
+## 7. Git workflow
+- Branch names: `feature/`, `fix/`, `refactor/`, `docs/` + short kebab-case description.
+- Commit format: `<gitmoji> <short imperative sentence>` (e.g. `🐛 fix owner field not saving`).
+- Consolidate commits before pushing. Run `yarn vibe-check` before opening a PR.
+
+---
+
+## 8. E2E tests (`osim-ui-tests`)
+- Specs live in `tests/`, page helpers in `pages/`.
+- Required env vars: `OSIDB_URL`, `OSIM_URL`, `LOGIN_USERNAME`, `LOGIN_PASSWORD`.
+- Run a single spec: `yarn playwright test tests/<file>.spec.ts --headed`
+- Record new interactions: `yarn playwright codegen $OSIM_URL`
+
+---
+
+## 9. OpenAPI client
+- API contract lives in `openapi-osidb.yml`.
+- After backend schema changes, regenerate with `yarn generate-openapi-client`.
+
+---
+
+## 10. PR checklist (from `CONTRIBUTING.md`)
+- [ ] Linting passed
+- [ ] Type checks passed
+- [ ] Test suite passed
+- [ ] Commits consolidated
+- [ ] Changelog updated
+- [ ] Test cases added/updated
+
+---
+
+> **First reading path:** `README.md` → `docs/overview.md` → `CONTRIBUTING.md` → pick a small `fix/` ticket to trace through the full workflow once.
diff --git a/.cursor/README.md b/.cursor/README.md
new file mode 100644
index 000000000..fe51d2cc6
--- /dev/null
+++ b/.cursor/README.md
@@ -0,0 +1,117 @@
+# Cursor Agentic Config — osim
+
+Local-only config (not tracked by git). Covers the full SDLC for the osim Vue 3 frontend.
+
+---
+
+## Rules (auto-applied by Cursor)
+
+| File | Applies to | Purpose |
+|------|-----------|---------|
+| `rules/vue-typescript.mdc` | `*.vue`, `*.ts` | Vue 3 composition API, Zod validation, security patterns |
+| `rules/git-workflow.mdc` | Always | Gitmoji commits, semantic branch naming |
+
+---
+
+## Agents (invoke with `@agent-name` or describe the task)
+
+### `code-reviewer` — Review code changes
+
+**When to use:** After you're satisfied with an implementation and want a structured review before running checks.
+
+**Example prompts:**
+```
+Review my changes to CommentList.vue and useFlawCommentFilter.ts
+```
+```
+@code-reviewer — what issues do you see in the flaw form changes?
+```
+
+**What it does:**
+- Runs `git diff HEAD` to see what changed
+- Checks TypeScript safety, Vue 3 patterns, security, code quality
+- Returns 🔴 Critical / 🟡 Suggestion / 🟢 Minor feedback with file+line references
+- Does NOT auto-run lint or tests
+
+---
+
+### `feature-scaffolder` — Generate new feature boilerplate
+
+**When to use:** Starting a new feature that needs component + composable + service + types.
+
+**Example prompts:**
+```
+Use feature-scaffolder to add a comment type filter. UI-only, no API changes needed.
+```
+```
+Scaffold a new CvssOverrideForm component similar to CvssCalculator.
+```
+
+**What it does:**
+1. Reads 2–3 similar existing files to match conventions
+2. Generates: `components/<Name>/<Name>.vue`, `composables/use<Name>Model.ts`, optionally service + Zod type
+3. Lists which existing files need updating to wire it in
+4. Stops — does NOT run type-check or tests
+
+---
+
+### `pr-description` — Generate a PR description from branch changes
+
+**When to use:** Before opening a PR.
+
+**Example prompts:**
+```
+Write the PR description for this branch.
+```
+```
+@pr-description
+```
+
+**Output:**
+```
+## Summary
+Add comment type filter to flaw comment list.
+
+## Changes
+- CommentList.vue: new filter UI with CommentType checkboxes
+- useFlawCommentFilter.ts: reactive filter composable
+
+## Considerations
+- Filter state is local — resets on navigation
+```
+
+---
+
+## Workflow: Implementing a feature end-to-end
+
+```
+1. SCAFFOLD    → "Use feature-scaffolder to build X"
+                 Agent generates files, stops.
+
+2. ITERATE     → Edit freely. No agent checks between iterations.
+
+3. REVIEW      → "Review my changes to <files>"  ← code-reviewer
+                 Fix any 🔴 items.
+
+4. VALIDATE    → "Run vibe-check"
+                 Agent runs: yarn vibe-check (lint + type-check + tests)
+
+5. COMMIT      → "Commit this"
+                 osim-commit skill generates: ✨ short imperative message
+
+6. E2E TESTS   → Switch to osim-ui-tests workspace
+                 "Write an E2E test for X"  ← e2e-test-writer agent there
+```
+
+---
+
+## Key SDLC commands (run manually or ask the agent explicitly)
+
+```bash
+yarn lint              # ESLint only
+yarn type-check        # TypeScript only
+yarn test:unit         # Vitest unit tests
+yarn vibe-check        # lint + type-check + tests (pre-PR gate)
+yarn dev               # local dev server
+yarn generate-openapi-client  # regenerate API client from openapi-osidb.yml
+```

From 474a63e238a1aed5339f9938ee43c67f6f4ca54d Mon Sep 17 00:00:00 2001
From: C-Valen <charlie.valen@gmail.com>
Date: Thu, 23 Apr 2026 15:49:52 +0200
Subject: [PATCH 6/7] =?UTF-8?q?=F0=9F=93=9D=20add=20release-manager=20agen?=
 =?UTF-8?q?t=20to=20cursor=20README?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Made-with: Cursor
---
 .cursor/README.md | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.cursor/README.md b/.cursor/README.md
index fe51d2cc6..754d5a994 100644
--- a/.cursor/README.md
+++ b/.cursor/README.md
@@ -82,6 +82,29 @@ Add comment type filter to flaw comment list.
 
 ---
 
+### `release-manager` — Prepare a release branch and PR
+
+**When to use:** When cutting a new versioned release from `main`.
+
+**Example prompts:**
+```
+Create a release for OSIDB-4935
+```
+```
+Prepare the release branch for ticket OSIDB-5012
+```
+
+**What it does:**
+1. Checks out `main` and pulls latest
+2. Derives the version (`YYYY.M.Z`) from the current date and existing tags/CHANGELOG
+3. Creates branch `release/OSIDB-{XXXX}-v{YYYY.M.Z}`
+4. Updates `CHANGELOG.md`: renames `[Unreleased]` header and fixes the links block
+5. Verifies no misplaced entries (commits since last tag vs CHANGELOG sections)
+6. Commits with `🔖 release v{YYYY.M.Z}`
+7. Pushes branch and opens a PR with label `Internal`, reviewers `osim-devs`, and the release changelog as description
+
+---
+
 ## Workflow: Implementing a feature end-to-end
 
 ```

From bfc168c8b33a21feb922f5670779ec2ab410ba18 Mon Sep 17 00:00:00 2001
From: C-Valen <charlie.valen@gmail.com>
Date: Thu, 23 Apr 2026 15:55:04 +0200
Subject: [PATCH 7/7] =?UTF-8?q?=F0=9F=93=9D=20add=20release-manager=20agen?=
 =?UTF-8?q?t=20file?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Made-with: Cursor
---
 .cursor/agents/release-manager.md | 91 +++++++++++++++++++++++++++++++
 1 file changed, 91 insertions(+)
 create mode 100644 .cursor/agents/release-manager.md

diff --git a/.cursor/agents/release-manager.md b/.cursor/agents/release-manager.md
new file mode 100644
index 000000000..e14183104
--- /dev/null
+++ b/.cursor/agents/release-manager.md
@@ -0,0 +1,91 @@
+---
+name: release-manager
+description: Automates the osim release branch creation process. Use when the user asks to create a release, cut a release, prepare a release branch, or start an osim release for a given OSIDB ticket number.
+---
+
+You are a release manager for the osim frontend. When asked to create a release, you receive an OSIDB ticket number and run the full release workflow automatically.
+
+## Inputs
+
+The user provides the OSIDB ticket number (e.g. `4935`). Derive everything else automatically.
+
+## Workflow
+
+### 1. Update main
+
+```bash
+cd /home/cavalenc/Dev/prodsec/osim
+git checkout main && git fetch origin && git pull origin main
+```
+
+### 2. Determine version
+
+- `YYYY` = current year, `M` = current month (no leading zero)
+- `Z` = counter: check existing tags for `v{YYYY}.{M}.*` and CHANGELOG headers; `Z` = highest existing + 1, starting at `0` if none
+
+```bash
+git tag --list "v{YYYY}.{M}.*" --sort=-version:refname | head -5
+```
+
+### 3. Create branch
+
+```bash
+git checkout -b release/OSIDB-{XXXX}-v{YYYY.M.Z}
+```
+
+### 4. Update CHANGELOG.md
+
+**4a.** Rename `## [Unreleased]` → `## [{YYYY.M.Z}]`
+
+**4b.** In the links block at the bottom, replace:
+```
+[Unreleased]: https://github.com/RedHatProductSecurity/osim/compare/v{PREV}...HEAD
+```
+With:
+```
+[Unreleased]: https://github.com/RedHatProductSecurity/osim/compare/v{YYYY.M.Z}...HEAD
+[{YYYY.M.Z}]: https://github.com/RedHatProductSecurity/osim/compare/v{PREV}...v{YYYY.M.Z}
+```
+
+### 5. Check for misplaced entries
+
+Run `git log v{PREV}..HEAD --oneline --no-merges` and cross-check each feature/fix commit against the CHANGELOG sections. If any entry is listed in a prior release but its code commit is after `v{PREV}`, move it to `## [{YYYY.M.Z}]`. Report any corrections made.
+
+### 6. Commit
+
+```bash
+git add CHANGELOG.md
+git commit -m "🔖 release v{YYYY.M.Z}"
+```
+
+### 7. Push and open PR
+
+```bash
+git push -u origin release/OSIDB-{XXXX}-v{YYYY.M.Z}
+```
+
+Extract the changelog body for `{YYYY.M.Z}` (all lines between its header and the next `## [`) and create the PR:
+
+```bash
+gh pr create \
+  --base main \
+  --title "release v{YYYY.M.Z}" \
+  --label "Internal" \
+  --reviewer "RedHatProductSecurity/osim-devs" \
+  --body "..."
+```
+
+PR body format:
+```
+## Release v{YYYY.M.Z}
+
+{changelog content}
+
+---
+Ticket: OSIDB-{XXXX}
+```
+
+## Notes
+
+- Show a summary at the end: branch name, version, PR URL, and any misplaced entries corrected.
+- Do NOT push or open PRs on the `main` branch directly.