diff --git a/skills/ns-advanced-memory-leak-hunter/SKILL.md b/skills/ns-advanced-memory-leak-hunter/SKILL.md index 8eefc42..d3216db 100644 --- a/skills/ns-advanced-memory-leak-hunter/SKILL.md +++ b/skills/ns-advanced-memory-leak-hunter/SKILL.md @@ -50,7 +50,7 @@ This skill reads N|Solid data through the N|Solid MCP server (`nsolid`) and bund node "/workspace-delta.cjs" ``` with `{"targetAppName": "", "runtimePath": "", "lineHint": , "contextLines": 40}`. It checks the workspace is that app, maps the runtime path to a workspace file (stripping `/app` and other deploy prefixes), and returns `workspaceCode`, `resolvedWorkspacePath` and `lineRange`. -3. **Then the running process.** Only when the helper says the workspace isn't the app, or the file isn't in it, call `get_source_code` with the `agentId`, `path`, `line`, `context: 80` and the `threadId`. It reads code out of a production process, and every read is in the tenant's audit log. It is offered only to people holding N|Solid's source-code permission (tenant admins by default) on a tenant where the source viewer is on. When the tool is missing or refuses, say which (no permission, or the feature is off for the tenant) and ask for the file or read it from the checkout instead. If the process runs in a container, try tweaking the path up to two times (strip `/app` or `/usr/src/app`, or a leading segment). If it still fails, ask the user to provide the source code. +3. **Then the running process.** Only when the helper says the workspace isn't the app, or the file isn't in it, call `get_source_code` with the `agentId`, `path`, `line`, `context: 80` and the `threadId`. It reads code out of a production process, and every read is in the tenant's audit log. It is offered only to people holding N|Solid's source-code permission (tenant admins by default) on a tenant where the source viewer is on. When the tool is missing or refuses, say which (no permission, or the feature is off for the tenant) and ask for the file or read it from the checkout instead. Pass the path exactly as the sample or snapshot gives it: the process looks the script up by the path it loaded it from, on that thread. If the call fails, ask the user to provide the source code. 4. **Human in the loop**: Present the problematic code and root cause to the user. Ask: *"I've isolated the cause of the memory leak in this function. Would you like me to propose a fix?"* 5. Only after user approval, propose an optimized rewrite and use the `ns-validate-optimization` skill to verify the fix. diff --git a/skills/ns-analyze-asset/SKILL.md b/skills/ns-analyze-asset/SKILL.md index 493162c..830638d 100644 --- a/skills/ns-analyze-asset/SKILL.md +++ b/skills/ns-analyze-asset/SKILL.md @@ -79,7 +79,7 @@ The summary gives objects and bytes by class and type. It has no retained sizes, node "/workspace-delta.cjs" ``` with `{"targetAppName": "", "runtimePath": "", "lineHint": , "contextLines": 40}`. It checks that the workspace is that app, maps the runtime path to a workspace file (stripping `/app` and other deploy prefixes), and returns `workspaceCode`, `resolvedWorkspacePath` and `lineRange`. If the path doesn't map, `get_agent` gives the process's main module as `info.main` (`/app/server.js` is `server.js` here): pass the workspace-relative path as `workspaceRelativePath`. -- **Then the running process.** Only when the helper says the workspace isn't the app, or the file isn't in it, offer `get_source_code` with the `agentId`, `path` (the frame's location without its `:line` suffix), `line` and `context: 80`. It reads code out of a production process, and every read is in the tenant's audit log. It is offered only to people holding N|Solid's source-code permission (tenant admins by default) on a tenant where the source viewer is on. When the tool is missing or refuses, say which (no permission, or the feature is off for the tenant) and ask for the file or read it from the checkout instead. If it fails on the path, retry up to 2 times: strip a leading `file://`, `/app` or `/usr/src/app`, or remove a leading path segment. +- **Then the running process.** Only when the helper says the workspace isn't the app, or the file isn't in it, offer `get_source_code` with the `agentId`, the asset's `threadId`, `path` (the frame's location without its `:line` suffix, exactly as the asset gives it), `line` and `context: 80`. It reads code out of a production process, and every read is in the tenant's audit log. It is offered only to people holding N|Solid's source-code permission (tenant admins by default) on a tenant where the source viewer is on. When the tool is missing or refuses, say which (no permission, or the feature is off for the tenant) and ask for the file or read it from the checkout instead. The process looks the script up by the path exactly as it loaded it, and by its thread, so don't tweak the path: if the call fails, say the code was unavailable. ### 7. Keep the User in the Loop - Present the key findings first. diff --git a/skills/ns-analyze-event/SKILL.md b/skills/ns-analyze-event/SKILL.md index 7ea6508..10ea5f1 100644 --- a/skills/ns-analyze-event/SKILL.md +++ b/skills/ns-analyze-event/SKILL.md @@ -39,7 +39,7 @@ This skill reads N|Solid data through the N|Solid MCP server (`nsolid`). The N|S node "/workspace-delta.cjs" ``` with `{"targetAppName": "", "runtimePath": "", "lineHint": , "contextLines": 40}`. It checks the workspace is that app and maps container paths such as `/app/server.js` to workspace files. `event_stacks` gives the latest process's main module (`latest.main`), which shows where the app was deployed. - - Only when the workspace isn't the app and the process still runs, call `get_source_code` with the `agentId`, `path` and `line`; a plain stack trace alone is not enough to fetch code. It is offered only with N|Solid's source-code permission, an admin one, on a tenant where the source viewer is on, and never over a browser sign-in to the MCP server (a sign-in carries read and operate permissions at most). When the tool is missing or refuses, say which (a sign-in, no permission, or the feature is off for the tenant) and ask for the file or read it from the checkout instead. + - Only when the workspace isn't the app and the process still runs, call `get_source_code` with the stack's process (`latest.agentId` from `event_stacks`, or the event's `agentId`), its `threadId` (`latest.threadId` when the stack ran on a worker thread, or the event's), and the frame's `path`, exactly as the stack gives it, and `line`; a plain stack trace alone is not enough to fetch code. It is offered only with N|Solid's source-code permission, an admin one, on a tenant where the source viewer is on, and never over a browser sign-in to the MCP server (a sign-in carries read and operate permissions at most). When the tool is missing or refuses, say which (a sign-in, no permission, or the feature is off for the tenant) and ask for the file or read it from the checkout instead. ### 3. Recommend the Right Next Step - If the issue needs deeper work, point to the most relevant follow-up skill: `ns-cpu-spike-analysis`, `ns-memory-spike-analysis`, `ns-analyze-vulnerabilities`, or `ns-analyze-tracing`. diff --git a/skills/ns-cpu-spike-analysis/SKILL.md b/skills/ns-cpu-spike-analysis/SKILL.md index ec4126f..04e23b1 100644 --- a/skills/ns-cpu-spike-analysis/SKILL.md +++ b/skills/ns-cpu-spike-analysis/SKILL.md @@ -80,10 +80,7 @@ when the token can use several tenants). - If the path doesn't map, the process's main module shows where the app was deployed: `get_agent` gives it as `info.main` (`/app/server.js` is `server.js` here). Pass the workspace-relative path as `workspaceRelativePath`. - Without shell access, do the same by hand: confirm the workspace is the app (`package.json` `name` or `nsolid.app`, or `NSOLID_APP` in its compose or env files), find the file, and read the lines around the frame. - The workspace may not be exactly what runs (another commit or build). Say so in the report when the running version isn't known to match. -- **Then the running process.** Only when the helper says the workspace isn't the app, or the file isn't in it, call `get_source_code` with the `agentId`, `path` (the frame's location without its `:line` suffix), `line` (its line) and `context: 80`. It reads the code out of the production process, and every read is in the tenant's audit log. It is offered only to people holding N|Solid's source-code permission (tenant admins by default) on a tenant where the source viewer is on. When the tool is missing or refuses, say which (no permission, or the feature is off for the tenant) and ask for the file or read it from the checkout instead. If it fails on the path, retry up to 2 times with path tweaks: - - Try stripping a leading `file://`, `/app` or `/usr/src/app` prefix. - - Try removing a leading path segment one level at a time. - - If still failing after 2 tweaks, continue without the code and say it was unavailable. +- **Then the running process.** Only when the helper says the workspace isn't the app, or the file isn't in it, call `get_source_code` with the `agentId`, the `threadId` the profile was taken on, `path` (the frame's location without its `:line` suffix, exactly as the profile gives it), `line` (its line) and `context: 80`. It reads the code out of the production process, and every read is in the tenant's audit log. It is offered only to people holding N|Solid's source-code permission (tenant admins by default) on a tenant where the source viewer is on. When the tool is missing or refuses, say which (no permission, or the feature is off for the tenant) and ask for the file or read it from the checkout instead. The process looks the script up by the path exactly as it loaded it, and by its thread, so don't tweak the path: if the call fails, continue without the code and say it was unavailable. - Before presenting it in the report, keep only the most relevant parts needed to explain the CPU problem and to ground the optimization proposal: the hot function and any nearby helpers, branches, loops, constants, or call sites that materially affect the bottleneck. ### 10. Compare Runtime Code to Workspace Source