Ingegneria dei Prompt AI: Comandi e Tecniche Essenziali per Sviluppatori

L'ingegneria dei prompt è diventata una delle competenze più critiche per gli sviluppatori che utilizzano strumenti AI. La qualità del tuo prompt determina direttamente la qualità dell'output dell'AI. Un prompt ben progettato può trasformare risposte vaghe e inutili in codice preciso e pronto per la produzione.

Cos'è l'Ingegneria dei Prompt?

L'ingegneria dei prompt è l'arte e la scienza di creare istruzioni efficaci per i modelli linguistici AI. Al suo nucleo, si tratta di comunicazione—imparare a esprimersi nel modo che i modelli AI comprendono meglio.

Piccole variazioni nei prompt producono enormi differenze. Confronta "correggi il bug" con "correggi l'eccezione di riferimento nullo nel metodo UserService.authenticate quando il parametro email è undefined. Il metodo si trova in src/services/UserService.ts e usa bcrypt per il confronto delle password."

Prompt zero-shot: istruzione diretta senza esempi. Funziona per compiti semplici e ben definiti dove il formato di output è ovvio.

Tecniche di Prompt di Base

Prompt few-shot: fornisci uno o più esempi del pattern input-output desiderato prima del compito effettivo. Dimostra esattamente cosa vuoi, riducendo l'ambiguità. Due o tre esempi sono sufficienti.

Prompt Zero-Shot

Prompt a catena di pensiero: chiedi all'AI di ragionare passo dopo passo. Migliora l'accuratezza del 30-50% sui compiti di ragionamento. Essenziale per debugging e decisioni architetturali.

Write a Python function that validates an email address using regex.
The function should return True for valid emails and False for invalid ones.

Prompt con assegnazione di ruolo: assegna all'AI una persona o un livello di competenza specifico. "Agisci come uno sviluppatore Python specializzato in pipeline di dati ad alte prestazioni" è molto più efficace di "Agisci come uno sviluppatore Python".

Prompt Few-Shot

I prompt di sistema impostano istruzioni persistenti (stack tecnologico, convenzioni di codifica). I prompt utente sono per compiti specifici. In Claude Code, CLAUDE.md funge da prompt di sistema.

Convert these database column names to camelCase JavaScript variable names:

user_first_name -> userFirstName
created_at_timestamp -> createdAtTimestamp
is_email_verified -> isEmailVerified
total_order_count ->

Now convert: product_category_id

"Act as..." attiva la conoscenza specifica del dominio. Più il ruolo è specifico, migliore è l'output.

Prompt a Catena di Pensiero

"Step by step" innesca l'AI a scomporre il processo di ragionamento. Efficace per debugging, progettazione di algoritmi e decisioni architetturali.

Analyze this React component for performance issues. Think step by step:

1. First, identify all state variables and their update patterns
2. Then, check for unnecessary re-renders
3. Next, look for missing memoization opportunities
4. Finally, suggest specific optimizations with code examples

Here's the component:
[component code]

"Think aloud" chiede all'AI di narrare il suo ragionamento, incluse le alternative considerate e le scelte fatte.

Prompt con Assegnazione di Ruolo

"Explain like I'm 5" rimuove il gergo tecnico e fornisce spiegazioni intuitive basate su analogie.

Act as a senior security engineer with 15 years of experience in web application security. Review this authentication implementation and identify any vulnerabilities, ranking them by severity. For each vulnerability, explain the attack vector and provide a secure code fix.

"Review and critique" fa assumere all'AI una prospettiva critica, producendo analisi approfondite con potenziali bug, problemi di sicurezza e violazioni di stile.

Prompt di Sistema vs Prompt Utente

"Write tests for" con specifica del framework e delle aspettative di copertura genera suite di test complete.

"Refactor using..." con un pattern di design nominato produce refactoring focalizzati e coerenti.

# System prompt example
You are a TypeScript expert working on a Next.js 14 project using:
- App Router (not Pages Router)
- Server Components by default
- Prisma for database access
- Tailwind CSS for styling
- Zod for validation

Always use strict TypeScript. Prefer server actions over API routes.
Never use 'any' type. Use 'unknown' and narrow with type guards.

# User prompt example
Add a user profile page that shows the current user's name, email,
avatar, and last 10 activity records. Include loading states and
error handling.

Comandi AI Essenziali per Sviluppatori

"Find bugs in" attiva la modalità analitica dell'AI per cercare problemi invece di generare codice.

"Act as..." / "You are a..."

"Add error handling" affronta la lacuna comune del percorso felice, chiedendo all'AI di considerare modalità di fallimento e strategie di recupero.

You are a senior backend engineer at a fintech company who specializes
in building secure, high-throughput payment processing systems.
You have deep expertise in PostgreSQL, Redis, and distributed systems.
You always consider edge cases, race conditions, and failure modes.

Design a payment processing API that handles:
- Credit card payments via Stripe
- Bank transfers via Plaid
- Retry logic with exponential backoff
- Idempotency keys to prevent duplicate charges

"Step by step"

Prompt per implementazione di funzionalità: descrivi la funzionalità, specifica lo stack tecnologico, definisci i criteri di accettazione e menziona i vincoli.

Debug this SQL query that's causing a timeout. Think step by step:

1. First, analyze the query structure and joins
2. Identify potential performance bottlenecks
3. Check for missing indexes
4. Suggest an optimized version with EXPLAIN analysis

SELECT u.name, COUNT(o.id), SUM(o.amount)
FROM users u
LEFT JOIN orders o ON u.id = o.user_id
LEFT JOIN order_items oi ON o.id = oi.order_id
WHERE o.created_at > '2026-01-01'
GROUP BY u.name
HAVING COUNT(o.id) > 10
ORDER BY SUM(o.amount) DESC;

"Think aloud"

Prompt per progettazione API: specifica stile architetturale, metodo di autenticazione, strategia di versionamento e formato di risposta.

I need to choose between WebSocket and Server-Sent Events for a
real-time notification system. Think aloud about the trade-offs,
considering: browser support, bidirectional communication needs,
server resource usage, and scalability. Then recommend one with
justification.

"Explain like I'm 5"

Prompt per schema di database: specifica ORM, convenzioni di denominazione, strategia di indicizzazione e relazioni.

Explain like I'm 5: What is a monad in functional programming,
and why do Haskell developers keep talking about them?
Use a real-world analogy, not code.

"Review and critique"

Prompt per componenti UI: specifica framework, approccio di styling, requisiti di accessibilità e stati di interazione.

Review and critique this Express.js middleware. Focus on:
- Security vulnerabilities
- Error handling gaps
- Performance concerns
- Best practice violations
- Suggest improvements with code examples

[paste your middleware code]

"Write tests for"

Prompt DevOps: specifica ambiente di destinazione, requisiti di sicurezza e standard organizzativi.

Write tests for the UserService.register method using Jest.
Cover these scenarios:
- Happy path with valid input
- Duplicate email registration
- Invalid email format
- Password too short
- Missing required fields
- Database connection failure
- Concurrent registration attempts

Use describe/it blocks. Include setup and teardown.
Mock the database layer.

"Refactor using..."

La concatenazione di prompt scompone compiti complessi in una serie di prompt più piccoli e focalizzati. Ogni passaggio si basa sull'output del precedente.

Refactor this notification system using the Strategy pattern.
Currently, all notification types (email, SMS, push) are handled
in a single class with if-else chains. Create separate strategy
classes for each notification type, a context class that delegates
to the active strategy, and a factory for creating strategies.

[paste your current code]

"Find bugs in"

Il popolamento del contesto fornisce all'AI tutto il codice, la documentazione e il contesto rilevanti prima della domanda. Più contesto = più accuratezza.

Find bugs in this async Node.js function. It's supposed to process
a batch of orders and update their status, but sometimes orders
get processed twice and the status updates are inconsistent under
high load.

[paste your function code]

"Add error handling"

La specifica dei vincoli definisce ciò che l'AI non dovrebbe fare: versioni tecnologiche, requisiti di prestazioni, regole di sicurezza, standard di codifica.

Add error handling to this file upload function. Consider:
- File size limits
- Invalid file types
- Network interruptions during upload
- Disk space errors
- Concurrent upload conflicts
- Partial upload cleanup

Use try-catch with specific error types. Add retry logic for
transient failures. Return meaningful error messages to the client.

Pattern di Prompt per la Generazione di Codice

Il controllo del formato di output garantisce che la risposta sia immediatamente utilizzabile (JSON, markdown, struttura di file specifica).

Prompt per Implementazione di Funzionalità

Il perfezionamento iterativo migliora progressivamente l'output attraverso prompt successivi. La prima risposta fornisce un punto di partenza da raffinare.

Implement a user avatar upload feature for a Next.js 14 application.

Tech stack: Next.js App Router, TypeScript, Prisma, PostgreSQL, AWS S3

Requirements:
- Accept JPEG, PNG, WebP (max 5MB)
- Resize to 200x200 and 400x400 thumbnails using Sharp
- Upload originals to S3 with unique keys
- Store S3 URLs in the User model
- Delete old avatar when uploading a new one
- Return presigned URLs for frontend display

Acceptance criteria:
- Invalid file types return 400 with error message
- Files over 5MB return 413
- Successful upload returns 200 with avatar URLs
- Old avatars are cleaned up from S3

Create: API route, service layer, Prisma schema update, and types.

Prompt per Progettazione API

ChatGPT/GPT-4: eccelle nell'interazione conversazionale. Usa istruzioni personalizzate, Code Interpreter per analisi dati, formattazione markdown.

Design a RESTful API for a project management application.

Architecture: Express.js with TypeScript, following clean architecture
Auth: JWT with refresh token rotation
Versioning: URL-based (/api/v1/)
Response format: { success: boolean, data?: T, error?: { code, message } }

Endpoints needed:
- Projects CRUD with team membership
- Tasks CRUD with assignee, priority, status
- Comments on tasks with mentions
- Activity feed (recent actions across projects)

Include:
- Request/response TypeScript interfaces
- Zod validation schemas
- Error handling middleware
- Pagination for list endpoints (cursor-based)

Prompt per Schema di Database

Claude/Claude Code: forte nel comprendere grandi codebase e seguire istruzioni complesse. Usa CLAUDE.md, specifica posizioni dei file, lascia eseguire comandi.

Design a Prisma schema for an e-commerce platform with these entities:

- Users (authentication, profile, addresses)
- Products (variants, categories, inventory)
- Orders (line items, status history, payments)
- Reviews (ratings, images, helpful votes)
- Cart (items, applied coupons)

Requirements:
- Use PostgreSQL with UUID primary keys
- Soft deletes with deletedAt timestamps
- Proper indexes for common query patterns
- Enums for order status, payment status
- Decimal fields for prices (not float)
- Full-text search on product name and description
- Include a migration file

Prompt per Componenti UI

GitHub Copilot: completamenti inline nell'IDE. Scrivi commenti descrittivi, usa tipi TypeScript, fornisci esempi nei commenti.

Create a reusable DataTable component in React with TypeScript.

Styling: Tailwind CSS + shadcn/ui conventions
Features:
- Column definitions with sort, filter, and custom renderers
- Server-side pagination with page size selector
- Row selection (single and multi) with checkboxes
- Loading skeleton state
- Empty state with custom message
- Responsive: card layout on mobile, table on desktop

Accessibility:
- Keyboard navigation (arrow keys, Enter, Escape)
- Screen reader announcements for sort and filter changes
- ARIA labels on all interactive elements

Props interface:
- data, columns, isLoading, pagination, onSort, onFilter, onSelect

Include a usage example with a user list table.

Prompt per Configurazione e DevOps

Cursor: integrazione IDE profonda. Usa riferimenti @file, @codebase, @docs, Cmd+K per modifiche inline, .cursorrules.

Create a Docker Compose setup for a development environment with:
- Next.js app (hot reload enabled)
- PostgreSQL 16 with persistent volume
- Redis for session storage
- MinIO (S3-compatible) for local file storage

Requirements:
- All services on a shared network
- Environment variables from .env file
- Health checks for all services
- Volumes for node_modules (avoid bind mount issues)
- PostgreSQL initialized with seed data
- Non-root containers where possible

Also create:
- Dockerfile for the Next.js app (multi-stage build)
- .env.example with all required variables
- Makefile with common commands (up, down, logs, reset-db)

Strategie Avanzate di Prompt

Codex CLI: agente basato su terminale. Fornisci obiettivi chiari, specifica la directory di lavoro, usa prima la modalità proposta.

Concatenazione di Prompt

Errori comuni: istruzioni vaghe, mancanza di contesto, sovraccarico del prompt (troppi compiti), formato di output non specificato, non iterare.

# Step 1: Design the architecture
"Design the architecture for a real-time chat application.
List the components, their responsibilities, and how they
communicate. Use a diagram-like text format."

# Step 2: Define the data model
"Based on the architecture above, design the database schema
for the chat application. Include users, conversations,
messages, and read receipts. Use Prisma schema format."

# Step 3: Implement the API
"Implement the REST API for the chat application based on
the architecture and schema we designed. Start with the
message endpoints: send, list, delete."

# Step 4: Add WebSocket support
"Now add WebSocket support for real-time message delivery.
Use Socket.io. Integrate with the existing message API."

# Step 5: Write tests
"Write integration tests for the chat API and WebSocket
events using Jest and Supertest."

L'ingegneria dei prompt è la pratica di creare istruzioni efficaci per i modelli AI. Per gli sviluppatori, è importante perché la qualità della generazione di codice dipende direttamente da quanto bene comunichi le tue intenzioni.

Popolamento del Contesto

Tecniche più importanti: zero-shot, few-shot, catena di pensiero, assegnazione di ruolo e prompt di sistema. Combina con comandi come "passo dopo passo", "pensa ad alta voce" e "rivedi e critica".

 {
    await this.db.query('UPDATE users SET email = $1 WHERE id = $2', [email, id]);
    await this.cache.del(`user:${id}`);
  }
}
```

Here is the User type:
```typescript
interface User {
  id: string;
  email: string;
  name: string;
  role: 'admin' | 'user';
  createdAt: Date;
}
```

Now, add an updateProfile method that allows updating name and email,
with validation that the email is not already taken by another user.

Sii specifico sullo stack tecnologico, fornisci contesto di codice, specifica il formato di output, scomponi compiti complessi, usa l'assegnazione di ruolo, includi vincoli e itera.

Specifica dei Vincoli

Dipende dal caso d'uso: ChatGPT per debugging conversazionale, Claude Code per compiti multi-file, Copilot per completamenti inline, Cursor per integrazione IDE profonda.

Build a URL shortener API with these constraints:

MUST:
- Use Node.js 20+ with native fetch (no axios)
- Use PostgreSQL via pg driver (no ORM)
- Generate short codes of exactly 7 characters
- Support custom aliases (max 20 chars)
- Return 301 for existing short URLs
- Rate limit to 100 creates per hour per IP

MUST NOT:
- Use any ORM or query builder
- Store full URLs without normalization
- Allow short codes that conflict with existing routes
- Return database errors to the client

PERFORMANCE:
- Handle 10,000 requests per second
- Cache hot URLs in Redis with 5-minute TTL
- P99 latency under 50ms for redirects

Controllo del Formato di Output

Errori: istruzioni vaghe, mancanza di contesto, troppi compiti in un prompt, formato di output non specificato, accettare la prima risposta senza iterare.

Analyze this codebase and provide the output in this exact format:

## Architecture Overview
[2-3 paragraph summary]

## Component Diagram
```mermaid
graph TD
    [components and relationships]
```

## API Endpoints
| Method | Path | Description | Auth |
|--------|------|-------------|------|

## Database Tables
| Table | Columns | Indexes | Relations |
|-------|---------|---------|-----------|

## Recommendations
1. [Priority] [Description] - [Estimated effort]
2. ...

## Technical Debt
- [ ] [Description] - [Impact: High/Medium/Low]

Perfezionamento Iterativo

No, l'ingegneria dei prompt complementa le competenze di programmazione ma non può sostituirle. Hai bisogno di comprendere concetti di programmazione per scrivere prompt efficaci e valutare l'output.

# Iteration 1: Get a starting point
"Write a rate limiter middleware for Express.js"

# Iteration 2: Add specificity
"Good start. Now modify it to use Redis for distributed
rate limiting across multiple server instances. Use sliding
window instead of fixed window."

# Iteration 3: Add edge cases
"Add handling for: Redis connection failures (fall back to
in-memory), custom rate limits per route, burst allowance
for legitimate traffic spikes, and proper headers
(X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset)."

# Iteration 4: Add tests
"Write comprehensive tests for all the scenarios we've
covered, including Redis failures and burst handling."

Rivedi sempre il codice generato, esegui test, chiedi all'AI di spiegare il suo ragionamento, fornisci riferimenti a versioni specifiche, verifica le API rispetto alla documentazione ufficiale.

Suggerimenti Specifici per Strumento

While the techniques above work across all AI tools, each platform has unique strengths and quirks. Adapting your prompting style to each tool's characteristics can significantly improve your results.

ChatGPT / GPT-4

ChatGPT and GPT-4 excel at conversational interactions and benefit from structured, well-organized prompts. They handle long context well and are particularly good at explaining concepts and generating documentation.

• ChatGPT: usa istruzioni personalizzate, sfrutta Code Interpreter, usa formattazione markdown, specifica la lunghezza della risposta.
• Claude: usa CLAUDE.md, specifica posizioni dei file, lascia eseguire comandi, usa /compact nelle sessioni lunghe.
• Copilot: scrivi commenti descrittivi, usa tipi TypeScript, fornisci esempi nei commenti, usa Copilot Chat per compiti complessi.
• Cursor: usa @file, @codebase, @docs, Cmd+K per modifiche inline, imposta .cursorrules.
• Codex CLI: fornisci obiettivi chiari, specifica la directory di lavoro, usa modalità proposta, itera sull'output.

# Effective GPT-4 prompt structure
**Role:** Senior TypeScript developer
**Task:** Implement a JWT authentication middleware
**Context:** Express.js API, PostgreSQL, existing User model
**Constraints:** No external auth libraries, use crypto module
**Output:** Complete, production-ready code with types
**Format:** Single file with inline comments for complex logic

Claude / Claude Code

Claude and Claude Code are particularly strong at understanding large codebases, following complex instructions, and producing well-structured output. Claude Code's agentic capabilities make it ideal for multi-step tasks.

• Use CLAUDE.md: This is the single most impactful thing you can do. Put your project context, conventions, and preferences in CLAUDE.md.
• Be explicit about file locations: Claude Code works best when you specify which files to read and modify.
• Let it run commands: Claude Code can execute tests and build commands. Ask it to verify its work by running tests.
• Use /compact for long sessions: When the context gets long, use /compact to compress the conversation while keeping the most important information.
• Leverage XML tags: Claude responds well to XML-tagged sections in prompts for clear delineation of different parts of your request.

# Effective Claude Code prompt
Read the following files to understand the current architecture:
- src/routes/userRoutes.ts
- src/middleware/authMiddleware.ts
- src/models/User.ts

Then refactor the authentication flow to support:
1. JWT access tokens (15 min expiry) + refresh tokens (7 day expiry)
2. Token rotation on refresh (invalidate old refresh token)
3. Rate limiting on the refresh endpoint (5 per minute per user)

Update all related files and run the test suite when done.

GitHub Copilot

GitHub Copilot operates differently from chat-based tools — it provides inline suggestions as you type. Effective Copilot usage relies on writing code that clearly signals your intent through comments, type signatures, and surrounding context.

• Write descriptive comments:// Validate email format and check for duplicates before a function gives Copilot clear intent.
• Use TypeScript types: Well-defined types and interfaces guide Copilot toward correct implementations.
• Provide examples in comments: Showing expected input/output in comments helps Copilot match your desired format.
• Accept partial suggestions: Sometimes Copilot gets the structure right but the details wrong. Accept the suggestion and edit the details.
• Use Copilot Chat for complex tasks: For multi-file changes or architecture decisions, use Copilot Chat instead of inline suggestions.

> {
  // Copilot will generate the implementation based on these types

Cursor

Cursor combines IDE integration with AI chat capabilities, offering both inline completions and a chat interface that understands your codebase. Its strength lies in deep project awareness and the ability to reference specific files and symbols.

• Use @file references:@filename to give Cursor precise context.
• Use @codebase for broad context:@codebase.
• Use @docs for library documentation:@docs.
• Leverage Cmd+K for inline edits: Select code and use Cmd+K to describe changes in natural language.
• Set project rules:.cursorrules file (similar to CLAUDE.md) for persistent project instructions.

# Effective Cursor prompt
@src/services/paymentService.ts @src/types/payment.ts

Refactor the processPayment function to use the Strategy pattern.
Create separate strategy classes for each payment provider
(Stripe, PayPal, BankTransfer). The function should accept a
payment method and delegate to the appropriate strategy.

Keep the same public API so existing callers don't break.

Codex CLI

Codex CLI is OpenAI's terminal-based coding agent, similar in concept to Claude Code. It excels at executing multi-step development tasks from the command line.

• Provide a clear goal: Codex CLI works best with a clear, high-level objective rather than step-by-step instructions.
• Specify the working directory: Make sure you run Codex CLI from the correct project root.
• Use proposal mode first: Before letting Codex make changes, use proposal mode to review its plan.
• Set sandbox permissions carefully: Control what Codex can execute by configuring sandbox permissions.
• Iterate on the output: Like other tools, the first attempt may need refinement through follow-up prompts.

Errori Comuni da Evitare

Even experienced developers make these common prompting mistakes. Recognizing and avoiding them will immediately improve your AI interactions.

Istruzioni Vaghe

The most common mistake is providing vague, underspecified instructions. Prompts like "fix this," "make it better," or "add a feature" give the AI almost nothing to work with. The AI will make assumptions, and those assumptions often won't match your intent.

# Bad
"Fix the login bug"

# Good
"Fix the bug where users with uppercase emails cannot log in.
The issue is in src/auth/login.ts - the email comparison is
case-sensitive but emails are stored in lowercase in the database.
The fix should normalize the email to lowercase before comparison."

Mancanza di Contesto

AI models don't know your project unless you tell them. Failing to provide relevant context — your tech stack, framework version, existing code patterns, or project structure — forces the AI to guess, often incorrectly. Always include the context that a new team member would need to understand your request.

# Bad
"Write a function to send emails"

# Good
"Write an email sending function for our NestJS application.
We use:
- @nestjs/mailer with Handlebars templates
- SMTP via AWS SES
- Templates stored in src/templates/emails/
- Existing MailService class in src/mail/mail.service.ts

The function should accept a template name, recipient, and
template variables. Include error handling for SES throttling
and bounce notifications."

Sovraccarico del Prompt

Trying to accomplish too many unrelated tasks in a single prompt leads to mediocre results across the board. The AI's attention is divided, and it may skip important details for some tasks while over-indexing on others. Break complex requests into focused, sequential prompts.

# Bad - Too many tasks in one prompt
"Build a complete user management system with authentication,
profile management, email verification, password reset,
role-based access control, and an admin dashboard"

# Good - Break it into focused prompts
Prompt 1: "Design the database schema for a user management system..."
Prompt 2: "Implement the authentication endpoints..."
Prompt 3: "Add email verification flow..."
Prompt 4: "Implement role-based access control middleware..."

Ignorare il Formato di Output

When you need output in a specific format — JSON, markdown, a particular file structure — failing to specify this leads to unpredictable formatting. The AI might return prose when you need JSON, or a single file when you need multiple files. Always specify the desired output format explicitly.

# Bad
"List all the API endpoints"

# Good
"List all API endpoints in a markdown table with these columns:
| Method | Path | Description | Auth Required | Request Body | Response |"

Non Iterare

Accepting the AI's first response without refinement is a missed opportunity. The first response provides a foundation that you can improve through follow-up prompts. Iteration is where the real power of AI-assisted development emerges — each cycle produces better, more refined output.

# Instead of accepting the first response, iterate:
"Good start. Now add input validation using Zod schemas."
"Now add proper error handling with custom error classes."
"Now add logging for all operations."
"Now write tests for all the edge cases we've discussed."

Libreria di Template di Prompt

Here are ready-to-use prompt templates for common developer tasks. Copy these templates, fill in the placeholders, and adapt them to your specific needs. Each template combines multiple prompting techniques for maximum effectiveness.

Template 1: Implementazione di Funzionalità

You are a senior {language} developer specializing in {framework}.

Implement {feature_description} for our {project_type} application.

Tech stack:
- {language} {version} with {framework} {version}
- {database} for data storage
- {orm} for database access
- {testing_framework} for tests

Requirements:
- {requirement_1}
- {requirement_2}
- {requirement_3}

Constraints:
- Must follow existing patterns in the codebase
- Must include input validation
- Must handle errors gracefully
- Must be backward compatible

Output:
1. Implementation code with inline comments for complex logic
2. Unit tests covering happy path and edge cases
3. Brief explanation of design decisions

Template 2: Indagine sui Bug

You are a debugging specialist with expertise in {language}/{framework}.

Investigate and fix this bug:

**Symptom:** {describe_the_observed_behavior}
**Expected:** {describe_the_expected_behavior}
**Frequency:** {always/sometimes/under_specific_conditions}
**Environment:** {production/staging/development}

Relevant code:
```
{paste_relevant_code}
```

Error output / stack trace:
```
{paste_error_output}
```

Think step by step:
1. Identify the root cause
2. Explain why this bug occurs
3. Provide the fix with code
4. Suggest how to prevent similar bugs
5. Write a regression test

Template 3: Revisione del Codice

You are a senior code reviewer at a {company_type} company.

Review this {language} code for:

1. **Correctness:** Logic errors, off-by-one errors, null handling
2. **Security:** Injection, XSS, auth bypasses, data exposure
3. **Performance:** N+1 queries, unnecessary allocations, missing caches
4. **Maintainability:** Code smells, naming, complexity
5. **Testing:** Missing test cases, brittle tests

Code to review:
```
{paste_code}
```

For each issue found, provide:
- Severity: 🔴 Critical / 🟡 Warning / 🔵 Info
- Category: Which of the 5 areas above
- Description: What's wrong and why
- Suggestion: How to fix it, with code example

End with an overall assessment and top 3 priorities.

Template 4: Progettazione Endpoint API

Design a {http_method} {endpoint_path} endpoint for {resource_description}.

Framework: {framework}
Auth: {auth_method}
Database: {database}

The endpoint should:
- {functionality_1}
- {functionality_2}
- {functionality_3}

Provide:
1. Route definition with middleware chain
2. Request validation schema ({validation_library})
3. Controller/handler function
4. Service layer function
5. Database query/function
6. Response types (success and error)
7. Example curl request and response

Template 5: Migrazione del Database

Create a database migration for {change_description}.

Current schema:
```
{current_schema}
```

Desired changes:
- {change_1}
- {change_2}

ORM: {orm_name}
Database: {database_type}

Requirements:
- Migration must be reversible (include down migration)
- Preserve existing data (write data migration SQL if needed)
- Add appropriate indexes for new columns
- Consider performance impact on large tables
- Include rollback safety checks

Template 6: Generazione Suite di Test

Write a comprehensive test suite for {function_or_class_name}.

Testing framework: {framework}
Mocking library: {library}

Code under test:
```
{paste_code}
```

Test categories to cover:
- ✅ Happy path: All valid inputs produce correct outputs
- 🔄 Edge cases: Empty inputs, boundary values, null/undefined
- ❌ Error cases: Invalid inputs, permission denied, network failures
- 🏎️ Performance: Response time expectations for critical paths
- 🔒 Security: Auth checks, input sanitization

For each test:
- Use descriptive test names that read like documentation
- Follow Arrange-Act-Assert pattern
- Include setup/teardown for shared state
- Mock external dependencies

Template 7: Piano di Refactoring

You are a software architect specializing in {language} refactoring.

Current code:
```
{paste_current_code}
```

Problems with current code:
- {problem_1}
- {problem_2}

Refactor using {pattern_or_principle}.

Provide:
1. **Analysis:** What's wrong and why the current approach doesn't scale
2. **Target Architecture:** How the refactored code should be structured
3. **Step-by-step Plan:** Ordered refactoring steps (safe, incremental)
4. **Refactored Code:** Complete implementation
5. **Migration Guide:** How to transition from old to new without breaking changes
6. **Risk Assessment:** What could go wrong and how to mitigate

Template 8: Generazione Documentazione

Generate documentation for this {language} code:

```
{paste_code}
```

Documentation type: {JSDoc/TSDoc/Python docstrings/README section}

Requirements:
- Document all public functions/classes/methods
- Include parameter descriptions with types
- Include return type descriptions
- Add usage examples for non-obvious APIs
- Note any side effects or important caveats
- Use {style_guide} conventions

For README documentation, include:
- Overview (1-2 paragraphs)
- Installation instructions
- Quick start example
- API reference table
- Configuration options

Template 9: Ottimizzazione delle Prestazioni

You are a performance engineering specialist.

Analyze and optimize this code for performance:

```
{paste_code}
```

Current performance:
- {metric}: {current_value}
- Target: {target_value}
- Bottleneck suspected at: {location}

Optimization constraints:
- Must not change the public API
- Must maintain all existing test passes
- Must not sacrifice readability for micro-optimizations
- {additional_constraint}

Provide:
1. **Profiling Analysis:** Where time/memory is being spent
2. **Optimization Strategies:** Ranked by expected impact
3. **Optimized Code:** With comments explaining each change
4. **Benchmark Comparison:** Before vs after expected metrics
5. **Trade-offs:** Any readability or complexity costs

Template 10: Audit di Sicurezza

You are a security engineer specializing in {language}/{framework} security.

Perform a security audit on this code:

```
{paste_code}
```

Check for:
- Injection attacks (SQL, NoSQL, command, LDAP)
- Authentication and authorization bypasses
- Cross-site scripting (XSS) vulnerabilities
- Cross-site request forgery (CSRF) exposure
- Insecure direct object references (IDOR)
- Sensitive data exposure (logging, error messages)
- Insecure cryptography or key management
- Race conditions in concurrent operations
- Denial of service vulnerabilities

For each finding:
- Severity: Critical / High / Medium / Low
- OWASP Category: Which Top 10 category
- Description: Clear explanation of the vulnerability
- Attack Scenario: How an attacker would exploit it
- Remediation: Specific code fix
- Verification: How to confirm the fix works