@appsforgood/next-supabase-kit 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.4.3
+
+- `doctor` fails if a default agent drops packaged `requiredTools` (QA/Design can no longer drop screenshot tools and still pass).
+- `adapter validate all` validates the IDEs in `.agent-kit/manifest.json` `activated`, not every IDE the kit supports. Named targets still check that one IDE.
+- `loadCatalog` caches per package root so tests and nested installs do not reuse the wrong catalog.
+- `agent-kit guide` prints the local `USER_GUIDE.html` path. GitHub shows that file as source; open it in a browser.
+- `planning` and `testing-qa` name the domain skills they must not replace.
+- Visual P0s: reject left accent bars on selected rows and status wells. Selection is radio/check + tint. Same family as accent-border cards / glow rails, not a second prompt. `USER_GUIDE.html` fail-closed well is a flat tint, not a left stroke.
+- Version Packages keeps a drafted next-version `CHANGELOG.md` heading instead of failing when `package.json` is still on the previous version.
+
+## 0.4.2
+
+- Uplift default domain skills so they are playbooks, not checklists: `nextjs-app-router` (App Router, async request APIs, `proxy.ts`), `supabase-auth-rls` (SSR clients, `getUser()`, service role, RLS), `postgres-migrations` (RLS in the same change), `owasp-security-review` (Top 10 mapped onto Actions/RLS/SSRF).
+- Planner’s `planning` skill names which of those skills the owner must run. App engineer must not skip them for a “small” route.
+
 ## 0.4.1
 
 - Catch-up release: npm `0.4.0` was the simplify cut; later GitHub work (`deslop`, frontend-design, catalog pointers, leftover `doctor`, HTML user guide) was not on npm.

package/README.md

@@ -10,7 +10,7 @@ QA does not review user-visible work from code alone. A change is not done until
 npx --yes @appsforgood/next-supabase-kit init --activate all
 ```
 
-Then open **[USER_GUIDE.html](USER_GUIDE.html)** (markdown twin: [USER_GUIDE.md](USER_GUIDE.md)). That guide is how you use the pack.
+Then open **[USER_GUIDE.html](USER_GUIDE.html)** in a browser (markdown twin: [USER_GUIDE.md](USER_GUIDE.md)). GitHub shows the HTML as source; `npx agent-kit guide` prints the local path. That guide is how you use the pack.
 
 ## What you get
 
@@ -23,6 +23,7 @@ Then open **[USER_GUIDE.html](USER_GUIDE.html)** (markdown twin: [USER_GUIDE.md]
 
 ```bash
 npx agent-kit init --activate all
+npx agent-kit guide
 npx agent-kit doctor
 npx agent-kit add skill debug
 npx agent-kit add agent lead-architect

package/UPGRADE.md

@@ -1,5 +1,28 @@
 # Upgrade Guide
 
+## 0.4.3
+
+`0.4.3` does not change installed agent files unless you stripped `requiredTools`. `doctor` now fails that. `adapter validate all` on a Cursor-only install checks Cursor only.
+
+```bash
+npx @appsforgood/next-supabase-kit@0.4.3 update
+npx @appsforgood/next-supabase-kit@0.4.3 doctor
+npx @appsforgood/next-supabase-kit@0.4.3 guide
+```
+
+Open `USER_GUIDE.html` in a browser. GitHub shows it as source.
+
+## 0.4.2
+
+`0.4.1` is the published simplify catch-up. `0.4.2` rewrites the Next.js and Supabase domain skills. `update` refreshes pristine skill files; local edits win or land in conflicts.
+
+```bash
+npx @appsforgood/next-supabase-kit@0.4.2 update
+npx @appsforgood/next-supabase-kit@0.4.2 doctor
+```
+
+Do not re-init. `update` still never deletes leftover 0.3 council docs.
+
 ## 0.4.1
 
 npm `0.4.0` was the simplify cut. `0.4.1` adds `deslop`, the 4-token `frontend-design` skill, catalog pointers on agents, and leftover-0.3 `doctor` warnings. Those leftover warnings are not a failure. `update` still never deletes old council docs.

package/USER_GUIDE.html

@@ -220,12 +220,15 @@
       }
 
       .rule {
-        border-left: 4px solid var(--safelight);
         padding: 0.7rem 0.9rem;
-        background: #1a1814;
+        background: #23160f;
         margin: 0 0 1.4rem;
       }
 
+      .rule strong {
+        color: var(--safelight);
+      }
+
       .steps {
         display: grid;
         gap: 0.85rem;
@@ -563,23 +566,23 @@
           <tbody>
             <tr>
               <td><code>planning</code></td>
-              <td>Ambiguous work; pick an owner</td>
+              <td>Ambiguous work; pick an owner and which skill they run</td>
             </tr>
             <tr>
               <td><code>nextjs-app-router</code></td>
-              <td>Routes, Server Components, actions</td>
+              <td>App Router, Server vs Client, actions, <code>proxy.ts</code></td>
             </tr>
             <tr>
               <td><code>supabase-auth-rls</code></td>
-              <td>Auth, RLS, service role</td>
+              <td>Auth, RLS, service role, Storage</td>
             </tr>
             <tr>
               <td><code>postgres-migrations</code></td>
-              <td>Schema and migrations</td>
+              <td>Schema, constraints, RLS in the same change</td>
             </tr>
             <tr>
               <td><code>owasp-security-review</code></td>
-              <td>Mutations, uploads, secrets</td>
+              <td>Mutations, uploads, SSRF, secrets</td>
             </tr>
             <tr>
               <td><code>frontend-design</code></td>
@@ -763,6 +766,10 @@ npx agent-kit update</pre>
               <td>QA finished from the diff</td>
               <td>Reject it. Re-run with the good QA prompt.</td>
             </tr>
+            <tr>
+              <td>GitHub shows this page as code</td>
+              <td>Open <code>USER_GUIDE.html</code> in a browser, or run <code>npx agent-kit guide</code>. GitHub does not render the layout.</td>
+            </tr>
             <tr>
               <td><code>doctor</code> fails the guide</td>
               <td>The screenshot fail-closed sentence must stay in <code>USER_GUIDE.md</code> and this page.</td>

package/USER_GUIDE.md

@@ -82,11 +82,11 @@ Do not ask one chat to be all six. Planner names the next specialist. It does no
 
 | Skill | Use when |
 | --- | --- |
-| `planning` | Ambiguous work; pick an owner |
-| `nextjs-app-router` | Routes, Server Components, actions |
-| `supabase-auth-rls` | Auth, RLS, service role |
-| `postgres-migrations` | Schema and migrations |
-| `owasp-security-review` | Mutations, uploads, secrets |
+| `planning` | Ambiguous work; pick an owner and which skill they run |
+| `nextjs-app-router` | App Router, Server vs Client, actions, `proxy.ts` |
+| `supabase-auth-rls` | Auth, RLS, service role, Storage |
+| `postgres-migrations` | Schema, constraints, RLS in the same change |
+| `owasp-security-review` | Mutations, uploads, SSRF, secrets |
 | `frontend-design` | Layout, simple palette, anti-generic UI |
 | `accessibility-wcag` | Keyboard, contrast, labels |
 | `browser-qa` | Any screen. Required for QA of UI |
@@ -179,5 +179,6 @@ Pristine files refresh. Local edits win or land in `.agent-kit/conflicts/`. Do n
 | Skill not triggering | Mention the skill name (`browser-qa`) or `@` it in Cursor. |
 | No browser in Copilot / Codex | Use the Playwright commands in `browser-qa`. |
 | QA finished from the diff | Reject it. Re-run with the good QA prompt above. |
+| GitHub shows `USER_GUIDE.html` as code | Open the file in a browser. Run `npx agent-kit guide` to print the path. GitHub does not render the layout. |
 | `doctor` fails USER_GUIDE | The screenshot fail-closed sentence must stay in this file. |
 | Still have `QUALITY_GATES.md` / `COUNCIL.md` | Expected. `update` does not delete them. `doctor` lists leftovers. |

package/agents/app-engineer/agent.md

@@ -23,6 +23,8 @@ Code-only “it should work” is incomplete for anything the user can see or cl
 
 `nextjs-app-router`, `supabase-auth-rls`, `postgres-migrations`.
 
+Run those skills. Do not treat a small route, form, or table as exempt.
+
 Available skills: `catalog.json` and the skill table in `USER_GUIDE.md`. Start with the skills named above. Use another listed skill when this job needs it.
 
 ## Handoff