@clue-ai/cli 0.0.10 → 0.0.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clue-ai/cli",
-  "version": "0.0.10",
+  "version": "0.0.12",
   "type": "module",
   "bin": {
     "clue-ai": "bin/clue-cli.mjs"

package/src/lifecycle-init.mjs

@@ -567,13 +567,15 @@ const buildLifecyclePrompt = ({ request, files }) =>
       "Do not send raw email, raw person names, tokens, workspace names, organization names, or tenant names as lifecycle traits unless the repository already has an explicit Clue privacy policy allowing them.",
       "Prefer stable ids and non-PII booleans/counts for ClueIdentify and ClueSetAccount traits.",
       "Use environment variable names for Clue configuration values.",
-      "For Python/FastAPI code, read CLUE_PROJECT_KEY, CLUE_ENVIRONMENT, CLUE_API_KEY, and CLUE_INGEST_ENDPOINT from environment variables.",
+      "For Python/FastAPI code, read CLUE_PROJECT_KEY, CLUE_ENVIRONMENT, CLUE_API_KEY, and CLUE_INGEST_ENDPOINT from the backend env block.",
+      "CLUE_API_BASE_URL is for Clue CLI and semantic snapshot CI configuration, not backend SDK runtime configuration. Do not add it to application config unless existing non-Clue code already requires it.",
       "For browser code, read CLUE_PROJECT_KEY, CLUE_ENVIRONMENT, CLUE_SERVICE_KEY, and CLUE_INGEST_ENDPOINT from environment variables through the target framework's safe client config mechanism. Do not hard-code a Next.js-only prefix.",
       "Never place CLUE_API_KEY in frontend code, frontend env files, browser bundles, or client-readable config.",
       "When browser SDK ingest is configured, implement a backend-owned browser token endpoint that reads server-side CLUE_API_KEY and requests POST /api/v1/ingest/browser-tokens from Clue.",
       "Configure frontend ClueInit with browserTokenProvider that calls the local backend token endpoint and returns the token string.",
       "The browser token request must include project key, environment, service key, and the current browser origin; the backend must attach x-clue-api-key server-side when calling Clue.",
       "Prefer minimal edits that engineers can review in one PR.",
+      "Do not run broad formatters, import sorters, cleanup tools, or style-only edits. Whitespace-only changes are allowed only on lines directly changed for Clue SDK wiring.",
       "If a lifecycle point is unclear, skip that edit and include a warning.",
       "Return status ready only when edits are safe to apply. Return status blocked when required SDKs or lifecycle points cannot be verified.",
       "If status is blocked, return no edits and no lifecycle_insertions, and list blockers. Do not encode blockers as warnings.",
@@ -585,8 +587,8 @@ const buildLifecyclePrompt = ({ request, files }) =>
       browser_project_key_env: "CLUE_PROJECT_KEY",
       environment_env: "CLUE_ENVIRONMENT",
       browser_environment_env: "CLUE_ENVIRONMENT",
-      clue_api_base_url_env: "CLUE_API_BASE_URL",
       clue_ingest_endpoint_env: "CLUE_INGEST_ENDPOINT",
+      tooling_api_base_url_env: "CLUE_API_BASE_URL",
       browser_ingest_endpoint_env: "CLUE_INGEST_ENDPOINT",
       browser_token_endpoint_path: "/api/v1/ingest/browser-tokens",
       service_key: request.service_key,

package/src/setup-check.mjs

@@ -27,7 +27,7 @@ const SETUP_SKILLS = [
   "clue-local-verification",
   "clue-setup-report",
 ];
-const SETUP_SKILL_CONTENT_VERSION = "2026-05-10.lifecycle-placement-only.v1";
+const SETUP_SKILL_CONTENT_VERSION = "2026-05-10.lifecycle-placement-only.v2";
 const REQUIRED_SETUP_SKILL_PHRASES = {
   "clue-sdk-instrumentation": [
     "Do not create no-op wrappers",
@@ -35,12 +35,15 @@ const REQUIRED_SETUP_SKILL_PHRASES = {
     "add the real `@clue-ai/browser-sdk` dependency",
     "Do not invent `clue-js-sdk`",
     "The implementation scope is only ClueInit, ClueIdentify, ClueSetAccount, and ClueLogout placement",
+    "CLUE_API_BASE_URL` is for Clue CLI and semantic snapshot CI configuration",
+    "Whitespace-only changes are allowed only on lines directly changed for Clue SDK wiring",
     "For Django code, use `clue-django-sdk` only after package-manager or registry verification confirms it is installable",
   ],
   "clue-setup-audit": [
     "Reject wrong SDK package names",
     "Reject Django SDK setup when `clue-django-sdk` installability has not been verified",
     "Reject ClueTrack instrumentation unless the user explicitly requested product event tracking",
+    "Reject whitespace-only edits, import sorting, formatter churn",
     "Reject unrelated refactors, renames, file moves",
     "Execution agents must not approve, certify, or mark their own work complete",
   ],

package/src/setup-help.mjs

@@ -3,7 +3,7 @@ import {
   clueCliCommand,
 } from "./cli-invocation.mjs";
 
-export const AI_SETUP_HELP_VERSION = "2026-05-10.lifecycle-placement-only.v1";
+export const AI_SETUP_HELP_VERSION = "2026-05-10.lifecycle-placement-only.v2";
 
 export const buildAiSetupHelp = () => ({
   name: "@clue-ai/cli AI setup help",
@@ -23,7 +23,7 @@ export const buildAiSetupHelp = () => ({
     ],
     lifecycle_apis_out_of_scope_by_default: ["ClueTrack"],
     allowed_change_scope: {
-      rule: "Only changes required to place ClueInit, ClueIdentify, ClueSetAccount, and ClueLogout are allowed.",
+      rule: "Only exact changes required to place ClueInit, ClueIdentify, ClueSetAccount, and ClueLogout are allowed.",
       allowed: [
         "Clue SDK dependency declarations and lockfile changes needed to install those SDKs",
         "Clue SDK imports, bootstrap adapters, and single initialization points",
@@ -40,6 +40,7 @@ export const buildAiSetupHelp = () => ({
         "UI layout, styling, copy, or navigation changes unrelated to Clue setup",
         "dependency upgrades unrelated to Clue SDK installability",
         "hand-authored semantic snapshot artifacts or runtime request files",
+        "whitespace-only edits, import sorting, formatter churn, or comment/style cleanup outside the exact Clue SDK wiring lines",
       ],
     },
     setup_watch: {

package/src/setup-tool.mjs

@@ -17,7 +17,7 @@ const SKILL_NAMES = [
   "clue-local-verification",
   "clue-setup-report",
 ];
-const SETUP_SKILL_CONTENT_VERSION = "2026-05-10.lifecycle-placement-only.v1";
+const SETUP_SKILL_CONTENT_VERSION = "2026-05-10.lifecycle-placement-only.v2";
 
 const TARGETS = new Set(["codex", "claude_code"]);
 
@@ -271,13 +271,15 @@ const skillBody = (name) => {
       "When browser SDK ingest is configured, implement a backend-owned browser token endpoint that reads server-side `CLUE_API_KEY` and requests `POST /api/v1/ingest/browser-tokens` from Clue.",
       "Configure frontend `ClueInit` with `browserTokenProvider` that calls the local backend token endpoint and returns the token string.",
       "The browser token request must include project key, environment, service key, and the current browser origin; the backend must attach `x-clue-api-key` server-side when calling Clue.",
-      "For FastAPI code, add `clue-fastapi-sdk` to the backend dependency file when missing, import `clue_init_fastapi` plus `ClueIdentify`, `ClueSetAccount`, and `ClueLogout` where needed, and use `CLUE_PROJECT_KEY`, `CLUE_ENVIRONMENT`, `CLUE_API_KEY`, and `CLUE_INGEST_ENDPOINT`.",
+      "For FastAPI code, add `clue-fastapi-sdk` to the backend dependency file when missing, import `clue_init_fastapi` plus `ClueIdentify`, `ClueSetAccount`, and `ClueLogout` where needed, and use `CLUE_PROJECT_KEY`, `CLUE_ENVIRONMENT`, `CLUE_API_KEY`, and `CLUE_INGEST_ENDPOINT` from the backend env block.",
+      "`CLUE_API_BASE_URL` is for Clue CLI and semantic snapshot CI configuration, not backend SDK runtime configuration. Do not add it to application config unless existing non-Clue code already requires it.",
       "Use `CLUE_SERVICE_KEY` as the canonical local service identifier. Do not ask the user to manage a separate producer id; SDKs should send producer id as the service key for setup verification compatibility.",
       "For frontend code, pass `serviceKey` from `CLUE_SERVICE_KEY` to `ClueInit`. Do not require a separate producer id unless the repository already has one for compatibility.",
       "For Django code, use `clue-django-sdk` only after package-manager or registry verification confirms it is installable; if it is not published or cannot be verified, report a blocker instead of adding a guessed dependency or import.",
       "For other backend frameworks, use the matching Clue backend SDK if one exists; if no backend SDK exists, report a blocker instead of silently frontend-only setup.",
       "Do not send raw email, raw person names, tokens, workspace names, organization names, or tenant names as lifecycle traits unless the repository already has an explicit Clue privacy policy allowing them.",
       "Prefer stable ids and non-PII booleans/counts for ClueIdentify and ClueSetAccount traits.",
+      "Do not run broad formatters, import sorters, cleanup tools, or style-only edits. Whitespace-only changes are allowed only on lines directly changed for Clue SDK wiring.",
       "Find the app/bootstrap entrypoint and add ClueInit only when the location is clear.",
       "Place ClueInit in a stable app bootstrap, SDK adapter, or client singleton; do not place ClueInit inside React component lifecycle hooks, page components, sidebars, login/register success callbacks, or other paths that can run repeatedly.",
       "If the repository needs lifecycle calls from UI hooks, import a shared initialized Clue adapter instead of calling ClueInit again.",
@@ -305,6 +307,7 @@ const skillBody = (name) => {
       "Reject ClueTrack instrumentation unless the user explicitly requested product event tracking.",
       "Confirm no project key, API key, secret, or env value appears in diff or report.",
       "Confirm lifecycle insertions are minimal and reviewable.",
+      "Reject whitespace-only edits, import sorting, formatter churn, or comment/style cleanup outside the exact Clue SDK wiring lines.",
       "Reject unrelated refactors, renames, file moves, formatting churn, broad cleanup, business logic rewrites, auth/session rewrites beyond minimal Clue hook insertion, and UI changes unrelated to Clue setup.",
     ],
     "clue-local-verification": [
@@ -340,7 +343,7 @@ const skillBody = (name) => {
       "List skills used for each workstream.",
       "List execution agent and monitoring agents, or named review passes if subagents were unavailable.",
       "List blockers with exact file or environment names when available.",
-      "List required env names without values.",
+      "List required env names without values and group them by scope: service runtime env blocks versus GitHub Secrets/Variables. Do not report `CLUE_API_BASE_URL` as a backend SDK runtime env; it belongs to Clue CLI and semantic snapshot CI configuration.",
       "List P0/P1 monitoring findings and fixes.",
       "State that commit and push were not performed.",
     ],
@@ -379,8 +382,9 @@ const skillBody = (name) => {
     `- Before editing a customer repository, run \`${clueCliCommand("help --json")}\` and follow its setup_execution_contract.`,
     `- Do not search for a global \`${CLUE_CLI_BINARY_NAME}\` binary or block on \`which ${CLUE_CLI_BINARY_NAME}\`; missing global binary is normal.`,
     "- The AI implementation task is only to decide where ClueInit, ClueIdentify, ClueSetAccount, and ClueLogout belong in existing code and apply the minimal SDK wiring for those calls.",
-    "- Only changes required to place ClueInit, ClueIdentify, ClueSetAccount, and ClueLogout are allowed. Do not perform ClueTrack instrumentation unless the user explicitly requested product event tracking.",
+    "- Only exact changes required to place ClueInit, ClueIdentify, ClueSetAccount, and ClueLogout are allowed. Do not perform ClueTrack instrumentation unless the user explicitly requested product event tracking.",
     "- Do not perform unrelated refactors, renames, file moves, formatting churn, broad cleanup, business logic rewrites, auth/session rewrites beyond minimal Clue hook insertion, UI changes unrelated to Clue setup, or unrelated dependency upgrades.",
+    "- Do not run broad formatters or make whitespace-only cleanup. Keep formatting changes limited to lines directly touched for Clue SDK wiring.",
     "- Do not implement or refresh semantic snapshot CI during lifecycle placement; report a blocker if generated semantic artifacts are missing or stale.",
     `- Do not run \`${clueCliCommand("setup-watch --local")}\` automatically. setup-watch and the Clue setup screen are user-operated verification steps, not implementation-agent responsibility.`,
     "- The full setup must start with `clue-setup-orchestrator`.",