@glxmart/boss-cli 1.0.0-beta.0

package/assets/worker-configs/technical-writer/CLAUDE.md

@@ -0,0 +1,107 @@
+# ${workerName} Worker Instructions
+
+This worker is responsible for ${workerRoleDescription}
+
+## Worker-Specific Guidelines
+
+- Follow the prompt in \`prompt.md\` for detailed role instructions
+- Use container-use environments for all operations
+- Reference \`.claude/commands/\`, \`.claude/skills/\`, and \`.claude/agents/\` for worker-specific resources
+
+## Environment Operations
+
+All file, code, and shell operations MUST use container-use environments.
+
+- DO NOT use git CLI directly
+- All operations must go through container-use MCP
+- Inform user: \`container-use log <env_id>\` AND \`container-use checkout <env_id>\`
+
+## Project Status & Configuration
+
+**CRITICAL:** Always check `.boss/project-config.json` to understand project state before starting work.
+
+**Read project-config.json to understand:**
+- Current branch and workflow stage
+- Active workers and their status
+- Completed tasks
+- Repository information
+- Initialization status
+
+**Update project-config.json when:**
+- Starting work: Add your environment ID to `workflow.activeWorkers`
+- Completing work: Add a summary to `workers.summaries` with:
+  - Environment ID
+  - Tasks completed
+  - Artifacts created (API docs, user guides, developer docs)
+  - Documentation coverage metrics
+  - Any blockers or issues encountered
+- After merging: Remove from `workflow.activeWorkers` and add to `workflow.completedTasks`
+
+**Example worker summary format:**
+```json
+{
+  "envId": "env-abc123",
+  "workerType": "${workerName}",
+  "completedAt": "2026-01-15T10:30:00Z",
+  "tasksCompleted": ["API documentation", "User guide", "Quickstart"],
+  "artifactsCreated": ["docs/api.md", "docs/user-guide.md", ".specify/specs/001-feature/quickstart.md"],
+  "coverage": "100%",
+  "notes": "Created comprehensive documentation for feature"
+}
+```
+
+**IMPORTANT:**
+- NEVER use git commands to check project status - read project-config.json instead
+- ALWAYS update project-config.json when completing work
+- Keep summaries concise but informative for BOSS to track progress
+
+## Git Commit Strategy
+
+**IMPORTANT:** Batch related changes into logical commits to reduce overhead and improve workflow efficiency.
+
+### Batching Guidelines
+
+1. **Group files by feature/fix** (not by file type)
+2. **Aim for 1-3 commits per task** instead of 5-10
+3. **Use meaningful commit messages** following Conventional Commits
+4. **Only commit when reaching a logical checkpoint**
+
+### Good Practice ✅
+
+```bash
+# Create documentation files in one commit
+git add docs/api.md docs/user-guide.md .specify/specs/001-feature/quickstart.md
+git commit -m "docs: add API documentation and user guide"
+
+# Or batch complete documentation phase
+git add docs/api.md docs/tutorials/ README.md
+git commit -m "docs: complete feature documentation with API reference and tutorials"
+```
+
+### Bad Practice ❌
+
+```bash
+# Individual commits for related work (too granular)
+git add docs/api.md
+git commit -m "docs: add API docs"
+
+git add docs/user-guide.md
+git commit -m "docs: add guide"
+
+git add README.md
+git commit -m "docs: update README"
+```
+
+### Commit Message Format
+
+Follow Conventional Commits:
+- `docs:` - Documentation changes (primary for technical-writer)
+
+### Expected Behavior
+
+- **Simple task:** 1-2 commits (initial docs + refinements)
+- **Complex task:** 2-3 commits (major documentation phases)
+- **Avoid:** 5-10 commits for small changes
+
+This batching strategy reduces git overhead by ~10-15 seconds per task and creates cleaner commit history.
+

package/assets/worker-configs/tester/CLAUDE.md

@@ -0,0 +1,110 @@
+# ${workerName} Worker Instructions
+
+This worker is responsible for ${workerRoleDescription}
+
+## Worker-Specific Guidelines
+
+- Follow the prompt in \`prompt.md\` for detailed role instructions
+- Use container-use environments for all operations
+- Reference \`.claude/commands/\`, \`.claude/skills/\`, and \`.claude/agents/\` for worker-specific resources
+
+## Environment Operations
+
+All file, code, and shell operations MUST use container-use environments.
+
+- DO NOT use git CLI directly
+- All operations must go through container-use MCP
+- Inform user: \`container-use log <env_id>\` AND \`container-use checkout <env_id>\`
+
+## Project Status & Configuration
+
+**CRITICAL:** Always check `.boss/project-config.json` to understand project state before starting work.
+
+**Read project-config.json to understand:**
+- Current branch and workflow stage
+- Active workers and their status
+- Completed tasks
+- Repository information
+- Initialization status
+
+**Update project-config.json when:**
+- Starting work: Add your environment ID to `workflow.activeWorkers`
+- Completing work: Add a summary to `workers.summaries` with:
+  - Environment ID
+  - Tasks completed
+  - Artifacts created (test files, test reports)
+  - Test coverage metrics
+  - Mutation testing scores
+  - Any blockers or issues encountered
+- After merging: Remove from `workflow.activeWorkers` and add to `workflow.completedTasks`
+
+**Example worker summary format:**
+```json
+{
+  "envId": "env-abc123",
+  "workerType": "${workerName}",
+  "completedAt": "2026-01-15T10:30:00Z",
+  "tasksCompleted": ["BDD test suite", "Integration tests"],
+  "artifactsCreated": ["tests/feature.test.ts", "tests/integration.test.ts"],
+  "testCoverage": "85%",
+  "mutationScore": "82%",
+  "notes": "Created comprehensive test suite with BDD tests matching spec.md"
+}
+```
+
+**IMPORTANT:**
+- NEVER use git commands to check project status - read project-config.json instead
+- ALWAYS update project-config.json when completing work
+- Keep summaries concise but informative for BOSS to track progress
+
+## Git Commit Strategy
+
+**IMPORTANT:** Batch related changes into logical commits to reduce overhead and improve workflow efficiency.
+
+### Batching Guidelines
+
+1. **Group files by feature/fix** (not by file type)
+2. **Aim for 1-3 commits per task** instead of 5-10
+3. **Use meaningful commit messages** following Conventional Commits
+4. **Only commit when reaching a logical checkpoint**
+
+### Good Practice ✅
+
+```bash
+# Create test files in one commit
+git add tests/feature.test.ts tests/integration.test.ts tests/e2e.test.ts
+git commit -m "test: add comprehensive test suite with unit, integration, and e2e tests"
+
+# Or batch test implementation with fixtures
+git add tests/api/users.test.ts tests/fixtures/users.ts tests/helpers/auth.ts
+git commit -m "test: implement user API tests with fixtures and helpers"
+```
+
+### Bad Practice ❌
+
+```bash
+# Individual commits for related work (too granular)
+git add tests/feature.test.ts
+git commit -m "test: add unit tests"
+
+git add tests/integration.test.ts
+git commit -m "test: add integration tests"
+
+git add tests/e2e.test.ts
+git commit -m "test: add e2e tests"
+```
+
+### Commit Message Format
+
+Follow Conventional Commits:
+- `test:` - Adding/updating tests (primary for tester)
+- `fix:` - Bug fixes found during testing
+
+### Expected Behavior
+
+- **Simple task:** 1-2 commits (test suite + coverage)
+- **Complex task:** 2-3 commits (major test phases)
+- **Avoid:** 5-10 commits for small changes
+
+This batching strategy reduces git overhead by ~10-15 seconds per task and creates cleaner commit history.
+

package/dist/assets/claude-folder/commands/boss-commands.md

@@ -0,0 +1,138 @@
+# BOSS Commands
+
+## Available Commands
+
+### Container-Use Commands
+
+- \`container-use log <env_id>\` - View worker logs
+- \`container-use checkout <env_id>\` - Checkout worker branch
+- \`container-use diff <env_id>\` - View code changes
+- \`container-use merge <env_id>\` - Merge worker branch
+
+### Spec-Kit Commands
+
+- \`bash .specify/scripts/speckit.plan.sh\` - Generate plan
+- \`bash .specify/scripts/speckit.tasks.sh\` - Generate tasks
+- \`bash .specify/scripts/speckit.implement.sh\` - Implement features
+
+### BOSS Commands
+
+- \`./start-boss.sh\` - Start BOSS with MCP restrictions
+
+### Initial Setup Command
+
+**Command:** `boss-initial-setup`
+
+**Purpose:** Complete the initial project setup after bootstrap.
+
+**When to Run:**
+- After bootstrap completes
+- When `initialization.stage` in `.boss/project-config.json` is `"bootstrap"` or `"remote-setup"`
+
+**What It Does:**
+1. Checks `.boss/project-config.json` for current initialization status
+2. Verifies if remote repository exists
+3. If no remote exists:
+   - Asks user:
+     - Should repository be **private** or **public**? (default: private)
+     - Should it be created in an **organization**? (if yes, which org?)
+     - Repository name (if different from project name)
+   - Creates GitHub repository using GitHub MCP
+   - Adds remote using Container-Use MCP (NOT git CLI)
+   - Pushes initial commit to remote
+   - Updates `.boss/project-config.json` with remote information
+4. Marks `initialization.stage = "ready"` in project-config.json
+5. Updates project status to indicate setup is complete
+
+**How to Execute:**
+- BOSS can run this command directly when user asks to complete setup
+- Or BOSS can spawn an initial-setup worker using Container-Use MCP
+- Worker should follow the checklist in its prompt.md
+
+**Checklist for Initial Setup:**
+- [ ] Read `.boss/project-config.json` to check current status
+- [ ] **Verify:** Main branch is EMPTY (only empty commit) - bootstrap files are NOT on main
+- [ ] **Verify:** Feature branch `feature/boss-initial-setup` exists with ALL bootstrap files (created during bootstrap)
+- [ ] Confirm you are on `feature/boss-initial-setup` branch (created during bootstrap)
+- [ ] Check if remote repository exists (read project-config.json, NOT git)
+- [ ] If no remote:
+  - [ ] Ask user for repository preferences (private/public, org)
+  - [ ] Create GitHub repository using GitHub MCP (will create under personal account)
+  - [ ] If organization was requested:
+    - [ ] Ask user: "Repository created under your personal account. Would you like me to transfer it to [org-name] now?"
+    - [ ] If user confirms:
+      - [ ] Transfer repository using GitHub API: `POST /repos/{owner}/{repo}/transfer` with `{"new_owner": "org-name"}`
+      - [ ] Wait for transfer to complete
+      - [ ] Update git remote URL to reflect new owner using Container-Use MCP
+  - [ ] **CRITICAL: Lock main branch and require PRs** - Use GitHub API to set branch protection:
+    - [ ] Make HTTP PUT request to: `https://api.github.com/repos/{owner}/{repo}/branches/main/protection`
+    - [ ] Headers: `Authorization: Bearer {GITHUB_PERSONAL_ACCESS_TOKEN}`, `Accept: application/vnd.github.v3+json` (use GITHUB_PERSONAL_ACCESS_TOKEN, not GITHUB_TOKEN, for API calls)
+    - [ ] Body (JSON):
+      ```json
+      {
+        "required_pull_request_reviews": {
+          "required": true,
+          "dismiss_stale_reviews": true,
+          "require_code_owner_reviews": false,
+          "required_approving_review_count": 1
+        },
+        "enforce_admins": true,
+        "required_status_checks": {
+          "strict": true,
+          "contexts": []
+        },
+        "restrictions": null,
+        "allow_force_pushes": false,
+        "allow_deletions": false,
+        "required_linear_history": false,
+        "allow_squash_merge": true,
+        "allow_merge_commit": true,
+        "allow_rebase_merge": true
+      }
+      ```
+    - [ ] Verify protection was set: Check response status is 200
+    - [ ] **DO NOT skip this step** - branch protection is mandatory
+  - [ ] **CRITICAL ORDER - Follow EXACTLY:**
+    1. **Add remote using HTTPS:** `git remote add origin https://github.com/<owner>/<repo>.git` (ALWAYS use HTTPS, NEVER SSH `git@github.com` format)
+    2. **If transferred, update remote:** `git remote set-url origin https://github.com/<new-owner>/<repo>.git` (use HTTPS format)
+    3. **Check current branch:** `git branch --show-current` - verify you're on the correct branch
+    4. **Handle uncommitted changes:** If on `feature/boss-initial-setup` with uncommitted changes, commit them first: `git add . && git commit -m "chore: bootstrap files"` (these should be on feature branch)
+    5. **Switch to main branch:** `git checkout main` (if uncommitted changes prevent checkout, commit them to current branch first, then switch)
+    6. **FIRST push empty main branch:** `git push -u origin main` (main is EMPTY - only empty commit, no validation needed, MUST be pushed first, git will use GITHUB_TOKEN from environment automatically, which is set to same value as GITHUB_PERSONAL_ACCESS_TOKEN)
+       - **NOTE:** The pre-push hook allows empty main push without validation checks
+       - **Main branch must be pushed first (empty) before feature branch**
+    7. **Switch back to feature branch:** `git checkout feature/boss-initial-setup` (branch should already exist from bootstrap)
+    8. **Verify validation checks pass BEFORE pushing feature branch:**
+       - **BEFORE pushing feature branch, verify all checks pass:**
+         1. **Typecheck:** Run `pnpm typecheck` (or `npm run typecheck`) - must pass
+         2. **Lint:** Run `pnpm lint` (or `npm run lint`) - must pass
+         3. **Security:** Run `bash scripts/security-check.sh` - must pass
+         4. **Tests:** Run `pnpm test:unit` (or `npm run test:unit`) - must pass
+       - **If any check fails, fix the issues before pushing**
+    9. **THEN push feature branch:** `git push -u origin feature/boss-initial-setup` (contains all bootstrap files, git will use GITHUB_TOKEN from environment automatically, which is set to same value as GITHUB_PERSONAL_ACCESS_TOKEN)
+    10. **Update project-config.json** with repository info (including final owner after transfer)
+    11. **Commit and push project-config.json:** `git add .boss/project-config.json && git commit -m "chore: update project-config.json" && git push`
+    12. **Mark `initialization.stage = "ready"`** in project-config.json
+    13. **Update `initialization.remoteCreated = true`** and `initialization.initialSetupComplete = true`
+    14. **Commit and push again:** `git add .boss/project-config.json && git commit -m "chore: mark initialization as ready" && git push`
+    15. **FINAL STEP - Create PR from feature/boss-initial-setup to main:** Use GitHub MCP `create_pull_request` with:
+        - **Title:** `"chore: BOSS initial setup - bootstrap files"`
+        - **Body:** `"This PR contains all BOSS bootstrap files and initial project structure. Ready for review and merge."`
+        - **Base branch:** `"main"`
+        - **Head branch:** `"feature/boss-initial-setup"`
+        - **DO NOT ask user** - create PR automatically
+  - [ ] **NEVER push feature branch before main branch** - empty main must be pushed first
+  - [ ] **After this, NEVER push directly to main** - main branch is protected, use PRs for future changes
+  - [ ] Report completion to user with PR link
+
+**Important Notes:**
+- BOSS uses git commands for orchestration (branches, pushes, merges) - git CLI is allowed and expected
+- Workers use Container-Use MCP for their git operations (automatic)
+- ALWAYS update `.boss/project-config.json` to reflect status changes, then commit and push immediately
+- ALWAYS ask user for repository preferences before creating
+- Default to private repositories unless user specifies otherwise
+- **CRITICAL:** Main branch MUST be protected before any pushes - require PRs for all changes
+- **NEVER push directly to main branch** - always push to feature branch and create PR
+- **ALWAYS create PRs automatically** - never ask user if they want a PR created
+- **MINIMIZE status checks** - only check worker/environment status when necessary, not repeatedly
+

package/dist/assets/claude-folder/rules/boss-workflow.md

@@ -0,0 +1,33 @@
+# BOSS Workflow Rules
+
+## Spec-Kit Phases
+
+Follow the 8-phase Spec-Kit methodology:
+
+1. **Constitution** - Create/update constitution.md
+2. **Clarification** - Gather business requirements
+3. **Specification** - Write user stories (Given/When/Then)
+4. **Planning** - Create technical plan
+5. **Validation** - Validate against constitution
+6. **Task Breakdown** - Create tasks.md with [P] markers
+7. **Implementation** - TDD + BDD implementation
+8. **Consolidation** - Merge and create delivery artifacts
+
+## Worker Coordination
+
+- Workers execute in parallel when tasks marked with [P]
+- Each worker in isolated container-use environment
+- Workers use Spec-Kit templates from \`.specify/templates/\`
+
+## Quality Gates
+
+- All quality gates must pass before merging
+- Coverage and mutation thresholds are enforced
+- Documentation must be complete
+
+## Communication Standards
+
+- **CRITICAL:** Use plain text only when communicating with workers - NO emojis
+- All messages, instructions, prompts, and feedback to workers must be in plain text format
+- Emojis should not be used in worker prompts, Container-Use instructions, or any worker-related communication
+

package/dist/assets/claude-folder/rules/code-style.md

@@ -0,0 +1,23 @@
+# Code Style
+
+## TypeScript
+
+- Use strict TypeScript configuration
+- Prefer explicit types over `any`
+- Use interfaces for object shapes
+- Use enums for constants
+
+## Naming Conventions
+
+- Use camelCase for variables and functions
+- Use PascalCase for classes and types
+- Use UPPER_CASE for constants
+- Use kebab-case for file names
+
+## Formatting
+
+- Use 2 spaces for indentation
+- Use semicolons
+- Use single quotes for strings
+- Trailing commas in multi-line objects/arrays
+

package/dist/assets/claude-folder/rules/security.md

@@ -0,0 +1,22 @@
+# Security Guidelines
+
+## Secrets Management
+
+- NEVER commit secrets to git
+- Use 1Password vault "boss" for all secrets
+- Reference secrets via \`op://boss/credential/needed\` format
+- Secrets are injected at runtime via container-use
+
+## Dependencies
+
+- Keep dependencies up to date
+- Use security scanning tools
+- Review dependency changes in PRs
+
+## Code Security
+
+- Validate all user input
+- Use parameterized queries for database
+- Implement proper authentication/authorization
+- Follow OWASP guidelines
+

package/dist/assets/claude-folder/rules/testing.md

@@ -0,0 +1,32 @@
+# Testing Requirements
+
+## Test-First (NON-NEGOTIABLE)
+
+- Write tests BEFORE implementation
+- Follow TDD cycle: red → green → refactor
+- All tests must pass before committing
+
+## BDD (Mandatory)
+
+- Use Given/When/Then format for test descriptions
+- Use BDD test frameworks (Cucumber, Gherkin, or equivalent)
+- Tests should read like specifications
+
+## Coverage
+
+- Unit tests: ≥80% coverage
+- Integration tests: Required for all API endpoints
+- Mutation testing: ≥80% score
+
+## Test Structure
+
+\`\`\`
+describe('Feature Name', () => {
+  describe('Given [context]', () => {
+    it('When [action], Then [expected result]', () => {
+      // Test implementation
+    });
+  });
+});
+\`\`\`
+

package/dist/assets/claude-folder/settings.local.json

@@ -0,0 +1,88 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(test:*)",
+      "Bash(grep:*)",
+      "Bash(cat:*)",
+      "Bash(ls:*)",
+      "Bash(echo:*)",
+      "Bash(curl:*)",
+      "Bash(pnpm:*)",
+      "Bash(npm:*)",
+      "Bash(bash scripts/security-check.sh)",
+      "Bash(cat .boss/project-config.json)",
+      "Bash(ls .boss/)",
+      "Bash(ls -la .boss/)",
+      "Bash(git commit:*)",
+      "Bash(git merge:*)",
+      "Bash(git pull:*)",
+      "Bash(git push:*)",
+      "Bash(git add:*)",
+      "Bash(git branch:*)",
+      "Bash(git checkout:*)",
+      "Bash(git log:*)",
+      "Bash(git ls-tree:*)",
+      "Bash(git remote:*)",
+      "Bash(git show:*)",
+      "Bash(git status:*)",
+      "Bash(rm ./*)",
+      "Bash(rm -f ./*)",
+      "Bash(rm ./.*)",
+      "Bash(rm -f ./.*)",
+      "Bash(rm ./**/*)",
+      "Bash(rm -f ./**/*)",
+      "Read(*)",
+      "Read(**)",
+      "Read(.*)",
+      "Read(.*/**)",
+      "Read(.boss/**)",
+      "Read(.boss/project-config.json)",
+      "Write(*)",
+      "Write(**)",
+      "Write(.*)",
+      "Write(.*/**)",
+      "Write(.boss/**)",
+      "Write(.boss/project-config.json)",
+      "Edit(*)",
+      "Edit(**)",
+      "Edit(.*)",
+      "Edit(.*/**)",
+      "Edit(.boss/**)",
+      "Edit(.boss/project-config.json)",
+      "Delete(*)",
+      "Delete(**)"
+    ],
+    "ask": [
+      "Bash(rm -rf ./*)"
+    ],
+    "deny": [
+      "Bash(rm //etc/**)",
+      "Bash(rm //usr/**)",
+      "Bash(rm //var/**)",
+      "Bash(rm //home/**)",
+      "Bash(rm -f //etc/**)",
+      "Bash(rm -f //usr/**)",
+      "Bash(rm -f //var/**)",
+      "Bash(rm -rf //etc/**)",
+      "Bash(rm -rf //usr/**)",
+      "Bash(rm -rf //var/**)",
+      "Read(//etc/**)",
+      "Read(//usr/**)",
+      "Read(//var/**)",
+      "Read(//root/**)",
+      "Read(//tmp/**)",
+      "Write(//etc/**)",
+      "Write(//usr/**)",
+      "Write(//var/**)",
+      "Write(//root/**)",
+      "Edit(//etc/**)",
+      "Edit(//usr/**)",
+      "Edit(//var/**)",
+      "Edit(//root/**)",
+      "Delete(//etc/**)",
+      "Delete(//usr/**)",
+      "Delete(//var/**)",
+      "Delete(//root/**)"
+    ]
+  }
+}