@gspothq/cli 0.0.0-stage → 0.1.1

package/configurations/framework/vue/rules/VUE.md

@@ -0,0 +1,41 @@
+# Vue
+
+These rules cover Vue 3 single-file components, reactivity, props and events, templates, and stores.
+
+## Components
+
+<!-- level: all -->
+
+- Use `computed` for derived template values.
+- Pass a prop or call an exposed method instead of changing state through a template ref.
+
+## Props and events
+
+- Require a prop when the component cannot operate without it. An optional prop can remain
+  undefined when absence has defined behavior; supply a default only when that matches the contract.
+
+### Event naming
+
+<!-- level: all -->
+
+Name an event for what happened, in the past tense or as a noun: `saved`, `update:modelValue`.
+
+## Reactivity
+
+- Use `ref` for a value and `reactive` for an object that keeps the same identity. Do not destructure a reactive object.
+- Derive with `computed`.
+- Use `watch` for an effect outside Vue: a request, a timer, storage. Do not use it to derive state.
+- Clean up in `onUnmounted`, or in the cleanup callback of the watcher, whatever a component started.
+
+## State and data
+
+<!-- level: all -->
+
+- Local state stays in the component. Shared state goes in a store, one store for each domain.
+- A store exposes actions that say what happened. Components do not assign to store state.
+- Fetch data in a composable or a store action, never inline in a template event.
+- Name a composable `use` and its subject, such as `useCart`, and returns reactive values when callers need reactivity.
+
+## Tests
+
+- Test a composable as a function, with no component around it where it needs none.

package/configurations/general/commits/manifest.toml

@@ -0,0 +1,111 @@
+[configuration]
+title = "Commits"
+always_selected = true
+when = { git = true }
+description = "Checks commit messages for a conventional type, an optional project scope, a first line of 72 characters or fewer, and a wrapped body."
+
+[files]
+paths = ["**"]
+
+[[tool]]
+name = "commitlint"
+version = "21.2.2"
+npm = "@commitlint/cli"
+mise = "npm:@commitlint/cli"
+[[tool.replace]]
+file = ".commitlintrc"
+shared = false
+
+[[tool.replace]]
+file = ".commitlintrc.json"
+shared = false
+
+[[tool.replace]]
+file = ".commitlintrc.yml"
+shared = false
+
+[[tool.replace]]
+file = ".commitlintrc.yaml"
+shared = false
+
+[[tool.replace]]
+file = ".commitlintrc.js"
+shared = false
+
+[[tool.replace]]
+file = ".commitlintrc.cjs"
+shared = false
+
+[[tool.replace]]
+file = ".commitlintrc.mjs"
+shared = false
+
+[[tool.replace]]
+file = ".commitlintrc.ts"
+shared = false
+
+[[tool.replace]]
+file = ".commitlintrc.cts"
+shared = false
+
+[[tool.replace]]
+file = ".commitlintrc.mts"
+shared = false
+
+[[tool.replace]]
+file = "commitlint.config.js"
+shared = false
+
+[[tool.replace]]
+file = "commitlint.config.cjs"
+shared = false
+
+[[tool.replace]]
+file = "commitlint.config.mjs"
+shared = false
+
+[[tool.replace]]
+file = "commitlint.config.ts"
+shared = false
+
+[[tool.replace]]
+file = "commitlint.config.cts"
+shared = false
+
+[[tool.replace]]
+file = "commitlint.config.mts"
+shared = false
+
+[[tool.replace]]
+file = "package.json"
+key = "commitlint"
+redirect = true
+shared = true
+
+[[tool_file]]
+target = ".gspot/config/commitlint.config.cjs"
+tool = "commitlint"
+rule_keys = ["rules"]
+
+[[check]]
+name = "commitlint"
+example = "The proposed message `changed stuff` lacks the configured conventional-commit structure. A message such as `fix(cli): report missing configuration` supplies a type, scope, and subject. Use a type and scope accepted by the repository policy."
+level = "all"
+stage = "message"
+command = ["commitlint", "--config", "{tool_file:commitlint}", "--edit", "{message_file}"]
+output = { format = "regex", pattern = "^\\s*[✖⚠]\\s+(?<message>.*?)\\s+\\[(?<rule>[a-z-]+)\\]\\s*$" }
+summary = "Checks the commit message being written: a conventional type, an optional known scope, a first line of 72 characters or fewer, and a wrapped body."
+why = "A history of typed, scoped subjects is what release notes, blame and bisect are read from; a free-form message hides the change."
+help = "Write `<type>`: `<subject>` or `<type>`(`<scope>`): `<subject>`, with an accepted type and optional scope. Keep the whole first line at 72 characters or fewer. Change accepted types with gspot set tools.commitlint.types."
+
+[[check]]
+name = "commitlint-pushed"
+example = "A new commit with message `changed stuff` causes the checked range to fail its message rules. Reword that commit to an accepted message such as `fix(cli): report missing configuration`. Rewriting commits changes their IDs; coordinate before rewriting shared history."
+level = "all"
+stage = "push"
+runs = "history"
+tool = "commitlint"
+output = { format = "regex", pattern = "^\\s*[✖⚠]\\s+(?<message>.*?)\\s+\\[(?<rule>[a-z-]+)\\]\\s*$" }
+summary = "Checks the message of every commit the push sends. Run by hand, it checks every commit from the upstream merge base to HEAD."
+why = "A message written past the hook (--no-verify, a rebase, a merge) still reaches the shared branch unless the push checks it."
+help = "Reword the commits that fail with git rebase -i, or change the rule with gspot set tools.commitlint.rules."

package/configurations/general/commits/rules/GIT.md

@@ -0,0 +1,31 @@
+# Git
+
+## Working with uncommitted changes
+
+Changes you did not make may belong to another agent or contributor working in parallel. Do not
+revert, stash, clean, or overwrite them. Keep working beside them, and ask the user only when your
+change overwrites or contradicts one.
+
+## Commits
+
+- Commit only when the user asks.
+- One change per commit. Put a rename and a behavior change in two commits.
+- The body says what changed and why.
+- Footers reference issues with `Refs: #123` or `Closes: #123`, and breaking changes with `BREAKING CHANGE: ...`.
+- Never bypass hooks with `--no-verify`.
+
+## Branches
+
+- Name branches `<type>/<kebab-summary>`, such as `feat/order-export` or `fix/session-expiry`.
+- Never force-push a protected branch. Force-push your own branch only after a rebase you performed.
+- Rebase onto the default branch before opening a pull request; do not merge the default branch into a feature branch.
+
+## Files to keep out of commits
+
+- Editor state such as `.vscode/`, `.idea/`, or `xcuserdata/`, except settings the team commits on purpose.
+
+## Pull requests
+
+- Use the commit subject as the title when the branch has one commit. Otherwise, write a sentence for the whole change.
+- The description states what changed, why, and which checks verified it. It links the issue.
+- A pull request does one thing. Unrelated fixes found on the way go in a separate branch.

package/configurations/general/coverage/manifest.toml

@@ -0,0 +1,3 @@
+[configuration]
+title = "Coverage"
+description = "Coverage floors shared by test runners."

package/configurations/general/dependencies/manifest.toml

@@ -0,0 +1,159 @@
+prefix_collisions = { prefixes = ["package", "pnpm"] }
+
+[configuration]
+title = "Dependencies"
+always_selected = true
+description = "Dependency health: known advisories, one version for each dependency, exact pins, one package manager, and a lockfile that matches its manifest."
+
+[files]
+filenames = ["package.json", "bun.lock", "bun.lockb", "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bunfig.toml", ".npmrc", "pnpm-workspace.yaml", "pyproject.toml", "uv.lock", "requirements*.txt", "Package.swift", "Package.resolved", "Cargo.toml", "Cargo.lock", "go.mod", "go.sum", "Gemfile.lock"]
+kinds = ["source", "generated"]
+
+[[tool]]
+name = "osv-scanner"
+version = "2.6.0"
+min_version = "2.0.0"
+mise = "osv-scanner"
+brew = "osv-scanner"
+github = { name = "google/osv-scanner", version = "v2.6.0" }
+winget = "Google.OSVScanner"
+scoop = "osv-scanner"
+[[tool.replace]]
+file = "osv-scanner.toml"
+shared = false
+
+[[tool]]
+name = "syncpack"
+version = "15.3.3"
+npm = "syncpack"
+mise = "npm:syncpack"
+[[tool.replace]]
+file = ".syncpackrc"
+shared = false
+
+[[tool.replace]]
+file = ".syncpackrc.json"
+shared = false
+
+[[tool.replace]]
+file = ".syncpackrc.yaml"
+shared = false
+
+[[tool.replace]]
+file = ".syncpackrc.yml"
+shared = false
+
+[[tool.replace]]
+file = ".syncpackrc.ts"
+shared = false
+
+[[tool.replace]]
+file = ".syncpackrc.mjs"
+shared = false
+
+[[tool.replace]]
+file = ".syncpackrc.js"
+shared = false
+
+[[tool.replace]]
+file = ".syncpackrc.cjs"
+shared = false
+
+[[tool.replace]]
+file = "syncpack.config.js"
+shared = false
+
+[[tool.replace]]
+file = "syncpack.config.cjs"
+shared = false
+
+[[tool.replace]]
+file = "syncpack.config.mjs"
+shared = false
+
+[[tool.replace]]
+file = "syncpack.config.ts"
+shared = false
+
+[[tool_file]]
+target = ".gspot/config/osv-scanner.toml"
+tool = "osv-scanner"
+
+[[tool_file]]
+source = "syncpack.json"
+target = ".gspot/config/syncpack.json"
+tool = "syncpack"
+
+[[check]]
+name = "osv"
+example = "A locked dependency version affected by a published OSV advisory reports the package and advisory. Upgrade to a reviewed fixed version and update the lockfile, then rescan."
+level = "recommended"
+stage = "push"
+runs = "once"
+needs = ["network"]
+files = { filenames = ["bun.lock", "package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "go.mod", "Cargo.lock", "Gemfile.lock", "gems.locked", "requirements.txt", "Pipfile.lock", "poetry.lock", "pdm.lock", "pylock.toml", "uv.lock", "pom.xml", "gradle.lockfile", "buildscript-gradle.lockfile", "conan.lock", "pubspec.lock", "mix.lock", "cabal.project.freeze", "stack.yaml.lock", "composer.lock", "renv.lock", "packages.config", "packages.lock.json", "*.deps.json"], paths = ["**/gradle/verification-metadata.xml", "gradle/verification-metadata.xml"], kinds = ["source", "generated"] }
+# The tool project lockfiles under .gspot stay out: a repository cannot upgrade a package that a gspot tool pins.
+command = ["osv-scanner", "scan", "source", "--config", "{tool_file:osv-scanner}", "--format", "json", "--allow-no-lockfiles", "--recursive", "--experimental-exclude", ".gspot", "{root}"]
+output = { format = "json", items = "results", children = "packages.vulnerabilities", fields = { file = "source.path", rule = "id", message = "package.name package.version summary" } }
+summary = "Looks up every locked dependency in the Open Source Vulnerabilities (OSV) advisory database."
+why = "An advisory identifies a vulnerability in a dependency version."
+help = "Upgrade the package the finding names. When no fix exists, accept the advisory with `gspot ignore dependencies/osv --rule <advisory-id> --reason \"<why>\" --until <YYYY-MM-DD>`. Recheck it before that date."
+
+[[check]]
+name = "syncpack"
+example = "Two workspace manifests declaring different versions of a dependency governed by the same version group report a mismatch. Align both declarations to the reviewed version and update the lockfile."
+level = "all"
+stage = "push"
+runs = "once"
+command = ["syncpack", "lint", "--config", "{tool_file:syncpack}"]
+tool = "syncpack"
+files = { filenames = ["package.json"] }
+output = { format = "lines" }
+summary = "Checks that every workspace package resolves each dependency to one version."
+why = "Two versions of one dependency in a workspace mean two behaviors, and a bug that appears in one package only."
+help = "Run syncpack fix --config .gspot/config/syncpack.json, or align the versions by hand."
+
+[[check]]
+name = "package-json"
+example = "A repository with both `bun.lock` and `package-lock.json` reports a second lockfile. Delete the lockfile of the package manager the repository does not use."
+level = "all"
+stage = "commit"
+runs = "once"
+files = { filenames = ["package.json"] }
+summary = "Checks every package.json: the root names a packageManager, every package names the same one, a workspace root is private, and only one kind of lockfile exists."
+why = "Two package managers install two different trees."
+help = "Name one packageManager in the root package.json, use it in every package, mark a workspace root private, and delete the other lockfile."
+
+[[check]]
+name = "stale-lockfile"
+example = "Adding a dependency to a package manifest without updating its lockfile reports an outdated lockfile. Run the owning package manager installation, inspect its manifest and lockfile changes, and retain both together."
+level = "recommended"
+stage = "push"
+runs = "once"
+needs = ["network"]
+files = { filenames = ["package.json", "bun.lock", "package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "pyproject.toml", "uv.lock"] }
+summary = "Runs each package manager's frozen install in a temporary copy."
+why = "A lockfile that lags its manifest installs versions nobody reviewed the moment someone runs a plain install."
+help = "Run the install of the package manager once and commit the lockfile it writes."
+
+[[check]]
+name = "bun-release-age"
+example = "A Bun project without the required `[install] minimumReleaseAge` reports a missing installation safeguard. Set it to the seconds named in the finding and configure the required scanner under `[install.security]`."
+level = "all"
+stage = "commit"
+runs = "scope"
+files = { filenames = ["bunfig.toml", "bun.lock", "bun.lockb"], kinds = ["source", "generated"] }
+summary = "Checks each Bun project's bunfig.toml for the required minimum release age and security scanner."
+why = "Most malicious releases are pulled within days, so a package nobody installs in its first week rarely harms anybody."
+help = "Set [install] minimumReleaseAge in bunfig.toml to the seconds the message names, and the scanner under [install.security]."
+
+[[check]]
+name = "lockfile-hosts"
+example = "A locked package URL pointing to a host outside `dependencies.allowed_registries` reports that host. Resolve the package again from the approved registry, or review and explicitly allow the required host."
+level = "recommended"
+stage = "commit"
+runs = "scope"
+files = { filenames = ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock", "bun.lock"], kinds = ["source", "generated"] }
+summary = "Checks that npm, pnpm, Yarn, and text Bun lockfile downloads in each project scope use HTTPS and allowed registry hosts."
+why = "A lockfile line that resolves from another host installs code nobody chose, and a review rarely reads lockfiles."
+help = "Install the package from the registry again, or add the host to dependencies.allowed_registries."

package/configurations/general/dependencies/rules/DEPENDENCIES.md

@@ -0,0 +1,30 @@
+# Dependencies
+
+## Adding one
+
+- Do not add a dependency for a one-line native API, a small local helper, or an array, object, or
+  string utility. Use the platform first, then what the repository already depends on.
+- A new dependency needs a reason in the commit: what it does that the platform and existing
+  dependencies do not.
+- Prefer a package that does one thing, receives maintenance, publishes types, and has no install scripts.
+- Each project uses one package manager and commits its lockfile. CI and Docker builds install
+  from the lockfile without changing it such as `npm ci`, `uv sync --frozen`.
+
+## Versions
+
+- Pin exact versions in an application. A published library keeps ranges for its dependencies and peers.
+- Pin the runtime version once for Node, Python, Bun, or the Swift toolchain. Every file that
+  states it agrees.
+- If the package manager refuses a release as too new, pick an older one or ask the user.
+- Upgrade one dependency per commit with the reason. Never upgrade broadly to satisfy a scanner
+  without reading what changed.
+
+## Policy
+
+- Ask the user before you add a dependency whose license falls outside the allowed list.
+- Record a known advisory that has no fix in `[[ignore]]`, with the check, advisory ID, reason,
+  and expiry. Never ignore advisories in bulk.
+- Declare vendored code and record its upstream version and license. Change it only by updating
+  it from upstream.
+- Remove dependencies when no runtime, build, tooling, or public peer dependency needs them.
+  Before you remove a package that a check calls unused, search configuration and scripts for it.

package/configurations/general/dependencies/syncpack.json

@@ -0,0 +1,15 @@
+{
+    "versionGroups": [
+        {
+            "label": "A workspace package is versioned by its own release, and a private root has no version.",
+            "dependencyTypes": ["local"],
+            "isIgnored": true
+        },
+        {
+            "label": "Every dependency resolves to one version across the workspace.",
+            "packages": ["**"],
+            "dependencies": ["**"],
+            "policy": "sameRange"
+        }
+    ]
+}

package/configurations/general/docs/manifest.toml

@@ -0,0 +1,79 @@
+[configuration]
+title = "Docs"
+always_selected = true
+description = "Documentation integrity: links and anchors, banned headings, stale paths, the README of every scope, and its shape."
+
+[files]
+extensions = [".md", ".mdx"]
+filenames = ["CLAUDE.md", "AGENTS.md", "README.md"]
+
+[[tool]]
+name = "lychee"
+version = "0.24.2"
+mise = "lychee"
+brew = "lychee"
+cargo = "lychee"
+github = { name = "lycheeverse/lychee", version = "lychee-v0.24.2" }
+[[tool.replace]]
+file = "lychee.toml"
+shared = false
+
+[[tool.replace]]
+file = ".lycheeignore"
+shared = false
+
+[[tool_file]]
+target = ".gspot/config/lychee.toml"
+tool = "lychee"
+per_scope = true
+
+[[check]]
+name = "lychee"
+example = "The Markdown link `[Setup](missing.md)` reports a missing local target when `missing.md` does not exist. Point it at the actual setup guide or add the intended document."
+level = "recommended"
+stage = "commit"
+command = ["lychee", "--config", "{tool_file:lychee}", "--offline", "--include-fragments=full", "--format", "detailed", "--no-progress", "{files}"]
+output = { format = "grouped", file_pattern = "^Errors in (?<file>.+)$", pattern = "^\\[(?<rule>[A-Z0-9]+)\\] (?<message>\\S+(?: \\(at (?<line>\\d+):(?<column>\\d+)\\))? \\| .*)$" }
+summary = "Checks that local documentation links reach existing files and valid anchor or text fragments."
+why = "A dead link inside the repository is a promise the docs broke without anyone noticing."
+help = "Point the link at the file or heading that exists, or delete it."
+
+[[check]]
+name = "lychee-external"
+example = "A documentation link returning HTTP 404 reports a broken external destination. Replace it with a verified current URL or remove the obsolete link, then rerun with network access."
+level = "recommended"
+stage = "manual"
+needs = ["network"]
+command = ["lychee", "--config", "{tool_file:lychee}", "--root-dir", "{root}", "--scheme", "http", "--scheme", "https", "--include-fragments=full", "--format", "detailed", "--no-progress", "{files}"]
+output = { format = "grouped", file_pattern = "^Errors in (?<file>.+)$", pattern = "^\\[(?<rule>[A-Z0-9]+)\\] (?<message>\\S+(?: \\(at (?<line>\\d+):(?<column>\\d+)\\))? \\| .*)$" }
+summary = "Checks every external link over the network."
+why = "An external link rots on its own schedule; this run says which ones did."
+help = "Update or remove the link, or exclude the URL pattern with a reason under docs.allowed_urls."
+
+[[check]]
+name = "missing-paths"
+example = "A documented repository path that no longer exists reports a stale reference. Update the path and any associated command to the current owner, then verify the procedure from its stated working directory."
+runs = "once"
+level = "recommended"
+stage = "commit"
+summary = "Checks that documented paths name tracked files and mise, npm, pnpm, yarn, and bun run commands name tasks or scripts in their project."
+why = "A path in the docs that nothing tracks sends the reader to a file that is gone."
+help = "Fix the path or the task name. Give an example code block a title= attribute."
+
+[[check]]
+name = "required-files"
+example = "A configured scope without `README.md` reports the missing README. Add one that explains its purpose and setup. The repository root also needs a license when license presence is required."
+level = "all"
+stage = "commit"
+summary = "Checks that every scope has a README.md and the root has a LICENSE."
+why = "A scope with no README is a door with no sign."
+help = "Write the README; the docs rule files say what goes in it."
+
+[[check]]
+name = "readme-shape"
+example = "A README with more H2 headings than limits.docs.headings_before_contents reports a missing Contents section. Add the section. A scope-root README also needs an opening paragraph and a section named install, setup, start, or requirements."
+level = "all"
+stage = "commit"
+summary = "Checks the shape of every README: an opening paragraph, a Contents list when long, a section on getting started."
+why = "A README with the right shape answers what this is and how to start before the reader scrolls."
+help = "Add the missing section or paragraph. For an accepted exception, run gspot ignore docs/readme-shape --paths `<glob>` --reason \"`<why>`\"."

package/configurations/general/docs/rules/DOCS.md

@@ -0,0 +1,86 @@
+# Documentation
+
+## Before you write
+
+Read the implementation and existing pages. Identify the reader, their task, starting state,
+permissions, and risks. Describe supported behavior. State limitations that rule out use before setup.
+
+Keep durable product information in its documentation. Link to its reference instead of copying
+procedures or configuration tables. When behavior changes, update the reference and examples.
+
+## Pages
+
+Give each page one purpose and a title that names its task or subject. Explain its purpose before
+its sections. Keep the shortest successful path in the README and link to specialist guides.
+Document real subprojects. Describe behavior instead of adding folder trees or file inventories.
+Mention a path only when the reader must use it.
+
+Use the renderer's Markdown. Keep routine pages free of custom layout HTML or CSS. A component
+that some viewers cannot show needs a text alternative. Use paragraphs, lists, and tables to match
+what readers need to compare.
+
+Use inline code for exact commands, values, fields, and identifiers.
+Bold names an interface control. Blockquotes hold attributed source text.
+
+Keep required instructions outside collapsed panels. Delete obsolete content. Comments explain
+maintenance constraints and contain no private discussions or product history. A badge belongs
+only where its accurate state affects a reader's decision.
+
+## Examples and procedures
+
+An example teaches one idea and uses the supported API. Include imports, setup, and the context
+readers need. Label an incomplete fragment and say what it omits. Keep volatile output out of
+examples unless the public API defines its exact text.
+
+State the starting directory and prerequisites before commands. Explain placeholders. Separate
+output from commands, or comment output where a copied block must run. State the expected result
+when the result does not make success clear. Give each platform alternative a complete procedure.
+
+A destructive step names its scope, irreversible effects, backup, and recovery before the action.
+Keep permissions, verification, and recovery beside the steps that need them. Use secure defaults
+and least privilege. Examples do not silently turn off access checks.
+Keep authentication, retries, and advanced variants outside minimal examples unless needed for correctness.
+
+Start troubleshooting with the observable symptom and common causes. Diagnose before a reset or
+other destructive recovery. Preserve exact public errors and remove private data from examples.
+
+## Reference pages
+
+Use the names and values of the API the page documents. Explain public behavior without requiring
+readers to inspect its code. A command reference covers inputs, outputs, exit codes, working folder,
+permissions, and side effects. An API reference covers identity, inputs, outputs, failures,
+pagination, and limits. A library reference covers initialization, cleanup, concurrency, errors,
+compatibility, and types. A settings reference covers scope, precedence, defaults, secrets, and reloads.
+
+Show settings with their parent keys. Distinguish missing, empty, and null values when they act
+differently. Explain required environment variable formats and failures.
+Describe releases by their effect on readers and required actions.
+
+A known issue states its trigger,
+risk, and verified workaround. A deprecation names support, replacement, and migration. A retirement
+names the unavailable functions. Security disclosures follow the project's disclosure policy.
+
+## Images and video
+
+Match the current interface and reproduce control labels exactly. Name controls by label.
+A screenshot adds to a text procedure. It does not replace instructions.
+
+Keep media with its
+editable source and license. Use screenshots for interfaces, diagrams for relationships, and
+charts for data. Add media when text alone does not explain the information. Report stale media.
+
+A video needs captions and a transcript for information absent from the page. Keep the full
+procedure in text. Do not embed trackers or commit video outside the project's asset workflow.
+Follow the accessibility rules for alt text and color.
+
+Keep diagrams small and give equal concepts
+equal shapes. Prefer editable diagrams and descriptive file names. List keyboard shortcuts and
+platform steps in the same order each time.
+
+## Links
+
+Use maintained primary sources for external APIs and relative paths for repository content.
+Link text identifies the destination. A public procedure states any account or permission needed
+to open a required page.
+See [Diátaxis](https://diataxis.fr/), [Google's documentation guidance](https://developers.google.com/style),
+and [W3C image guidance](https://www.w3.org/WAI/tutorials/images/).

package/configurations/general/duplication/manifest.toml

@@ -0,0 +1,32 @@
+[configuration]
+title = "Duplication"
+always_selected = true
+description = "Copy-paste detection across every language a selected configuration claims, with a ceiling for the share of duplicated lines."
+
+[files]
+languages = true
+
+[[tool]]
+name = "jscpd"
+version = "5.2.0"
+npm = "jscpd"
+mise = "npm:jscpd"
+[[tool.replace]]
+file = ".jscpd.json"
+shared = false
+
+[[tool_file]]
+target = ".gspot/config/jscpd.json"
+tool = "jscpd"
+
+[[check]]
+name = "jscpd"
+example = "Two selected files containing the same substantial code block can exceed the configured duplication threshold. Move the shared behavior into its actual owner and call it from both locations, then rerun."
+level = "all"
+stage = "push"
+runs = "scope"
+files = { languages = true }
+tool = "jscpd"
+summary = "Finds blocks of code copied between files. While the duplicated share stays at or under the ceiling it passes, and over it every copy is a finding that names both places."
+why = "A copied block is fixed in one place and stays broken in the other."
+help = "Move the shared block into one function both callers use, or raise limits.duplication.percent with a reason."

package/configurations/general/engineering/manifest.toml

@@ -0,0 +1,8 @@
+allowed_words = ["Bun", "Node", "npm", "pnpm", "mise", "CI", "macOS", "Linux", "Windows", "CSRF", "ASD"]
+[configuration]
+title = "Engineering guidance"
+always_selected = true
+description = "Rules on how to work and how to write code. The `[rules]` setting turns them on or off."
+
+[rules]
+"ACCESSIBILITY.md" = { filenames = ["*.html", "*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.swift"] }

package/configurations/general/engineering/rules/agent/PLANNING.md

@@ -0,0 +1,42 @@
+# Planning
+
+## Complete change content
+
+A plan holds the complete content of every change it proposes, so another agent can carry it
+out without inventing anything.
+
+- Show the exact diff of every code, configuration, documentation, schema, and text change, and
+  the full contents of every new file. Do not summarize a change the diff can show.
+- Name every command that creates, moves, renames, regenerates, or deletes a file, and every
+  generated file the change rewrites.
+- For an image or another binary file, give the source path, the output path, the operation, and
+  the command that reproduces it.
+- Leave no placeholder such as `update accordingly`, `adjust imports`, or `fix any errors`.
+
+Bad:
+
+```text
+Update the settings screen copy.
+```
+
+Good:
+
+```diff
+--- a/app/settings/page.tsx
++++ b/app/settings/page.tsx
+-<h1>Old title</h1>
++<h1>Account settings</h1>
+```
+
+## Order and detail
+
+One step holds one change. Order the steps so each one builds on finished work. Change
+a shared interface before its callers, and move a module before the imports that point at it.
+Generated output follows the source that produces it, and cleanup follows the last caller.
+
+Say why the steps run in that order, and name the constraints and assumptions that affect them.
+Mention an edge case only when it belongs to the requested work.
+
+## Verification steps
+
+A plan verifies the requested change.

package/configurations/general/engineering/rules/agent/SUPPRESSIONS.md

@@ -0,0 +1,16 @@
+# Suppressions
+
+A suppression turns a rule off for one place, and it carries a reason.
+
+- Write the reason on the same line or directly above, in the form `reason: <sentence>.`. It says
+  why the rule does not apply here, not the content of the rule.
+- Scope a suppression to the narrowest thing that works: one rule, one line, one symbol. A
+  file-wide suppression needs a reason that applies to the whole file.
+- Suppress only when the rule misjudges this line. When the code breaks the rule, fix the code.
+- Delete a suppression with no remaining cause. Never add filler statements to pass a check.
+
+The forms differ by language. Apply the same rule to all of them: the ESLint
+disable comment, the Ruff `noqa`, the type-checker ignore, the SwiftLint disable, the ShellCheck
+disable. gspot refuses Semgrep and Vale directives.
+
+To accept a finding without changing the code, run `gspot ignore <check>` with a reason. Ask the user first.