@haposoft/cafekit 0.15.1 → 0.16.0-rc.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (99) hide show
  1. package/README.md +6 -2
  2. package/bin/__tests__/codex-hooks.test.js +140 -0
  3. package/bin/__tests__/codex-native.test.js +230 -2
  4. package/bin/__tests__/develop-contract.test.js +1120 -0
  5. package/bin/__tests__/installer-safety.test.js +553 -2
  6. package/bin/__tests__/package-inventory.test.js +258 -0
  7. package/bin/__tests__/secret-scanner.test.js +157 -0
  8. package/bin/__tests__/validator-grounding.test.js +713 -0
  9. package/bin/install.js +5 -1
  10. package/bin/lib/codex-install.js +21 -6
  11. package/bin/lib/context.js +17 -6
  12. package/bin/lib/copy-utils.js +31 -0
  13. package/bin/lib/i18n.js +12 -3
  14. package/bin/lib/instruction-blocks.js +85 -0
  15. package/bin/lib/managed-writer.js +4 -1
  16. package/bin/lib/opencode-install.js +75 -30
  17. package/bin/lib/skill-deps.js +45 -7
  18. package/bin/phases/claude-runtime.js +103 -4
  19. package/bin/phases/codex-runtime.js +41 -7
  20. package/bin/phases/post-install.js +29 -22
  21. package/bin/phases/root-config.js +89 -10
  22. package/bin/phases/select-platform.js +23 -0
  23. package/bin/phases/skills-setup.js +7 -3
  24. package/package.json +15 -5
  25. package/src/claude/CLAUDE.md +6 -122
  26. package/src/claude/agents/code-auditor.md +21 -22
  27. package/src/claude/agents/debugger.md +3 -3
  28. package/src/claude/agents/deployer.md +1 -1
  29. package/src/claude/agents/{god-developer.md → implementer.md} +2 -2
  30. package/src/claude/agents/project-manager.md +1 -1
  31. package/src/claude/agents/spec-maker.md +2 -2
  32. package/src/claude/hooks/__tests__/spec-gate.test.js +356 -5
  33. package/src/claude/hooks/agent.cjs +7 -14
  34. package/src/claude/hooks/rules.cjs +33 -53
  35. package/src/claude/hooks/spec-gate.cjs +66 -21
  36. package/src/claude/hooks/spec-state.cjs +5 -0
  37. package/src/claude/migration-manifest.json +9 -2
  38. package/src/claude/runtime.json +0 -3
  39. package/src/claude/scripts/generate-skill-catalog.cjs +1 -1
  40. package/src/claude/scripts/scan-staged-secrets.cjs +170 -0
  41. package/src/claude/scripts/spec-ground.cjs +189 -83
  42. package/src/claude/scripts/validate-spec-output.cjs +294 -30
  43. package/src/claude/scripts/workflow-policy.cjs +609 -0
  44. package/src/claude/skills/ai-multimodal/SKILL.md +2 -2
  45. package/src/claude/skills/ai-multimodal/references/audio-processing.md +6 -6
  46. package/src/claude/skills/ai-multimodal/references/video-analysis.md +1 -1
  47. package/src/claude/skills/backend-development/SKILL.md +4 -4
  48. package/src/claude/skills/backend-development/references/backend-architecture.md +1 -1
  49. package/src/claude/skills/backend-development/references/backend-devops.md +2 -2
  50. package/src/claude/skills/backend-development/references/backend-mindset.md +3 -3
  51. package/src/claude/skills/backend-development/references/backend-performance.md +5 -5
  52. package/src/claude/skills/backend-development/references/backend-security.md +3 -3
  53. package/src/claude/skills/backend-development/references/backend-technologies.md +5 -5
  54. package/src/claude/skills/backend-development/references/backend-testing.md +2 -2
  55. package/src/claude/skills/brainstorm/SKILL.md +2 -3
  56. package/src/claude/skills/chrome-devtools/scripts/package-lock.json +261 -150
  57. package/src/claude/skills/chrome-devtools/scripts/package.json +1 -1
  58. package/src/claude/skills/code-review/SKILL.md +12 -8
  59. package/src/claude/skills/code-review/references/verification-gate.md +4 -4
  60. package/src/claude/skills/debug/SKILL.md +2 -0
  61. package/src/claude/skills/develop/SKILL.md +100 -52
  62. package/src/claude/skills/develop/references/parallel-waves.md +105 -26
  63. package/src/claude/skills/develop/references/quality-gate.md +58 -38
  64. package/src/claude/skills/develop/references/subagent-patterns.md +2 -2
  65. package/src/claude/skills/git/SKILL.md +44 -50
  66. package/src/claude/skills/hotfix/SKILL.md +10 -8
  67. package/src/claude/skills/hotfix/references/parallel-patterns.md +2 -2
  68. package/src/claude/skills/hotfix/references/review-cycle.md +26 -21
  69. package/src/claude/skills/inspect/SKILL.md +12 -30
  70. package/src/claude/skills/mobile-development/SKILL.md +12 -12
  71. package/src/claude/skills/mobile-development/references/mobile-android.md +7 -7
  72. package/src/claude/skills/mobile-development/references/mobile-best-practices.md +22 -23
  73. package/src/claude/skills/mobile-development/references/mobile-frameworks.md +13 -13
  74. package/src/claude/skills/mobile-development/references/mobile-ios.md +1 -1
  75. package/src/claude/skills/mobile-development/references/mobile-mindset.md +17 -19
  76. package/src/claude/skills/pptx/scripts/package-lock.json +868 -0
  77. package/src/claude/skills/pptx/scripts/package.json +1 -1
  78. package/src/claude/skills/question/SKILL.md +13 -13
  79. package/src/claude/skills/research/SKILL.md +2 -2
  80. package/src/claude/skills/specs/SKILL.md +32 -15
  81. package/src/claude/skills/specs/references/review.md +3 -3
  82. package/src/claude/skills/specs/rules/tasks-generation.md +1 -1
  83. package/src/claude/skills/specs/templates/spec-state.json +7 -3
  84. package/src/claude/skills/sync/SKILL.md +26 -1
  85. package/src/claude/skills/sync/references/sync-protocols.md +3 -3
  86. package/src/claude/skills/test/SKILL.md +12 -4
  87. package/src/claude/skills/test/references/failure-triage.md +17 -17
  88. package/src/claude/skills/test/references/test-memory.md +2 -2
  89. package/src/codex/AGENTS.md +16 -24
  90. package/src/codex/hooks/lib/spec-receipt.cjs +57 -4
  91. package/src/codex/hooks/rules.cjs +27 -26
  92. package/src/codex/hooks/spec-gate.cjs +19 -8
  93. package/src/codex/hooks/spec-state.cjs +10 -1
  94. package/src/codex/hooks.json +14 -14
  95. package/src/common/AGENTS.md +43 -0
  96. package/src/opencode/AGENTS.md +21 -121
  97. package/src/opencode/plugins/rules.ts +26 -34
  98. package/src/opencode/plugins/spec-gate.ts +283 -0
  99. package/src/claude/skills/inspect/references/external-gemini-inspection.md +0 -169
@@ -59,13 +59,13 @@ See: `references/backend-technologies.md` for detailed comparisons
59
59
 
60
60
  ## Key Best Practices (2025)
61
61
 
62
- **Security:** Argon2id passwords, parameterized queries (98% SQL injection reduction), OAuth 2.1 + PKCE, rate limiting, security headers
62
+ **Security:** Argon2id passwords, parameterized queries prevent SQL injection, OAuth 2.1 + PKCE, rate limiting, security headers
63
63
 
64
- **Performance:** Redis caching (90% DB load reduction), database indexing (30% I/O reduction), CDN (50%+ latency cut), connection pooling
64
+ **Performance:** Redis caching reduces DB load, database indexing reduces I/O, CDN cuts latency, connection pooling
65
65
 
66
- **Testing:** 70-20-10 pyramid (unit-integration-E2E), Vitest 50% faster than Jest, contract testing for microservices, 83% migrations fail without tests
66
+ **Testing:** 70-20-10 pyramid (unit-integration-E2E), Vitest or Jest, contract testing for microservices, migration tests
67
67
 
68
- **DevOps:** Blue-green/canary deployments, feature flags (90% fewer failures), Kubernetes 84% adoption, Prometheus/Grafana monitoring, OpenTelemetry tracing
68
+ **DevOps:** Blue-green/canary deployments, feature flags can reduce failures, Kubernetes, Prometheus/Grafana monitoring, OpenTelemetry tracing
69
69
 
70
70
  ## Quick Decision Matrix
71
71
 
@@ -218,7 +218,7 @@ Shipping Service
218
218
 
219
219
  ## Event-Driven Architecture
220
220
 
221
- **Impact:** 85% organizations recognize business value
221
+ **Impact:** Organizations recognize business value
222
222
 
223
223
  ### Event Sourcing
224
224
 
@@ -50,7 +50,7 @@ kubectl rollout resume deployment/api
50
50
 
51
51
  ### Feature Flags (Progressive Delivery)
52
52
 
53
- **Impact:** 90% fewer deployment failures when combined with canary
53
+ **Impact:** Fewer deployment failures when combined with canary
54
54
 
55
55
  ```typescript
56
56
  import { LaunchDarkly } from 'launchdarkly-node-server-sdk';
@@ -105,7 +105,7 @@ CMD ["node", "dist/main.js"]
105
105
  ```
106
106
 
107
107
  **Benefits:**
108
- - Smaller image size (50-90% reduction)
108
+ - Smaller image size
109
109
  - Faster deployments
110
110
  - Reduced attack surface
111
111
 
@@ -105,7 +105,7 @@ const users = await db.query(`
105
105
 
106
106
  ### Technical Debt Management
107
107
 
108
- **20-40% productivity increase** from addressing technical debt properly
108
+ **Productivity increase** from addressing technical debt properly
109
109
 
110
110
  **Debt Quadrants:**
111
111
  1. **Reckless + Deliberate:** "We don't have time for design"
@@ -264,7 +264,7 @@ async function getUsers(limit?: number) {
264
264
 
265
265
  ### Testing Mindset (TDD/BDD)
266
266
 
267
- **70% happy-path tests drafted by AI, humans focus on edge cases**
267
+ **AI drafts happy-path tests, humans focus on edge cases**
268
268
 
269
269
  **Test-Driven Development (TDD):**
270
270
  ```
@@ -287,7 +287,7 @@ Feature: User Registration
287
287
 
288
288
  ### Observability and Debugging Approach
289
289
 
290
- **100% median ROI, $500k average return** from observability investments
290
+ **Positive ROI** from observability investments
291
291
 
292
292
  **Three Questions:**
293
293
  1. **Is it slow?** → Check metrics (response time, DB queries)
@@ -8,7 +8,7 @@ Performance optimization strategies, caching patterns, and scalability best prac
8
8
 
9
9
  #### Indexing Strategies
10
10
 
11
- **Impact:** 30% disk I/O reduction, 10-100x query speedup
11
+ **Impact:** Reduced disk I/O and faster queries
12
12
 
13
13
  ```sql
14
14
  -- Create index on frequently queried columns
@@ -88,7 +88,7 @@ const posts = await Post.findAll({
88
88
 
89
89
  ### Redis Caching
90
90
 
91
- **Impact:** 90% DB load reduction, 10-100x faster response
91
+ **Impact:** Reduced DB load and faster responses
92
92
 
93
93
  #### Cache-Aside Pattern (Lazy Loading)
94
94
 
@@ -140,7 +140,7 @@ await redis.keys('user:*').then(keys => redis.del(...keys));
140
140
 
141
141
  ```
142
142
  Client
143
- → CDN Cache (static assets, 50%+ latency reduction)
143
+ → CDN Cache (static assets, reduced latency)
144
144
  → API Gateway Cache (public endpoints)
145
145
  → Application Cache (Redis)
146
146
  → Database Query Cache
@@ -236,7 +236,7 @@ emailQueue.process('send-welcome', async (job) => {
236
236
 
237
237
  ## CDN (Content Delivery Network)
238
238
 
239
- **Impact:** 50%+ latency reduction for global users
239
+ **Impact:** Reduced latency for global users
240
240
 
241
241
  ### Configuration
242
242
 
@@ -302,7 +302,7 @@ const users = await replicaDb.users.findAll();
302
302
  ```
303
303
 
304
304
  **Use Cases:**
305
- - Read-heavy workloads (90%+ reads)
305
+ - Read-heavy workloads
306
306
  - Analytics queries
307
307
  - Reporting dashboards
308
308
 
@@ -11,7 +11,7 @@ Security best practices, OWASP Top 10 mitigation, and modern security standards
11
11
  ### Top Vulnerabilities & Mitigation
12
12
 
13
13
  #### 1. Broken Access Control
14
- **Risk:** Users access unauthorized resources (28% of vulnerabilities)
14
+ **Risk:** Users access unauthorized resources
15
15
 
16
16
  **Mitigation:**
17
17
  - Implement RBAC (Role-Based Access Control)
@@ -52,7 +52,7 @@ ph.verify(hash, "password123") # Verify password
52
52
  #### 3. Injection Attacks
53
53
  **Risk:** SQL injection, NoSQL injection, command injection (6x increase 2020-2024)
54
54
 
55
- **Mitigation (98% vulnerability reduction):**
55
+ **Mitigation:** Parameterized queries prevent SQL injection.
56
56
  - Use parameterized queries ALWAYS
57
57
  - Input validation with allow-lists
58
58
  - Escape special characters
@@ -156,7 +156,7 @@ pip-audit --fix
156
156
  - Network segmentation
157
157
  - Disable unnecessary protocols (file://, gopher://)
158
158
 
159
- ## Input Validation (Prevents 70%+ Vulnerabilities)
159
+ ## Input Validation (Prevents Vulnerabilities)
160
160
 
161
161
  ### Validation Strategies
162
162
 
@@ -22,7 +22,7 @@ Core technologies, frameworks, databases, and message queues for modern backend
22
22
  **When to Choose:** Team already using JavaScript/TypeScript, real-time features needed, rapid development priority
23
23
 
24
24
  ### Python
25
- **Market Position:** FastAPI adoption surge - 73% migrating from Flask
25
+ **Market Position:** FastAPI adoption is increasing among Flask users
26
26
 
27
27
  **Best For:**
28
28
  - Data-heavy applications
@@ -54,7 +54,7 @@ Core technologies, frameworks, databases, and message queues for modern backend
54
54
  **When to Choose:** Microservices, high concurrency needs, DevOps tooling, simple deployment (single binary)
55
55
 
56
56
  ### Rust
57
- **Market Position:** 72% most admired language, 1.5x faster than Go
57
+ **Market Position:** Highly admired language, faster than Go
58
58
 
59
59
  **Best For:**
60
60
  - Performance-critical systems
@@ -129,7 +129,7 @@ Core technologies, frameworks, databases, and message queues for modern backend
129
129
  - Rate limiting
130
130
  - Real-time leaderboards
131
131
  - Job queues (Bull, BullMQ)
132
- - Caching layer (90% DB load reduction)
132
+ - Caching layer (reduces DB load)
133
133
 
134
134
  **When to Choose:** Need sub-millisecond latency, caching layer, session management
135
135
 
@@ -242,9 +242,9 @@ Millions msg/sec? → Yes → Kafka
242
242
 
243
243
  1. **Choosing NoSQL for relational data** - Use PostgreSQL if data has clear relationships
244
244
  2. **Not using connection pooling** - Implement pooling for 5-10x performance boost
245
- 3. **Ignoring indexes** - Add indexes to frequently queried columns (30% I/O reduction)
245
+ 3. **Ignoring indexes** - Add indexes to frequently queried columns (reduces I/O)
246
246
  4. **Over-engineering with microservices** - Start monolith, split when needed
247
- 5. **Not caching** - Redis caching provides 90% DB load reduction
247
+ 5. **Not caching** - Redis caching reduces DB load
248
248
 
249
249
  ## Resources
250
250
 
@@ -24,7 +24,7 @@ Comprehensive testing approaches, frameworks, and quality assurance practices (2
24
24
  ### Frameworks by Language
25
25
 
26
26
  **TypeScript/JavaScript:**
27
- - **Vitest** - 50% faster than Jest in CI/CD, ESM native
27
+ - **Vitest** - Faster than Jest in CI/CD, ESM native
28
28
  - **Jest** - Mature, large ecosystem, snapshot testing
29
29
 
30
30
  **Python:**
@@ -269,7 +269,7 @@ test('user can register and login', async ({ page }) => {
269
269
 
270
270
  ## Database Migration Testing
271
271
 
272
- **Critical:** 83% migrations fail without proper testing
272
+ **Migrations fail without proper testing**
273
273
 
274
274
  ```typescript
275
275
  describe('Database Migrations', () => {
@@ -59,7 +59,7 @@ If any item is vague, ask one more grounded question. Do not proceed with phrase
59
59
  | "This is too simple to need a design" | Simple projects = most wasted work from unexamined assumptions. |
60
60
  | "I already know the solution" | Then writing it down takes 30 seconds. Do it. |
61
61
  | "The user wants action, not talk" | Bad action wastes more time than good planning. |
62
- | "Let me explore the code first" | Brainstorming tells you HOW to explore. Follow the process. |
62
+ | "I'll skip the scout summary and go straight to questions" | Gate order is scout → summarize findings → ask. Questions come from evidence. |
63
63
  | "I'll just prototype quickly" | Prototypes become production code. Design first. |
64
64
 
65
65
  ## Collaboration Tools
@@ -70,8 +70,7 @@ Leverage these specific tools or sub-agents to execute the workflow effectively:
70
70
  - `hapo:ai-multimodal`: Use this when analyzing visual materials and mockups.
71
71
  - `repomix --remote`: Use this bash command to summarize external Github repositories if a URL is provided.
72
72
  - `psql`: Query database schemas to understand existing data structures.
73
- - `brainstormer`: Call only for medium/high-complexity architecture trade-offs.
74
- - **Ecosystem Swarm (`SendMessage`):** Call `researcher` (validation), `docs-keeper` (architecture boundaries), or `project-manager` (scope warnings) for deeply complex specs.
73
+ Call brainstormer only when 2+ architectures have material trade-offs after discovery; call researcher only for external/current facts the repo cannot answer.
75
74
 
76
75
  ## Discovery Question Framework
77
76