@haposoft/cafekit 0.15.1 → 0.16.0-rc.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -2
- package/bin/__tests__/codex-hooks.test.js +140 -0
- package/bin/__tests__/codex-native.test.js +230 -2
- package/bin/__tests__/develop-contract.test.js +1120 -0
- package/bin/__tests__/installer-safety.test.js +553 -2
- package/bin/__tests__/package-inventory.test.js +258 -0
- package/bin/__tests__/secret-scanner.test.js +157 -0
- package/bin/__tests__/validator-grounding.test.js +713 -0
- package/bin/install.js +5 -1
- package/bin/lib/codex-install.js +21 -6
- package/bin/lib/context.js +17 -6
- package/bin/lib/copy-utils.js +31 -0
- package/bin/lib/i18n.js +12 -3
- package/bin/lib/instruction-blocks.js +85 -0
- package/bin/lib/managed-writer.js +4 -1
- package/bin/lib/opencode-install.js +75 -30
- package/bin/lib/skill-deps.js +45 -7
- package/bin/phases/claude-runtime.js +103 -4
- package/bin/phases/codex-runtime.js +41 -7
- package/bin/phases/post-install.js +29 -22
- package/bin/phases/root-config.js +89 -10
- package/bin/phases/select-platform.js +23 -0
- package/bin/phases/skills-setup.js +7 -3
- package/package.json +15 -5
- package/src/claude/CLAUDE.md +6 -122
- package/src/claude/agents/code-auditor.md +21 -22
- package/src/claude/agents/debugger.md +3 -3
- package/src/claude/agents/deployer.md +1 -1
- package/src/claude/agents/{god-developer.md → implementer.md} +2 -2
- package/src/claude/agents/project-manager.md +1 -1
- package/src/claude/agents/spec-maker.md +2 -2
- package/src/claude/hooks/__tests__/spec-gate.test.js +356 -5
- package/src/claude/hooks/agent.cjs +7 -14
- package/src/claude/hooks/rules.cjs +33 -53
- package/src/claude/hooks/spec-gate.cjs +66 -21
- package/src/claude/hooks/spec-state.cjs +5 -0
- package/src/claude/migration-manifest.json +9 -2
- package/src/claude/runtime.json +0 -3
- package/src/claude/scripts/generate-skill-catalog.cjs +1 -1
- package/src/claude/scripts/scan-staged-secrets.cjs +170 -0
- package/src/claude/scripts/spec-ground.cjs +189 -83
- package/src/claude/scripts/validate-spec-output.cjs +294 -30
- package/src/claude/scripts/workflow-policy.cjs +609 -0
- package/src/claude/skills/ai-multimodal/SKILL.md +2 -2
- package/src/claude/skills/ai-multimodal/references/audio-processing.md +6 -6
- package/src/claude/skills/ai-multimodal/references/video-analysis.md +1 -1
- package/src/claude/skills/backend-development/SKILL.md +4 -4
- package/src/claude/skills/backend-development/references/backend-architecture.md +1 -1
- package/src/claude/skills/backend-development/references/backend-devops.md +2 -2
- package/src/claude/skills/backend-development/references/backend-mindset.md +3 -3
- package/src/claude/skills/backend-development/references/backend-performance.md +5 -5
- package/src/claude/skills/backend-development/references/backend-security.md +3 -3
- package/src/claude/skills/backend-development/references/backend-technologies.md +5 -5
- package/src/claude/skills/backend-development/references/backend-testing.md +2 -2
- package/src/claude/skills/brainstorm/SKILL.md +2 -3
- package/src/claude/skills/chrome-devtools/scripts/package-lock.json +261 -150
- package/src/claude/skills/chrome-devtools/scripts/package.json +1 -1
- package/src/claude/skills/code-review/SKILL.md +12 -8
- package/src/claude/skills/code-review/references/verification-gate.md +4 -4
- package/src/claude/skills/debug/SKILL.md +2 -0
- package/src/claude/skills/develop/SKILL.md +100 -52
- package/src/claude/skills/develop/references/parallel-waves.md +105 -26
- package/src/claude/skills/develop/references/quality-gate.md +58 -38
- package/src/claude/skills/develop/references/subagent-patterns.md +2 -2
- package/src/claude/skills/git/SKILL.md +44 -50
- package/src/claude/skills/hotfix/SKILL.md +10 -8
- package/src/claude/skills/hotfix/references/parallel-patterns.md +2 -2
- package/src/claude/skills/hotfix/references/review-cycle.md +26 -21
- package/src/claude/skills/inspect/SKILL.md +12 -30
- package/src/claude/skills/mobile-development/SKILL.md +12 -12
- package/src/claude/skills/mobile-development/references/mobile-android.md +7 -7
- package/src/claude/skills/mobile-development/references/mobile-best-practices.md +22 -23
- package/src/claude/skills/mobile-development/references/mobile-frameworks.md +13 -13
- package/src/claude/skills/mobile-development/references/mobile-ios.md +1 -1
- package/src/claude/skills/mobile-development/references/mobile-mindset.md +17 -19
- package/src/claude/skills/pptx/scripts/package-lock.json +868 -0
- package/src/claude/skills/pptx/scripts/package.json +1 -1
- package/src/claude/skills/question/SKILL.md +13 -13
- package/src/claude/skills/research/SKILL.md +2 -2
- package/src/claude/skills/specs/SKILL.md +32 -15
- package/src/claude/skills/specs/references/review.md +3 -3
- package/src/claude/skills/specs/rules/tasks-generation.md +1 -1
- package/src/claude/skills/specs/templates/spec-state.json +7 -3
- package/src/claude/skills/sync/SKILL.md +26 -1
- package/src/claude/skills/sync/references/sync-protocols.md +3 -3
- package/src/claude/skills/test/SKILL.md +12 -4
- package/src/claude/skills/test/references/failure-triage.md +17 -17
- package/src/claude/skills/test/references/test-memory.md +2 -2
- package/src/codex/AGENTS.md +16 -24
- package/src/codex/hooks/lib/spec-receipt.cjs +57 -4
- package/src/codex/hooks/rules.cjs +27 -26
- package/src/codex/hooks/spec-gate.cjs +19 -8
- package/src/codex/hooks/spec-state.cjs +10 -1
- package/src/codex/hooks.json +14 -14
- package/src/common/AGENTS.md +43 -0
- package/src/opencode/AGENTS.md +21 -121
- package/src/opencode/plugins/rules.ts +26 -34
- package/src/opencode/plugins/spec-gate.ts +283 -0
- package/src/claude/skills/inspect/references/external-gemini-inspection.md +0 -169
|
@@ -59,13 +59,13 @@ See: `references/backend-technologies.md` for detailed comparisons
|
|
|
59
59
|
|
|
60
60
|
## Key Best Practices (2025)
|
|
61
61
|
|
|
62
|
-
**Security:** Argon2id passwords, parameterized queries
|
|
62
|
+
**Security:** Argon2id passwords, parameterized queries prevent SQL injection, OAuth 2.1 + PKCE, rate limiting, security headers
|
|
63
63
|
|
|
64
|
-
**Performance:** Redis caching
|
|
64
|
+
**Performance:** Redis caching reduces DB load, database indexing reduces I/O, CDN cuts latency, connection pooling
|
|
65
65
|
|
|
66
|
-
**Testing:** 70-20-10 pyramid (unit-integration-E2E), Vitest
|
|
66
|
+
**Testing:** 70-20-10 pyramid (unit-integration-E2E), Vitest or Jest, contract testing for microservices, migration tests
|
|
67
67
|
|
|
68
|
-
**DevOps:** Blue-green/canary deployments, feature flags
|
|
68
|
+
**DevOps:** Blue-green/canary deployments, feature flags can reduce failures, Kubernetes, Prometheus/Grafana monitoring, OpenTelemetry tracing
|
|
69
69
|
|
|
70
70
|
## Quick Decision Matrix
|
|
71
71
|
|
|
@@ -50,7 +50,7 @@ kubectl rollout resume deployment/api
|
|
|
50
50
|
|
|
51
51
|
### Feature Flags (Progressive Delivery)
|
|
52
52
|
|
|
53
|
-
**Impact:**
|
|
53
|
+
**Impact:** Fewer deployment failures when combined with canary
|
|
54
54
|
|
|
55
55
|
```typescript
|
|
56
56
|
import { LaunchDarkly } from 'launchdarkly-node-server-sdk';
|
|
@@ -105,7 +105,7 @@ CMD ["node", "dist/main.js"]
|
|
|
105
105
|
```
|
|
106
106
|
|
|
107
107
|
**Benefits:**
|
|
108
|
-
- Smaller image size
|
|
108
|
+
- Smaller image size
|
|
109
109
|
- Faster deployments
|
|
110
110
|
- Reduced attack surface
|
|
111
111
|
|
|
@@ -105,7 +105,7 @@ const users = await db.query(`
|
|
|
105
105
|
|
|
106
106
|
### Technical Debt Management
|
|
107
107
|
|
|
108
|
-
**
|
|
108
|
+
**Productivity increase** from addressing technical debt properly
|
|
109
109
|
|
|
110
110
|
**Debt Quadrants:**
|
|
111
111
|
1. **Reckless + Deliberate:** "We don't have time for design"
|
|
@@ -264,7 +264,7 @@ async function getUsers(limit?: number) {
|
|
|
264
264
|
|
|
265
265
|
### Testing Mindset (TDD/BDD)
|
|
266
266
|
|
|
267
|
-
**
|
|
267
|
+
**AI drafts happy-path tests, humans focus on edge cases**
|
|
268
268
|
|
|
269
269
|
**Test-Driven Development (TDD):**
|
|
270
270
|
```
|
|
@@ -287,7 +287,7 @@ Feature: User Registration
|
|
|
287
287
|
|
|
288
288
|
### Observability and Debugging Approach
|
|
289
289
|
|
|
290
|
-
**
|
|
290
|
+
**Positive ROI** from observability investments
|
|
291
291
|
|
|
292
292
|
**Three Questions:**
|
|
293
293
|
1. **Is it slow?** → Check metrics (response time, DB queries)
|
|
@@ -8,7 +8,7 @@ Performance optimization strategies, caching patterns, and scalability best prac
|
|
|
8
8
|
|
|
9
9
|
#### Indexing Strategies
|
|
10
10
|
|
|
11
|
-
**Impact:**
|
|
11
|
+
**Impact:** Reduced disk I/O and faster queries
|
|
12
12
|
|
|
13
13
|
```sql
|
|
14
14
|
-- Create index on frequently queried columns
|
|
@@ -88,7 +88,7 @@ const posts = await Post.findAll({
|
|
|
88
88
|
|
|
89
89
|
### Redis Caching
|
|
90
90
|
|
|
91
|
-
**Impact:**
|
|
91
|
+
**Impact:** Reduced DB load and faster responses
|
|
92
92
|
|
|
93
93
|
#### Cache-Aside Pattern (Lazy Loading)
|
|
94
94
|
|
|
@@ -140,7 +140,7 @@ await redis.keys('user:*').then(keys => redis.del(...keys));
|
|
|
140
140
|
|
|
141
141
|
```
|
|
142
142
|
Client
|
|
143
|
-
→ CDN Cache (static assets,
|
|
143
|
+
→ CDN Cache (static assets, reduced latency)
|
|
144
144
|
→ API Gateway Cache (public endpoints)
|
|
145
145
|
→ Application Cache (Redis)
|
|
146
146
|
→ Database Query Cache
|
|
@@ -236,7 +236,7 @@ emailQueue.process('send-welcome', async (job) => {
|
|
|
236
236
|
|
|
237
237
|
## CDN (Content Delivery Network)
|
|
238
238
|
|
|
239
|
-
**Impact:**
|
|
239
|
+
**Impact:** Reduced latency for global users
|
|
240
240
|
|
|
241
241
|
### Configuration
|
|
242
242
|
|
|
@@ -302,7 +302,7 @@ const users = await replicaDb.users.findAll();
|
|
|
302
302
|
```
|
|
303
303
|
|
|
304
304
|
**Use Cases:**
|
|
305
|
-
- Read-heavy workloads
|
|
305
|
+
- Read-heavy workloads
|
|
306
306
|
- Analytics queries
|
|
307
307
|
- Reporting dashboards
|
|
308
308
|
|
|
@@ -11,7 +11,7 @@ Security best practices, OWASP Top 10 mitigation, and modern security standards
|
|
|
11
11
|
### Top Vulnerabilities & Mitigation
|
|
12
12
|
|
|
13
13
|
#### 1. Broken Access Control
|
|
14
|
-
**Risk:** Users access unauthorized resources
|
|
14
|
+
**Risk:** Users access unauthorized resources
|
|
15
15
|
|
|
16
16
|
**Mitigation:**
|
|
17
17
|
- Implement RBAC (Role-Based Access Control)
|
|
@@ -52,7 +52,7 @@ ph.verify(hash, "password123") # Verify password
|
|
|
52
52
|
#### 3. Injection Attacks
|
|
53
53
|
**Risk:** SQL injection, NoSQL injection, command injection (6x increase 2020-2024)
|
|
54
54
|
|
|
55
|
-
**Mitigation
|
|
55
|
+
**Mitigation:** Parameterized queries prevent SQL injection.
|
|
56
56
|
- Use parameterized queries ALWAYS
|
|
57
57
|
- Input validation with allow-lists
|
|
58
58
|
- Escape special characters
|
|
@@ -156,7 +156,7 @@ pip-audit --fix
|
|
|
156
156
|
- Network segmentation
|
|
157
157
|
- Disable unnecessary protocols (file://, gopher://)
|
|
158
158
|
|
|
159
|
-
## Input Validation (Prevents
|
|
159
|
+
## Input Validation (Prevents Vulnerabilities)
|
|
160
160
|
|
|
161
161
|
### Validation Strategies
|
|
162
162
|
|
|
@@ -22,7 +22,7 @@ Core technologies, frameworks, databases, and message queues for modern backend
|
|
|
22
22
|
**When to Choose:** Team already using JavaScript/TypeScript, real-time features needed, rapid development priority
|
|
23
23
|
|
|
24
24
|
### Python
|
|
25
|
-
**Market Position:** FastAPI adoption
|
|
25
|
+
**Market Position:** FastAPI adoption is increasing among Flask users
|
|
26
26
|
|
|
27
27
|
**Best For:**
|
|
28
28
|
- Data-heavy applications
|
|
@@ -54,7 +54,7 @@ Core technologies, frameworks, databases, and message queues for modern backend
|
|
|
54
54
|
**When to Choose:** Microservices, high concurrency needs, DevOps tooling, simple deployment (single binary)
|
|
55
55
|
|
|
56
56
|
### Rust
|
|
57
|
-
**Market Position:**
|
|
57
|
+
**Market Position:** Highly admired language, faster than Go
|
|
58
58
|
|
|
59
59
|
**Best For:**
|
|
60
60
|
- Performance-critical systems
|
|
@@ -129,7 +129,7 @@ Core technologies, frameworks, databases, and message queues for modern backend
|
|
|
129
129
|
- Rate limiting
|
|
130
130
|
- Real-time leaderboards
|
|
131
131
|
- Job queues (Bull, BullMQ)
|
|
132
|
-
- Caching layer (
|
|
132
|
+
- Caching layer (reduces DB load)
|
|
133
133
|
|
|
134
134
|
**When to Choose:** Need sub-millisecond latency, caching layer, session management
|
|
135
135
|
|
|
@@ -242,9 +242,9 @@ Millions msg/sec? → Yes → Kafka
|
|
|
242
242
|
|
|
243
243
|
1. **Choosing NoSQL for relational data** - Use PostgreSQL if data has clear relationships
|
|
244
244
|
2. **Not using connection pooling** - Implement pooling for 5-10x performance boost
|
|
245
|
-
3. **Ignoring indexes** - Add indexes to frequently queried columns (
|
|
245
|
+
3. **Ignoring indexes** - Add indexes to frequently queried columns (reduces I/O)
|
|
246
246
|
4. **Over-engineering with microservices** - Start monolith, split when needed
|
|
247
|
-
5. **Not caching** - Redis caching
|
|
247
|
+
5. **Not caching** - Redis caching reduces DB load
|
|
248
248
|
|
|
249
249
|
## Resources
|
|
250
250
|
|
|
@@ -24,7 +24,7 @@ Comprehensive testing approaches, frameworks, and quality assurance practices (2
|
|
|
24
24
|
### Frameworks by Language
|
|
25
25
|
|
|
26
26
|
**TypeScript/JavaScript:**
|
|
27
|
-
- **Vitest** -
|
|
27
|
+
- **Vitest** - Faster than Jest in CI/CD, ESM native
|
|
28
28
|
- **Jest** - Mature, large ecosystem, snapshot testing
|
|
29
29
|
|
|
30
30
|
**Python:**
|
|
@@ -269,7 +269,7 @@ test('user can register and login', async ({ page }) => {
|
|
|
269
269
|
|
|
270
270
|
## Database Migration Testing
|
|
271
271
|
|
|
272
|
-
**
|
|
272
|
+
**Migrations fail without proper testing**
|
|
273
273
|
|
|
274
274
|
```typescript
|
|
275
275
|
describe('Database Migrations', () => {
|
|
@@ -59,7 +59,7 @@ If any item is vague, ask one more grounded question. Do not proceed with phrase
|
|
|
59
59
|
| "This is too simple to need a design" | Simple projects = most wasted work from unexamined assumptions. |
|
|
60
60
|
| "I already know the solution" | Then writing it down takes 30 seconds. Do it. |
|
|
61
61
|
| "The user wants action, not talk" | Bad action wastes more time than good planning. |
|
|
62
|
-
| "
|
|
62
|
+
| "I'll skip the scout summary and go straight to questions" | Gate order is scout → summarize findings → ask. Questions come from evidence. |
|
|
63
63
|
| "I'll just prototype quickly" | Prototypes become production code. Design first. |
|
|
64
64
|
|
|
65
65
|
## Collaboration Tools
|
|
@@ -70,8 +70,7 @@ Leverage these specific tools or sub-agents to execute the workflow effectively:
|
|
|
70
70
|
- `hapo:ai-multimodal`: Use this when analyzing visual materials and mockups.
|
|
71
71
|
- `repomix --remote`: Use this bash command to summarize external Github repositories if a URL is provided.
|
|
72
72
|
- `psql`: Query database schemas to understand existing data structures.
|
|
73
|
-
|
|
74
|
-
- **Ecosystem Swarm (`SendMessage`):** Call `researcher` (validation), `docs-keeper` (architecture boundaries), or `project-manager` (scope warnings) for deeply complex specs.
|
|
73
|
+
Call brainstormer only when 2+ architectures have material trade-offs after discovery; call researcher only for external/current facts the repo cannot answer.
|
|
75
74
|
|
|
76
75
|
## Discovery Question Framework
|
|
77
76
|
|