@haposoft/cafekit 0.16.0-rc.8 → 0.16.1

package/src/omp/runtime.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "./runtime.schema.json",
+  "privacyBlock": true,
+  "inspect": {
+    "enabled": true
+  },
+  "docs": {
+    "maxLoc": 800
+  },
+  "paths": {
+    "docs": "docs",
+    "specs": "specs",
+    "plans": "plans"
+  },
+  "spec": {
+    "scaffold_guard": true,
+    "completion_gate": true,
+    "tollgate": true
+  },
+  "develop": {
+    "parallel": true
+  },
+  "locale": {
+    "thinkingLanguage": null,
+    "responseLanguage": null
+  },
+  "codingLevel": 1,
+  "usage": {
+    "enabled": false
+  },
+  "hooks": {},
+  "assertions": []
+}

package/bin/lib/rtk-run.js

@@ -1,28 +0,0 @@
-/**
- * Local captured-spawnSync helper for the rtk install phase.
- *
- * Why local: `lib/skill-deps.js` does not export a `run(cmd, args)` helper
- * (it uses `runAsync` internally and never re-exports it). The rtk phase
- * needs a synchronous, captured spawnSync (R2.2, R4.2) that returns
- * `{ ok, status, stdout, stderr }` — same shape as `skill-deps.runAsync` but
- * blocking. KISS: one 20-line module, no dependency on `lib/skill-deps.js`
- * (which is skill-domain and not a generic command runner).
- *
- * @param {string} cmd
- * @param {string[]} args
- * @param {object} [opts] — passed through to spawnSync (e.g. { timeout })
- * @returns {{ ok: boolean, status: number|null, stdout: string, stderr: string }}
- */
-const { spawnSync } = require('child_process');
-
-function run(cmd, args, opts = {}) {
-  const r = spawnSync(cmd, args, { encoding: 'utf8', ...opts });
-  return {
-    ok: !r.error && r.status === 0,
-    status: r.status,
-    stdout: r.stdout || '',
-    stderr: r.stderr || ''
-  };
-}
-
-module.exports = { run };

package/bin/phases/setup-rtk.js

@@ -1,159 +0,0 @@
-/**
- * setup-rtk — opt-in install of the rtk token-saver and its Claude Code hook.
- *
- * Phase order (per specs/rtk-installer-integration/design.md):
- *   shouldRunRtk → ensureRtkBinary → `rtk init -g` → jq precheck → manifest
- *
- * R1-01 wired the consent gate (`shouldRunRtk`) and a thin `setupRtk` wrapper.
- * R2-01 adds the orchestrator: `ensureRtkBinary` (detect/install), the
- * `rtk init -g` hook registration, the `jq` precheck, and the manifest write.
- *
- * Non-fatal invariant (R2.7, R4.1): the entire `setupRtk` body is wrapped in
- * try/catch. Any throw / non-zero exit / timeout is logged as a warning via
- * `ctx.t('rtkFailed')` (with `{reason}` interpolation) and the cafekit
- * install continues with its existing exit code. Mirrors the non-fatal
- * contract of `phases/skills-setup.js`.
- *
- * Idempotency (R2.1, R2.6): re-runs see `hasCmd('rtk')` short-circuit the
- * binary install path and re-invoke `rtk init -g` (rtk's own command handles
- * its hook idempotency). The in-memory `ctx.rtkSetupRan` flag records that
- * setup executed, so downstream consumers (R3-01 summary line) can read it.
- *
- * Cross-OS install (validated 2026-06-15): best-effort order
- *   (1) official prebuilt install script (pinned source)
- *   (2) `cargo install rtk` when `hasCmd('cargo')`
- *   (3) skip + warn
- * covers macOS/Linux dev machines (cargo fall-through) and CI (skip+warn).
- *
- * No timeout for `cargo install rtk` (validated 2026-06-15): user accepted
- * default `spawnSync` timeout; non-fatal guarantee holds via try/catch.
- */
-
-const dep = require('../lib/skill-deps');
-const rtkRun = require('../lib/rtk-run');
-const { hasCmd } = dep;
-const { run } = rtkRun;
-
-const RTK_INIT_TIMEOUT_MS = 30_000;       // `rtk init -g` is a fast global-hook write
-const RTK_PREBUILT_TIMEOUT_MS = 120_000;  // prebuilt install: curl download + sh pipe; slow networks need headroom
-const RTK_PREBUILT_INSTALL_URL =
-  'https://raw.githubusercontent.com/rtk-ai/rtk/main/install.sh';
-
-/**
- * Detect rtk binary, installing it if absent. Pure function over `ctx`.
- *
- * @param {object} ctx
- * @returns {'present'|'installed'|'absent'}
- */
-function ensureRtkBinary(ctx) {
-  if (hasCmd('rtk')) return 'present';
-  return installRtkBinary(ctx) ? 'installed' : 'absent';
-}
-
-/**
- * Best-effort rtk install. Tries the official prebuilt install script first
- * (R5.2: surface source), then falls back to `cargo install rtk` if cargo is
- * available, otherwise returns false (R2.3 non-fatal skip).
- *
- * @param {object} ctx
- * @returns {boolean} true on success, false on failure or no method available
- */
-function installRtkBinary(ctx) {
-  // Method 1: official prebuilt install script (pinned URL).
-  ctx.ui.info(ctx.t('rtkInstalling', { method: `prebuilt script (${RTK_PREBUILT_INSTALL_URL})` }));
-  const prebuilt = run('sh', ['-c', `curl -fsSL ${RTK_PREBUILT_INSTALL_URL} | sh`], {
-    timeout: RTK_PREBUILT_TIMEOUT_MS
-  });
-  if (prebuilt.ok) return true;
-
-  // Method 2: `cargo install rtk` if cargo is on PATH.
-  if (hasCmd('cargo')) {
-    ctx.ui.info(ctx.t('rtkInstalling', { method: 'cargo install rtk' }));
-    const cargo = run('cargo', ['install', 'rtk']);
-    if (cargo.ok) return true;
-  }
-
-  // No method succeeded.
-  return false;
-}
-
-/**
- * Phase entrypoint. R2-01 wires the full install + hook + manifest pipeline.
- * The consent gate is delegated to `shouldRunRtk(ctx)` (R1-01).
- *
- * @param {object} ctx
- * @returns {Promise<object>} the same ctx
- */
-async function setupRtk(ctx) {
-  if (!(await shouldRunRtk(ctx))) {
-    // Dry-run: enumerate the action set that would have run (validated 2026-06-15).
-    if (ctx.dryRun) {
-      ctx.ui.info(
-        '[dry-run] rtk setup skipped (would: detect rtk binary, install if missing via prebuilt/cargo, run rtk init -g, check jq)'
-      );
-    } else {
-      ctx.ui.info(ctx.t('rtkSkipped'));
-    }
-    return ctx;
-  }
-
-  try {
-    // Step 1: ensure the binary is on PATH (R2.1, R2.2, R2.3).
-    const state = ensureRtkBinary(ctx);
-    if (state === 'absent') {
-      ctx.ui.warn(ctx.t('rtkInstallFailed'));
-      return ctx;
-    }
-    if (state === 'installed') {
-      ctx.ui.info(ctx.t('rtkInstalled'));
-    }
-
-    // Step 2: register rtk's official Claude Code hook via `rtk init -g` (R2.4).
-    const init = run('rtk', ['init', '-g'], { timeout: RTK_INIT_TIMEOUT_MS });
-    if (!init.ok) {
-      ctx.ui.warn(ctx.t('rtkInitFailed', { reason: init.stderr || `exit ${init.status}` }));
-      return ctx;
-    }
-
-    // Step 3: `jq` precheck (R2.5). Warn if missing; do not fail.
-    if (!hasCmd('jq')) {
-      ctx.ui.warn(ctx.t('rtkNeedsJq'));
-    }
-
-    // Step 4: record the action (R2.6, idempotency). In-memory flag — re-runs
-    // observe `hasCmd('rtk')` short-circuit and re-invoke `rtk init -g`,
-    // which is itself idempotent. R3-01 reads this flag for the summary line.
-    ctx.rtkSetupRan = true;
-    return ctx;
-  } catch (err) {
-    // Non-fatal boundary: any unexpected throw becomes a warning, the
-    // installer continues (R2.7, R4.1).
-    ctx.ui.warn(ctx.t('rtkFailed', { reason: (err && err.message) || String(err) }));
-    return ctx;
-  }
-}
-
-/**
- * Decision matrix for whether the rtk setup phase should run. R1-01.
- *
- *   1. --dry-run                          → false (R1.4)
- *   2. ctx.options.withRtk === true       → true  (R1.1)
- *   3. !ctx.interactive                   → false (R1.3)
- *   4. interactive confirm resolves true  → true  (R1.2)
- *   5. interactive confirm resolves false → false (R1.2)
- *
- * @param {object} ctx
- * @returns {Promise<boolean>}
- */
-async function shouldRunRtk(ctx) {
-  if (ctx.dryRun) return false;
-  if (ctx.options.withRtk) return true;
-  if (!ctx.interactive) return false;
-  const yes = await ctx.ui.confirm(
-    { message: ctx.t('rtkConfirm'), initialValue: false },
-    false
-  );
-  return yes === true;
-}
-
-module.exports = { shouldRunRtk, setupRtk, ensureRtkBinary, installRtkBinary };

package/src/claude/skills/backend-development/SKILL.md

@@ -1,101 +0,0 @@
----
-name: hapo:backend-development
-description: Build backends with Node.js, Python, Go (NestJS, FastAPI, Django). Use for REST/GraphQL/gRPC APIs, auth (OAuth, JWT), databases, microservices, security (OWASP), Docker/K8s.
-license: MIT
-user-invocable: true
-when_to_use: "Invoke to build or modify server APIs, services, and data layers."
-category: backend
-keywords: [backend, api, server, database]
-argument-hint: "[framework] [task]"
-metadata:
-  author: haposoft
-  version: "1.0.0"
----
-# Backend Development Skill
-
-Production-ready backend development with modern technologies, best practices, and proven patterns.
-
-## When to Use
-
-- Designing RESTful, GraphQL, or gRPC APIs
-- Building authentication/authorization systems
-- Optimizing database queries and schemas
-- Implementing caching and performance optimization
-- OWASP Top 10 security mitigation
-- Designing scalable microservices
-- Testing strategies (unit, integration, E2E)
-- CI/CD pipelines and deployment
-- Monitoring and debugging production systems
-
-## Technology Selection Guide
-
-**Languages:** Node.js/TypeScript (full-stack), Python (data/ML), Go (concurrency), Rust (performance)
-**Frameworks:** NestJS, FastAPI, Django, Express, Gin
-**Databases:** PostgreSQL (ACID), MongoDB (flexible schema), Redis (caching)
-**APIs:** REST (simple), GraphQL (flexible), gRPC (performance)
-
-See: `references/backend-technologies.md` for detailed comparisons
-
-## Reference Navigation
-
-**Core Technologies:**
-- `backend-technologies.md` - Languages, frameworks, databases, message queues, ORMs
-- `backend-api-design.md` - REST, GraphQL, gRPC patterns and best practices
-
-**Security & Authentication:**
-- `backend-security.md` - OWASP Top 10 2025, security best practices, input validation
-- `backend-authentication.md` - OAuth 2.1, JWT, RBAC, MFA, session management
-
-**Performance & Architecture:**
-- `backend-performance.md` - Caching, query optimization, load balancing, scaling
-- `backend-architecture.md` - Microservices, event-driven, CQRS, saga patterns
-
-**Quality & Operations:**
-- `backend-testing.md` - Testing strategies, frameworks, tools, CI/CD testing
-- `backend-code-quality.md` - SOLID principles, design patterns, clean code
-- `backend-devops.md` - Docker, Kubernetes, deployment strategies, monitoring
-- `backend-debugging.md` - Debugging strategies, profiling, logging, production debugging
-- `backend-mindset.md` - Problem-solving, architectural thinking, collaboration
-
-## Key Best Practices (2025)
-
-**Security:** Argon2id passwords, parameterized queries prevent SQL injection, OAuth 2.1 + PKCE, rate limiting, security headers
-
-**Performance:** Redis caching reduces DB load, database indexing reduces I/O, CDN cuts latency, connection pooling
-
-**Testing:** 70-20-10 pyramid (unit-integration-E2E), Vitest or Jest, contract testing for microservices, migration tests
-
-**DevOps:** Blue-green/canary deployments, feature flags can reduce failures, Kubernetes, Prometheus/Grafana monitoring, OpenTelemetry tracing
-
-## Quick Decision Matrix
-
-| Need | Choose |
-|------|--------|
-| Fast development | Node.js + NestJS |
-| Data/ML integration | Python + FastAPI |
-| High concurrency | Go + Gin |
-| Max performance | Rust + Axum |
-| ACID transactions | PostgreSQL |
-| Flexible schema | MongoDB |
-| Caching | Redis |
-| Internal services | gRPC |
-| Public APIs | GraphQL/REST |
-| Real-time events | Kafka |
-
-## Implementation Checklist
-
-**API:** Choose style → Design schema → Validate input → Add auth → Rate limiting → Documentation → Error handling
-
-**Database:** Choose DB → Design schema → Create indexes → Connection pooling → Migration strategy → Backup/restore → Test performance
-
-**Security:** OWASP Top 10 → Parameterized queries → OAuth 2.1 + JWT → Security headers → Rate limiting → Input validation → Argon2id passwords
-
-**Testing:** Unit 70% → Integration 20% → E2E 10% → Load tests → Migration tests → Contract tests (microservices)
-
-**Deployment:** Docker → CI/CD → Blue-green/canary → Feature flags → Monitoring → Logging → Health checks
-
-## Resources
-
-- OWASP Top 10: https://owasp.org/www-project-top-ten/
-- OAuth 2.1: https://oauth.net/2.1/
-- OpenTelemetry: https://opentelemetry.io/