@hasna/instructions 0.3.0 → 0.4.0

package/README.md

@@ -27,6 +27,8 @@ instructions show <slug>             # full metadata + content
 instructions inspect <slug>          # alias for show
 instructions profile resolve
 instructions profile apply --auto
+instructions package-manager-scan --fail-on-findings .
+instructions package-manager-scan --home --fail-on-findings .
 ```
 
 Collection commands are compact by default to keep agent terminals and context
@@ -37,6 +39,36 @@ small. Human output is capped at 20 rows unless you pass `--limit`; use
 - `--json` preserves full machine-readable records for automation.
 - `show`/`inspect` and `snapshot show` print full config or snapshot content.
 
+## Package-Manager Secret Guard
+
+`instructions package-manager-scan` blocks package-manager credential ingress without
+printing credential values. It scans repo `.npmrc` files, home `.npmrc`, Bun
+config, lockfiles, and shell profiles, then reports only path, line, rule,
+surface, and tracked status.
+
+Use it in CI or pre-commit hooks:
+
+```bash
+instructions package-manager-scan --fail-on-findings .
+```
+
+Use `--home` for local operator scans:
+
+```bash
+instructions package-manager-scan --home --fail-on-findings .
+```
+
+Safe `.npmrc` auth uses npm's environment reference, not a rendered literal:
+
+```ini
+@hasna:registry=https://registry.npmjs.org/
+# Add the npm auth-token entry with an environment reference, not a literal value.
+```
+
+Bun release-age quarantine must stay enabled. Keep
+`minimumReleaseAgeExcludes` narrowed to exact `@hasna/<package>` names only;
+wildcards and third-party package names fail the guard.
+
 ## MCP Server
 
 ```bash
@@ -102,21 +134,20 @@ and `API_KEY_SIGNING_SECRET` are also accepted). Client apps use
 `InstructionsV1Client` is generated from the serve OpenAPI document
 (`bun run generate:sdk`).
 
-## Storage Sync (local CLI)
+## Storage Modes
 
-The local CLI supports optional remote storage sync through a package-local
-Postgres connection:
+Every CLI command, MCP tool, and SDK method routes through a single `ConfigStore`
+abstraction with two transports:
 
-```bash
-export HASNA_INSTRUCTIONS_DATABASE_URL=postgres://...
-instructions storage status
-instructions storage push
-instructions storage pull
-instructions storage sync
-```
+- **local** — on-box SQLite (`LocalConfigStore`), fully first-class. Used when no
+  API env vars are set.
+- **api** (self_hosted / cloud) — HTTP `/v1` + bearer key (`CloudConfigStore`).
+  Activated by setting **both** `HASNA_INSTRUCTIONS_API_URL` and
+  `HASNA_INSTRUCTIONS_API_KEY`. Identical client code; only the URL/key differ,
+  and the self_hosted/cloud distinction is enforced server-side by tenancy.
 
-The MCP server also exposes `storage_status`, `storage_push`, `storage_pull`, and
-`storage_sync`.
+Clients never hold a database DSN. The raw Postgres connection is a server-only
+concern (`instructions-serve`).
 
 ## Data Directory
 

package/dashboard/README.md

@@ -0,0 +1,73 @@
+# React + TypeScript + Vite
+
+This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.
+
+Currently, two official plugins are available:
+
+- [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react) uses [Babel](https://babeljs.io/) (or [oxc](https://oxc.rs) when used in [rolldown-vite](https://vite.dev/guide/rolldown)) for Fast Refresh
+- [@vitejs/plugin-react-swc](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react-swc) uses [SWC](https://swc.rs/) for Fast Refresh
+
+## React Compiler
+
+The React Compiler is not enabled on this template because of its impact on dev & build performances. To add it, see [this documentation](https://react.dev/learn/react-compiler/installation).
+
+## Expanding the ESLint configuration
+
+If you are developing a production application, we recommend updating the configuration to enable type-aware lint rules:
+
+```js
+export default defineConfig([
+  globalIgnores(['dist']),
+  {
+    files: ['**/*.{ts,tsx}'],
+    extends: [
+      // Other configs...
+
+      // Remove tseslint.configs.recommended and replace with this
+      tseslint.configs.recommendedTypeChecked,
+      // Alternatively, use this for stricter rules
+      tseslint.configs.strictTypeChecked,
+      // Optionally, add this for stylistic rules
+      tseslint.configs.stylisticTypeChecked,
+
+      // Other configs...
+    ],
+    languageOptions: {
+      parserOptions: {
+        project: ['./tsconfig.node.json', './tsconfig.app.json'],
+        tsconfigRootDir: import.meta.dirname,
+      },
+      // other options...
+    },
+  },
+])
+```
+
+You can also install [eslint-plugin-react-x](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-x) and [eslint-plugin-react-dom](https://github.com/Rel1cx/eslint-react/tree/main/packages/plugins/eslint-plugin-react-dom) for React-specific lint rules:
+
+```js
+// eslint.config.js
+import reactX from 'eslint-plugin-react-x'
+import reactDom from 'eslint-plugin-react-dom'
+
+export default defineConfig([
+  globalIgnores(['dist']),
+  {
+    files: ['**/*.{ts,tsx}'],
+    extends: [
+      // Other configs...
+      // Enable lint rules for React
+      reactX.configs['recommended-typescript'],
+      // Enable lint rules for React DOM
+      reactDom.configs.recommended,
+    ],
+    languageOptions: {
+      parserOptions: {
+        project: ['./tsconfig.node.json', './tsconfig.app.json'],
+        tsconfigRootDir: import.meta.dirname,
+      },
+      // other options...
+    },
+  },
+])
+```