@hivehub/rulebook 4.0.0 → 4.2.0

package/templates/core/WORKSPACE.md

@@ -0,0 +1,69 @@
+<!-- RULEBOOK:START -->
+# Workspace Mode
+
+**This project is part of a multi-project workspace managed by Rulebook.**
+
+## CRITICAL: Project Routing
+
+When calling ANY Rulebook MCP tool, you MUST pass the `projectId` parameter to target the correct project.
+
+### How to determine the current project
+
+1. **Check which files you are editing** — the file path tells you which project you are in
+2. **Use `rulebook_workspace_list`** to see all available projects and their paths
+3. **Match the file path to a project path** to determine the `projectId`
+
+### Examples
+
+```
+# You are editing files in /path/to/frontend/src/App.tsx
+# → projectId = "frontend"
+
+rulebook_task_create({ taskId: "add-auth", projectId: "frontend" })
+rulebook_task_list({ projectId: "frontend" })
+rulebook_memory_save({ ..., projectId: "frontend" })
+rulebook_memory_search({ query: "auth", projectId: "frontend" })
+```
+
+### Cross-project operations
+
+Use these dedicated workspace tools for operations across ALL projects:
+
+- `rulebook_workspace_list` — List all projects in the workspace
+- `rulebook_workspace_status` — Status of each project (active workers, task count)
+- `rulebook_workspace_search` — Search memory across ALL projects at once
+- `rulebook_workspace_tasks` — List tasks from ALL projects at once
+
+### Default project
+
+If you omit `projectId`, the **default project** is used: `{{DEFAULT_PROJECT}}`.
+Only omit `projectId` when you are certain the operation targets the default project.
+
+## Workspace Projects
+
+{{WORKSPACE_PROJECTS}}
+
+## Rules
+
+1. **NEVER save memory to the wrong project** — always verify `projectId` before calling `rulebook_memory_save`
+2. **NEVER create tasks in the wrong project** — check which project the feature belongs to
+3. **When working across projects** (e.g., shared types), save memory to BOTH relevant projects
+4. **Use `rulebook_workspace_search`** to find related context across all projects before starting work
+5. **Each project has its own `.rulebook/`** directory — configs, tasks, and memory are fully isolated
+
+## CLI Commands
+
+```bash
+# List tasks from a specific project
+rulebook task list --project frontend
+
+# List tasks from ALL projects
+rulebook task list --all-projects
+
+# Create task in specific project
+rulebook task create my-task --project backend
+
+# Update all projects at once
+rulebook update
+```
+<!-- RULEBOOK:END -->

package/templates/frameworks/ANGULAR.md

@@ -1,36 +1,36 @@
-<!-- ANGULAR:START -->
-# Angular Framework Rules
-
-**CRITICAL**: Angular projects must meet these standards before delivery.
-
-## Quality Commands
-- Lint: `npm run lint`
-- Unit tests: `npm run test -- --watch=false --code-coverage`
-- e2e tests: `npm run e2e`
-- Build: `npm run build -- --configuration production`
-
-## Project Structure
-- Colocate features inside `src/app/<feature>/`
-- Keep shared modules in `src/app/shared`
-- Avoid `providedIn: 'root'` unless service truly global
-- Leverage `OnPush` change detection for performance-critical components
-
-## Implementation Guidelines
-- Define interfaces for component inputs/outputs
-- Use `HttpClient` interceptors for auth/logging
-- Isolate environment variables in `src/environments/`
-- Prefer Reactive Forms and RxJS operators over manual subscriptions
-
-## Pre-Commit Sequence
-```bash
-npm run lint
-npm run test -- --watch=false
-npm run build -- --configuration production
-```
-
-## Documentation
-- Update `/docs/angular-architecture.md` with new modules and routes
-- Record shared component APIs in Storybook or `/docs/ui-components.md`
-- Version major route changes in `/docs/roadmap.md`
-
-<!-- ANGULAR:END -->
+<!-- ANGULAR:START -->
+# Angular Framework Rules
+
+**CRITICAL**: Angular projects must meet these standards before delivery.
+
+## Quality Commands
+- Lint: `npm run lint`
+- Unit tests: `npm run test -- --watch=false --code-coverage`
+- e2e tests: `npm run e2e`
+- Build: `npm run build -- --configuration production`
+
+## Project Structure
+- Colocate features inside `src/app/<feature>/`
+- Keep shared modules in `src/app/shared`
+- Avoid `providedIn: 'root'` unless service truly global
+- Leverage `OnPush` change detection for performance-critical components
+
+## Implementation Guidelines
+- Define interfaces for component inputs/outputs
+- Use `HttpClient` interceptors for auth/logging
+- Isolate environment variables in `src/environments/`
+- Prefer Reactive Forms and RxJS operators over manual subscriptions
+
+## Pre-Commit Sequence
+```bash
+npm run lint
+npm run test -- --watch=false
+npm run build -- --configuration production
+```
+
+## Documentation
+- Update `/docs/angular-architecture.md` with new modules and routes
+- Record shared component APIs in Storybook or `/docs/ui-components.md`
+- Version major route changes in `/docs/roadmap.md`
+
+<!-- ANGULAR:END -->

package/templates/frameworks/DJANGO.md

@@ -1,83 +1,83 @@
-<!-- DJANGO:START -->
-# Django Framework Rules
-
-**Language**: Python  
-**Version**: Django 4.2+ (LTS) or 5.0+
-
-## Setup & Configuration
-
-```python
-# settings.py
-SECRET_KEY = env('SECRET_KEY')  # Never hardcode
-DEBUG = env.bool('DEBUG', default=False)
-ALLOWED_HOSTS = env.list('ALLOWED_HOSTS')
-
-INSTALLED_APPS = [
-    # Django apps
-    'django.contrib.admin',
-    'django.contrib.auth',
-    # Third-party
-    'rest_framework',
-    'corsheaders',
-    # Local apps
-    'apps.users',
-]
-
-DATABASES = {
-    'default': env.db('DATABASE_URL')  # Use django-environ
-}
-```
-
-## Quality Gates
-
-```bash
-# Code quality
-black .                          # Format
-ruff check .                     # Lint
-mypy .                          # Type check
-
-# Tests
-python manage.py test            # Run tests
-pytest --cov=apps --cov-report=html  # With coverage
-
-# Security
-python manage.py check --deploy  # Production checks
-bandit -r apps/                  # Security scan
-```
-
-## Best Practices
-
-✅ **DO:**
-- Use Class-Based Views (CBVs) or Django REST Framework ViewSets
-- Implement custom User model from start
-- Use Django ORM properly (select_related, prefetch_related)
-- Enable CSRF protection
-- Use environment variables for secrets
-- Write tests for views, models, and forms
-
-❌ **DON'T:**
-- Use `DEBUG=True` in production
-- Store secrets in settings.py
-- Use raw SQL without parameterization
-- Skip migrations
-- Ignore security middleware
-
-## Project Structure
-
-```
-project/
-├── manage.py
-├── requirements.txt
-├── apps/
-│   ├── users/
-│   ├── api/
-│   └── core/
-├── config/
-│   ├── settings.py
-│   ├── urls.py
-│   └── wsgi.py
-└── tests/
-```
-
-<!-- DJANGO:END -->
-
+<!-- DJANGO:START -->
+# Django Framework Rules
+
+**Language**: Python  
+**Version**: Django 4.2+ (LTS) or 5.0+
+
+## Setup & Configuration
+
+```python
+# settings.py
+SECRET_KEY = env('SECRET_KEY')  # Never hardcode
+DEBUG = env.bool('DEBUG', default=False)
+ALLOWED_HOSTS = env.list('ALLOWED_HOSTS')
+
+INSTALLED_APPS = [
+    # Django apps
+    'django.contrib.admin',
+    'django.contrib.auth',
+    # Third-party
+    'rest_framework',
+    'corsheaders',
+    # Local apps
+    'apps.users',
+]
+
+DATABASES = {
+    'default': env.db('DATABASE_URL')  # Use django-environ
+}
+```
+
+## Quality Gates
+
+```bash
+# Code quality
+black .                          # Format
+ruff check .                     # Lint
+mypy .                          # Type check
+
+# Tests
+python manage.py test            # Run tests
+pytest --cov=apps --cov-report=html  # With coverage
+
+# Security
+python manage.py check --deploy  # Production checks
+bandit -r apps/                  # Security scan
+```
+
+## Best Practices
+
+✅ **DO:**
+- Use Class-Based Views (CBVs) or Django REST Framework ViewSets
+- Implement custom User model from start
+- Use Django ORM properly (select_related, prefetch_related)
+- Enable CSRF protection
+- Use environment variables for secrets
+- Write tests for views, models, and forms
+
+❌ **DON'T:**
+- Use `DEBUG=True` in production
+- Store secrets in settings.py
+- Use raw SQL without parameterization
+- Skip migrations
+- Ignore security middleware
+
+## Project Structure
+
+```
+project/
+├── manage.py
+├── requirements.txt
+├── apps/
+│   ├── users/
+│   ├── api/
+│   └── core/
+├── config/
+│   ├── settings.py
+│   ├── urls.py
+│   └── wsgi.py
+└── tests/
+```
+
+<!-- DJANGO:END -->
+

package/templates/frameworks/ELECTRON.md

@@ -1,147 +1,147 @@
-<!-- ELECTRON:START -->
-# Electron Framework Rules
-
-**Language**: TypeScript, JavaScript  
-**Version**: Electron 28+
-
-## Setup & Configuration
-
-```typescript
-// main.ts (Main Process)
-import { app, BrowserWindow } from 'electron'
-import path from 'path'
-
-function createWindow() {
-  const win = new BrowserWindow({
-    width: 1200,
-    height: 800,
-    webPreferences: {
-      preload: path.join(__dirname, 'preload.js'),
-      contextIsolation: true,
-      nodeIntegration: false,
-    },
-  })
-
-  win.loadFile('index.html')
-}
-
-app.whenReady().then(createWindow)
-```
-
-## Quality Gates
-
-```bash
-# Type check
-npm run type-check
-
-# Lint
-npm run lint
-
-# Tests
-npm test
-
-# Build
-npm run build              # Compile TypeScript
-npm run package            # Package app
-npm run make               # Create distributables
-```
-
-## Best Practices
-
-✅ **DO:**
-- Use contextIsolation: true
-- Disable nodeIntegration
-- Use preload scripts for IPC
-- Implement auto-updates (electron-updater)
-- Sign and notarize apps (production)
-- Use Content Security Policy
-- Implement proper error handling
-- Separate main and renderer processes
-
-❌ **DON'T:**
-- Enable nodeIntegration in renderer
-- Skip contextIsolation
-- Use remote module (deprecated)
-- Ignore security warnings
-- Skip code signing
-- Load remote content without CSP
-- Use synchronous IPC
-- Hardcode credentials
-
-## Project Structure
-
-```
-src/
-├── main/
-│   ├── main.ts           # Main process
-│   ├── preload.ts        # Preload script
-│   └── ipc/              # IPC handlers
-├── renderer/
-│   ├── index.html
-│   ├── renderer.ts
-│   └── components/
-└── shared/
-    └── types.ts
-```
-
-## IPC Communication
-
-```typescript
-// preload.ts
-import { contextBridge, ipcRenderer } from 'electron'
-
-contextBridge.exposeInMainWorld('electronAPI', {
-  sendMessage: (message: string) => ipcRenderer.send('message', message),
-  onReply: (callback: (reply: string) => void) => 
-    ipcRenderer.on('reply', (_event, reply) => callback(reply)),
-})
-
-// main.ts
-import { ipcMain } from 'electron'
-
-ipcMain.on('message', (event, message) => {
-  console.log(message)
-  event.reply('reply', 'Message received')
-})
-
-// renderer.ts
-declare global {
-  interface Window {
-    electronAPI: {
-      sendMessage: (message: string) => void
-      onReply: (callback: (reply: string) => void) => void
-    }
-  }
-}
-
-window.electronAPI.sendMessage('Hello from renderer')
-window.electronAPI.onReply((reply) => console.log(reply))
-```
-
-## Security Checklist
-
-```typescript
-// ✅ Good security configuration
-const win = new BrowserWindow({
-  webPreferences: {
-    contextIsolation: true,        // ✅ MUST enable
-    nodeIntegration: false,        // ✅ MUST disable
-    sandbox: true,                 // ✅ Enable sandbox
-    webSecurity: true,            // ✅ Enable web security
-    allowRunningInsecureContent: false,  // ✅ Block insecure content
-  },
-})
-
-// Content Security Policy
-session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
-  callback({
-    responseHeaders: {
-      ...details.responseHeaders,
-      'Content-Security-Policy': ["default-src 'self'"]
-    }
-  })
-})
-```
-
-<!-- ELECTRON:END -->
-
+<!-- ELECTRON:START -->
+# Electron Framework Rules
+
+**Language**: TypeScript, JavaScript  
+**Version**: Electron 28+
+
+## Setup & Configuration
+
+```typescript
+// main.ts (Main Process)
+import { app, BrowserWindow } from 'electron'
+import path from 'path'
+
+function createWindow() {
+  const win = new BrowserWindow({
+    width: 1200,
+    height: 800,
+    webPreferences: {
+      preload: path.join(__dirname, 'preload.js'),
+      contextIsolation: true,
+      nodeIntegration: false,
+    },
+  })
+
+  win.loadFile('index.html')
+}
+
+app.whenReady().then(createWindow)
+```
+
+## Quality Gates
+
+```bash
+# Type check
+npm run type-check
+
+# Lint
+npm run lint
+
+# Tests
+npm test
+
+# Build
+npm run build              # Compile TypeScript
+npm run package            # Package app
+npm run make               # Create distributables
+```
+
+## Best Practices
+
+✅ **DO:**
+- Use contextIsolation: true
+- Disable nodeIntegration
+- Use preload scripts for IPC
+- Implement auto-updates (electron-updater)
+- Sign and notarize apps (production)
+- Use Content Security Policy
+- Implement proper error handling
+- Separate main and renderer processes
+
+❌ **DON'T:**
+- Enable nodeIntegration in renderer
+- Skip contextIsolation
+- Use remote module (deprecated)
+- Ignore security warnings
+- Skip code signing
+- Load remote content without CSP
+- Use synchronous IPC
+- Hardcode credentials
+
+## Project Structure
+
+```
+src/
+├── main/
+│   ├── main.ts           # Main process
+│   ├── preload.ts        # Preload script
+│   └── ipc/              # IPC handlers
+├── renderer/
+│   ├── index.html
+│   ├── renderer.ts
+│   └── components/
+└── shared/
+    └── types.ts
+```
+
+## IPC Communication
+
+```typescript
+// preload.ts
+import { contextBridge, ipcRenderer } from 'electron'
+
+contextBridge.exposeInMainWorld('electronAPI', {
+  sendMessage: (message: string) => ipcRenderer.send('message', message),
+  onReply: (callback: (reply: string) => void) => 
+    ipcRenderer.on('reply', (_event, reply) => callback(reply)),
+})
+
+// main.ts
+import { ipcMain } from 'electron'
+
+ipcMain.on('message', (event, message) => {
+  console.log(message)
+  event.reply('reply', 'Message received')
+})
+
+// renderer.ts
+declare global {
+  interface Window {
+    electronAPI: {
+      sendMessage: (message: string) => void
+      onReply: (callback: (reply: string) => void) => void
+    }
+  }
+}
+
+window.electronAPI.sendMessage('Hello from renderer')
+window.electronAPI.onReply((reply) => console.log(reply))
+```
+
+## Security Checklist
+
+```typescript
+// ✅ Good security configuration
+const win = new BrowserWindow({
+  webPreferences: {
+    contextIsolation: true,        // ✅ MUST enable
+    nodeIntegration: false,        // ✅ MUST disable
+    sandbox: true,                 // ✅ Enable sandbox
+    webSecurity: true,            // ✅ Enable web security
+    allowRunningInsecureContent: false,  // ✅ Block insecure content
+  },
+})
+
+// Content Security Policy
+session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
+  callback({
+    responseHeaders: {
+      ...details.responseHeaders,
+      'Content-Security-Policy': ["default-src 'self'"]
+    }
+  })
+})
+```
+
+<!-- ELECTRON:END -->
+

package/templates/frameworks/FLASK.md

@@ -1,38 +1,38 @@
-<!-- FLASK:START -->
-# Flask Framework Rules
-
-**Language**: Python  
-**Version**: Flask 3.0+
-
-## Setup
-
-```python
-from flask import Flask
-app = Flask(__name__)
-app.config.from_object('config.ProductionConfig')
-
-# Use Flask-SQLAlchemy for ORM
-# Use Flask-Migrate for migrations
-# Use Flask-Login for auth
-```
-
-## Quality Gates
-
-```bash
-black .
-ruff check .
-pytest --cov=app
-```
-
-## Best Practices
-
-✅ Use application factory pattern  
-✅ Enable CORS properly  
-✅ Use blueprints for organization  
-✅ Implement error handlers  
-
-❌ Don't use `debug=True` in production  
-❌ Don't store secrets in code  
-
-<!-- FLASK:END -->
-
+<!-- FLASK:START -->
+# Flask Framework Rules
+
+**Language**: Python  
+**Version**: Flask 3.0+
+
+## Setup
+
+```python
+from flask import Flask
+app = Flask(__name__)
+app.config.from_object('config.ProductionConfig')
+
+# Use Flask-SQLAlchemy for ORM
+# Use Flask-Migrate for migrations
+# Use Flask-Login for auth
+```
+
+## Quality Gates
+
+```bash
+black .
+ruff check .
+pytest --cov=app
+```
+
+## Best Practices
+
+✅ Use application factory pattern  
+✅ Enable CORS properly  
+✅ Use blueprints for organization  
+✅ Implement error handlers  
+
+❌ Don't use `debug=True` in production  
+❌ Don't store secrets in code  
+
+<!-- FLASK:END -->
+