@jgiox/goodvibes 1.0.0 → 1.1.0

package/dist/index.js

@@ -8,7 +8,7 @@ import { intro, outro, note, tasks } from "@clack/prompts";
 
 // src/steps/copy-templates.ts
 import { copy } from "fs-extra";
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile2, rename } from "fs/promises";
 import { readdir } from "fs/promises";
 import { existsSync } from "fs";
 import { join, relative } from "path";
@@ -86,9 +86,25 @@ async function listTemplateFiles(templateDir) {
   await walk(templateDir);
   return results.sort();
 }
-async function copyTemplates(templateDir, destDir, dryRun, minimal) {
+async function walkDir(dir, base) {
+  const results = [];
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...await walkDir(fullPath, base));
+    } else {
+      results.push(relative(base, fullPath));
+    }
+  }
+  return results;
+}
+async function copyTemplates(templateDir, destDir, dryRun, minimal, projectType = "both") {
+  const ciVariants = ["ci-node.yml", "ci-python.yml", "ci-both.yml"];
+  const selectedVariant = `ci-${projectType}.yml`;
   if (dryRun) {
-    return listTemplateFiles(templateDir);
+    const all = await listTemplateFiles(templateDir);
+    return all.filter((p) => !ciVariants.some((v) => p.endsWith(v) && v !== selectedVariant));
   }
   await copy(templateDir, destDir, {
     overwrite: false,
@@ -97,14 +113,25 @@ async function copyTemplates(templateDir, destDir, dryRun, minimal) {
       if (src.endsWith("CLAUDE.md")) return false;
       if (minimal && src.includes(".github/workflows")) return false;
       if (relative(templateDir, src).includes("..")) return false;
+      for (const variant of ciVariants) {
+        if (src.endsWith(variant) && variant !== selectedVariant) return false;
+      }
       return true;
     }
   });
+  if (!minimal) {
+    const variantPath = join(destDir, ".github", "workflows", selectedVariant);
+    const ciPath = join(destDir, ".github", "workflows", "ci.yml");
+    if (existsSync(variantPath)) {
+      await rename(variantPath, ciPath);
+    }
+  }
   const claudeSrc = join(templateDir, "CLAUDE.md");
   const claudeDest = join(destDir, "CLAUDE.md");
   const templateContent = await readFile2(claudeSrc, "utf-8");
   await mergeClaude(claudeDest, templateContent);
-  return listTemplateFiles(templateDir);
+  const destFiles = await walkDir(destDir, destDir);
+  return destFiles.sort();
 }
 
 // src/steps/install-headroom.ts
@@ -215,12 +242,25 @@ async function configureMcp(log) {
   }
 }
 
+// src/utils/detect-project-type.ts
+import { existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+function detectProjectType(cwd) {
+  const hasNode = existsSync2(join2(cwd, "package.json"));
+  const hasPython = existsSync2(join2(cwd, "pyproject.toml")) || existsSync2(join2(cwd, "requirements.txt"));
+  if (hasNode && hasPython) return "both";
+  if (hasNode) return "node";
+  if (hasPython) return "python";
+  return "both";
+}
+
 // src/commands/init.ts
 function registerInitCommand(program2) {
   program2.command("init").description("Bootstrap a project with goodvibes configuration").option("--dry-run", "Preview files without writing to disk").option("--minimal", "Skip headroom install and CI workflows").action(async (options) => {
     const dryRun = options.dryRun ?? false;
     const minimal = options.minimal ?? false;
     const cwd = process.cwd();
+    const projectType = detectProjectType(cwd);
     const templateDir = resolveTemplatesDir();
     intro("goodvibes init");
     if (dryRun) {
@@ -229,7 +269,7 @@ function registerInitCommand(program2) {
       note(
         [
           "1. Open this project in Claude Code",
-          "2. Run /plugin marketplace add DietrichGebert/ponytail",
+          "2. In Claude Code CLI: /plugin marketplace add DietrichGebert/ponytail",
           "3. Start coding \u2014 CLAUDE.md rules are already active"
         ].join("\n"),
         "Next steps"
@@ -242,7 +282,7 @@ function registerInitCommand(program2) {
       {
         title: "Copying template files",
         task: async (message) => {
-          const files = await copyTemplates(templateDir, cwd, false, minimal);
+          const files = await copyTemplates(templateDir, cwd, false, minimal, projectType);
           createdFiles.push(...files);
           return `Copied ${files.length} files`;
         }
@@ -270,7 +310,7 @@ function registerInitCommand(program2) {
     note(createdFiles.join("\n"), "Files created");
     const nextSteps = [
       "1. Open this project in Claude Code",
-      "2. Run /plugin marketplace add DietrichGebert/ponytail",
+      "2. In Claude Code CLI: /plugin marketplace add DietrichGebert/ponytail",
       "3. Start coding \u2014 CLAUDE.md rules are already active"
     ].join("\n");
     note(nextSteps, "Next steps");
@@ -278,6 +318,161 @@ function registerInitCommand(program2) {
   });
 }
 
+// src/commands/upgrade.ts
+import { intro as intro2, outro as outro2, note as note2, tasks as tasks2 } from "@clack/prompts";
+import { copy as copy2, pathExists as pathExists2 } from "fs-extra";
+import { readFile as readFile3, rename as rename2 } from "fs/promises";
+import { existsSync as existsSync3 } from "fs";
+import { join as join3, relative as relative2 } from "path";
+import { execa as execa4 } from "execa";
+import { createRequire } from "module";
+var _require = createRequire(import.meta.url);
+var _GV_UPGRADING = "_GV_UPGRADING";
+async function checkLatestNpmVersion() {
+  try {
+    const { stdout } = await execa4("npm", ["view", "@jgiox/goodvibes", "version"]);
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function getInstalledVersion() {
+  try {
+    const pkg = _require("../../package.json");
+    return pkg.version ?? null;
+  } catch {
+    return null;
+  }
+}
+async function selfUpdateNpm(version) {
+  await execa4("npm", ["install", "-g", `@jgiox/goodvibes@${version}`], { stdio: "inherit" });
+}
+var MANAGED_FIXED = /* @__PURE__ */ new Set([
+  "CLAUDE.md",
+  ".github/workflows/ci.yml",
+  ".github/workflows/security.yml",
+  ".github/workflows/dependency-review.yml",
+  ".github/dependabot.yml"
+]);
+async function detectInstalledVersion(cwd) {
+  const claudePath = join3(cwd, "CLAUDE.md");
+  if (!await pathExists2(claudePath)) return null;
+  const content = await readFile3(claudePath, "utf-8");
+  return extractVersion(content);
+}
+async function detectBundledVersion(templateDir) {
+  if (!templateDir) return null;
+  const claudeSrc = join3(templateDir, "CLAUDE.md");
+  if (!await pathExists2(claudeSrc)) return null;
+  const content = await readFile3(claudeSrc, "utf-8");
+  return extractVersion(content);
+}
+async function computeChanges(templateDir, destDir, projectType) {
+  const allFiles = await listTemplateFiles(templateDir) ?? [];
+  const managedFiles = allFiles.filter(
+    (f) => f.startsWith(".claude/skills/") || MANAGED_FIXED.has(f) || // ci.yml variant maps to the fixed set already — include it for comparison
+    f === `.github/workflows/ci-${projectType}.yml`
+  );
+  const results = [];
+  for (const rel of managedFiles) {
+    const destRel = rel === `.github/workflows/ci-${projectType}.yml` ? ".github/workflows/ci.yml" : rel;
+    const srcPath = join3(templateDir, rel);
+    const destPath = join3(destDir, destRel);
+    if (!await pathExists2(destPath)) {
+      results.push({ path: destRel, status: "new" });
+      continue;
+    }
+    const srcContent = await readFile3(srcPath, "utf-8");
+    const destContent = await readFile3(destPath, "utf-8");
+    results.push({ path: destRel, status: srcContent === destContent ? "unchanged" : "changed" });
+  }
+  return results.sort((a, b) => a.path.localeCompare(b.path));
+}
+function formatChangeSummary(changes) {
+  if (changes.length === 0) return "(no managed files found)";
+  const symbol = { changed: "~", unchanged: "=", new: "+" };
+  return changes.map((c) => `${symbol[c.status] ?? "?"} ${c.path}`).join("\n");
+}
+async function upgradeTemplates(templateDir, destDir, projectType) {
+  const ciVariants = ["ci-node.yml", "ci-python.yml", "ci-both.yml"];
+  const selectedVariant = `ci-${projectType}.yml`;
+  const claudeDest = join3(destDir, "CLAUDE.md");
+  await copy2(templateDir, destDir, {
+    overwrite: true,
+    errorOnExist: false,
+    filter: (src) => {
+      if (src.endsWith("CLAUDE.md")) return false;
+      if (relative2(templateDir, src).includes("..")) return false;
+      if (src.includes(".claude/skills/")) return true;
+      for (const v of ciVariants) {
+        if (src.endsWith(v) && v !== selectedVariant) return false;
+      }
+      if (src.includes(".github/workflows/")) return true;
+      return false;
+    }
+  });
+  const variantPath = join3(destDir, ".github", "workflows", selectedVariant);
+  const ciPath = join3(destDir, ".github", "workflows", "ci.yml");
+  if (existsSync3(variantPath)) {
+    await rename2(variantPath, ciPath);
+  }
+  const claudeSrc = join3(templateDir, "CLAUDE.md");
+  const templateContent = await readFile3(claudeSrc, "utf-8");
+  await mergeClaude(claudeDest, templateContent);
+  const allDest = await listTemplateFiles(destDir) ?? [];
+  return allDest.filter((f) => f.startsWith(".claude/skills/") || f.startsWith(".github/workflows/") || f === "CLAUDE.md").sort();
+}
+function registerUpgradeCommand(program2) {
+  program2.command("upgrade").description("Update goodvibes-managed files to the latest version").option("--dry-run", "Preview what would change without writing").action(async (options) => {
+    const dryRun = options.dryRun ?? false;
+    const cwd = process.cwd();
+    intro2("goodvibes upgrade");
+    if (!process.env[_GV_UPGRADING]) {
+      const current = getInstalledVersion();
+      const latest = await checkLatestNpmVersion();
+      if (latest && current && !versionGte(current, latest)) {
+        note2(`Updating goodvibes ${current} \u2192 ${latest}\u2026`, "New version available");
+        await selfUpdateNpm(latest);
+        note2(`Updated to ${latest} \u2014 re-applying templates\u2026`, "\u2713");
+        const { execa: execaFn } = await import("execa");
+        await execaFn(process.argv[1], process.argv.slice(2), {
+          stdio: "inherit",
+          env: { ...process.env, [_GV_UPGRADING]: "1" }
+        });
+        process.exit(0);
+        return;
+      }
+    }
+    const templateDir = resolveTemplatesDir();
+    const projectType = detectProjectType(cwd);
+    const installedVersion = await detectInstalledVersion(cwd);
+    const bundledVersion = await detectBundledVersion(templateDir);
+    if (installedVersion && bundledVersion && versionGte(installedVersion, bundledVersion)) {
+      outro2(`Already up to date (v${installedVersion})`);
+      return;
+    }
+    const changes = await computeChanges(templateDir, cwd, projectType);
+    note2(formatChangeSummary(changes), "What will change");
+    if (dryRun) {
+      outro2("Run without --dry-run to apply these changes.");
+      return;
+    }
+    const updated = [];
+    await tasks2([
+      {
+        title: "Upgrading managed files",
+        task: async () => {
+          const files = await upgradeTemplates(templateDir, cwd, projectType);
+          updated.push(...files);
+          return `Updated ${files.length} files`;
+        }
+      }
+    ]);
+    note2(updated.join("\n") || "(no files changed)", "Files updated");
+    outro2("Upgrade complete!");
+  });
+}
+
 // src/index.ts
 var [major] = process.version.replace("v", "").split(".").map(Number);
 if (major < 20) {
@@ -292,4 +487,5 @@ Install the latest LTS from https://nodejs.org
 var program = new Command();
 program.name("goodvibes").version("1.0.0").description("One-command bootstrap for vibe coding projects");
 registerInitCommand(program);
+registerUpgradeCommand(program);
 await program.parseAsync(process.argv);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jgiox/goodvibes",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "One-command bootstrap for vibe coding projects",
   "type": "module",
   "bin": {
@@ -8,7 +8,7 @@
   },
   "main": "./dist/index.js",
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=20.12.0"
   },
   "files": [
     "dist",
@@ -37,15 +37,18 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "commander": "^13",
-    "@clack/prompts": "^0.9",
+    "commander": "^15",
+    "@clack/prompts": "^1",
     "fs-extra": "^11",
     "execa": "^9"
   },
   "devDependencies": {
     "tsup": "^8",
-    "typescript": "^5.5",
-    "@types/node": "^20",
-    "vitest": "^2"
+    "typescript": "^6",
+    "@types/node": "^26",
+    "vitest": "^4"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1"
   }
 }

package/templates/.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

package/templates/.github/workflows/ci-both.yml

@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test-node:
+    name: Node.js tests (Node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: ['20', '22']
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'npm'
+          # ponytail: no cache-dependency-path — beginner projects are single-package, not monorepos
+
+      # npm install (not npm ci) — new projects may lack package-lock.json on first push
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build
+        run: npm run build --if-present
+
+      - name: Test
+        run: npm test --if-present
+
+      - name: Lint
+        run: npm run lint --if-present
+
+  test-python:
+    name: Python tests (Python ${{ matrix.python }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ['3.10', '3.11', '3.12']
+    steps:
+      - uses: actions/checkout@v7
+
+      # python-version must be explicit — setup-uv does not auto-read matrix.python (Pitfall 4)
+      - uses: astral-sh/setup-uv@v8.2.0
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install dependencies
+        run: |
+          if [ -f "pyproject.toml" ]; then
+            uv sync --all-extras 2>/dev/null || uv sync
+          elif [ -f "requirements.txt" ]; then
+            uv pip install -r requirements.txt
+          fi
+
+      - name: Run tests
+        run: |
+          if find . -name "test_*.py" -not -path "./.venv/*" | grep -q .; then
+            uv run --extra dev pytest -x -q
+          else
+            echo "No tests found — add a tests/ directory to get started"
+          fi

package/templates/.github/workflows/ci-node.yml

@@ -0,0 +1,36 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Node.js tests (Node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: ['20', '22']
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'npm'
+          # ponytail: no cache-dependency-path — beginner projects are single-package, not monorepos
+
+      # npm install (not npm ci) — new projects may lack package-lock.json on first push
+      - name: Install dependencies
+        run: npm install
+
+      - name: Build
+        run: npm run build --if-present
+
+      - name: Test
+        run: npm test --if-present
+
+      - name: Lint
+        run: npm run lint --if-present

package/templates/.github/workflows/ci-python.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Python tests (Python ${{ matrix.python }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ['3.10', '3.11', '3.12']
+    steps:
+      - uses: actions/checkout@v7
+
+      # python-version must be explicit — setup-uv does not auto-read matrix.python (Pitfall 4)
+      - uses: astral-sh/setup-uv@v8.2.0
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install dependencies
+        run: |
+          if [ -f "pyproject.toml" ]; then
+            uv sync --all-extras 2>/dev/null || uv sync
+          elif [ -f "requirements.txt" ]; then
+            uv pip install -r requirements.txt
+          fi
+
+      - name: Run tests
+        run: |
+          if find . -name "test_*.py" -not -path "./.venv/*" | grep -q .; then
+            uv run --extra dev pytest -x -q
+          else
+            echo "No tests found — add a tests/ directory to get started"
+          fi

package/templates/.github/workflows/dependency-review.yml

@@ -0,0 +1,15 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/dependency-review-action@v5

package/templates/.github/workflows/security.yml

@@ -0,0 +1,46 @@
+name: Security scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly scan on Monday at 08:00 UTC
+    - cron: '0 8 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Detect languages
+        id: langs
+        run: |
+          py=$(find . -name "*.py" -not -path "./.venv/*" | head -1)
+          js=$(find . \( -name "*.js" -o -name "*.ts" \) -not -path "*/node_modules/*" | head -1)
+          langs=""
+          [ -n "$py" ] && langs="python"
+          [ -n "$js" ] && [ -n "$langs" ] && langs="python,javascript-typescript"
+          [ -n "$js" ] && [ -z "$langs" ] && langs="javascript-typescript"
+          [ -z "$langs" ] && langs="python"
+          echo "value=$langs" >> $GITHUB_OUTPUT
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ steps.langs.outputs.value }}
+          queries: security-extended
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4

package/templates/CLAUDE.md

@@ -1,7 +1,7 @@
 # CLAUDE.md
 
 <!-- goodvibes:start -->
-# goodvibes: v1.0.0
+# goodvibes: v1.1.0
 
 ## Engineering Rules
 
@@ -49,6 +49,10 @@ Must flag immediately: SQL injection, XSS, command injection, path traversal, br
 Each entry must include: date, task summary, files changed, why the change was made, tests run, docs updated.
 Rules: do not rewrite history. Additive entries only. Keep it short, factual, and readable.
 
+### Push to remote
+**Push to GitHub after every completed task or end of session.**
+A commit that only exists locally is one machine failure away from being lost. Run `git push origin <branch>` after each commit, or at minimum before stopping for the day. Never leave completed work unpushed for more than one session.
+
 ## Ponytail — Minimalism Ruleset
 
 You are a lazy senior developer. Lazy means efficient, not careless. You have
@@ -94,4 +98,27 @@ that prevents data loss, security measures, accessibility basics, anything
 explicitly requested. User insists on the full version → build it.
 
 Never lazy about understanding the problem. Trace the whole thing first.
+
+## Testing
+
+**Inline comments:** Only write a comment when WHY is non-obvious. Never describe what the
+code does. No docstrings for self-evident functions. One line max.
+
+**Unit tests:** Mock all external calls (subprocess, network, filesystem). Test one function
+in isolation. File: `src/steps/foo.ts` → `src/steps/foo.test.ts` (TS) or `tests/test_foo.py`
+(Python). Every public function gets at least one test. Use vitest (TS) or pytest + pytest-mock
+(Python). Never run real uv/pip/claude/npm in a unit test.
+
+**Integration tests:** Use a real temporary directory, no mocks for file ops. Verify that
+modules work together. Live in `tests/integration/` or `src/**/*.integration.test.ts`.
+Run with: `npm run test:integration` or `pytest tests/integration/`.
+
+**Regression tests:** For every bug fix — write a failing test reproducing the bug BEFORE the
+fix. Commit the failing test first (RED), then the fix (GREEN), in separate commits.
+Test name must reference the symptom: `test_install_headroom_does_not_throw_on_cpp_failure`.
+
+**Test naming:** Test names are sentences describing the expected behavior.
+- TS: `it('returns null when Python version is below 3.10')`
+- Python: `def test_returns_none_when_python_below_3_10()`
+Never name tests `test_1`, `test_happy_path`, or `test_works`.
 <!-- goodvibes:end -->