@next-friday/create-app 2.1.2 → 2.1.4

package/README.md

@@ -32,7 +32,7 @@ Every stack is built from [`templates/base`](templates/base), which holds the sh
 - **Git hooks:** Husky runs gitleaks and lint-staged before each commit, commitlint on each message, and `pnpm check` before each push. Commits and pushes to `main` are blocked after the first one.
 - **CI:** GitHub Actions run the static checks, tests with patch coverage, the build, end-to-end tests for Next.js and Payload, a container build and vulnerability scan, Semgrep, OSV-Scanner, CodeQL, dependency review, OpenSSF Scorecard, gitleaks, TruffleHog, zizmor, and pull request title validation. Dependabot keeps dependencies current.
 - **Deployment:** a `Dockerfile` that runs as the `node` user, and a Railway workflow that promotes one commit through `dev`, `uat`, and `prod`.
-- **Agent rules:** shared rules in `.agents/rules`, with hooks that enforce them in Claude Code and Cursor, and a Cursor Bugbot configuration.
+- **Agent rules:** `CLAUDE.md` imports `AGENTS.md`. Shared rules live in `.agents/rules`, with hooks that enforce them in Claude Code and Cursor, and a Cursor Bugbot configuration.
 
 ## Requirements
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",
@@ -73,15 +73,19 @@
     "dev": "tsdown --watch",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
+    "gates:check": "node scripts/check-agent-gates.ts",
     "knip": "knip",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
+    "rules:check": "node scripts/sync-agent-rules.ts --check",
+    "rules:sync": "node scripts/sync-agent-rules.ts",
     "sort-package-json": "sort-package-json package.json",
     "sort-package-json:check": "sort-package-json --check package.json",
+    "suppressions:check": "bash .agents/hooks/agent-suppression-gate.sh --repo",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm test:coverage && pnpm knip && pnpm build && pnpm check:publint"
+    "verify": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm test:coverage && pnpm knip && pnpm build && pnpm check:publint"
   }
 }

package/templates/base/.agents/hooks/agent-shell-gate.sh

@@ -20,7 +20,7 @@ command=$(jq -r '.command // .tool_input.command // empty' <<< "$input")
 
 separator=$'\x1f'
 redirect=$'\x1e'
-protected_names='(\.husky|\.agents|\.cursor|\.claude/rules|\.claude/settings(\.local)?\.json|\.git/hooks|\.git/config|\.lintstagedrc\.json|\.gitleaks\.toml|\.commitlintrc\.json|\.prettierrc\.json|prettier\.config\.ts|eslint\.config\.ts|scripts/(sync-agent-rules|check-agent-gates)\.ts)'
+protected_names='(\.husky|\.agents|\.cursor|\.claude/rules|\.claude/settings(\.local)?\.json|\.git/hooks|\.git/config(\.worktree)?|\.lintstagedrc\.json|\.gitleaks\.toml|\.commitlintrc\.json|\.prettierrc\.json|prettier\.config\.ts|eslint\.config\.ts|scripts/(sync-agent-rules|check-agent-gates)\.ts)'
 protected="(^|[/=])$protected_names(/|$)"
 policy="Hooks and agent policy files are company policy; stop and ask the user."
 in_protected=0
@@ -117,6 +117,15 @@ lex() {
           flush
           words+=("$separator")
           ;;
+        '{' | '}')
+          if ((has_word)); then
+            word+=$char
+            has_word=1
+          else
+            flush
+            words+=("$separator")
+          fi
+          ;;
         '>')
           flush
           while [[ ${text:index+1:1} == [\>\|\&] ]]; do
@@ -271,7 +280,9 @@ check_command() {
       continue
     fi
     case ${word##*/} in
-      env | command | exec | nohup | time | nice | sudo | builtin) args=("${args[@]:1}") ;;
+      env | command | exec | nohup | time | nice | sudo | builtin | if | then | else | elif | fi | while | until | for | do | done | case | esac | select | in | '!' | '{' | '}')
+        args=("${args[@]:1}")
+        ;;
       *) break ;;
     esac
   done

package/templates/base/.agents/rules/codebase-hygiene.md

@@ -0,0 +1,13 @@
+# Codebase Hygiene
+
+Keep the codebase clean. Modify existing code instead of accumulating new code. Git owns history, not source code.
+
+- **No duplication.** Do not add code that repeats an existing declaration or behavior.
+- **No dead code.** Do not keep code the current behavior does not run.
+- **No unnecessary versioning.** Do not store version history in source. Do not add a version constant or a versioned copy of a prompt, instruction, or behavior.
+- **No log accumulation.** Do not add a log that repeats one already recorded, and do not commit log output.
+- **Single source of truth.** One fact has one owning declaration.
+- **Minimal changes.** Change only what the current behavior requires.
+- **Remove before adding.** Change or delete the existing code before adding new code. When a declaration already exists, overwrite it. Do not keep the previous text as an example.
+
+_Completion criterion_: The diff changes or deletes current code when that meets the requirement. New code exists only when no current code can be changed to do the job. History stays in git.

package/templates/base/.claude/rules/codebase-hygiene.md

@@ -0,0 +1 @@
+@../../.agents/rules/codebase-hygiene.md

package/templates/base/.claude/settings.json

@@ -18,6 +18,9 @@
       "Edit(./scripts/sync-agent-rules.ts)",
       "Edit(./scripts/check-agent-gates.ts)",
       "Edit(./.husky/**)",
+      "Edit(./.git/hooks/**)",
+      "Edit(./.git/config)",
+      "Edit(./.git/config.worktree)",
       "Edit(./.lintstagedrc.json)",
       "Edit(./.gitleaks.toml)",
       "Bash(gh repo delete *)",

package/templates/base/.cursor/BUGBOT.md

@@ -5,6 +5,7 @@ Review pull requests against the project's agent guide and rules:
 - [Agent guide](../AGENTS.md)
 - [Owned Checks](../.agents/rules/automation-owned-checks.md)
 - [Required Comments](../.agents/rules/code-comments.md)
+- [Codebase Hygiene](../.agents/rules/codebase-hygiene.md)
 - [Current State](../.agents/rules/current-state-authority.md)
 - [Demand-Driven Configuration](../.agents/rules/demand-driven-configuration.md)
 - [Dependencies](../.agents/rules/dependency-security.md)

package/templates/base/.cursor/hooks/agent-constitution-gate.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -uo pipefail
 
-protected='^(\.agents/rules/|\.agents/rules\.json$|\.agents/hooks/|\.claude/rules/|\.claude/settings(\.local)?\.json$|\.cursor/rules/|\.cursor/hooks/|\.cursor/hooks\.json$|scripts/sync-agent-rules\.ts$|scripts/check-agent-gates\.ts$|\.commitlintrc\.json$|\.prettierrc\.json$|prettier\.config\.ts$|eslint\.config\.ts$|\.husky/|\.lintstagedrc\.json$|\.gitleaks\.toml$)'
+protected='^(\.agents/rules/|\.agents/rules\.json$|\.agents/hooks/|\.claude/rules/|\.claude/settings(\.local)?\.json$|\.cursor/rules/|\.cursor/hooks/|\.cursor/hooks\.json$|scripts/sync-agent-rules\.ts$|scripts/check-agent-gates\.ts$|\.commitlintrc\.json$|\.prettierrc\.json$|prettier\.config\.ts$|eslint\.config\.ts$|\.husky/|\.lintstagedrc\.json$|\.gitleaks\.toml$|\.git/hooks/|\.git/config(\.worktree)?$)'
 
 allow() {
   printf '%s\n' '{"permission":"allow"}'

package/templates/base/.cursor/rules/codebase-hygiene.mdc

@@ -0,0 +1,18 @@
+---
+description: "Codebase hygiene: modify existing code instead of accumulating new code"
+alwaysApply: true
+---
+
+# Codebase Hygiene
+
+Keep the codebase clean. Modify existing code instead of accumulating new code. Git owns history, not source code.
+
+- **No duplication.** Do not add code that repeats an existing declaration or behavior.
+- **No dead code.** Do not keep code the current behavior does not run.
+- **No unnecessary versioning.** Do not store version history in source. Do not add a version constant or a versioned copy of a prompt, instruction, or behavior.
+- **No log accumulation.** Do not add a log that repeats one already recorded, and do not commit log output.
+- **Single source of truth.** One fact has one owning declaration.
+- **Minimal changes.** Change only what the current behavior requires.
+- **Remove before adding.** Change or delete the existing code before adding new code. When a declaration already exists, overwrite it. Do not keep the previous text as an example.
+
+_Completion criterion_: The diff changes or deletes current code when that meets the requirement. New code exists only when no current code can be changed to do the job. History stays in git.

package/templates/base/.github/file-filters.yml

@@ -7,6 +7,7 @@ heavy:
   - "!.github/pull_request_template.md"
   - "!.github/dependabot.yml"
   - "!AGENTS.md"
+  - "!CLAUDE.md"
 
 ci_policy:
   - ".github/file-filters.yml"

package/templates/base/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/base/scripts/check-agent-gates.ts

@@ -75,6 +75,11 @@ const blockedCommands = [
   'echo "$(true&# )\ngit commit -n -m x)"',
   'echo "$(true|# )\ngit commit -n -m x)"',
   'echo "$( (true)# )\ngit commit -n -m x)"',
+  "{ git commit --no-verify -m x; }",
+  "if true; then git commit -n -m x; fi",
+  "while true; do git commit -n -m x; done",
+  "if git commit -n -m x; then true; fi",
+  "printf x > .git/config.worktree",
 ];
 
 const allowedCommands = [
@@ -115,6 +120,9 @@ const protectedPaths = [
   ".husky/pre-commit",
   ".lintstagedrc.json",
   ".gitleaks.toml",
+  ".git/hooks/pre-commit",
+  ".git/config",
+  ".git/config.worktree",
   ".claude/settings.local.json",
   "src/../.husky/pre-commit",
 ];

package/templates/nestjs/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },

package/templates/nestjs/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root:

package/templates/nextjs/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },

package/templates/nextjs/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root:

package/templates/nodejs/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },

package/templates/nodejs/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root:

package/templates/payload/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },

package/templates/payload/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root:

package/templates/turborepo/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },

package/templates/turborepo/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and both Dockerfiles together. Dependabot updates only the Dockerfiles.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root: