@next-friday/create-app 2.1.3 → 2.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.1.3",
+  "version": "2.1.5",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",
@@ -73,15 +73,19 @@
     "dev": "tsdown --watch",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
+    "gates:check": "node scripts/check-agent-gates.ts",
     "knip": "knip",
     "lint": "eslint . --fix --cache --max-warnings=0 --no-inline-config",
     "lint:check": "eslint . --cache --max-warnings=0 --no-inline-config",
+    "rules:check": "node scripts/sync-agent-rules.ts --check",
+    "rules:sync": "node scripts/sync-agent-rules.ts",
     "sort-package-json": "sort-package-json package.json",
     "sort-package-json:check": "sort-package-json --check package.json",
+    "suppressions:check": "bash .agents/hooks/agent-suppression-gate.sh --repo",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm test:coverage && pnpm knip && pnpm build && pnpm check:publint"
+    "verify": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm typecheck && pnpm test:coverage && pnpm knip && pnpm build && pnpm check:publint"
   }
 }

package/templates/base/.agents/hooks/agent-shell-gate.sh

@@ -20,7 +20,7 @@ command=$(jq -r '.command // .tool_input.command // empty' <<< "$input")
 
 separator=$'\x1f'
 redirect=$'\x1e'
-protected_names='(\.husky|\.agents|\.cursor|\.claude/rules|\.claude/settings(\.local)?\.json|\.git/hooks|\.git/config|\.lintstagedrc\.json|\.gitleaks\.toml|\.commitlintrc\.json|\.prettierrc\.json|prettier\.config\.ts|eslint\.config\.ts|scripts/(sync-agent-rules|check-agent-gates)\.ts)'
+protected_names='(\.husky|\.agents|\.cursor|\.claude/rules|\.claude/settings(\.local)?\.json|\.git/hooks|\.git/config(\.worktree)?|\.lintstagedrc\.json|\.gitleaks\.toml|\.commitlintrc\.json|\.prettierrc\.json|prettier\.config\.ts|eslint\.config\.ts|scripts/(sync-agent-rules|check-agent-gates)\.ts)'
 protected="(^|[/=])$protected_names(/|$)"
 policy="Hooks and agent policy files are company policy; stop and ask the user."
 in_protected=0
@@ -117,6 +117,15 @@ lex() {
           flush
           words+=("$separator")
           ;;
+        '{' | '}')
+          if ((has_word)); then
+            word+=$char
+            has_word=1
+          else
+            flush
+            words+=("$separator")
+          fi
+          ;;
         '>')
           flush
           while [[ ${text:index+1:1} == [\>\|\&] ]]; do
@@ -271,7 +280,9 @@ check_command() {
       continue
     fi
     case ${word##*/} in
-      env | command | exec | nohup | time | nice | sudo | builtin) args=("${args[@]:1}") ;;
+      env | command | exec | nohup | time | nice | sudo | builtin | if | then | else | elif | fi | while | until | for | do | done | case | esac | select | in | '!' | '{' | '}')
+        args=("${args[@]:1}")
+        ;;
       *) break ;;
     esac
   done

package/templates/base/.agents/rules/codebase-hygiene.md

@@ -0,0 +1,13 @@
+# Codebase Hygiene
+
+Keep the codebase clean. Modify existing code instead of accumulating new code. Git owns history, not source code.
+
+- **No duplication.** Do not add code that repeats an existing declaration or behavior.
+- **No dead code.** Do not keep code the current behavior does not run.
+- **No unnecessary versioning.** Do not store version history in source. Do not add a version constant or a versioned copy of a prompt, instruction, or behavior.
+- **No log accumulation.** Do not add a log that repeats one already recorded, and do not commit log output.
+- **Single source of truth.** One fact has one owning declaration.
+- **Minimal changes.** Change only what the current behavior requires.
+- **Remove before adding.** Change or delete the existing code before adding new code. When a declaration already exists, overwrite it. Do not keep the previous text as an example.
+
+_Completion criterion_: The diff changes or deletes current code when that meets the requirement. New code exists only when no current code can be changed to do the job. History stays in git.

package/templates/base/.agents/rules/descriptive-naming.md

@@ -0,0 +1,12 @@
+# Descriptive Naming
+
+A path or identifier names what it holds. A reader knows what a file, directory, module, or route contains without opening it.
+
+- **Name the responsibility.** Each file and directory name states the feature, domain concept, or role it holds.
+- **No organization names.** Do not put an organization, brand, customer, or tenant name in a path or identifier. User-visible text that names the organization reads it from one configured source, not from a literal.
+- **Distinguishable siblings.** Qualify a generic word such as `settings`, `config`, `utils`, `helpers`, `common`, or `detail` with its domain noun. Files that sit together each name the role they play.
+- **Do not copy a name that breaks this rule.** Sibling style does not override it. Give new code a descriptive name and report the existing name to the user.
+
+Folder names and file suffixes that the framework or toolchain requires follow that tool's convention.
+
+_Completion criterion_: Every path and identifier the diff adds names its responsibility, contains no organization name, and is distinguishable from its siblings.

package/templates/base/.agents/rules/single-author-style.md

@@ -2,6 +2,6 @@
 
 Treat each application, package, or component as one author's work. Match representative siblings for layout, naming, exports, helpers, composition, errors, and abstraction. Use the language's standard idiom when no sibling exists. Name the convention when a conflict affects the design.
 
-Keep execution flow collocated. Extract a helper when multiple callers share it. One term per concept; parallel symbols share grammatical shape. Comments follow `code-comments.md`.
+Keep execution flow collocated. Extract a helper when multiple callers share it. One term per concept; parallel symbols share grammatical shape. Comments follow `code-comments.md`. Names follow `descriptive-naming.md`, which matching siblings does not override.
 
 Keep edits in the requested component, its call sites, and the workspace metadata it needs. Cross-project convention changes are in scope only when the task names them.

package/templates/base/.claude/rules/codebase-hygiene.md

@@ -0,0 +1 @@
+@../../.agents/rules/codebase-hygiene.md

package/templates/base/.claude/rules/descriptive-naming.md

@@ -0,0 +1 @@
+@../../.agents/rules/descriptive-naming.md

package/templates/base/.claude/settings.json

@@ -18,6 +18,9 @@
       "Edit(./scripts/sync-agent-rules.ts)",
       "Edit(./scripts/check-agent-gates.ts)",
       "Edit(./.husky/**)",
+      "Edit(./.git/hooks/**)",
+      "Edit(./.git/config)",
+      "Edit(./.git/config.worktree)",
       "Edit(./.lintstagedrc.json)",
       "Edit(./.gitleaks.toml)",
       "Bash(gh repo delete *)",

package/templates/base/.cursor/BUGBOT.md

@@ -5,9 +5,11 @@ Review pull requests against the project's agent guide and rules:
 - [Agent guide](../AGENTS.md)
 - [Owned Checks](../.agents/rules/automation-owned-checks.md)
 - [Required Comments](../.agents/rules/code-comments.md)
+- [Codebase Hygiene](../.agents/rules/codebase-hygiene.md)
 - [Current State](../.agents/rules/current-state-authority.md)
 - [Demand-Driven Configuration](../.agents/rules/demand-driven-configuration.md)
 - [Dependencies](../.agents/rules/dependency-security.md)
+- [Descriptive Naming](../.agents/rules/descriptive-naming.md)
 - [Test Admission](../.agents/rules/deterministic-testing.md)
 - [Diagnostics](../.agents/rules/diagnostics-and-error-handling.md)
 - [Git Workflow](../.agents/rules/git-workflow.md)

package/templates/base/.cursor/hooks/agent-constitution-gate.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -uo pipefail
 
-protected='^(\.agents/rules/|\.agents/rules\.json$|\.agents/hooks/|\.claude/rules/|\.claude/settings(\.local)?\.json$|\.cursor/rules/|\.cursor/hooks/|\.cursor/hooks\.json$|scripts/sync-agent-rules\.ts$|scripts/check-agent-gates\.ts$|\.commitlintrc\.json$|\.prettierrc\.json$|prettier\.config\.ts$|eslint\.config\.ts$|\.husky/|\.lintstagedrc\.json$|\.gitleaks\.toml$)'
+protected='^(\.agents/rules/|\.agents/rules\.json$|\.agents/hooks/|\.claude/rules/|\.claude/settings(\.local)?\.json$|\.cursor/rules/|\.cursor/hooks/|\.cursor/hooks\.json$|scripts/sync-agent-rules\.ts$|scripts/check-agent-gates\.ts$|\.commitlintrc\.json$|\.prettierrc\.json$|prettier\.config\.ts$|eslint\.config\.ts$|\.husky/|\.lintstagedrc\.json$|\.gitleaks\.toml$|\.git/hooks/|\.git/config(\.worktree)?$)'
 
 allow() {
   printf '%s\n' '{"permission":"allow"}'

package/templates/base/.cursor/rules/codebase-hygiene.mdc

@@ -0,0 +1,18 @@
+---
+description: "Codebase hygiene: modify existing code instead of accumulating new code"
+alwaysApply: true
+---
+
+# Codebase Hygiene
+
+Keep the codebase clean. Modify existing code instead of accumulating new code. Git owns history, not source code.
+
+- **No duplication.** Do not add code that repeats an existing declaration or behavior.
+- **No dead code.** Do not keep code the current behavior does not run.
+- **No unnecessary versioning.** Do not store version history in source. Do not add a version constant or a versioned copy of a prompt, instruction, or behavior.
+- **No log accumulation.** Do not add a log that repeats one already recorded, and do not commit log output.
+- **Single source of truth.** One fact has one owning declaration.
+- **Minimal changes.** Change only what the current behavior requires.
+- **Remove before adding.** Change or delete the existing code before adding new code. When a declaration already exists, overwrite it. Do not keep the previous text as an example.
+
+_Completion criterion_: The diff changes or deletes current code when that meets the requirement. New code exists only when no current code can be changed to do the job. History stays in git.

package/templates/base/.cursor/rules/descriptive-naming.mdc

@@ -0,0 +1,17 @@
+---
+description: "Descriptive naming: paths and identifiers name what they hold, without organization names"
+alwaysApply: true
+---
+
+# Descriptive Naming
+
+A path or identifier names what it holds. A reader knows what a file, directory, module, or route contains without opening it.
+
+- **Name the responsibility.** Each file and directory name states the feature, domain concept, or role it holds.
+- **No organization names.** Do not put an organization, brand, customer, or tenant name in a path or identifier. User-visible text that names the organization reads it from one configured source, not from a literal.
+- **Distinguishable siblings.** Qualify a generic word such as `settings`, `config`, `utils`, `helpers`, `common`, or `detail` with its domain noun. Files that sit together each name the role they play.
+- **Do not copy a name that breaks this rule.** Sibling style does not override it. Give new code a descriptive name and report the existing name to the user.
+
+Folder names and file suffixes that the framework or toolchain requires follow that tool's convention.
+
+_Completion criterion_: Every path and identifier the diff adds names its responsibility, contains no organization name, and is distinguishable from its siblings.

package/templates/base/.cursor/rules/single-author-style.mdc

@@ -7,6 +7,6 @@ alwaysApply: true
 
 Treat each application, package, or component as one author's work. Match representative siblings for layout, naming, exports, helpers, composition, errors, and abstraction. Use the language's standard idiom when no sibling exists. Name the convention when a conflict affects the design.
 
-Keep execution flow collocated. Extract a helper when multiple callers share it. One term per concept; parallel symbols share grammatical shape. Comments follow `code-comments.md`.
+Keep execution flow collocated. Extract a helper when multiple callers share it. One term per concept; parallel symbols share grammatical shape. Comments follow `code-comments.md`. Names follow `descriptive-naming.md`, which matching siblings does not override.
 
 Keep edits in the requested component, its call sites, and the workspace metadata it needs. Cross-project convention changes are in scope only when the task names them.

package/templates/base/scripts/check-agent-gates.ts

@@ -75,6 +75,11 @@ const blockedCommands = [
   'echo "$(true&# )\ngit commit -n -m x)"',
   'echo "$(true|# )\ngit commit -n -m x)"',
   'echo "$( (true)# )\ngit commit -n -m x)"',
+  "{ git commit --no-verify -m x; }",
+  "if true; then git commit -n -m x; fi",
+  "while true; do git commit -n -m x; done",
+  "if git commit -n -m x; then true; fi",
+  "printf x > .git/config.worktree",
 ];
 
 const allowedCommands = [
@@ -115,6 +120,9 @@ const protectedPaths = [
   ".husky/pre-commit",
   ".lintstagedrc.json",
   ".gitleaks.toml",
+  ".git/hooks/pre-commit",
+  ".git/config",
+  ".git/config.worktree",
   ".claude/settings.local.json",
   "src/../.husky/pre-commit",
 ];

package/templates/nestjs/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -15,6 +18,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts"]

package/templates/nextjs/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -15,6 +18,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts", "**/*.test.tsx"]

package/templates/nodejs/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -15,6 +18,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts"]

package/templates/payload/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -15,6 +18,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts", "**/*.test.tsx"]

package/templates/turborepo/.agents/rules.json

@@ -5,6 +5,9 @@
   "code-comments": {
     "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
   },
+  "codebase-hygiene": {
+    "description": "Codebase hygiene: modify existing code instead of accumulating new code"
+  },
   "current-state-authority": {
     "description": "Current state: implement from user requirements and the working tree"
   },
@@ -15,6 +18,9 @@
     "description": "Dependencies: add a package only when code or a contract uses it",
     "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
   },
+  "descriptive-naming": {
+    "description": "Descriptive naming: paths and identifiers name what they hold, without organization names"
+  },
   "deterministic-testing": {
     "description": "Test admission: add a case only when it catches a defect current tests miss",
     "globs": ["**/*.test.ts", "**/*.test.tsx"]