@next-friday/create-app 2.1.8 → 3.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.1.8",
+  "version": "3.0.0",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/.agents/agents.json

@@ -0,0 +1,7 @@
+{
+  "verifier": {
+    "description": "Runs the app and checks the change works before the session reports done",
+    "readonly": true,
+    "tools": ["Bash", "Read"]
+  }
+}

package/templates/base/.agents/hooks/agent-format-after-edit.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+input=$(cat)
+cd "${CLAUDE_PROJECT_DIR:-${CURSOR_PROJECT_DIR:-$PWD}}" || exit 0
+path=$(jq -r '.tool_input.file_path // .tool_input.notebook_path // .file_path // empty' <<< "$input")
+[[ -n $path && -f $path ]] || exit 0
+
+case $path in
+  *.ts | *.tsx | *.js | *.jsx | *.mjs | *.cjs)
+    pnpm exec eslint --fix --cache --max-warnings=0 --no-warn-ignored --no-inline-config "$path" > /dev/null 2>&1
+    ;;
+esac
+pnpm exec prettier --write --cache --ignore-unknown "$path" > /dev/null 2>&1
+exit 0

package/templates/base/.agents/hooks/agent-production-gate.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Production deploys require a named release authorization
+cmd=$(jq -r '.tool_input.command // .command' < /dev/stdin)
+if [[ "$cmd" == *"deploy"* && "$cmd" == *"production"* ]]; then
+  if [ -z "$RELEASE_APPROVAL" ]; then
+    echo "Production deploys need a release authorization." >&2
+    exit 2 # exit 2 blocks the action; the message goes to Claude
+  fi
+fi
+exit 0

package/templates/base/.agents/hooks/agent-test-edit-gate.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+allow() {
+  printf '%s\n' '{"permission":"allow"}'
+  exit 0
+}
+
+block() {
+  jq -n --arg message "$1" '{permission:"deny",user_message:$message,agent_message:$message}'
+  printf 'agent-test-edit-gate: %s\n' "$1" >&2
+  exit 2
+}
+
+trap 'block ".agents/hooks/agent-test-edit-gate.sh failed. Stop and report this error to the user; agents may not edit the gate."' ERR
+command -v jq > /dev/null || block "jq is required to read the hook input. Install it: https://jqlang.org/download/"
+input=$(cat)
+project=${CLAUDE_PROJECT_DIR:-${CURSOR_PROJECT_DIR:-$PWD}}
+[[ -e "$project/.git/bug-fix-in-progress" ]] || allow
+path=$(jq -r '.tool_input.file_path // .tool_input.path // .tool_input.notebook_path // .file_path // empty' <<< "$input")
+[[ -n $path ]] || allow
+if [[ $path =~ (\.test\.|\.spec\.|\.e2e\.test\.|(^|/)tests?/) ]]; then
+  block "A bug fix is in progress (.git/bug-fix-in-progress), so $path cannot change. Fix the code, not the test."
+fi
+allow

package/templates/base/.agents/review.md

@@ -0,0 +1,21 @@
+# Review instructions
+
+## Passes
+
+Run three passes and tag each finding with its pass:
+
+- Bugs: logic errors, broken edge cases, subtle regressions
+- Security: injection risks, authentication gaps, PII in logs
+- Compliance: the change matches spec.md, plan.md and our design principles
+
+## What Important means here
+
+Reserve Important for findings that would break behavior, leak data or breach a policy. Style and naming are nits.
+
+## Cap the nits
+
+Report at most five nits per review; summarize the rest as a count.
+
+## Do not report
+
+Generated files under src/gen/ and anything CI already enforces.

package/templates/base/.agents/rules/no-suppression.md

@@ -2,6 +2,6 @@
 
 Fix what a linter, type checker, or scanner reports, including the replacement it suggests. Comments a tool requires follow `code-comments.md`.
 
-Record an accepted risk only in that tool's central file, with an owner, a reason, and an expiry date: `.github/zizmor.yml` for zizmor, `osv-scanner.toml` for OSV-Scanner, `.gitleaksignore` for gitleaks, `.trivyignore` for Trivy, or `.hadolint.yaml` for hadolint. Create the file or key when the first accepted risk needs it. Do not add inline suppressions; `.agents/hooks/agent-suppression-gate.sh` defines the rejected directives.
+Record an accepted risk only in that tool's central file, with an owner and a reason: `.github/zizmor.yml` for zizmor, `osv-scanner.toml` for OSV-Scanner, `.gitleaksignore` for gitleaks, `.trivyignore` for Trivy, or `.hadolint.yaml` for hadolint. Create the file or key when the first accepted risk needs it. Do not add inline suppressions; `.agents/hooks/agent-suppression-gate.sh` defines the rejected directives.
 
 When a finding looks wrong, stop and cite the tool's documentation to the user. Report a finding as fixed only when the tool passes, with any accepted risk in that central file.

package/templates/base/.agents/skills/babysit-pr/SKILL.md

@@ -0,0 +1,8 @@
+---
+name: babysit-pr
+description: Drive a pull request you opened until it waits only on code owner approval. Use when asked to babysit, watch, or finish a pull request.
+---
+
+# Babysit a pull request
+
+Sweep the unresolved review comments and failing checks on the pull request, address them, and push the fixes. Repeat until the pull request is green and waiting only on code owner approval. Never approve or merge it.

package/templates/base/.agents/skills/brand-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: brand-policy
+description: Apply the organization's brand policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Brand policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.agents/skills/compliance-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: compliance-policy
+description: Apply the organization's compliance policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Compliance policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.agents/skills/security-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: security-policy
+description: Apply the organization's security policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Security policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.agents/skills/ux-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: ux-policy
+description: Apply the organization's UX policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# UX policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.agents/skills/write-intent/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: write-intent
+description: Write intent.md, the proto-spec that starts a change. Use whenever someone describes an idea, a problem, or a change they want, before a spec or code exists.
+---
+
+# Write intent.md
+
+1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
+2. Brainstorm until the idea is concrete. Ask the questions an analyst would ask: scope, users, constraints, and what success looks like.
+3. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below.
+4. Ask the originator to correct anything you misunderstood.
+5. Commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by closing it.
+
+## Template
+
+```markdown
+# Intent: <title>
+
+Author: <name> (<team>). Status: draft.
+
+## Problem
+
+## Proposed outcome
+
+## Affected users and systems
+
+## Constraints
+
+## Open questions
+```

package/templates/base/.agents/skills/write-spec/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: write-spec
+description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when an intent.md has been accepted and the change needs its spec.
+---
+
+# Write spec.md
+
+Read the `intent.md` the user names, and follow this prompt:
+
+> Read the attached intent.md and produce a requirements and design spec for integrating it into our existing codebase. Apply the skills available to you so the plan conforms to our brand guidelines, security policies and UX standards. Document the spec fully as spec.md, ready to hand to the engineering team. Describe clearly any areas of concern, especially where you cannot satisfy contradicting policies.
+
+Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward.

package/templates/base/.claude/managed-settings.example.json

@@ -0,0 +1,26 @@
+{
+  "permissions": {
+    "deny": ["Read(.env*)", "Read(./secrets/**)", "WebFetch", "Bash(curl *)", "Bash(wget *)"],
+    "allow": ["Bash(git *)", "Bash(make build)", "Bash(make test)", "Bash(make lint)"],
+    "disableBypassPermissionsMode": "disable"
+  },
+  "allowManagedPermissionRulesOnly": true,
+  "sandbox": {
+    "enabled": true,
+    "failIfUnavailable": true,
+    "allowUnsandboxedCommands": false,
+    "network": {"allowedDomains": ["git.internal.example.com", "registry.npmjs.org"]},
+    "credentials": {
+      "files": [
+        {"path": "~/.ssh", "mode": "deny"},
+        {"path": "~/.aws/credentials", "mode": "deny"}
+      ],
+      "envVars": [{"name": "GITHUB_TOKEN", "mode": "deny"}]
+    }
+  },
+  "allowManagedHooksOnly": true,
+  "disableSideloadFlags": true,
+  "allowManagedMcpServersOnly": true,
+  "strictKnownMarketplaces": [{"source": "github", "repo": "example-corp/approved-plugins"}],
+  "requiredMinimumVersion": "2.1.193"
+}

package/templates/base/.claude/settings.json

@@ -1,6 +1,15 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "permissions": {
+    "defaultMode": "plan",
+    "allow": [
+      "Bash(git *)",
+      "Bash(pnpm build)",
+      "Bash(pnpm test)",
+      "Bash(pnpm test:coverage)",
+      "Bash(pnpm verify:static)",
+      "Bash(pnpm verify)"
+    ],
     "deny": [
       "Edit(./.agents/rules/**)",
       "Edit(./.claude/rules/**)",
@@ -45,6 +54,12 @@
             "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-suppression-gate.sh",
             "timeout": 10,
             "onFailure": "block"
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-test-edit-gate.sh",
+            "timeout": 10,
+            "onFailure": "block"
           }
         ]
       },
@@ -56,6 +71,22 @@
             "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-shell-gate.sh",
             "timeout": 10,
             "onFailure": "block"
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-production-gate.sh",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write|MultiEdit|NotebookEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.agents/hooks/agent-format-after-edit.sh"
           }
         ]
       }

package/templates/base/.claude/skills/babysit-pr/SKILL.md

@@ -0,0 +1,8 @@
+---
+name: babysit-pr
+description: Drive a pull request you opened until it waits only on code owner approval. Use when asked to babysit, watch, or finish a pull request.
+---
+
+# Babysit a pull request
+
+Sweep the unresolved review comments and failing checks on the pull request, address them, and push the fixes. Repeat until the pull request is green and waiting only on code owner approval. Never approve or merge it.

package/templates/base/.claude/skills/brand-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: brand-policy
+description: Apply the organization's brand policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Brand policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.claude/skills/compliance-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: compliance-policy
+description: Apply the organization's compliance policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Compliance policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.claude/skills/security-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: security-policy
+description: Apply the organization's security policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Security policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.claude/skills/ux-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: ux-policy
+description: Apply the organization's UX policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# UX policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.claude/skills/write-intent/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: write-intent
+description: Write intent.md, the proto-spec that starts a change. Use whenever someone describes an idea, a problem, or a change they want, before a spec or code exists.
+---
+
+# Write intent.md
+
+1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
+2. Brainstorm until the idea is concrete. Ask the questions an analyst would ask: scope, users, constraints, and what success looks like.
+3. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below.
+4. Ask the originator to correct anything you misunderstood.
+5. Commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by closing it.
+
+## Template
+
+```markdown
+# Intent: <title>
+
+Author: <name> (<team>). Status: draft.
+
+## Problem
+
+## Proposed outcome
+
+## Affected users and systems
+
+## Constraints
+
+## Open questions
+```

package/templates/base/.claude/skills/write-spec/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: write-spec
+description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when an intent.md has been accepted and the change needs its spec.
+---
+
+# Write spec.md
+
+Read the `intent.md` the user names, and follow this prompt:
+
+> Read the attached intent.md and produce a requirements and design spec for integrating it into our existing codebase. Apply the skills available to you so the plan conforms to our brand guidelines, security policies and UX standards. Document the spec fully as spec.md, ready to hand to the engineering team. Describe clearly any areas of concern, especially where you cannot satisfy contradicting policies.
+
+Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward.

package/templates/base/.cursor/BUGBOT.md

@@ -2,6 +2,7 @@
 
 Review pull requests against the project's agent guide and rules:
 
+- [Review instructions](../.agents/review.md)
 - [Agent guide](../AGENTS.md)
 - [Agent-Owned Work](../.agents/rules/agent-owned-work.md)
 - [Owned Checks](../.agents/rules/automation-owned-checks.md)

package/templates/base/.cursor/hooks.json

@@ -13,6 +13,12 @@
         "matcher": "Write|StrReplace|Delete",
         "timeout": 10,
         "failClosed": true
+      },
+      {
+        "command": ".agents/hooks/agent-test-edit-gate.sh",
+        "matcher": "Write|StrReplace",
+        "timeout": 10,
+        "failClosed": true
       }
     ],
     "beforeShellExecution": [
@@ -20,6 +26,15 @@
         "command": ".agents/hooks/agent-shell-gate.sh",
         "timeout": 10,
         "failClosed": true
+      },
+      {
+        "command": ".agents/hooks/agent-production-gate.sh",
+        "timeout": 10
+      }
+    ],
+    "afterFileEdit": [
+      {
+        "command": ".agents/hooks/agent-format-after-edit.sh"
       }
     ]
   }

package/templates/base/.cursor/rules/no-suppression.mdc

@@ -7,6 +7,6 @@ alwaysApply: true
 
 Fix what a linter, type checker, or scanner reports, including the replacement it suggests. Comments a tool requires follow `code-comments.md`.
 
-Record an accepted risk only in that tool's central file, with an owner, a reason, and an expiry date: `.github/zizmor.yml` for zizmor, `osv-scanner.toml` for OSV-Scanner, `.gitleaksignore` for gitleaks, `.trivyignore` for Trivy, or `.hadolint.yaml` for hadolint. Create the file or key when the first accepted risk needs it. Do not add inline suppressions; `.agents/hooks/agent-suppression-gate.sh` defines the rejected directives.
+Record an accepted risk only in that tool's central file, with an owner and a reason: `.github/zizmor.yml` for zizmor, `osv-scanner.toml` for OSV-Scanner, `.gitleaksignore` for gitleaks, `.trivyignore` for Trivy, or `.hadolint.yaml` for hadolint. Create the file or key when the first accepted risk needs it. Do not add inline suppressions; `.agents/hooks/agent-suppression-gate.sh` defines the rejected directives.
 
 When a finding looks wrong, stop and cite the tool's documentation to the user. Report a finding as fixed only when the tool passes, with any accepted risk in that central file.

package/templates/base/.cursor/skills/babysit-pr/SKILL.md

@@ -0,0 +1,8 @@
+---
+name: babysit-pr
+description: Drive a pull request you opened until it waits only on code owner approval. Use when asked to babysit, watch, or finish a pull request.
+---
+
+# Babysit a pull request
+
+Sweep the unresolved review comments and failing checks on the pull request, address them, and push the fixes. Repeat until the pull request is green and waiting only on code owner approval. Never approve or merge it.

package/templates/base/.cursor/skills/brand-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: brand-policy
+description: Apply the organization's brand policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Brand policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.cursor/skills/compliance-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: compliance-policy
+description: Apply the organization's compliance policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Compliance policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.cursor/skills/security-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: security-policy
+description: Apply the organization's security policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# Security policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.cursor/skills/ux-policy/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: ux-policy
+description: Apply the organization's UX policy. Use whenever writing or reviewing a spec.md, a plan, or code that this policy covers.
+---
+
+# UX policy
+
+Owner: <the named policy owner>
+
+Source of truth: <where the written policy lives>
+
+This policy is not written yet. Report that as an area of concern.

package/templates/base/.cursor/skills/write-intent/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: write-intent
+description: Write intent.md, the proto-spec that starts a change. Use whenever someone describes an idea, a problem, or a change they want, before a spec or code exists.
+---
+
+# Write intent.md
+
+1. Let the originator describe the problem in their own words: what they cannot do today, who is affected, what better looks like, and what is out of scope.
+2. Brainstorm until the idea is concrete. Ask the questions an analyst would ask: scope, users, constraints, and what success looks like.
+3. Write the result as `intent/<change>/intent.md`, where `<change>` is a short kebab-case name, using the template below.
+4. Ask the originator to correct anything you misunderstood.
+5. Commit `intent.md` and open a pull request. The product owner accepts it by merging the pull request, or rejects it by closing it.
+
+## Template
+
+```markdown
+# Intent: <title>
+
+Author: <name> (<team>). Status: draft.
+
+## Problem
+
+## Proposed outcome
+
+## Affected users and systems
+
+## Constraints
+
+## Open questions
+```

package/templates/base/.cursor/skills/write-spec/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: write-spec
+description: Produce spec.md, the requirements and design spec, from an accepted intent.md. Use when an intent.md has been accepted and the change needs its spec.
+---
+
+# Write spec.md
+
+Read the `intent.md` the user names, and follow this prompt:
+
+> Read the attached intent.md and produce a requirements and design spec for integrating it into our existing codebase. Apply the skills available to you so the plan conforms to our brand guidelines, security policies and UX standards. Document the spec fully as spec.md, ready to hand to the engineering team. Describe clearly any areas of concern, especially where you cannot satisfy contradicting policies.
+
+Write `spec.md` alongside that `intent.md`, in the same folder. Answer each open question from `intent.md`, or carry it forward.