@next-friday/create-app 9.5.1 → 9.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "9.5.1",
+  "version": "9.6.0",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/SETUP.md

@@ -43,6 +43,8 @@ In `.github/CODEOWNERS`, add these lines in this order. GitHub uses the last mat
 
 Replace every owner above with a GitHub user or team that has write access to the repository. Also replace the owner placeholder in `.github/zizmor.yml`.
 
+Code owners need: write access to the repository for each owner; for a team, a visible team that itself has write access; and, in a private repository, GitHub Pro, Team, or Enterprise ([code owners](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners)). Until the ruleset of step 3 requires their review, a code owner is asked for a review and a pull request merges without it.
+
 Replace `security@example.com` in `SECURITY.md` with the contact the security policy owner names, such as the security email of the company or of the client.
 
 **Check:** on GitHub, open `.github/CODEOWNERS`; GitHub shows no errors in the file. `grep example.com SECURITY.md` prints nothing.
@@ -73,7 +75,7 @@ Replace `security@example.com` in `SECURITY.md` with the contact the security po
 
 - **Code Review:** in [**Admin settings → Claude Code**](https://claude.ai/admin-settings/claude-code#code-review), turn on **Allow code review**, install the Claude GitHub App, and add this repository ([set up Code Review](https://code.claude.com/docs/en/code-review-setup)). It needs a Team or Enterprise plan ([availability](https://code.claude.com/docs/en/code-review#availability)). Keep **Review runs** at **After every push**, the default, so every push to a pull request gets a review. Reviews run on Anthropic's infrastructure, so the repository has no review workflow. Anyone with write access can also comment `@claude review` on a pull request to start a review ([comment commands](https://code.claude.com/docs/en/code-review-pull-requests#comment-commands)).
 - **Managed settings:** deploy the non-negotiable settings and hooks as [managed settings](https://code.claude.com/docs/en/settings), tailored from the example in `.claude/managed-settings.example.json`. Engineers cannot override them. When `strictKnownMarketplaces` is set, as in the example, add the marketplace `next-friday-plugins` of this project to it, or Claude Code does not register the project's plugin.
-- **Monitoring:** turn on the [OpenTelemetry export](https://code.claude.com/docs/en/monitoring-usage).
+- **Monitoring:** turn on the [OpenTelemetry export](https://code.claude.com/docs/en/monitoring-usage). It needs an OpenTelemetry collector or backend that the organization runs, and its endpoint. Set `CLAUDE_CODE_ENABLE_TELEMETRY`, the exporters, and `OTEL_EXPORTER_OTLP_ENDPOINT` in managed settings, or each engineer sets them in a shell or in `~/.claude/settings.json`: Claude Code ignores these variables in the repository's `.claude/settings.json`, so the project cannot turn the export on.
 
 **Check:** the test pull request gets a **Claude Code Review** check run within a few minutes.
 

package/templates/base/plugins/sdlc/claude-code/hooks/check-reply-shape.sh

@@ -3,8 +3,44 @@ command -v jq > /dev/null || exit 0
 mode=${1:-}
 input=$(cat)
 state_directory=${TMPDIR:-/tmp}/sdlc-reply-shape
-conversation=$(printf '%s' "$input" | jq -r '.conversation_id // ""' | tr -cd 'A-Za-z0-9_-')
+conversation=$(printf '%s' "$input" | jq -r '.conversation_id // .session_id // ""')
+conversation=${conversation:+$(printf '%s' "$conversation" | cksum | tr ' ' '-')}
+project=$(printf '%s' "$input" | jq -r '.cwd // .workspace_roots[0] // ""')
+snapshot_file=$state_directory/$conversation.files
+
+# A copy of the index and a scratch object store keep the project's own Git data unwritten.
+snapshot() {
+  [ -n "$project" ] && [ -n "$conversation" ] || return 1
+  repository=$(git -C "$project" rev-parse --show-toplevel 2> /dev/null) || return 1
+  index=$(git -C "$repository" rev-parse --git-path index) || return 1
+  objects=$(git -C "$repository" rev-parse --git-path objects) || return 1
+  case $index in /*) ;; *) index=$repository/$index ;; esac
+  case $objects in /*) ;; *) objects=$repository/$objects ;; esac
+  scratch=$state_directory/$conversation.git
+  rm -rf "$scratch"
+  mkdir -p "$scratch/objects" || return 1
+  cp "$index" "$scratch/index" 2> /dev/null
+  content=$(
+    export GIT_INDEX_FILE="$scratch/index" GIT_OBJECT_DIRECTORY="$scratch/objects" GIT_ALTERNATE_OBJECT_DIRECTORIES="$objects"
+    git -C "$repository" add -A -- ':(top)' ':(top,exclude)intent' 2> /dev/null
+    git -C "$repository" ls-files -s -- ':(top)' ':(top,exclude)intent' | cksum
+  )
+  rm -rf "$scratch"
+  printf '%s|%s' "$repository" "$content"
+}
+
+changed_since_snapshot() {
+  current=$(snapshot) || return 1
+  previous=$(cat "$snapshot_file" 2> /dev/null)
+  printf '%s' "$current" > "$snapshot_file"
+  [ "${previous%|*}" = "${current%|*}" ] && [ "$previous" != "$current" ]
+}
+
 case $mode in
+  snapshot)
+    changed_since_snapshot
+    exit 0
+    ;;
   save)
     text=$(printf '%s' "$input" | jq -r '.text // ""')
     [ -n "$text" ] && [ -n "$conversation" ] || exit 0
@@ -12,12 +48,16 @@ case $mode in
     exit 0
     ;;
   followup)
+    changed=false
+    changed_since_snapshot && changed=true
     [ -n "$conversation" ] && [ -f "$state_directory/$conversation" ] || exit 0
     reply=$(cat "$state_directory/$conversation")
     rm -f "$state_directory/$conversation"
     [ "$(printf '%s' "$input" | jq -r '"\(.status // "") \(.loop_count // "")"')" = 'completed 0' ] || exit 0
     ;;
   *)
+    changed=false
+    changed_since_snapshot && changed=true
     [ "$(printf '%s' "$input" | jq -r '.stop_hook_active // false')" = true ] && exit 0
     reply=$(printf '%s' "$input" | jq -r '.last_assistant_message // ""')
     ;;
@@ -48,6 +88,10 @@ case $last in
   *) problems="${problems}End the reply with a line that starts with **Status:**; nothing may follow it. " ;;
 esac
 
+if [ "$changed" = true ] && ! printf '%s\n' "$outside_fences" | grep -q '^\*\*Checks:\*\*'; then
+  problems="${problems}A file outside intent/ changed in this turn and the reply has no **Checks:** section. Run the checks the project names and add **Checks:** with each command and the lines of its output that show the result, or with each check that could not run and why. "
+fi
+
 [ -z "$problems" ] && exit 0
 jq -n --arg mode "$mode" --arg reason "${problems}Send the whole reply again." \
   'if $mode == "followup" then {followup_message:$reason} else {decision:"block",reason:$reason} end'

package/templates/base/plugins/sdlc/claude-code/hooks/hooks.json

@@ -1,5 +1,16 @@
 {
   "hooks": {
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "timeout": 10,
+            "type": "command",
+            "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/check-reply-shape.sh\" snapshot"
+          }
+        ]
+      }
+    ],
     "Stop": [
       {
         "hooks": [

package/templates/base/plugins/sdlc/claude-code/skills/sdlc-mode/SKILL.md

@@ -49,7 +49,7 @@ For example, the person writes "who must approve pull request #7 of https://host
 
 **Steps:** <only when the session has no task-list tool, and never for the `question` playbook. One line for each numbered step of the playbook: `1. <the step, copied word for word>: done | open | skip: <reason>`. When the turn ran more than one playbook, one list for each, under its file name on a line of its own, such as `playbooks/build.md`.>
 
-**Checks:** <only when a step ran checks, and never for the `question` playbook. Each command, then the lines of its output that show the result, copied from the output.>
+**Checks:** <when a step ran checks, and always when the turn changed a file outside `intent/`, whichever playbook ran. Otherwise never for the `question` playbook. Each command, then the lines of its output that show the result, copied from the output. For a check that could not run, the check and why.>
 
 <What the current step produces: the round of questions, or the whole draft. For a question or a request no row fits, the answer.>
 

package/templates/base/plugins/sdlc/claude-code/skills/sdlc-mode/playbooks/maintain.md

@@ -13,6 +13,6 @@ This playbook starts from a finding such as an alert, a monitoring ticket, a fai
    - Start a subagent that has not seen the diagnosis, give it only the finding, the logs and files you read, and `intent.md`, and have it try to disprove the **Problem** section from the evidence. When you cannot start a subagent, read the evidence again from the first line as if someone else wrote the intent.
    - When a claim does not survive, move it under **Open questions**, and say in the pull request that the confidence check failed and on which claim.
 5. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as the opening paragraph of `playbooks/open-pr.md` says for branches and pull requests. When you cannot open a pull request from this session, say so and give the pushed branch's name.
-6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, leaves it open to schedule it, or closes it to dismiss it. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
+6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, comments on it with when the finding is scheduled and leaves it open, or closes it to dismiss it. An open pull request with no such comment is undecided: say so, and never report it as scheduled. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
 
 **Next:** `playbooks/design.md`; an agent; when the service owner has merged the intent's pull request and a person or a job sends `/sdlc:sdlc-mode` with the intent's path.

package/templates/base/plugins/sdlc/claude-code/skills/sdlc-mode/playbooks/review.md

@@ -1,6 +1,6 @@
 # Review phase: review the pull request and drive it to green
 
-1. Find what to review: the pull request this session just opened, or the pull request or branch the request names. When there is no pull request, or this session cannot reach its host, review the branch's diff against the default branch and put the findings in your reply in place of a comment.
+1. Find what to review: the pull request this session just opened, or the pull request or branch the request names. When there is no pull request, or this session cannot reach its host, review the branch's diff against the default branch and put the findings in your reply in place of a comment. When a pull request exists and this session cannot post on it, the findings are not in the pull request's history: the **Status** line says that the findings are not on the pull request and that a person posts them there, step 3 stays `open`, and you do not report the review as done.
 2. Review with a fresh context. Start a subagent that has not seen the work. Give it only the diff, `REVIEW.md`, the change's `intent/<change>/spec.md` and `plan.md`, and the four policy files in force, found as `playbooks/design.md` step 2 says. When you cannot start a subagent, read the diff again from the first line as if someone else wrote it. The review runs each pass in `REVIEW.md` and reports each finding with its pass, **Important** or **Nit**, `path:line`, and the evidence. A change that is not a fix, an intent, or a spec, and has no `spec.md` or no `plan.md`, is itself a finding.
 3. Post the findings as one comment on the pull request, most severe first. Write "No findings" when there are none. A finding does not decide the merge. When a finding flags a mistake that an earlier review of this project flagged too, its correction goes into the project's agent instructions as part of this review: in the push of step 4, or, on a pull request or a branch this session did not create, as the exact line in this comment.
 4. On a pull request or a branch that this session did not create, change nothing and push nothing. Skip the rest of this step, and in step 5 only read and answer. Otherwise, fix every Important finding. Run the checks the project's agent instructions name, and push. Answer each finding you do not fix with the reason.

package/templates/base/plugins/sdlc/claude-code/skills/setup-sdlc/SKILL.md

@@ -46,6 +46,8 @@ Do these steps in order. Run again with the same answers, the skill writes the s
    - `2. Owners: not done. .github/CODEOWNERS still holds the placeholder.`
    - `3. Repository settings: a person checks this. They live on the host, not in the repository.`
 
+   Report code owners, the ruleset of the default branch, and the OpenTelemetry export each on a line of its own, with what `SETUP.md` says the step needs, such as `Ruleset of main: a person checks this. It needs a repository admin, and in a private repository GitHub Pro, Team, or Enterprise.` A step that is not done fails no check.
+
 7. **Do the `not done` steps an agent can do:** a step whose whole work is editing a file of the repository with values the repository or the request already gives. Do not redo a `done` step. Do not edit a file the project's rules or agent settings reserve for a person, such as rules, hooks, lint, format, and commit configuration, and the agent settings themselves; list it with the exact new text and the file it goes in. Commit nothing. After each step, run its **Check** again and report the result.
 8. **List the steps a person does outside the repository,** each with who does it, from `SETUP.md`, and the full URL of the page where it is done when `SETUP.md` or the repository names one.
 9. **Write the reply** by the reply rules in `../sdlc-mode/SKILL.md`. After them, in this order: the budget line and the four role lines as written; each step of `SETUP.md` with its state; what you did; what a person does.

package/templates/base/plugins/sdlc/cursor/hooks/check-reply-shape.sh

@@ -3,8 +3,44 @@ command -v jq > /dev/null || exit 0
 mode=${1:-}
 input=$(cat)
 state_directory=${TMPDIR:-/tmp}/sdlc-reply-shape
-conversation=$(printf '%s' "$input" | jq -r '.conversation_id // ""' | tr -cd 'A-Za-z0-9_-')
+conversation=$(printf '%s' "$input" | jq -r '.conversation_id // .session_id // ""')
+conversation=${conversation:+$(printf '%s' "$conversation" | cksum | tr ' ' '-')}
+project=$(printf '%s' "$input" | jq -r '.cwd // .workspace_roots[0] // ""')
+snapshot_file=$state_directory/$conversation.files
+
+# A copy of the index and a scratch object store keep the project's own Git data unwritten.
+snapshot() {
+  [ -n "$project" ] && [ -n "$conversation" ] || return 1
+  repository=$(git -C "$project" rev-parse --show-toplevel 2> /dev/null) || return 1
+  index=$(git -C "$repository" rev-parse --git-path index) || return 1
+  objects=$(git -C "$repository" rev-parse --git-path objects) || return 1
+  case $index in /*) ;; *) index=$repository/$index ;; esac
+  case $objects in /*) ;; *) objects=$repository/$objects ;; esac
+  scratch=$state_directory/$conversation.git
+  rm -rf "$scratch"
+  mkdir -p "$scratch/objects" || return 1
+  cp "$index" "$scratch/index" 2> /dev/null
+  content=$(
+    export GIT_INDEX_FILE="$scratch/index" GIT_OBJECT_DIRECTORY="$scratch/objects" GIT_ALTERNATE_OBJECT_DIRECTORIES="$objects"
+    git -C "$repository" add -A -- ':(top)' ':(top,exclude)intent' 2> /dev/null
+    git -C "$repository" ls-files -s -- ':(top)' ':(top,exclude)intent' | cksum
+  )
+  rm -rf "$scratch"
+  printf '%s|%s' "$repository" "$content"
+}
+
+changed_since_snapshot() {
+  current=$(snapshot) || return 1
+  previous=$(cat "$snapshot_file" 2> /dev/null)
+  printf '%s' "$current" > "$snapshot_file"
+  [ "${previous%|*}" = "${current%|*}" ] && [ "$previous" != "$current" ]
+}
+
 case $mode in
+  snapshot)
+    changed_since_snapshot
+    exit 0
+    ;;
   save)
     text=$(printf '%s' "$input" | jq -r '.text // ""')
     [ -n "$text" ] && [ -n "$conversation" ] || exit 0
@@ -12,12 +48,16 @@ case $mode in
     exit 0
     ;;
   followup)
+    changed=false
+    changed_since_snapshot && changed=true
     [ -n "$conversation" ] && [ -f "$state_directory/$conversation" ] || exit 0
     reply=$(cat "$state_directory/$conversation")
     rm -f "$state_directory/$conversation"
     [ "$(printf '%s' "$input" | jq -r '"\(.status // "") \(.loop_count // "")"')" = 'completed 0' ] || exit 0
     ;;
   *)
+    changed=false
+    changed_since_snapshot && changed=true
     [ "$(printf '%s' "$input" | jq -r '.stop_hook_active // false')" = true ] && exit 0
     reply=$(printf '%s' "$input" | jq -r '.last_assistant_message // ""')
     ;;
@@ -48,6 +88,10 @@ case $last in
   *) problems="${problems}End the reply with a line that starts with **Status:**; nothing may follow it. " ;;
 esac
 
+if [ "$changed" = true ] && ! printf '%s\n' "$outside_fences" | grep -q '^\*\*Checks:\*\*'; then
+  problems="${problems}A file outside intent/ changed in this turn and the reply has no **Checks:** section. Run the checks the project names and add **Checks:** with each command and the lines of its output that show the result, or with each check that could not run and why. "
+fi
+
 [ -z "$problems" ] && exit 0
 jq -n --arg mode "$mode" --arg reason "${problems}Send the whole reply again." \
   'if $mode == "followup" then {followup_message:$reason} else {decision:"block",reason:$reason} end'

package/templates/base/plugins/sdlc/cursor/hooks/hooks.json

@@ -1,6 +1,11 @@
 {
   "version": 1,
   "hooks": {
+    "beforeSubmitPrompt": [
+      {
+        "command": "sh \"${CURSOR_PLUGIN_ROOT}/hooks/check-reply-shape.sh\" snapshot"
+      }
+    ],
     "afterAgentResponse": [
       {
         "command": "sh \"${CURSOR_PLUGIN_ROOT}/hooks/check-reply-shape.sh\" save"

package/templates/base/plugins/sdlc/cursor/skills/sdlc-mode/SKILL.md

@@ -49,7 +49,7 @@ For example, the person writes "who must approve pull request #7 of https://host
 
 **Steps:** <only when the session has no task-list tool, and never for the `question` playbook. One line for each numbered step of the playbook: `1. <the step, copied word for word>: done | open | skip: <reason>`. When the turn ran more than one playbook, one list for each, under its file name on a line of its own, such as `playbooks/build.md`.>
 
-**Checks:** <only when a step ran checks, and never for the `question` playbook. Each command, then the lines of its output that show the result, copied from the output.>
+**Checks:** <when a step ran checks, and always when the turn changed a file outside `intent/`, whichever playbook ran. Otherwise never for the `question` playbook. Each command, then the lines of its output that show the result, copied from the output. For a check that could not run, the check and why.>
 
 <What the current step produces: the round of questions, or the whole draft. For a question or a request no row fits, the answer.>
 

package/templates/base/plugins/sdlc/cursor/skills/sdlc-mode/playbooks/maintain.md

@@ -13,6 +13,6 @@ This playbook starts from a finding such as an alert, a monitoring ticket, a fai
    - Start a subagent that has not seen the diagnosis, give it only the finding, the logs and files you read, and `intent.md`, and have it try to disprove the **Problem** section from the evidence. When you cannot start a subagent, read the evidence again from the first line as if someone else wrote the intent.
    - When a claim does not survive, move it under **Open questions**, and say in the pull request that the confidence check failed and on which claim.
 5. Commit `intent.md` on a new branch, push it, and open a pull request ready for review, as the opening paragraph of `playbooks/open-pr.md` says for branches and pull requests. When you cannot open a pull request from this session, say so and give the pushed branch's name.
-6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, leaves it open to schedule it, or closes it to dismiss it. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
+6. **Gate: the service owner triages the finding.** The service owner merges the pull request to fix the finding now, comments on it with when the finding is scheduled and leaves it open, or closes it to dismiss it. An open pull request with no such comment is undecided: say so, and never report it as scheduled. A dismissal tunes the bands: the service owner adjusts `bands.yaml` so the same noise raises fewer findings. The service owner asks the product owner to decide a product-facing finding. You do none of these. Report the pull request's URL, keep it green as `playbooks/review.md` says, and wait.
 
 **Next:** `playbooks/design.md`; an agent; when the service owner has merged the intent's pull request and a person or a job sends `/sdlc:sdlc-mode` with the intent's path.

package/templates/base/plugins/sdlc/cursor/skills/sdlc-mode/playbooks/review.md

@@ -1,6 +1,6 @@
 # Review phase: review the pull request and drive it to green
 
-1. Find what to review: the pull request this session just opened, or the pull request or branch the request names. When there is no pull request, or this session cannot reach its host, review the branch's diff against the default branch and put the findings in your reply in place of a comment.
+1. Find what to review: the pull request this session just opened, or the pull request or branch the request names. When there is no pull request, or this session cannot reach its host, review the branch's diff against the default branch and put the findings in your reply in place of a comment. When a pull request exists and this session cannot post on it, the findings are not in the pull request's history: the **Status** line says that the findings are not on the pull request and that a person posts them there, step 3 stays `open`, and you do not report the review as done.
 2. Review with a fresh context. Start a subagent that has not seen the work. Give it only the diff, `REVIEW.md`, the change's `intent/<change>/spec.md` and `plan.md`, and the four policy files in force, found as `playbooks/design.md` step 2 says. When you cannot start a subagent, read the diff again from the first line as if someone else wrote it. The review runs each pass in `REVIEW.md` and reports each finding with its pass, **Important** or **Nit**, `path:line`, and the evidence. A change that is not a fix, an intent, or a spec, and has no `spec.md` or no `plan.md`, is itself a finding.
 3. Post the findings as one comment on the pull request, most severe first. Write "No findings" when there are none. A finding does not decide the merge. When a finding flags a mistake that an earlier review of this project flagged too, its correction goes into the project's agent instructions as part of this review: in the push of step 4, or, on a pull request or a branch this session did not create, as the exact line in this comment.
 4. On a pull request or a branch that this session did not create, change nothing and push nothing. Skip the rest of this step, and in step 5 only read and answer. Otherwise, fix every Important finding. Run the checks the project's agent instructions name, and push. Answer each finding you do not fix with the reason.

package/templates/base/plugins/sdlc/cursor/skills/setup-sdlc/SKILL.md

@@ -46,6 +46,8 @@ Do these steps in order. Run again with the same answers, the skill writes the s
    - `2. Owners: not done. .github/CODEOWNERS still holds the placeholder.`
    - `3. Repository settings: a person checks this. They live on the host, not in the repository.`
 
+   Report code owners, the ruleset of the default branch, and the OpenTelemetry export each on a line of its own, with what `SETUP.md` says the step needs, such as `Ruleset of main: a person checks this. It needs a repository admin, and in a private repository GitHub Pro, Team, or Enterprise.` A step that is not done fails no check.
+
 7. **Do the `not done` steps an agent can do:** a step whose whole work is editing a file of the repository with values the repository or the request already gives. Do not redo a `done` step. Do not edit a file the project's rules or agent settings reserve for a person, such as rules, hooks, lint, format, and commit configuration, and the agent settings themselves; list it with the exact new text and the file it goes in. Commit nothing. After each step, run its **Check** again and report the result.
 8. **List the steps a person does outside the repository,** each with who does it, from `SETUP.md`, and the full URL of the page where it is done when `SETUP.md` or the repository names one.
 9. **Write the reply** by the reply rules in `../sdlc-mode/SKILL.md`. After them, in this order: the budget line and the four role lines as written; each step of `SETUP.md` with its state; what you did; what a person does.