@polymorphism-tech/morph-spec 4.15.0 → 4.17.0

package/src/lib/installers/mcp-installer.js

@@ -26,7 +26,7 @@ export function loadMcpRegistry() {
 /**
  * Filter MCPs by stack relevance
  * @param {Object} registry - Full MCP registry
- * @param {string} stack - Detected project stack (e.g., 'nextjs-supabase', 'blazor')
+ * @param {string} stack - Detected project stack (e.g., 'nextjs-neon', 'blazor')
  * @returns {Object} Filtered map of mcpName → mcpEntry
  */
 export function filterByStack(registry, stack) {

package/src/lib/tasks/task-classifier.js

@@ -1,5 +1,5 @@
 /**
- * Task classifier — identifies test/validation tasks by title.
+ * Task classifier — identifies test/validation and infrastructure tasks by title.
  */
 
 const TEST_TASK_PATTERN = /\b(tests?|testing|specs?|coverage|e2e|unit|integration|integra[cç][aã]o|valida[cç][aã]o|cobertura|testes?)\b/i;
@@ -14,3 +14,17 @@ export function isTestTask(taskTitle) {
   if (!taskTitle) return false;
   return TEST_TASK_PATTERN.test(taskTitle);
 }
+
+const INFRA_TASK_PATTERN = /\b(infrastructure|infra|cleanup|migration|migra[cç][aã]o|config|setup|ci\/cd|devops|deploy|docker|packages?|dependencies|tags)\b/i;
+
+/**
+ * Returns true if the task title indicates an infrastructure/cleanup/migration task.
+ * Used to skip contract validation and suppress breaking change warnings.
+ *
+ * @param {string} taskTitle
+ * @returns {boolean}
+ */
+export function isInfrastructureTask(taskTitle) {
+  if (!taskTitle) return false;
+  return INFRA_TASK_PATTERN.test(taskTitle);
+}

package/src/lib/tasks/test-runner.js

@@ -68,9 +68,13 @@ export function runTestSuite(projectPath = '.', opts = {}) {
     });
     return { passed: true, output: output ?? '', exitCode: 0 };
   } catch (err) {
+    const output = (err.stdout || '') + (err.stderr || '');
+    const BUILD_FAIL = /Build FAILED|error MSB\d+|error CS\d+|Could not find.*\.csproj/i;
+    const buildFailed = BUILD_FAIL.test(output);
     return {
       passed: false,
-      output: (err.stdout || '') + (err.stderr || ''),
+      buildFailed,
+      output,
       exitCode: err.status ?? 1
     };
   }

package/src/lib/validators/content/content-validator.js

@@ -23,18 +23,17 @@ export function validateSpecContent(specPath) {
 
   const content = readFileSync(specPath, 'utf8');
 
-  // Required sections for a complete spec (prefix-match to handle variants like
-  // "## Functional Requirements" and "## Technical Architecture")
+  // Required sections (flexible regex handles numbered variants like '## 1. Overview')
   const requiredSections = [
-    '## Overview',
-    '## Functional Requirements',
-    '## Technical',
-    '## Data Model',
+    { label: '## Overview',                pattern: /^##\s+(?:\d+\.?\s+)?Overview/i },
+    { label: '## Functional Requirements', pattern: /^##\s+(?:\d+\.?\s+)?Functional Requirements/i },
+    { label: '## Technical',              pattern: /^##\s+(?:\d+\.?\s+)?Technical/i },
+    { label: '## Data Model',             pattern: /^##\s+(?:\d+\.?\s+)?Data Model/i },
   ];
 
   const lines = content.split('\n');
-  const missing = requiredSections.filter(section =>
-    !lines.some(line => line.startsWith(section))
+  const missing = requiredSections.filter(s =>
+    !lines.some(line => s.pattern.test(line))
   );
 
   // Additional quality checks
@@ -44,8 +43,8 @@ export function validateSpecContent(specPath) {
   // Missing sections are warnings, not errors — not every spec needs all sections
   // (e.g., frontend-only features may not have Data Model, CLI tools may not have Technical Architecture)
   if (missing.length > 0) {
-    missing.forEach(section => {
-      warnings.push(`Missing recommended section: ${section}`);
+    missing.forEach(s => {
+      warnings.push(`Missing recommended section: ${s.label}`);
     });
   }
 

package/src/lib/validators/validation-runner.js

@@ -119,11 +119,13 @@ export async function runValidation(projectPath, featureName, options = {}) {
   }
 
   // Always run contract compliance if the contracts file exists (stack-aware)
-  const _profileForContracts = getStackProfile(projectPath);
-  const contractsType = resolveContractsOutputType(_profileForContracts.stack);
-  const contractsPath = getAbsoluteOutputPath(projectPath, featureName, contractsType);
-  if (existsSync(contractsPath) && !_profileForContracts.isNextjs) {
-    validatorIds.push('contract-compliance');
+  if (!options.skipContracts) {
+    const _profileForContracts = getStackProfile(projectPath);
+    const contractsType = resolveContractsOutputType(_profileForContracts.stack);
+    const contractsPath = getAbsoluteOutputPath(projectPath, featureName, contractsType);
+    if (existsSync(contractsPath) && !_profileForContracts.isNextjs) {
+      validatorIds.push('contract-compliance');
+    }
   }
 
   // Deduplicate

package/src/scripts/setup-infra.js

@@ -79,19 +79,75 @@ export function installRulesForStack(rulesSrc, rulesDest, projectTags) {
   }
 }
 
+/**
+ * Re-install only stack-aware assets (rules, skills, agents) using current config.json.
+ * Skips infrastructure steps (dirs, framework copy, hooks).
+ *
+ * @param {string} targetPath - Absolute path to the target project directory
+ * @param {Function} log - Logging function
+ * @returns {{ agentCounts: object, domainCounts: object, projectTags: string[] }}
+ */
+async function installStackAwareAssets(targetPath, log) {
+  const configPath = join(targetPath, '.morph', 'config', 'config.json');
+  let projectTags = [];
+  if (await pathExists(configPath)) {
+    try {
+      const config = JSON.parse(readFileSync(configPath, 'utf-8'));
+      projectTags = getProjectTags(config);
+    } catch { /* ignore malformed config */ }
+  }
+
+  log('Installing stack-filtered rules...');
+  const claudeDest = join(targetPath, '.claude');
+  const rulesSrc = join(FRAMEWORK_DIR, 'rules');
+  const rulesDest = join(claudeDest, 'rules');
+  if (await pathExists(rulesSrc)) {
+    await ensureDir(rulesDest);
+    installRulesForStack(rulesSrc, rulesDest, projectTags);
+  }
+
+  log('Installing skills...');
+  await installSkills(targetPath, { projectTags });
+
+  log('Installing agents...');
+  const agentCounts = await installAgents(targetPath, FRAMEWORK_DIR, { projectTags });
+
+  log('Installing domain agents...');
+  const domainCounts = await installDomainAgents(targetPath, FRAMEWORK_DIR, { projectTags });
+
+  return { agentCounts, domainCounts, projectTags };
+}
+
 /**
  * Installs MORPH-SPEC infrastructure into the target project directory.
  * Headless — no prompts, no spinner (suppressed when MORPH_QUIET=1), no stack detection.
  *
  * @param {string} targetPath - Absolute path to the target project directory
+ * @param {object} options
+ * @param {Function} options._exec - exec function (for testing)
+ * @param {boolean} options.reinstall - If true, only re-install stack-aware assets (rules, skills, agents)
  */
-export async function setupInfra(targetPath, { _exec = execSync } = {}) {
+export async function setupInfra(targetPath, { _exec = execSync, reinstall = false } = {}) {
   const quiet = process.env.MORPH_QUIET === '1';
 
   function log(msg) {
     if (!quiet) process.stdout.write(msg + '\n');
   }
 
+  // --- Reinstall mode: only re-install stack-aware assets ---
+  if (reinstall) {
+    log('setup-infra (reinstall): re-installing stack-aware assets...');
+    const { agentCounts, domainCounts } = await installStackAwareAssets(targetPath, log);
+    log('setup-infra (reinstall): complete.');
+    return {
+      agents: {
+        tier1: agentCounts?.tier1 ?? 0,
+        tier2: agentCounts?.tier2 ?? 0,
+        specialists: domainCounts?.specialists ?? 0,
+      },
+    };
+  }
+
   // --- 0. Install required Claude Code plugins ---
   await installRequiredPlugins(log, _exec);
 
@@ -188,35 +244,9 @@ export async function setupInfra(targetPath, { _exec = execSync } = {}) {
     await copyDirectory(commandsSrc, commandsDest);
   }
 
-  // --- Compute project tags for stack-aware installation ---
-  let projectTags = [];
-  if (await pathExists(configPath)) {
-    try {
-      const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-      projectTags = getProjectTags(config);
-    } catch { /* ignore malformed config */ }
-  }
-
-  // --- 10. Copy framework/rules → .claude/rules (filtered by stack) ---
-  log('Step 10: Installing path-scoped rules...');
-  const rulesSrc = join(FRAMEWORK_DIR, 'rules');
-  const rulesDest = join(claudeDest, 'rules');
-  if (await pathExists(rulesSrc)) {
-    await ensureDir(rulesDest);
-    installRulesForStack(rulesSrc, rulesDest, projectTags);
-  }
-
-  // --- 11. installSkills (filtered by stack) ---
-  log('Step 11: Installing skills...');
-  await installSkills(targetPath, { projectTags });
-
-  // --- 12. installAgents ---
-  log('Step 12: Installing agents...');
-  const agentCounts = await installAgents(targetPath, FRAMEWORK_DIR, { projectTags });
-
-  // --- 13. installDomainAgents (filtered by stack) ---
-  log('Step 13: Installing domain agents...');
-  const domainCounts = await installDomainAgents(targetPath, FRAMEWORK_DIR, { projectTags });
+  // --- 10-13. Install stack-aware assets (rules, skills, agents) ---
+  log('Steps 10-13: Installing stack-aware assets...');
+  const { agentCounts, domainCounts } = await installStackAwareAssets(targetPath, log);
 
   // --- 14. Copy framework/CLAUDE.md → .claude/CLAUDE.md (morph-owned, gitignored) ---
   log('Step 14: Installing .claude/CLAUDE.md...');

package/framework/agents/backend/supabase-expert.md

@@ -1,256 +0,0 @@
----
-name: supabase-expert
-description: Supabase & PostgreSQL specialist for RLS policies, auth integration, pgvector, Realtime subscriptions, Edge Functions, and migration management. Use when designing database schemas, implementing Row Level Security, setting up auth flows, or working with pgvector embeddings.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - supabase
-color: teal
-effort: medium
----
-
-# Supabase & PostgreSQL Specialist
-
-Expert in Supabase auth, Row Level Security, Realtime, Edge Functions, and pgvector.
-
-> **Ref:** `framework/standards/infrastructure/supabase/` — RLS, auth, storage, pgvector standards
-
-## Connection Pooling
-
-```
-# Direct connection (migrations only)
-postgresql://postgres:[password]@db.[project].supabase.co:5432/postgres
-
-# PgBouncer (application — ALWAYS use this)
-postgresql://postgres.[project]:[password]@aws-0-[region].pooler.supabase.com:6543/postgres
-```
-
-**Rule:** Application code ALWAYS connects via PgBouncer (port 6543). Direct connections (port 5432) only for migrations and schema changes.
-
----
-
-## Row Level Security (RLS)
-
-### Enable RLS on every table
-
-```sql
-ALTER TABLE public.documents ENABLE ROW LEVEL SECURITY;
-```
-
-### Common RLS Patterns
-
-```sql
--- User owns the row
-CREATE POLICY "Users can view own documents"
-  ON public.documents FOR SELECT
-  USING (auth.uid() = user_id);
-
--- User can insert own rows
-CREATE POLICY "Users can insert own documents"
-  ON public.documents FOR INSERT
-  WITH CHECK (auth.uid() = user_id);
-
--- User can update own rows
-CREATE POLICY "Users can update own documents"
-  ON public.documents FOR UPDATE
-  USING (auth.uid() = user_id)
-  WITH CHECK (auth.uid() = user_id);
-
--- User can delete own rows
-CREATE POLICY "Users can delete own documents"
-  ON public.documents FOR DELETE
-  USING (auth.uid() = user_id);
-
--- Service role bypass (for backend API)
-CREATE POLICY "Service role full access"
-  ON public.documents FOR ALL
-  USING (auth.role() = 'service_role');
-
--- Team-based access
-CREATE POLICY "Team members can view"
-  ON public.documents FOR SELECT
-  USING (
-    team_id IN (
-      SELECT team_id FROM public.team_members
-      WHERE user_id = auth.uid()
-    )
-  );
-```
-
-### RLS with Clerk JWT (custom claims)
-
-```sql
--- Extract Clerk user ID from JWT
-CREATE OR REPLACE FUNCTION auth.clerk_user_id()
-RETURNS TEXT AS $$
-  SELECT coalesce(
-    current_setting('request.jwt.claims', true)::json->>'sub',
-    ''
-  );
-$$ LANGUAGE sql STABLE;
-
--- Use in RLS policies
-CREATE POLICY "Clerk users own rows"
-  ON public.documents FOR ALL
-  USING (clerk_user_id = auth.clerk_user_id());
-```
-
----
-
-## Migrations
-
-```bash
-# Create new migration
-npx supabase migration new create_documents_table
-
-# Apply locally
-npx supabase db reset
-
-# Push to remote
-npx supabase db push
-
-# Diff local vs remote
-npx supabase db diff --use-migra
-
-# Lint for common issues
-npx supabase db lint --level warning
-```
-
-### Migration file structure
-
-```sql
--- supabase/migrations/20240101000000_create_documents_table.sql
-
-CREATE TABLE public.documents (
-  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
-  user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
-  title TEXT NOT NULL,
-  content TEXT,
-  created_at TIMESTAMPTZ DEFAULT now() NOT NULL,
-  updated_at TIMESTAMPTZ DEFAULT now() NOT NULL
-);
-
--- Always enable RLS
-ALTER TABLE public.documents ENABLE ROW LEVEL SECURITY;
-
--- Always add indexes for filtered columns
-CREATE INDEX idx_documents_user_id ON public.documents(user_id);
-CREATE INDEX idx_documents_created_at ON public.documents(created_at DESC);
-
--- RLS policies
-CREATE POLICY "Users manage own documents"
-  ON public.documents FOR ALL
-  USING (auth.uid() = user_id)
-  WITH CHECK (auth.uid() = user_id);
-```
-
----
-
-## pgvector (Embeddings)
-
-### Setup
-
-```sql
-CREATE EXTENSION IF NOT EXISTS vector;
-
-CREATE TABLE public.embeddings (
-  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
-  document_id UUID REFERENCES public.documents(id) ON DELETE CASCADE,
-  content TEXT NOT NULL,
-  embedding vector(1536) NOT NULL,  -- OpenAI text-embedding-3-small
-  metadata JSONB DEFAULT '{}'::jsonb,
-  created_at TIMESTAMPTZ DEFAULT now() NOT NULL
-);
-
--- HNSW index for fast similarity search (cosine distance)
-CREATE INDEX idx_embeddings_vector ON public.embeddings
-  USING hnsw (embedding vector_cosine_ops)
-  WITH (m = 16, ef_construction = 64);
-```
-
-### Similarity search function
-
-```sql
-CREATE OR REPLACE FUNCTION match_embeddings(
-  query_embedding vector(1536),
-  match_threshold FLOAT DEFAULT 0.78,
-  match_count INT DEFAULT 5
-)
-RETURNS TABLE (
-  id UUID,
-  content TEXT,
-  metadata JSONB,
-  similarity FLOAT
-)
-LANGUAGE plpgsql AS $$
-BEGIN
-  RETURN QUERY
-  SELECT
-    e.id,
-    e.content,
-    e.metadata,
-    1 - (e.embedding <=> query_embedding) AS similarity
-  FROM public.embeddings e
-  WHERE 1 - (e.embedding <=> query_embedding) > match_threshold
-  ORDER BY e.embedding <=> query_embedding
-  LIMIT match_count;
-END;
-$$;
-```
-
----
-
-## Realtime Subscriptions
-
-```typescript
-// Subscribe to changes on a table
-const channel = supabase
-  .channel('documents-changes')
-  .on('postgres_changes',
-    { event: '*', schema: 'public', table: 'documents', filter: `user_id=eq.${userId}` },
-    (payload) => {
-      console.log('Change:', payload.eventType, payload.new);
-    }
-  )
-  .subscribe();
-
-// Cleanup
-channel.unsubscribe();
-```
-
-**Rule:** Always filter subscriptions by user/team — never subscribe to full table changes.
-
----
-
-## Storage (File Uploads)
-
-```sql
--- Create bucket
-INSERT INTO storage.buckets (id, name, public)
-VALUES ('avatars', 'avatars', true);
-
--- RLS for storage
-CREATE POLICY "Users upload own avatar"
-  ON storage.objects FOR INSERT
-  WITH CHECK (
-    bucket_id = 'avatars' AND
-    auth.uid()::text = (storage.foldername(name))[1]
-  );
-```
-
----
-
-## Checklist
-
-- [ ] PgBouncer (port 6543) used for all application connections
-- [ ] RLS enabled on ALL public tables
-- [ ] RLS policies cover SELECT, INSERT, UPDATE, DELETE
-- [ ] Service role policy exists for backend API access
-- [ ] Migrations use `npx supabase migration new` (not manual SQL)
-- [ ] Indexes on all frequently filtered columns
-- [ ] pgvector: HNSW index with appropriate m/ef_construction values
-- [ ] Realtime subscriptions filtered by user/team
-- [ ] Storage buckets have RLS policies
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/framework/rules/supabase-standards.md

@@ -1,29 +0,0 @@
----
-paths:
-  - "**/*.sql"
-  - "**/supabase/**"
-  - "**/migrations/**"
-stacks:
-  - supabase
----
-
-# Supabase & PostgreSQL Standards
-
-@.morph/framework/standards/infrastructure/supabase/supabase-auth.md
-@.morph/framework/standards/infrastructure/supabase/supabase-rls.md
-@.morph/framework/standards/infrastructure/supabase/supabase-storage.md
-@.morph/framework/standards/infrastructure/supabase/supabase-pgvector.md
-@.morph/framework/standards/infrastructure/supabase/mcp-setup.md
-@.morph/framework/standards/infrastructure/supabase/supabase-custom-jwt.md
-@.morph/framework/standards/backend/database/postgresql/database.md
-
-## SQL & Migration Templates
-
-| Template | Path | Purpose |
-|----------|------|---------|
-| Migration (full) | `.morph/framework/templates/code/sql/supabase-migration.template.sql` | RLS + indexes |
-| Migration (simple) | `.morph/framework/templates/code/sql/supabase-migration.sql` | Basic migration |
-| RLS Policy | `.morph/framework/templates/code/sql/rls-policy.sql` | Row Level Security |
-| TS Types | `.morph/framework/templates/code/typescript/contracts.ts` | Supabase DB types |
-
-Read the template to see the exact pattern for migrations, RLS policies, and type generation.

package/framework/standards/infrastructure/supabase/mcp-setup.md

@@ -1,142 +0,0 @@
-# Supabase Local Development Guide
-
-> **Scope:** nextjs-supabase
-> **Layer:** 2 (on keyword)
-> **Keywords:** supabase, cli, local, docker, setup, migrations, psql
-> **Load When:** supabase setup keywords detected
-
-Local-first database management via Supabase CLI and psql — always targeting the local Docker instance.
-
-## CRITICAL WARNING
-
-```
-==========================================================
-  NEVER connect to a PRODUCTION Supabase project.
-
-  All database operations MUST target the local Docker
-  instance started via `npx supabase start`.
-
-  Production schema may diverge from local (renamed tables,
-  columns, migrations). Local is the single source of truth
-  during development.
-==========================================================
-```
-
-## Setup
-
-### 1. Install Supabase CLI
-
-```bash
-npm install -g supabase
-# or use npx (no global install needed)
-npx supabase --version
-```
-
-### 2. Start Local Instance
-
-```bash
-npx supabase start
-```
-
-This starts PostgreSQL, GoTrue (auth), Storage, and other services in Docker containers.
-
-### 3. Get Connection Details
-
-```bash
-npx supabase status
-```
-
-Output includes:
-- **DB URL**: `postgresql://postgres:postgres@127.0.0.1:54322/postgres` (port may vary)
-- **API URL**: `http://127.0.0.1:54321`
-- **anon key** and **service_role key** for local testing
-
-> **Important:** The port (54322) may vary when running multiple Supabase instances. Always use `npx supabase status` to get the current DB URL — never hardcode it.
-
-## Common CLI Commands
-
-### Schema Inspection
-
-```bash
-# Full schema dump
-npx supabase db dump --local --schema public
-
-# List tables (from dump output)
-npx supabase db dump --local --schema public 2>/dev/null | grep "CREATE TABLE"
-
-# Detailed table schema via psql
-psql $DB_URL -c "SELECT column_name, data_type, is_nullable, column_default \
-  FROM information_schema.columns WHERE table_name = 'TABLE_NAME' ORDER BY ordinal_position"
-
-# Foreign key relationships
-psql $DB_URL -c "SELECT tc.table_name, kcu.column_name, ccu.table_name AS foreign_table, \
-  ccu.column_name AS foreign_column FROM information_schema.table_constraints tc \
-  JOIN information_schema.key_column_usage kcu ON tc.constraint_name = kcu.constraint_name \
-  JOIN information_schema.constraint_column_usage ccu ON tc.constraint_name = ccu.constraint_name \
-  WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_name = 'TABLE_NAME'"
-
-# RLS policies
-psql $DB_URL -c "SELECT tablename, policyname, cmd, qual FROM pg_policies WHERE schemaname = 'public'"
-
-# Indexes
-psql $DB_URL -c "SELECT indexname, indexdef FROM pg_indexes WHERE tablename = 'TABLE_NAME'"
-```
-
-### Migrations
-
-```bash
-# Create a new migration
-npx supabase migration new add_status_to_leads
-
-# Apply pending migrations to local
-npx supabase migration up --local
-
-# List applied migrations
-npx supabase migration list --local
-
-# Reset local database (destructive — re-applies all migrations)
-npx supabase db reset
-```
-
-### Data Operations
-
-```bash
-# Run arbitrary SQL against local
-psql $DB_URL -c "SELECT * FROM leads LIMIT 5"
-
-# Seed data
-npx supabase db seed --local
-```
-
-## Usage with MORPH-SPEC Workflow
-
-During MORPH-SPEC phases, the Supabase CLI is used for:
-
-| Phase | CLI Usage | Commands |
-|-------|-----------|----------|
-| **Phase 2 (Design)** | Inspect existing schema to inform spec | `npx supabase status` → `psql` queries |
-| **Phase 4 (Tasks)** | Verify migration dependencies | `npx supabase migration list --local` |
-| **Phase 5 (Implement)** | Apply migrations, verify RLS, test queries | `npx supabase migration up --local` + `psql` |
-| **Post-Implementation** | Verify RLS policies are correct | `psql` pg_policies queries |
-
-### Example Workflow
-
-```
-1. Design phase: `npx supabase status` → `psql $DB_URL` to inspect schema
-2. Write migration SQL in supabase/migrations/
-3. Apply: `npx supabase migration up --local`
-4. Verify: `psql $DB_URL -c "SELECT policyname, cmd FROM pg_policies WHERE tablename = 'search_logs'"`
-5. Test: `psql $DB_URL -c "SELECT * FROM search_logs LIMIT 5"`
-```
-
-## Best Practices
-
-1. **Always use local Supabase** (`npx supabase start`) — never connect to remote/production
-2. **Use `npx supabase status`** to detect the DB URL dynamically — port may vary
-3. **Write migrations as SQL files** in `supabase/migrations/` — apply via CLI
-4. **Verify RLS after every table change** — missing policies are a CRITICAL security issue
-5. **Reset local DB when needed** — `npx supabase db reset` re-applies all migrations cleanly
-
----
-
-*MORPH-SPEC by Polymorphism Tech*