@polymorphism-tech/morph-spec 4.17.0 → 4.19.0

package/framework/templates/integrations/neon-auth-config.cs

@@ -0,0 +1,133 @@
+// ==============================================================================
+// MORPH-SPEC - Neon Auth Configuration Template
+// Configuracao de autenticacao com Neon Auth (Better Auth) para .NET
+// ==============================================================================
+
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.IdentityModel.Tokens;
+using System.Security.Claims;
+
+namespace {{Namespace}}.Infrastructure.Auth;
+
+// ==============================================================================
+// OPTIONS
+// ==============================================================================
+
+public class NeonAuthOptions
+{
+    public const string SectionName = "NeonAuth";
+
+    /// <summary>
+    /// Neon Auth Base URL (e.g., https://ep-xxx.neonauth.us-east-2.aws.neon.build/neondb/auth)
+    /// </summary>
+    public string BaseUrl { get; set; } = string.Empty;
+}
+
+// ==============================================================================
+// SERVICE EXTENSIONS
+// ==============================================================================
+
+public static class NeonAuthServiceExtensions
+{
+    /// <summary>
+    /// Adds Neon Auth JWT Bearer authentication to the project.
+    /// Validates JWTs issued by Neon Auth service.
+    /// </summary>
+    public static IServiceCollection AddNeonAuthentication(
+        this IServiceCollection services,
+        IConfiguration configuration)
+    {
+        services.Configure<NeonAuthOptions>(configuration.GetSection(NeonAuthOptions.SectionName));
+
+        var neonAuthOptions = configuration.GetSection(NeonAuthOptions.SectionName).Get<NeonAuthOptions>()!;
+
+        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
+            .AddJwtBearer(options =>
+            {
+                options.Authority = neonAuthOptions.BaseUrl;
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = true,
+                    ValidateAudience = false,
+                    ValidateLifetime = true,
+                    ValidateIssuerSigningKey = true,
+                    NameClaimType = "sub"
+                };
+            });
+
+        services.AddAuthorization();
+
+        return services;
+    }
+}
+
+// ==============================================================================
+// USER CONTEXT SERVICE
+// ==============================================================================
+
+public interface ICurrentUserService
+{
+    string? UserId { get; }
+    string? Email { get; }
+    bool IsAuthenticated { get; }
+}
+
+public class CurrentUserService(IHttpContextAccessor httpContextAccessor) : ICurrentUserService
+{
+    public string? UserId =>
+        httpContextAccessor.HttpContext?.User.FindFirstValue("sub");
+
+    public string? Email =>
+        httpContextAccessor.HttpContext?.User.FindFirstValue("email");
+
+    public bool IsAuthenticated =>
+        httpContextAccessor.HttpContext?.User.Identity?.IsAuthenticated ?? false;
+}
+
+// ==============================================================================
+// MIDDLEWARE PIPELINE
+// ==============================================================================
+
+public static class NeonAuthMiddlewareExtensions
+{
+    public static IApplicationBuilder UseNeonAuthentication(this IApplicationBuilder app)
+    {
+        app.UseAuthentication();
+        app.UseAuthorization();
+        return app;
+    }
+}
+
+// ==============================================================================
+// APPSETTINGS EXAMPLE
+// ==============================================================================
+
+/*
+{
+  "NeonAuth": {
+    "BaseUrl": "https://ep-xxx.neonauth.us-east-2.aws.neon.build/neondb/auth"
+  }
+}
+*/
+
+// ==============================================================================
+// PROGRAM.CS EXAMPLE
+// ==============================================================================
+
+/*
+var builder = WebApplication.CreateBuilder(args);
+
+// Add Neon Auth authentication
+builder.Services.AddNeonAuthentication(builder.Configuration);
+builder.Services.AddHttpContextAccessor();
+builder.Services.AddScoped<ICurrentUserService, CurrentUserService>();
+
+var app = builder.Build();
+
+app.UseNeonAuthentication();
+
+app.MapControllers().RequireAuthorization();
+
+app.Run();
+*/

package/framework/workflows/docs/full-morph.md

@@ -63,7 +63,7 @@ proposal.md, design-system.md, mockups.md, components.md, flows.md, spec.md, con
 
 ## Exemplos
 - "Sistema de relatórios com jobs agendados Hangfire"
-- "Autenticação completa com Clerk (login, signup, OAuth)"
+- "Autenticação completa com Neon Auth (login, signup, OAuth)"
 - "Dashboard com gráficos, tabelas e filtros complexos"
 - "RAG pipeline com AI Search e embeddings"
 - "Infraestrutura completa com Docker/Easypanel"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polymorphism-tech/morph-spec",
-  "version": "4.17.0",
+  "version": "4.19.0",
   "description": "MORPH-SPEC: AI-First development framework with validation pipeline and multi-stack support",
   "keywords": [
     "claude-code",

package/src/commands/mcp/mcp-setup.js

@@ -16,6 +16,7 @@ import ora from 'ora';
 import {
   orchestrateMcpSetup,
   installAutoMcps,
+  installCompanionSkills,
   installMcpWithCredentials,
   generateSetupInstructions,
   formatMcpStatusTable,
@@ -120,6 +121,16 @@ async function autoInstall(targetPath, stack, existingMcps) {
     console.log(chalk.gray(`  Skipped (already configured): ${result.skipped.join(', ')}`));
   }
 
+  // Install companion skills for MCPs that define them
+  const skillResults = installCompanionSkills(orchestration.autoInstallable);
+  for (const r of skillResults) {
+    if (r.success) {
+      console.log(chalk.green(`  ✓ Companion skills installed: ${r.repo}`));
+    } else {
+      console.log(chalk.yellow(`  ⚠ Failed to install companion skills: ${r.repo}`));
+    }
+  }
+
   console.log('');
 }
 
@@ -305,6 +316,16 @@ async function interactiveWizard(targetPath, stack, existingMcps) {
       const spinner = ora('Installing...').start();
       const result = await installAutoMcps(targetPath, orchestration.autoInstallable);
       spinner.succeed(`Installed: ${result.added.join(', ')}`);
+
+      // Install companion skills for MCPs that define them
+      const skillResults = installCompanionSkills(orchestration.autoInstallable);
+      for (const r of skillResults) {
+        if (r.success) {
+          console.log(chalk.green(`  ✓ Companion skills: ${r.repo}`));
+        } else {
+          console.log(chalk.yellow(`  ⚠ Companion skills failed: ${r.repo}`));
+        }
+      }
     }
   }
 

package/src/commands/project/init.js

@@ -20,6 +20,7 @@ import { generateSettings, saveIntegrations } from '../../lib/generators/setting
 import {
   orchestrateMcpSetup,
   installAutoMcps,
+  installCompanionSkills,
   installMcpWithCredentials,
   generateSetupInstructions,
   formatMcpStatusTable,
@@ -256,6 +257,16 @@ export async function initCommand(options) {
               for (const name of result.added) {
                 autoInstalled[name] = orchestration.autoInstallable[name];
               }
+
+              // Install companion skills for MCPs that define them (e.g., Stitch agent skills)
+              const skillResults = installCompanionSkills(orchestration.autoInstallable);
+              for (const r of skillResults) {
+                if (r.success) {
+                  logger.info(`✓ Companion skills installed: ${r.repo}`);
+                } else {
+                  logger.warn(`Failed to install companion skills: ${r.repo}`);
+                }
+              }
             }
           }
 

package/src/lib/contracts/sprint-contract-generator.js

@@ -0,0 +1,137 @@
+/**
+ * Sprint Contract Generator
+ *
+ * Generates sprint contracts from tasks.md + spec.md for the evaluator.
+ * Contracts define objective "definition of done" criteria.
+ */
+
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';
+import { join } from 'path';
+import { getBuildCommand } from '../../../framework/hooks/shared/build-check.js';
+
+/**
+ * Parse a task entry from tasks.md markdown.
+ *
+ * Expected format: ## T001: Task Title [FR001, FR003]
+ *
+ * @param {string} content - tasks.md content
+ * @param {string} taskId - Task ID (e.g., 'T001')
+ * @returns {{ id: string, title: string, frs: string[], description: string }|null}
+ */
+export function parseTaskFromMarkdown(content, taskId) {
+  const pattern = new RegExp(
+    `##\\s+${taskId}:\\s+(.+?)(?:\\s+\\[([^\\]]+)\\])?\\s*\\n([\\s\\S]*?)(?=\\n##\\s|$)`,
+    'i'
+  );
+  const match = content.match(pattern);
+  if (!match) return null;
+
+  const title = match[1].trim();
+  const frString = match[2] || '';
+  const description = match[3].trim();
+
+  const frs = frString
+    ? frString.split(',').map(fr => fr.trim()).filter(Boolean)
+    : [];
+
+  return { id: taskId, title, frs, description };
+}
+
+/**
+ * Generate a sprint contract for a task.
+ *
+ * @param {string} projectPath - Project root
+ * @param {string} featureName - Feature name
+ * @param {string} taskId - Task ID
+ * @returns {Object|null} Contract object or null if unable to generate
+ */
+export function generateSprintContract(projectPath, featureName, taskId) {
+  const featureDir = join(projectPath, '.morph/features', featureName);
+  const tasksPath = join(featureDir, '4-tasks/tasks.md');
+
+  if (!existsSync(tasksPath)) return null;
+
+  const tasksContent = readFileSync(tasksPath, 'utf-8');
+  const task = parseTaskFromMarkdown(tasksContent, taskId);
+  if (!task) return null;
+
+  // Read spec for FR-based criteria
+  const specPath = join(featureDir, '2-design/spec.md');
+  let definitionOfDone = [];
+  if (task.frs.length > 0 && existsSync(specPath)) {
+    const specContent = readFileSync(specPath, 'utf-8');
+    for (const fr of task.frs) {
+      const frPattern = new RegExp(`##\\s+${fr}[:\\s]([\\s\\S]*?)(?=\\n##\\s|$)`, 'i');
+      const frMatch = specContent.match(frPattern);
+      if (frMatch) {
+        const bullets = frMatch[1].match(/^[\s]*[-*]\s+(.+)/gm);
+        if (bullets) {
+          definitionOfDone.push(...bullets.map(b => b.replace(/^[\s]*[-*]\s+/, '').trim()));
+        }
+      }
+    }
+  }
+
+  if (definitionOfDone.length === 0) {
+    definitionOfDone = [task.description || `Complete ${task.title}`];
+  }
+
+  // Read stack for build commands
+  let stack = '';
+  try {
+    const configPath = join(projectPath, '.morph/config/config.json');
+    if (existsSync(configPath)) {
+      const config = JSON.parse(readFileSync(configPath, 'utf-8'));
+      stack = config?.project?.stack || '';
+    }
+  } catch { /* ignore */ }
+
+  const hasTsConfig = existsSync(join(projectPath, 'tsconfig.json'));
+  const buildCmd = getBuildCommand(stack, hasTsConfig);
+
+  const contract = {
+    task: taskId,
+    title: task.title,
+    functionalRequirements: task.frs,
+    definitionOfDone,
+    verification: {
+      build: buildCmd || 'echo "No build command configured"',
+      test: stack.includes('dotnet') ? `dotnet test --filter ${task.title.replace(/\s+/g, '')}` : 'npm test',
+      e2e: null
+    },
+    maxAttempts: 3,
+    generatedAt: new Date().toISOString()
+  };
+
+  // Write contract to disk
+  const contractsDir = join(featureDir, '5-implement/contracts');
+  mkdirSync(contractsDir, { recursive: true });
+  const yamlContent = contractToYaml(contract);
+  writeFileSync(join(contractsDir, `${taskId}-contract.yaml`), yamlContent, 'utf-8');
+
+  return contract;
+}
+
+/**
+ * Simple YAML serializer for contracts (no dependency needed).
+ *
+ * @param {Object} contract - Contract object
+ * @returns {string} YAML string
+ */
+function contractToYaml(contract) {
+  const lines = [
+    `task: ${contract.task}`,
+    `title: "${contract.title}"`,
+    `functionalRequirements:`,
+    ...contract.functionalRequirements.map(fr => `  - ${fr}`),
+    `definitionOfDone:`,
+    ...contract.definitionOfDone.map(d => `  - "${d}"`),
+    `verification:`,
+    `  build: "${contract.verification.build}"`,
+    `  test: "${contract.verification.test}"`,
+    `  e2e: ${contract.verification.e2e ? `"${contract.verification.e2e}"` : 'null'}`,
+    `maxAttempts: ${contract.maxAttempts}`,
+    `generatedAt: "${contract.generatedAt}"`,
+  ];
+  return lines.join('\n') + '\n';
+}

package/src/lib/detectors/index.js

@@ -74,8 +74,8 @@ export function detectProject(targetPath, opts = {}) {
       if (depNames.includes('@neondatabase/serverless') || depNames.includes('postgres') || depNames.includes('pg')) {
         structure.integrations.push('neon');
       }
-      if (depNames.includes('@clerk/nextjs') || depNames.includes('@clerk/clerk-sdk-node')) {
-        structure.integrations.push('clerk');
+      if (depNames.includes('@neondatabase/auth')) {
+        structure.integrations.push('neon-auth');
       }
       if (depNames.includes('stripe')) {
         structure.integrations.push('stripe');

package/src/lib/generators/architecture-scanner.js

@@ -223,7 +223,7 @@ export async function scanIntegrations(projectPath) {
     );
 
     const knownServices = {
-      'Clerk': 'auth',
+      'NeonAuth': 'auth',
       'AsaaS': 'payment',
       'Resend': 'email',
       'Hangfire': 'background-jobs',
@@ -266,8 +266,7 @@ export async function scanIntegrations(projectPath) {
 
     // Scan .env files for known prefixes
     const envPrefixes = {
-      'NEXT_PUBLIC_CLERK': 'Clerk',
-      'CLERK_': 'Clerk',
+      'NEON_AUTH_': 'NeonAuth',
       'DATABASE_URL': 'Neon',
       'NEON_': 'Neon',
       'RESEND_': 'Resend',

package/src/lib/installers/mcp-installer.js

@@ -148,6 +148,31 @@ export async function installAutoMcps(targetPath, mcpsToInstall) {
   return installMcpServers(targetPath, servers);
 }
 
+/**
+ * Install companion skills for MCPs that define them (e.g., Stitch agent skills).
+ * Reads the `companionSkills` field from registry entries and runs the install command.
+ * @param {Object} mcpsInstalled - Map of mcpName → mcpEntry that were just installed
+ * @param {Function} exec - execSync function (for testing)
+ * @returns {Array<{name: string, repo: string, success: boolean}>}
+ */
+export function installCompanionSkills(mcpsInstalled, exec = execSync) {
+  const results = [];
+
+  for (const [name, entry] of Object.entries(mcpsInstalled)) {
+    const companion = entry.companionSkills;
+    if (!companion?.installCommand) continue;
+
+    try {
+      exec(companion.installCommand, { stdio: 'inherit', timeout: 30000 });
+      results.push({ name, repo: companion.repo, success: true });
+    } catch {
+      results.push({ name, repo: companion.repo, success: false });
+    }
+  }
+
+  return results;
+}
+
 /**
  * Install a single MCP with provided credentials
  * @param {string} targetPath - Project root directory

package/src/utils/hooks-installer.js

@@ -15,7 +15,7 @@ import { homedir } from 'os';
 import { execSync } from 'child_process';
 
 /** Current hooks schema version — bump when hook definitions change */
-const HOOKS_VERSION = '2.14.0';
+const HOOKS_VERSION = '3.0.0';
 
 /** Marker for old dispatch.js (v1) */
 const OLD_DISPATCH_COMMAND = 'node framework/hooks/agent-teams/dispatch.js';
@@ -155,6 +155,17 @@ Otherwise respond: {"ok": true}`
     ]
   },
 
+  // === PostToolUse: All — loop detection ===
+  {
+    event: 'PostToolUse',
+    matcher: null,
+    hooks: [{
+      type: 'command',
+      command: 'node framework/hooks/claude-code/post-tool-use/loop-detect.js',
+      timeout: 5000
+    }]
+  },
+
   // === Stop ===
   {
     event: 'Stop',

package/framework/agents/integrations/clerk-auth.md

@@ -1,109 +0,0 @@
----
-name: clerk-auth
-description: Clerk Auth specialist for Clerk SDK integration, social login, JWT session management, and user management in Next.js and .NET projects. Use when integrating Clerk authentication, implementing social login flows, managing user sessions with Clerk JWT, or protecting routes with Clerk middleware.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
-stacks:
-  - clerk
-color: teal
-effort: medium
----
-
-# Clerk Auth
-
-Autenticação SaaS com Clerk para .NET e Next.js. SDK: `Clerk.Net.AspNetCore.Security` (.NET) / `@clerk/nextjs` (Next.js).
-
-## Setup
-
-```csharp
-// appsettings.json
-{ "Clerk": { "SecretKey": "${CLERK_SECRET_KEY}", "PublishableKey": "pk_test_xxx" } }
-
-// Program.cs
-builder.Services.AddClerk(builder.Configuration);
-builder.Services.AddAuthentication(ClerkAuthenticationDefaults.AuthenticationScheme)
-    .AddClerk(o => { o.Authority = "https://clerk.{instance}.com"; o.ValidAudiences = ["your-app-id"]; });
-builder.Services.AddAuthorization();
-app.UseAuthentication();
-app.UseAuthorization();
-```
-
-## Protected Endpoints
-
-```csharp
-// Minimal API
-app.MapGet("/api/profile", async (ClaimsPrincipal user, IClerkClient clerk) =>
-{
-    var userId = user.FindFirstValue(ClaimTypes.NameIdentifier);
-    if (userId is null) return Results.Unauthorized();
-    var u = await clerk.Users.GetUserAsync(userId);
-    return Results.Ok(new { u.Id, Email = u.EmailAddresses.FirstOrDefault()?.EmailAddress });
-}).RequireAuthorization();
-
-// Controller: same pattern with [Authorize] + User.FindFirstValue()
-// Role-based: [Authorize(Roles = "admin")]
-```
-
-## Next.js Integration
-
-```tsx
-// middleware.ts
-import { clerkMiddleware } from '@clerk/nextjs/server';
-export default clerkMiddleware();
-export const config = { matcher: ['/((?!.*\\..*|_next).*)', '/'] };
-
-// Protected page
-import { auth } from '@clerk/nextjs/server';
-export default async function DashboardPage() {
-  const { userId } = await auth();
-  if (!userId) redirect('/sign-in');
-  return <Dashboard />;
-}
-
-// Client component
-'use client';
-import { useUser } from '@clerk/nextjs';
-const { user, isLoaded } = useUser();
-```
-
-## Client Operations (.NET)
-
-```csharp
-var user = await _clerk.Users.GetUserAsync(userId);                    // Get
-var users = await _clerk.Users.GetUserListAsync(new() { Limit = 10 }); // List
-await _clerk.Users.UpdateUserMetadataAsync(userId, new()               // Update metadata
-    { PublicMetadata = new Dictionary<string, object> { ["plan"] = "pro" } });
-await _clerk.Users.DeleteUserAsync(userId);                            // Delete
-```
-
-## Webhooks
-
-```csharp
-[ApiController, Route("api/webhooks/clerk")]
-public class ClerkWebhookController(IUserService users) : ControllerBase
-{
-    [HttpPost]
-    public async Task<IActionResult> Handle([FromBody] ClerkWebhookPayload payload)
-    {
-        switch (payload.Type)
-        {
-            case "user.created": await users.SyncUserAsync(payload.Data); break;
-            case "user.updated": await users.UpdateUserAsync(payload.Data); break;
-            case "user.deleted": await users.DeleteUserAsync(payload.Data.Id); break;
-        }
-        return Ok();
-    }
-}
-```
-
-## Checklist
-
-- [ ] Secret Key in environment variables (not hardcoded)
-- [ ] Authentication scheme configured
-- [ ] Authorization policies defined
-- [ ] Webhook endpoint + signature validation
-- [ ] Redirect after login configured
-- [ ] Error handling for expired sessions
-
----
-
-*MORPH-SPEC by Polymorphism Tech*

package/framework/rules/clerk-standards.md

@@ -1,13 +0,0 @@
----
-paths:
-  - "**/Auth/**"
-  - "**/auth/**"
-  - "**/Identity/**"
-  - "**/Clerk/**"
-stacks:
-  - dotnet
----
-
-# Clerk Authentication Standards
-
-@.morph/framework/standards/backend/integrations/clerk/clerk-auth.md