@tsfpp/agents 1.3.4 → 1.3.5

package/CHANGELOG.md

@@ -10,6 +10,14 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.3.5] - 2026-05-18
+
+### Changed
+
+- Fixed an `init.mjs` regression by restoring the main-clause wrapper to prevent dangling awaits and improve idempotent handling of existing files.
+- Updated `tdd` and `backfill-tests` agents to include a standards-enforcing self-review step.
+- Expanded `audit` agent checklist coverage with an extensive backfill of checklist items.
+
 ## [1.3.4] - 2026-05-18
 
 ### Changed

package/copilot/agents/tsfpp-audit.agent.md

@@ -129,17 +129,48 @@ Append each completed slice to the report:
 
 #### Checklist
 
-- [x] 1.4 — No bare `interface` (or DEVIATION documented)
-- [ ] 1.5 — No `any`
-- [x] 1.6 — No `!` assertions
-- [x] 2.x — `readonly` fields and `ReadonlyArray`
-- [x] 3.x — `const` bindings only
-- [x] 4.1 — Exhaustive `switch` with `absurd`
-- [ ] 4.5 — No truthiness checks on non-booleans
-- [x] 5.1 — Pipelines via `pipe` from prelude
-- [x] 6.x — No `throw` in core
-- [x] 7.x — JSDoc on all exports
-- [x] 9.x — No direct `ramda` import
+**Types and ADTs (§1)**
+- [ ] 1.1 — Sum types modelled as tagged discriminated union with literal discriminant
+- [ ] 1.2 — Exhaustive `switch` ends in `default: return absurd(x)`
+- [ ] 1.3 — Nominal distinctions via branded types; only smart constructors (`mk*`, `from*`, `as*`) cast with `as`
+- [ ] 1.4 — No bare `interface` (or `// DEVIATION(1.4): <reason>` present)
+- [ ] 1.5 — No `any`; `unknown` used at I/O boundaries, narrowed in scope
+- [ ] 1.6 — No `!`; no `as` outside smart constructor bodies
+- [ ] 1.8 — No `enum`; use string literal unions or `as const`
+- [ ] 1.9 — No `class` · `this` · `new` · `instanceof` · `namespace`
+- [ ] 1.11 — Prelude ADT discriminants accessed via exported guards only (`isOk`, `isSome`)
+- [ ] 1.12 — Discriminant convention: `_tag` for prelude ADTs · `kind` for domain ADTs
+
+**Immutability (§2–§3)**
+- [ ] 2.1 — `const` for every binding; no `let` / `var`
+- [ ] 2.2 — `ReadonlyArray<T>` everywhere; no mutable arrays
+- [ ] 2.3 — No mutating methods (`push`, `pop`, `splice`, `sort`, `reverse`, `fill`, `copyWithin`)
+- [ ] 2.4 — No property assignment or `delete` after construction
+- [ ] 2.5 — `as const` for literal narrowing and config tables
+- [ ] 3.x — `readonly` on every record field
+
+**Control flow (§4)**
+- [ ] 4.1 — Every sum-type `switch` is exhaustive; `default: return absurd(x)`
+- [ ] 4.5 — No truthiness checks on non-booleans (`if (str)`, `if (value)`)
+- [ ] No `for` · `while` · `do..while`; use `map`, `filter`, `reduce`, `pipe`, or traversal combinators
+
+**Pipelines and effects (§5–§6)**
+- [ ] 5.1 — Pipelines via `pipe` from `@tsfpp/prelude`
+- [ ] 6.2 — `throw` only at adapter boundaries; core uses `Result<T, E>`
+- [ ] 6.3 — No `null`/`undefined` propagation; use `Option<A>`
+- [ ] 6.6 — `Promise.allSettled` over `Promise.all` when partial failure is meaningful
+
+**Annotations (§7)**
+- [ ] 7.x — JSDoc on every exported symbol (`@param`, `@returns`; `@law` on combinators)
+
+**Boundary and imports (§8–§9)**
+- [ ] 8.4 — Parse, don't validate: `unknown` converted to domain types at the boundary
+- [ ] 9.x — No `import from 'ramda'`; use `@tsfpp/prelude`
+
+**Size limits (§11)**
+- [ ] 11.1 — One type / one responsibility per file
+- [ ] 11.2 — File ≤ 400 LOC (800 absolute max with deviation)
+- [ ] Function body ≤ 40 lines · cyclomatic complexity ≤ 10 · nesting ≤ 4 · arity ≤ 3
 
 #### Deviation register
 
@@ -153,29 +184,134 @@ Append each completed slice to the report:
 ## Focus-specific rule sets
 
 ### `types`
-1.4 (no bare interface) · 1.5 (no `any`) · 1.6 (no `!` or `as`) · 3.x (readonly) · branded types on domain primitives · smart constructor completeness · exhaustive sum-type dispatch
+Checklist:
+
+- [ ] 1.1 — Sum types are tagged discriminated unions with a literal discriminant field
+- [ ] 1.2 — Every exhaustive `switch` ends in `default: return absurd(x)`
+- [ ] 1.3 — Domain primitives use branded types; only smart constructors may cast with `as`
+- [ ] 1.4 — No bare `interface`; `type` aliases used throughout (or DEVIATION documented)
+- [ ] 1.5 — No `any`; `unknown` at I/O boundaries, narrowed before use
+- [ ] 1.6 — No `!`; no `as` outside smart constructor bodies
+- [ ] 1.8 — No `enum`; string literal unions or `as const` objects used instead
+- [ ] 1.9 — No `class` · `this` · `new` · `instanceof` · `namespace`
+- [ ] 1.11 — Prelude ADTs accessed via exported guards only (`isOk`, `isSome`, `isNone`, `isErr`)
+- [ ] 1.12 — `_tag` on prelude ADTs · `kind` on domain ADTs — no cross-contamination
+- [ ] 2.2 — `ReadonlyArray<T>` throughout; no mutable arrays
+- [ ] 3.x — Every record field is `readonly`
+- [ ] 6.3 — No `null` / `undefined` in domain types; `Option<A>` used instead
+- [ ] Smart constructors cover all valid input cases; invalid inputs return `None` or `Err`
+- [ ] No missing variant in sum-type definitions relative to the domain model
 
 ### `boundary`
-API_CODING_STANDARD.md (full) + `@tsfpp/boundary` surface:
-`extractContext` called at the top of every handler · Zod `safeParse` at every input boundary lifted via `fromZodError` ·
-all handlers return `Result<T, ApiError>` internally · `apiErrorToResponse` used for all error paths · no raw `throw` ·
-response builders (`okResponse`, `createdResponse`, `noContentResponse`, etc.) used; no hand-built `new Response()` ·
-`rateLimitHeaders` on all responses for rate-limited endpoints · `corsHeaders` never reflects `Origin` blindly ·
-`withIdempotency` + `withRequestLog` composed via `pipe` · pagination via `mkPaginated` + `parsePaginationQuery` ·
-LRO via `acceptedResponse` + `mkRunningOp`/`mkSucceededOp` · bulk via `bulkResponse` + `mkBulkOkItem`/`mkBulkErrorItem` ·
-handler architecture: parse → domain map → use-case → response map (nothing else)
+Full reference: `node_modules/@tsfpp/standard/spec/API_CODING_STANDARD.md`
+
+**Request handling**
+- [ ] `extractContext(req, routeTemplate)` called first in every handler
+- [ ] `routeTemplate` is the parameterised path (`/v1/tracks/:id`), never the resolved URL
+- [ ] All input validated with Zod `safeParse` at the boundary; never `parse` (throws)
+- [ ] `fromZodError(zodError)` used to lift Zod errors into `ValidationError`
+- [ ] No unvalidated `req.json()` passed into domain or use-case code
+
+**Error handling**
+- [ ] `apiErrorToResponse(error, ctx)` used for all error paths; no manual `new Response()`
+- [ ] `dependency` and `internal` `ApiError` variants: `cause` logged before calling mapper
+- [ ] No raw `throw` in handlers; all errors returned as `Result<T, ApiError>`
+- [ ] `fromZodError` used, not manual `ValidationError` construction for Zod errors
+
+**Response builders**
+- [ ] `okResponse` / `createdResponse` / `noContentResponse` / `acceptedResponse` used — no `new Response()`
+- [ ] `createdResponse` sets `Location` header with the resource URL
+- [ ] `acceptedResponse` used for async / LRO operations; polling URL provided
+- [ ] `bulkResponse` + `mkBulkOkItem` / `mkBulkErrorItem` for batch endpoints
+
+**Handler architecture**
+- [ ] Handler shape: parse → domain map → use-case → response map (nothing else)
+- [ ] No domain logic or business rules in handler body
+- [ ] No direct DB or infrastructure access in handler body
+
+**Security headers**
+- [ ] `baselineSecurityHeaders` merged into every response
+- [ ] `corsHeaders` used; never reflects `Origin` blindly; `allowedOrigins` from config
+- [ ] `rateLimitHeaders` attached to all responses on rate-limited endpoints, not just 429s
+
+**Middleware**
+- [ ] Middleware composed via `pipe`, outermost-last
+- [ ] `withRequestLog` is always the outermost wrapper
+- [ ] `withIdempotency` present on all state-mutating operations
+
+**Pagination**
+- [ ] `parsePaginationQuery` used; result checked for `Err` before use
+- [ ] `mkPaginated` used; `totalCount` is `null` unless precomputed
+- [ ] `encodeCursor` / `decodeCursor` used; no hand-rolled base64
 
 ### `complexity`
-Function body ≤ 40 lines · cyclomatic complexity ≤ 10 · nesting ≤ 4 · arity ≤ 3 positional params · pipeline depth ≤ 8 stages
+Checklist:
+
+- [ ] Function body ≤ 40 lines (excluding blank lines and comments)
+- [ ] Cyclomatic complexity ≤ 10 per function
+- [ ] Nesting depth ≤ 4 (ternaries, callbacks, and blocks combined)
+- [ ] Positional arity ≤ 3; ≥ 3 parameters use a readonly record
+- [ ] Pipeline depth ≤ 8 stages in a single `pipe` call
+- [ ] File ≤ 400 LOC; 800 absolute maximum (requires DEVIATION)
+- [ ] No god-module (one file handling multiple unrelated concerns)
+- [ ] No function doing more than one named thing (single responsibility)
 
 ### `loc`
-File LOC · function LOC · god-module candidates · decomposition opportunities
+Checklist:
+
+- [ ] File LOC ≤ 400 (flag at 300; hard limit 800 with DEVIATION)
+- [ ] Function body ≤ 40 lines
+- [ ] No file with more than one primary exported concern (god-module)
+- [ ] No function longer than 40 lines that could be decomposed
+- [ ] No deeply nested anonymous functions or callbacks (extract and name them)
+- [ ] Test files excluded from LOC limits but flagged if > 600 lines
 
 ### `annotations`
-JSDoc on every export · `@param` + `@returns` present · `@law` on combinators · DEVIATION comments formatted correctly · TODO/HACK/FIXME/NOTE/OPTIMIZE/BUG/XXX have date + author + ticket
+Checklist:
+
+**JSDoc (§7)**
+- [ ] Every exported symbol has a JSDoc comment
+- [ ] `@param` present for every parameter on exported functions
+- [ ] `@returns` present on every exported function with a non-void return
+- [ ] `@law` present on every combinator with algebraic laws
+- [ ] No JSDoc on non-exported symbols (unnecessary noise)
+
+**Code markers**
+- [ ] `TODO` / `FIXME` / `HACK` / `NOTE` / `OPTIMIZE` / `BUG` / `XXX` all have format: `(author, YYYY-MM-DD[, TICKET]): description`
+- [ ] No marker missing author or date
+- [ ] No stale TODO older than one release cycle without a ticket reference
+
+**Deviations**
+- [ ] Every rule violation has `// DEVIATION(N.M): <one-line justification>` immediately before the offending line
+- [ ] DEVIATION format is exact: `DEVIATION(N.M)` — not `deviation`, not `Deviation`, not `DEVIATION N.M`
+- [ ] Project-wide deviations are documented in `DEVIATIONS.md`
 
 ### `security`
-SECURITY_CODING_STANDARD.md: input validation at boundaries · no secrets in code · no sensitive data in errors · auth/authz at correct layer · dependency hygiene
+Full reference: `node_modules/@tsfpp/standard/spec/SECURITY_CODING_STANDARD.md`
+
+**Input validation**
+- [ ] All external input validated at the boundary before entering the domain
+- [ ] No `unknown` values passed into domain functions without prior narrowing
+- [ ] Dynamic sort/filter fields allow-listed before use in queries
+
+**Secrets and sensitive data**
+- [ ] No secrets, credentials, or tokens in source code or committed config files
+- [ ] No sensitive data (PII, credentials, tokens) in error messages or log output
+- [ ] No sensitive data in `console.log` or structured log `info` entries
+
+**Authentication and authorisation**
+- [ ] Auth/authz enforced at the correct layer (handler / middleware), not inside use-cases
+- [ ] No route accessible without authentication unless explicitly marked `// PUBLIC`
+- [ ] Principal ID never trusted from request body; always extracted from verified context
+
+**Dependencies**
+- [ ] No known vulnerable dependencies (`pnpm audit` clean)
+- [ ] No direct use of `eval`, `Function()`, or dynamic `import()` with user-controlled input
+
+**Output safety**
+- [ ] No user input reflected in error responses without sanitisation
+- [ ] CORS: `allowedOrigins` from config; never reflects `Origin` header blindly
+- [ ] `baselineSecurityHeaders` applied to every response
 
 ### `prelude`
 Cross-cutting — applies to all layers. Check for hand-rolled patterns that `@tsfpp/prelude` already provides.

package/copilot/agents/tsfpp-backfill-tests.agent.md

@@ -41,6 +41,13 @@ Full coding standard: `node_modules/@tsfpp/standard/spec/CODING_STANDARD.md`
 
 ---
 
+## Before writing any test
+
+Load and apply the `/test-standard` skill. Every test you write must conform to
+all rules in that skill. Do not write a single test before the skill is loaded.
+
+---
+
 ## Session start
 
 Infer the layer per file from the path and contents:
@@ -163,6 +170,36 @@ All rules from `TEST_CODING_STANDARD.md` apply:
 
 ---
 
+## Factories
+
+Always use typed factory functions from `tests/factories/` for test data.
+Never write raw object literals inline.
+
+```ts
+// tests/factories/track.factory.ts
+const makeTrack = (overrides: Partial<Track> = {}): Track => ({
+  id:       mkTrackId('test-track-001'),
+  title:    'Default Title',
+  artistId: mkArtistId('test-artist-001'),
+  ...overrides,
+})
+```
+
+Import and use with overrides for the specific case under test:
+
+```ts
+// Specific case — override only what matters for this test
+const track = makeTrack({ title: 'Blue Flame' })
+
+// Default case — the specific values don't matter
+const track = makeTrack()
+```
+
+Never hard-code raw objects like `{ id: 'abc', title: 'Test', artistId: 'xyz' }` in test bodies.
+Never use production or staging IDs in fixtures.
+
+---
+
 ## Layer-specific patterns
 
 ### `core`
@@ -199,9 +236,11 @@ describe('mkTrackId', () => {
 
 ```ts
 it('responds with 201 and a Location header on valid input', async () => {
+  const input = makeCreateTrackInput()  // from tests/factories/track.factory.ts
+
   const req = new Request('http://localhost/v1/tracks', {
     method:  'POST',
-    body:    JSON.stringify({ title: 'Test', artistId: 'a1' }),
+    body:    JSON.stringify(input),
     headers: { 'Content-Type': 'application/json' },
   })
 

package/copilot/agents/tsfpp-tdd.agent.md

@@ -36,6 +36,13 @@ Full coding standard: `node_modules/@tsfpp/standard/spec/CODING_STANDARD.md`
 
 ---
 
+## Before writing any test
+
+Load and apply the `/test-standard` skill. Every test you write must conform to
+all rules in that skill. Do not write a single test before the skill is loaded.
+
+---
+
 ## Session start
 
 Infer the layer per task from the user's message:
@@ -153,6 +160,36 @@ All rules from `TEST_CODING_STANDARD.md` apply. The most critical during test au
 
 ---
 
+## Factories
+
+Always use typed factory functions from `tests/factories/` for test data.
+Never write raw object literals inline.
+
+```ts
+// tests/factories/track.factory.ts
+const makeTrack = (overrides: Partial<Track> = {}): Track => ({
+  id:       mkTrackId('test-track-001'),
+  title:    'Default Title',
+  artistId: mkArtistId('test-artist-001'),
+  ...overrides,
+})
+```
+
+Import and use with overrides for the specific case under test:
+
+```ts
+// Specific case — override only what matters for this test
+const track = makeTrack({ title: 'Blue Flame' })
+
+// Default case — the specific values don't matter
+const track = makeTrack()
+```
+
+Never hard-code raw objects like `{ id: 'abc', title: 'Test', artistId: 'xyz' }` in test bodies.
+Never use production or staging IDs in fixtures.
+
+---
+
 ## Layer-specific test patterns
 
 ### `core`
@@ -164,14 +201,21 @@ import { isSome, isNone, isOk, isErr } from '@tsfpp/prelude'
 describe('mkTrackId', () => {
   describe('when the input is a non-empty string', () => {
     it('returns Some containing a branded TrackId', () => {
-      const result = mkTrackId('abc')
+      const raw = 'abc'
+
+      const result = mkTrackId(raw)
+
       expect(isSome(result)).toBe(true)
     })
   })
 
   describe('when the input is empty', () => {
     it('returns None', () => {
-      expect(mkTrackId('')).toEqual(none)
+      const raw = ''
+
+      const result = mkTrackId(raw)
+
+      expect(result).toEqual(none)
     })
   })
 
@@ -200,11 +244,13 @@ describe('POST /v1/tracks', () => {
   describe('when the request body is valid', () => {
     it('responds with 201 and a Location header', async () => {
       const req = new Request('http://localhost/v1/tracks', {
-        method: 'POST',
-        body: JSON.stringify({ title: 'Test', artistId: 'a1' }),
+        method:  'POST',
+        body:    JSON.stringify({ title: 'Test', artistId: 'a1' }),
         headers: { 'Content-Type': 'application/json' },
       })
+
       const res = await handler(req)
+
       expect(res.status).toBe(201)
       expect(res.headers.get('Location')).toMatch(/\/v1\/tracks\//)
     })
@@ -212,12 +258,16 @@ describe('POST /v1/tracks', () => {
 
   describe('when title is missing', () => {
     it('responds with 422', async () => {
+      const input = makeCreateTrackInput({ title: undefined })  // override to trigger validation failure
+
       const req = new Request('http://localhost/v1/tracks', {
-        method: 'POST',
-        body: JSON.stringify({ artistId: 'a1' }),
+        method:  'POST',
+        body:    JSON.stringify(input),
         headers: { 'Content-Type': 'application/json' },
       })
+
       const res = await handler(req)
+
       expect(res.status).toBe(422)
     })
   })
@@ -266,7 +316,9 @@ describe('TrackRepository', () => {
       it('returns Some containing the track', async () => {
         const track = makeTrack()
         await repo.save(track)
+
         const result = await repo.findById(track.id)
+
         expect(isSome(result)).toBe(true)
       })
     })
@@ -274,6 +326,7 @@ describe('TrackRepository', () => {
     describe('when the track does not exist', () => {
       it('returns None', async () => {
         const result = await repo.findById(mkTrackId('nonexistent'))
+
         expect(isNone(result)).toBe(true)  // will fail — findById not implemented
       })
     })

package/init.mjs

@@ -2,23 +2,27 @@
 /**
  * @tsfpp/agents init
  *
- * Copies Copilot agents, instructions, prompts, skills, and Claude Code configuration
- * into the correct locations in the consumer's project. Also generates
- * eslint.config.js if not already present.
+ * Copies Copilot agents, instructions, prompts, skills, and Claude Code
+ * configuration into the correct locations in the consumer's project.
  *
  * Usage:
- *   pnpm dlx @tsfpp/agents           (one-shot, no install)
- *   node node_modules/@tsfpp/agents/init.mjs
+ *   node node_modules/@tsfpp/agents/init.mjs          (interactive)
+ *   node node_modules/@tsfpp/agents/init.mjs --yes    (non-interactive / postinstall)
+ *
+ * --yes mode: copies all package-managed files (agents, instructions, skills,
+ * prompts, copilot-instructions.md) without prompting. Skips eslint.config.js
+ * and tsconfig.json — those are workspace-owned and never touched automatically.
  */
 
 import { copyFile, mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
-import { existsSync }                  from 'node:fs';
-import { join, dirname }               from 'node:path';
-import { fileURLToPath }               from 'node:url';
-import { createInterface }             from 'node:readline';
+import { existsSync }    from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const cwd       = process.cwd();
+const YES       = process.argv.includes('--yes');
 
 const dim    = (s) => `\x1b[2m${s}\x1b[0m`;
 const green  = (s) => `\x1b[32m${s}\x1b[0m`;
@@ -26,51 +30,66 @@ const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
 const bold   = (s) => `\x1b[1m${s}\x1b[0m`;
 
 // ─── File map ─────────────────────────────────────────────────────────────────
-// Each entry: [source (relative to this file), destination (relative to cwd)]
+// [source (relative to this file), destination (relative to cwd)]
+// All entries are package-managed — always overwritten in --yes mode.
 
 const FILES = [
   // Always-on workspace instructions
-  ['copilot/copilot-instructions.md',                       '.github/copilot-instructions.md'],
+  ['copilot/copilot-instructions.md',                        '.github/copilot-instructions.md'],
 
   // Scoped instruction files
-  ['copilot/instructions/tsfpp-base.instructions.md',       '.github/instructions/tsfpp-base.instructions.md'],
-  ['copilot/instructions/tsfpp-prelude.instructions.md',    '.github/instructions/tsfpp-prelude.instructions.md'],
-  ['copilot/instructions/tsfpp-api.instructions.md',        '.github/instructions/tsfpp-api.instructions.md'],
-  ['copilot/instructions/tsfpp-react.instructions.md',      '.github/instructions/tsfpp-react.instructions.md'],
-  ['copilot/instructions/tsfpp-testing.instructions.md',    '.github/instructions/tsfpp-testing.instructions.md'],
-  ['copilot/instructions/trunk.instructions.md',            '.github/instructions/trunk.instructions.md'],
+  ['copilot/instructions/tsfpp-base.instructions.md',        '.github/instructions/tsfpp-base.instructions.md'],
+  ['copilot/instructions/tsfpp-prelude.instructions.md',     '.github/instructions/tsfpp-prelude.instructions.md'],
+  ['copilot/instructions/tsfpp-api.instructions.md',         '.github/instructions/tsfpp-api.instructions.md'],
+  ['copilot/instructions/tsfpp-react.instructions.md',       '.github/instructions/tsfpp-react.instructions.md'],
+  ['copilot/instructions/tsfpp-testing.instructions.md',     '.github/instructions/tsfpp-testing.instructions.md'],
+  ['copilot/instructions/trunk.instructions.md',             '.github/instructions/trunk.instructions.md'],
 
   // Agents
-  ['copilot/agents/tsfpp-tdd.agent.md',                    '.github/agents/tsfpp-tdd.agent.md'],
-  ['copilot/agents/tsfpp-backfill-tests.agent.md',          '.github/agents/tsfpp-backfill-tests.agent.md'],
-  ['copilot/agents/tsfpp-guarded-coding.agent.md',          '.github/agents/tsfpp-guarded-coding.agent.md'],
-  ['copilot/agents/tsfpp-audit.agent.md',                   '.github/agents/tsfpp-audit.agent.md'],
-  ['copilot/agents/tsfpp-refactor-engineer.agent.md',       '.github/agents/tsfpp-refactor-engineer.agent.md'],
-  ['copilot/agents/tsfpp-annotate.agent.md',                '.github/agents/tsfpp-annotate.agent.md'],
-
-  // Reusable prompts
-  ['copilot/prompts/trunk-init-repo.prompt.md',             '.github/prompts/trunk-init-repo.prompt.md'],
-  ['copilot/prompts/tsfpp-new-module.prompt.md',            '.github/prompts/tsfpp-new-module.prompt.md'],
-  ['copilot/prompts/tsfpp-boundary-review.prompt.md',       '.github/prompts/tsfpp-boundary-review.prompt.md'],
-
-  // Reusable skills
-  ['copilot/skills/coding-standard/SKILL.md',               '.github/skills/coding-standard/SKILL.md'],
-  ['copilot/skills/prelude-api/SKILL.md',                   '.github/skills/prelude-api/SKILL.md'],
-  ['copilot/skills/boundary-api/SKILL.md',                  '.github/skills/boundary-api/SKILL.md'],
-  ['copilot/skills/react-coding-standard/SKILL.md',         '.github/skills/react-coding-standard/SKILL.md'],
-  ['copilot/skills/test-standard/SKILL.md',                 '.github/skills/test-standard/SKILL.md'],
+  ['copilot/agents/tsfpp-tdd.agent.md',                      '.github/agents/tsfpp-tdd.agent.md'],
+  ['copilot/agents/tsfpp-backfill-tests.agent.md',            '.github/agents/tsfpp-backfill-tests.agent.md'],
+  ['copilot/agents/tsfpp-guarded-coding.agent.md',            '.github/agents/tsfpp-guarded-coding.agent.md'],
+  ['copilot/agents/tsfpp-audit.agent.md',                     '.github/agents/tsfpp-audit.agent.md'],
+  ['copilot/agents/tsfpp-refactor-engineer.agent.md',         '.github/agents/tsfpp-refactor-engineer.agent.md'],
+  ['copilot/agents/tsfpp-annotate.agent.md',                  '.github/agents/tsfpp-annotate.agent.md'],
+
+  // Prompts
+  ['copilot/prompts/trunk-init-repo.prompt.md',               '.github/prompts/trunk-init-repo.prompt.md'],
+  ['copilot/prompts/tsfpp-new-module.prompt.md',              '.github/prompts/tsfpp-new-module.prompt.md'],
+  ['copilot/prompts/tsfpp-boundary-review.prompt.md',         '.github/prompts/tsfpp-boundary-review.prompt.md'],
+
+  // Skills
+  ['copilot/skills/coding-standard/SKILL.md',                 '.github/skills/coding-standard/SKILL.md'],
+  ['copilot/skills/prelude-api/SKILL.md',                     '.github/skills/prelude-api/SKILL.md'],
+  ['copilot/skills/boundary-api/SKILL.md',                    '.github/skills/boundary-api/SKILL.md'],
+  ['copilot/skills/react-coding-standard/SKILL.md',           '.github/skills/react-coding-standard/SKILL.md'],
+  ['copilot/skills/test-standard/SKILL.md',                   '.github/skills/test-standard/SKILL.md'],
 
   // Claude Code
-  ['claude/CLAUDE.md',                                      '.claude/CLAUDE.md'],
+  ['claude/CLAUDE.md',                                        '.claude/CLAUDE.md'],
 ];
 
-// ─── ESLint config generation ─────────────────────────────────────────────────
+// ─── Helpers ──────────────────────────────────────────────────────────────────
 
-const PROFILES = {
-  base:  { import: `import tsfpp from '@tsfpp/eslint-config'`,            spread: 'tsfpp' },
-  react: { import: `import tsfppReact from '@tsfpp/eslint-config/react'`, spread: 'tsfppReact' },
-  api:   { import: `import tsfppApi from '@tsfpp/eslint-config/api'`,     spread: 'tsfppApi' },
-};
+async function ensureDir(filePath) {
+  await mkdir(dirname(filePath), { recursive: true });
+}
+
+async function ask(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim().toLowerCase());
+    });
+  });
+}
+
+async function confirm(question) {
+  return (await ask(question)) === 'y';
+}
+
+// ─── Workspace detection ──────────────────────────────────────────────────────
 
 async function detectWorkspacePackages() {
   const wsFile = join(cwd, 'pnpm-workspace.yaml');
@@ -78,7 +97,7 @@ async function detectWorkspacePackages() {
 
   const yaml     = await readFile(wsFile, 'utf8');
   const patterns = [...yaml.matchAll(/^\s*-\s*['"]?([^'"#\n]+?)['"]?\s*$/gm)]
-    .map(m => m[1].trim().replace(/\/\*\*?$/, '')); // strip trailing /* or /**
+    .map(m => m[1].trim().replace(/\/\*\*?$/, ''));
 
   const IGNORE = new Set(['dist', 'build', 'out', 'coverage', 'node_modules', '.git', '.turbo', 'tmp']);
 
@@ -96,8 +115,16 @@ async function detectWorkspacePackages() {
   return packages.length > 0 ? packages : null;
 }
 
+// ─── ESLint config ────────────────────────────────────────────────────────────
+
+const ESLINT_PROFILES = {
+  base:  { import: `import tsfpp from '@tsfpp/eslint-config'`,            spread: 'tsfpp' },
+  react: { import: `import tsfppReact from '@tsfpp/eslint-config/react'`, spread: 'tsfppReact' },
+  api:   { import: `import tsfppApi from '@tsfpp/eslint-config/api'`,     spread: 'tsfppApi' },
+};
+
 async function askProfile(label) {
-  console.log(`\n  Profile for ${bold(label)}:`);
+  console.log(`\n  ESLint profile for ${bold(label)}:`);
   console.log(`  ${dim('1')} base  ${dim('— TypeScript / Node.js')}`);
   console.log(`  ${dim('2')} react ${dim('— React / TSX')}`);
   console.log(`  ${dim('3')} api   ${dim('— HTTP API / Node.js servers')}`);
@@ -105,66 +132,48 @@ async function askProfile(label) {
   return choice === '2' ? 'react' : choice === '3' ? 'api' : 'base';
 }
 
-function generateMonorepoConfig(packageProfiles) {
-  // Collect which profiles are used
+function generateMonorepoEslint(packageProfiles) {
   const usedProfiles = [...new Set(Object.values(packageProfiles))];
+  const imports = usedProfiles.map(p => ESLINT_PROFILES[p].import).join('\n');
 
-  const imports = usedProfiles.map(p => PROFILES[p].import).join('\n');
-
-  // base spreads globally (no files filter); react/api are scoped per package
   const basePackages = Object.entries(packageProfiles)
     .filter(([, p]) => p === 'base')
     .map(([pkg]) => `'${pkg}/src/**'`);
 
-  const scopedProfiles = ['react', 'api'].flatMap(profile => {
+  const scopedBlocks = ['react', 'api'].flatMap(profile => {
     const pkgs = Object.entries(packageProfiles)
       .filter(([, p]) => p === profile)
       .map(([pkg]) => `'${pkg}/src/**'`);
     if (pkgs.length === 0) return [];
-    const spread = PROFILES[profile].spread;
-    return [
-      `  // ${profile}`,
-      `  ...${spread}.map(c => ({ ...c, files: [${pkgs.join(', ')}] })),`,
-    ];
+    const spread = ESLINT_PROFILES[profile].spread;
+    return [`  // ${profile}`, `  ...${spread}.map(c => ({ ...c, files: [${pkgs.join(', ')}] })),`];
   });
 
   const baseSpread = basePackages.length > 0
     ? `  // base\n  ...tsfpp.map(c => ({ ...c, files: [${basePackages.join(', ')}] })),`
     : `  // base — applies to all files not matched by a scoped profile\n  ...tsfpp,`;
 
-  return [
-    imports,
-    '',
-    'export default [',
-    baseSpread,
-    ...scopedProfiles,
-    ']',
-    '',
-  ].join('\n');
+  return [imports, '', 'export default [', baseSpread, ...scopedBlocks, ']', ''].join('\n');
 }
 
-function generateSingleConfig(profile) {
-  const { import: imp, spread } = PROFILES[profile];
+function generateSingleEslint(profile) {
+  const { import: imp, spread } = ESLINT_PROFILES[profile];
   return `${imp}\nexport default [...${spread}]\n`;
 }
 
-async function writeEslintConfig() {
+async function writeEslintConfig(results) {
   const packages = await detectWorkspacePackages();
-
-  let content;
-  let description;
+  let content, description;
 
   if (packages) {
     console.log(`\n  Monorepo detected — ${packages.length} package(s) found.\n`);
     const packageProfiles = {};
-    for (const pkg of packages) {
-      packageProfiles[pkg] = await askProfile(pkg);
-    }
-    content     = generateMonorepoConfig(packageProfiles);
+    for (const pkg of packages) packageProfiles[pkg] = await askProfile(pkg);
+    content     = generateMonorepoEslint(packageProfiles);
     description = 'monorepo';
   } else {
     const profile = await askProfile('this project');
-    content       = generateSingleConfig(profile);
+    content       = generateSingleEslint(profile);
     description   = `profile: ${profile}`;
   }
 
@@ -178,175 +187,178 @@ async function writeEslintConfig() {
   }
 }
 
-// ─── Helpers ─────────────────────────────────────────────────────────────────
+// ─── tsconfig generation ──────────────────────────────────────────────────────
 
-async function ensureDir(filePath) {
-  await mkdir(dirname(filePath), { recursive: true });
-}
+const TSCONFIG_PRESETS = {
+  app: '@tsfpp/tsconfig/app',
+  lib: '@tsfpp/tsconfig/lib',
+};
 
-async function ask(question) {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      resolve(answer.trim().toLowerCase());
-    });
-  });
+async function askPreset(label) {
+  console.log(`\n  tsconfig preset for ${bold(label)}:`);
+  console.log(`  ${dim('1')} app ${dim('— application / tool (noEmit: true)')}`);
+  console.log(`  ${dim('2')} lib ${dim('— publishable package (declaration, composite)')}`);
+  console.log(`  ${dim('N')} skip`);
+  const choice = await ask(`  ${dim('[1/2/N, default: 1]')} `);
+  if (choice === 'n') return null;
+  return choice === '2' ? 'lib' : 'app';
 }
 
-async function confirm(question) {
-  return (await ask(question)) === 'y';
+function generateTsConfig(preset) {
+  return JSON.stringify(
+    { extends: TSCONFIG_PRESETS[preset], compilerOptions: { rootDir: 'src' }, include: ['src'] },
+    null, 2
+  ) + '\n';
 }
 
-// ─── Main ─────────────────────────────────────────────────────────────────────
-
-console.log();
-console.log(bold('  @tsfpp/agents — init'));
-console.log(dim('  Sets up Copilot agents, instructions, prompts, skills, and ESLint config.\n'));
-
-const results = { copied: [], skipped: [], failed: [] };
-
-// ── Copy files ────────────────────────────────────────────────────────────────
-
-for (const [src, dest] of FILES) {
-  const srcPath  = join(__dirname, src);
-  const destPath = join(cwd, dest);
+function generateRootTsConfig(packagePaths) {
+  return JSON.stringify(
+    { files: [], references: packagePaths.map(p => ({ path: p })) },
+    null, 2
+  ) + '\n';
+}
 
+async function writeIfConfirmed(destPath, content, label, results) {
   if (existsSync(destPath)) {
     const overwrite = await confirm(
-      `  ${yellow('!')} ${dest} already exists. Overwrite? ${dim('[y/N]')} `
+      `  ${yellow('!')} ${label} already exists. Overwrite? ${dim('[y/N]')} `
     );
     if (!overwrite) {
-      results.skipped.push(dest);
-      console.log(`  ${dim('–')} ${dim(dest)} ${dim('(skipped)')}`);
-      continue;
+      results.skipped.push(label);
+      console.log(`  ${dim('–')} ${dim(label)} ${dim('(skipped)')}`);
+      return;
     }
   }
-
   try {
     await ensureDir(destPath);
-    await copyFile(srcPath, destPath);
-    results.copied.push(dest);
-    console.log(`  ${green('✓')} ${dest}`);
+    await writeFile(destPath, content, 'utf8');
+    results.copied.push(label);
+    console.log(`  ${green('✓')} ${label}`);
   } catch (err) {
-    results.failed.push(dest);
-    console.log(`  \x1b[31m✗\x1b[0m ${dest} ${dim(`(${err.message})`)}`);
+    results.failed.push(label);
+    console.log(`  \x1b[31m✗\x1b[0m ${label} ${dim(`(${err.message})`)}`);
   }
 }
 
-// ── Generate eslint.config.js ─────────────────────────────────────────────────
-
-console.log();
+async function writeTsConfigs(results) {
+  const packages = await detectWorkspacePackages();
 
-const eslintDest = join(cwd, 'eslint.config.js');
+  if (packages) {
+    console.log(`  Generating tsconfig.json per package.\n`);
+    const packagePresets = {};
+    for (const pkg of packages) packagePresets[pkg] = await askPreset(pkg);
 
-if (existsSync(eslintDest)) {
-  const overwrite = await confirm(
-    `  ${yellow('!')} eslint.config.js already exists. Overwrite? ${dim('[y/N]')} `
-  );
-  if (!overwrite) {
-    results.skipped.push('eslint.config.js');
-    console.log(`  ${dim('–')} ${dim('eslint.config.js')} ${dim('(skipped)')}`);
+    for (const [pkg, preset] of Object.entries(packagePresets)) {
+      if (preset === null) {
+        results.skipped.push(`${pkg}/tsconfig.json`);
+        console.log(`  ${dim('–')} ${dim(`${pkg}/tsconfig.json`)} ${dim('(skipped)')}`);
+        continue;
+      }
+      await writeIfConfirmed(join(cwd, pkg, 'tsconfig.json'), generateTsConfig(preset), `${pkg}/tsconfig.json`, results);
+    }
+    await writeIfConfirmed(join(cwd, 'tsconfig.json'), generateRootTsConfig(packages), 'tsconfig.json (root references)', results);
   } else {
-    await writeEslintConfig();
+    const preset = await askPreset('this project');
+    if (preset === null) {
+      results.skipped.push('tsconfig.json');
+      console.log(`  ${dim('–')} ${dim('tsconfig.json')} ${dim('(skipped)')}`);
+    } else {
+      await writeIfConfirmed(join(cwd, 'tsconfig.json'), generateTsConfig(preset), 'tsconfig.json', results);
+    }
   }
-} else {
-  await writeEslintConfig();
 }
 
-// ── Generate tsconfig.json ────────────────────────────────────────────────────
+// ─── Main ─────────────────────────────────────────────────────────────────────
 
-console.log();
+async function main() {
+  console.log();
+  console.log(bold('  @tsfpp/agents — init') + (YES ? dim('  (--yes)') : ''));
+  if (YES) {
+    console.log(dim('  Copying package-managed files. eslint.config.js and tsconfig.json are not touched.\n'));
+  } else {
+    console.log(dim('  Sets up Copilot agents, instructions, prompts, skills, and ESLint config.\n'));
+  }
 
-await writeTsConfigs(await detectWorkspacePackages());
+  const results = { copied: [], skipped: [], failed: [] };
 
-async function writeTsConfigs(packages) {
-  const PRESETS = {
-    app: { extends: '@tsfpp/tsconfig/app', label: 'app — application / tool (noEmit)' },
-    lib: { extends: '@tsfpp/tsconfig/lib', label: 'lib — publishable package (declaration, composite)' },
-  };
+  // ── Copy package-managed files ─────────────────────────────────────────────
 
-  async function askPreset(label) {
-    console.log(`\n  tsconfig preset for ${bold(label)}:`);
-    console.log(`  ${dim('1')} app ${dim('— application / tool (noEmit: true)')}`);
-    console.log(`  ${dim('2')} lib ${dim('— publishable package (declaration, composite)')}`);
-    const choice = await ask(`  ${dim('[1/2, default: 1]')} `);
-    return choice === '2' ? 'lib' : 'app';
-  }
+  for (const [src, dest] of FILES) {
+    const srcPath  = join(__dirname, src);
+    const destPath = join(cwd, dest);
 
-  function generateTsConfig(preset, extra = {}) {
-    return JSON.stringify({
-      extends: PRESETS[preset].extends,
-      compilerOptions: { rootDir: 'src', ...extra },
-      include: ['src'],
-    }, null, 2) + '\n';
-  }
-
-  function generateRootTsConfig(packagePaths) {
-    return JSON.stringify({
-      files: [],
-      references: packagePaths.map(p => ({ path: p })),
-    }, null, 2) + '\n';
-  }
+    if (!existsSync(srcPath)) {
+      results.skipped.push(dest);
+      console.log(`  ${dim('–')} ${dim(dest)} ${dim('(source not found — skipped)')}`);
+      continue;
+    }
 
-  async function writeIfConfirmed(destPath, content, label) {
-    if (existsSync(destPath)) {
+    if (existsSync(destPath) && !YES) {
       const overwrite = await confirm(
-        `  ${yellow('!')} ${label} already exists. Overwrite? ${dim('[y/N]')} `
+        `  ${yellow('!')} ${dest} already exists. Overwrite? ${dim('[y/N]')} `
       );
       if (!overwrite) {
-        results.skipped.push(label);
-        console.log(`  ${dim('–')} ${dim(label)} ${dim('(skipped)')}`);
-        return;
+        results.skipped.push(dest);
+        console.log(`  ${dim('–')} ${dim(dest)} ${dim('(skipped)')}`);
+        continue;
       }
     }
+
     try {
       await ensureDir(destPath);
-      await writeFile(destPath, content, 'utf8');
-      results.copied.push(label);
-      console.log(`  ${green('✓')} ${label}`);
+      await copyFile(srcPath, destPath);
+      results.copied.push(dest);
+      console.log(`  ${green('✓')} ${dest}`);
     } catch (err) {
-      results.failed.push(label);
-      console.log(`  \x1b[31m✗\x1b[0m ${label} ${dim(`(${err.message})`)}`);
+      results.failed.push(dest);
+      console.log(`  \x1b[31m✗\x1b[0m ${dest} ${dim(`(${err.message})`)}`);
     }
   }
 
-  if (packages) {
-    // Monorepo: tsconfig per package + root references
-    console.log(`  Generating tsconfig.json per package.\n`);
-    const packagePresets = {};
-    for (const pkg of packages) {
-      packagePresets[pkg] = await askPreset(pkg);
-    }
+  // ── ESLint (interactive only) ──────────────────────────────────────────────
 
-    for (const [pkg, preset] of Object.entries(packagePresets)) {
-      const destPath = join(cwd, pkg, 'tsconfig.json');
-      const content  = generateTsConfig(preset);
-      await writeIfConfirmed(destPath, content, `${pkg}/tsconfig.json`);
+  if (!YES) {
+    console.log();
+    const eslintDest = join(cwd, 'eslint.config.js');
+    if (existsSync(eslintDest)) {
+      const overwrite = await confirm(
+        `  ${yellow('!')} eslint.config.js already exists. Overwrite? ${dim('[y/N]')} `
+      );
+      if (!overwrite) {
+        results.skipped.push('eslint.config.js');
+        console.log(`  ${dim('–')} ${dim('eslint.config.js')} ${dim('(skipped)')}`);
+      } else {
+        await writeEslintConfig(results);
+      }
+    } else {
+      await writeEslintConfig(results);
     }
+  }
+
+  // ── tsconfig (interactive only) ────────────────────────────────────────────
 
-    // Root references tsconfig
-    const rootDest    = join(cwd, 'tsconfig.json');
-    const rootContent = generateRootTsConfig(packages);
-    await writeIfConfirmed(rootDest, rootContent, 'tsconfig.json (root references)');
+  if (!YES) {
+    console.log();
+    await writeTsConfigs(results);
+  }
+
+  // ── Summary ────────────────────────────────────────────────────────────────
+
+  console.log();
+  console.log(dim('  ─────────────────────────────────────────'));
+  console.log(`  ${green(results.copied.length + ' copied')}  ${yellow(results.skipped.length + ' skipped')}  ${results.failed.length > 0 ? `\x1b[31m${results.failed.length} failed\x1b[0m` : dim('0 failed')}`);
+  console.log();
+
+  if (results.failed.length === 0) {
+    console.log('  ' + bold('Done.') + ' Reload VS Code to activate Copilot instructions.');
+    console.log(dim('  Commit the generated files — they are workspace configuration.\n'));
   } else {
-    // Single package
-    const preset  = await askPreset('this project');
-    const dest    = join(cwd, 'tsconfig.json');
-    const content = generateTsConfig(preset);
-    await writeIfConfirmed(dest, content, 'tsconfig.json');
+    console.log('  Some files could not be copied. Check the errors above.\n');
+    process.exit(1);
   }
 }
 
-console.log();
-console.log(dim('  ─────────────────────────────────────────'));
-console.log(`  ${green(results.copied.length + ' copied')}  ${yellow(results.skipped.length + ' skipped')}  ${results.failed.length > 0 ? `\x1b[31m${results.failed.length} failed\x1b[0m` : dim('0 failed')}`);
-console.log();
-
-if (results.failed.length === 0) {
-  console.log('  ' + bold('Done.') + ' Reload VS Code to activate Copilot instructions.');
-  console.log(dim('  Commit the generated files — they are workspace configuration.\n'));
-} else {
-  console.log('  Some files could not be copied. Check the errors above.\n');
+main().catch(err => {
+  console.error(err);
   process.exit(1);
-}
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tsfpp/agents",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "Workspace AI tooling for TSF++ projects: scoped instructions, coding agents, and reusable prompts",
   "keywords": [
     "tsfpp",