@webjsdev/cli 0.10.10 → 0.10.11

package/bin/webjs.js

@@ -255,10 +255,12 @@ async function main() {
 
       if (rest.includes('--rules')) {
         console.log('webjs check, correctness rules:');
-        console.log('  Every rule catches objectively broken code (a crash, a');
-        console.log('  security leak, or a build/type-strip failure) and always');
-        console.log('  runs. Project conventions (layout, style, process) are');
-        console.log('  guidance in CONVENTIONS.md, not rules here.\n');
+        console.log('  Every rule catches code that is wrong to ship: a crash, a');
+        console.log('  security leak, a build/type-strip failure, or (the one');
+        console.log('  sentinel-based rule, no-scaffold-placeholder) unreplaced');
+        console.log('  scaffold example content. They always run. Project');
+        console.log('  conventions (layout, style, process) are guidance in');
+        console.log('  CONVENTIONS.md, not rules here.\n');
         for (const r of RULES) {
           console.log(`  ${r.name.padEnd(30)} ${r.description}`);
         }

package/lib/create.js

@@ -685,7 +685,8 @@ export type ActionResult<T> =
       .replace(/`/g, '\\`')
       .replace(/\$\{/g, '\\${');
 
-  await writeFile(join(appDir, 'app', 'layout.ts'), `import { html, cspNonce } from '@webjsdev/core';
+  await writeFile(join(appDir, 'app', 'layout.ts'), `// webjs-scaffold-placeholder. This is the example app chrome (brand, nav, content-width container). Adapt it to your app, then delete this line. webjs check fails while the marker remains.
+import { html, cspNonce } from '@webjsdev/core';
 import '@webjsdev/core/client-router';
 import '../components/theme-toggle.ts';
 // Webjs UI components are tiered:
@@ -846,11 +847,19 @@ ${SHADCN_THEME}
         <span>${name}</span>
       </a>
       <nav class="flex gap-4 items-center">
+        <!-- Example nav. Replace with the real navigation for your app. -->
         \${navLink('/', 'Home')}
         <theme-toggle></theme-toggle>
       </nav>
     </header>
 
+    <!--
+      Content shell. The max-w-[760px] cap is a comfortable READING width,
+      right for prose, forms, and marketing. For a full-bleed app, dashboard,
+      or board, REPLACE it: widen the cap (for example max-w-[1400px]) or
+      drop the cap and mx-auto for an edge-to-edge layout. A wide layout left
+      inside the 760px reading column overflows into a horizontal scrollbar.
+    -->
     <main class="block max-w-[760px] mx-auto px-4 sm:px-6 pt-[72px] pb-12 min-h-screen">
       \${children}
     </main>
@@ -858,7 +867,8 @@ ${SHADCN_THEME}
 }
 `);
 
-  await writeFile(join(appDir, 'app', 'page.ts'), `import { html } from '@webjsdev/core';
+  await writeFile(join(appDir, 'app', 'page.ts'), `// webjs-scaffold-placeholder. This is the example homepage. Replace it with your app's real page, then delete this line. webjs check fails while the marker remains.
+import { html } from '@webjsdev/core';
 import { rubric, displayH1, accentLink } from '../lib/utils/ui.ts';
 import { buttonClass } from '../components/ui/button.ts';
 import { badgeClass } from '../components/ui/badge.ts';
@@ -1076,6 +1086,10 @@ For AI agents, read this before editing scaffolded files:
     Replace them with the app the user actually asked for. Don't ship
     the scaffold's example User model or "Hello from …" page as the
     final product.
+  • This fresh app intentionally FAILS \`webjs check\` with two
+    no-scaffold-placeholder violations (app/page.ts, app/layout.ts).
+    That is the signal to replace the example content. Delete each
+    marker comment line as you do, and the check goes green.
   • Use Prisma + SQLite for app data. It's already wired up. Define
     real models in prisma/schema.prisma and run \`webjs db migrate\`.
     NEVER store app data in JSON files, in-memory arrays, or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webjsdev/cli",
-  "version": "0.10.10",
+  "version": "0.10.11",
   "type": "module",
   "description": "webjs CLI - dev, start, create, db",
   "bin": {

package/templates/.dockerignore

@@ -6,10 +6,12 @@ node_modules
 # `.webjs/` is ignored EXCEPT for `.webjs/vendor/`, which holds the committed
 # importmap manifest (and optionally downloaded bundle bytes) the server needs
 # at boot without reaching api.jspm.io. DO NOT collapse to `**/.webjs`: parent
-# exclusion blocks child negations and the vendor files would never ship.
-.webjs/*
-!.webjs/vendor/
-!.webjs/vendor/**
+# exclusion blocks child negations and the vendor files would never ship. The
+# `**/` prefix matches `.webjs/` at any depth so a nested build context does
+# not ship the per-machine cache, mirroring the `.gitignore` pattern.
+**/.webjs/*
+!**/.webjs/vendor/
+!**/.webjs/vendor/**
 
 dist
 build

package/templates/AGENTS.md

@@ -14,7 +14,19 @@ now (`app/page.ts` printing "Hello from {{APP_NAME}}", the example `User`
 model in `prisma/schema.prisma`, the `theme-toggle` component, the
 example users module in api/saas templates) are **starting-point
 references, not the final product**. Your job is to replace them with
-the app the user actually asked for.
+the app the user actually asked for. That includes adapting
+`app/layout.ts`, not just the page. Set the real brand, replace the
+example `Home` nav, and pick a content-width container that fits. The
+default `<main class="max-w-[760px]">` is a reading column for prose and
+forms, so for a full-bleed app, dashboard, or board, widen the cap or
+remove it (keep the theme tokens). A wide layout left in the 760px
+reading column overflows into a horizontal scrollbar. This is ENFORCED:
+the example `app/page.ts` and `app/layout.ts` carry a
+`webjs-scaffold-placeholder` marker comment, and `webjs check` fails
+while any marker remains, so this freshly scaffolded app fails the check
+until you replace the example content (or deliberately keep it) and
+delete the marker line. The delivered app must contain only what the
+user asked for, never leftover scaffold code.
 
 **Non-negotiables for every webjs app:**
 
@@ -449,15 +461,18 @@ URLs or transitive deps drift. Pin is a deliberate developer action,
 like `npm install` itself.
 
 **Do NOT modify the `.webjs/` lines in `.gitignore` / `.dockerignore`.**
-The scaffolded pattern is three lines (`.webjs/*` + `!.webjs/vendor/`
-+ `!.webjs/vendor/**`) and is structurally load-bearing. Collapsing it
-to a single `.webjs/` excludes the parent directory; once the parent
-is excluded, git cannot re-include `.webjs/vendor/` via a child
-negation (gitignore semantics: parent exclusion blocks child
-negations). The breakage is invisible: `webjs vendor pin` runs, writes
-files, and git silently ignores them. Production then has no
-importmap.json and the server falls back to calling api.jspm.io on
-every cold start. The `gitignore-vendor-not-ignored` lint rule
+The scaffolded `.gitignore` pattern is three lines (`**/.webjs/*` +
+`!**/.webjs/vendor/` + `!**/.webjs/vendor/**`) and is structurally
+load-bearing. Collapsing it to a single `.webjs/` excludes the parent
+directory; once the parent is excluded, git cannot re-include
+`.webjs/vendor/` via a child negation (gitignore semantics: parent
+exclusion blocks child negations). The breakage is invisible: `webjs
+vendor pin` runs, writes files, and git silently ignores them.
+Production then has no importmap.json and the server falls back to
+calling api.jspm.io on every cold start. The `**/` prefix matters too:
+it ignores `.webjs/` at any depth, so an app nested below its repo root
+(a monorepo package) does not leak its generated `.webjs/routes.d.ts`
+into `git status`. The `gitignore-vendor-not-ignored` lint rule
 (`webjs check`) verifies the pattern with `git check-ignore` and will
 fail CI if it regresses.
 

package/templates/CONVENTIONS.md

@@ -308,11 +308,28 @@ When the user asks the agent to build their actual app:
    need a theme picker.
 4. **Delete the example users module** (api/saas templates) if the app
    doesn't use it.
-5. **Keep:** the Prisma setup, the test config, the agent config files
+5. **Adapt `app/layout.ts` to the app, not just the page.** Set the real
+   brand, replace the example `Home` nav with the app's navigation, and
+   pick a content-width container that fits. The default
+   `<main class="max-w-[760px]">` is a reading column for prose, forms,
+   and marketing. Widen it or drop the cap for a full-bleed app,
+   dashboard, or board, or a wide layout overflows into an unnecessary
+   horizontal scrollbar. Keep the design tokens and theme setup, those
+   are infrastructure.
+6. **Keep:** the Prisma setup, the test config, the agent config files
    (`AGENTS.md`, `CONVENTIONS.md`, `CLAUDE.md`, `.cursorrules`, etc.),
    `lib/prisma.server.ts`, the directory conventions, the design tokens in
    `app/layout.ts`. These are the infrastructure, not the example app.
 
+This is enforced, not just advised. The example `app/page.ts` and
+`app/layout.ts` carry a `webjs-scaffold-placeholder` marker comment, and
+the `no-scaffold-placeholder` check fails while any marker remains, so a
+freshly scaffolded app fails `webjs check` until you address each
+placeholder. The marker is acknowledge-and-remove: replace the example
+content, or deliberately keep it, and in either case delete the marker
+line. So the delivered app contains only what the user asked for, never
+leftover scaffold code.
+
 The scaffold exists so the agent doesn't reinvent the directory layout,
 the Prisma wiring, the test runner config, or the convention files. It
 does NOT exist so the agent ships the example homepage.