ac-framework 2.2.0 → 2.4.0

package/framework/make_your_own/.crush/skills/vibe-security/references/payments.md

@@ -0,0 +1,63 @@
+# Payment Security (Stripe)
+
+## Never Trust Client-Submitted Prices
+
+The #1 payment vulnerability in vibe-coded apps: the price comes from the client. An attacker can set any amount, including $0.
+
+```typescript
+// BAD: price comes from the request body
+const session = await stripe.checkout.sessions.create({
+  line_items: [{
+    price_data: {
+      currency: 'usd',
+      unit_amount: req.body.price, // attacker controls this
+      product_data: { name: req.body.name },
+    },
+    quantity: 1,
+  }],
+});
+
+// GOOD: look up the price server-side
+const product = await db.products.findUnique({ where: { id: req.body.productId } });
+if (!product) return new Response('Not found', { status: 404 });
+
+const session = await stripe.checkout.sessions.create({
+  line_items: [{ price: product.stripePriceId, quantity: 1 }],
+});
+```
+
+Use Stripe Price IDs (created via the Stripe dashboard or API) rather than constructing prices from your database. This way, prices are defined in Stripe and can't be manipulated.
+
+## Webhook Signature Verification
+
+Stripe webhooks must have their signatures verified. This requires the **raw request body** — parsing the body as JSON first destroys the signature.
+
+```typescript
+// Express: webhook route MUST use express.raw() BEFORE express.json()
+app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
+  const sig = req.headers['stripe-signature'];
+  const event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret);
+  // ... handle event
+});
+
+// Next.js App Router: use request.text(), NOT request.json()
+export async function POST(request: Request) {
+  const body = await request.text();
+  const sig = request.headers.get('stripe-signature')!;
+  const event = stripe.webhooks.constructEvent(body, sig, webhookSecret);
+  // ... handle event
+}
+```
+
+## Subscription Status Validation
+
+Check subscription status **server-side on every protected request** using your database (kept in sync via webhooks). Do not rely on:
+- A cached session value from login time
+- A client-side flag
+- A JWT claim that was set at token creation and never refreshed
+
+Subscriptions can be cancelled, expire, or change tier at any time. Your database (updated via webhooks) is the source of truth.
+
+## Checkout Session Metadata
+
+Validate that checkout session metadata (user ID, plan, etc.) was set **server-side** when creating the session, not passed from the client. If metadata comes from the client, an attacker can claim to be a different user or select a different plan.

package/framework/make_your_own/.crush/skills/vibe-security/references/rate-limiting.md

@@ -0,0 +1,55 @@
+# Rate Limiting & Abuse Prevention
+
+## Where Rate Limiting Is Required
+
+Every one of these endpoints needs rate limiting. AI assistants almost never add it:
+
+- **Auth endpoints** — login, register, password reset, OTP verification, magic link. Without limits, attackers can brute-force passwords or enumerate accounts.
+- **AI API calls** — Any endpoint that calls OpenAI, Anthropic, or similar. A single user can drain your entire monthly budget in minutes.
+- **Email / SMS sending** — Attackers can use your app as a spam relay.
+- **File processing** — Upload, resize, convert. CPU-intensive operations without limits enable denial-of-service.
+- **Webhook-like endpoints** — Anything accepting external input at scale.
+
+## Don't Store Rate Limits in Public Tables
+
+If rate limit counters live in a Supabase public table, users can reset their own counters via the REST API. Use:
+
+- **Upstash Redis** — Serverless Redis with built-in rate limiting primitives
+- **Private schema table** — Not exposed via PostgREST
+- **Middleware-level limiting** — At the edge or API gateway
+- **In-memory stores** — For single-server deployments (Redis for multi-server)
+
+## Combine Per-IP and Per-User Limiting
+
+- IP-only limits are defeated by rotating IPs (trivial with VPNs or botnets)
+- User-only limits are defeated by creating new accounts
+- Use both together for effective protection
+
+## Billing Protection
+
+- Set billing alerts on every cloud provider (AWS, GCP, Vercel, etc.)
+- Set **hard spending caps** on AI API providers (OpenAI, Anthropic)
+- Use per-user usage quotas with hard limits, not just soft warnings
+- Monitor for anomalous usage patterns (sudden spikes, requests at odd hours)
+
+## Implementation Pattern
+
+```typescript
+// Example: rate limiting with Upstash Redis
+import { Ratelimit } from '@upstash/ratelimit';
+import { Redis } from '@upstash/redis';
+
+const ratelimit = new Ratelimit({
+  redis: Redis.fromEnv(),
+  limiter: Ratelimit.slidingWindow(10, '1 m'), // 10 requests per minute
+});
+
+export async function POST(request: Request) {
+  const ip = request.headers.get('x-forwarded-for') ?? '127.0.0.1';
+  const { success } = await ratelimit.limit(ip);
+  if (!success) {
+    return new Response('Too many requests', { status: 429 });
+  }
+  // ... handle request
+}
+```

package/framework/make_your_own/.crush/skills/vibe-security/references/secrets-and-env.md

@@ -0,0 +1,47 @@
+# Secrets & Environment Variables
+
+## Hardcoded Credentials
+
+Never hardcode API keys, tokens, passwords, or credentials in source code. This includes:
+- Strings that look like API keys in source files
+- Connection strings with embedded passwords
+- Private keys or certificates in the repo
+
+If a secret was ever committed to Git history, consider it compromised — deleting the file doesn't remove it from history. The key must be rotated immediately. Run `gitleaks detect` to scan for leaked secrets.
+
+## Client-Side Environment Variable Prefixes
+
+These prefixes cause env vars to be inlined into the client bundle at build time. Everything in the bundle is visible to anyone:
+
+| Framework | Client Prefix | Danger |
+|-----------|--------------|--------|
+| Next.js | `NEXT_PUBLIC_` | Inlined into browser JS at build time |
+| Vite | `VITE_` | Inlined into browser JS at build time |
+| Expo / React Native | `EXPO_PUBLIC_` | Baked into the app bundle |
+| Create React App | `REACT_APP_` | Inlined into browser JS at build time |
+
+**What belongs client-side:**
+- Stripe publishable key (`pk_live_*`, `pk_test_*`)
+- Supabase anon key
+- Firebase client config (apiKey, authDomain, projectId)
+- Public analytics IDs
+
+**What must NEVER be client-side:**
+- Supabase `service_role` key (bypasses all RLS)
+- Stripe secret key (`sk_live_*`, `sk_test_*`)
+- Any database connection string
+- Any third-party API secret key
+- JWT signing secrets
+- OAuth client secrets
+
+## .gitignore
+
+Ensure `.env`, `.env.local`, `.env.*.local`, and any file containing secrets is in `.gitignore` **before the first commit**. Check that `.env.example` or `.env.sample` files contain only placeholder values, not real keys.
+
+## Detection Tips
+
+When auditing, search for:
+- Files named `.env` that are tracked by git (`git ls-files | grep .env`)
+- Strings matching common key patterns: `sk_live_`, `sk_test_`, `AKIA`, `ghp_`, `glpat-`, `xoxb-`, `Bearer `
+- `process.env.NEXT_PUBLIC_` or `import.meta.env.VITE_` referencing anything with "secret", "private", "service", or "key" in the name
+- Hardcoded URLs containing credentials (e.g., `postgresql://user:password@host`)

package/framework/make_your_own/.cursor/commands/ac-lite.md

@@ -0,0 +1,42 @@
+# AC Lite Custom Workflow Template
+
+Use this lite template after `find-skills` to keep a minimal, focused workflow.
+
+## Lite rules
+
+1. Detect assistant folders first (`ls -la`).
+2. Run `find-skills` on project bootstrap or direct request.
+3. Offer at least 5 skills per search batch.
+4. Install only user-confirmed skills.
+5. Ensure installed skills end in the intended assistant `skills/` folder.
+
+## Default baseline
+
+- `acfm-spec-workflow`
+- `acfm-memory`
+- `find-skills`
+- `openspec-new-change` or `openspec-ff-change`
+- `openspec-continue-change`
+- `openspec-apply-change`
+- `openspec-verify-change`
+- `openspec-archive-change`
+
+## Selected add-on skills
+
+- {{SELECTED_SKILLS_LIST}}
+
+## Lite execution flow
+
+1. Bootstrap checks + memory recall.
+2. Skill discovery batch (>=5 options) and user confirmation.
+3. Install and normalize paths.
+4. Implement with selected baseline + add-on skills.
+5. Verify, document, archive.
+
+## Checklist
+
+- [ ] Recommendations per batch >= 5
+- [ ] Install targets confirmed
+- [ ] `ac.md` regenerated
+- [ ] Companion instruction files synchronized
+

package/framework/make_your_own/.cursor/commands/ac.md

@@ -0,0 +1,95 @@
+# AC Custom Workflow Template
+
+This is a template guide for building a project-specific workflow after running `find-skills`.
+
+## How to use this template
+
+1. Detect assistant folders at workspace root (`ls -la`).
+2. Run skill discovery batches (minimum 5 recommendations per batch).
+3. Confirm selected skills with the user.
+4. Install selected skills to target assistant folders.
+5. Normalize install paths if a temporary folder (for example `.agents`) is created.
+6. Replace placeholders in this file with the final skill set and workflow.
+
+## Assistant targets detected
+
+- {{ASSISTANT_FOLDERS}}
+
+## Selected skill repertoire
+
+| Skill | Why selected | Workflow phase |
+|---|---|---|
+| {{SKILL_1}} | {{RATIONALE_1}} | {{PHASE_1}} |
+| {{SKILL_2}} | {{RATIONALE_2}} | {{PHASE_2}} |
+| {{SKILL_3}} | {{RATIONALE_3}} | {{PHASE_3}} |
+| {{SKILL_4}} | {{RATIONALE_4}} | {{PHASE_4}} |
+| {{SKILL_5}} | {{RATIONALE_5}} | {{PHASE_5}} |
+
+Add rows as needed.
+
+## Workflow skeleton
+
+### Phase 0: Bootstrap
+
+- Run `acfm-spec-workflow` checks.
+- Run memory recall (`acfm-memory`).
+- Run `find-skills` for initial repertoire (mandatory on project start).
+
+### Phase 1: Discovery and planning
+
+- `openspec-explore`
+- `brainstorming`
+- `spec-clarification`
+- Optional domain skills selected by the user
+
+### Phase 2: Design and tasking
+
+- `openspec-new-change` or `openspec-ff-change`
+- `openspec-continue-change`
+- `spec-analysis`
+- `requirement-checklist`
+
+### Phase 3: Implementation
+
+- `test-generator`
+- `openspec-apply-change`
+- `code-review`
+- Security/performance skills as selected
+
+### Phase 4: Verification and closure
+
+- `openspec-verify-change`
+- `vibe-security`
+- `documentation`
+- `sync-index`
+- `openspec-archive-change`
+
+## Installation commands log
+
+```bash
+# discovery
+npx skills find {{QUERY}}
+
+# install examples
+npx skills add {{PACKAGE_OR_REPO}} --skill {{SKILL_NAME}}
+
+# optional explicit example
+npx skills add https://github.com/vercel-labs/skills --skill find-skills
+```
+
+## Path normalization log
+
+Document any relocation from temporary folders to real assistant targets:
+
+- Source: `{{TEMP_SKILL_PATH}}`
+- Destination: `{{TARGET_AGENT_SKILL_PATH}}`
+- Cleanup: `{{REMOVED_TEMP_FOLDERS}}`
+
+## Required outputs checklist
+
+- [ ] At least 5 recommendations were produced for each search batch.
+- [ ] User confirmed which skills to install.
+- [ ] Skills installed in intended assistant folder(s).
+- [ ] Temporary install folders cleaned.
+- [ ] `ac.md` updated with final selected skills.
+

package/framework/make_your_own/.cursor/commands/opsx-apply.md

@@ -0,0 +1,152 @@
+---
+name: /opsx-apply
+id: opsx-apply
+category: Workflow
+description: Implement tasks from an OpenSpec change (Experimental)
+---
+
+Implement tasks from an OpenSpec change.
+
+**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `acfm spec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   acfm spec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   acfm spec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - Context file paths (varies by schema)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue`
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read the files listed in `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! You can archive this change with `/opsx:archive`.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly

package/framework/make_your_own/.cursor/commands/opsx-archive.md

@@ -0,0 +1,157 @@
+---
+name: /opsx-archive
+id: opsx-archive
+category: Workflow
+description: Archive a completed change in the experimental workflow
+---
+
+Archive a completed change in the experimental workflow.
+
+**Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `acfm spec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `acfm spec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, execute `/opsx:sync` logic. Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create the archive directory if it doesn't exist:
+   ```bash
+   mkdir -p openspec/changes/archive
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move the change directory to archive
+
+   ```bash
+   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Spec sync status (synced / sync skipped / no delta specs)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success (No Delta Specs)**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** No delta specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success With Warnings**
+
+```
+## Archive Complete (with warnings)
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Specs:** Sync skipped (user chose to skip)
+
+**Warnings:**
+- Archived with 2 incomplete artifacts
+- Archived with 3 incomplete tasks
+- Delta spec sync was skipped (user chose to skip)
+
+Review the archive if this was not intentional.
+```
+
+**Output On Error (Archive Exists)**
+
+```
+## Archive Failed
+
+**Change:** <change-name>
+**Target:** openspec/changes/archive/YYYY-MM-DD-<name>/
+
+Target archive directory already exists.
+
+**Options:**
+1. Rename the existing archive
+2. Delete the existing archive if it's a duplicate
+3. Wait until a different date to archive
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (acfm spec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use /opsx:sync approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting