class-ai-agent 1.3.0 → 1.4.0

package/.kiro/skills/supabase-postgres-best-practices/references/security-rls-basics.md

@@ -0,0 +1,50 @@
+---
+title: Enable Row Level Security for Multi-Tenant Data
+impact: CRITICAL
+impactDescription: Database-enforced tenant isolation, prevent data leaks
+tags: rls, row-level-security, multi-tenant, security
+---
+
+## Enable Row Level Security for Multi-Tenant Data
+
+Row Level Security (RLS) enforces data access at the database level, ensuring users only see their own data.
+
+**Incorrect (application-level filtering only):**
+
+```sql
+-- Relying only on application to filter
+select * from orders where user_id = $current_user_id;
+
+-- Bug or bypass means all data is exposed!
+select * from orders;  -- Returns ALL orders
+```
+
+**Correct (database-enforced RLS):**
+
+```sql
+-- Enable RLS on the table
+alter table orders enable row level security;
+
+-- Create policy for users to see only their orders
+create policy orders_user_policy on orders
+  for all
+  using (user_id = current_setting('app.current_user_id')::bigint);
+
+-- Force RLS even for table owners
+alter table orders force row level security;
+
+-- Set user context and query
+set app.current_user_id = '123';
+select * from orders;  -- Only returns orders for user 123
+```
+
+Policy for authenticated role:
+
+```sql
+create policy orders_user_policy on orders
+  for all
+  to authenticated
+  using (user_id = auth.uid());
+```
+
+Reference: [Row Level Security](https://supabase.com/docs/guides/database/postgres/row-level-security)

package/.kiro/skills/supabase-postgres-best-practices/references/security-rls-performance.md

@@ -0,0 +1,63 @@
+---
+title: Optimize RLS Policies for Performance
+impact: HIGH
+impactDescription: 5-10x faster RLS queries with proper patterns
+tags: rls, performance, security, optimization
+---
+
+## Optimize RLS Policies for Performance
+
+Poorly written RLS policies can cause severe performance issues. Use subqueries and indexes strategically.
+
+**Incorrect (function called for every row):**
+
+```sql
+create policy orders_policy on orders
+  using (auth.uid() = user_id);  -- auth.uid() called per row!
+
+-- With 1M rows, auth.uid() is called 1M times
+```
+
+**Correct (wrap functions in SELECT):**
+
+```sql
+create policy orders_policy on orders
+  using ((select auth.uid()) = user_id);  -- Called once, cached
+
+-- 100x+ faster on large tables
+```
+
+Use security definer functions for complex checks:
+
+`SECURITY DEFINER` functions run with the creator's privileges and bypass RLS on any tables they touch — which is what makes them useful for internal lookups, but also what makes them dangerous if misused. Always include an explicit `auth.uid()` check inside the function body, keep them in a non-exposed schema, and revoke `EXECUTE` from any role that shouldn't call them directly.
+
+```sql
+-- Create helper function in a private schema
+create or replace function private.is_team_member(team_id bigint)
+returns boolean
+language sql
+security definer
+set search_path = ''
+as $$
+  select exists (
+    select 1 from public.team_members
+    -- always check the calling user's identity inside the function
+    where team_id = $1 and user_id = (select auth.uid())
+  );
+$$;
+
+-- Revoke direct execution from public roles
+revoke execute on function private.is_team_member(bigint) from PUBLIC, anon, authenticated, service_role;
+
+-- Use in policy (indexed lookup, not per-row check)
+create policy team_orders_policy on orders
+  using ((select private.is_team_member(team_id)));
+```
+
+Always add indexes on columns used in RLS policies:
+
+```sql
+create index orders_user_id_idx on orders (user_id);
+```
+
+Reference: [RLS Performance](https://supabase.com/docs/guides/database/postgres/row-level-security#rls-performance-recommendations)

package/.kiro/steering/tech-stack.md

@@ -23,8 +23,9 @@ description: "Technology Stack — Selection & Standards"
 | **Backend Framework** | Express.js + Node | Fastify | Hapi, Koa |
 | **API Style** | REST (default) | tRPC (fullstack TS) | GraphQL (unless needed) |
 | **Language** | TypeScript (always) | — | Plain JavaScript |
-| **Database** | PostgreSQL | — | MySQL (prefer PG) |
+| **Database** | PostgreSQL | Supabase (managed Postgres + bundled `supabase` skills) | MySQL (prefer PG) |
 | **ORM** | Prisma | Drizzle | Sequelize, TypeORM |
+| **BaaS (Auth, DB, Storage, Realtime)** | — | Supabase | Firebase |
 | **Cache** | Redis (ioredis) | Upstash Redis | Memcached |
 | **Queue — Simple jobs** | BullMQ (Redis-backed) | — | — |
 | **Queue — Enterprise/Microservices** | RabbitMQ | Kafka (high-throughput streams) | — |

package/AGENTS.md

@@ -14,4 +14,4 @@ Project guidance for AI coding agents:
 
 **Cross-tool continuity:** committed [`.agent/SESSION.md`](.agent/README.md) — use `/resume` at session start and `/handoff` at session end (see hub docs and `.agent/README.md`).
 
-Keep **`.claude/`**, **`.cursor/`**, and **`.kiro/`** in sync when you change workflows or standards. After editing `.cursor/`, run `npm run sync:kiro` in the **class-ai-agent** repo to refresh `.kiro/`.
+Keep **`.claude/`**, **`.cursor/`**, and **`.kiro/`** in sync when you change workflows or standards. After editing `.cursor/`, run `npm run sync:kiro` in the **class-ai-agent** repo to refresh `.kiro/`. To refresh vendored Supabase skills from upstream, run `npm run sync:supabase-skills`.

package/README.md

@@ -18,7 +18,7 @@ Open-source AI agent scaffolding by **Royal Solution** — use it in your own pr
   <a href="https://www.npmjs.com/package/class-ai-agent"><img src="https://img.shields.io/npm/v/class-ai-agent?label=npm&logo=npm&style=flat-square" alt="npm version" /></a>
   <img src="https://img.shields.io/badge/node-%3E%3D16.7-339933?logo=node.js&logoColor=white&style=flat-square" alt="Node.js 16.7+" />
   <img src="https://img.shields.io/badge/license-MIT-blue?style=flat-square" alt="License MIT" />
-  <img src="https://img.shields.io/badge/version-1.3.0-blue?style=flat-square" alt="Version" />
+  <img src="https://img.shields.io/badge/version-1.4.0-blue?style=flat-square" alt="Version" />
 </p>
 
 </div>
@@ -152,10 +152,10 @@ What is inside:
 - **10 specialized agents** (markdown personas under `agents/`)
 - **13 mandatory topic rules** (plus **`cursor-overview.mdc`** under `.cursor/rules/`)
 - **11 workflow prompts** under `commands/` (includes `handoff`, `resume`)
-- **7 skills** (TDD, code review, incremental implementation, deploy, security review, agent continuity, UI/UX Pro Max)
-- **6 reference docs** (security, testing, performance, accessibility, codegraph, agent-continuity)
+- **9 skills** (TDD, code review, incremental implementation, deploy, security review, agent continuity, UI/UX Pro Max, **supabase**, **supabase-postgres-best-practices**)
+- **7 reference docs** (security, testing, performance, accessibility, codegraph, agent-continuity, **supabase**)
 - **`.agent/SESSION.md`** for cross-tool session handoff
-- **CodeGraph MCP** for Cursor and Kiro (`.cursor/mcp.json`, `.kiro/settings/mcp.json`)
+- **CodeGraph + Supabase MCP** for Cursor and Kiro (`.cursor/mcp.json`, `.kiro/settings/mcp.json`)
 
 Keep **`.claude/`**, **`.cursor/`**, and **`.kiro/`** in sync when you change standards. After editing `.cursor/`, run **`npm run sync:kiro`** (or `node scripts/sync-kiro-from-cursor.mjs`) to refresh `.kiro/`.
 
@@ -224,7 +224,7 @@ Same ideas as `.claude/` for `commands/`, `agents/`, `skills/`, `references/`. D
 ```
 .cursor/
 ├── CURSOR.md
-├── mcp.json                  # CodeGraph MCP (npx @colbymchenry/codegraph)
+├── mcp.json                  # CodeGraph + Supabase MCP
 ├── settings.json
 ├── commands/
 ├── agents/
@@ -250,7 +250,7 @@ Mirrors `.cursor/` for `commands/`, `agents/`, `skills/`, `references/`. Kiro us
 .kiro/
 ├── KIRO.md
 ├── settings/
-│   └── mcp.json              # CodeGraph MCP
+│   └── mcp.json              # CodeGraph + Supabase MCP
 ├── settings.json
 ├── steering/                 # kiro-overview.md, security.md, codegraph.md, …
 ├── commands/
@@ -364,7 +364,11 @@ Ship thin end-to-end slices (DB + API + UI), not “all models first, then all r
 
 ## Release notes
 
+### 1.4.0 — 2026-06-02
 
+- Bundle official **Supabase Agent Skills** (`supabase`, `supabase-postgres-best-practices`) for Cursor, Claude Code, and Kiro
+- Add **Supabase MCP** (`https://mcp.supabase.com/mcp?features=docs`) alongside CodeGraph in `.cursor/mcp.json` and `.kiro/settings/mcp.json`
+- Add `.cursor/references/supabase.md`, `THIRD_PARTY_NOTICES.md`, and maintainer command `npm run sync:supabase-skills` (pinned to [supabase/agent-skills](https://github.com/supabase/agent-skills) v0.1.5)
 
 ### 1.3.0 — 2026-06-02
 
@@ -380,7 +384,7 @@ Ship thin end-to-end slices (DB + API + UI), not “all models first, then all r
 2. Keep tests green.
 3. Run **`/review`** before opening a PR.
 4. Use [conventional commits](https://www.conventionalcommits.org/).
-5. Update **`.claude/`**, **`.cursor/`**, and **`.kiro/`** when rules or workflows change (run `npm run sync:kiro` after `.cursor/` edits).
+5. Update **`.claude/`**, **`.cursor/`**, and **`.kiro/`** when rules or workflows change (run `npm run sync:kiro` after `.cursor/` edits; run `npm run sync:supabase-skills` to refresh vendored Supabase skills).
 
 ---
 

package/bin/class-ai-agent.cjs

@@ -37,6 +37,10 @@ CodeGraph:
   After install, runs "npx @colbymchenry/codegraph init -i" in the target directory
   (Node 20+ recommended). Set CODEGRAPH_SKIP_INIT=1 to skip indexing.
 
+Supabase:
+  Bundled skills under skills/supabase/ and skills/supabase-postgres-best-practices/.
+  MCP: https://mcp.supabase.com/mcp (OAuth on first use). Reload Cursor / restart Kiro after install.
+
 Examples:
   npx class-ai-agent
   npx class-ai-agent --dir ./my-app
@@ -304,10 +308,12 @@ function run(opts) {
   if (installKiro) hints.push('.kiro/KIRO.md');
   console.log(`\nDone. Next steps: read ${hints.join(', ')}.`);
   if (installCursor) {
-    console.log('  Cursor: reload the window so CodeGraph MCP loads (.cursor/mcp.json).');
+    console.log('  Cursor: reload the window so MCP loads (.cursor/mcp.json — CodeGraph + Supabase).');
+    console.log('  Supabase: complete OAuth in the browser when you first use Supabase MCP tools.');
   }
   if (installKiro) {
-    console.log('  Kiro: restart IDE/CLI so CodeGraph MCP loads (.kiro/settings/mcp.json).');
+    console.log('  Kiro: restart IDE/CLI so MCP loads (.kiro/settings/mcp.json — CodeGraph + Supabase).');
+    console.log('  Supabase: complete OAuth when you first use Supabase MCP tools.');
   }
   if (shouldInstallAgentDir(opts)) {
     console.log('  Continuity: edit .agent/SESSION.md at session end (/handoff); read at start (/resume).');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "class-ai-agent",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Production-grade AI agent configuration for Claude Code, Cursor & Kiro",
   "license": "MIT",
   "repository": {
@@ -17,6 +17,7 @@
     "cursor",
     "kiro",
     "codegraph",
+    "supabase",
     "ai",
     "agent",
     "scaffold"
@@ -39,7 +40,8 @@
   "scripts": {
     "prepack": "node -e \"const fs=require('fs');['.agent','.claude','.cursor','.kiro','AGENTS.md'].forEach(p=>{if(!fs.existsSync(p))process.exit(1)})\"",
     "sync:kiro": "node scripts/sync-kiro-from-cursor.mjs",
+    "sync:supabase-skills": "node scripts/sync-supabase-skills.mjs",
     "release:readme": "node scripts/update-readme-release.mjs",
-    "test:cli": "node bin/class-ai-agent.cjs --help && node bin/class-ai-agent.cjs --version && node -e \"const fs=require('fs');const c=JSON.parse(fs.readFileSync('.cursor/mcp.json','utf8'));const k=JSON.parse(fs.readFileSync('.kiro/settings/mcp.json','utf8'));if(!c.mcpServers?.codegraph||!k.mcpServers?.codegraph)throw new Error('missing codegraph MCP');if(!fs.existsSync('.cursor/rules/codegraph.mdc'))throw new Error('missing codegraph.mdc');if(!fs.existsSync('.kiro/steering/codegraph.md'))throw new Error('missing kiro codegraph steering');if(!fs.existsSync('.agent/SESSION.template.md'))throw new Error('missing SESSION.template');if(!fs.existsSync('.cursor/rules/agent-continuity.mdc'))throw new Error('missing agent-continuity.mdc');if(!fs.existsSync('.kiro/steering/agent-continuity.md'))throw new Error('missing kiro agent-continuity steering');if(!fs.existsSync('.cursor/commands/handoff.md')||!fs.existsSync('.cursor/commands/resume.md'))throw new Error('missing handoff/resume commands');\""
+    "test:cli": "node bin/class-ai-agent.cjs --help && node bin/class-ai-agent.cjs --version && node -e \"const fs=require('fs');const c=JSON.parse(fs.readFileSync('.cursor/mcp.json','utf8'));const k=JSON.parse(fs.readFileSync('.kiro/settings/mcp.json','utf8'));if(!c.mcpServers?.codegraph||!k.mcpServers?.codegraph)throw new Error('missing codegraph MCP');if(!c.mcpServers?.supabase?.url?.includes('mcp.supabase.com')||!k.mcpServers?.supabase?.url?.includes('mcp.supabase.com'))throw new Error('missing supabase MCP');if(!fs.existsSync('.cursor/skills/supabase/SKILL.md')||!fs.existsSync('.cursor/skills/supabase-postgres-best-practices/SKILL.md'))throw new Error('missing supabase skills');if(!fs.existsSync('.claude/skills/supabase/SKILL.md'))throw new Error('missing claude supabase skill');if(!fs.existsSync('.cursor/references/supabase.md'))throw new Error('missing supabase reference');if(!fs.existsSync('scripts/sync-supabase-skills.mjs'))throw new Error('missing sync-supabase-skills');if(!fs.existsSync('.cursor/rules/codegraph.mdc'))throw new Error('missing codegraph.mdc');if(!fs.existsSync('.kiro/steering/codegraph.md'))throw new Error('missing kiro codegraph steering');if(!fs.existsSync('.agent/SESSION.template.md'))throw new Error('missing SESSION.template');if(!fs.existsSync('.cursor/rules/agent-continuity.mdc'))throw new Error('missing agent-continuity.mdc');if(!fs.existsSync('.kiro/steering/agent-continuity.md'))throw new Error('missing kiro agent-continuity steering');if(!fs.existsSync('.cursor/commands/handoff.md')||!fs.existsSync('.cursor/commands/resume.md'))throw new Error('missing handoff/resume commands');\""
   }
 }