codebyplan 1.12.0 → 1.13.3

package/templates/skills/cbp-setup-eslint/SKILL.md

@@ -0,0 +1,199 @@
+---
+scope: org-shared
+name: cbp-setup-eslint
+description: Detect each app's tech stack, resolve matching DB ESLint presets, confirm which to enable per app, run `codebyplan eslint init` to generate eslint.config.mjs, and write/refresh .codebyplan/eslint.json. Interactive, idempotent.
+argument-hint: "[--force]"
+model: sonnet
+effort: xhigh
+allowed-tools: Read, Write, Edit, Bash(cat *), Bash(jq *), Bash(test *), Bash(ls *), Bash(mkdir *), Bash(cp *), Bash(echo *), Bash(mv *), Bash(npx codebyplan eslint *), AskUserQuestion, mcp__codebyplan__get_repos, mcp__codebyplan__get_eslint_presets
+---
+
+# ESLint Setup
+
+Configure ESLint flat config (`eslint.config.mjs`) across the repo's apps: detect each
+app's tech stack, resolve the DB ESLint presets that match it, generate per-app configs via
+`codebyplan eslint init`, and record the enabled presets in `.codebyplan/eslint.json` so the
+setup is reproducible and refreshes idempotently.
+
+Invoke at any time. Already-configured apps are preserved unless `--force` is passed.
+Pass `--force` to re-ask every app and re-resolve presets from scratch.
+
+The DB ESLint presets are the source of truth for rule bodies; `.codebyplan/eslint.json`
+only records *which* presets are enabled per app (the rules live in the generated
+`eslint.config.mjs` and the DB). See `reference/*.md` for the latest official flat-config
+setup per stack — including stacks that have **no preset yet** (manual-config guidance).
+
+## Arguments
+
+Inspect `$ARGUMENTS` for `--force`. If present, set `force_mode = true`.
+Absent: idempotent mode — preserve existing `apps[*]` entries in `.codebyplan/eslint.json`,
+skip re-asking already-configured apps.
+
+## Step 1 — Detect apps + per-app tech
+
+Run two detection signals and merge:
+
+**Signal A — DB tech_stack** via `mcp__codebyplan__get_repos` (match `repo_id` from
+`.codebyplan/repo.json`). Read the repo's `tech_stack`:
+- `tech_stack.apps[]` — each `{ name, path, stack[] }` is one app/package (monorepo).
+- `tech_stack.flat[]` — the deduped repo-wide stack (single-app repos, or when `apps[]` is empty).
+
+**Signal B — Filesystem fallback** (when `apps[]` is empty or stale). Discover workspaces the
+same way `tech-detect.ts` does, then probe each app's `package.json`:
+
+```bash
+# workspace globs → app dirs that contain a package.json
+cat pnpm-workspace.yaml 2>/dev/null            # packages: [...] globs
+jq -r '.workspaces[]?' package.json 2>/dev/null # or package.json#workspaces
+```
+
+For each app dir, read `package.json` dependencies to infer the stack (next → Next.js,
+react → React, @nestjs/* → NestJS, vitest → Vitest, jest → Jest, @playwright/test →
+Playwright, tailwindcss → Tailwind, expo → Expo, etc.). A single-app repo is one target
+with `source_path: "."` and `app: "root"`.
+
+**Signal C — Read existing `.codebyplan/eslint.json`** for the idempotent merge:
+
+```bash
+cat .codebyplan/eslint.json 2>/dev/null || echo '{}'
+```
+
+An app already present under `apps[<source_path>]` is "configured"; in non-`--force` mode it
+is skipped in Step 3 (presets preserved verbatim).
+
+## Step 2 — Resolve matched presets
+
+Call `mcp__codebyplan__get_eslint_presets` with `repo_id`. The response gives:
+- `presets[]` — all system presets (base, nextjs, react, node, cli, testing, testing-react, testing-e2e).
+- `matched[]` — the subset whose `tech_match` (requires / excludes / requires_capabilities) the
+  repo's DB tech_stack satisfies. **Use this — do not re-implement the matching client-side.**
+
+`matched[]` is repo-wide. Attribute presets to apps by intersecting each app's detected tech
+with each preset's `tech_match.requires` (e.g. `nextjs` → apps with Next.js; `node`/`cli` →
+the Node/CLI packages; `testing-e2e` → apps with Playwright). The `base` preset applies to
+every TypeScript app.
+
+**Gap stacks have NO preset.** NestJS, React Native/Expo, Jest, Tailwind, and
+WebdriverIO/Mocha are real stacks with no system preset. When an app's tech includes one,
+flag it in Step 3 and point at its `reference/*.md` for manual setup — never silently drop it.
+
+## Step 3 — Confirm presets per app
+
+For each detected app NOT already configured (or every app in `--force` mode), present its
+matched presets and ask via AskUserQuestion (one batch per app, matched pre-checked):
+
+```
+App: apps/web  (Next.js + React + SCSS + Playwright + Vitest)
+Enable which ESLint presets?
+  [x] base          (TypeScript + security + Prettier)
+  [x] nextjs        (Core Web Vitals + jsx-a11y + import order)
+  [x] testing       (Vitest)
+  [x] testing-react (Testing Library + jest-dom)
+  [x] testing-e2e   (Playwright)
+Gap stacks with no preset (manual setup — see reference/):
+  · tailwind  → reference/tailwind.md   (if this app uses Tailwind)
+```
+
+Record the confirmed preset-name list per app. Toggling is allowed; an app may opt out of a
+matched preset or in to an unmatched one.
+
+## Step 4 — Generate config (`codebyplan eslint init`)
+
+Offer to run the CLI, which detects tech, resolves presets, generates each
+`eslint.config.mjs`, installs missing deps, and saves the DB config:
+
+```bash
+npx codebyplan eslint init
+```
+
+**Degrade gracefully.** The CLI is sometimes unavailable (OAuth/MCP env, stale bin). If it
+errors or is absent, do NOT hard-fail — print the command for the user to run manually and
+continue to Step 5 (the `.codebyplan/eslint.json` record is written regardless). For gap
+stacks, point the user at the matching `reference/*.md` to hand-author the config.
+
+## Step 5 — Write `.codebyplan/eslint.json`
+
+Build the payload conforming to the `EslintLocalConfig` schema
+(`packages/codebyplan-package/src/lib/types.ts`): an `apps` map keyed by `source_path`, each
+value an `EslintAppConfig` `{ app, enabled_presets[], rule_overrides?, config_path, reference_docs? }`.
+
+Idempotency rule: deep-merge the new per-app entries onto the existing `apps` map so apps
+skipped by the Step 3 gate keep their prior entry. Assemble in the shell, then write
+atomically (tmp + mv) so the file is never left partial:
+
+```bash
+EXISTING_APPS=$(jq -c '.apps // {}' .codebyplan/eslint.json 2>/dev/null || echo '{}')
+APPS_JSON=$(echo "$EXISTING_APPS" | jq -c --argjson new "$NEW_APPS_JSON" '. * $new')
+jq -n --argjson apps "$APPS_JSON" '{apps: $apps}' \
+  > .codebyplan/eslint.json.tmp && mv .codebyplan/eslint.json.tmp .codebyplan/eslint.json
+```
+
+Example populated entry:
+
+```json
+{
+  "apps": {
+    "apps/web": {
+      "app": "web",
+      "enabled_presets": ["base", "nextjs", "testing", "testing-react", "testing-e2e"],
+      "config_path": "apps/web/eslint.config.mjs",
+      "reference_docs": ["base", "nextjs", "testing-react", "e2e"]
+    }
+  }
+}
+```
+
+Only the `apps` field is written — `EslintLocalConfig` defines no other. Never store rule
+bodies here; they live in the DB presets and the generated `eslint.config.mjs`.
+
+## Step 6 — Verify and report
+
+Re-read `.codebyplan/eslint.json` and emit a per-app summary:
+
+```
+ESLint Setup — Complete
+
+App                          | Presets                              | Config              | Gaps
+---------------------------- | ------------------------------------ | ------------------- | --------
+apps/web                     | base, nextjs, testing, testing-react | apps/web/eslint…mjs | —
+packages/codebyplan-package  | base, node, cli, testing             | …/eslint.config.mjs | —
+
+eslint.json written to .codebyplan/eslint.json
+
+Per-stack setup references — see reference docs:
+  base/typescript → reference/base.md      nextjs → reference/nextjs.md
+  react           → reference/react.md      node   → reference/node.md
+  nestjs          → reference/nestjs.md      cli    → reference/cli.md
+  tailwind        → reference/tailwind.md    expo   → reference/react-native.md
+  vitest          → reference/vitest.md      jest   → reference/jest.md
+  testing-react   → reference/testing-react.md   e2e → reference/e2e.md
+```
+
+If `codebyplan eslint init` was skipped (CLI unavailable), say so and restate the manual
+command + which apps still need their `eslint.config.mjs` generated.
+
+## Key Rules
+
+- DB presets are the source of truth for rule bodies — `.codebyplan/eslint.json` records only
+  which presets are enabled per app
+- `get_eslint_presets` `matched[]` drives preset resolution — never re-implement tech matching
+- Gap stacks (NestJS, Expo, Jest, Tailwind, WebdriverIO/Mocha) have no preset — point at
+  `reference/*.md`, never silently skip
+- `codebyplan eslint init` failure is non-fatal — print the manual command and still write eslint.json
+- Atomic write (tmp + mv) — never leave eslint.json partial
+- Reference docs track the **latest official** flat-config setup and flag where CBP's DB
+  presets diverge (e.g. ESLint v10 + `eslint-plugin-react-hooks@7` bundled compiler rules)
+
+## Additional resources
+
+- TypeScript foundation (ESLint v10 flat config): [reference/base.md](reference/base.md)
+- Next.js: [reference/nextjs.md](reference/nextjs.md) · React (+ Storybook): [reference/react.md](reference/react.md)
+- Node / Hono / Express: [reference/node.md](reference/node.md) · NestJS: [reference/nestjs.md](reference/nestjs.md)
+- CLI tools: [reference/cli.md](reference/cli.md) · Tailwind CSS: [reference/tailwind.md](reference/tailwind.md)
+- React Native / Expo: [reference/react-native.md](reference/react-native.md)
+- Vitest: [reference/vitest.md](reference/vitest.md) · Jest: [reference/jest.md](reference/jest.md)
+- Testing Library + jest-dom: [reference/testing-react.md](reference/testing-react.md)
+- E2E (Playwright / WebdriverIO / Mocha): [reference/e2e.md](reference/e2e.md)
+- ESLint local-config schema: `packages/codebyplan-package/src/lib/types.ts` (`EslintLocalConfig`)
+- DB presets + generator: `mcp__codebyplan__get_eslint_presets`, `codebyplan eslint init`
+- VS Code extension lint is not yet covered by a reference doc — use `reference/base.md` + `reference/node.md`.

package/templates/skills/cbp-setup-eslint/reference/base.md

@@ -0,0 +1,82 @@
+# base — TypeScript foundation (ESLint v10 flat config)
+
+The foundation every TypeScript app shares: ESLint flat config, type-checked
+`typescript-eslint` rules, security scanning, and Prettier. Maps to the CBP **`base`** DB
+preset (`tech_match.requires: ["TypeScript"]`).
+
+> **Verified 2026-05-31.** ESLint is on **v10** — flat config (`eslint.config.mjs`) is the
+> only native format (legacy `.eslintrc*` was removed). `defineConfig` from `eslint/config`
+> is the canonical wrapper for every stack below.
+
+## Packages
+
+| Package | Latest | Purpose |
+| ------- | ------ | ------- |
+| `eslint` | `10.4.1` | the linter (flat config only) |
+| `@eslint/js` | `10.0.1` | `js.configs.recommended` |
+| `typescript-eslint` | `8.60.0` | unified parser + plugin + presets |
+| `eslint-config-prettier` | `10.x` | turns off formatting rules (subpath `/flat`) |
+| `eslint-plugin-security` | `^3` | OWASP-style heuristics |
+| `eslint-plugin-no-secrets` | `^2.1` | high-entropy string detection |
+| `globals` | `17.6.0` | env global definitions |
+
+```bash
+pnpm add -D eslint @eslint/js typescript-eslint eslint-config-prettier \
+  eslint-plugin-security eslint-plugin-no-secrets globals
+```
+
+## Flat config
+
+```js
+// eslint.config.mjs
+import { defineConfig } from "eslint/config";
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+import security from "eslint-plugin-security";
+import noSecrets from "eslint-plugin-no-secrets";
+import prettier from "eslint-config-prettier/flat";
+
+export default defineConfig([
+  js.configs.recommended,
+  ...tseslint.configs.recommendedTypeChecked, // type-aware: no-floating-promises, etc.
+  security.configs.recommended,
+  { plugins: { "no-secrets": noSecrets }, rules: { "no-secrets/no-secrets": ["warn", { tolerance: 4.5 }] } },
+  {
+    languageOptions: {
+      parserOptions: {
+        projectService: true,                 // current type-info mechanism
+        tsconfigRootDir: import.meta.dirname,
+      },
+    },
+  },
+  { rules: { "security/detect-object-injection": "off" } }, // famously noisy
+  prettier, // MUST be last
+]);
+```
+
+## Gotchas
+
+- **`recommended` vs `recommendedTypeChecked`.** The type-checked preset is what enables the
+  genuinely valuable rules (`no-floating-promises`, `no-misused-promises`, `no-unsafe-*`) but
+  needs type info and is **much slower** — scope it to `**/*.ts`/`**/*.tsx` and disable on JS
+  config files with `tseslint.configs.disableTypeChecked`.
+- **`projectService: true`** replaces the old `project: "./tsconfig.json"`. It auto-finds the
+  nearest `tsconfig.json` per file and lints out-of-project files (like `eslint.config.mjs`)
+  without a `tsconfig.eslint.json`. Always pair it with `tsconfigRootDir: import.meta.dirname`.
+- **`tseslint.config()` is deprecated** in favour of core `defineConfig` from `eslint/config`
+  (a near-exact clone). The `tseslint.configs.*` presets are unchanged.
+- **Prettier last.** `eslint-config-prettier/flat` must come after every rule-defining config
+  so it can switch off conflicting stylistic rules.
+
+## CBP preset divergence
+
+CBP's `base` DB preset currently pins `eslint: ^9.0.0` / `typescript-eslint: ^8.0.0` and
+keeps several `@typescript-eslint/no-unsafe-*` rules at `warn`. The setup above reflects the
+**latest** (`eslint@10`); both are flat-config and interoperate. Bumping the preset to v10 is
+out of scope for the skill (no DB/preset changes) — adopt v10 per-repo when you regenerate.
+
+## Official docs
+
+- Configuration files: https://eslint.org/docs/latest/use/configure/configuration-files
+- Typed linting: https://typescript-eslint.io/getting-started/typed-linting/
+- `projectService`: https://typescript-eslint.io/blog/project-service/

package/templates/skills/cbp-setup-eslint/reference/cli.md

@@ -0,0 +1,56 @@
+# cli — Node CLI tool overrides
+
+For Node CLI packages with a `bin` (the CBP `codebyplan` package). Layers a small **override
+block** on top of [base](base.md) + [node](node.md). Maps to the CBP **`cli`** DB preset
+(`tech_match.requires_capabilities: ["cli-bin"]`).
+
+> **Verified 2026-05-31.** There is no "CLI" ESLint plugin — the convention is a scoped
+> rule-override block.
+
+## What it does
+
+A CLI legitimately (a) talks to the user via `console`, and (b) operates on user-supplied
+filesystem paths and dynamic keys — so the `eslint-plugin-security` heuristics that flag those
+produce noise, not findings. Relax them, **scoped narrowly** to the CLI surface.
+
+## Flat config (override block)
+
+```js
+// eslint.config.mjs — appended after base + node + security configs
+export default [
+  // ...base, node, security.configs.recommended, etc.
+  {
+    files: ["bin/**/*.{js,ts,mjs}", "src/cli/**/*.{js,ts}"],
+    rules: {
+      "no-console": "off", // console output IS the CLI's UI
+
+      // CLIs operate on user paths and dynamic keys by design:
+      "security/detect-non-literal-fs-filename": "off",
+      "security/detect-object-injection": "off",
+
+      // optional, if eslint-plugin-n is in use (CLIs call process.exit):
+      // "n/no-process-exit": "off",
+    },
+  },
+];
+```
+
+## Gotchas
+
+- **Scope via `files`** — do NOT disable these repo-wide; the same rules are valuable in
+  server/library code.
+- The two `security/*` lines require `eslint-plugin-security` to be installed and registered
+  (otherwise ESLint errors "rule not found"). If the project has no security plugin, only the
+  `no-console: "off"` line applies.
+
+## CBP preset divergence
+
+The CBP `cli` preset matches the rule set above exactly (`no-console`,
+`security/detect-non-literal-fs-filename`, `security/detect-object-injection` all off) and is
+capability-gated on `cli-bin`. The repo's own `packages/codebyplan-package/eslint.config.mjs`
+already applies this. No divergence — this doc just documents the convention.
+
+## Official docs
+
+- Convention (no upstream doc); rules: https://eslint.org/docs/latest/rules/no-console and
+  https://github.com/eslint-community/eslint-plugin-security

package/templates/skills/cbp-setup-eslint/reference/e2e.md

@@ -0,0 +1,68 @@
+# e2e — Playwright / WebdriverIO / Mocha test rules
+
+For end-to-end specs. Three runners appear across CBP repos: **Playwright** (web), **WebdriverIO**
+(Tauri desktop), and **Mocha** (the framework WDIO drives). Each is a **directory-scoped**
+override. Playwright maps to the CBP **`testing-e2e`** preset
+(`tech_match.requires: ["Playwright"]`); WebdriverIO + Mocha are **gap stacks — no preset**.
+
+> **Verified 2026-05-31.** Version traps: Playwright is **2.10.4** (not the 0.15.x search
+> sometimes returns); Mocha 11.x uses **`configs.recommended`** — NOT `configs.flat.recommended`.
+
+## Packages
+
+| Package | Latest | Flat key |
+| ------- | ------ | -------- |
+| `eslint-plugin-playwright` | `2.10.4` | `configs['flat/recommended']` |
+| `eslint-plugin-wdio` | `9.27.2` | `configs['flat/recommended']` |
+| `eslint-plugin-mocha` | `11.3.0` | `configs.recommended` (NOT `.flat`) |
+
+```bash
+pnpm add -D eslint-plugin-playwright   # web
+pnpm add -D eslint-plugin-wdio eslint-plugin-mocha   # Tauri / WebdriverIO desktop
+```
+
+## Flat config
+
+```js
+// eslint.config.mjs
+import playwright from "eslint-plugin-playwright";
+// desktop: import { configs as wdioConfigs } from "eslint-plugin-wdio";
+// desktop: import mocha from "eslint-plugin-mocha";
+
+export default [
+  // Playwright — scope to the web e2e dir
+  {
+    ...playwright.configs["flat/recommended"],
+    files: ["e2e/**", "**/*.e2e.{ts,js}"],
+    rules: { ...playwright.configs["flat/recommended"].rules, "no-console": "off" },
+  },
+
+  // WebdriverIO + Mocha (Tauri desktop) — scope to the wdio spec dir
+  // { ...wdioConfigs["flat/recommended"], files: ["test/**", "e2e/**"] },
+  // { ...mocha.configs.recommended, files: ["test/**/*.{ts,js}"] },
+];
+```
+
+## Gotchas
+
+- **Scope every e2e override via `files`** — Playwright/WDIO/Mocha rules false-positive on
+  unit tests, and Testing-Library rules false-positive on e2e specs.
+- **Mocha 11.x = `mocha.configs.recommended`** — `mocha.configs.flat.recommended` is
+  `undefined` in 11.x (it only exists on the unreleased 12.x main branch) and crashes config
+  load. Don't copy a `.flat.recommended` example.
+- **WebdriverIO**: `eslint-plugin-wdio@9` requires ESLint 9+; when `typescript-eslint` is
+  present its recommended config auto-swaps `wdio/await-expect` → `wdio/no-floating-promise`.
+- The CBP web app keeps Playwright specs in `e2e/**` with a Vitest sibling override for
+  `e2e/**/__tests__/**` — mirror that split if you co-locate unit tests under `e2e/`.
+
+## CBP preset divergence
+
+CBP's `testing-e2e` preset covers **Playwright only** (`eslint-plugin-playwright: ^2.0.0`,
+`no-console: off`). There is **no** preset for WebdriverIO or Mocha — the Tauri desktop e2e
+config is manual. The skill does not add presets for the gap runners.
+
+## Official docs
+
+- Playwright: https://github.com/mskelton/eslint-plugin-playwright
+- WebdriverIO: https://github.com/webdriverio/webdriverio/tree/main/packages/eslint-plugin-wdio
+- Mocha: https://github.com/lo1tuma/eslint-plugin-mocha

package/templates/skills/cbp-setup-eslint/reference/jest.md

@@ -0,0 +1,59 @@
+# jest — Jest test-file rules
+
+For apps that test with Jest (CBP `apps/backend` NestJS specs, `livebyplan` Expo). **Gap
+stack — no CBP DB preset** (the `testing` preset is Vitest-only). Layers a test-scoped
+override on top of [base](base.md).
+
+> **Verified 2026-05-31.** `eslint-plugin-jest` uses the **bracketed** flat-config keys
+> `configs['flat/recommended']` / `['flat/style']` (the un-prefixed keys are legacy eslintrc).
+
+## Packages
+
+| Package | Latest | Purpose |
+| ------- | ------ | ------- |
+| `eslint-plugin-jest` | `29.15.2` | Jest rules |
+
+```bash
+pnpm add -D eslint-plugin-jest
+```
+
+Peers: `eslint ^8.57 || ^9 || ^10`, `@typescript-eslint/eslint-plugin ^8`, `jest`.
+
+## Flat config
+
+```js
+// eslint.config.mjs
+import jest from "eslint-plugin-jest";
+
+export default [
+  {
+    files: ["**/*.{test,spec}.{ts,tsx,js,jsx}", "**/__tests__/**/*.{ts,tsx,js,jsx}"],
+    ...jest.configs["flat/recommended"],
+    rules: {
+      ...jest.configs["flat/recommended"].rules,
+      ...jest.configs["flat/style"].rules, // optional stylistic rules
+      // type-aware: hand the unbound-method check to the jest-aware version
+      "@typescript-eslint/unbound-method": "off",
+      "jest/unbound-method": "error",
+    },
+  },
+];
+```
+
+## Gotchas
+
+- Keys are **`configs['flat/recommended']`** / **`['flat/style']`** (bracketed) — the
+  unprefixed `configs.recommended` is the legacy eslintrc preset.
+- **`jest/unbound-method`** extends `@typescript-eslint/unbound-method`; turn the base rule
+  off on test files and enable the jest version (needs `@typescript-eslint/parser` + type
+  info). Type-aware jest rules safely no-op when type info is absent.
+- Avoid pinning `flat/all` long-term — it enables every rule and can break on minor releases.
+
+## CBP preset divergence
+
+There is **no** CBP `testing-jest` preset. NestJS/Expo Jest specs are currently linted only by
+the base rules. Add the override above per-repo; the skill does not add a preset.
+
+## Official docs
+
+- eslint-plugin-jest: https://github.com/jest-community/eslint-plugin-jest

package/templates/skills/cbp-setup-eslint/reference/nestjs.md

@@ -0,0 +1,69 @@
+# nestjs — NestJS back-end flat config
+
+For NestJS apps (the CBP `apps/backend`). **Gap stack — no CBP DB preset.** Use this doc to
+hand-author `eslint.config.mjs`; the `base` + `node` presets cover most of it, but the
+official Nest starter has a specific shape worth matching.
+
+> **Verified 2026-05-31.** There is **no first-party NestJS ESLint plugin** — the official
+> `nest new` starter uses plain type-checked `typescript-eslint` + Prettier.
+
+## Packages
+
+| Package | Latest | Purpose |
+| ------- | ------ | ------- |
+| `typescript-eslint` | `8.60.0` | parser + type-checked preset |
+| `@eslint/js` | `10.0.1` | `eslint.configs.recommended` |
+| `eslint-plugin-prettier` | `^5` | `/recommended` subpath |
+| `globals` | `17.6.0` | `globals.node`, `globals.jest` |
+
+```bash
+pnpm add -D typescript-eslint @eslint/js eslint-plugin-prettier eslint-config-prettier globals
+```
+
+## Flat config (official `nest new` starter, verbatim)
+
+```js
+// @ts-check
+import eslint from "@eslint/js";
+import eslintPluginPrettierRecommended from "eslint-plugin-prettier/recommended";
+import globals from "globals";
+import tseslint from "typescript-eslint";
+
+export default tseslint.config(
+  { ignores: ["eslint.config.mjs"] },
+  eslint.configs.recommended,
+  ...tseslint.configs.recommendedTypeChecked,
+  eslintPluginPrettierRecommended,
+  {
+    languageOptions: {
+      globals: { ...globals.node, ...globals.jest },
+      sourceType: "commonjs", // "module" for an ESM Nest app
+      parserOptions: { projectService: true, tsconfigRootDir: import.meta.dirname },
+    },
+  },
+  {
+    rules: {
+      "@typescript-eslint/no-explicit-any": "off",
+      "@typescript-eslint/no-floating-promises": "warn",
+      "@typescript-eslint/no-unsafe-argument": "warn",
+      "prettier/prettier": ["error", { endOfLine: "auto" }],
+    },
+  },
+);
+```
+
+## Gotchas
+
+- Nest relaxes three type-checked rules (`no-explicit-any` off; `no-floating-promises` and
+  `no-unsafe-argument` to `warn`) because its DI/decorator patterns trip them. Keep these.
+- `{ ignores: ["eslint.config.mjs"] }` keeps type-aware linting off the config file itself.
+- `sourceType: "commonjs"` matches Nest's default CJS build — flip to `"module"` for ESM.
+- The starter still uses `tseslint.config(...)`; you may swap it for `defineConfig` from
+  `eslint/config` (deprecation note in [base.md](base.md)) — the presets are identical.
+- Optional community add-on: `@darraghor/eslint-plugin-nestjs-typed` adds
+  decorator/Swagger/DTO-aware rules. Not part of the official starter.
+- Nest tests use **Jest** — add the [jest.md](jest.md) override scoped to `**/*.spec.ts`.
+
+## Official docs
+
+- Starter config: https://github.com/nestjs/typescript-starter/blob/master/eslint.config.mjs

package/templates/skills/cbp-setup-eslint/reference/nextjs.md

@@ -0,0 +1,63 @@
+# nextjs — Next.js (App Router) flat config
+
+For Next.js apps. Layers on top of [base](base.md). Maps to the CBP **`nextjs`** DB preset
+(`tech_match.requires: ["Next.js"]`, `requires_capabilities: ["jsx"]`).
+
+> **Verified 2026-05-31.** As of **Next.js 16**, `eslint-config-next` ships **native flat
+> config**, `next lint` is **removed** (run `eslint .` directly), and the `eslint` key in
+> `next.config.js` is gone. No `FlatCompat` shim is needed.
+
+## Packages
+
+| Package | Latest | Purpose |
+| ------- | ------ | ------- |
+| `eslint-config-next` | `16.2.6` | bundles `@next/eslint-plugin-next` + react/react-hooks/import |
+
+```bash
+pnpm add -D eslint-config-next
+```
+
+## Flat config
+
+`eslint-config-next` exposes spreadable **array** subpath exports:
+
+```js
+// eslint.config.mjs
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextVitals from "eslint-config-next/core-web-vitals";
+import nextTs from "eslint-config-next/typescript";
+
+export default defineConfig([
+  ...nextVitals, // base + Core-Web-Vitals rules promoted warn→error
+  ...nextTs,     // typescript-eslint rules (based on @typescript-eslint/recommended)
+  globalIgnores([".next/**", "out/**", "build/**", "next-env.d.ts"]),
+]);
+```
+
+Subpath exports:
+- `eslint-config-next` — base (Next + react + react-hooks recommended).
+- `eslint-config-next/core-web-vitals` — base + CWV rules at error (**recommended default**).
+- `eslint-config-next/typescript` — adds typescript-eslint rules; spread alongside a base.
+
+## Gotchas
+
+- **`globalIgnores([...])` is required** when you spread the config — re-assert the default
+  ignores (`.next/`, etc.) per the official docs example.
+- **Monorepo**: point the plugin at the app with `settings: { next: { rootDir: "apps/web" } }`
+  (path, glob, or array).
+- **Prettier**: add `import prettier from "eslint-config-prettier/flat"` last.
+- `next lint` removal landed in Next 16.0.0 — old `.eslintrc.json` configs should migrate to
+  `eslint.config.mjs` (a codemod exists).
+
+## CBP preset divergence
+
+CBP's `nextjs` preset pins `eslint-config-next: ^15.0.0` and registers
+`eslint-plugin-react-compiler` explicitly (see [react.md](react.md) — that plugin is now
+**superseded**). The repo's own `apps/web/eslint.config.mjs` already uses the
+`createRequire` + `eslint-config-next/core-web-vitals` + `eslint-config-next/typescript`
+pattern. Adopt the native spread form above when regenerating; presets are not changed by
+this skill.
+
+## Official docs
+
+- ESLint config: https://nextjs.org/docs/app/api-reference/config/eslint

package/templates/skills/cbp-setup-eslint/reference/node.md

@@ -0,0 +1,74 @@
+# node — Node/TypeScript service (Hono, Express, plain Node) flat config
+
+For Node back-end services and server-side packages (the CBP MCP server uses Hono; any
+`node-server` capability). Layers on [base](base.md). Maps to the CBP **`node`** DB preset
+(`tech_match.requires: ["Node.js"]`, `requires_capabilities: ["node-server"]`).
+
+> **Verified 2026-05-31.** The valuable async-safety rules (`no-floating-promises`,
+> `no-misused-promises`) are **typescript-eslint** rules that need type info — they come from
+> `recommendedTypeChecked`, not from a node plugin.
+
+## Packages
+
+| Package | Latest | Purpose |
+| ------- | ------ | ------- |
+| `globals` | `17.6.0` | `globals.node` |
+| `typescript-eslint` | `8.60.0` | type-aware promise rules |
+| `eslint-plugin-n` | `18.0.1` | **optional** — unsupported-Node-API / import / engines checks |
+
+```bash
+pnpm add -D globals typescript-eslint
+# optional (libraries / dual ESM-CJS packages):
+pnpm add -D eslint-plugin-n
+```
+
+## Flat config
+
+```js
+// eslint.config.mjs
+import { defineConfig } from "eslint/config";
+import js from "@eslint/js";
+import tseslint from "typescript-eslint";
+import globals from "globals";
+// optional: import n from "eslint-plugin-n";
+
+export default defineConfig([
+  js.configs.recommended,
+  ...tseslint.configs.recommendedTypeChecked, // enables the promise rules below
+  {
+    files: ["**/*.{ts,mts,cts}"],
+    languageOptions: {
+      globals: globals.node,
+      sourceType: "module", // "commonjs" for a CJS service
+      parserOptions: { projectService: true, tsconfigRootDir: import.meta.dirname },
+    },
+    rules: {
+      "@typescript-eslint/no-floating-promises": "error",
+      "@typescript-eslint/no-misused-promises": "error",
+    },
+  },
+  // optional eslint-plugin-n:
+  // { files: ["**/*.{ts,mts,cts}"], plugins: { n }, extends: ["n/recommended-module"] },
+]);
+```
+
+## Gotchas
+
+- **`eslint-plugin-n` is optional.** For a pure internal TS service you can skip it — its main
+  value is catching unsupported Node APIs, missing imports, and `package.json#engines` issues
+  in **libraries** and dual ESM/CJS packages. Pick the right preset: `n/recommended-module`
+  (ESM), `n/recommended-script` (CJS), `n/recommended` (mixed).
+- The promise rules **require** a type-checked config + `projectService` — they silently do
+  nothing without type info.
+- A CJS service uses `sourceType: "commonjs"`; an ESM service uses `"module"`.
+
+## CBP preset divergence
+
+CBP's `node` preset ships only the two `@typescript-eslint` promise rules at `error` (no
+`eslint-plugin-n`). The repo's MCP server / CLI configs follow this minimal shape. Add
+`eslint-plugin-n` per-repo if you publish a library; the skill does not modify the preset.
+
+## Official docs
+
+- eslint-plugin-n: https://github.com/eslint-community/eslint-plugin-n
+- no-floating-promises: https://typescript-eslint.io/rules/no-floating-promises/