codebyplan 1.13.65 → 1.13.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebyplan",
-  "version": "1.13.65",
+  "version": "1.13.66",
   "description": "CLI for CodeByPlan — AI-powered development planning and tracking",
   "type": "module",
   "bin": {
@@ -52,18 +52,17 @@
     "registry": "https://registry.npmjs.org/"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "dependencies": {
     "@napi-rs/keyring": "^1.1.6",
-    "@supabase/supabase-js": "^2.106.0",
-    "ws": ">=8.20.1"
+    "@supabase/supabase-js": "^2.106.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.18.0",
-    "@types/node": "^20",
+    "@types/node": "^22",
     "@vitest/eslint-plugin": "^1.1.44",
-    "esbuild": ">=0.28.1",
+    "esbuild": "^0.28.1",
     "eslint": "^9.18.0",
     "eslint-config-prettier": "^10.0.1",
     "eslint-plugin-no-secrets": "^2.2.1",

package/templates/agents/cbp-security-agent.md

@@ -1,5 +1,4 @@
 ---
-scope: org-shared
 name: cbp-security-agent
 description: Security review specialist. Checks for OWASP top 10 vulnerabilities, hardcoded secrets, SQL injection, XSS, CSRF, and dependency vulnerabilities.
 tools: Read, Glob, Grep, Bash

package/templates/agents/cbp-stripe-agent.md

@@ -1,5 +1,4 @@
 ---
-scope: org-shared
 name: cbp-stripe-agent
 description: Stripe integration specialist. Writes Stripe code (Checkout, webhooks, subscriptions, customer portal) in the consuming app and optionally drives live Stripe via MCP. Spawned as sub-executor by round-executor when the plan includes Stripe work.
 tools: Read, Write, Edit, Glob, Grep, Bash, AskUserQuestion

package/templates/agents/cbp-testing-qa-agent.md

@@ -1,5 +1,4 @@
 ---
-scope: org-shared
 name: cbp-testing-qa-agent
 description: Combined testing, QA generation, and default checklists. Runs build/lint/types/unit-tests/audit, generates auto QA items, applies default production checklists. Does NOT consume e2e screenshots or frontend-ui findings.
 tools: Read, Glob, Grep, Bash, AskUserQuestion

package/templates/hooks/cbp-skill-context-guard.sh

@@ -1,5 +1,4 @@
 #!/bin/bash
-# @scope: org-shared
 # Hook: PreToolUse (Skill)
 # Purpose: Deny heavy close-out skills when context window exceeds the model-aware threshold:
 #          200K tokens for standard models (CBP_CONTEXT_WARN_TOKENS, default 200000);

package/templates/hooks/validate-structure-lib.sh

@@ -103,17 +103,44 @@ has_scope_comment() {
 }
 
 # has_template_twin <rel_path_under_claude>
-# Returns 0 when the codebyplan package ships a template twin for this .claude file
-# (i.e. the file is package-MANAGED — org-shared is its implicit default and a
-# scope marker is NOT required). <rel_path_under_claude> is the path beneath
-# .claude/ (e.g. "rules/foo.md", "skills/x/SKILL.md").
-#   Monorepo: $REPO_ROOT/packages/codebyplan-package/templates/<rel>
-#   Consumer: $REPO_ROOT/node_modules/codebyplan/templates/<rel>
-# Returns non-zero when no twin is found — including when no templates dir is
-# resolvable at all. Callers treat a non-zero result as "user-created", which is
-# the conservative fallback: a scope marker is then required (legacy behavior).
+# Returns 0 when the file is package-MANAGED (a template twin exists) — org-shared
+# is its implicit default and a scope marker is NOT required. <rel_path_under_claude>
+# is the path beneath .claude/ (e.g. "rules/foo.md", "skills/x/SKILL.md").
+#
+# Resolution order:
+#   1. The install manifest (.claude/.cbp.manifest.json, with mid/legacy filename
+#      fallback). Its files[].dest entries are the authoritative record of what
+#      codebyplan installed INTO THIS repo — independent of where the package
+#      lives on disk (pnpm symlinks, hoisting, monorepo sub-packages). Requires jq.
+#   2. Filesystem probe of the package's templates dir — fallback when there is no
+#      manifest/jq, and a backstop so a stale manifest never hides a genuine twin:
+#        Monorepo: $REPO_ROOT/packages/codebyplan-package/templates/<rel>
+#        Consumer: $REPO_ROOT/node_modules/codebyplan/templates/<rel>
+# Returns non-zero when no twin is found by either path. Callers treat non-zero as
+# "user-created": a scope marker is then required (the conservative fallback).
 has_template_twin() {
   local rel="$1"
+
+  # 1. Authoritative: the install manifest lists every managed file by dest path.
+  if command -v jq >/dev/null 2>&1; then
+    local manifest
+    for manifest in \
+      "$REPO_ROOT/.claude/.cbp.manifest.json" \
+      "$REPO_ROOT/.claude/.cbp-claude.manifest.json" \
+      "$REPO_ROOT/.claude/.codebyplan-claude.manifest.json"; do
+      if [ -f "$manifest" ]; then
+        if jq -e --arg rel "$rel" 'any(.files[]?; .dest == $rel)' "$manifest" >/dev/null 2>&1; then
+          return 0
+        fi
+        # Manifest found but does not list this file — stop scanning older
+        # manifest names and fall through to the filesystem probe (a stale
+        # manifest must not hide a genuine template twin).
+        break
+      fi
+    done
+  fi
+
+  # 2. Fallback / backstop: probe the package's templates dir directly.
   [ -f "$REPO_ROOT/packages/codebyplan-package/templates/$rel" ] && return 0
   [ -f "$REPO_ROOT/node_modules/codebyplan/templates/$rel" ] && return 0
   return 1

package/templates/skills/cbp-checkpoint-check/SKILL.md

@@ -1,5 +1,4 @@
 ---
-scope: org-shared
 name: cbp-checkpoint-check
 description: Full re-evaluation of a checkpoint with before/after comparison
 argument-hint: [CHK-NNN]

package/templates/skills/cbp-clear-continue/SKILL.md

@@ -1,5 +1,4 @@
 ---
-scope: org-shared
 name: cbp-clear-continue
 description: Resume work after /clear by reading .codebyplan/clear/handoff.md and re-invoking the previously-blocked heavy skill. Reports a friendly error if no handoff file exists.
 model: inherit

package/templates/skills/cbp-clear-prep/SKILL.md

@@ -1,5 +1,4 @@
 ---
-scope: org-shared
 name: cbp-clear-prep
 description: Capture a clear-context handoff when the context window is too large to run a heavy skill. Reads active task/round state, writes .codebyplan/clear/handoff.md, then instructs the user to run /clear and /cbp-clear-continue to resume.
 argument-hint: "[blocked-skill]"

package/templates/skills/cbp-setup-cd/SKILL.md

@@ -1,5 +1,4 @@
 ---
-scope: org-shared
 name: cbp-setup-cd
 description: Detect configured CD surfaces, write/update .codebyplan/cd.json via `codebyplan cd init`, scaffold publish.yml and release-desktop.yml GitHub Actions workflows, and walk through environment/approval/OIDC setup. Interactive, idempotent.
 argument-hint: "[--force]"

package/templates/skills/cbp-setup-ci/SKILL.md

@@ -1,5 +1,4 @@
 ---
-scope: org-shared
 name: cbp-setup-ci
 description: Detect CI platforms, write/update .codebyplan/ci.json, scaffold the GitHub Actions CI workflow, and enforce the required CI status check on the main branch. Interactive, idempotent.
 argument-hint: "[--force]"

package/templates/skills/cbp-stripe/SKILL.md

@@ -1,5 +1,4 @@
 ---
-scope: org-shared
 name: cbp-stripe
 description: "Stripe integration guidance — load when implementing or reviewing payments, Checkout, subscriptions/billing, webhooks, Connect, Tax, or Treasury. Encodes the API-selection routing table, the no-payment_method_types rule, restricted-key security, and Stripe SDK conventions."
 model: inherit