codebyplan 1.5.1 → 1.9.0

package/templates/skills/cbp-ship/templates/vscodeignore

@@ -0,0 +1,21 @@
+.vscode/**
+.vscode-test/**
+src/**
+.gitignore
+.yarnrc
+vsc-extension-quickstart.md
+**/tsconfig.json
+**/.eslintrc.*
+**/eslint.config.*
+**/*.map
+**/*.ts
+node_modules
+.git/**
+*.test.*
+*.spec.*
+**/__tests__/**
+**/__mocks__/**
+.github/**
+.claude/**
+docs/**
+CHANGELOG.md

package/templates/skills/cbp-ship/templates/workflow-changesets.yml

@@ -0,0 +1,41 @@
+name: changesets
+
+on:
+  push:
+    branches:
+      - REPLACE_WITH_INTEGRATION_BRANCH
+
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - run: pnpm install --frozen-lockfile
+
+      - uses: changesets/action@v1
+        with:
+          version: pnpm changeset version
+          publish: pnpm changeset publish
+          commit: 'chore(release): version packages'
+          title: 'chore(release): version packages'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'

package/templates/skills/cbp-ship/templates/workflow-eas-submit.yml

@@ -0,0 +1,53 @@
+name: EAS Build + Submit
+
+on:
+  push:
+    tags:
+      - 'mobile-v*.*.*'
+  workflow_dispatch:
+    inputs:
+      profile:
+        type: choice
+        description: Build profile
+        options: [preview, production]
+        default: preview
+      platform:
+        type: choice
+        description: Platform
+        options: [all, ios, android]
+        default: all
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - uses: expo/expo-github-action@v8
+        with:
+          eas-version: latest
+          token: ${{ secrets.EXPO_TOKEN }}
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: EAS Build
+        run: |
+          cd apps/mobile
+          eas build --profile ${{ inputs.profile || 'preview' }} \
+                    --platform ${{ inputs.platform || 'all' }} \
+                    --non-interactive --no-wait
+
+      - name: EAS Submit (production only)
+        if: inputs.profile == 'production'
+        run: |
+          cd apps/mobile
+          eas submit --platform ${{ inputs.platform || 'all' }} --latest --non-interactive

package/templates/skills/cbp-ship/templates/workflow-npm-publish.yml

@@ -0,0 +1,36 @@
+name: npm publish
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write  # required for OIDC trusted publishing
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+      - run: pnpm publint
+      - run: pnpm attw --pack
+      - run: npm publish --provenance --access public

package/templates/skills/cbp-ship/templates/workflow-release-please.yml

@@ -0,0 +1,21 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - REPLACE_WITH_INTEGRATION_BRANCH
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          release-type: node
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

package/templates/skills/cbp-ship/templates/workflow-tauri-release.yml

@@ -0,0 +1,69 @@
+name: Release Desktop App
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+jobs:
+  release:
+    permissions:
+      contents: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: macos-14   # Apple Silicon
+            target: aarch64-apple-darwin
+          - platform: macos-13   # Intel
+            target: x86_64-apple-darwin
+
+    runs-on: ${{ matrix.platform }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          workspaces: apps/desktop/src-tauri
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Write Apple API key to file
+        run: |
+          mkdir -p ~/private_keys
+          echo "$APPLE_API_KEY_CONTENT" > ~/private_keys/AuthKey.p8
+        env:
+          APPLE_API_KEY_CONTENT: ${{ secrets.APPLE_API_KEY_CONTENT }}
+
+      - uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_PATH: ~/private_keys/AuthKey.p8
+        with:
+          projectPath: apps/desktop
+          tagName: ${{ github.ref_name }}
+          releaseName: 'REPLACE_WITH_APP_NAME ${{ github.ref_name }}'
+          releaseDraft: false
+          prerelease: false
+          args: --target ${{ matrix.target }}

package/templates/skills/cbp-ship/templates/workflow-vsce-publish.yml

@@ -0,0 +1,31 @@
+name: VS Code Marketplace publish
+
+on:
+  push:
+    tags:
+      - 'vscode-v*.*.*'
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v3
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter REPLACE_WITH_EXT_NAME build
+      - name: Publish to Marketplace
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: |
+          cd apps/vscode
+          npx @vscode/vsce publish --no-yarn

package/templates/skills/cbp-ship-configure/SKILL.md

@@ -0,0 +1,296 @@
+---
+scope: org-shared
+name: cbp-ship-configure
+description: Configure shipment for one or more surfaces in the current repo — Vercel link, EAS project + eas.json scaffold, Apple credentials probe, npm publish auth check (including `codebyplan` asset-publish automation via release-please), Railway project link, Supabase access token verify; Supabase GitHub branching integration via /cbp-supabase-setup. Interactive step-by-step; never stores credentials in the repo.
+argument-hint: [--surface=<id>]
+allowed-tools: Read, Write, Edit, Bash(which *), Bash(vercel *), Bash(eas *), Bash(npm *), Bash(railway *), Bash(jq *), Bash(mkdir *), Bash(cp *), Bash(echo *), Skill(cbp-supabase-setup)
+effort: xhigh
+---
+
+# Ship Configure Command
+
+Set up shipment for a surface so `/cbp-ship` can deploy it. Each surface is configured independently — runs once per repo per surface, persists in `.codebyplan/shipment.json` `surfaces.{id}`, then never asks again unless re-invoked.
+
+## When to Use
+
+- First-time shipment setup for a fresh repo
+- Adding a new surface to an existing repo (e.g., adding mobile to a web-only project)
+- Auto-suggested by `/cbp-ship` when it detects a surface that's not configured
+- Rotating credentials (re-runs the credential check, doesn't store anything)
+
+## Arguments
+
+`$ARGUMENTS`:
+
+- `--surface=<id>` — configure one surface. Valid: `vercel-web`, `expo-mobile`, `tauri-desktop`, `npm-package`, `vscode-ext`, `railway-backend`, `supabase`
+- No args — interactive picker; lists undetected/unconfigured surfaces and asks which to set up
+
+## Instructions
+
+### Step 1 — Pick the surface
+
+If `--surface=<id>` is set, use it. Otherwise:
+
+```bash
+bash "${CLAUDE_SKILL_DIR}/../ship/scripts/detect-surfaces.sh"
+```
+
+Show the detection result and ask which to configure via AskUserQuestion (multi-select allowed).
+
+### Step 2 — Load the surface configurator
+
+For each chosen surface, read its configurator block from this skill's reference. Each block has the same shape:
+
+1. **Prerequisites** — what the user must have before starting (e.g., Apple Developer account, Vercel team)
+2. **Probe** — non-destructive checks (CLI installed, credential reachable, account permissions)
+3. **Setup** — the interactive walkthrough
+4. **Persist** — write to `.codebyplan/shipment.json` `surfaces.{id}`
+5. **Verify** — final check that the surface is now ready for `/cbp-ship` to use
+
+References:
+
+| Surface         | Reference                                                    |
+| --------------- | ------------------------------------------------------------ |
+| vercel-web      | [reference/vercel.md](reference/vercel.md)                   |
+| expo-mobile     | [reference/expo-mobile.md](reference/expo-mobile.md)         |
+| tauri-desktop   | [reference/tauri-desktop.md](reference/tauri-desktop.md)     |
+| npm-package     | [reference/npm-package.md](reference/npm-package.md)         |
+| vscode-ext      | [reference/vscode-ext.md](reference/vscode-ext.md)           |
+| railway-backend | [reference/railway-backend.md](reference/railway-backend.md) |
+| supabase        | [reference/supabase.md](reference/supabase.md)               |
+
+**Supabase — branching integration** (run AFTER Step 5 — Verify completes for the
+supabase surface; do NOT invoke during Steps 1–4): once Step 5 has finished and
+`shipment.surfaces.supabase` is persisted, run
+`jq '.shipment.surfaces.supabase.branching_configured // empty' .codebyplan.json`.
+If empty, invoke `/cbp-supabase-setup` (GitHub integration, required-status-check,
+persistent branch). Delegate fully — do NOT duplicate steps inline. If already set,
+note as already-done in the Step 6 report.
+
+### Step 3 — Walk the user through setup, step by step
+
+This skill NEVER dumps "here's a 200-line guide, follow it." Every step is one-at-a-time, interactive:
+
+```
+Step 1/6: Check Vercel CLI is installed
+[runs: which vercel]
+✓ vercel 35.0.1 found at /usr/local/bin/vercel
+
+Step 2/6: Check you're logged in
+[runs: vercel whoami]
+✓ Logged in as midevyou
+
+Step 3/6: Link this repo to a Vercel project
+You'll run: vercel link
+This creates .vercel/project.json. Choose: existing project / create new.
+
+Press Enter when ready to run, or type 'skip' to do it yourself.
+```
+
+For commands the user must run (vsce login, npm login, eas login, supabase login — any 2FA/OTP flow), display the command and wait for the user to run it themselves, then verify by re-probing. Never run interactive auth commands via Bash.
+
+For commands that are safe to run on the user's behalf (CLI version checks, file scaffolding, JSON read/write), run them directly with the user's pre-confirmation.
+
+### Step 4 — Persist what was configured
+
+Write to `.codebyplan/shipment.json` (create the file if missing):
+
+```json
+{
+  "surfaces": {
+    "vercel-web": {
+      "configured_at": "2026-04-29T14:32:00Z",
+      "project_id": "prj_abc123",
+      "team_id": "team_xyz789",
+      "framework": "nextjs",
+      "production_branch": "main"
+    }
+  }
+}
+```
+
+The block contains references and IDs only — NO credentials, tokens, or secrets. Credentials live in:
+
+- Vercel: `~/.local/share/com.vercel.cli/auth.json` (CLI session)
+- npm: `~/.npmrc` (auth token) or 2FA per-publish
+- EAS: `~/.expo/state.json` (CLI session)
+- Apple: Keychain + ASC API key files
+- Supabase: `~/.supabase/access-token` (CLI session)
+- Railway: `~/.railway/config.json` (CLI session)
+- vsce (VS Code): `~/.vscode/.vsce` (PAT)
+
+The skill's job is to verify these credentials EXIST and are valid; never to store or copy them.
+
+### Step 5 — Verify shipment-readiness
+
+Run the verification step from the surface reference. For Vercel, this is:
+
+```bash
+vercel inspect "$(jq -r '.surfaces."vercel-web".project_id' .codebyplan/shipment.json)" 2>&1 | head -20
+```
+
+If verification passes, mark the surface as configured. If it fails, surface the error and offer to retry the failing step.
+
+### Step 6 — Report
+
+```
+## Surface configured: vercel-web
+
+Project: codebyplan-web (prj_abc123)
+Team: midevy-eu (team_xyz789)
+Framework: Next.js
+Production branch: main
+
+Saved to .codebyplan/shipment.json: surfaces.vercel-web
+
+Ready for /cbp-ship.
+```
+
+If multiple surfaces were configured, list each one's status. If any failed, list those at the end with the next-step prompt.
+
+## Re-run safety
+
+Re-running on an already-configured surface re-runs the probe (CLI installed? logged in? token still valid?) and refreshes the `.codebyplan/shipment.json` block. It does NOT replace credentials — those stay where the CLI keeps them. This is the primary path for "I rotated my npm token, does shipment still work?" — re-run, the probe catches the bad token immediately.
+
+## Special case: opt-in to release-please
+
+`release-please` is one of three versioning modes (manual, release-please, changesets). Opt-in is part of npm-package configure:
+
+```
+Step N/M: Versioning mode
+A) Manual — bump package.json version yourself before /cbp-ship
+B) release-please — GH Action opens version-bump PRs based on conventional commits (recommended for npm packages)
+C) changesets — manual changeset entries; tooling aggregates into version PRs (recommended for monorepos with many published packages)
+```
+
+If B or C, the skill scaffolds the GitHub Actions workflow + config file (`templates/workflows/release-please.yml` or `.changeset/config.json`).
+
+## Special case: `codebyplan` asset-publish automation
+
+The canonical-owner repo publishes the `codebyplan` npm package — the distribution mechanism for `scope: org-shared` skills/agents/hooks (via its `claude install|update|uninstall` subcommand group). Sibling repos consume it via `npx codebyplan claude update` (the merged CLI; package path `packages/codebyplan-package/`). This branch handles the once-per-repo setup so release-please can autopublish on merge to main. (CHK-132 consolidated the prior standalone `@codebyplan/claude` package into `codebyplan`; the legacy `@codebyplan/claude` package on npm stays un-deprecated at its last published version for backward-compat, but receives no further updates.)
+
+When the user picks `--surface=npm-package` AND the detected package is `packages/codebyplan-package`, the walkthrough runs these extra probes / scaffolds in addition to the standard npm-package configurator (see [reference/npm-package.md](reference/npm-package.md)):
+
+### Probe 1 — npm whoami
+
+```bash
+npm whoami 2>&1 || echo "RUN: npm login (need: https://www.npmjs.com/login)"
+```
+
+If 401 / not logged in, STOP and surface the login URL. Re-run after the user logs in.
+
+### Probe 2 — @codebyplan scope membership
+
+```bash
+npm access list packages @codebyplan 2>&1 | head -20
+```
+
+Confirms the logged-in account has read on the `@codebyplan` org scope. If 404 / no access:
+
+- Either the user does not belong to the `@codebyplan` org → STOP, request invitation from org owner
+- Or the scope is unclaimed → user creates the org at https://www.npmjs.com/org/create (org name `codebyplan`, free public-packages tier)
+
+### Scaffold 1 — release-please workflow
+
+If `.github/workflows/release-please.yml` is absent:
+
+```bash
+mkdir -p .github/workflows
+cp "${CLAUDE_SKILL_DIR}/../ship/templates/workflow-release-please.yml" .github/workflows/release-please.yml
+# Then replace REPLACE_WITH_INTEGRATION_BRANCH with the production branch from .codebyplan/git.json branch_config.production (typically `main`)
+```
+
+The mechanics + commit-prefix → bump-tier mapping live in [../ship/reference/release-please-overview.md](../ship/reference/release-please-overview.md).
+
+### Scaffold 2 — release-please-config.json at repo root
+
+If `release-please-config.json` is absent:
+
+```bash
+cp "${CLAUDE_SKILL_DIR}/../ship/templates/release-please-config.json" release-please-config.json
+# Then replace REPLACE_WITH_PACKAGE_NAME with codebyplan
+# Confirm `packages."."` block is replaced with `packages."packages/codebyplan-package"`
+```
+
+### Scaffold 3 — .release-please-manifest.json at repo root
+
+If `.release-please-manifest.json` is absent:
+
+```bash
+VERSION=$(jq -r '.version' packages/codebyplan-package/package.json)
+echo "{\"packages/codebyplan-package\": \"${VERSION}\"}" > .release-please-manifest.json
+```
+
+(Bootstrap version reads from `packages/codebyplan-package/package.json` `version` field at scaffold time.)
+
+### Verify — publishConfig.access on the package
+
+```bash
+jq -r '.publishConfig.access // "missing"' packages/codebyplan-package/package.json
+```
+
+Required value: `public`. If `missing` or `restricted`, instruct the user to add:
+
+```json
+{
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}
+```
+
+### Persist
+
+```json
+{
+  "surfaces": {
+    "npm-package": {
+      "packages/codebyplan-package": {
+        "package_name": "codebyplan",
+        "bin_name": "codebyplan",
+        "versioning": "release-please",
+        "publish_mode": "release-please-on-merge-to-main",
+        "access": "public"
+      }
+    }
+  }
+}
+```
+
+After this branch completes, every merge to main with `feat:` / `fix:` / `feat!:` Conventional Commits will trigger release-please to open a version-bump PR. When the maintainer merges that PR, release-please tags the release and `npm publish` runs from the workflow (auth via `NODE_AUTH_TOKEN` GH secret or OIDC trusted publishing — see [../ship/reference/npm-publish-oidc-trusted.md](../ship/reference/npm-publish-oidc-trusted.md)). Siblings then pick up the new asset content via `npx codebyplan claude update`.
+
+## Special case: Apple credentials for TestFlight
+
+Apple credential setup is by far the most error-prone step. The reference lays out:
+
+1. Apple Developer Program enrollment ($99/yr) — user-side, link only
+2. App Store Connect API key creation — user-side, walk-through
+3. Local p8 file storage — user does, skill verifies path
+4. Tauri-style p12 + signing identity — only needed if also configuring tauri-desktop
+5. EAS credentials sync — `eas credentials` walkthrough
+
+The configurator confirms each piece is reachable; it never stores them. See [reference/expo-mobile.md](reference/expo-mobile.md) and [reference/tauri-desktop.md](reference/tauri-desktop.md).
+
+## Key Rules
+
+- **Step-by-step always** — never paste a 200-line "do all of this" block; one step, wait for confirmation, next
+- **Run safe commands directly, instruct unsafe ones** — version checks and JSON edits run via Bash; auth commands and 2FA flows are user-run
+- **Never store credentials in `.codebyplan/repo.json`** — only IDs, project refs, branch names
+- **Re-running is idempotent** — re-runs refresh the probe + persist block, never overwrite credentials
+- **One surface per invocation when via `--surface`** — multi-select picker for the no-args path
+- **Verify at the end** — final probe must succeed before marking configured
+
+## Additional resources
+
+- Per-surface configurators: [reference/](reference/) — one file per surface
+- GH Actions workflow templates: [scripts/](scripts/) — scaffolded into `.github/workflows/` when versioning mode is opt-in
+- Detection script (shared with `/cbp-ship`): `${CLAUDE_PLUGIN_ROOT}/skills/ship/scripts/detect-surfaces.sh`
+
+## Integration
+
+- **Triggered by**: user invocation; auto-suggested by `/cbp-ship` when an unconfigured surface is detected
+- **Reads**: `.codebyplan/shipment.json`, repo filesystem (vercel.json, eas.json, supabase/, etc.), CLI session state via probe commands
+- **Writes**: `.codebyplan/shipment.json` `surfaces.{id}`; optionally scaffolds `eas.json`, `vercel.json`, `.github/workflows/*.yml`, `.changeset/config.json` from templates
+- **Calls**: shared detection script; per-surface CLI tools (vercel, eas, supabase, railway, npm, vsce) for probes
+- **Triggers**: returns control to user; if invoked from `/cbp-ship`, returns there for resume