create-anpunkit 2.2.0 → 2.3.0

package/template/knowledge/webapp.md

@@ -0,0 +1,265 @@
+# knowledge/webapp.md — matured web-app practice (preinstalled)
+
+> **What this file is.** Use-case knowledge for browser-facing web apps,
+> consulted by `researcher` (STEP 0.5) when `knowledge/webapp.md` appears in
+> the `knowledge_docs:` list of `docs/OVERVIEW.md`. Selection is deterministic
+> — declared at `/overview`, never inferred (hard rule 10).
+>
+> **Templates below are materialized per-project** — copied to the stated path
+> the first time the phase work needs them. Once materialized they are
+> user-owned project files: adjust freely, the kit never overwrites them.
+
+## Browser boundary practice (E2E_KIND: browser)
+
+- `ui` spec cases carry a `fixtures/<case-id>-ui.json` descriptor with a
+  closed, kit-versioned assert vocabulary: `visible`, `text-equals`,
+  `enabled`, `count`. `e2e-runner` EMITS Playwright specs from descriptors —
+  it never authors blind from prose.
+- Each emitted spec block carries a `// spec: <case-id>` citation
+  (`spec-conformance.sh` checks it).
+- EVIDENCE (hard rule 13): at each UI-existence assertion, capture a
+  screenshot regardless of pass/fail to
+  `docs/evidence/e2e-phase-<n>/<case-id>-<element-slug>.png` — one shot per
+  asserted element, on green as well as red.
+- `ui` cases have NO mock mirror — the browser IS the boundary.
+
+## E2E stack ritual
+
+Two target modes, recorded in `docs/INFRA.md`:
+
+- **azure-deployed** (`E2E_STACK_EXTERNAL=1` in `.env.test`): tests hit the
+  deployed app; `e2e-stack.sh up` only health-checks reachability.
+- **local-docker**: `e2e-stack.sh up` builds + starts the compose stack and
+  polls health.
+
+Sequence, always: `bash scripts/e2e-stack.sh up` -> `npx playwright test` ->
+`bash scripts/e2e-stack.sh down`. Stack didn't come up -> classify
+**STACK NOT READY** (not a bug; no debug budget).
+
+## Web deploy ritual (DEPLOY_KIND: cloud-deploy)
+
+- Deploy task lives in the final phase (DEPLOY_KIND completion, hard rules).
+- After deploy: record the deployed base URL in `docs/INFRA.md`
+  (`## Deployed base URL`) and confirm `docs/ENDPOINTS.md` entries resolve
+  against it; run a `/health` (or equivalent) check before calling it done.
+
+## .gitignore lines a materialized stack needs
+
+```
+e2e/.auth/
+playwright-report/
+test-results/
+```
+
+---
+
+## Templates
+
+### `playwright.config.ts` — materialize to project root
+
+```ts
+// playwright.config.ts
+import { defineConfig, devices } from '@playwright/test';
+
+export default defineConfig({
+  testDir: './e2e',
+  globalSetup: './e2e/global-setup.ts',
+  fullyParallel: false,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 1 : 0,
+  workers: 1,
+  reporter: [['list'], ['html', { open: 'never' }]],
+  use: {
+    baseURL: process.env.E2E_BASE_URL || 'http://localhost:8080',
+    storageState: 'e2e/.auth/state.json',
+    trace: 'retain-on-failure',
+    screenshot: 'only-on-failure',
+    actionTimeout: 15_000,
+  },
+  projects: [
+    { name: 'chromium', use: { ...devices['Desktop Chrome'] } },
+  ],
+  webServer: process.env.E2E_STACK_EXTERNAL ? undefined : {
+    command: 'bash scripts/e2e-stack.sh up',
+    url: process.env.E2E_BASE_URL || 'http://localhost:8080',
+    timeout: 180_000,
+    reuseExistingServer: !process.env.CI,
+  },
+});
+```
+
+### `e2e/global-setup.ts` — materialize to `e2e/`
+
+Entra ID ROPC token injection (Azure/MSAL apps — see `knowledge/azure.md` for
+the auth practice). Known gap: the localStorage keys (`e2e.access_token`,
+`e2e.id_token`) are a stub convention — align them with your app's real MSAL
+cache keys when materializing.
+
+```ts
+// e2e/global-setup.ts
+import { chromium } from '@playwright/test';
+import * as fs from 'fs';
+import * as path from 'path';
+
+const AUTH_DIR = path.join(__dirname, '.auth');
+const STATE = path.join(AUTH_DIR, 'state.json');
+
+async function fetchRopcToken() {
+  const tenant = reqEnv('E2E_TENANT_ID');
+  const body = new URLSearchParams({
+    grant_type: 'password',
+    client_id: reqEnv('E2E_CLIENT_ID'),
+    username: reqEnv('E2E_TEST_USER'),
+    password: reqEnv('E2E_TEST_PASSWORD'),
+    scope: `openid profile ${reqEnv('E2E_SCOPE')}`,
+  });
+  const url = `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`;
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body,
+  });
+  if (!res.ok) {
+    const txt = await res.text();
+    throw new Error(
+      `ROPC token fetch failed (${res.status}). ` +
+      `Check: ROPC enabled on app registration, test user exists, ` +
+      `MFA excluded via Conditional Access. Response: ${txt}`
+    );
+  }
+  return res.json() as Promise<{ access_token: string; id_token: string; expires_in: number }>;
+}
+
+function reqEnv(k: string): string {
+  const v = process.env[k];
+  if (!v) throw new Error(`Missing env ${k} — run /infra to regenerate .env.test`);
+  return v;
+}
+
+async function globalSetup() {
+  fs.mkdirSync(AUTH_DIR, { recursive: true });
+  const token = await fetchRopcToken();
+  const baseURL = reqEnv('E2E_BASE_URL');
+  const browser = await chromium.launch();
+  const page = await browser.newPage();
+  await page.goto(baseURL);
+  await page.evaluate((t) => {
+    localStorage.setItem('e2e.access_token', t.access_token);
+    localStorage.setItem('e2e.id_token', t.id_token);
+  }, token);
+  await page.context().storageState({ path: STATE });
+  await browser.close();
+  console.log('E2E auth ready — real Entra token injected, MFA UI bypassed.');
+}
+
+export default globalSetup;
+```
+
+### `docker-compose.test.yml` — materialize to project root
+
+```yaml
+# docker-compose.test.yml — E2E test stack (local-docker mode).
+# TEMPLATE — adjust build contexts and ports for your project layout.
+services:
+  backend:
+    build:
+      context: ./backend          # <-- adjust
+    environment:
+      SQL_SERVER: ${E2E_SQL_SERVER}
+      SQL_DB: ${E2E_SQL_DB}
+      SQL_USER: ${E2E_SQL_USER}
+      SQL_PASSWORD: ${E2E_SQL_PASSWORD}
+      TENANT_ID: ${E2E_TENANT_ID}
+      CLIENT_ID: ${E2E_CLIENT_ID}
+      STORAGE_CONN: ${E2E_STORAGE_CONN:-}
+    ports:
+      - "8081:8081"
+    healthcheck:
+      test: ["CMD", "curl", "-fs", "http://localhost:8081/health"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+
+  webapp:
+    build:
+      context: ./frontend         # <-- adjust
+    environment:
+      API_BASE_URL: http://backend:8081
+      TENANT_ID: ${E2E_TENANT_ID}
+      CLIENT_ID: ${E2E_CLIENT_ID}
+    ports:
+      - "8080:80"
+    depends_on:
+      backend:
+        condition: service_healthy
+```
+
+### `scripts/e2e-stack.sh` — materialize to `scripts/`
+
+```bash
+#!/usr/bin/env bash
+# scripts/e2e-stack.sh — E2E test stack lifecycle.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+CMD="${1:-}"
+COMPOSE="docker-compose.test.yml"
+ENVFILE=".env.test"
+
+[ -f "$ENVFILE" ] || { echo "missing $ENVFILE — run /infra to generate it"; exit 1; }
+set -a; . "./$ENVFILE"; set +a
+
+if [ "${E2E_STACK_EXTERNAL:-}" = "1" ]; then
+  echo "[e2e-stack] E2E_STACK_EXTERNAL=1 — targeting deployed Azure app at ${E2E_BASE_URL:-<unset>}"
+  case "$CMD" in
+    up)
+      echo "[e2e-stack] Verifying Azure app is reachable..."
+      for i in $(seq 1 10); do
+        if curl -fs "${E2E_BASE_URL:-http://localhost:8080}/health" >/dev/null 2>&1 \
+        || curl -fs "${E2E_BASE_URL:-http://localhost:8080}" >/dev/null 2>&1; then
+          echo "[e2e-stack] Azure app reachable."
+          exit 0
+        fi
+        sleep 3
+      done
+      echo "[e2e-stack] WARNING: Azure app not reachable. Classify as AZURE UNAVAILABLE."
+      exit 1
+      ;;
+    down)
+      echo "[e2e-stack] External mode — nothing to stop."
+      exit 0
+      ;;
+    *)
+      echo "usage: e2e-stack.sh up|down"
+      exit 1
+      ;;
+  esac
+fi
+
+if docker compose version >/dev/null 2>&1; then DC="docker compose"; else DC="docker-compose"; fi
+
+case "$CMD" in
+  up)
+    echo "[e2e-stack] building + starting local app containers..."
+    $DC -f "$COMPOSE" --env-file "$ENVFILE" up -d --build
+    for i in $(seq 1 30); do
+      if curl -fs "${E2E_BASE_URL:-http://localhost:8080}" >/dev/null 2>&1; then
+        echo "[e2e-stack] up."
+        exit 0
+      fi
+      sleep 3
+    done
+    echo "[e2e-stack] ERROR: app did not become healthy — STACK NOT READY"
+    exit 1
+    ;;
+  down)
+    echo "[e2e-stack] stopping local containers..."
+    $DC -f "$COMPOSE" --env-file "$ENVFILE" down
+    echo "[e2e-stack] down."
+    ;;
+  *)
+    echo "usage: e2e-stack.sh up|down"
+    exit 1
+    ;;
+esac
+```

package/template/setup.sh

@@ -11,9 +11,8 @@
 #   user-owned  -> NEVER overwritten
 #   hybrid      -> merged idempotently, never replaced
 #
+# Claude Code only (v2.3 — Cursor support dropped, §5.69).
 # Flags: --src DIR --kb-path P --kb-remote URL --no-kb --force --dry-run
-#        --tools LIST   (comma/space list from: claude cursor; default both)
-#        --add-tool T   (additive: install T's files into an existing project)
 set -euo pipefail
 
 SRC="."
@@ -22,9 +21,6 @@ KB_REMOTE="${ANPUNKIT_KB_REMOTE:-}"
 NO_KB=0
 FORCE=0
 DRY=0
-TOOLS_FLAG=""
-ADD_TOOL=""
-AVAILABLE_TOOLS="claude cursor"   # tools with real adapters; extend here
 while [ $# -gt 0 ]; do
   case "$1" in
     --src)       SRC="$2"; shift 2;;
@@ -33,8 +29,6 @@ while [ $# -gt 0 ]; do
     --no-kb)     NO_KB=1; shift;;
     --force)     FORCE=1; shift;;
     --dry-run)   DRY=1; shift;;
-    --tools)     TOOLS_FLAG="$2"; shift 2;;
-    --add-tool)  ADD_TOOL="$2"; shift 2;;
     *) echo "unknown flag: $1" >&2; exit 2;;
   esac
 done
@@ -70,36 +64,6 @@ fi
 say "mode: $MODE (installed: ${OLD_VER:-none} -> new: $NEW_VER)"
 [ "$MODE" = "newer-installed" ] && say "  ! installed version is newer than this package — proceeding as repair, review carefully."
 
-# ---- tool selection (v2.1): install only the selected tools' adapters/hooks/files
-TOOLS_FILE="$DEST/.claude/anpunkit-tools.json"
-norm_tools() { printf '%s' "$1" | tr ',' ' ' | tr -s ' ' | sed 's/^ //; s/ $//'; }
-read_recorded_tools() {
-  [ -f "$TOOLS_FILE" ] || { printf ''; return; }
-  node -e "try{console.log((JSON.parse(require('fs').readFileSync(process.argv[1],'utf8')).tools||[]).join(' '))}catch(e){console.log('')}" "$TOOLS_FILE" 2>/dev/null || printf ''
-}
-valid_tool() { case " $AVAILABLE_TOOLS " in *" $1 "*) return 0;; *) return 1;; esac; }
-
-RECORDED="$(read_recorded_tools)"
-if [ -n "$TOOLS_FLAG" ]; then
-  TOOLS="$(norm_tools "$TOOLS_FLAG")"
-elif [ -n "$RECORDED" ]; then
-  TOOLS="$RECORDED"               # re-run: preserve prior selection
-elif [ "$MODE" = "fresh" ] && [ -t 0 ]; then
-  printf "  Select tools to install (space-separated from: %s) [claude cursor]: " "$AVAILABLE_TOOLS"
-  read -r _sel || true
-  TOOLS="$(norm_tools "${_sel:-claude cursor}")"
-else
-  TOOLS="claude cursor"           # non-interactive default = both (no regression)
-fi
-# additive: --add-tool unions into the selection (and is recorded)
-[ -n "$ADD_TOOL" ] && TOOLS="$(norm_tools "$TOOLS $(norm_tools "$ADD_TOOL")" | tr ' ' '\n' | sort -u | tr '\n' ' ')"
-TOOLS="$(norm_tools "$TOOLS")"
-# validate
-for t in $TOOLS; do valid_tool "$t" || { echo "FATAL: unknown tool '$t' (available: $AVAILABLE_TOOLS)"; exit 2; }; done
-[ -z "$TOOLS" ] && { echo "FATAL: no tools selected"; exit 2; }
-tool_selected() { case " $TOOLS " in *" $1 "*) return 0;; *) return 1;; esac; }
-say "tools: $TOOLS$([ -n "$ADD_TOOL" ] && echo '  (+'"$ADD_TOOL"' added)')"
-
 BACKUP="$DEST/.anpunkit-backup-$(date +%Y%m%d-%H%M%S)"
 backup_one() {
   [ "$MODE" = "fresh" ] && return 0
@@ -114,11 +78,6 @@ backup_one() {
 install_kit_file() {
   local rel="$1" s="$SRC/$1" d="$DEST/$1"
   [ -f "$s" ] || return 0
-  # v2.1 tool gating: cursor-only files skipped unless cursor selected.
-  # (.claude/* is shared infra — Cursor reads .claude/agents + .claude/hooks too.)
-  case "$rel" in
-    .cursor/*) tool_selected cursor || { act "skip     $rel (cursor not selected)"; return 0; };;
-  esac
   if [ ! -f "$d" ]; then
     act "write    $rel"; [ "$DRY" = 1 ] && return 0
     mkdir -p "$(dirname "$d")"; cp -p "$s" "$d"; return 0
@@ -156,76 +115,44 @@ else
 fi
 
 # ---- generate command adapters from commands.src/ (manifest-owned output)
-say ""; say "[2/6] generate command adapters (tools: $TOOLS):"
+say ""; say "[2/6] generate command adapters (.claude/commands/):"
 gen_adapters() {
-  tool_selected claude && mkdir -p "$DEST/.claude/commands"
-  tool_selected cursor && mkdir -p "$DEST/.cursor/commands" "$DEST/.cursor/rules"
+  mkdir -p "$DEST/.claude/commands"
   for f in "$DEST"/commands.src/*.md; do
     [ -f "$f" ] || continue
     n=$(basename "$f")
-    if tool_selected claude; then
-      act "claude   .claude/commands/$n"
-      [ "$DRY" = 1 ] || cp -p "$f" "$DEST/.claude/commands/$n"
-    fi
-    if tool_selected cursor; then
-      act "cursor   .cursor/commands/$n"
-      [ "$DRY" = 1 ] || awk 'BEGIN{fm=0} NR==1 && $0=="---"{fm=1; next} fm==1 && $0=="---"{fm=0; next} fm==0{print}' "$f" \
-        | sed '/^$/{1d}' > "$DEST/.cursor/commands/$n"
-    fi
+    act "claude   .claude/commands/$n"
+    [ "$DRY" = 1 ] || cp -p "$f" "$DEST/.claude/commands/$n"
   done
 }
 gen_adapters
 
-# ---- hybrid JSON merge: ensure the hook entries for selected tools, never drop user keys
-say ""; say "[3/6] wire hooks (idempotent merge, tools: $TOOLS):"
+# ---- hybrid JSON merge: ensure the Claude hook entries, never drop user keys
+say ""; say "[3/6] wire hooks (idempotent merge, .claude/settings.json):"
 merge_settings() {
-  [ "$DRY" = 1 ] && { act "merge    $(tool_selected claude && echo -n '.claude/settings.json ')$(tool_selected cursor && echo -n '.cursor/hooks.json')"; return 0; }
-  tool_selected claude && backup_one "$DEST/.claude/settings.json"
-  tool_selected cursor && backup_one "$DEST/.cursor/hooks.json"
-  CLAUDE_SEL=$(tool_selected claude && echo 1 || echo 0) \
-  CURSOR_SEL=$(tool_selected cursor && echo 1 || echo 0) \
+  [ "$DRY" = 1 ] && { act "merge    .claude/settings.json"; return 0; }
+  backup_one "$DEST/.claude/settings.json"
   node - "$DEST" <<'NODE'
 const fs=require('fs'),path=require('path');
 const dest=process.argv[2];
-const claudeSel=process.env.CLAUDE_SEL==='1', cursorSel=process.env.CURSOR_SEL==='1';
 const load=(p,d)=>{try{return JSON.parse(fs.readFileSync(p,'utf8'))}catch(e){return d}};
 const save=(p,o)=>{fs.mkdirSync(path.dirname(p),{recursive:true});fs.writeFileSync(p,JSON.stringify(o,null,2)+"\n")};
-const out=[];
-// Claude settings.json
-if(claudeSel){
-  const sp=path.join(dest,'.claude/settings.json');
-  const s=load(sp,{});
-  if(!s.$schema)s.$schema='https://json.schemastore.org/claude-code-settings.json';
-  s.hooks=s.hooks||{};
-  const ensure=(event,matcher,cmd)=>{
-    const arr=s.hooks[event]=s.hooks[event]||[];
-    for(const blk of arr)for(const h of (blk.hooks||[]))if(h.command===cmd)return;
-    const blk={hooks:[{type:'command',command:cmd}]};
-    if(matcher)blk.matcher=matcher;
-    arr.push(blk);
-  };
-  ensure('SessionStart','startup|clear|compact','bash .claude/hooks/session-start.sh');
-  ensure('PreCompact','auto|manual','bash .claude/hooks/pre-compact.sh');
-  ensure('SubagentStop','','bash .claude/hooks/subagent-stop.sh');
-  save(sp,s);
-  out.push('.claude/settings.json');
-}
-// Cursor hooks.json
-if(cursorSel){
-  const cp=path.join(dest,'.cursor/hooks.json');
-  const c=load(cp,{version:1,hooks:{}});
-  c.hooks=c.hooks||{};
-  const cursorEnsure=(event,cmd)=>{
-    const arr=c.hooks[event]=c.hooks[event]||[];
-    if(!arr.some(h=>h.command===cmd))arr.push({command:cmd});
-  };
-  cursorEnsure('sessionStart','bash .claude/hooks/cursor-session-start.sh');
-  cursorEnsure('preCompact','bash .claude/hooks/pre-compact.sh');
-  cursorEnsure('subagentStop','bash .claude/hooks/subagent-stop.sh');
-  save(cp,c);
-  out.push('.cursor/hooks.json');
-}
-console.log('  merged '+(out.join(' + ')||'(nothing — no tool selected hooks)'));
+const sp=path.join(dest,'.claude/settings.json');
+const s=load(sp,{});
+if(!s.$schema)s.$schema='https://json.schemastore.org/claude-code-settings.json';
+s.hooks=s.hooks||{};
+const ensure=(event,matcher,cmd)=>{
+  const arr=s.hooks[event]=s.hooks[event]||[];
+  for(const blk of arr)for(const h of (blk.hooks||[]))if(h.command===cmd)return;
+  const blk={hooks:[{type:'command',command:cmd}]};
+  if(matcher)blk.matcher=matcher;
+  arr.push(blk);
+};
+ensure('SessionStart','startup|clear|compact','bash .claude/hooks/session-start.sh');
+ensure('PreCompact','auto|manual','bash .claude/hooks/pre-compact.sh');
+ensure('SubagentStop','','bash .claude/hooks/subagent-stop.sh');
+save(sp,s);
+console.log('  merged .claude/settings.json');
 NODE
 }
 merge_settings
@@ -237,17 +164,11 @@ say ""; say "[4/6] AGENTS.md / CLAUDE.md verify:"
 verify_import() {
   local CL="$DEST/CLAUDE.md" AG="$DEST/AGENTS.md"
   [ -f "$AG" ] || { echo "FATAL VERIFY: AGENTS.md not on disk"; exit 1; }
-  # sentinel present in AGENTS.md (shared — both tools read AGENTS.md)
   if ! grep -q 'ANPUNKIT-AGENTS-SENTINEL' "$AG"; then
     echo "FATAL VERIFY: AGENTS.md sentinel missing (file clobbered or empty?)"; exit 1; fi
-  # CLAUDE.md bare @AGENTS.md import is Claude-specific — only verify if claude selected
-  if tool_selected claude; then
-    if ! grep -qE '^@AGENTS\.md[[:space:]]*$' "$CL"; then
-      echo "FATAL VERIFY: CLAUDE.md is missing a bare top-level '@AGENTS.md' import line"; exit 1; fi
-    say "  VERIFY ok: bare @AGENTS.md import + AGENTS.md on disk + sentinel present."
-  else
-    say "  VERIFY ok: AGENTS.md on disk + sentinel present (claude not selected — CLAUDE.md import not required)."
-  fi
+  if ! grep -qE '^@AGENTS\.md[[:space:]]*$' "$CL"; then
+    echo "FATAL VERIFY: CLAUDE.md is missing a bare top-level '@AGENTS.md' import line"; exit 1; fi
+  say "  VERIFY ok: bare @AGENTS.md import + AGENTS.md on disk + sentinel present."
 }
 verify_import
 
@@ -305,14 +226,12 @@ configure_kb() {
 
 configure_kb
 
-# ---- finalize: stamp the installed manifest (copy the new one) + record tools
+# ---- finalize: stamp the installed manifest (copy the new one)
 if [ "$DRY" != 1 ]; then
   cp -p "$MAN_SRC" "$MAN_DEST" 2>/dev/null || true
-  mkdir -p "$DEST/.claude"
-  node -e "require('fs').writeFileSync(process.argv[1],JSON.stringify({tools:process.argv[2].split(' ').filter(Boolean)},null,2)+'\n')" "$TOOLS_FILE" "$TOOLS" 2>/dev/null || true
   [ -d "$BACKUP" ] && say "" && say "backup written: ${BACKUP#$DEST/}"
 fi
 
-say ""; say "anpunkit setup complete ($MODE, tools: $TOOLS). Open Claude Code or Cursor — the SessionStart/sessionStart hook fires automatically."
+say ""; say "anpunkit setup complete ($MODE). Open Claude Code — the SessionStart hook fires automatically."
 if [ "$DRY" = 1 ]; then say "(dry-run: no files were written.)"; fi
 exit 0

package/template/.claude/hooks/cursor-session-start.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-# cursor-session-start.sh — Cursor wiring for the SESSION-OPEN ritual.
-# Cursor's sessionStart hook expects JSON on stdout ({"additional_context": ...}),
-# unlike Claude Code, which injects raw stdout. This wrapper runs the SHARED
-# session-start.sh body (single copy — anti-drift) and wraps its output in the
-# JSON envelope Cursor requires. Cursor sets CLAUDE_PROJECT_DIR (compat alias),
-# so the shared script needs no changes.
-# Uses node for JSON (the kit assumes Node; python3 is a fallback only).
-# Verified against cursor.com/docs/hooks (sessionStart output schema), 2026-06.
-set -euo pipefail
-HERE="$(cd "$(dirname "$0")" && pwd)"
-OUT="$(bash "$HERE/session-start.sh" 2>/dev/null || true)"
-if command -v node >/dev/null 2>&1; then
-  printf '%s' "$OUT" | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>console.log(JSON.stringify({additional_context:d})))'
-else
-  printf '%s' "$OUT" | python3 -c 'import json,sys; print(json.dumps({"additional_context": sys.stdin.read()}))'
-fi

package/template/.claude/skills/caveman/SKILL.md

@@ -1,39 +0,0 @@
----
-name: caveman
-description: >
-  Ultra-compressed communication mode. Cuts token usage ~75% by dropping
-  filler, articles, and pleasantries while keeping full technical accuracy.
-  Use when user says "caveman mode", "talk like caveman", "use caveman",
-  "less tokens", "be brief", or invokes /caveman.
----
-
-Respond terse like smart caveman. All technical substance stay. Only fluff die.
-
-## Persistence
-
-ACTIVE EVERY RESPONSE once triggered. No revert after many turns. No filler drift. Still active if unsure. Off only when user says "stop caveman" or "normal mode".
-
-## Rules
-
-Drop: articles (a/an/the), filler (just/really/basically/actually/simply), pleasantries (sure/certainly/of course/happy to), hedging. Fragments OK. Short synonyms (big not extensive, fix not "implement a solution for"). Abbreviate common terms (DB/auth/config/req/res/fn/impl). Strip conjunctions. Use arrows for causality (X -> Y). One word when one word enough.
-
-Technical terms stay exact. Code blocks unchanged. Errors quoted exact.
-
-Pattern: `[thing] [action] [reason]. [next step].`
-
-Not: "Sure! I'd be happy to help you with that. The issue you're experiencing is likely caused by..."
-Yes: "Bug in auth middleware. Token expiry check use `<` not `<=`. Fix:"
-
-### Examples
-
-**"Why React component re-render?"**
-
-> Inline obj prop -> new ref -> re-render. `useMemo`.
-
-**"Explain database connection pooling."**
-
-> Pool = reuse DB conn. Skip handshake -> fast under load.
-
-## Auto-Clarity Exception
-
-Drop caveman temporarily for: security warnings, irreversible action confirmations, multi-step sequences where fragment order risks misread, user asks to clarify or repeats question. Resume caveman after.

package/template/.cursor/commands/infra.md

@@ -1,82 +0,0 @@
-Caveman ULTRA mode. You are the ORCHESTRATOR.
-
-Action: $ARGUMENTS (default: "provision" if INFRA.md missing, "verify" if present)
-
----
-
-## PRE-FLIGHT
-
-1. Check `az account show` — if it fails, STOP.
-   Tell me: "Run `scripts/auth-setup.sh` first."
-
-2. Determine mode from $ARGUMENTS or default logic.
-
----
-
-## PROVISION / UPDATE flow
-
-1. Dispatch `infra-provisioner` with the mode.
-
-2. It returns WHAT-IF READY. Show me:
-   - resource list with SKUs and costs
-   - total monthly cost estimate
-   - what-if detail file path
-   Then ask:
-   > "Review docs/research/infra-whatif-<timestamp>.md. Type 'go' to apply,
-   >  or describe changes to make first."
-   WAIT. Do not proceed until I say "go".
-
-3. On "go": pass APPROVED to `infra-provisioner`.
-
-4. On "make changes": dispatch UPDATE with feedback. Loop to step 2.
-
-5. On APPLIED: tell me INFRA.md ✓, .env.test ✓, and any manual steps remaining.
-   Then run AUTH PROOF (below) before declaring Phase 0 complete.
-
----
-
-## AUTH PROOF (one-time, hard rule 16)
-
-Runs after a successful PROVISION (and on demand via `/infra auth-proof`). Proves
-every credential the project's real tests will use is reusable WITHOUT interaction.
-"Reusable" is defined falsifiably: obtainable headlessly TWICE IN A ROW.
-
-1. Enumerate the credentials in scope: the Entra/MSAL app login, plus every
-   external datasource credential referenced in docs/DATAFLOW.md (external rows)
-   and docs/ENDPOINTS.md (auth column) — Azure SQL, Tableau, etc.
-
-2. Dispatch `infra-provisioner` to run, for EACH credential, a headless obtain
-   twice in a row: first call primes (token fetch / connect), second call must
-   succeed from cache/refresh with ZERO prompts. The Microsoft login UI is never
-   driven (ROPC + dedicated MFA-excluded test account; hard rule 8).
-
-3. Result:
-   - All credentials pass twice headlessly -> write `AUTH PROOF: PASS <timestamp>`
-     to docs/INFRA.md with the per-credential list. Phase 0 may complete.
-   - Any credential prompts or fails the second obtain -> NOT reusable. Write
-     `AUTH PROOF: FAIL` + which credential, STOP, tell me what to fix. Phase 0 is
-     not complete until the proof passes.
-
----
-
-## VERIFY flow
-
-1. Check INFRA.md exists. If missing: tell me to run `/infra provision` first.
-2. Dispatch `infra-provisioner` VERIFY mode.
-3. Return drift report. If the AUTH PROOF marker is missing or stale, re-run AUTH PROOF.
-
----
-
-## REGENERATE-ENV flow
-
-1. Check INFRA.md exists.
-2. Dispatch `infra-provisioner` REGENERATE-ENV.
-3. Confirm .env.test rewritten.
-
----
-
-## Notes
-
-- /infra never touches PLAN.md, STATE.md, ISSUES.md, or DESIGN_LOG.md.
-- Infra errors are AZURE UNAVAILABLE or CONFIG ERROR — do NOT route to debugger.
-- If UNDERSPEC: list missing decisions, ask me to fill them, re-dispatch.

package/template/.cursor/commands/log-decision.md

@@ -1,29 +0,0 @@
-Caveman ULTRA mode.
-
-Append an architectural decision to docs/DESIGN_LOG.md. Change: $ARGUMENTS
-
-WHEN this applies — the change is ARCHITECTURAL:
-- new / removed / renamed agent, hook, or command
-- changed workflow rule (escalation, phase gate, test layering)
-- design decision where alternatives were weighed
-
-WHEN it does NOT apply:
-- code changes, features, phase progress -> HISTORY.md
-- bugs + fixes -> ISSUES.md
-- infra changes -> INFRA.md
-
-Steps:
-1. Read docs/DESIGN_LOG.md.
-2. Append a dated line to `## 0. Changelog`, newest first.
-3. If alternatives were weighed, ALSO append a full entry to §5:
-```
-
-### 5.x <decision title>
-
-Options: <a, b, c>. **Chosen: <x>.** <why it won.>
-
-```
-4. If agent/hook/command/file added or removed, update the file inventory (§6).
-5. NEVER rewrite or delete existing entries — append only.
-
-Confirm back in 2-3 lines: what was logged and where.

package/template/.cursor/commands/log-issue.md

@@ -1,23 +0,0 @@
-Caveman ULTRA mode.
-
-Append an entry to docs/ISSUES.md. Error: $ARGUMENTS
-
-Canonical format:
-```
-
-### <short error title — searchable, literal error keywords>
-
-- [x] open      (or “- [x] resolved”)
-- symptom: <what was observed>
-- root cause: <the REAL underlying cause>
-- solution: <exact fix, or “pending”>
-- failed attempts: <approaches that did NOT work>
-
-```
-Rules:
-- title must contain literal error keywords -> grep finds it.
-- root cause is the real cause, not "the line threw an error".
-- always fill "failed attempts" — stops repeated dead ends.
-- open issues go at the TOP; resolved below; archived oldest at bottom.
-
-Confirm the entry back in 2 lines.