create-tigra 3.1.1 → 3.2.0

package/README.md

@@ -40,7 +40,7 @@ npx create-tigra my-app
 
 ### Codex Development
 
-Includes concise Codex-native `AGENTS.md` guidance at the project root and scoped guidance inside `client/` and `server/`. Generated projects also include Cloudflare's MIT-licensed `security-audit` repository skill. Meaningful server changes must use its focused guidance and, when the Codex Security plugin is installed, complete a `security-diff-scan` of the working-tree patch before completion.
+Includes concise `AGENTS.md` guidance at the project root and scoped guidance inside `client/` and `server/`, with matching `CLAUDE.md` files that import them so Claude Code reads the same rules. Generated projects also include Cloudflare's MIT-licensed `security-audit` repository skill (in `.agents/skills/` for Codex, with a thin pointer in `.claude/skills/` for Claude Code). Meaningful server changes must use its focused guidance and, before completion, scan the working-tree patch: `security-diff-scan` when the Codex Security plugin is installed, or `/security-review` in Claude Code.
 
 The security workflow falls back to the bundled skill when Codex Security is unavailable, while full or deep repository audits remain explicit operations rather than an automatic cost on every edit.
 

package/bin/create-tigra.js

@@ -23,6 +23,7 @@ const JWT_SECRET_PLACEHOLDER = 'CHANGE_ME_generate_with_openssl_rand_hex_48';
 
 // Files that contain template variables and need replacement
 const FILES_TO_REPLACE = [
+  'AGENTS.md',
   'server/package.json',
   'server/.env.example',
   'server/docker-compose.yml',
@@ -104,10 +105,10 @@ async function copyTemplate(templateDir, targetDir) {
       continue;
     }
 
-    // The repository stores the gitignore without a leading dot so npm reliably
-    // includes it in the published template; generated projects receive the dotfile.
-    let destName = entry.name;
-    if (entry.name === 'gitignore') destName = '.gitignore';
+    // The repository stores the gitignore without a leading dot so npm reliably
+    // includes it in the published template; generated projects receive the dotfile.
+    let destName = entry.name;
+    if (entry.name === 'gitignore') destName = '.gitignore';
 
     const destPath = path.join(targetDir, destName);
 
@@ -404,7 +405,7 @@ async function main() {
           }
         }
 
-        spinner.succeed('Project scaffolded successfully!');
+        spinner.succeed('Project scaffolded successfully!');
       } catch (error) {
         spinner.fail('Failed to scaffold project');
         console.error(chalk.red(`\n  ${error.message}\n`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-tigra",
-  "version": "3.1.1",
+  "version": "3.2.0",
   "type": "module",
   "description": "Create a production-ready full-stack app with Next.js 16 + Fastify 5 + Prisma + Redis",
   "bin": {

package/template/.claude/skills/security-audit/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: security-audit
+description: Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.
+---
+
+# Security Audit (pointer)
+
+This is a thin pointer so Claude Code discovers the skill. The real skill is shared with Codex and lives in `.agents/skills/security-audit/` (vendored from Cloudflare's `security-audit-skill`; see its `SOURCE.md`). Do not copy it here, so the two agents never drift.
+
+Read `.agents/skills/security-audit/SKILL.md` in full and follow it exactly. Resolve every relative file it references (for example `HUNTING.md`, `report-schema.json`, the `validate-*.cjs` scripts) against `.agents/skills/security-audit/`, not this directory. Its "Task tool" is Claude Code's subagent mechanism.

package/template/AGENTS.md

@@ -4,6 +4,22 @@
 
 Every implementation change MUST include a human-readability pass. Add or update concise comments or doc comments for important functionality and for non-obvious contracts, invariants, edge cases, business rules, security boundaries, deployment constraints, performance choices, and workarounds. Explain why and what must remain true; do not narrate obvious syntax. Keep comments accurate and remove stale ones.
 
+<!-- project-facts:start -->
+## Project facts
+
+> Maintained by the `seed-project-facts` skill: run it once to fill the TODOs. This section is the source of truth for this project: keep it true. If your work changes any line (deployment, URLs, hosting, databases, Redis, integrations, rules), update it and the seed-plugins registry row in the same change. If it conflicts with reality, trust reality, fix it, and tell Tornike. No secrets here.
+
+- **Name:** {{PROJECT_NAME}}
+- **Purpose:** TODO
+- **Production:** TODO (client URL / server URL, or "not deployed")
+- **Hosting:** TODO (Coolify instance, or none)
+- **Local MySQL:** `{{DATABASE_NAME}}` on TODO (central-mysql | per-project container)
+- **Production MySQL:** TODO (`db` on shared MySQL on <instance> | dedicated Coolify MySQL | none)
+- **Redis:** TODO (local yes/no / production yes/no)
+- **Talks to:** TODO
+- **Special rules:** none
+<!-- project-facts:end -->
+
 ## Architecture and sources of truth
 
 - `client/` is a Next.js App Router application; `server/` is a Fastify API backed by Prisma/MySQL and Redis. They deploy independently.
@@ -36,8 +52,8 @@ Every implementation change MUST include a human-readability pass. Add or update
 ## Required server security workflow
 
 - For every meaningful server implementation, bug fix, refactor, dependency update, or configuration change, use the repository-local `security-audit` skill in guidance mode while designing and reviewing the change. Treat authentication, authorization, validation, database access, outbound requests, uploads, cookies, CORS/origin handling, rate limits, environment configuration, and deployment behavior as security-sensitive surfaces.
-- Before completion, use the Codex Security plugin's `codex-security:security-diff-scan` skill to review the current working-tree patch when that plugin skill is available. Scope the review to the changed server behavior and the supporting code needed to establish impact; do not expand it into an unrelated repository audit.
-- If Codex Security is unavailable, perform an equivalent focused patch review with the bundled `security-audit` skill and explicitly report that the plugin scan was unavailable. Do not skip the security gate silently.
+- Before completion, review the current working-tree patch with the agent's own security scan when available: in Codex use the Codex Security plugin's `codex-security:security-diff-scan` skill; in Claude Code run `/security-review`. Scope the review to the changed server behavior and the supporting code needed to establish impact; do not expand it into an unrelated repository audit.
+- If that scan is unavailable, perform an equivalent focused patch review with the bundled `security-audit` skill and explicitly report that the scan was unavailable. Do not skip the security gate silently.
 - A full or deep repository audit remains explicit work: do not start one merely because ordinary server code changed. Fix confirmed in-scope findings, rerun affected checks, and disclose any unresolved or unverified security concern before claiming completion.
 - Documentation-only, comment-only, and formatting-only changes may skip the patch scan when they cannot affect runtime behavior, permissions, deployment, or security policy.
 

package/template/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/template/client/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/template/server/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md