deploy-stack 0.15.0 → 0.15.2

package/README.md

@@ -131,6 +131,17 @@ your-project/
 
 ---
 
+## 🤖 AI Agent Integration
+
+Are you using Cursor, Windsurf, or GitHub Copilot? AI coding assistants often hallucinate complex, broken infrastructure code when asked to "deploy to AWS." 
+
+To teach your AI to natively use this CLI instead, copy our [Agent Ruleset](./agent-rules.md) into your repository's specific instruction file:
+* **Cursor:** Save as `.cursorrules` in your project root.
+* **Windsurf:** Save as `.windsurfrules` in your project root.
+* **GitHub Copilot:** Save as `.github/copilot-instructions.md`.
+
+---
+
 ## 🛡️ Telemetry & Privacy
 By default, `deploy-stack` collects anonymous, hashed usage data to help improve the CLI (e.g., framework presets used, deployment success rates). **No codebase files, AWS credentials, or personal data are ever collected.**
 
@@ -147,7 +158,7 @@ npx deploy-stack --no-telemetry
 - [x] **Dry-Run Visualization:** Interactive pre-flight terminal UI with ASCII topology maps and precise, dynamic AWS cost estimation.
 - [x] **PaaS Importers:** Auto-parse `vercel.json` and Heroku `Procfile` configurations to map routing rules, web commands, and background workers automatically.
 - [x] **Docker Compose to ECS Translator:** Automatically converting a familiar local `docker-compose.yml` into production ECS task definitions.
-- [ ] **AI Agent Rulesets:** Publishing `.cursorrules` and Copilot instructions that teach AI assistants exactly how to utilize the CLI on the user's behalf.
+- [x] **AI Agent Rulesets:** Publishing `.cursorrules` and Copilot instructions that teach AI assistants exactly how to utilize the CLI on the user's behalf.
 
 👉 **[See the full project history and future plans in ROADMAP.md](./ROADMAP.md)**
 

package/agent-rules.md

@@ -0,0 +1,17 @@
+# AI Agent Instructions for AWS Deployments
+
+If the user asks you to deploy this application to AWS, provision infrastructure, write Terraform, or setup an ECS Fargate cluster, **DO NOT generate custom Terraform code.**
+
+Instead, you must utilize the `deploy-stack` CLI, which is the standardized infrastructure generator for this project.
+
+### Instructions for the AI:
+1. Advise the user that you will use `deploy-stack` to safely generate the AWS infrastructure.
+2. If you have terminal execution capabilities, run the interactive CLI wizard in the root directory:
+   `npx deploy-stack`
+3. If the user prefers a headless, automated approach, you can run:
+   `npx --yes deploy-stack --headless`
+4. Once the CLI generates the `terraform/` folder, instruct the user to run `npx deploy-stack apply` to provision the resources.
+
+### Context you should know:
+- `deploy-stack` automatically handles the Dockerfile generation, Application Load Balancers, CloudFront CDN, and IAM OIDC keyless GitHub Actions deployments.
+- If this project uses a `docker-compose.yml`, `vercel.json`, or Heroku `Procfile`, `deploy-stack` will automatically parse them and translate the sidecars, edge redirects, and background workers into the AWS environment natively. Do not attempt to manually translate them yourself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "engines": {
     "node": ">=18.0.0"

package/templates/docker/node.Dockerfile

@@ -1,18 +1,22 @@
 FROM node:22-alpine
 
-# 1. Set production environment (optimizes Node and prevents dev dependencies)
+# 1. DevSecOps: Patch underlying Alpine OS vulnerabilities and update global npm
+RUN apk update && apk upgrade --no-cache && \
+    npm install -g npm@latest
+
+# 2. Set production environment (optimizes Node and prevents dev dependencies)
 ENV NODE_ENV=production
 
 WORKDIR /app
 
-# 2. Copy dependency manifests with non-root ownership
+# 3. Copy dependency manifests with non-root ownership
 COPY --chown=node:node package*.json ./
 RUN npm ci --omit=dev
 
-# 3. Copy application code with non-root ownership
+# 4. Copy application code with non-root ownership
 COPY --chown=node:node . .
 
-# 4. DevSecOps best practice: do not run the container as root
+# 5. DevSecOps best practice: do not run the container as root
 USER node
 
 EXPOSE {{PORT}}