nerdsystem 0.0.5 → 0.0.6

package/README.md

@@ -6,7 +6,7 @@
 npx nerdsystem init my-app
 cd my-app && pnpm install
 nerd dev       # run locally with real sign-in
-nerd verify    # secrets, dependencies, policy, PII, types
+nerd check     # every gate a deploy runs: secrets, dependencies, policy, PII, types (alias: nerd verify)
 nerd deploy    # checks, builds, migrates, ships
 ```
 

package/dist/api.js

@@ -37,7 +37,8 @@ export class ApiClient {
         if (!res.ok) {
             const err = json?.error;
             const details = err?.details ? `\n${JSON.stringify(err.details, null, 2)}` : "";
-            throw new CliError(`${err?.code ?? "error"} (${res.status}): ${err?.message ?? "request failed"}${details}`);
+            // The message leads; the code and status follow for people who need them.
+            throw new CliError(`${err?.message ?? "request failed"} [${err?.code ?? "error"} ${res.status}]${details}`);
         }
         return json;
     }

package/dist/commands/check.d.ts

@@ -13,8 +13,13 @@ export declare function runChecks(root: string, opts: {
     remote: boolean;
     typecheck: boolean;
 }): Promise<CheckResult>;
+/**
+ * `nerd check` (and its alias `nerd verify`): every gate a deploy runs, plus a check that the linked
+ * project still exists. One command, one output shape, so agents learn one thing.
+ */
 export declare function check(opts: {
     json: boolean;
-    "no-typecheck": boolean;
+    "no-build": boolean;
     "no-remote": boolean;
+    rule?: string | undefined;
 }): Promise<void>;

package/dist/commands/check.js

@@ -126,20 +126,37 @@ export async function runChecks(root, opts) {
     }
     return { ok: problems.length === 0, problems };
 }
+/**
+ * `nerd check` (and its alias `nerd verify`): every gate a deploy runs, plus a check that the linked
+ * project still exists. One command, one output shape, so agents learn one thing.
+ */
 export async function check(opts) {
     const root = findProjectRoot();
-    const result = await runChecks(root, { remote: !opts["no-remote"], typecheck: !opts["no-typecheck"] });
-    if (opts.json) {
-        process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-    }
-    else if (result.ok) {
-        log.ok("All checks passed");
+    const problems = [];
+    if (!opts["no-remote"] && !opts.rule) {
+        const nerd = readNerdJson(root);
+        try {
+            await ApiClient.fromConfig().get(projectPath(nerd));
+        }
+        catch (err) {
+            problems.push(`The linked project ${nerd.org}/${nerd.project} is not reachable: ${err.message}`);
+        }
     }
+    // Loaded here, not at the top: the gates import staticChecks from this file.
+    const { runVerify } = await import("./verify.js");
+    const out = await runVerify(root, { withBuild: !opts["no-build"], stopOnFail: false, quiet: opts.json, onlyRules: opts.rule ? [opts.rule] : undefined });
+    const failed = out.results.filter((r) => r.status === "fail").length;
+    if (opts.json)
+        process.stdout.write(`${JSON.stringify({ ok: out.ok && problems.length === 0, failures: out.failures, stop: out.stop, problems }, null, 2)}\n`);
     else {
-        for (const p of result.problems)
+        for (const p of problems)
             log.warn(p);
+        if (out.ok && problems.length === 0)
+            log.ok("All gates passed");
+        const human = out.failures.filter((f) => f.audience === "human" && f.severity === "block");
+        if (human.length)
+            log.warn(`${human.length} finding(s) need a person, not the agent: ${human.map((f) => f.rule_id).join(", ")}`);
     }
-    const blocking = result.problems.filter((p) => !p.endsWith("(warning)") && !p.startsWith("Agent instruction files"));
-    if (blocking.length)
-        throw new CliError(`${blocking.length} problem(s) found`, 2);
+    if (failed || problems.length)
+        throw new CliError(failed ? `${failed} gate(s) failed. Fix what is listed above, then run nerd check again.` : problems[0], 2);
 }

package/dist/commands/deploy.js

@@ -2,7 +2,7 @@ import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { ApiClient } from "../api.js";
 import { findProjectRoot, projectPath, readNerdJson } from "../project.js";
-import { CliError, log, printJson, runOrThrow, table } from "../util.js";
+import { CliError, log, printJson, runOrThrow, table, dashboardUrl, ensureDeps } from "../util.js";
 import { runChecks } from "./check.js";
 import { BUILD_GATES, knownSecretsFrom, runGates, SOURCE_GATES } from "../gates/index.js";
 import { readDevVars } from "../project.js";
@@ -76,6 +76,7 @@ export async function deploy(opts) {
     }
     if (!opts["skip-build"]) {
         log.step("Building with vite");
+        ensureDeps(root);
         await runOrThrow("npx", ["vite", "build"], { cwd: root });
     }
     const build = readBuildOutput(root);
@@ -109,6 +110,7 @@ export async function deploy(opts) {
     if (opts.json)
         return printJson({ deployment, url: project.url, migrations: mig });
     log.ok(`Deployed ${deployment.id} (${deployment.status}) → ${project.url}`);
+    log.info(`First time? Sign up on your app at ${project.url}, then make yourself admin in the dashboard's Auth tab: ${dashboardUrl(api.apiUrl)}/app/${nerd.org}/projects/${nerd.project}/auth`);
 }
 export async function deployments(opts) {
     const nerd = readNerdJson(findProjectRoot());

package/dist/commands/dev.js

@@ -2,7 +2,7 @@ import { existsSync } from "node:fs";
 import path from "node:path";
 import { ApiClient } from "../api.js";
 import { findProjectRoot, projectPath, readDevVars, readNerdJson, writeDevVars } from "../project.js";
-import { log, run, runOrThrow } from "../util.js";
+import { log, run, runOrThrow, ensureDeps } from "../util.js";
 /** Makes sure .dev.vars carries the platform bindings for local dev, minting a dev tenant secret once. */
 export async function ensureDevVars(root) {
     const nerd = readNerdJson(root);
@@ -33,6 +33,7 @@ export async function dev(extra) {
         await runOrThrow("npx", ["wrangler", "d1", "migrations", "apply", "DB", "--local"], { cwd: root });
     }
     log.step("Starting vite dev");
+    ensureDeps(root);
     const code = await run("npx", ["vite", ...extra], { cwd: root });
     process.exitCode = code;
 }

package/dist/commands/github.d.ts

@@ -7,6 +7,7 @@ export declare function githubLink(fullName: string | undefined, opts: {
     "root-dir"?: string;
     "no-previews": boolean;
     "require-pr": boolean;
+    agent?: string;
     installation?: string;
 }): Promise<void>;
 export declare function githubUnlink(opts: {

package/dist/commands/github.js

@@ -10,9 +10,9 @@ export async function githubConnect(opts) {
 }
 export async function githubLink(fullName, opts) {
     if (!fullName)
-        throw new CliError("Usage: nerd github link owner/repo [--branch main] [--root-dir apps/web] [--no-previews] [--require-pr]");
+        throw new CliError("Usage: nerd github link owner/repo [--branch main] [--root-dir apps/web] [--no-previews] [--require-pr] [--agent @claude]");
     const nerd = readNerdJson(findProjectRoot());
-    const body = { fullName, previews: !opts["no-previews"], rootDir: opts["root-dir"] ?? "", requirePr: opts["require-pr"] };
+    const body = { fullName, previews: !opts["no-previews"], rootDir: opts["root-dir"] ?? "", requirePr: opts["require-pr"], ...(opts.agent ? { agentMention: opts.agent } : {}) };
     if (opts.branch)
         body.productionBranch = opts.branch;
     if (opts.installation)

package/dist/commands/init.js

@@ -77,8 +77,19 @@ export async function init(dir, args) {
     if (!SLUG_RE.test(slug))
         throw new CliError(`"${slug}" is not a valid project slug (lowercase letters, digits, hyphens). Pass --slug.`);
     const name = args.name ?? slug;
-    if (existsSync(root) && readdirSync(root).length > 0)
-        throw new CliError(`${root} is not empty.`);
+    if (existsSync(root) && readdirSync(root).length > 0) {
+        throw new CliError(`${root} is not empty. If an earlier \`nerd init\` stopped partway, run \`nerd link --slug ${slug}\` inside it instead; otherwise pick a new folder name.`);
+    }
+    // Everything that can fail remotely is checked before a single file is written, so a failure never
+    // leaves a half-made folder behind.
+    if (!args["no-create"]) {
+        const api = ApiClient.fromConfig(); // throws "Not logged in" with the fix
+        const me = await api.get("/v1/me");
+        if (me.orgs.length === 0)
+            throw new CliError("Your account has no organization yet. Sign in to the dashboard once, or ask the person who invited you for the link.");
+        if (args.org && !me.orgs.some((o) => o.slug === args.org))
+            throw new CliError(`You are not in an org called "${args.org}". Yours: ${me.orgs.map((o) => o.slug).join(", ")}`);
+    }
     const src = templateDir();
     log.step(`Copying template into ${root}`);
     mkdirSync(root, { recursive: true });
@@ -100,8 +111,27 @@ export async function init(dir, args) {
     }
     const description = args.describe ?? (await askDescription());
     seedDescription(root, name, description);
-    const project = await linkProject(root, { ...(args.org !== undefined ? { org: args.org } : {}), slug, name, create: !args["no-create"] });
+    let project;
+    try {
+        project = await linkProject(root, { ...(args.org !== undefined ? { org: args.org } : {}), slug, name, create: !args["no-create"] });
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        throw new CliError(`The folder is ready but the project was not created: ${reason}\nFix that, then run: cd ${dir} && nerd link --slug ${slug}${args.org ? ` --org ${args.org}` : ""}`);
+    }
+    // A repository from the first minute: deploy-on-push and the agent's commits both expect one.
+    try {
+        const { execFileSync } = await import("node:child_process");
+        if (!existsSync(path.join(root, ".git"))) {
+            execFileSync("git", ["init", "-q"], { cwd: root, stdio: "ignore" });
+            execFileSync("git", ["add", "-A"], { cwd: root, stdio: "ignore" });
+            execFileSync("git", ["commit", "-q", "-m", "Start from the nerdsystem template"], { cwd: root, stdio: "ignore" });
+        }
+    }
+    catch {
+        // git missing or not configured: fine, the person can init later
+    }
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.5";
+const SDK_VERSION = "0.0.6";

package/dist/commands/login.js

@@ -28,7 +28,7 @@ export async function login(args) {
         else {
             log.info(`Open this link in your browser and approve code ${start.userCode}:\n\n  ${start.verificationUrl}\n`);
             if (args.email)
-                log.info(`An email with the same link went to ${args.email}.`);
+                log.info(`An email went to ${args.email}: one click signs you in (creating your account if you are new) and approves.`);
             log.info("Waiting for approval…");
         }
     }

package/dist/commands/ops.d.ts

@@ -23,6 +23,7 @@ export declare function secretList(opts: {
 /** Value from the argument, or from stdin when omitted, so keys stay out of shell history. */
 export declare function secretSet(name: string | undefined, value: string | undefined, opts: {
     json: boolean;
+    previews?: boolean;
 }): Promise<void>;
 export declare function secretRemove(name: string | undefined, opts: {
     json: boolean;

package/dist/commands/ops.js

@@ -81,13 +81,13 @@ export async function secretList(opts) {
         return printJson(r);
     if (!r.secrets.length)
         return log.info("No app secrets yet. Set one with: nerd secret set STRIPE_SECRET_KEY");
-    table(r.secrets.map((s) => ({ name: s.name, updated: s.updatedAt })), ["name", "updated"]);
+    table(r.secrets.map((s) => ({ name: s.name, previews: s.scope === "all" ? "yes" : "no", updated: s.updatedAt })), ["name", "previews", "updated"]);
     log.info(`\n${r.note}`);
 }
 /** Value from the argument, or from stdin when omitted, so keys stay out of shell history. */
 export async function secretSet(name, value, opts) {
     if (!name)
-        throw new CliError("Usage: nerd secret set NAME [value]   (omit the value to read it from stdin)");
+        throw new CliError("Usage: nerd secret set NAME [value] [--previews]   (omit the value to read it from stdin; --previews also gives it to pull request previews)");
     let v = value;
     if (v === undefined) {
         if (process.stdin.isTTY)
@@ -97,7 +97,7 @@ export async function secretSet(name, value, opts) {
     if (!v)
         throw new CliError("Empty value.");
     const nerd = readNerdJson(findProjectRoot());
-    const r = await ApiClient.fromConfig().put(projectPath(nerd, `/secrets/${name}`), { value: v });
+    const r = await ApiClient.fromConfig().put(projectPath(nerd, `/secrets/${name}`), { value: v, scope: opts.previews ? "all" : "production" });
     if (opts.json)
         return printJson(r);
     log.ok(`Set ${r.secret.name}. ${r.note} For local dev, add ${name}=... to .dev.vars (never commit it).`);

package/dist/index.js

@@ -7,7 +7,6 @@ import { deploy, deployments } from "./commands/deploy.js";
 import { dev } from "./commands/dev.js";
 import { doctor } from "./commands/doctor.js";
 import { cron, health, rollback, secretList, secretRemove, secretSet, transfer, waitlist } from "./commands/ops.js";
-import { verify } from "./commands/verify.js";
 import { agentsSync } from "./commands/agents.js";
 import { billingPortal, billingShow, billingUpgrade } from "./commands/billing.js";
 import { auditExport, clientsCreate, clientsList, clientsRelease, domainsAdd, domainsList, domainsRemove, logs, membersInvite, membersList, membersRemove } from "./commands/org.js";
@@ -19,14 +18,13 @@ import { findProjectRoot } from "./project.js";
 import { CliError, log } from "./util.js";
 const HELP = `nerd — deploy apps to nerdsystem
 
-  nerd login [--email you@x.com]      Sign in: prints a link to approve in the browser (or --token nsk_...)
+  nerd login [--email you@x.com]      Sign in or sign up: prints a link to approve in the browser (--email sends it; --token nsk_... for scripts)
   nerd whoami                         Show the current user and orgs
   nerd doctor                         Check Node, pnpm, git, login, and the project
   nerd init <dir> [--org] [--name] [--describe "what it does"]   Create an app and a project for it
   nerd link --slug <project> [--org]  Link this directory to an existing or new project
   nerd dev [vite args]                Run locally (writes .dev.vars, applies local migrations)
-  nerd check                          Verify platform rules and typecheck
-  nerd verify [--no-build] [--rule id] [--json]   Run the security gates; --json gives failures the agent can fix
+  nerd check [--no-build] [--rule id] [--json]   Run every gate a deploy runs; --json gives failures the agent can fix (alias: nerd verify)
   nerd deploy [--note "what changed"] Check, build, migrate, upload. Prints the URL
   nerd rollback [deploymentId]        Re-publish the previous production bundle
   nerd cron [off|hourly|daily]        Scheduled job: the platform calls POST /api/cron
@@ -42,7 +40,7 @@ const HELP = `nerd — deploy apps to nerdsystem
   nerd secret set NAME [value]        App secret for production (c.env.NAME); value from stdin when omitted
   nerd secret list | rm NAME          Names only; values are never shown
   nerd github connect                 Install the GitHub App for this org (prints a link)
-  nerd github link owner/repo [--branch main] [--root-dir dir] [--no-previews] [--require-pr]
+  nerd github link owner/repo [--branch main] [--root-dir dir] [--no-previews] [--require-pr] [--agent @claude]
   nerd github status | unlink
   nerd builds [--limit n]             List git-triggered builds
   nerd builds show <id>               Build details and log
@@ -101,13 +99,10 @@ async function main(argv) {
         }
         case "dev":
             return dev(rest);
-        case "check": {
-            const { values } = parse({ "no-typecheck": BOOL, "no-remote": BOOL });
-            return check(values);
-        }
+        case "check":
         case "verify": {
-            const { values } = parse({ "no-build": BOOL, rule: STR });
-            return verify({ json: Boolean(values.json), "no-build": Boolean(values["no-build"]), ...(values.rule ? { rule: values.rule } : {}) });
+            const { values } = parse({ "no-build": BOOL, "no-remote": BOOL, "no-typecheck": BOOL, rule: STR });
+            return check({ json: Boolean(values.json), "no-build": Boolean(values["no-build"]), "no-remote": Boolean(values["no-remote"]), ...(values.rule ? { rule: values.rule } : {}) });
         }
         case "deploy": {
             const { values } = parse({ "skip-check": BOOL, "skip-build": BOOL, note: STR });
@@ -193,15 +188,15 @@ async function main(argv) {
         }
         case "secret": {
             const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL }, allowPositionals: true });
+            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL, previews: BOOL }, allowPositionals: true });
             const json = Boolean(values.json);
             if (sub === "set")
-                return secretSet(positionals[0], positionals[1], { json });
+                return secretSet(positionals[0], positionals[1], { json, previews: Boolean(values.previews) });
             if (sub === "rm" || sub === "remove" || sub === "delete")
                 return secretRemove(positionals[0], { json });
             if (sub === "list" || sub === "ls" || sub === undefined)
                 return secretList({ json });
-            throw new CliError("Usage: nerd secret set NAME [value] | list | rm NAME");
+            throw new CliError("Usage: nerd secret set NAME [value] [--previews] | list | rm NAME");
         }
         case "domains": {
             const [sub, ...subRest] = rest;
@@ -231,12 +226,12 @@ async function main(argv) {
         }
         case "github": {
             const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL, branch: STR, "root-dir": STR, "no-previews": BOOL, "require-pr": BOOL, installation: STR }, allowPositionals: true });
+            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL, branch: STR, "root-dir": STR, "no-previews": BOOL, "require-pr": BOOL, installation: STR, agent: STR }, allowPositionals: true });
             const json = Boolean(values.json);
             if (sub === "connect")
                 return githubConnect({ json });
             if (sub === "link")
-                return githubLink(positionals[0], { json, "no-previews": Boolean(values["no-previews"]), "require-pr": Boolean(values["require-pr"]), ...(values.branch ? { branch: values.branch } : {}), ...(values["root-dir"] ? { "root-dir": values["root-dir"] } : {}), ...(values.installation ? { installation: values.installation } : {}) });
+                return githubLink(positionals[0], { json, "no-previews": Boolean(values["no-previews"]), "require-pr": Boolean(values["require-pr"]), ...(values.agent ? { agent: String(values.agent) } : {}), ...(values.branch ? { branch: values.branch } : {}), ...(values["root-dir"] ? { "root-dir": values["root-dir"] } : {}), ...(values.installation ? { installation: values.installation } : {}) });
             if (sub === "unlink")
                 return githubUnlink({ json });
             if (sub === "status" || sub === undefined)

package/dist/util.d.ts

@@ -19,3 +19,7 @@ export declare function runOrThrow(cmd: string, args: string[], opts?: {
 }): Promise<void>;
 export declare function printJson(value: unknown): void;
 export declare function table(rows: Record<string, unknown>[], columns: string[]): void;
+/** The dashboard that goes with an API origin (https://api.nerdsystem.com -> https://nerdsystem.com). */
+export declare function dashboardUrl(apiUrl: string): string;
+/** Stops with one sentence instead of npx noise when `pnpm install` has not been run. */
+export declare function ensureDeps(root: string): void;

package/dist/util.js

@@ -1,4 +1,6 @@
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
 export class CliError extends Error {
     exitCode;
     constructor(message, exitCode = 1) {
@@ -37,3 +39,12 @@ export function table(rows, columns) {
     for (const r of rows)
         process.stdout.write(`${line(columns.map((c) => String(r[c] ?? "")))}\n`);
 }
+/** The dashboard that goes with an API origin (https://api.nerdsystem.com -> https://nerdsystem.com). */
+export function dashboardUrl(apiUrl) {
+    return apiUrl.replace(/\/$/, "").replace(/^https?:\/\/api\./, "https://");
+}
+/** Stops with one sentence instead of npx noise when `pnpm install` has not been run. */
+export function ensureDeps(root) {
+    if (!existsSync(path.join(root, "node_modules")))
+        throw new CliError(`Dependencies are not installed. Run \`pnpm install\` in ${root} first (install pnpm with \`npm install -g pnpm\` if it is missing).`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "nerd: deploy apps to nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -15,7 +15,7 @@ If this project still has the template's todo app (the `todos` table and `src/se
 2. Say what you will build first, in plain words: the one table and the one screen that make the idea real. Keep the first feature small enough to deploy within the session.
 3. Replace the todo example with that feature: schema, migration (`pnpm db:generate`), a router under `/api/...`, and the client screen. The template is a normal website: a public homepage at `/`, auth pages at `/login`, `/signup`, `/forgot-password`, `/reset-password`, and a signed-in area. Reshape it to the idea (a public landing page with sign-in in the header, a members-only area, an admin section) rather than forcing a login wall; the forms already work.
 4. Run `nerd check`, then `nerd dev`, and tell the person to open the local URL, create an account, and try it. Fix what they report.
-5. Run `nerd deploy` and give them the live URL. Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd verify` any time.
+5. Run `nerd deploy` and give them the live URL. Tell them to sign up on their own app first, then make themselves admin in the dashboard's Auth tab (the URL is printed after the deploy). Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd check` any time.
 6. Offer the next steps once, briefly: link the GitHub repo for previews on pull requests (`nerd github connect`), add a custom domain, or invite a teammate from the dashboard.
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
@@ -32,7 +32,7 @@ Run `nerd check --json` when you want a machine-readable list of problems.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Previews share the production database and do not run migrations; a PR that changes the schema will only work in full after it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -99,7 +99,9 @@ The loop: run `run_gates`, fix every failure with `audience: "agent"`, run `run_
 - `audience: "human"` means a person must act: a secret that was committed must be rotated at the provider before you remove it; an ignore comment, ignore file, or gate setting you added is a suppression that only a person can approve in the dashboard. Never add `nosemgrep`, `gitleaks:allow`, `nerd-ignore`, or a `gates` key in `nerd.json` to make a finding go away.
 - When `stop` is non-empty, the same rule has failed three runs in a row. Stop, summarize what you tried in plain words, and hand it to the person.
 
-Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rule <rule_id>` runs one rule. Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
+When a git build fails after a push, the same findings are posted back to the repository for you: as a comment on the pull request, or as a GitHub issue titled "nerdsystem refused <sha>" for a push to the production branch (`nerd builds show <id>` prints them too). Treat that text as the task: apply each fix, run the gates until clean, commit naming the rule ids, push. The issue closes itself when the next deploy succeeds. If the repository is linked with `--agent @claude` (or another handle), the post starts with that mention so a cloud agent is summoned without anyone pasting anything.
+
+Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule <rule_id>` runs one rule (`nerd verify` is the same command). Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
 
 ## What `nerd check` rejects
 
@@ -112,7 +114,7 @@ Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rul
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
 - **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (ca70e3512072); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (b1d847104ce0); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -16,7 +16,7 @@ If this project still has the template's todo app (the `todos` table and `src/se
 2. Say what you will build first, in plain words: the one table and the one screen that make the idea real. Keep the first feature small enough to deploy within the session.
 3. Replace the todo example with that feature: schema, migration (`pnpm db:generate`), a router under `/api/...`, and the client screen. The template is a normal website: a public homepage at `/`, auth pages at `/login`, `/signup`, `/forgot-password`, `/reset-password`, and a signed-in area. Reshape it to the idea (a public landing page with sign-in in the header, a members-only area, an admin section) rather than forcing a login wall; the forms already work.
 4. Run `nerd check`, then `nerd dev`, and tell the person to open the local URL, create an account, and try it. Fix what they report.
-5. Run `nerd deploy` and give them the live URL. Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd verify` any time.
+5. Run `nerd deploy` and give them the live URL. Tell them to sign up on their own app first, then make themselves admin in the dashboard's Auth tab (the URL is printed after the deploy). Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd check` any time.
 6. Offer the next steps once, briefly: link the GitHub repo for previews on pull requests (`nerd github connect`), add a custom domain, or invite a teammate from the dashboard.
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
@@ -33,7 +33,7 @@ Run `nerd check --json` when you want a machine-readable list of problems.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Previews share the production database and do not run migrations; a PR that changes the schema will only work in full after it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -100,7 +100,9 @@ The loop: run `run_gates`, fix every failure with `audience: "agent"`, run `run_
 - `audience: "human"` means a person must act: a secret that was committed must be rotated at the provider before you remove it; an ignore comment, ignore file, or gate setting you added is a suppression that only a person can approve in the dashboard. Never add `nosemgrep`, `gitleaks:allow`, `nerd-ignore`, or a `gates` key in `nerd.json` to make a finding go away.
 - When `stop` is non-empty, the same rule has failed three runs in a row. Stop, summarize what you tried in plain words, and hand it to the person.
 
-Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rule <rule_id>` runs one rule. Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
+When a git build fails after a push, the same findings are posted back to the repository for you: as a comment on the pull request, or as a GitHub issue titled "nerdsystem refused <sha>" for a push to the production branch (`nerd builds show <id>` prints them too). Treat that text as the task: apply each fix, run the gates until clean, commit naming the rule ids, push. The issue closes itself when the next deploy succeeds. If the repository is linked with `--agent @claude` (or another handle), the post starts with that mention so a cloud agent is summoned without anyone pasting anything.
+
+Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule <rule_id>` runs one rule (`nerd verify` is the same command). Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
 
 ## What `nerd check` rejects
 
@@ -113,7 +115,7 @@ Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rul
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
 - **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (ca70e3512072); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (b1d847104ce0); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -12,7 +12,7 @@ If this project still has the template's todo app (the `todos` table and `src/se
 2. Say what you will build first, in plain words: the one table and the one screen that make the idea real. Keep the first feature small enough to deploy within the session.
 3. Replace the todo example with that feature: schema, migration (`pnpm db:generate`), a router under `/api/...`, and the client screen. The template is a normal website: a public homepage at `/`, auth pages at `/login`, `/signup`, `/forgot-password`, `/reset-password`, and a signed-in area. Reshape it to the idea (a public landing page with sign-in in the header, a members-only area, an admin section) rather than forcing a login wall; the forms already work.
 4. Run `nerd check`, then `nerd dev`, and tell the person to open the local URL, create an account, and try it. Fix what they report.
-5. Run `nerd deploy` and give them the live URL. Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd verify` any time.
+5. Run `nerd deploy` and give them the live URL. Tell them to sign up on their own app first, then make themselves admin in the dashboard's Auth tab (the URL is printed after the deploy). Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd check` any time.
 6. Offer the next steps once, briefly: link the GitHub repo for previews on pull requests (`nerd github connect`), add a custom domain, or invite a teammate from the dashboard.
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
@@ -29,7 +29,7 @@ Run `nerd check --json` when you want a machine-readable list of problems.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Previews share the production database and do not run migrations; a PR that changes the schema will only work in full after it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -96,7 +96,9 @@ The loop: run `run_gates`, fix every failure with `audience: "agent"`, run `run_
 - `audience: "human"` means a person must act: a secret that was committed must be rotated at the provider before you remove it; an ignore comment, ignore file, or gate setting you added is a suppression that only a person can approve in the dashboard. Never add `nosemgrep`, `gitleaks:allow`, `nerd-ignore`, or a `gates` key in `nerd.json` to make a finding go away.
 - When `stop` is non-empty, the same rule has failed three runs in a row. Stop, summarize what you tried in plain words, and hand it to the person.
 
-Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rule <rule_id>` runs one rule. Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
+When a git build fails after a push, the same findings are posted back to the repository for you: as a comment on the pull request, or as a GitHub issue titled "nerdsystem refused <sha>" for a push to the production branch (`nerd builds show <id>` prints them too). Treat that text as the task: apply each fix, run the gates until clean, commit naming the rule ids, push. The issue closes itself when the next deploy succeeds. If the repository is linked with `--agent @claude` (or another handle), the post starts with that mention so a cloud agent is summoned without anyone pasting anything.
+
+Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule <rule_id>` runs one rule (`nerd verify` is the same command). Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
 
 ## What `nerd check` rejects
 
@@ -109,7 +111,7 @@ Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rul
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
 - **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (ca70e3512072); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (b1d847104ce0); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -12,7 +12,7 @@ If this project still has the template's todo app (the `todos` table and `src/se
 2. Say what you will build first, in plain words: the one table and the one screen that make the idea real. Keep the first feature small enough to deploy within the session.
 3. Replace the todo example with that feature: schema, migration (`pnpm db:generate`), a router under `/api/...`, and the client screen. The template is a normal website: a public homepage at `/`, auth pages at `/login`, `/signup`, `/forgot-password`, `/reset-password`, and a signed-in area. Reshape it to the idea (a public landing page with sign-in in the header, a members-only area, an admin section) rather than forcing a login wall; the forms already work.
 4. Run `nerd check`, then `nerd dev`, and tell the person to open the local URL, create an account, and try it. Fix what they report.
-5. Run `nerd deploy` and give them the live URL. Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd verify` any time.
+5. Run `nerd deploy` and give them the live URL. Tell them to sign up on their own app first, then make themselves admin in the dashboard's Auth tab (the URL is printed after the deploy). Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd check` any time.
 6. Offer the next steps once, briefly: link the GitHub repo for previews on pull requests (`nerd github connect`), add a custom domain, or invite a teammate from the dashboard.
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
@@ -29,7 +29,7 @@ Run `nerd check --json` when you want a machine-readable list of problems.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Previews share the production database and do not run migrations; a PR that changes the schema will only work in full after it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -96,7 +96,9 @@ The loop: run `run_gates`, fix every failure with `audience: "agent"`, run `run_
 - `audience: "human"` means a person must act: a secret that was committed must be rotated at the provider before you remove it; an ignore comment, ignore file, or gate setting you added is a suppression that only a person can approve in the dashboard. Never add `nosemgrep`, `gitleaks:allow`, `nerd-ignore`, or a `gates` key in `nerd.json` to make a finding go away.
 - When `stop` is non-empty, the same rule has failed three runs in a row. Stop, summarize what you tried in plain words, and hand it to the person.
 
-Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rule <rule_id>` runs one rule. Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
+When a git build fails after a push, the same findings are posted back to the repository for you: as a comment on the pull request, or as a GitHub issue titled "nerdsystem refused <sha>" for a push to the production branch (`nerd builds show <id>` prints them too). Treat that text as the task: apply each fix, run the gates until clean, commit naming the rule ids, push. The issue closes itself when the next deploy succeeds. If the repository is linked with `--agent @claude` (or another handle), the post starts with that mention so a cloud agent is summoned without anyone pasting anything.
+
+Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule <rule_id>` runs one rule (`nerd verify` is the same command). Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
 
 ## What `nerd check` rejects
 
@@ -109,7 +111,7 @@ Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rul
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
 - **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (ca70e3512072); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (b1d847104ce0); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -12,7 +12,7 @@ If this project still has the template's todo app (the `todos` table and `src/se
 2. Say what you will build first, in plain words: the one table and the one screen that make the idea real. Keep the first feature small enough to deploy within the session.
 3. Replace the todo example with that feature: schema, migration (`pnpm db:generate`), a router under `/api/...`, and the client screen. The template is a normal website: a public homepage at `/`, auth pages at `/login`, `/signup`, `/forgot-password`, `/reset-password`, and a signed-in area. Reshape it to the idea (a public landing page with sign-in in the header, a members-only area, an admin section) rather than forcing a login wall; the forms already work.
 4. Run `nerd check`, then `nerd dev`, and tell the person to open the local URL, create an account, and try it. Fix what they report.
-5. Run `nerd deploy` and give them the live URL. Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd verify` any time.
+5. Run `nerd deploy` and give them the live URL. Tell them to sign up on their own app first, then make themselves admin in the dashboard's Auth tab (the URL is printed after the deploy). Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd check` any time.
 6. Offer the next steps once, briefly: link the GitHub repo for previews on pull requests (`nerd github connect`), add a custom domain, or invite a teammate from the dashboard.
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
@@ -29,7 +29,7 @@ Run `nerd check --json` when you want a machine-readable list of problems.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Previews share the production database and do not run migrations; a PR that changes the schema will only work in full after it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -96,7 +96,9 @@ The loop: run `run_gates`, fix every failure with `audience: "agent"`, run `run_
 - `audience: "human"` means a person must act: a secret that was committed must be rotated at the provider before you remove it; an ignore comment, ignore file, or gate setting you added is a suppression that only a person can approve in the dashboard. Never add `nosemgrep`, `gitleaks:allow`, `nerd-ignore`, or a `gates` key in `nerd.json` to make a finding go away.
 - When `stop` is non-empty, the same rule has failed three runs in a row. Stop, summarize what you tried in plain words, and hand it to the person.
 
-Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rule <rule_id>` runs one rule. Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
+When a git build fails after a push, the same findings are posted back to the repository for you: as a comment on the pull request, or as a GitHub issue titled "nerdsystem refused <sha>" for a push to the production branch (`nerd builds show <id>` prints them too). Treat that text as the task: apply each fix, run the gates until clean, commit naming the rule ids, push. The issue closes itself when the next deploy succeeds. If the repository is linked with `--agent @claude` (or another handle), the post starts with that mention so a cloud agent is summoned without anyone pasting anything.
+
+Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule <rule_id>` runs one rule (`nerd verify` is the same command). Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
 
 ## What `nerd check` rejects
 
@@ -109,7 +111,7 @@ Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rul
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
 - **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production

package/template/src/client/auth.tsx

@@ -7,7 +7,7 @@ import { auth, ApiError, type User } from "./api";
 import { navigate } from "./router";
 
 // Optional bot protection on signup: set VITE_TURNSTILE_SITE_KEY (client) and NERD_TURNSTILE_SECRET
-// (server, via `nerd secrets`) from a Cloudflare Turnstile widget. Without them, signup is open.
+// (server, via `nerd secret set`) from a Cloudflare Turnstile widget. Without them, signup is open.
 const TURNSTILE_SITE_KEY = import.meta.env.VITE_TURNSTILE_SITE_KEY as string | undefined;
 
 function Turnstile({ onToken }: { onToken: (t: string) => void }) {