procedure-cli 1.3.0 → 1.5.0

package/templates/AGENTS.md.hbs

@@ -7,11 +7,11 @@ This file provides tool-agnostic instructions for AI coding agents working on th
 ## Build & Test
 
 ```bash
-{{buildCommand}}              # Build
-{{typecheckCommand}}           # Typecheck
-{{testCommand}}                # Run tests
-{{lintCommand}}                # Lint
-{{prCommand}}                  # Pre-PR checks
+{{{buildCommand}}}              # Build
+{{{typecheckCommand}}}           # Typecheck
+{{{testCommand}}}                # Run tests
+{{{lintCommand}}}                # Lint
+{{{prCommand}}}                  # Pre-PR checks
 ```
 
 Run typecheck before build. Run all checks before submitting a PR.
@@ -62,16 +62,23 @@ When a user reports a bug:
 
 ## Understanding, Planning & Approval
 
-- Always confirm the understanding in Vietnamese
-- Always present the approach based on the confirming understanding
+- Confirm understanding and present the approach in Vietnamese before implementing
+- Code, identifiers, comments, commit messages, and committed docs stay in English
 - Always wait for the user's approval on the understanding and the approach
 - Make a task after being approved
 
+## Documentation Sync
+
+- After EVERY implementation: update CLAUDE.md, README.md, and product artifacts (docs/PRD.md, docs/USER-STORIES.md) to reflect the current state
+- **AGENTS.md must always stay in sync with CLAUDE.md** — CLAUDE.md is the source of truth. After any change to CLAUDE.md, propagate relevant updates to AGENTS.md immediately
+- Architecture descriptions, step counts, component lists, and behavioral descriptions must match the actual code
+- Never leave docs describing removed features, old step numbers, or stale behavior
+
 ## Testing
 
-1. Run `{{typecheckCommand}}` — must pass with no errors
-2. Run `{{testCommand}}` — all tests must pass
-3. Run `{{lintCommand}}` — no lint violations
+1. Run `{{{typecheckCommand}}}` — must pass with no errors
+2. Run `{{{testCommand}}}` — all tests must pass
+3. Run `{{{lintCommand}}}` — no lint violations
 
 When adding new functionality, add corresponding tests. When fixing a bug, add a regression test.
 
@@ -80,7 +87,7 @@ When adding new functionality, add corresponding tests. When fixing a bug, add a
 - Keep commits focused — one logical change per commit
 - Write descriptive commit messages explaining **why**, not just what
 - After any implementation change, verify that documentation (README.md, docs/PRD.md, docs/USER-STORIES.md) still reflects the current state
-- Run `{{prCommand}}` before opening a PR
+- Run `{{{prCommand}}}` before opening a PR
 
 ## Security
 

package/templates/CLAUDE.md.hbs

@@ -7,12 +7,13 @@ See docs/PRD.md for product requirements and docs/USER-STORIES.md for user stori
 ## Build & Test
 
 ```bash
-{{buildCommand}}              # Build
-{{typecheckCommand}}           # Typecheck (fast — run first)
-{{testCommand}} -- -t "name"   # Test (specific)
-{{testCommand}}                # Test (full suite)
-{{lintCommand}}                # Lint
-{{prCommand}}                  # Before creating a PR
+{{{buildCommand}}}              # Build
+{{{typecheckCommand}}}           # Typecheck (fast — run first)
+{{{testCommandFiltered}}}   # Test (specific)
+{{{testCommand}}}                # Test (full suite)
+{{#if e2eTestCommand}}{{{e2eTestCommand}}}            # E2E tests
+{{/if}}{{{lintCommand}}}                # Lint
+{{{prCommand}}}                  # Before creating a PR
 ```
 
 ## Documentation Lookup
@@ -30,6 +31,58 @@ See docs/PRD.md for product requirements and docs/USER-STORIES.md for user stori
 
 {{{architecture}}}
 
+{{#contains techStack "Supabase"}}
+## Auth & RLS
+
+This project uses Supabase. Key rules:
+
+- **Defense in depth**: every gated mutation is checked at three layers — UI visibility, server-route helpers, and DB-level RLS policies. Never rely on a single layer.
+- **RLS-first**: every new table needs an RLS policy in the same migration. `authenticated` SELECT and owner-scoped INSERT/UPDATE/DELETE are the default; widen explicitly.
+- **Server vs client**: use `@supabase/ssr` for server components and route handlers; `@supabase/supabase-js` for client components. Never mix sessions across the boundary.
+- **Mutations must be awaited**: `supabase.from(...).update(...).eq(...)` returns a lazy thenable — a bare statement is a silent no-op. Always `await` or `.then()`.
+{{/contains}}
+{{#contains techStack "Upstash"}}
+## Rate-limiting
+
+Rate limits are enforced via Upstash Redis (`@upstash/ratelimit`). When adding a new endpoint:
+
+- Pick the right tier: public unauthenticated routes ≤ 10/min/IP, authenticated reads ≤ 600/min, mutations ≤ 120/min.
+- Fail-open if Upstash env vars are absent — never block production traffic on a missing credential.
+- Emit `security.rate_limited` audit events for tripped limits.
+{{/contains}}
+{{#contains techStack "MCP SDK"}}
+## MCP Tools
+
+This project exposes Model Context Protocol tools via `@modelcontextprotocol/sdk`. Conventions:
+
+- Tool definitions live in `src/mcp/tools/` — one file per tool, default-exporting `{ name, description, inputSchema, handler }`.
+- Server entry point in `src/mcp/server.ts` registers all tools and wires transport.
+- Document each tool's `name`, args, and side effects in this section as you add them — agents discover tools by name only.
+{{/contains}}
+{{#contains techStack "Vercel"}}
+## Deployment
+
+Deployment runbook lives in [`deployment/`](./deployment/). Single source of truth for:
+
+- Env-var matrix (`deployment/01-env-vars.md`)
+- Vercel project settings & domains (`deployment/02-vercel-checklist.md`)
+- Migration log
+- Preflight script run before infra-affecting commits
+
+Update `deployment/` **in the same commit** as any infrastructure change.
+{{else}}{{#contains techStack "Fly.io"}}
+## Deployment
+
+Deployment runbook lives in [`deployment/`](./deployment/) — Fly.io app config (`fly.toml`), env-var matrix, release commands. Update `deployment/` in the same commit as any infra change.
+{{else}}{{#contains techStack "Railway"}}
+## Deployment
+
+Deployment runbook lives in [`deployment/`](./deployment/) — Railway service config, env-var matrix, migration log. Update `deployment/` in the same commit as any infra change.
+{{else}}{{#contains techStack "Cloudflare"}}
+## Deployment
+
+Deployment runbook lives in [`deployment/`](./deployment/) — Cloudflare Workers config (`wrangler.toml`), env-var matrix, secret bindings. Update `deployment/` in the same commit as any infra change.
+{{/contains}}{{/contains}}{{/contains}}{{/contains}}
 {{#if (eq framework "Ink")}}
 ## Ink TUI Development
 
@@ -88,14 +141,15 @@ All colors accessed through `C` from `src/lib/theme.ts`. **Never hardcode hex va
 - A good plan lets you one-shot the implementation
 
 ### Understanding, Planning & Approval
-- Always confirm the understanding in Vietnamese
-- Always present the approach based on the confirming understanding
+- Confirm understanding and present the approach in Vietnamese before implementing
+- Code, identifiers, comments, commit messages, and committed docs stay in English
 - Always wait for the user's approval on the understanding and the approach
 - Make a task after being approved
 - Leverage team agents if possible
 
 ### Documentation Sync
 - After EVERY implementation: update CLAUDE.md, README.md, and product artifacts (docs/PRD.md, docs/USER-STORIES.md) to reflect the current state
+- **AGENTS.md must always stay in sync with CLAUDE.md** — CLAUDE.md is the source of truth. After any change to CLAUDE.md, propagate relevant updates to AGENTS.md immediately
 - Architecture descriptions, step counts, component lists, and behavioral descriptions must match the actual code
 - Never leave docs describing removed features, old step numbers, or stale behavior
 
@@ -176,6 +230,7 @@ When a user reports a bug:
 2. **If valid** — append a new `CR-` entry to `CODE-REVIEW.md` following the code review logging procedure (Entry ID, Scope, Validation Matrix, Findings with `file:line` evidence and severity, Verification Notes).
 3. **If not valid** — explain to the user why the reported behavior is expected or not reproducible.
 
+{{#if hasReleaseScript}}
 ## Release
 
 ```bash
@@ -190,6 +245,7 @@ The release script (`~/bin/{{projectName}}-release`) will:
 3. Bump version via `npm version`
 4. Push branch + tags to origin
 5. Publish to registry
+{{/if}}
 
 ## Core Principles
 

package/templates/deployment/00-README.md.hbs

@@ -0,0 +1,38 @@
+# Deployment — {{projectName}}
+
+Single source of truth for shipping {{projectName}} to **{{deployTarget}}**. After any infrastructure-affecting change, update the relevant file in this folder **in the same commit** as the code.
+
+## Files in this folder
+
+| File | Purpose |
+|------|---------|
+| `00-README.md` | This index — overview and update protocol |
+| `01-env-vars.md` | Env-var matrix (name, scope, source, rotation) |
+| `02-{{deployTarget}}-checklist.md` | Provider-specific deploy checklist |
+| `05-migrations.md` | DB migration log (append-only) |
+| `07-scripts/01-preflight.sh` | Local preflight: typecheck + lint + build + env audit |
+
+## Update protocol
+
+1. **Add or rename an env var** → update `01-env-vars.md`, `02-{{deployTarget}}-checklist.md`, and `.env.example` in the same commit.
+2. **New migration** → append to `05-migrations.md`. Bump any generated DB types.
+3. **New third-party integration** → add to `02-{{deployTarget}}-checklist.md` plus an integration-specific doc.
+4. **Change preflight or release scripts** → the script file itself + reference here.
+
+## Preflight
+
+Run `bash deployment/07-scripts/01-preflight.sh` before pushing infra-touching commits. It exercises typecheck, lint, build, and the env audit. CI runs the same script — if it fails locally, it will fail in CI.
+
+{{#contains techStack "Supabase"}}
+## Supabase notes
+
+- Migrations live in `supabase/migrations/` — apply with `supabase db push` against the linked project.
+- Auth URL allowlist must be updated in the Supabase dashboard whenever a new domain is added.
+- RLS policies are part of the migration file that creates the table — never enable RLS in a separate commit.
+{{/contains}}
+{{#contains techStack "Upstash"}}
+## Upstash notes
+
+- Rate-limit env vars: `UPSTASH_REDIS_REST_URL`, `UPSTASH_REDIS_REST_TOKEN`.
+- Rate-limit code is fail-open: if env vars are absent, requests pass through. Audit the `01-env-vars.md` matrix to confirm presence in every environment.
+{{/contains}}

package/templates/gitignore.hbs

@@ -9,11 +9,54 @@ dist/
 *.so
 *.dylib
 vendor/
+{{else if (eq language "Kotlin")}}
+# Android / Kotlin
+build/
+.gradle/
+local.properties
+*.iml
+.idea/
+captures/
+.cxx/
+{{else if (eq language "Dart")}}
+# Flutter / Dart
+.dart_tool/
+.flutter-plugins
+.flutter-plugins-dependencies
+.packages
+.pub-cache/
+.pub/
+build/
+ios/Pods/
+ios/.symlinks/
+android/.gradle/
+android/local.properties
+*.g.dart
+*.freezed.dart
+{{else if (eq language "Swift")}}
+# Swift / Xcode
+build/
+DerivedData/
+*.xcuserstate
+*.xcworkspace/xcuserdata/
+xcuserdata/
+.swiftpm/
+Pods/
 {{else}}
 # Node.js
 node_modules/
 dist/
 *.tsbuildinfo
+{{#if (eq framework "Ionic")}}
+# Ionic / Capacitor
+www/
+.sourcemaps/
+ios/App/Pods/
+ios/App/build/
+android/app/build/
+android/.gradle/
+android/build/
+{{/if}}
 {{/if}}
 
 # Environment

package/templates/skills/assets/CODE-FIXED.template.md

@@ -7,7 +7,7 @@
 - Each finding is referenced as `Finding #N (Severity)` matching the review's numbering.
 - Fixed findings must include `file:line` for every change made.
 - Deferred findings must include rationale and a revisit trigger.
-- Verification section must confirm `npm run typecheck` + `npm run build` status after fixes.
+- Verification section must confirm the project's typecheck + build commands (see the Build & Test section in `CLAUDE.md`) pass after fixes.
 - Language: English only. Tone: Technical, concise, action-focused.
 
 ### Entry ID Convention

package/templates/skills/b3awesome-code-fix/SKILL.md

@@ -33,7 +33,7 @@ Each entry must include:
   - `file:line` for every change made
   - Brief description of the fix
 - **Deferred**: findings not fixed, with rationale and revisit trigger
-- **Verification Notes**: must confirm `npm run typecheck` + `npm run build` status (or project equivalent) after fixes
+- **Verification Notes**: must confirm the project's typecheck + build commands (see the Build & Test section in `CLAUDE.md`) pass after fixes
 
 ## Writing Standard
 
@@ -62,7 +62,7 @@ If `CODE-FIXED.md` does not exist in the project root, create it with this heade
 - Each finding is referenced as `Finding #N (Severity)` matching the review's numbering.
 - Fixed findings must include `file:line` for every change made.
 - Deferred findings must include rationale and a revisit trigger.
-- Verification section must confirm `npm run typecheck` + `npm run build` status after fixes.
+- Verification section must confirm the project's typecheck + build commands (see Build & Test in `CLAUDE.md`) pass after fixes.
 - Language: English only. Tone: Technical, concise, action-focused.
 
 ### Entry ID Convention

package/templates/skills/b3awesome-code-review/SKILL.md

@@ -34,7 +34,7 @@ Each entry must include:
   - `file:line` evidence
   - Clear recommendation
   - `Status`: `New`, `Still Open`, `Fixed`, `Regressed`, or `Not Reproducible`
-- **Verification Notes**: `npm run typecheck` / `npm run build` status (or project equivalent)
+- **Verification Notes**: status of the project's typecheck / build commands (see the Build & Test section in `CLAUDE.md`)
 - **Residual Risks / Testing Gaps**: known untested areas
 
 ## Writing Standard