start-vibing 2.0.27 → 2.0.28

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "start-vibing",
-	"version": "2.0.27",
+	"version": "2.0.28",
 	"description": "Setup Claude Code agents, skills, and hooks in your project. Smart copy that preserves your custom domains and configurations.",
 	"type": "module",
 	"bin": {

package/template/.claude/CLAUDE.md

@@ -113,6 +113,80 @@ Project-specific settings are in `.claude/config/`:
 
 ---
 
+## HTTP Requests (MANDATORY)
+
+All HTTP requests MUST use **axios** with proper configuration.
+
+### Base Setup
+
+```typescript
+// lib/api/axios.ts - Create a configured axios instance
+import axios from 'axios';
+
+export const api = axios.create({
+  baseURL: process.env.NEXT_PUBLIC_API_URL || '/api',
+  withCredentials: true, // ALWAYS for auth cookies/sessions
+  headers: {
+    'Content-Type': 'application/json',
+  },
+});
+
+// Request interceptor for auth tokens
+api.interceptors.request.use((config) => {
+  const token = localStorage.getItem('token');
+  if (token) {
+    config.headers.Authorization = `Bearer ${token}`;
+  }
+  return config;
+});
+
+// Response interceptor for error handling
+api.interceptors.response.use(
+  (response) => response,
+  (error) => {
+    if (error.response?.status === 401) {
+      // Handle unauthorized
+    }
+    return Promise.reject(error);
+  }
+);
+```
+
+### Usage Rules
+
+| Rule | Description |
+|------|-------------|
+| ALWAYS use `api` instance | Never raw `axios.get()` or `fetch()` |
+| ALWAYS `withCredentials: true` | Required for cookies/sessions |
+| Extend for specific APIs | Create `api.auth`, `api.payments`, etc. |
+| Type responses | `api.get<UserResponse>('/users')` |
+| Handle errors centrally | Use interceptors, not try/catch everywhere |
+
+### When to Create API Wrapper
+
+```typescript
+// If you call the same endpoint multiple times, create a wrapper:
+// lib/api/users.ts
+export const usersApi = {
+  getAll: () => api.get<User[]>('/users'),
+  getById: (id: string) => api.get<User>(`/users/${id}`),
+  create: (data: CreateUser) => api.post<User>('/users', data),
+  update: (id: string, data: UpdateUser) => api.patch<User>(`/users/${id}`, data),
+  delete: (id: string) => api.delete(`/users/${id}`),
+};
+```
+
+### FORBIDDEN
+
+| Don't | Do Instead |
+|-------|------------|
+| `fetch('/api/...')` | `api.get('/...')` |
+| `axios.get(...)` | `api.get(...)` |
+| `withCredentials: false` | Always `true` |
+| Inline error handling | Use interceptors |
+
+---
+
 ## VETO Power Agents
 
 These agents CAN and MUST stop the flow if rules are violated: