start-vibing 4.1.1 → 4.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/template/.claude/agents/sd-fix.md +91 -6
- package/template/.claude/skills/super-design/SKILL.md +6 -2
- package/template/.claude/skills/super-design/templates/fix-history.md.tpl +7 -6
- package/template/.claude/skills/super-design/templates/fix-report.md.tpl +165 -0
- package/template/.claude/config/README.md +0 -27
- package/template/.claude/config/project-config.json +0 -53
- package/template/.claude/config/quality-gates.json +0 -46
- package/template/.claude/config/security-rules.json +0 -45
- package/template/.claude/config/testing-config.json +0 -164
package/package.json
CHANGED
|
@@ -1,9 +1,30 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: sd-fix
|
|
3
|
-
description: Applies surgical fixes for super-design audit findings. Invoked when user explicitly asks for fixes after audit. Classifies risk, applies templates inline (a11y A1-A15, design V1-V8, ux U1-U10, perf P1-P10), commits per-fix with finding IDs, runs two-stage verify (technical + semantic), auto-rollback on failure.
|
|
4
|
-
tools:
|
|
3
|
+
description: Applies surgical fixes for super-design audit findings. Invoked when user explicitly asks for fixes after audit. Classifies risk, applies templates inline (a11y A1-A15, design V1-V8, ux U1-U10, perf P1-P10), commits per-fix with finding IDs, runs two-stage verify (technical + semantic), captures before/after screenshots via Playwright MCP, emits fix-report.md with visual diff, auto-rollback on failure.
|
|
4
|
+
tools:
|
|
5
|
+
- Read
|
|
6
|
+
- Edit
|
|
7
|
+
- MultiEdit
|
|
8
|
+
- Write
|
|
9
|
+
- Glob
|
|
10
|
+
- Grep
|
|
11
|
+
- Bash
|
|
12
|
+
- Task
|
|
13
|
+
- mcp__playwright__browser_navigate
|
|
14
|
+
- mcp__playwright__browser_navigate_back
|
|
15
|
+
- mcp__playwright__browser_resize
|
|
16
|
+
- mcp__playwright__browser_snapshot
|
|
17
|
+
- mcp__playwright__browser_take_screenshot
|
|
18
|
+
- mcp__playwright__browser_evaluate
|
|
19
|
+
- mcp__playwright__browser_click
|
|
20
|
+
- mcp__playwright__browser_wait_for
|
|
21
|
+
- mcp__playwright__browser_console_messages
|
|
22
|
+
- mcp__playwright__browser_install
|
|
23
|
+
- mcp__playwright__browser_close
|
|
5
24
|
model: sonnet
|
|
6
25
|
color: green
|
|
26
|
+
mcpServers:
|
|
27
|
+
- playwright
|
|
7
28
|
---
|
|
8
29
|
|
|
9
30
|
You are sd-fix — the unified fix agent. You apply templates for all four categories (a11y / design / ux / perf) inline, dispatching only to verify agents. You never auto-apply risk ≥ MEDIUM.
|
|
@@ -30,8 +51,11 @@ git rev-parse HEAD > ".super-design/sessions/$SESSION_ID/base-sha"
|
|
|
30
51
|
# Outputs
|
|
31
52
|
|
|
32
53
|
- `.super-design/sessions/<id>/fix-results.json` (append-only)
|
|
54
|
+
- `.super-design/sessions/<id>/screens/F-NNNN_after_full.png` — after-fix full-page screenshot per applied finding
|
|
55
|
+
- `.super-design/sessions/<id>/screens/F-NNNN_after_element.png` — after-fix element-cropped screenshot per applied finding
|
|
33
56
|
- Commits on `fix/<session-id>`, one per applied fix
|
|
34
|
-
- `docs/super-design/fix-
|
|
57
|
+
- `docs/super-design/sessions/<session-id>/fix-report.md` — self-contained visual diff doc with per-finding before/after images, file diffs, verification, commit SHA
|
|
58
|
+
- `docs/super-design/fix-history.md` appended (index of sessions with link to fix-report.md)
|
|
35
59
|
- Skipped HIGH → GitHub issues via `gh`
|
|
36
60
|
|
|
37
61
|
# Core workflow
|
|
@@ -46,7 +70,52 @@ For each finding in findings.json, in order:
|
|
|
46
70
|
|
|
47
71
|
4. **Apply** via Edit (single) or MultiEdit (multiple in same file). NEVER Write unless creating net-new file (e.g., new EmptyState component).
|
|
48
72
|
|
|
49
|
-
5. **Verify** — spawn `sd-fix-verify-technical` via Task. On pass, spawn `sd-fix-verify-semantic` via Task. Only if BOTH pass →
|
|
73
|
+
5. **Verify** — spawn `sd-fix-verify-technical` via Task. On pass, spawn `sd-fix-verify-semantic` via Task. Only if BOTH pass → proceed to capture-after (5.5). Either fails → `git reset --hard HEAD~1`, mark finding failed with rolled_back=true, continue.
|
|
74
|
+
|
|
75
|
+
5.5. **Capture after state** (mandatory for every applied finding — this is how the before/after report is built):
|
|
76
|
+
|
|
77
|
+
a. Ensure the app is reachable. If the dev server URL differs from `finding.page_url`, read `base_url` from `.super-design/sessions/<id>/scope.json` (written by sd-audit) and rewrite the path portion. If unreachable after 1 retry → mark `after_capture=skipped`, still commit the fix, log reason.
|
|
78
|
+
|
|
79
|
+
b. Drive Playwright MCP (sequential, not parallel):
|
|
80
|
+
```
|
|
81
|
+
mcp__playwright__browser_resize(width, height) # from finding.viewport
|
|
82
|
+
mcp__playwright__browser_navigate(url) # finding.page_url
|
|
83
|
+
mcp__playwright__browser_wait_for(text=<copy from before-snapshot>)
|
|
84
|
+
mcp__playwright__browser_evaluate(<disable-animations snippet>)
|
|
85
|
+
<dismiss cookie banners: snapshot → role=button accept/consent → click>
|
|
86
|
+
mcp__playwright__browser_console_messages(level="error") # record, don't abort
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
c. Take TWO screenshots per finding, saved under `.super-design/sessions/<id>/screens/`:
|
|
90
|
+
```
|
|
91
|
+
mcp__playwright__browser_take_screenshot({
|
|
92
|
+
fullPage: true,
|
|
93
|
+
filename: "<session_dir>/screens/F-NNNN_after_full.png"
|
|
94
|
+
})
|
|
95
|
+
```
|
|
96
|
+
Then re-snapshot to get a fresh `[ref=eNN]`, find the element by accessible name matching the original finding (use `finding.snapshot_quote` text), and:
|
|
97
|
+
```
|
|
98
|
+
mcp__playwright__browser_take_screenshot({
|
|
99
|
+
element: "<accessible-name or short description>",
|
|
100
|
+
ref: "<fresh ref from new snapshot>",
|
|
101
|
+
filename: "<session_dir>/screens/F-NNNN_after_element.png"
|
|
102
|
+
})
|
|
103
|
+
```
|
|
104
|
+
If the element no longer exists (e.g., fix removed the offending node intentionally), save a note file `screens/F-NNNN_after_element.missing.txt` with the reason and skip the element screenshot.
|
|
105
|
+
|
|
106
|
+
d. Record in fix-results.json entry:
|
|
107
|
+
```json
|
|
108
|
+
{
|
|
109
|
+
"before_full": "<path to original sd-audit full screenshot>",
|
|
110
|
+
"before_element": "<path or null — only if sd-audit captured element-level>",
|
|
111
|
+
"after_full": "screens/F-NNNN_after_full.png",
|
|
112
|
+
"after_element": "screens/F-NNNN_after_element.png" | null,
|
|
113
|
+
"after_console_errors": [...] | [],
|
|
114
|
+
"after_capture": "ok" | "skipped" | "element-missing"
|
|
115
|
+
}
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
e. Use ONE Playwright browser session for the whole Step 5.5 batch. Open at the start of the run, reuse per-finding, close with `browser_close` at the end. Never spawn parallel tabs.
|
|
50
119
|
|
|
51
120
|
6. **Commit** per fix-playbook §4.2:
|
|
52
121
|
|
|
@@ -62,7 +131,15 @@ Applied by: super-design sd-fix (<model>)
|
|
|
62
131
|
Undo: git revert <sha> (session: <SESSION_ID>)
|
|
63
132
|
```
|
|
64
133
|
|
|
65
|
-
7. **Report** — append to fix-results.json incrementally. After batch:
|
|
134
|
+
7. **Report** — append to fix-results.json incrementally. After the full batch:
|
|
135
|
+
|
|
136
|
+
a. Render `docs/super-design/sessions/<session-id>/fix-report.md` using `.claude/skills/super-design/templates/fix-report.md.tpl`. For every applied finding, embed before+after images using paths relative to the report file (copy or symlink screenshots from `.super-design/sessions/<id>/screens/` into `docs/super-design/sessions/<session-id>/screens/` so the doc is portable in git). Proposed and skipped findings list their before screenshot only.
|
|
137
|
+
|
|
138
|
+
b. Append a row to `docs/super-design/fix-history.md` using `fix-history.md.tpl`, including a link to the per-session `fix-report.md`.
|
|
139
|
+
|
|
140
|
+
c. Close the Playwright browser: `mcp__playwright__browser_close`.
|
|
141
|
+
|
|
142
|
+
d. If `--ci`, create PR via `gh` and include the fix-report.md path in the PR body.
|
|
66
143
|
|
|
67
144
|
# Template library (apply inline, don't dispatch to specialists)
|
|
68
145
|
|
|
@@ -165,6 +242,9 @@ Source of truth: `references/fix-agent-playbook.md` §7.
|
|
|
165
242
|
- Never remove `autocomplete` on login forms.
|
|
166
243
|
- Never block paste on password fields.
|
|
167
244
|
- Never change a component's exported prop surface.
|
|
245
|
+
- Never skip Step 5.5 (capture-after) for an applied fix unless the app is unreachable — in which case record `after_capture=skipped` with reason.
|
|
246
|
+
- Never fabricate after-screenshots. No real browser call → no after image.
|
|
247
|
+
- Never run Step 5.5 in parallel against the same browser tab.
|
|
168
248
|
|
|
169
249
|
# Evidence rule
|
|
170
250
|
|
|
@@ -185,7 +265,12 @@ Every applied fix MUST cite finding ID in commit message AND fix-results.json. N
|
|
|
185
265
|
- [ ] fix-results.json has entry for every finding in findings.json
|
|
186
266
|
- [ ] Applied count matches commit count on session branch
|
|
187
267
|
- [ ] Tests and types passing on tip
|
|
188
|
-
- [ ]
|
|
268
|
+
- [ ] Every applied finding has `after_full` screenshot on disk (or `after_capture=skipped` with reason)
|
|
269
|
+
- [ ] Every applied finding has `after_element` screenshot on disk OR a `.missing.txt` note (or `after_capture=skipped`)
|
|
270
|
+
- [ ] `docs/super-design/sessions/<session-id>/fix-report.md` exists and embeds before+after for every applied finding
|
|
271
|
+
- [ ] Screenshots copied into `docs/super-design/sessions/<session-id>/screens/` (portable paths)
|
|
272
|
+
- [ ] fix-history.md updated with link to fix-report.md
|
|
273
|
+
- [ ] Playwright browser closed (`browser_close`)
|
|
189
274
|
- [ ] Proposals persisted as patch files under proposals/
|
|
190
275
|
- [ ] Skipped HIGH linked to GitHub issues
|
|
191
276
|
|
|
@@ -8,7 +8,7 @@ description: >
|
|
|
8
8
|
UX audit (WCAG 2.2 AA, Nielsen heuristics, Baymard, CWV), and synthesized
|
|
9
9
|
overview. Re-audits only what changed since last run. On explicit user request,
|
|
10
10
|
applies surgical fixes with full rollback.
|
|
11
|
-
version: 0.
|
|
11
|
+
version: 0.5.0
|
|
12
12
|
---
|
|
13
13
|
|
|
14
14
|
# super-design
|
|
@@ -25,7 +25,11 @@ Four-phase pipeline with 6 specialist agents:
|
|
|
25
25
|
3. **Synthesis** (sd-synthesis) — unifies research + audit into overview.md.
|
|
26
26
|
4. **Fix** (sd-fix + two-stage verify) — optional. Applies safe fixes with
|
|
27
27
|
technical gates (types/lint/tests) AND semantic verification ("does this
|
|
28
|
-
fix actually resolve the finding, or just mask it?").
|
|
28
|
+
fix actually resolve the finding, or just mask it?"). After each successful
|
|
29
|
+
fix, re-drives Playwright to capture an after-screenshot (full page +
|
|
30
|
+
element crop) and emits `docs/super-design/sessions/<id>/fix-report.md`:
|
|
31
|
+
a self-contained visual diff with before/after images, file diffs,
|
|
32
|
+
verification status, and commit SHA per finding.
|
|
29
33
|
|
|
30
34
|
## Entry flow
|
|
31
35
|
|
|
@@ -2,15 +2,16 @@
|
|
|
2
2
|
|
|
3
3
|
**Counts:** Applied {{applied}} · Proposed {{proposed}} · Skipped {{skipped}} · Failed {{failed}}
|
|
4
4
|
**Base:** `{{base_sha}}` · **Tip:** `{{tip_sha}}`
|
|
5
|
+
**Visual report:** [`sessions/{{session_id}}/fix-report.md`](./sessions/{{session_id}}/fix-report.md) — before/after screenshots per finding
|
|
5
6
|
|
|
6
7
|
### Applied
|
|
7
|
-
| Finding | Category | Files | Commit |
|
|
8
|
-
|
|
8
|
+
| Finding | Category | Files | Commit | Before/After |
|
|
9
|
+
|---|---|---|---|---|
|
|
9
10
|
{{applied_table}}
|
|
10
11
|
|
|
11
12
|
### Proposed (awaiting approval)
|
|
12
|
-
| Finding | Category | Files | Patch |
|
|
13
|
-
|
|
13
|
+
| Finding | Category | Files | Patch | Before |
|
|
14
|
+
|---|---|---|---|---|
|
|
14
15
|
{{proposed_table}}
|
|
15
16
|
|
|
16
17
|
### Skipped (HIGH risk — tracked as issues)
|
|
@@ -19,8 +20,8 @@
|
|
|
19
20
|
{{skipped_table}}
|
|
20
21
|
|
|
21
22
|
### Failed (rolled back)
|
|
22
|
-
| Finding | Gate | Reason |
|
|
23
|
-
|
|
23
|
+
| Finding | Gate | Reason | Before |
|
|
24
|
+
|---|---|---|---|
|
|
24
25
|
{{failed_table}}
|
|
25
26
|
|
|
26
27
|
---
|
|
@@ -0,0 +1,165 @@
|
|
|
1
|
+
# Fix report — `{{session_id}}`
|
|
2
|
+
|
|
3
|
+
**Date:** {{session_date}}
|
|
4
|
+
**Branch:** `{{branch}}`
|
|
5
|
+
**Base:** `{{base_sha}}` · **Tip:** `{{tip_sha}}`
|
|
6
|
+
**Audit source:** [`findings.json`](../../../.super-design/sessions/{{session_id}}/findings.json)
|
|
7
|
+
|
|
8
|
+
## Summary
|
|
9
|
+
|
|
10
|
+
| Status | Count |
|
|
11
|
+
|---|---|
|
|
12
|
+
| Applied | {{applied}} |
|
|
13
|
+
| Proposed (awaiting approval) | {{proposed}} |
|
|
14
|
+
| Skipped (HIGH risk → issues) | {{skipped}} |
|
|
15
|
+
| Failed (rolled back) | {{failed}} |
|
|
16
|
+
|
|
17
|
+
---
|
|
18
|
+
|
|
19
|
+
## Applied fixes — before / after
|
|
20
|
+
|
|
21
|
+
{{#each applied_findings}}
|
|
22
|
+
### {{id}} — {{rule}}{{#if wcag_criterion}} · WCAG {{wcag_criterion}}{{/if}}{{#if nielsen_heuristic}} · Nielsen H{{nielsen_heuristic}}{{/if}}
|
|
23
|
+
|
|
24
|
+
- **Page:** `{{page_url}}` · **Viewport:** {{viewport}}
|
|
25
|
+
- **Severity:** {{severity}}/4 · **Risk:** {{risk_for_fix}} · **Template:** `{{template_id}}`
|
|
26
|
+
- **Commit:** [`{{commit_sha_short}}`]({{commit_url}}) — `{{commit_subject}}`
|
|
27
|
+
- **Verification:** technical {{technical_result}} · semantic {{semantic_result}}
|
|
28
|
+
|
|
29
|
+
**Problem**
|
|
30
|
+
|
|
31
|
+
{{finding}}
|
|
32
|
+
|
|
33
|
+
**Evidence quote (from audit snapshot):**
|
|
34
|
+
|
|
35
|
+
```
|
|
36
|
+
{{snapshot_quote}}
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
**Before**
|
|
40
|
+
|
|
41
|
+
Full page:
|
|
42
|
+
|
|
43
|
+

|
|
44
|
+
|
|
45
|
+
{{#if before_element}}
|
|
46
|
+
Element:
|
|
47
|
+
|
|
48
|
+

|
|
49
|
+
{{/if}}
|
|
50
|
+
|
|
51
|
+
**After**
|
|
52
|
+
|
|
53
|
+
Full page:
|
|
54
|
+
|
|
55
|
+

|
|
56
|
+
|
|
57
|
+
{{#if after_element}}
|
|
58
|
+
Element:
|
|
59
|
+
|
|
60
|
+

|
|
61
|
+
{{else if after_element_missing_reason}}
|
|
62
|
+
_Element screenshot skipped: {{after_element_missing_reason}}_
|
|
63
|
+
{{/if}}
|
|
64
|
+
|
|
65
|
+
**What changed**
|
|
66
|
+
|
|
67
|
+
```diff
|
|
68
|
+
{{file_diff_summary}}
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
Files touched:
|
|
72
|
+
{{#each files_affected}}
|
|
73
|
+
- `{{this}}`
|
|
74
|
+
{{/each}}
|
|
75
|
+
|
|
76
|
+
{{#if after_console_errors}}
|
|
77
|
+
**Console errors after fix:** {{after_console_errors.length}} — see `fix-results.json` for verbatim.
|
|
78
|
+
{{/if}}
|
|
79
|
+
|
|
80
|
+
---
|
|
81
|
+
|
|
82
|
+
{{/each}}
|
|
83
|
+
|
|
84
|
+
{{#if proposed_findings.length}}
|
|
85
|
+
## Proposed fixes (awaiting approval)
|
|
86
|
+
|
|
87
|
+
Before-only evidence is shown because these are not yet applied.
|
|
88
|
+
|
|
89
|
+
{{#each proposed_findings}}
|
|
90
|
+
### {{id}} — {{rule}}
|
|
91
|
+
|
|
92
|
+
- **Page:** `{{page_url}}` · **Viewport:** {{viewport}}
|
|
93
|
+
- **Severity:** {{severity}}/4 · **Risk:** {{risk_for_fix}}
|
|
94
|
+
- **Patch:** [`proposals/{{id}}.patch`](../../../.super-design/sessions/{{session_id}}/proposals/{{id}}.patch)
|
|
95
|
+
|
|
96
|
+
**Problem**
|
|
97
|
+
|
|
98
|
+
{{finding}}
|
|
99
|
+
|
|
100
|
+
**Before**
|
|
101
|
+
|
|
102
|
+

|
|
103
|
+
|
|
104
|
+
**Proposed change**
|
|
105
|
+
|
|
106
|
+
```diff
|
|
107
|
+
{{proposed_diff}}
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
---
|
|
111
|
+
|
|
112
|
+
{{/each}}
|
|
113
|
+
{{/if}}
|
|
114
|
+
|
|
115
|
+
{{#if skipped_findings.length}}
|
|
116
|
+
## Skipped (HIGH risk — tracked as issues)
|
|
117
|
+
|
|
118
|
+
{{#each skipped_findings}}
|
|
119
|
+
- **{{id}}** · {{rule}} · `{{page_url}}` · Issue [#{{issue_number}}]({{issue_url}}) — {{skip_reason}}
|
|
120
|
+
{{/each}}
|
|
121
|
+
|
|
122
|
+
{{/if}}
|
|
123
|
+
|
|
124
|
+
{{#if failed_findings.length}}
|
|
125
|
+
## Failed (rolled back)
|
|
126
|
+
|
|
127
|
+
{{#each failed_findings}}
|
|
128
|
+
### {{id}} — {{rule}}
|
|
129
|
+
|
|
130
|
+
- **Failed gate:** {{failed_gate}} ({{gate_reason}})
|
|
131
|
+
- **Rolled back:** yes · **Commit sha:** none (reset before commit)
|
|
132
|
+
|
|
133
|
+
**Before**
|
|
134
|
+
|
|
135
|
+

|
|
136
|
+
|
|
137
|
+
**Attempted change (reverted)**
|
|
138
|
+
|
|
139
|
+
```diff
|
|
140
|
+
{{attempted_diff}}
|
|
141
|
+
```
|
|
142
|
+
|
|
143
|
+
---
|
|
144
|
+
|
|
145
|
+
{{/each}}
|
|
146
|
+
{{/if}}
|
|
147
|
+
|
|
148
|
+
## Reproduce locally
|
|
149
|
+
|
|
150
|
+
```bash
|
|
151
|
+
git switch fix/{{session_id}}
|
|
152
|
+
git log --oneline {{base_sha}}..HEAD
|
|
153
|
+
git diff {{base_sha}}..HEAD -- <file>
|
|
154
|
+
```
|
|
155
|
+
|
|
156
|
+
Re-run audit to confirm findings cleared:
|
|
157
|
+
|
|
158
|
+
```bash
|
|
159
|
+
# From repo root
|
|
160
|
+
super-design --scope <page_url>
|
|
161
|
+
```
|
|
162
|
+
|
|
163
|
+
---
|
|
164
|
+
|
|
165
|
+
_Generated by `sd-fix` using `fix-report.md.tpl`. Screenshots captured via Playwright MCP at the same viewport as the original audit._
|
|
@@ -1,27 +0,0 @@
|
|
|
1
|
-
# Project Configuration
|
|
2
|
-
|
|
3
|
-
This directory contains project-specific configuration files that agents and skills read to adapt their behavior to your project.
|
|
4
|
-
|
|
5
|
-
## Files
|
|
6
|
-
|
|
7
|
-
| File | Purpose |
|
|
8
|
-
| --------------------- | ------------------------------------------------------- |
|
|
9
|
-
| `project-config.json` | Main project configuration (stack, structure, commands) |
|
|
10
|
-
| `quality-gates.json` | Quality check commands |
|
|
11
|
-
| `testing-config.json` | Testing framework and conventions |
|
|
12
|
-
| `security-rules.json` | Security audit rules |
|
|
13
|
-
|
|
14
|
-
## How Agents and Skills Use These
|
|
15
|
-
|
|
16
|
-
1. **tester-unit** agent - Reads `testing-config.json` for frameworks and conventions
|
|
17
|
-
2. **commit-manager** agent - Reads `project-config.json` for commit conventions
|
|
18
|
-
3. **quality-gate** skill - Reads `quality-gates.json` for commands
|
|
19
|
-
4. **security-scan** skill - Reads `security-rules.json` for security patterns
|
|
20
|
-
|
|
21
|
-
## Customizing for Your Project
|
|
22
|
-
|
|
23
|
-
1. Update `project-config.json` with your stack and commands
|
|
24
|
-
2. Update `testing-config.json` with your test conventions
|
|
25
|
-
3. Update `security-rules.json` with your auth framework
|
|
26
|
-
|
|
27
|
-
The agents and skills will automatically adapt to your configuration.
|
|
@@ -1,53 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
3
|
-
"$comment": "Project-specific configuration. Agents read this to adapt to your project.",
|
|
4
|
-
|
|
5
|
-
"stack": {
|
|
6
|
-
"runtime": "bun",
|
|
7
|
-
"language": "typescript",
|
|
8
|
-
"strictMode": true,
|
|
9
|
-
"database": "mongodb",
|
|
10
|
-
"orm": "mongoose",
|
|
11
|
-
"validation": "zod",
|
|
12
|
-
"container": "docker"
|
|
13
|
-
},
|
|
14
|
-
|
|
15
|
-
"structure": {
|
|
16
|
-
"apps": "apps/",
|
|
17
|
-
"shared": "common/",
|
|
18
|
-
"types": "types/",
|
|
19
|
-
"tests": "tests/",
|
|
20
|
-
"docs": "docs/"
|
|
21
|
-
},
|
|
22
|
-
|
|
23
|
-
"pathAliases": {
|
|
24
|
-
"$types/*": "./types/*",
|
|
25
|
-
"@common/*": "./common/*",
|
|
26
|
-
"@common": "./common/index.ts",
|
|
27
|
-
"@db/*": "./common/db/*",
|
|
28
|
-
"@db": "./common/db/index.ts",
|
|
29
|
-
"@apps/*": "./apps/*"
|
|
30
|
-
},
|
|
31
|
-
|
|
32
|
-
"commands": {
|
|
33
|
-
"typecheck": "bun run typecheck",
|
|
34
|
-
"lint": "bun run lint",
|
|
35
|
-
"test": "bun run test",
|
|
36
|
-
"testE2e": "bun run test:e2e",
|
|
37
|
-
"build": "bun run build",
|
|
38
|
-
"dev": "bun run dev",
|
|
39
|
-
"dockerBuild": "docker compose build",
|
|
40
|
-
"dockerUp": "docker compose up"
|
|
41
|
-
},
|
|
42
|
-
|
|
43
|
-
"conventions": {
|
|
44
|
-
"branchPrefix": {
|
|
45
|
-
"feature": "feature/",
|
|
46
|
-
"bugfix": "fix/",
|
|
47
|
-
"refactor": "refactor/"
|
|
48
|
-
},
|
|
49
|
-
"commitFormat": "conventional",
|
|
50
|
-
"typesLocation": "types/",
|
|
51
|
-
"noTypesInSrc": true
|
|
52
|
-
}
|
|
53
|
-
}
|
|
@@ -1,46 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"$comment": "Quality gate commands. Agents use these to run checks.",
|
|
3
|
-
|
|
4
|
-
"gates": {
|
|
5
|
-
"typecheck": {
|
|
6
|
-
"command": "bun run typecheck",
|
|
7
|
-
"description": "TypeScript type checking",
|
|
8
|
-
"required": true,
|
|
9
|
-
"order": 1
|
|
10
|
-
},
|
|
11
|
-
"lint": {
|
|
12
|
-
"command": "bun run lint",
|
|
13
|
-
"description": "ESLint code linting",
|
|
14
|
-
"required": true,
|
|
15
|
-
"order": 2
|
|
16
|
-
},
|
|
17
|
-
"unitTests": {
|
|
18
|
-
"command": "bun run test",
|
|
19
|
-
"description": "Unit tests with Vitest",
|
|
20
|
-
"required": true,
|
|
21
|
-
"order": 3
|
|
22
|
-
},
|
|
23
|
-
"e2eTests": {
|
|
24
|
-
"command": "bun run test:e2e",
|
|
25
|
-
"description": "E2E tests with Playwright",
|
|
26
|
-
"required": false,
|
|
27
|
-
"order": 4
|
|
28
|
-
},
|
|
29
|
-
"build": {
|
|
30
|
-
"command": "bun run build",
|
|
31
|
-
"description": "Production build",
|
|
32
|
-
"required": true,
|
|
33
|
-
"order": 5
|
|
34
|
-
},
|
|
35
|
-
"dockerBuild": {
|
|
36
|
-
"command": "docker compose build",
|
|
37
|
-
"description": "Docker image build",
|
|
38
|
-
"required": false,
|
|
39
|
-
"order": 6
|
|
40
|
-
}
|
|
41
|
-
},
|
|
42
|
-
|
|
43
|
-
"runAll": "bun run typecheck && bun run lint && bun run test && bun run build",
|
|
44
|
-
|
|
45
|
-
"skipGatesForTypes": ["config", "docs"]
|
|
46
|
-
}
|
|
@@ -1,45 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"$comment": "Security rules. Used by security-auditor agent.",
|
|
3
|
-
|
|
4
|
-
"authentication": {
|
|
5
|
-
"framework": "session-based",
|
|
6
|
-
"userIdSource": "ctx.user._id",
|
|
7
|
-
"protectedProcedure": "protectedProcedure",
|
|
8
|
-
"sessionStore": "mongodb"
|
|
9
|
-
},
|
|
10
|
-
|
|
11
|
-
"validation": {
|
|
12
|
-
"library": "zod",
|
|
13
|
-
"requireOnAllRoutes": true
|
|
14
|
-
},
|
|
15
|
-
|
|
16
|
-
"sensitivePatterns": {
|
|
17
|
-
"forbidden": [
|
|
18
|
-
"input.userId",
|
|
19
|
-
"input.user_id",
|
|
20
|
-
"req.body.userId",
|
|
21
|
-
"passwordHash",
|
|
22
|
-
"password:"
|
|
23
|
-
],
|
|
24
|
-
"files": ["auth/", "api/", "server/", "routers/"]
|
|
25
|
-
},
|
|
26
|
-
|
|
27
|
-
"cryptography": {
|
|
28
|
-
"passwordHashing": "bcrypt",
|
|
29
|
-
"minSaltRounds": 10,
|
|
30
|
-
"tokenGeneration": "crypto.randomBytes"
|
|
31
|
-
},
|
|
32
|
-
|
|
33
|
-
"cookies": {
|
|
34
|
-
"httpOnly": true,
|
|
35
|
-
"secure": true,
|
|
36
|
-
"sameSite": "strict"
|
|
37
|
-
},
|
|
38
|
-
|
|
39
|
-
"owaspChecks": {
|
|
40
|
-
"a01_brokenAccessControl": true,
|
|
41
|
-
"a02_cryptographicFailures": true,
|
|
42
|
-
"a03_injection": true,
|
|
43
|
-
"a07_authenticationFailures": true
|
|
44
|
-
}
|
|
45
|
-
}
|
|
@@ -1,164 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"$comment": "Testing configuration. Used by tester agent.",
|
|
3
|
-
|
|
4
|
-
"framework": {
|
|
5
|
-
"unit": "vitest",
|
|
6
|
-
"e2e": "playwright",
|
|
7
|
-
"version": "1.40+"
|
|
8
|
-
},
|
|
9
|
-
|
|
10
|
-
"paths": {
|
|
11
|
-
"unitTests": "tests/unit/*.test.ts",
|
|
12
|
-
"e2eTests": "tests/e2e/**/*.spec.ts",
|
|
13
|
-
"fixtures": "tests/e2e/fixtures/",
|
|
14
|
-
"pages": "tests/e2e/pages/",
|
|
15
|
-
"flows": "tests/e2e/flows/",
|
|
16
|
-
"api": "tests/e2e/api/",
|
|
17
|
-
"authState": "tests/e2e/.auth/"
|
|
18
|
-
},
|
|
19
|
-
|
|
20
|
-
"viewports": {
|
|
21
|
-
"desktop": {
|
|
22
|
-
"device": "Desktop Chrome",
|
|
23
|
-
"width": 1280,
|
|
24
|
-
"height": 800,
|
|
25
|
-
"required": true
|
|
26
|
-
},
|
|
27
|
-
"tablet": {
|
|
28
|
-
"device": "iPad",
|
|
29
|
-
"width": 768,
|
|
30
|
-
"height": 1024,
|
|
31
|
-
"required": true
|
|
32
|
-
},
|
|
33
|
-
"mobile": {
|
|
34
|
-
"device": "iPhone SE",
|
|
35
|
-
"width": 375,
|
|
36
|
-
"height": 667,
|
|
37
|
-
"required": true
|
|
38
|
-
},
|
|
39
|
-
"mobileLarge": {
|
|
40
|
-
"device": "iPhone 14",
|
|
41
|
-
"width": 390,
|
|
42
|
-
"height": 844,
|
|
43
|
-
"required": false
|
|
44
|
-
}
|
|
45
|
-
},
|
|
46
|
-
|
|
47
|
-
"auth": {
|
|
48
|
-
"storageStatePath": "tests/e2e/.auth/user.json",
|
|
49
|
-
"loginPage": "/auth/login",
|
|
50
|
-
"registerPage": "/auth/register",
|
|
51
|
-
"protectedPrefix": "/app",
|
|
52
|
-
"setupProject": "setup",
|
|
53
|
-
"reuseSession": true
|
|
54
|
-
},
|
|
55
|
-
|
|
56
|
-
"database": {
|
|
57
|
-
"type": "mongodb",
|
|
58
|
-
"testConnectionEnv": "MONGODB_URI",
|
|
59
|
-
"cleanupStrategy": "fixture-tracking",
|
|
60
|
-
"verifyAfterActions": true
|
|
61
|
-
},
|
|
62
|
-
|
|
63
|
-
"cleanup": {
|
|
64
|
-
"strategy": "fixture-based",
|
|
65
|
-
"trackCreatedIds": true,
|
|
66
|
-
"deleteOnlyTracked": true,
|
|
67
|
-
"cleanupOnFailure": true,
|
|
68
|
-
"collections": ["users", "items", "sessions"]
|
|
69
|
-
},
|
|
70
|
-
|
|
71
|
-
"dataTestIds": {
|
|
72
|
-
"form": {
|
|
73
|
-
"nameInput": "name-input",
|
|
74
|
-
"emailInput": "email-input",
|
|
75
|
-
"passwordInput": "password-input",
|
|
76
|
-
"confirmPasswordInput": "confirm-password-input",
|
|
77
|
-
"submitButton": "submit-button"
|
|
78
|
-
},
|
|
79
|
-
"feedback": {
|
|
80
|
-
"errorMessage": "error-message",
|
|
81
|
-
"successMessage": "success-message",
|
|
82
|
-
"loadingSpinner": "loading-spinner"
|
|
83
|
-
},
|
|
84
|
-
"navigation": {
|
|
85
|
-
"sidebar": "sidebar",
|
|
86
|
-
"hamburgerMenu": "hamburger-menu",
|
|
87
|
-
"mobileNav": "mobile-nav",
|
|
88
|
-
"logoutButton": "logout-button"
|
|
89
|
-
},
|
|
90
|
-
"actions": {
|
|
91
|
-
"deleteButton": "delete-button",
|
|
92
|
-
"editButton": "edit-button",
|
|
93
|
-
"confirmDelete": "confirm-delete",
|
|
94
|
-
"cancelButton": "cancel-button"
|
|
95
|
-
}
|
|
96
|
-
},
|
|
97
|
-
|
|
98
|
-
"api": {
|
|
99
|
-
"rest": {
|
|
100
|
-
"baseUrl": "/api",
|
|
101
|
-
"authEndpoint": "/api/auth/login",
|
|
102
|
-
"validateInput": true,
|
|
103
|
-
"requireAuth": true
|
|
104
|
-
},
|
|
105
|
-
"trpc": {
|
|
106
|
-
"baseUrl": "/api/trpc",
|
|
107
|
-
"batchEnabled": true,
|
|
108
|
-
"validateInput": true
|
|
109
|
-
}
|
|
110
|
-
},
|
|
111
|
-
|
|
112
|
-
"security": {
|
|
113
|
-
"testForbiddenRequests": true,
|
|
114
|
-
"testRateLimiting": true,
|
|
115
|
-
"testCrossUserAccess": true,
|
|
116
|
-
"testUnauthenticated": true,
|
|
117
|
-
"expectedForbiddenStatus": 403,
|
|
118
|
-
"expectedUnauthorizedStatus": 401,
|
|
119
|
-
"expectedRateLimitStatus": 429
|
|
120
|
-
},
|
|
121
|
-
|
|
122
|
-
"flows": {
|
|
123
|
-
"required": [
|
|
124
|
-
"registration",
|
|
125
|
-
"login",
|
|
126
|
-
"logout",
|
|
127
|
-
"crud-create",
|
|
128
|
-
"crud-read",
|
|
129
|
-
"crud-update",
|
|
130
|
-
"crud-delete",
|
|
131
|
-
"permissions"
|
|
132
|
-
],
|
|
133
|
-
"optional": ["password-reset", "email-verification", "profile-update"]
|
|
134
|
-
},
|
|
135
|
-
|
|
136
|
-
"commands": {
|
|
137
|
-
"install": "bun add -D @playwright/test && bunx playwright install",
|
|
138
|
-
"run": "bunx playwright test",
|
|
139
|
-
"runUi": "bunx playwright test --ui",
|
|
140
|
-
"runHeaded": "bunx playwright test --headed",
|
|
141
|
-
"runMobile": "bunx playwright test --project='iPhone SE'",
|
|
142
|
-
"debug": "bunx playwright test --debug",
|
|
143
|
-
"report": "bunx playwright show-report",
|
|
144
|
-
"codegen": "bunx playwright codegen"
|
|
145
|
-
},
|
|
146
|
-
|
|
147
|
-
"rules": {
|
|
148
|
-
"noSkip": true,
|
|
149
|
-
"noMockAuth": true,
|
|
150
|
-
"requireCleanup": true,
|
|
151
|
-
"requireDbValidation": true,
|
|
152
|
-
"requireViewportTests": true,
|
|
153
|
-
"requireDataTestId": true,
|
|
154
|
-
"uniqueTestData": true,
|
|
155
|
-
"timestampEmails": true
|
|
156
|
-
},
|
|
157
|
-
|
|
158
|
-
"reporting": {
|
|
159
|
-
"trace": "on-first-retry",
|
|
160
|
-
"screenshot": "only-on-failure",
|
|
161
|
-
"video": "retain-on-failure",
|
|
162
|
-
"outputFolder": "test-results"
|
|
163
|
-
}
|
|
164
|
-
}
|