vibecoding-devtools 1.0.1

package/templates/AGENTS.md

@@ -0,0 +1,68 @@
+<!--
+AGENTS.md template from vibecoding-devtools. Copy to the project root, fill in <...> and delete what does not apply,
+including this comment. Claude Code, Codex and Antigravity read this file; the project's CLAUDE.md contains only
+`@AGENTS.md`.
+
+Limits: Codex reads at most 32 KiB across all AGENTS.md files, and Claude Code recommends fewer than 200 lines. This
+file is a routing table: always applicable content stays here, in a few lines; the rest lives in separate files and
+goes into the "Before starting" table.
+-->
+
+# <Project name>
+
+<One or two sentences: what the system does and for whom.>
+
+## Map
+
+| App or folder | Role | Stack | README |
+|---|---|---|---|
+| `<apps/api>` | <public API> | <Python 3.13, FastAPI> | `<apps/api/README.md>` |
+| `<apps/web>` | <web dashboard> | <TypeScript, Next.js> | `<apps/web/README.md>` |
+
+- **Boundaries:** <who can call whom; what one app never imports from another>.
+- **External integrations:** <service → client folder → official documentation in `docs/vendor/<service>`>.
+
+## Commands
+
+| For | Command |
+|---|---|
+| Install dependencies | `<pnpm install>` |
+| Run locally | `<pnpm dev>` |
+| Lint and typecheck | `<pnpm lint && pnpm typecheck>` |
+| Tests for a path | `<pnpm test -- path>` |
+| Build | `<pnpm build>` |
+
+Locally, run only tests for what you changed; CI runs the full suite.
+
+## Risk map
+
+Overrides the generic list in the `risk-process` rule. The riskiest file in the change determines the level.
+
+| Level | Paths |
+|---|---|
+| **High** | `<apps/api/payments/**>`, `<apps/api/auth/**>`, `<migrations/**>`, `<.github/workflows/**>`, `<infra/**>` |
+| **Medium** | `<apps/*/src/**>` outside High-risk paths |
+| **Low** | `<docs/**>`, `<**/*.md>`, `<public/**>` |
+
+Critical areas with a higher coverage floor: <list or write "none">.
+
+## Before starting
+
+| If the task involves | Read or use |
+|---|---|
+| Any coding task | the `risk-triage` skill |
+| High risk | the `security-surfaces` skill, only touched surfaces |
+| <Integration with service X> | `<docs/vendor/x/README.md>` |
+| <Visual interface> | <project design skill> |
+
+## Project rules
+
+Always apply and override generic kit and third-party (ECC) rules. Only what is specific to this project:
+
+- <Example: all amounts in cents, type `Money`; never `float`.>
+- <Example: interface text in pt-BR, code and commits in English.>
+
+## Done
+
+- <Project criterion beyond green CI, for example: migration tested on a database with data.>
+- If an app's structure, role or flow changes, update its README in the same commit.

package/templates/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/coderabbit.yaml

@@ -0,0 +1,127 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+#
+# .coderabbit.yaml template (copy to the repository root and adjust the TODOs).
+# Reference: https://docs.coderabbit.ai/reference/configuration
+# Problem solved: noisy reviews (poems, diagrams, test suggestions to raise coverage) and enforcing generic rules
+# the project has replaced. Cost avoided: PR cycles spent on low-value comments.
+
+language: en-US
+tone_instructions: >-
+  Objective technical reviewer, in English. Focus on bugs, security and regressions. Cite file:line, group repetitions
+  into a single comment and do not praise.
+inheritance: false
+
+reviews:
+  profile: chill
+  # Branch protection blocks merges; the checks below only flag issues.
+  request_changes_workflow: false
+  high_level_summary: true
+  review_status: true
+  collapse_walkthrough: true
+  changed_files_summary: false
+  sequence_diagrams: false
+  estimate_code_review_effort: false
+  poem: false
+  in_progress_fortune: false
+  suggested_reviewers: false
+  suggested_labels: false
+  auto_apply_labels: false
+
+  auto_review:
+    enabled: true
+    drafts: false
+    auto_incremental_review: true
+    base_branches:
+      - main
+    ignore_title_keywords:
+      - "WIP"
+      - "[skip review]"
+
+  path_filters:
+    # TODO: project lockfiles, binary assets, vendor and generated files.
+    - "!**/*.min.js"
+    - "!**/*.min.css"
+
+  path_instructions:
+    - path: "**/*"
+      instructions: |
+        - `AGENTS.md`, `CLAUDE.md` and project rules override generic rules (ECC). Do not request tests just to raise
+          coverage or TDD outside bug fixes and pure rules.
+        - Follow the item's risk level: for text, styling, docs or configuration changes, flag only actual bugs.
+        - Never describe an exploitable vulnerability detail in a public comment; point to the file and request a
+          private report.
+    # TODO: area-specific instructions (e.g. money, authentication, personal data folders) referring to the
+    # security-surfaces skill and the project's risk map.
+
+  pre_merge_checks:
+    docstrings:
+      mode: off
+    title:
+      mode: warning
+      requirements: >-
+        Conventional Commits: type (feat, fix, refactor, docs, test, chore, perf, ci), optional scope and short
+        description.
+    description:
+      mode: warning
+    issue_assessment:
+      mode: off
+    custom_checks:
+      - name: "CHANGELOG updated"
+        mode: warning
+        instructions: |
+          If the PR changes production code, Dockerfiles or dependencies (not only tests or documentation), the diff
+          must include an entry under `[Unreleased]` in CHANGELOG. Pass if the entry exists or the PR does not touch
+          these paths.
+      - name: "No secrets or exploitable details"
+        mode: error
+        instructions: |
+          Fail if the diff adds a real secret (token, API key, password, webhook URL, connection string with
+          credentials)
+          or exploitable steps for an unfixed vulnerability to a public file.
+          Clearly fake synthetic values in tests and empty variables in `.env.example` pass.
+
+  finishing_touches:
+    docstrings:
+      enabled: false
+    unit_tests:
+      enabled: false
+
+  tools:
+    # TODO: enable stack linters (ruff, eslint, biome, golangci-lint) and disable redundant ones.
+    actionlint:
+      enabled: true
+    hadolint:
+      enabled: true
+    yamllint:
+      enabled: true
+    shellcheck:
+      enabled: true
+    markdownlint:
+      enabled: true
+    gitleaks:
+      enabled: true
+    osvScanner:
+      enabled: true
+    zizmor:
+      enabled: true
+    github-checks:
+      enabled: true
+    languagetool:
+      enabled: false
+
+chat:
+  auto_reply: true
+
+knowledge_base:
+  code_guidelines:
+    enabled: true
+    filePatterns:
+      - "AGENTS.md"
+      - "CLAUDE.md"
+      # TODO: project rules, for example ".claude/rules/<project>/*.md".
+  learnings:
+    scope: local
+  issues:
+    scope: local
+  pull_requests:
+    scope: local