vibefast-cli 1.1.5 → 1.2.1

package/dist/commands/add.js

@@ -1,122 +1,94 @@
-import { Command } from 'commander';
-import { log } from '../core/log.js';
-import { getPaths } from '../core/paths.js';
-import { validateSignature, validateTarget } from '../core/validate.js';
-import { getToken, getDeviceInfo } from '../core/auth.js';
-import { fetchRecipe, downloadZip } from '../core/http.js';
-import { addEntry, getEntry } from '../core/journal.js';
-import { copyTree, readFileContent, exists, writeFileContent } from '../core/fsx.js';
-import { addEnvVars, hasEnvKey } from '../core/env.js';
-import { insertEnvSnippets, insertNavLinkNative, insertNavLinkWeb, ENV_BUILD_TIME_ENV_END, ENV_BUILD_TIME_ENV_START, ENV_BUILD_TIME_SCHEMA_END, ENV_BUILD_TIME_SCHEMA_START, ENV_CLIENT_ENV_END, ENV_CLIENT_ENV_START, ENV_CLIENT_SCHEMA_END, ENV_CLIENT_SCHEMA_START, ENV_CONSTANTS_END, ENV_CONSTANTS_START, } from '../core/codemod.js';
-import { join, resolve, dirname, relative } from 'path';
-import { copyFile, mkdir } from 'fs/promises';
-import { appendFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
-import { ensureWithinBase } from '../core/pathGuard.js';
-import { extractZipSafe } from '../core/archive.js';
-import { hashFiles } from '../core/hash.js';
-import { promptYesNo } from '../core/prompt.js';
-import { detectTarget } from '../core/detect.js';
-import { withSpinner } from '../core/spinner.js';
-import { getBundledRecipeZipPath } from '../core/recipes.js';
-import { tmpdir } from 'os';
-import { randomUUID } from 'crypto';
-let manualStepsFilePath = null;
-function formatTimestampForSteps() {
-    const now = new Date();
-    const pad = (n) => n.toString().padStart(2, '0');
-    return `${pad(now.getDate())}.${pad(now.getMonth() + 1)}.${now
-        .getFullYear()
-        .toString()
-        .slice(-2)}`;
+import { Command } from "commander";
+import { log } from "../core/log.js";
+import { getPaths } from "../core/paths.js";
+import { validateSignature, validateTarget } from "../core/validate.js";
+import { getToken, getDeviceInfo } from "../core/auth.js";
+import { fetchRecipe, downloadZip } from "../core/http.js";
+import { addEntry, getEntry } from "../core/journal.js";
+import { copyTree, readFileContent, exists, } from "../core/fsx.js";
+import { hasEnvKey } from "../core/env.js";
+import { insertEnvSnippets, insertNavLinkNative, insertNavLinkWeb, ENV_BUILD_TIME_ENV_END, ENV_BUILD_TIME_ENV_START, ENV_BUILD_TIME_SCHEMA_END, ENV_BUILD_TIME_SCHEMA_START, ENV_CLIENT_ENV_END, ENV_CLIENT_ENV_START, ENV_CLIENT_SCHEMA_END, ENV_CLIENT_SCHEMA_START, ENV_CONSTANTS_END, ENV_CONSTANTS_START, } from "../core/codemod.js";
+import { join, resolve, relative } from "path";
+import { ensureWithinBase } from "../core/pathGuard.js";
+import { extractZipSafe } from "../core/archive.js";
+import { hashFiles } from "../core/hash.js";
+import { promptYesNo } from "../core/prompt.js";
+import { detectTarget, detectBackendType } from "../core/detect.js";
+import { withSpinner } from "../core/spinner.js";
+import { getBundledRecipeZipPath } from "../core/recipes.js";
+import { tmpdir } from "os";
+import { randomUUID } from "crypto";
+import { appendManualSteps } from "../core/manualSteps.js";
+import { addAppConfigPlugin, addAppConfigIosProperties } from "../core/ast.js";
+import { spawnSync } from "child_process";
+/**
+ * Validates a package name/version string to prevent shell injection.
+ * Allows: letters, numbers, @, /, ., _, -, ^, ~, >, <, =, space (for version ranges)
+ * Disallows: shell metacharacters like ; | & $ ` etc.
+ */
+function isValidPackageArg(arg) {
+    // Package names can include @scope/name@version patterns
+    // Version can include ^, ~, >, <, =, space for ranges
+    if (!arg || arg.length > 200)
+        return false;
+    // Disallow dangerous characters
+    if (/[;&|$`"'\\]/.test(arg))
+        return false;
+    // Disallow path traversal
+    if (arg.includes(".."))
+        return false;
+    // Must start with letter, @ or number
+    if (!/^[@a-zA-Z0-9]/.test(arg))
+        return false;
+    return true;
 }
-function ensureManualStepsFile(cwd) {
-    if (manualStepsFilePath)
-        return manualStepsFilePath;
-    const dir = join(cwd, 'vf-manual-steps');
-    mkdirSync(dir, { recursive: true });
-    const base = formatTimestampForSteps();
-    let counter = 1;
-    let filename = `${base}-01.md`;
-    while (existsSync(join(dir, filename))) {
-        counter += 1;
-        filename = `${base}-${String(counter).padStart(2, '0')}.md`;
-    }
-    const header = [
-        '# VibeFast Manual Steps',
-        '',
-        `Generated: ${new Date().toISOString()}`,
-        `Command: ${process.argv.join(' ')}`,
-        '',
-    ].join('\n');
-    writeFileSync(join(dir, filename), header, { encoding: 'utf8' });
-    manualStepsFilePath = join(dir, filename);
-    return manualStepsFilePath;
-}
-function appendManualSteps(cwd, featureName, steps) {
-    if (!steps.length)
-        return '';
-    const filePath = ensureManualStepsFile(cwd);
-    const lines = [];
-    lines.push('');
-    lines.push(`## ${featureName}`);
-    lines.push('');
-    steps.forEach((step) => {
-        lines.push(`- [ ] ${step.title}`);
-        if (step.description) {
-            lines.push(`  - Details: ${step.description}`);
-        }
-        if (step.file) {
-            lines.push(`  - File: ${step.file}`);
-        }
-        if (step.link) {
-            lines.push(`  - Link: ${step.link}`);
-        }
-        lines.push('');
-    });
-    appendFileSync(filePath, lines.join('\n'), { encoding: 'utf8' });
-    const relPath = relative(cwd, filePath);
-    return relPath;
+/**
+ * Validates all package names and returns invalid ones.
+ */
+function getInvalidPackages(packages) {
+    return packages.filter((pkg) => !isValidPackageArg(pkg));
 }
-export const addCommand = new Command('add')
-    .description('Add VibeFast features, UI components, or integrations')
-    .argument('[feature]', 'Feature name to install (optional - will show interactive menu if omitted)')
-    .option('--target <target>', 'Target platform (native or web)')
-    .option('--dry-run', 'Preview changes without applying')
-    .option('--force', 'Overwrite existing files without asking')
-    .option('--yes', 'Answer yes to all prompts (for automation)')
-    .option('--category <category>', 'Filter by category (feature, ui, integration)')
-    .on('--help', () => {
-    log.plain('');
-    log.info('Examples:');
-    log.plain('  vf add                    # Interactive menu');
-    log.plain('  vf add chatbot            # Add specific feature');
-    log.plain('  vf add chatbot --dry-run  # Preview changes');
-    log.plain('  vf add chatbot --force    # Force reinstall');
-    log.plain('  vf add chatbot --yes      # Skip prompts');
+export const addCommand = new Command("add")
+    .description("Add VibeFast features or advanced UI components")
+    .argument("[feature]", "Feature name to install (optional - will show interactive menu if omitted)")
+    .option("--target <target>", "Target platform (native or web)")
+    .option("--dry-run", "Preview changes without applying")
+    .option("--force", "Overwrite existing files without asking")
+    .option("--yes", "Answer yes to all prompts (for automation)")
+    .option("--skip-install", "Skip dependency installation")
+    .on("--help", () => {
+    log.plain("");
+    log.info("Examples:");
+    log.plain("  vf add                    # Interactive menu");
+    log.plain("  vf add chatbot            # Add specific feature");
+    log.plain("  vf add chatbot --dry-run  # Preview changes");
+    log.plain("  vf add chatbot --force    # Force reinstall");
+    log.plain("  vf add chatbot --yes      # Skip prompts");
 })
     .action(async (feature, options) => {
     try {
-        // Fix MaxListeners warning for batch operations
-        process.stdin.setMaxListeners(0);
-        process.stdout.setMaxListeners(0);
-        const paths = getPaths();
+        // Fix MaxListeners warning for batch operations (reasonable limit, not unlimited)
+        process.stdin.setMaxListeners(50);
+        process.stdout.setMaxListeners(50);
+        const paths = await getPaths();
         // Interactive mode if no feature specified
         if (!feature) {
-            const { RECIPES, getRecipesByCategory, formatCategory, getCategories } = await import('../core/recipes.js');
-            const { promptSelectAsync, promptMultiSelectAsync, intro, outro } = await import('../core/prompt.js');
+            const { RECIPES, getRecipesByCategory, formatCategory, getCategories } = await import("../core/recipes.js");
+            const { promptSelectAsync, promptMultiSelectAsync, intro, outro } = await import("../core/prompt.js");
             // Check if it's a category name
-            const categories = getCategories();
+            // Temporarily hide integrations from the interactive menu
+            const categories = getCategories().filter((cat) => cat !== "integration");
             // Show intro
-            intro('🎯 VibeFast Feature Installer');
+            intro("🎯 VibeFast Feature Installer");
             // Show category selection
             const categoryChoices = categories.map((cat) => ({
                 value: cat,
                 label: formatCategory(cat),
                 description: `Browse ${formatCategory(cat).toLowerCase()}`,
             }));
-            const selectedCategory = await promptSelectAsync('What would you like to add?', categoryChoices);
+            const selectedCategory = await promptSelectAsync("What would you like to add?", categoryChoices);
             if (!selectedCategory) {
-                outro('Cancelled');
+                outro("Cancelled");
                 return;
             }
             // Show items in selected category
@@ -128,22 +100,22 @@ export const addCommand = new Command('add')
             }));
             const selectedRecipes = await promptMultiSelectAsync(`Select ${formatCategory(selectedCategory).toLowerCase()} to add:`, recipeChoices);
             if (selectedRecipes.length === 0) {
-                outro('No items selected');
+                outro("No items selected");
                 return;
             }
             // Install each selected recipe
             for (const recipeName of selectedRecipes) {
-                log.plain('');
-                log.plain('━'.repeat(60));
+                log.plain("");
+                log.plain("━".repeat(60));
                 await installFeature(recipeName, options, paths);
             }
-            outro('✨ Installation complete!');
+            outro("✨ Installation complete!");
             return;
         }
         // Check if feature is a category name
-        const { getCategories, getRecipesByCategory, formatCategory } = await import('../core/recipes.js');
-        const { promptMultiSelectAsync, intro, outro } = await import('../core/prompt.js');
-        const categories = getCategories();
+        const { getCategories, getRecipesByCategory, formatCategory } = await import("../core/recipes.js");
+        const { promptMultiSelectAsync, intro, outro } = await import("../core/prompt.js");
+        const categories = getCategories().filter((cat) => cat !== "integration");
         if (categories.includes(feature)) {
             intro(`🎯 ${formatCategory(feature)}`);
             // Show items in this category
@@ -155,16 +127,16 @@ export const addCommand = new Command('add')
             }));
             const selectedRecipes = await promptMultiSelectAsync(`Select ${formatCategory(feature).toLowerCase()} to add:`, recipeChoices);
             if (selectedRecipes.length === 0) {
-                outro('No items selected');
+                outro("No items selected");
                 return;
             }
             // Install each selected recipe
             for (const recipeName of selectedRecipes) {
-                log.plain('');
-                log.plain('━'.repeat(60));
+                log.plain("");
+                log.plain("━".repeat(60));
                 await installFeature(recipeName, options, paths);
             }
-            outro('✨ Installation complete!');
+            outro("✨ Installation complete!");
             return;
         }
         // Install single feature
@@ -189,309 +161,30 @@ export async function installFeature(feature, options, paths) {
                 log.info(`Auto-detected target: ${target}`);
             }
             else {
-                log.error('Could not auto-detect target (native/web)');
-                log.info('Please specify with --target native or --target web');
+                log.error("Could not auto-detect target (native/web)");
+                log.info("Please specify with --target native or --target web");
                 process.exit(1);
             }
         }
-        function groupEnvVars(env, cwd) {
-            if (!env?.length) {
-                return [];
-            }
-            const groups = new Map();
-            for (const envVar of env) {
-                const relativePath = envVar.file ?? 'apps/native/.env.local';
-                const resolvedPath = resolve(cwd, relativePath);
-                const existing = groups.get(resolvedPath);
-                if (existing) {
-                    existing.vars.push(envVar);
-                }
-                else {
-                    groups.set(resolvedPath, {
-                        path: resolvedPath,
-                        relativePath,
-                        vars: [envVar],
-                    });
-                }
-            }
-            return [...groups.values()];
-        }
-        async function ensureEnvFileFromExample(group, options) {
-            if (await exists(group.path)) {
-                return false;
-            }
-            const exampleCandidates = [
-                `${group.path}.example`,
-                join(dirname(group.path), '.env.example'),
-            ];
-            const examplePath = (await Promise.all(exampleCandidates.map(async (candidate) => ((await exists(candidate)) ? candidate : null)))).find(Boolean);
-            if (!examplePath) {
-                return false;
-            }
-            const exampleLabel = examplePath.startsWith(dirname(group.path))
-                ? examplePath.slice(dirname(group.path).length + 1)
-                : examplePath;
-            if (options?.dryRun) {
-                log.info(`[DRY RUN] Would create ${group.relativePath} from ${exampleLabel}`);
-                return true;
-            }
-            await mkdir(dirname(group.path), { recursive: true });
-            await copyFile(examplePath, group.path);
-            log.info(`Created ${group.relativePath} from ${exampleLabel}`);
-            return true;
-        }
-        async function ensureEnvVarsForGroups(envGroups, options) {
-            const summary = [];
-            for (const group of envGroups) {
-                await ensureEnvFileFromExample(group, options);
-                const vars = group.vars.map(envVar => ({
-                    key: envVar.key,
-                    value: envVar.value ?? envVar.example ?? '',
-                    comment: envVar.description?.replace(/\s+/g, ' ').trim() || undefined,
-                }));
-                const result = await addEnvVars(group.path, vars, { dryRun: options.dryRun });
-                if (result.added.length > 0) {
-                    summary.push({
-                        relativePath: group.relativePath,
-                        added: result.added,
-                    });
-                }
-            }
-            return summary;
-        }
-        async function reportEnvStatus(envGroups, options) {
-            const attention = [];
-            for (const group of envGroups) {
-                const missing = [];
-                const existing = [];
-                for (const envVar of group.vars) {
-                    const hasKey = await hasEnvKey(group.path, envVar.key);
-                    if (hasKey) {
-                        existing.push(envVar.key);
-                    }
-                    else {
-                        missing.push(envVar);
-                    }
-                }
-                if (missing.length > 0) {
-                    log.plain('');
-                    log.warn(`⚠ REQUIRED ENVIRONMENT VARIABLES (${group.relativePath}):`);
-                    log.plain('');
-                    missing.forEach(envVar => {
-                        log.plain(`  ${envVar.key}`);
-                        log.plain(`    ${envVar.description}`);
-                        log.plain(`    Example: ${envVar.example}`);
-                        if (envVar.link) {
-                            log.plain(`    Get it: ${envVar.link}`);
-                        }
-                        log.plain('');
-                        attention.push(`Add ${envVar.key} to ${group.relativePath}`);
-                    });
-                    log.info(`Add these to ${group.relativePath}`);
-                    log.plain('');
-                }
-                if (existing.length > 0) {
-                    log.success(`✓ Already configured (${group.relativePath}): ${existing.join(', ')}`);
-                    log.plain('');
-                }
-            }
-            return attention;
-        }
-        async function applyEnvConfiguration(paths, envConfig, options) {
-            const envPath = join(paths.cwd, 'apps', 'native', 'env.js');
-            if (!(await exists(envPath))) {
-                return;
-            }
-            const suffix = options.dryRun ? ' (dry run)' : '';
-            if (envConfig.constants?.length) {
-                const inserted = await insertEnvSnippets(envPath, ENV_CONSTANTS_START, ENV_CONSTANTS_END, envConfig.constants, options);
-                if (inserted) {
-                    log.info(`Updated env.js constants${suffix}.`);
-                }
-            }
-            if (envConfig.client?.schema?.length) {
-                const inserted = await insertEnvSnippets(envPath, ENV_CLIENT_SCHEMA_START, ENV_CLIENT_SCHEMA_END, envConfig.client.schema, options);
-                if (inserted) {
-                    log.info(`Updated env.js client schema definitions${suffix}.`);
-                }
-            }
-            if (envConfig.client?.env?.length) {
-                const inserted = await insertEnvSnippets(envPath, ENV_CLIENT_ENV_START, ENV_CLIENT_ENV_END, envConfig.client.env, options);
-                if (inserted) {
-                    log.info(`Updated env.js client env exports${suffix}.`);
-                }
-            }
-            if (envConfig.buildTime?.schema?.length) {
-                const inserted = await insertEnvSnippets(envPath, ENV_BUILD_TIME_SCHEMA_START, ENV_BUILD_TIME_SCHEMA_END, envConfig.buildTime.schema, options);
-                if (inserted) {
-                    log.info(`Updated env.js build-time schema${suffix}.`);
-                }
-            }
-            if (envConfig.buildTime?.env?.length) {
-                const inserted = await insertEnvSnippets(envPath, ENV_BUILD_TIME_ENV_START, ENV_BUILD_TIME_ENV_END, envConfig.buildTime.env, options);
-                if (inserted) {
-                    log.info(`Updated env.js build-time exports${suffix}.`);
-                }
-            }
-        }
-        async function applyAppConfigPlugins(feature, paths, options) {
-            const appConfigPath = join(paths.cwd, 'apps', 'native', 'app.config.ts');
-            if (!(await exists(appConfigPath)))
-                return;
-            const original = await readFileContent(appConfigPath);
-            let updated = original;
-            const fail = (msg) => {
-                log.error(msg);
-                throw new Error(msg);
-            };
-            // Ensure a plugins block exists; insert one if missing (before extra: or at end)
-            const findIndex = (pattern) => {
-                const match = pattern.exec(updated);
-                return match ? match.index : -1;
-            };
-            let pluginsStart = findIndex(/plugins\s*:\s*\[/);
-            let extraStart = findIndex(/\n\s+extra:/);
-            if (pluginsStart === -1) {
-                const block = `  plugins: [\n  ],\n\n`;
-                if (extraStart !== -1) {
-                    updated = `${updated.slice(0, extraStart)}${block}${updated.slice(extraStart)}`;
-                }
-                else {
-                    // Append before the final closing of the config object
-                    const insertPos = updated.lastIndexOf('};');
-                    updated =
-                        insertPos !== -1
-                            ? `${updated.slice(0, insertPos)}${block}${updated.slice(insertPos)}`
-                            : `${updated.trimEnd()}\n\n${block}};`;
-                }
-                // recompute positions
-                pluginsStart = findIndex(/plugins\s*:\s*\[/);
-                extraStart = findIndex(/\n\s+extra:/);
-            }
-            if (pluginsStart === -1) {
-                fail('Could not locate plugins block in app.config.ts; aborting plugin auto-insert.');
-            }
-            if (extraStart === -1) {
-                extraStart = updated.length;
-            }
-            // Boundaries for plugins block (tolerant of nested arrays)
-            const firstBracket = updated.indexOf('[', pluginsStart);
-            let depth = 0;
-            let pluginsClose = -1;
-            for (let i = firstBracket; i < updated.length; i++) {
-                const ch = updated[i];
-                if (ch === '[')
-                    depth += 1;
-                if (ch === ']') {
-                    depth -= 1;
-                    if (depth === 0) {
-                        pluginsClose = i;
-                        break;
-                    }
-                }
-                if (i >= extraStart && extraStart !== updated.length && depth <= 0)
-                    break;
-            }
-            if (pluginsClose === -1) {
-                fail('Could not locate plugins closing bracket; aborting plugin auto-insert.');
-            }
-            const addBlock = (block, needle) => {
-                if (updated.includes(needle))
-                    return;
-                updated = `${updated.slice(0, pluginsClose)}  ${block}\n${updated.slice(pluginsClose)}`;
-            };
-            const findBlockRange = (label) => {
-                const idx = updated.indexOf(label);
-                if (idx === -1)
-                    return null;
-                const startBrace = updated.indexOf('{', idx);
-                if (startBrace === -1)
-                    return null;
-                let depthLocal = 0;
-                for (let i = startBrace; i < updated.length; i++) {
-                    const ch = updated[i];
-                    if (ch === '{')
-                        depthLocal += 1;
-                    if (ch === '}') {
-                        depthLocal -= 1;
-                        if (depthLocal === 0)
-                            return { start: idx, end: i + 1 };
-                    }
-                }
-                return null;
-            };
-            const patchIosBlock = () => {
-                let iosRange = findBlockRange('ios:');
-                // If ios block is missing, inject a minimal one before plugins.
-                if (!iosRange) {
-                    updated = updated.replace('plugins: [', `ios: {\n    supportsTablet: true,\n    bundleIdentifier: Env.BUNDLE_ID,\n    appleTeamId: Env.APPLE_TEAM_ID,\n    config: { usesNonExemptEncryption: false },\n    entitlements: { 'com.apple.security.application-groups': ['group.' + Env.BUNDLE_ID] },\n  },\n\n  plugins: [`);
-                    iosRange = findBlockRange('ios:');
-                }
-                if (!iosRange) {
-                    fail('Could not locate or create ios block in app.config.ts; aborting plugin auto-insert.');
-                }
-                const block = updated.slice(iosRange.start, iosRange.end);
-                let patched = block;
-                if (!patched.includes('appleTeamId')) {
-                    patched = patched.replace(/bundleIdentifier:\s*Env\.BUNDLE_ID,?/, (m) => `${m}\n    appleTeamId: Env.APPLE_TEAM_ID,`);
-                    if (patched === block) {
-                        patched = patched.replace('{', '{\n    appleTeamId: Env.APPLE_TEAM_ID,');
-                    }
-                }
-                if (!patched.includes('com.apple.security.application-groups')) {
-                    if (patched.includes('entitlements:')) {
-                        patched = patched.replace(/entitlements:\s*{([^}]*)}/s, (m, inner) => `entitlements: {\n      'com.apple.security.application-groups': ['group.' + Env.BUNDLE_ID],${inner.trim() ? `\n${inner.trimStart()}` : ''}\n    }`);
-                    }
-                    else {
-                        patched = patched.replace(/config:\s*{[^}]*},/, (m) => `${m}\n    entitlements: {\n      'com.apple.security.application-groups': ['group.' + Env.BUNDLE_ID],\n    },`);
-                    }
-                }
-                updated = updated.replace(block, patched);
-            };
-            if (feature === 'ios-widget') {
-                addBlock(`[
-      '@bacons/apple-targets',
-      {
-        targets: [
-          {
-            name: 'VibeFastWidget',
-            type: 'widget',
-            bundleIdentifier: \`\${Env.BUNDLE_ID}.widget\`,
-            entitlements: {
-              'com.apple.security.application-groups': [
-                'group.' + Env.BUNDLE_ID,
-              ],
-            },
-          },
-        ],
-      },
-    ],`, '@bacons/apple-targets');
-                patchIosBlock();
-            }
-            if (feature === 'voice-bot') {
-                addBlock(`'@livekit/react-native-expo-plugin',`, '@livekit/react-native-expo-plugin');
-                addBlock(`'@config-plugins/react-native-webrtc',`, '@config-plugins/react-native-webrtc');
-                patchIosBlock();
-            }
-            if (feature === 'wake-word') {
-                addBlock(`'expo-audio',`, `'expo-audio'`);
-                addBlock(`[
-      'react-native-vosk',
-      {
-        models: ['assets/vosk-model/model-en-us'],
-        iOSMicrophonePermission: 'We use the mic for on-device wake-phrase detection.',
-      },
-    ],`, 'react-native-vosk');
-                patchIosBlock();
-            }
-            if (updated !== original && !options?.dryRun) {
-                await writeFileContent(appConfigPath, updated, { force: true });
-                log.info('Updated app.config.ts plugins for feature requirements.');
-            }
-        }
         // Validate setup
         const config = await validateSignature(paths.signatureFile);
         validateTarget(target, config.targets);
+        // Detect backend type for recipe selection
+        const backend = await detectBackendType(paths.cwd);
+        log.info(`Target: ${target}, Backend: ${backend}`);
+        // For Supabase projects, try feature-supabase recipe first
+        // This allows backend-specific recipes while maintaining backwards compatibility
+        let recipeName = feature;
+        if (backend === "supabase") {
+            // Check if supabase-specific bundled recipe exists
+            const supabaseRecipe = `${feature}-supabase`;
+            const supabaseZipPath = await getBundledRecipeZipPath(supabaseRecipe);
+            if (supabaseZipPath) {
+                recipeName = supabaseRecipe;
+                log.info(`Using Supabase-specific recipe: ${recipeName}`);
+            }
+            // Otherwise fall back to base recipe (which may work for both backends)
+        }
         // Check auth
         const token = await getToken();
         if (!token) {
@@ -502,10 +195,10 @@ export async function installFeature(feature, options, paths) {
         const existing = await getEntry(paths.journalFile, feature, target);
         if (existing && !options.force && !options.yes) {
             log.warn(`${feature} is already installed for ${target}`);
-            const shouldReinstall = await promptYesNo('Reinstall and overwrite existing files? (y/N) ', false);
+            const shouldReinstall = await promptYesNo("Reinstall and overwrite existing files? (y/N) ", false);
             if (!shouldReinstall) {
-                log.info('Skipped. Use --force to reinstall without prompting');
-                log.plain('');
+                log.info("Skipped. Use --force to reinstall without prompting");
+                log.plain("");
                 return;
             }
             // Auto-enable force mode for reinstall to avoid per-file prompts
@@ -513,20 +206,20 @@ export async function installFeature(feature, options, paths) {
         }
         else if (existing && !options.force) {
             log.warn(`${feature} is already installed for ${target}`);
-            log.info('Use --force to reinstall');
-            log.plain('');
+            log.info("Use --force to reinstall");
+            log.plain("");
             return;
         }
         if (options.dryRun) {
-            log.info('[DRY RUN] No changes will be made');
+            log.info("[DRY RUN] No changes will be made");
         }
         // Fetch recipe
         const device = await getDeviceInfo();
-        const response = await withSpinner(`Fetching ${feature} for ${target}...`, async () => {
+        const response = await withSpinner(`Fetching ${recipeName} for ${target}...`, async () => {
             return await fetchRecipe({
                 token,
                 device,
-                feature,
+                feature: recipeName,
                 target,
                 starter: { name: config.name, version: config.version },
             });
@@ -537,85 +230,89 @@ export async function installFeature(feature, options, paths) {
         let extractDir = null;
         if (!response.ok || (!response.signedUrl && !response.zipData)) {
             // Remote fetch failed; try bundled fallback
-            const error = response.error || 'Unknown error';
-            const message = response.message || '';
-            const localZip = await getBundledRecipeZipPath(feature);
+            const error = response.error || "Unknown error";
+            const message = response.message || "";
+            const localZip = await getBundledRecipeZipPath(recipeName);
             if (localZip) {
                 log.info(`Remote recipe unavailable (${error}). Using bundled recipe.`);
                 zipPath = localZip;
             }
             else {
-                log.plain('');
+                log.plain("");
                 // User-friendly error messages
-                if (error.includes('Invalid') || error.includes('token') || error.includes('license')) {
-                    log.plain('❌ Invalid or expired license key');
-                    log.plain('');
-                    log.info('Your license key may be:');
-                    log.plain('  • Incorrect or mistyped');
-                    log.plain('  • Expired');
-                    log.plain('  • Revoked');
-                    log.plain('');
-                    log.info('To fix this:');
-                    log.plain('  1. Check your license key from your purchase receipt');
-                    log.plain('  2. Run: vf logout');
-                    log.plain('  3. Run: vf login --token YOUR_CORRECT_TOKEN');
-                    log.plain('');
-                    log.info('Need help? Contact support@vibefast.pro');
-                }
-                else if (error.includes('Device limit') || error.includes('device') || message.includes('device')) {
-                    log.plain('❌ Device limit reached');
-                    log.plain('');
-                    log.info('You have reached the maximum number of devices for your license');
-                    log.plain('');
-                    log.info('To fix this:');
-                    log.plain('  1. Run: vf devices');
-                    log.plain('  2. Deactivate an unused device: vf devices --deactivate <device-id>');
-                    log.plain('  3. Try again: vf add ' + feature);
-                    log.plain('');
+                if (error.includes("Invalid") ||
+                    error.includes("token") ||
+                    error.includes("license")) {
+                    log.plain("❌ Invalid or expired license key");
+                    log.plain("");
+                    log.info("Your license key may be:");
+                    log.plain("  • Incorrect or mistyped");
+                    log.plain("  • Expired");
+                    log.plain("  • Revoked");
+                    log.plain("");
+                    log.info("To fix this:");
+                    log.plain("  1. Check your license key from your purchase receipt");
+                    log.plain("  2. Run: vf logout");
+                    log.plain("  3. Run: vf login --token YOUR_CORRECT_TOKEN");
+                    log.plain("");
+                    log.info("Need help? Contact support@vibefast.pro");
+                }
+                else if (error.includes("Device limit") ||
+                    error.includes("device") ||
+                    message.includes("device")) {
+                    log.plain("❌ Device limit reached");
+                    log.plain("");
+                    log.info("You have reached the maximum number of devices for your license");
+                    log.plain("");
+                    log.info("To fix this:");
+                    log.plain("  1. Run: vf devices");
+                    log.plain("  2. Deactivate an unused device: vf devices --deactivate <device-id>");
+                    log.plain("  3. Try again: vf add " + feature);
+                    log.plain("");
                     if (message) {
                         log.plain(`Details: ${message}`);
-                        log.plain('');
+                        log.plain("");
                     }
                 }
-                else if (error.includes('Network') || error.includes('connect')) {
-                    log.plain('❌ Network error');
-                    log.plain('');
-                    log.info('Could not connect to VibeFast servers');
-                    log.plain('');
-                    log.info('Please check:');
-                    log.plain('  • Your internet connection');
-                    log.plain('  • Firewall settings');
-                    log.plain('  • VPN configuration');
-                    log.plain('');
+                else if (error.includes("Network") || error.includes("connect")) {
+                    log.plain("❌ Network error");
+                    log.plain("");
+                    log.info("Could not connect to VibeFast servers");
+                    log.plain("");
+                    log.info("Please check:");
+                    log.plain("  • Your internet connection");
+                    log.plain("  • Firewall settings");
+                    log.plain("  • VPN configuration");
+                    log.plain("");
                     if (message) {
                         log.plain(`Details: ${message}`);
-                        log.plain('');
+                        log.plain("");
                     }
                 }
-                else if (error.includes('not found') || error.includes('404')) {
-                    log.plain('❌ Feature not found');
-                    log.plain('');
+                else if (error.includes("not found") || error.includes("404")) {
+                    log.plain("❌ Feature not found");
+                    log.plain("");
                     log.info(`The feature "${feature}" does not exist or is not available for ${target}`);
-                    log.plain('');
-                    log.info('To see available features:');
-                    log.plain('  vf list');
-                    log.plain('');
+                    log.plain("");
+                    log.info("To see available features:");
+                    log.plain("  vf list");
+                    log.plain("");
                 }
                 else {
                     // Generic error
                     log.plain(`❌ ${error}`);
                     if (message) {
-                        log.plain('');
+                        log.plain("");
                         log.plain(`Details: ${message}`);
                     }
-                    log.plain('');
-                    log.info('If this problem persists, contact support@vibefast.pro');
+                    log.plain("");
+                    log.info("If this problem persists, contact support@vibefast.pro");
                 }
-                log.plain('');
+                log.plain("");
                 process.exit(1);
             }
         }
-        const fallbackZip = await getBundledRecipeZipPath(feature);
+        const fallbackZip = await getBundledRecipeZipPath(recipeName);
         let attemptedFallback = false;
         let installedManifest = null;
         let installedEnvGroups = [];
@@ -629,30 +326,30 @@ export async function installFeature(feature, options, paths) {
             try {
                 // Download and extract (or use bundled zip)
                 if (!zipPath) {
-                    const result = await withSpinner('Downloading and extracting recipe...', async () => {
+                    const result = await withSpinner("Downloading and extracting recipe...", async () => {
                         const zip = response.zipData
                             ? await downloadZip(response.zipData, true)
                             : await downloadZip(response.signedUrl);
-                        const dir = join(tmpdir(), 'vibefast', randomUUID());
+                        const dir = join(tmpdir(), "vibefast", randomUUID());
                         await extractZipSafe(zip, dir);
                         return { zipPath: zip, extractDir: dir };
                     }, {
-                        successText: '✓ Recipe downloaded',
+                        successText: "✓ Recipe downloaded",
                     });
                     zipPath = result.zipPath;
                     extractDir = result.extractDir;
                 }
                 else {
                     // Bundled zip path - extract to temp location
-                    extractDir = join(tmpdir(), 'vibefast', randomUUID());
+                    extractDir = join(tmpdir(), "vibefast", randomUUID());
                     await extractZipSafe(zipPath, extractDir);
                 }
                 // Locate manifest (some archives may nest recipe.json)
                 const findManifest = async (dir) => {
-                    const entries = await import('fs/promises').then((m) => m.readdir(dir, { withFileTypes: true }));
+                    const entries = await import("fs/promises").then((m) => m.readdir(dir, { withFileTypes: true }));
                     for (const entry of entries) {
                         const full = join(dir, entry.name);
-                        if (entry.isFile() && entry.name === 'recipe.json')
+                        if (entry.isFile() && entry.name === "recipe.json")
                             return full;
                         if (entry.isDirectory()) {
                             const found = await findManifest(full);
@@ -662,7 +359,7 @@ export async function installFeature(feature, options, paths) {
                     }
                     return null;
                 };
-                let manifestPath = join(extractDir, 'recipe.json');
+                let manifestPath = join(extractDir, "recipe.json");
                 if (!(await exists(manifestPath))) {
                     const found = await findManifest(extractDir);
                     if (!found) {
@@ -681,20 +378,22 @@ export async function installFeature(feature, options, paths) {
                 if (!Array.isArray(manifest.copy)) {
                     throw new Error('recipe.json is missing a valid "copy" array');
                 }
-                const extractRoot = resolve(manifestPath, '..');
+                const extractRoot = resolve(manifestPath, "..");
                 const repoRoot = resolve(paths.cwd);
                 const manifestTarget = manifest.target ??
-                    (Array.isArray(manifest.platforms) && manifest.platforms.includes('native')
-                        ? 'native'
-                        : Array.isArray(manifest.platforms) && manifest.platforms.includes('web')
-                            ? 'web'
+                    (Array.isArray(manifest.platforms) &&
+                        manifest.platforms.includes("native")
+                        ? "native"
+                        : Array.isArray(manifest.platforms) &&
+                            manifest.platforms.includes("web")
+                            ? "web"
                             : undefined);
                 if (!manifestTarget) {
                     throw new Error(`Recipe target missing for ${manifest.name}`);
                 }
                 manifest.target = manifestTarget;
                 if (manifestTarget !== target) {
-                    throw new Error(`Recipe target mismatch: expected ${target}, got ${manifestTarget ?? 'undefined'}`);
+                    throw new Error(`Recipe target mismatch: expected ${target}, got ${manifestTarget ?? "undefined"}`);
                 }
                 log.info(`Installing ${manifest.name} v${manifest.version}...`);
                 const envGroups = groupEnvVars(manifest.env, paths.cwd);
@@ -718,17 +417,52 @@ export async function installFeature(feature, options, paths) {
                 }
                 // Show conflict warnings in dry-run mode
                 if (options.dryRun && allConflicts.length > 0) {
-                    log.plain('');
+                    log.plain("");
                     log.warn(`⚠ ${allConflicts.length} file(s) will be overwritten:`);
-                    allConflicts.slice(0, 5).forEach(f => {
-                        const relativePath = f.replace(paths.cwd + '/', '');
+                    allConflicts.slice(0, 5).forEach((f) => {
+                        const relativePath = relative(paths.cwd, f);
                         log.plain(`  • ${relativePath}`);
                     });
                     if (allConflicts.length > 5) {
                         log.plain(`  ... and ${allConflicts.length - 5} more`);
                     }
-                    log.warn('⚠ Make sure you have committed your changes to Git!');
-                    log.plain('');
+                    log.warn("⚠ Make sure you have committed your changes to Git!");
+                    log.plain("");
+                }
+                // Handle Supabase migrations (rename with timestamp)
+                if (backend === "supabase") {
+                    const { rename } = await import("fs/promises");
+                    const { basename, dirname, join } = await import("path");
+                    for (const file of copiedFiles) {
+                        if (file.includes("/supabase/migrations/") &&
+                            file.endsWith(".sql")) {
+                            const name = basename(file);
+                            // Check if already timestamped (14 digits at start)
+                            if (!/^\d{14}_/.test(name)) {
+                                // Use base timestamp + index to prevent collisions when multiple migrations installed
+                                const baseTimestamp = Date.now();
+                                const migrationIndex = copiedFiles
+                                    .filter((f) => f.includes("/supabase/migrations/") && f.endsWith(".sql"))
+                                    .indexOf(file);
+                                const timestamp = `${baseTimestamp}${String(migrationIndex).padStart(4, "0")}`;
+                                const newName = `${timestamp}_${name}`;
+                                const newPath = join(dirname(file), newName);
+                                try {
+                                    await rename(file, newPath);
+                                    // Update file in copiedFiles list so hashing works correctly
+                                    const index = copiedFiles.indexOf(file);
+                                    if (index !== -1) {
+                                        copiedFiles[index] = newPath;
+                                    }
+                                    log.info(`📦 Timestamped migration: ${newName}`);
+                                    log.plain("  (Run 'supabase db push' to apply)");
+                                }
+                                catch (err) {
+                                    log.warn(`Failed to rename migration ${name}: ${err}`);
+                                }
+                            }
+                        }
+                    }
                 }
                 // Show skipped files
                 if (allSkipped.length > 0) {
@@ -736,9 +470,12 @@ export async function installFeature(feature, options, paths) {
                 }
                 // Add watermark if provided
                 if (response.watermark && !options.dryRun) {
-                    const { writeFileContent, readFileContent } = await import('../core/fsx.js');
+                    const { writeFileContent, readFileContent } = await import("../core/fsx.js");
                     for (const file of copiedFiles) {
-                        if (file.endsWith('.ts') || file.endsWith('.tsx') || file.endsWith('.js') || file.endsWith('.jsx')) {
+                        if (file.endsWith(".ts") ||
+                            file.endsWith(".tsx") ||
+                            file.endsWith(".js") ||
+                            file.endsWith(".jsx")) {
                             const content = await readFileContent(file);
                             const watermarked = `// vibefast license: ${response.watermark}\n${content}`;
                             await writeFileContent(file, watermarked, { force: true });
@@ -750,23 +487,27 @@ export async function installFeature(feature, options, paths) {
                 let navHref;
                 let navLabel;
                 if (manifest.nav) {
-                    log.info('Adding navigation link...');
-                    const navFile = target === 'native' ? paths.nativeNavFile : paths.webNavFile;
-                    const insertFn = target === 'native' ? insertNavLinkNative : insertNavLinkWeb;
+                    log.info("Adding navigation link...");
+                    const navFile = target === "native" ? paths.nativeNavFile : paths.webNavFile;
+                    const insertFn = target === "native" ? insertNavLinkNative : insertNavLinkWeb;
                     navHref = manifest.nav.href;
                     navLabel = manifest.nav.label;
-                    navInserted = await insertFn(navFile, manifest.nav, { dryRun: options.dryRun });
+                    navInserted = await insertFn(navFile, manifest.nav, {
+                        dryRun: options.dryRun,
+                    });
                     if (navInserted) {
-                        log.success('Navigation link added');
+                        log.success("Navigation link added");
                     }
                     else {
-                        log.info('Navigation link already exists');
+                        log.info("Navigation link already exists");
                     }
                 }
                 // Hash files and update journal
                 if (!options.dryRun) {
-                    log.info('Computing file hashes...');
-                    const fileHashes = await hashFiles(copiedFiles, { showProgress: copiedFiles.length > 20 });
+                    log.info("Computing file hashes...");
+                    const fileHashes = await hashFiles(copiedFiles, {
+                        showProgress: copiedFiles.length > 20,
+                    });
                     const fileEntries = Array.from(fileHashes.entries()).map(([path, hash]) => ({
                         path,
                         hash,
@@ -799,7 +540,9 @@ export async function installFeature(feature, options, paths) {
                 break retry_install;
             }
             catch (err) {
-                if (!attemptedFallback && fallbackZip) {
+                // Don't retry for nav marker errors - bundled recipe will have same problem
+                const isNavMarkerError = err.message?.includes("Missing navigation markers");
+                if (!attemptedFallback && fallbackZip && !isNavMarkerError) {
                     attemptedFallback = true;
                     zipPath = fallbackZip;
                     extractDir = null;
@@ -810,112 +553,145 @@ export async function installFeature(feature, options, paths) {
             }
         }
         // Auto-install dependencies
-        if (installedManifest && installedManifest.dependencies && !options.dryRun) {
-            log.plain('');
-            log.warn('⚠ This feature requires additional packages');
-            log.plain('');
-            if (installedManifest.target === 'native') {
+        if (installedManifest &&
+            installedManifest.dependencies &&
+            !options.dryRun) {
+            log.plain("");
+            log.warn("⚠ This feature requires additional packages");
+            log.plain("");
+            if (installedManifest.target === "native") {
                 const packages = Array.from(new Set([
                     ...(installedManifest.dependencies.expo ?? []),
                     ...(installedManifest.dependencies.npm ?? []),
                 ]));
                 if (packages.length > 0) {
-                    log.info('📦 Required packages:');
-                    packages.forEach(pkg => {
+                    // Security: Validate package names before shell execution
+                    const invalidPkgs = getInvalidPackages(packages);
+                    if (invalidPkgs.length > 0) {
+                        log.error(`Invalid package names detected: ${invalidPkgs.join(", ")}`);
+                        log.info("Install manually with: pnpx expo install <packages>");
+                        return;
+                    }
+                    log.info("📦 Required packages:");
+                    packages.forEach((pkg) => {
                         log.plain(`  • ${pkg}`);
                     });
-                    log.plain('');
-                    const shouldInstall = options.yes || await promptYesNo('Would you like to install these packages now? (Y/n) ', true);
+                    log.plain("");
+                    const shouldInstall = !options.skipInstall &&
+                        (options.yes ||
+                            (await promptYesNo("Would you like to install these packages now? (Y/n) ", true)));
                     if (shouldInstall) {
-                        const storeDir = join(paths.cwd, '.pnpm-store');
-                        await withSpinner('Installing packages with Expo...', async () => {
-                            const { execSync } = await import('child_process');
-                            const nativeDir = join(paths.cwd, 'apps', 'native');
+                        const storeDir = join(paths.cwd, ".pnpm-store");
+                        await withSpinner("Installing packages with Expo...", async () => {
+                            const nativeDir = join(paths.cwd, "apps", "native");
                             try {
-                                execSync(`pnpx expo install ${packages.join(' ')}`, {
+                                // Use spawnSync with args array for safety (no shell interpolation)
+                                const result = spawnSync("pnpx", ["expo", "install", ...packages], {
                                     cwd: nativeDir,
-                                    stdio: 'inherit',
+                                    stdio: "inherit",
                                     env: {
                                         ...process.env,
                                         PNPM_STORE_PATH: storeDir,
                                     },
+                                    shell: false,
                                 });
+                                if (result.error) {
+                                    throw result.error;
+                                }
                             }
                             catch (err) {
-                                log.warn('⚠ Expo install reported an error (packages may still be installed). Verify dependencies and app.config.ts plugin additions.');
+                                log.warn("⚠ Expo install reported an error (packages may still be installed). Verify dependencies and app.config.ts plugin additions.");
                                 if (err?.message) {
                                     log.warn(err.message);
                                 }
                             }
                         }, {
-                            successText: '✓ Packages installed',
+                            successText: "✓ Packages installed",
                         });
                     }
                     else {
-                        log.info('Install manually with:');
-                        log.plain(`  pnpx expo install ${packages.join(' ')}`);
-                        log.plain('');
-                        log.info('💡 Expo will automatically pick compatible versions');
+                        log.info("Install manually with:");
+                        log.plain(`  pnpx expo install ${packages.join(" ")}`);
+                        log.plain("");
+                        log.info("💡 Expo will automatically pick compatible versions");
                     }
                 }
             }
-            else if (installedManifest.target === 'web' && installedManifest.dependencies.npm) {
+            else if (installedManifest.target === "web" &&
+                installedManifest.dependencies.npm) {
                 const packages = installedManifest.dependencies.npm;
-                log.info('📦 Required packages:');
-                packages.forEach(pkg => {
+                // Security: Validate package names before shell execution
+                const invalidPkgs = getInvalidPackages(packages);
+                if (invalidPkgs.length > 0) {
+                    log.error(`Invalid package names detected: ${invalidPkgs.join(", ")}`);
+                    log.info("Install manually with: pnpm add <packages>");
+                    return;
+                }
+                log.info("📦 Required packages:");
+                packages.forEach((pkg) => {
                     log.plain(`  • ${pkg}`);
                 });
-                log.plain('');
-                const shouldInstall = options.yes || await promptYesNo('Would you like to install these packages now? (Y/n) ', true);
+                log.plain("");
+                const shouldInstall = !options.skipInstall &&
+                    (options.yes ||
+                        (await promptYesNo("Would you like to install these packages now? (Y/n) ", true)));
                 if (shouldInstall) {
-                    const { detectPackageManager } = await import('../core/detect.js');
-                    const pkgManager = detectPackageManager(paths.cwd) || 'pnpm';
+                    const { detectPackageManager } = await import("../core/detect.js");
+                    const pkgManager = detectPackageManager(paths.cwd) || "pnpm";
                     await withSpinner(`Installing packages with ${pkgManager}...`, async () => {
-                        const { execSync } = await import('child_process');
-                        const installCmd = pkgManager === 'npm'
-                            ? `npm install ${packages.join(' ')}`
-                            : `${pkgManager} add ${packages.join(' ')}`;
-                        execSync(installCmd, {
+                        // Use spawnSync with args array for safety (no shell interpolation)
+                        const args = pkgManager === "npm"
+                            ? ["install", ...packages]
+                            : ["add", ...packages];
+                        const result = spawnSync(pkgManager, args, {
                             cwd: paths.cwd,
-                            stdio: 'inherit',
+                            stdio: "inherit",
+                            shell: false,
                         });
+                        if (result.error) {
+                            throw result.error;
+                        }
                     }, {
-                        successText: '✓ Packages installed',
+                        successText: "✓ Packages installed",
                     });
                 }
                 else {
-                    log.info('Install manually with:');
-                    log.plain(`  pnpm add ${packages.join(' ')}`);
-                    log.plain('  OR');
-                    log.plain(`  yarn add ${packages.join(' ')}`);
+                    log.info("Install manually with:");
+                    log.plain(`  pnpm add ${packages.join(" ")}`);
+                    log.plain("  OR");
+                    log.plain(`  yarn add ${packages.join(" ")}`);
                     log.plain(`  OR`);
-                    log.plain(`  npm install ${packages.join(' ')}`);
+                    log.plain(`  npm install ${packages.join(" ")}`);
                 }
             }
-            log.plain('');
+            log.plain("");
         }
         // Auto-setup Vosk model for wake-word
-        if (installedManifest?.name === 'wake-word' && !options.dryRun) {
-            const { setupVoskModel } = await import('../core/vosk.js');
-            log.plain('');
-            await withSpinner('Setting up Vosk speech model...', async () => {
+        if (installedManifest?.name === "wake-word" && !options.dryRun) {
+            const { setupVoskModel } = await import("../core/vosk.js");
+            log.plain("");
+            await withSpinner("Setting up Vosk speech model...", async () => {
                 return await setupVoskModel(paths.cwd, { dryRun: options.dryRun });
             }, {
-                successText: '✓ Vosk model ready',
+                successText: "✓ Vosk model ready",
             });
         }
         if (installedManifest?.configuration?.env) {
             await applyEnvConfiguration(paths, installedManifest.configuration.env, options);
         }
+        // Apply api-client exports injection
+        if (installedManifest?.configuration?.apiClient) {
+            await applyApiClientConfiguration(paths, installedManifest.configuration.apiClient, options);
+        }
         // Apply app.config plugin inserts for certain features
         if (installedManifest?.name) {
-            await applyAppConfigPlugins(installedManifest.name, paths, options);
+            await applyAppConfigPlugins(installedManifest, paths, options);
         }
         // Show manual steps with smart detection
         if (installedManifest?.manualSteps && !options.dryRun) {
-            const { readFileContent, exists } = await import('../core/fsx.js');
-            const { join } = await import('path');
-            const normalize = (text) => text.replace(/\\n/g, '\n');
+            const { readFileContent, exists } = await import("../core/fsx.js");
+            const { join } = await import("path");
+            const normalize = (text) => text.replace(/\\n/g, "\n");
             const featureName = installedManifest?.name;
             // Check which steps might already be done
             const pendingSteps = [];
@@ -924,17 +700,20 @@ export async function installFeature(feature, options, paths) {
                 let alreadyDone = false;
                 const filePath = step.file ? join(paths.cwd, step.file) : null;
                 // Wake-word specific checks (more lenient matching)
-                if (featureName === 'wake-word' && step.file && filePath && (await exists(filePath))) {
+                if (featureName === "wake-word" &&
+                    step.file &&
+                    filePath &&
+                    (await exists(filePath))) {
                     const content = await readFileContent(filePath);
                     const lowerTitle = step.title.toLowerCase();
-                    if (lowerTitle.includes('vosk plugin')) {
-                        if (content.includes('react-native-vosk')) {
+                    if (lowerTitle.includes("vosk plugin")) {
+                        if (content.includes("react-native-vosk")) {
                             alreadyDone = true;
                             completedSteps.push(step.title);
                         }
                     }
-                    else if (step.file === '.gitignore') {
-                        if (content.includes('assets/vosk-model/model-en-us')) {
+                    else if (step.file === ".gitignore") {
+                        if (content.includes("assets/vosk-model/model-en-us")) {
                             alreadyDone = true;
                             completedSteps.push(step.title);
                         }
@@ -945,8 +724,8 @@ export async function installFeature(feature, options, paths) {
                     if (filePath && (await exists(filePath))) {
                         const content = await readFileContent(filePath);
                         // Simple check: does the file contain the content to add?
-                        const contentToCheck = step.content.replace(/\s+/g, ' ').trim();
-                        const fileContentNormalized = content.replace(/\s+/g, ' ').trim();
+                        const contentToCheck = step.content.replace(/\s+/g, " ").trim();
+                        const fileContentNormalized = content.replace(/\s+/g, " ").trim();
                         if (fileContentNormalized.includes(contentToCheck)) {
                             alreadyDone = true;
                             completedSteps.push(step.title);
@@ -964,30 +743,19 @@ export async function installFeature(feature, options, paths) {
                     log.info(`Checklist saved to ${relPath}`);
                 }
                 log.info(`Run 'vf checklist ${installedManifest.name}' to see these steps again`);
-                log.plain('');
+                log.plain("");
             }
             else if (completedSteps.length > 0) {
-                log.success(`✓ Manual steps already satisfied: ${completedSteps.join(', ')}`);
-                log.plain('');
+                log.success(`✓ Manual steps already satisfied: ${completedSteps.join(", ")}`);
+                log.plain("");
             }
         }
         if (installedEnvGroups.length > 0) {
-            const additions = await ensureEnvVarsForGroups(installedEnvGroups, options);
-            if (additions.length > 0) {
-                log.plain('');
-                const suffix = options.dryRun ? ' (dry run)' : '';
-                log.info(`✅ Placeholder environment variables added${suffix}:`);
-                additions.forEach(({ relativePath, added }) => {
-                    log.plain(`  • ${relativePath}: ${added.join(', ')}`);
-                });
-                log.info('Update those files with your real API keys or secrets.');
-                log.plain('');
-            }
             installedEnvAttention = await reportEnvStatus(installedEnvGroups, options);
         }
         // Post-install message
         if (installedManifest?.postInstall?.message && !options.dryRun) {
-            log.plain('');
+            log.plain("");
             log.info(installedManifest.postInstall.message);
         }
         // Final summary of what needs user attention
@@ -998,16 +766,39 @@ export async function installFeature(feature, options, paths) {
             }
             // Check manual steps
             if (installedManifest?.manualSteps) {
-                const { readFileContent, exists } = await import('../core/fsx.js');
-                const { join } = await import('path');
+                const { readFileContent, exists } = await import("../core/fsx.js");
+                const { join } = await import("path");
+                const featureName = installedManifest.name;
                 for (const step of installedManifest.manualSteps) {
                     let alreadyDone = false;
-                    if (step.file && step.content) {
+                    // Wake-word: mark done if plugin/gitignore entries already exist
+                    if (featureName === "wake-word" &&
+                        step.file &&
+                        step.title.toLowerCase().includes("vosk plugin")) {
+                        const filePath = join(paths.cwd, step.file);
+                        if (await exists(filePath)) {
+                            const content = await readFileContent(filePath);
+                            if (content.includes("react-native-vosk")) {
+                                alreadyDone = true;
+                            }
+                        }
+                    }
+                    else if (featureName === "wake-word" &&
+                        step.file === ".gitignore") {
                         const filePath = join(paths.cwd, step.file);
                         if (await exists(filePath)) {
                             const content = await readFileContent(filePath);
-                            const contentToCheck = step.content.replace(/\s+/g, ' ').trim();
-                            const fileContentNormalized = content.replace(/\s+/g, ' ').trim();
+                            if (content.includes("assets/vosk-model/model-en-us")) {
+                                alreadyDone = true;
+                            }
+                        }
+                    }
+                    if (!alreadyDone && step.file && step.content) {
+                        const filePath = join(paths.cwd, step.file);
+                        if (await exists(filePath)) {
+                            const content = await readFileContent(filePath);
+                            const contentToCheck = step.content.replace(/\s+/g, " ").trim();
+                            const fileContentNormalized = content.replace(/\s+/g, " ").trim();
                             if (fileContentNormalized.includes(contentToCheck)) {
                                 alreadyDone = true;
                             }
@@ -1020,31 +811,198 @@ export async function installFeature(feature, options, paths) {
             }
             // Show summary
             if (needsAttention.length > 0) {
-                log.plain('');
-                log.plain('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
+                log.plain("");
+                log.plain("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
                 log.warn(`⚠ ACTION REQUIRED: ${needsAttention.length} item(s) need your attention`);
-                log.plain('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-                log.plain('');
+                log.plain("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
+                log.plain("");
                 needsAttention.forEach((item, index) => {
                     log.plain(`  ${index + 1}. ${item}`);
                 });
-                log.plain('');
+                log.plain("");
                 log.info(`💡 Run 'vf checklist ${installedManifest?.name ?? feature}' for detailed instructions`);
-                log.plain('');
+                log.plain("");
             }
             else {
-                log.plain('');
-                log.success('🎉 All set! No manual configuration needed.');
-                log.plain('');
+                log.plain("");
+                log.success("🎉 All set! No manual configuration needed.");
+                log.plain("");
             }
         }
         if (options.dryRun) {
-            log.plain('');
-            log.warn('This was a dry run. Run without --dry-run to apply changes.');
+            log.plain("");
+            log.warn("This was a dry run. Run without --dry-run to apply changes.");
         }
     }
     catch (error) {
         throw error;
     }
 }
+function groupEnvVars(env, cwd) {
+    if (!env?.length) {
+        return [];
+    }
+    const groups = new Map();
+    for (const envVar of env) {
+        const relativePath = envVar.file ?? "apps/native/.env.local";
+        const resolvedPath = ensureWithinBase(cwd, resolve(cwd, relativePath), `Env file path ${relativePath}`);
+        const existing = groups.get(resolvedPath);
+        if (existing) {
+            existing.vars.push(envVar);
+            continue;
+        }
+        groups.set(resolvedPath, {
+            path: resolvedPath,
+            relativePath,
+            vars: [envVar],
+        });
+    }
+    return [...groups.values()];
+}
+async function reportEnvStatus(envGroups, options) {
+    const attention = [];
+    for (const group of envGroups) {
+        const missing = [];
+        for (const envVar of group.vars) {
+            const hasKey = await hasEnvKey(group.path, envVar.key);
+            if (!hasKey) {
+                missing.push(envVar);
+            }
+        }
+        if (missing.length > 0) {
+            log.plain("");
+            log.warn(`⚠ REQUIRED ENVIRONMENT VARIABLES (${group.relativePath}):`);
+            log.plain("");
+            missing.forEach((envVar) => {
+                log.plain(`  ${envVar.key}`);
+                log.plain(`    ${envVar.description}`);
+                log.plain(`    Example: ${envVar.example}`);
+                if (envVar.link) {
+                    log.plain(`    Get it: ${envVar.link}`);
+                }
+                log.plain("");
+                attention.push(`Add ${envVar.key} to ${group.relativePath}`);
+            });
+            log.info(`Add these to ${group.relativePath}`);
+            log.plain("");
+        }
+    }
+    return attention;
+}
+async function applyEnvConfiguration(paths, envConfig, options) {
+    const envPath = join(paths.cwd, "apps", "native", "env.js");
+    if (!(await exists(envPath))) {
+        return;
+    }
+    const suffix = options.dryRun ? " (dry run)" : "";
+    if (envConfig.constants?.length) {
+        const inserted = await insertEnvSnippets(envPath, ENV_CONSTANTS_START, ENV_CONSTANTS_END, envConfig.constants, options);
+        if (inserted) {
+            log.info(`Updated env.js constants${suffix}.`);
+        }
+    }
+    if (envConfig.client?.schema?.length) {
+        const inserted = await insertEnvSnippets(envPath, ENV_CLIENT_SCHEMA_START, ENV_CLIENT_SCHEMA_END, envConfig.client.schema, options);
+        if (inserted) {
+            log.info(`Updated env.js client schema definitions${suffix}.`);
+        }
+    }
+    if (envConfig.client?.env?.length) {
+        const inserted = await insertEnvSnippets(envPath, ENV_CLIENT_ENV_START, ENV_CLIENT_ENV_END, envConfig.client.env, options);
+        if (inserted) {
+            log.info(`Updated env.js client env exports${suffix}.`);
+        }
+    }
+    if (envConfig.buildTime?.schema?.length) {
+        const inserted = await insertEnvSnippets(envPath, ENV_BUILD_TIME_SCHEMA_START, ENV_BUILD_TIME_SCHEMA_END, envConfig.buildTime.schema, options);
+        if (inserted) {
+            log.info(`Updated env.js build-time schema${suffix}.`);
+        }
+    }
+    if (envConfig.buildTime?.env?.length) {
+        const inserted = await insertEnvSnippets(envPath, ENV_BUILD_TIME_ENV_START, ENV_BUILD_TIME_ENV_END, envConfig.buildTime.env, options);
+        if (inserted) {
+            log.info(`Updated env.js build-time exports${suffix}.`);
+        }
+    }
+}
+const API_CLIENT_EXPORTS_START = "// --- @vibefast:api-client:exports:start ---";
+const API_CLIENT_EXPORTS_END = "// --- @vibefast:api-client:exports:end ---";
+async function applyApiClientConfiguration(paths, apiClientConfig, options) {
+    const apiClientIndexPath = join(paths.nativeDir, "src/api-client/index.ts");
+    if (!(await exists(apiClientIndexPath))) {
+        return;
+    }
+    const suffix = options.dryRun ? " (dry run)" : "";
+    if (apiClientConfig.exports?.length) {
+        const inserted = await insertEnvSnippets(apiClientIndexPath, API_CLIENT_EXPORTS_START, API_CLIENT_EXPORTS_END, apiClientConfig.exports, options);
+        if (inserted) {
+            log.info(`Updated api-client exports${suffix}.`);
+        }
+    }
+}
+async function applyAppConfigPlugins(manifest, paths, options) {
+    const appConfigPath = join(paths.nativeDir, "app.config.ts");
+    if (!(await exists(appConfigPath)))
+        return;
+    // Handle plugins
+    if (manifest.plugins?.length) {
+        if (options.dryRun) {
+            log.info(`[DRY RUN] Would add plugins to app.config.ts: ${manifest.plugins
+                .map((p) => p.name)
+                .join(", ")}`);
+        }
+        else {
+            for (const plugin of manifest.plugins) {
+                const added = await addAppConfigPlugin(appConfigPath, plugin.name, plugin.config);
+                if (added) {
+                    log.info(`Added plugin ${plugin.name} to app.config.ts`);
+                }
+                else {
+                    log.info(`Plugin ${plugin.name} already exists in app.config.ts`);
+                }
+            }
+        }
+    }
+    // Handle iosConfig (for ios-widget: appleTeamId and entitlements)
+    if (manifest.iosConfig) {
+        if (options.dryRun) {
+            log.info(`[DRY RUN] Would add ios config to app.config.ts`);
+        }
+        else {
+            const iosProps = {};
+            if (manifest.iosConfig.appleTeamId) {
+                iosProps.appleTeamId = manifest.iosConfig.appleTeamId;
+            }
+            if (manifest.iosConfig.entitlements) {
+                iosProps.entitlements = manifest.iosConfig.entitlements;
+            }
+            if (Object.keys(iosProps).length > 0) {
+                const added = await addAppConfigIosProperties(appConfigPath, iosProps);
+                if (added) {
+                    log.info(`Added ios config to app.config.ts`);
+                }
+                else {
+                    log.info(`ios config already exists in app.config.ts`);
+                }
+            }
+        }
+    }
+    // Run eslint --fix to format the modified file
+    if (!options.dryRun) {
+        try {
+            const result = spawnSync("pnpm", ["exec", "eslint", "--fix", appConfigPath], {
+                cwd: paths.cwd,
+                stdio: "pipe",
+                encoding: "utf-8",
+            });
+            if (result.status === 0) {
+                log.info("✓ Formatted app.config.ts");
+            }
+        }
+        catch {
+            // Silently ignore - formatting is best-effort
+        }
+    }
+}
 //# sourceMappingURL=add.js.map