vybekiit 0.7.28 → 0.7.32

package/dist/global-skills/aws-cdk/SKILL.md

@@ -3,6 +3,7 @@ name: aws-cdk
 description: Authors, deploys, and troubleshoots AWS infrastructure using CDK with TypeScript or Python. Covers best practices, stack architecture, and construct patterns. Applies when writing CDK constructs, bootstrapping environments, running cdk deploy/synth/diff, fixing CDK or CloudFormation errors, planning stack structure, importing existing resources, resolving drift, or refactoring stacks without resource replacement.
 metadata:
   version: "2"
+disable-model-invocation: true
 ---
 
 # AWS CDK

package/dist/global-skills/aws-cloudformation/SKILL.md

@@ -3,6 +3,7 @@ name: aws-cloudformation
 description: Authors, validates, and troubleshoots AWS CloudFormation templates. Covers template authoring with secure defaults, local validation with either cfn-lint or cloudformation-validate, cfn-guard security and compliance checks as a recommended default, account-aware CloudFormation service pre-deployment validation, CloudFormation Express mode for faster deployments, and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation. Also covers author-time template intelligence with the CloudFormation Language Server and published cloudformation-validate libraries.
 metadata:
   version: "3"
+disable-model-invocation: true
 ---
 # CloudFormation
 

package/dist/global-skills/aws-serverless/SKILL.md

@@ -3,6 +3,7 @@ name: aws-serverless
 description: Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK. Covers cold starts, CORS debugging, event source mappings, troubleshooting, concurrency, SnapStart, Powertools, function URLs, EventBridge Scheduler, Lambda layers, and production readiness. Triggers on mentions of Lambda, API Gateway, Step Functions, SAM templates, CDK serverless stacks, DynamoDB stream triggers, SQS event sources, cold starts, timeouts, 502/504 errors, throttling, concurrency, CORS, Powertools, or any event-driven architecture on AWS, even without the word "serverless." Does not apply to EC2, ECS/Fargate containers, or Amplify hosting.
 metadata:
   version: "4"
+disable-model-invocation: true
 ---
 
 # AWS Serverless

package/dist/global-skills/aws-serverless/references/compute-decision-edge-cases.md

@@ -0,0 +1,77 @@
+# Compute Decision Edge Cases (Tier 4)
+
+Tier 4 of the compute decision flow in `SKILL.md`: feature-level questions that are decided **after** the form factor and capacity provider are locked. Each section gives the question to ask, the decision, and the thresholds and caveats that the one-line summary in `SKILL.md` leaves out. Read this file when a request raises duration limits, cold starts or first-request latency, stream or queue lag, or tenant isolation.
+
+## Contents
+
+- [Duration ceilings](#duration-ceilings)
+- [Long-lived sessions and long executions](#long-lived-sessions-and-long-executions)
+- [Cold start vs stream lag](#cold-start-vs-stream-lag)
+- [First-request latency](#first-request-latency)
+- [Steady-state traffic: Managed Instances](#steady-state-traffic-managed-instances)
+- [Tenant isolation](#tenant-isolation)
+
+---
+
+## Duration ceilings
+
+| Form factor / feature | Ceiling | Notes |
+|---|---|---|
+| Event Functions · On-Demand | 15 min per invocation | Every invocation type |
+| Web Functions | 15 min per request | Node.js only; On-Demand only |
+| Event Functions · Managed Instances | 90 min per invocation | Asynchronous and event source mapping invocations only; synchronous invocations keep the 15-minute ceiling |
+| MicroVMs | 8 h per session | Customer-managed lifecycle (launch/suspend/resume/terminate) within the session |
+| Durable Functions | 1 year per execution (async invocation) | Each step is bounded by the Lambda timeout of the capacity provider it runs on; waits cost nothing |
+| Step Functions | Standard 1 year, Express 5 min | See [orchestration.md](orchestration.md) |
+
+Anything longer than these is outside Lambda: **aws-containers** (ECS/Fargate) or **aws-compute** (EC2).
+
+---
+
+## Long-lived sessions and long executions
+
+Ask for the overall duration and, if the work splits into tasks, the per-task duration (the per-step ceiling is min(task, overall)).
+
+- MicroVMs: session > 8 h → **aws-compute** (EC2); otherwise MicroVMs.
+- Functions with multiple coordinated tasks → **Durable Functions** on Event Functions (`SKILL.md` Step 3); the remaining choice is On-Demand vs Managed Instances per step duration.
+- Single **Event Function** invocation > 15 min → if asynchronous or invoked through an event source mapping and up to 90 min, use **Managed Instances**; if > 90 min, or synchronous and > 15 min, use **aws-containers** / **aws-compute**. This does not apply to MicroVM sessions, which use the 8 h session ceiling above.
+
+---
+
+## Cold start vs stream lag
+
+Decide form factor, programming model, and capacity first. Infer the symptom from metrics or the request when possible. If it is still unclear, ask in customer-observable terms: *"Is only the first request after an idle period slow, or is a queue/stream backlog growing while traffic is being processed?"*
+
+- **Stream/queue lag** (consumer backlog, `ApproximateAgeOfOldestRecord` or `IteratorAge` climbing, Kafka consumer lag) → **provisioned mode for the event source mapping** (minimum and maximum pollers / event poller units), on either Event Functions capacity provider. Provisioned mode controls input delivery: how quickly the event source mapping reads the source and hands records to Lambda. Provisioned Concurrency controls environment availability and does nothing for a backlog. Details: [concurrency.md](concurrency.md).
+- **First-request latency** → next section.
+
+---
+
+## First-request latency
+
+### Event Functions on On-Demand
+
+1. Start with the levers that cost nothing: a smaller deployment package and fewer or lighter layers, lazy initialization outside the hot path, and right-sized memory — [lambda.md](lambda.md). (arm64/Graviton is a price-performance choice, not a cold-start fix.)
+2. Use the stated latency objective when available. If the objective would change the choice and is missing, ask whether the application requires consistently double-digit-millisecond startup overhead or whether sub-second startup is sufficient.
+   - Double-digit milliseconds → **Provisioned Concurrency**.
+   - Sub-second → **SnapStart** if the runtime is Java, Python, or .NET, for zip or a container image: it snapshots the initialized execution environment after heavy initialization and resumes from that snapshot. Values generated during initialization must be regenerated when uniqueness matters, and network connections must be re-established after restore ([lambda.md](lambda.md)). Other runtimes → Provisioned Concurrency.
+3. If traffic runs continuously (peak-to-mean ratio below 2 within 5–10 minutes), Managed Instances may remove repeated environment launches — next section.
+
+### Web Functions
+
+Web Functions use On-Demand capacity, but Provisioned Concurrency and SnapStart do not apply. Optimize application initialization and dependency loading, then continue with **aws-lambda-web-functions** for its latency and concurrency guidance. Do not send a Web Functions workload through the Event Functions Provisioned Concurrency/SnapStart decision path.
+
+---
+
+## Steady-state traffic: Managed Instances
+
+Steady state or "always busy" traffic cited to eliminate environment-launch latency → **Managed Instances**: warm, multi-concurrent instances remove repeated cold starts. Infer this from continuous utilization when the request or metrics establish it. If traffic shape is missing, ask whether peak traffic stays below twice the average within any 5–10 minute window (peak-to-mean ratio below 2) or drains and sits idle for meaningful periods. The threshold follows from how Managed Instances scales: asynchronously on CPU utilization and multi-concurrency saturation, so traffic that more than doubles within 5 minutes can be throttled while capacity is added ([scaling](https://docs.aws.amazon.com/lambda/latest/dg/lambda-managed-instances-scaling.html)). Using Managed Instances requires creating a new function; Savings Plans and Reserved Instance pricing apply.
+
+---
+
+## Tenant isolation
+
+- Event and request handlers have **per-function isolation by default**; this is not a promise of a fresh Firecracker VM or a new execution environment for every invocation.
+- Handlers that need execution environments dedicated to one invoker or tenant → Event Functions on **On-Demand** with **tenant isolation mode**: set at creation, every invoke carries a tenant id, and environments assigned to one tenant are not reused for another. Tenant isolation mode is On-Demand only (not available on Managed Instances) and is not compatible with Function URLs, Provisioned Concurrency, or SnapStart.
+- A persistent per-tenant environment, untrusted user- or LLM-generated code, retained memory/disk/processes, or OS access (FUSE, eBPF, custom ports) → **MicroVMs** (**aws-lambda-microvms**). Isolation is per MicroVM environment and persists with that environment's lifecycle.
+- Do not rely on application-level sandboxing inside a shared execution environment.

package/dist/global-skills/back-up-my-code/SKILL.md

@@ -1,15 +1,21 @@
 ---
 name: back-up-my-code
-description: "the builder's project is saved on GitHub so they never lose work. Use when the vibe coder says something like: save my code; back up; put it on github."
+description: "the builder's project is saved on GitHub at a verified checkpoint. Use when the vibe coder says something like: save my code; back up; put it on github."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: back-up-my-code
 
-**Goal:** the builder's project is saved on GitHub so they never lose work.
+**Goal:** the builder's project is saved on GitHub at a verified checkpoint.
 
 **Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
 translate every error · celebrate. You handle git and GitHub; the builder only signs in or creates an account when asked.
@@ -18,7 +24,12 @@ translate every error · celebrate. You handle git and GitHub; the builder only
 
 ## Steps
 
-1. **Explain in one line.** *"I'll save your project online so you can't lose it."*
+0. **Status questions require inspection only.** For "Is my work saved?", inspect changed files,
+   the current commit, and the remote branch. Say which changes are local and which are online.
+   Do not create a repository or push for a status question. For an explicit backup request,
+   continue below. Reuse the existing repository and preserve unrelated changes.
+
+1. **Explain in one line.** *"I'll save a copy of your project online."*
 
 2. **GitHub account.** If they don't have one, walk them through creating one at github.com — **one step at a time** in plain words. `gh` cannot create accounts for them.
 
@@ -26,12 +37,12 @@ translate every error · celebrate. You handle git and GitHub; the builder only
    **Verify:** `gh auth status` shows signed in.
 
 4. **Save it.** Initialize the repo (if needed), commit all safe files (never `.env`), create a **private** GitHub repo, and push.
-   **Verify:** files visible on github.com.
+   **Verify:** the remote branch commit matches the intended local commit, the repository is private, and a fresh clone installs and passes the relevant app check. Check uncommitted and untracked work separately; never claim it was included unless it was.
 
 5. **Give them the link.** Share the repo URL in plain words — *"Your project is saved here."*
    🎉 *Celebrate* — their work is backed up.
 
-6. **Later saves.** For ongoing checkpoints, use `ship-via-pr-vybekiit.md` — the **online checker** runs on all three operating systems before merge. Builder hears: *"Your latest work is saved and checked."*
+6. **Later saves.** For ongoing checkpoints, use `ship-via-pr-vybekiit.md` — the **online checker** runs on all three operating systems before merge. Say "Your latest work is saved and checked" only after verifying that checkpoint and its checks.
 
 ## If anything breaks
 

package/dist/global-skills/better-auth-best-practices/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: better-auth-best-practices
 description: Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to set up TypeScript authentication with email/password, OAuth, or plugin configuration.
+disable-model-invocation: true
 ---
 
 # Better Auth Integration Guide

package/dist/global-skills/better-auth-security-best-practices/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: better-auth-security-best-practices
 description: Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.
+disable-model-invocation: true
 ---
 
 ## Secret Management

package/dist/global-skills/building-native-ui/SKILL.md

@@ -3,6 +3,7 @@ name: building-native-ui
 description: Complete guide for building beautiful apps with Expo Router. Covers fundamentals, styling, components, navigation, animations, patterns, and native tabs.
 version: 1.0.1
 license: MIT
+disable-model-invocation: true
 ---
 
 # Expo UI Guidelines

package/dist/global-skills/buy-domain/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: buy-domain
@@ -23,13 +29,10 @@ it.
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the launch checklist recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/LaunchChecklistPage.tsx` export `LaunchChecklistPage` into the buyer app at route `/dashboard/launch`
-   (reuse if `go-live` already installed it).
-   Recipe id: `launch-checklist`. Preset: job_runs when deploy jobs are tracked.
-   Keep every `TODO:` in the recipe and wire domain checklist items after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('buy-domain')` / page-recipe-manifest.json.
-   **Verify:** `/dashboard/launch` builds with practice checklist UI.
+0. **Add the launch checklist page first.** Run `vybekiit add page-recipe launch-checklist` (skip it
+   if `go-live` already added it). It adds the page at `/launch`. Keep every `TODO:` in the page and
+   fill in the domain items as you go.
+   **Verify:** `/launch` opens and shows the practice checklist.
 
 1. **Help them choose a name.** Talk through a web address they'd like. Check it's available and
    guide registration **one step at a time** — they pay for it (it's their address).

package/dist/global-skills/check-safety/SKILL.md

@@ -1,10 +1,16 @@
 ---
 name: check-safety
-description: "confirm the app is protected end-to-end before ship — abuse, database safety, and every. Use when the vibe coder says something like: am i ready to ship; is my app safe; did we cover security."
+description: "confirm the app is protected end-to-end before ship — abuse, database safety, and every API route classified correctly. Use when the vibe coder says something like: am i ready to ship; is my app safe; did we cover security."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: check-safety
@@ -17,13 +23,10 @@ API route classified correctly. Output a plain pass/fail summary for the builder
 ## Steps
 
 <!-- vybekiit:page-recipe-install -->
-0. **Install the page recipe first (catalog SSOT — Option C).**
-   Copy `apps/componentLibrary/src/pageRecipes/SafetyPage.tsx` export `SafetyPage` into the buyer app at route `/dashboard/safety`.
-   Recipe id: `safety`. Presets: none.
-   Keep every `TODO:` in the recipe and wire each one after the route renders.
-   Also reference `packages/agentKit` `getPageRecipeInstall('check-safety')` / page-recipe-manifest.json.
-   **Verify:** route builds and shows practice UI before provider wiring.
-
+0. **Add the ready-made page first.** Run `vybekiit add page-recipe safety`. It adds the page
+   at `/safety` and lists any data setup to run next. Keep every `TODO:` in the page and fill
+   each one in as you connect the real service.
+   **Verify:** `/safety` opens and shows practice content.
 
 1. **Abuse / DDoS layer.** Confirm `SECURITY_RATE_LIMIT` and `SECURITY_ORIGIN_LOCK` are `on` in
    `.env`. Confirm `middleware.ts` passes the request path for tiered limits. Confirm `/api/webhook`

package/dist/global-skills/claimable-postgres/SKILL.md

@@ -11,6 +11,7 @@ description: >-
 metadata:
   parent: neon
   source: https://github.com/neondatabase/agent-skills/tree/main/skills/claimable-postgres
+disable-model-invocation: true
 ---
 
 **FIRST**: Use the parent `neon` skill for a Neon overview, getting started with Neon, Neon development best practices, and more.

package/dist/global-skills/configure-capabilities/SKILL.md

@@ -1,10 +1,16 @@
 ---
 name: configure-capabilities
-description: "the app has **only the permissions it needs** — the builder never thinks about Info.plist, Android manifest, or Expo plugins. Use when the vibe coder says something like: camera; location permission; notifications permission."
+description: "the app has only the permissions it needs — the builder never thinks about Info.plist, Android manifest, or Expo plugins. Use when the vibe coder says something like: camera; location permission; notifications permission."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/mobile/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: configure-capabilities

package/dist/global-skills/connect-account/SKILL.md

@@ -1,10 +1,16 @@
 ---
 name: connect-account
-description: "people can create accounts and sign in **inside the app**. Use when the vibe coder says something like: sign in; log in; create accounts; add users; forgot password; reset password."
+description: "people can create accounts and sign in inside the app. Use when the vibe coder says something like: sign in; log in; create accounts; add users; forgot password; reset password."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/mobile/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: connect-account

package/dist/global-skills/connect-account-backend/SKILL.md

@@ -5,6 +5,12 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/mobile/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: connect-account (mobile / extension)

package/dist/global-skills/create-auth-skill/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: create-auth-skill
 description: Scaffold and implement authentication in TypeScript/JavaScript apps using Better Auth. Detect frameworks, configure database adapters, set up route handlers, add OAuth providers, and create auth UI pages. Use when users want to add login, sign-up, or authentication to a new or existing project with Better Auth.
+disable-model-invocation: true
 ---
 
 # Create Auth Skill

package/dist/global-skills/design-my-data/SKILL.md

@@ -5,10 +5,18 @@ metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: design-my-data
 
+> Agent-only: follow the Persistent features sequence in `.vybekiit/agent/session-bootstrap.md`. Reuse the relevant catalog presets before adding app-owned extensions, and record structural and behavioral evidence separately.
+
 **Goal:** figure out what the app should remember before wiring storage.
 
 **Contract:** one action at a time · verify-before-advance · plain language (`language.md`) ·
@@ -20,18 +28,17 @@ translate every error · celebrate. You do all the planning; the builder describ
 
 ## Steps
 
-1. **Learn what users do.** From the product description, ask what must be saved (not a schema interview).
+1. **Learn what users do.** Infer what must be saved from the product description. Ask only when a missing product decision changes the behavior.
    **Verify:** you can list 1–3 things the app remembers.
 
 2. **Plan the shape (agent-only).** Run `vybekiit plan-data-model entities.json` with entities from step 1.
    **Verify:** plan has collections and a `buyerSummary` sentence.
 
 3. **Read back in one sentence.** Use `renderDataModelSummary(plan)` — plain words only.
-   **Verify:** builder says yes.
+   **Verify:** the plan covers the requested behavior; continue when the request supplies enough intent.
 
 4. **Route to save-data.** Hand off to `save-data.md` to provision the database, wire CRUD, and test.
-   When `DATA_PROVIDER=supabase`, pick an RLS preset from `infra/supabase/policies/` (user-owned,
-   team-owned, or public-read) and include it in the migration — see `harden.md` step on database rules.
+   Use the validated table access contracts in the selected presets and app extensions. Test both allowed and denied actions through the selected provider.
    **Verify:** `save-data` definition of done.
 
 ## When to skip
@@ -41,7 +48,7 @@ instead of running this skill separately.
 
 ## Definition of done
 
-Builder agreed on what the app remembers and `save-data` is running with a clear target shape.
+The plan matches what the builder asked the app to remember and `save-data` is running with a clear target shape.
 
 ## After completing this skill
 

package/dist/global-skills/doctor/SKILL.md

@@ -1,10 +1,16 @@
 ---
 name: doctor
-description: "find out why something isn't working and fix it — without making the builder debug. Use when the vibe coder says something like: it's broken; nothing works; get an error; check my app."
+description: "find out why something isn't working and fix it — without making the builder debug anything. Use when the vibe coder says something like: it's broken; nothing works; get an error; check my app."
 metadata:
   vybekiit-generated: buyer-skill-stub
 ---
 
+Prefer the current project instructions and matching project skill when inside a kit app.
+Outside a kit app, resolve guidance relative to this skill directory: ../vybekiitReferences/web/.
+That folder contains language.md, AGENTS.md, CODE-STYLE.md, agent/ and platform-skills/.
+Bare wrapper filenames refer to platform-skills/ there. Do not assume project code or recipe files exist globally.
+Inspect an existing app before changing it. Scaffold a new kit app only when the builder asked for a new app.
+
 <!-- vybekiit:generated:buyer-skill-stub -->
 
 # Skill: doctor
@@ -19,15 +25,16 @@ translate every error · celebrate the fix. The builder should mostly just watch
 
 Work through these in order. Stop as soon as you find and fix the problem, then verify.
 
-1. **Reproduce.** Ask the builder, in one question, what they were doing when it broke — **unless**
-   the prompt starts with `[VybeKiit Report]` or they say they used Report mode (Option+Shift+R,
-   clicked an element, sent a note). In that case context is pre-filled; skip this question.
+1. **Reproduce the reported symptom.** Use the prompt, current preview URL, process logs,
+   and recent changes first. For a page that will not open, check that exact URL and process.
+   A stopped preview does not prove lost files. Inspect files and backup status separately.
+   Ask one question only when the failing action or location cannot be determined.
 
-2. **Check the basics, in order:**
+2. **Check only the basics relevant to the reproduced failure:**
    - **Secret settings:** are the required values in `.env` present and non-empty? (Use
      `.env.example` as the checklist.) Missing/blank is the #1 cause. Never read `.env` values aloud —
      follow `env-secrets-vybekiit.md`. Doctor verifies `.cursorignore` lists `.env`.
-   - **Tools installed + signed in:** run `vybekiit doctor` — it installs your AI assistant (Claude Code,
+   - **Tools installed + signed in:** run `vybekiit doctor` only when tool setup is the cause. It installs your AI assistant (Claude Code,
      Codex, or Cursor), the skills installer, and whichever cloud tools your settings use (database, hosting,
      Google sign-in). It also checks official platform skills are present. If it reports "not signed
      in yet," walk the builder through the one sign-in command it prints (a browser window opens;
@@ -48,12 +55,12 @@ Work through these in order. Stop as soon as you find and fix the problem, then
 3. **Fix the one thing.** Make the smallest change that addresses the actual cause. If it's a value
    the builder must supply, ask for **just that one**, with exactly where to get it.
 
-4. **Still stuck on generated code?** If the fix lives in scaffolded kit code and basics are green,
-   follow the maintainer **diagnose** workflow internally (`~/.claude/skills/diagnose/SKILL.md` or
-   equivalent) — never expose that skill name to the builder. Translate the outcome to one plain fix.
+4. **Still stuck?** Inspect the relevant project instructions and official documentation.
+   Do not assume a machine-global maintainer skill is installed. Record the concrete blocker
+   and continue independent work that does not depend on it.
 
 5. **Verify the fix.** Re-run the thing that was broken. Confirm it works now.
-   If the app is already online, ask: *"Want me to put this fix online now?"* (contract rule ⑧).
+   If the app is already online and publishing was not already authorized, ask: *"Want me to put this fix online now?"* (contract rule ⑧).
    Don't say "fixed" until the live URL reflects the change — or the builder said to wait.
    🎉 *Celebrate* — and tell them in one sentence what it was, in plain words.
 

package/dist/global-skills/eas-app-stores/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: eas-app-stores
-description: EAS service (paid). Build and submit iOS and Android apps with EAS to TestFlight, the App Store, or Google Play. Supports Expo and other React Native projects, plus existing native apps. Use for eas.json setup, release pipelines, signing, app versions and build numbers, store submissions, and listing metadata. For Expo websites and API routes, use eas-hosting; for adding React Native screens to a native app, use expo-brownfield.
+description: Build and submit iOS and Android apps with EAS to TestFlight, the App Store, or Google Play. Supports Expo and other React Native projects, plus existing native apps. Use for eas.json setup, release pipelines, signing, app versions and build numbers, store submissions, and listing metadata. For Expo websites and API routes, use eas-hosting; for adding React Native screens to a native app, use expo-brownfield.
 version: 1.1.0
 license: MIT
+disable-model-invocation: true
 ---
 
 # App Store Deployment

package/dist/global-skills/eas-app-stores/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "EAS App Stores"
-  short_description: "Paid EAS service. Build and submit iOS and Android apps."
+  short_description: "Build and submit iOS and Android apps."
   default_prompt: "Use $eas-app-stores to set up or verify EAS builds, TestFlight and store submissions, signing, versioning, and store metadata for iOS and Android apps: Expo and other React Native projects, plus existing native apps."

package/dist/global-skills/eas-hosting/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: eas-hosting
-description: EAS service (paid). Deploy Expo websites and Expo Router API routes to EAS Hosting - export the web bundle, run eas deploy for production and PR preview URLs, manage environment secrets and custom domains, and work within the Cloudflare Workers runtime. Also covers authoring API routes (+api.ts handlers, HTTP methods, request handling, CORS). Use when deploying an Expo web app or API routes, setting up EAS Hosting, or configuring hosting environments and domains. Not for native builds or store releases - use the eas-app-stores skill for those.
+description: Deploy Expo websites and Expo Router API routes to EAS Hosting - export the web bundle, run eas deploy for production and PR preview URLs, manage environment secrets and custom domains, and work within the Cloudflare Workers runtime. Also covers authoring API routes (+api.ts handlers, HTTP methods, request handling, CORS). Use when deploying an Expo web app or API routes, setting up EAS Hosting, or configuring hosting environments and domains. Not for native builds or store releases - use the eas-app-stores skill for those.
 version: 1.0.0
 license: MIT
+disable-model-invocation: true
 ---
 
 # EAS Hosting

package/dist/global-skills/eas-hosting/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "EAS Hosting"
-  short_description: "Paid EAS service. Deploy Expo websites and Expo Router API routes to EAS Hosting, with environment secrets, custom domains, and the Cloudflare Workers runtime"
+  short_description: "Deploy Expo websites and Expo Router API routes to EAS Hosting, with environment secrets, custom domains, and the Cloudflare Workers runtime"
   default_prompt: "Use $eas-hosting to deploy an Expo web app or Expo Router API routes to EAS Hosting, author +api.ts route handlers, manage hosting environment secrets and custom domains, and work within the Cloudflare Workers runtime."

package/dist/global-skills/eas-observe/SKILL.md

@@ -1,8 +1,9 @@
 ---
 name: eas-observe
-description: EAS service (paid). Use for anything related to EAS Observe - adding `expo-observe` to an Expo project (AppMetricsRoot/ObserveRoot HOC, markInteractive and ObserveInteractiveMarker, the useObserve hook, the Expo Router / React Navigation integrations for per-route metrics, user-defined events via `Observe.logEvent`, error reporting via ObserveErrorBoundary and `Observe.reportError`, and runtime config such as sampleRate and dispatchInDebug), querying via the EAS CLI (`eas observe:metrics-summary`, `observe:metrics`, `observe:routes`, `observe:events`, `observe:session`, `observe:versions`), interpreting the resulting metrics (cold/warm launch, TTR, TTI, navigation cold/warm TTR, update download, and the TTI frameRate/device/network params for triaging slow startups), or shipping an Observe integration inside a third-party package.
+description: Use for anything related to EAS Observe - adding `expo-observe` to an Expo project (AppMetricsRoot/ObserveRoot HOC, markInteractive and ObserveInteractiveMarker, the useObserve hook, the Expo Router / React Navigation integrations for per-route metrics, user-defined events via `Observe.logEvent`, error reporting via ObserveErrorBoundary and `Observe.reportError`, and runtime config such as sampleRate and dispatchInDebug), querying via the EAS CLI (`eas observe:metrics-summary`, `observe:metrics`, `observe:routes`, `observe:events`, `observe:session`, `observe:versions`), interpreting the resulting metrics (cold/warm launch, TTR, TTI, navigation cold/warm TTR, update download, and the TTI frameRate/device/network params for triaging slow startups), or shipping an Observe integration inside a third-party package.
 version: 1.1.0
 license: MIT
+disable-model-invocation: true
 ---
 
 # EAS Observe

package/dist/global-skills/eas-observe/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "EAS Observe"
-  short_description: "Paid EAS service. Set up expo-observe app metrics and query launch, route, event, and version performance with the EAS CLI"
+  short_description: "Set up expo-observe app metrics and query launch, route, event, and version performance with the EAS CLI"
   default_prompt: "Use $eas-observe to add expo-observe instrumentation (AppMetricsRoot/ObserveRoot, useObserve, ObserveInteractiveMarker, the router integrations, error reporting), query metrics with eas observe:* commands, and interpret cold/warm launch, TTR, and TTI results."

package/dist/global-skills/eas-simulator/SKILL.md

@@ -1,9 +1,10 @@
 ---
 name: eas-simulator
-description: "EAS service (paid). Run and control a user's app on a remote iOS/Android simulator hosted on EAS cloud. Read before running any `eas simulator:*` commands - it has the current syntax for this experimental API. Use whenever the user needs a simulator they can't run locally - 'run my app on a cloud simulator', 'use eas simulator to run/install/screenshot my app', 'I'm on Linux/Cursor and need an iOS device', 'no sim on this box / headless CI', 'let an agent click through my app and screenshot it', 'test my dev build on a remote sim with live reload', 'stream a sim to my browser' - even when they don't say 'EAS Simulator' or 'cloud'. On a host WITHOUT a local simulator (Linux, CI, cloud sandbox) it's the default; on macOS, do NOT auto-trigger for a plain 'run on the simulator' - use it only for a cloud/remote/shareable sim, an iOS version they lack, or an agent-driven session. NOT for local sims (expo run:ios, Xcode, Android Studio), EAS Build/Update, web preview, or physical devices."
+description: "Run and control a user's app on a remote iOS/Android simulator hosted on EAS cloud. Read before running any `eas simulator:*` commands - it has the current syntax for this experimental API. Use whenever the user needs a simulator they can't run locally - 'run my app on a cloud simulator', 'use eas simulator to run/install/screenshot my app', 'I'm on Linux/Cursor and need an iOS device', 'no sim on this box / headless CI', 'let an agent click through my app and screenshot it', 'test my dev build on a remote sim with live reload', 'stream a sim to my browser' - even when they don't say 'EAS Simulator' or 'cloud'. On a host WITHOUT a local simulator (Linux, CI, cloud sandbox) it's the default; on macOS, do NOT auto-trigger for a plain 'run on the simulator' - use it only for a cloud/remote/shareable sim, an iOS version they lack, or an agent-driven session. NOT for local sims (expo run:ios, Xcode, Android Studio), EAS Build/Update, web preview, or physical devices."
 version: 1.0.0
 license: MIT
 allowed-tools: "Bash(npx *eas-cli@*), Bash(npx *agent-device@*), Bash(npx expo *), Bash(eas *), Bash(expo *), Bash(xcodebuild*), Bash(pod*), Bash(argent *), Bash(ffmpeg*)"
+disable-model-invocation: true
 ---
 
 # EAS Simulator
@@ -187,6 +188,12 @@ If a controller fails to download a recording, retrieve it from [EAS session art
 
 For the full verb set and the `argent` controller alternative, see [references/controllers.md](./references/controllers.md).
 
+## When the app crashes: device logs and crash reports (iOS)
+
+When the app crashes or closes on launch, read the iOS session's crash reports and device log before guessing from screenshots. Read them from the preview API URL in `simulator:get --json`. That URL carries the session token, so never print it.
+
+**Hold the device log before you reproduce the crash.** Without the hold, the crash gets a report but an empty log tail. Commands, fields, and fallbacks are in [references/logs-and-crashes.md](./references/logs-and-crashes.md).
+
 ## Operating principles
 
 The non-obvious mental model worth internalizing. Specific error→fix lookups (hung verbs, `tap`→`press`, `--platform`, `--json`, `pod install` locale, orphaned sessions, boot variability) live in [references/troubleshooting.md](./references/troubleshooting.md).
@@ -217,6 +224,7 @@ printf '# managed by eas-cli\n' > .env.eas-simulator   # clear the stale session
 
 - [references/run-your-app.md](./references/run-your-app.md) — full command sequences for modes A, B, and C (read before running a mode).
 - [references/controllers.md](./references/controllers.md) — agent-device verb reference and the `argent` alternative.
+- [references/logs-and-crashes.md](./references/logs-and-crashes.md) — device logs and crash reports from an iOS session (read when the app crashes or misbehaves).
 - [references/troubleshooting.md](./references/troubleshooting.md) — concrete errors and fixes.
 
 Source of truth: Expo docs and the `eas` / `agent-device` CLIs (`npx --yes eas-cli@latest simulator:* --help`, `agent-device --help`). This skill teaches how to apply them; it doesn't replace them.

package/dist/global-skills/eas-simulator/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "EAS Simulator"
-  short_description: "Paid EAS service. Run and drive your app on a remote iOS/Android simulator on EAS cloud, from the CLI or an agent, with a live browser preview"
+  short_description: "Run and drive your app on a remote iOS/Android simulator on EAS cloud, from the CLI or an agent, with a live browser preview"
   default_prompt: "Use $eas-simulator to run, install, screenshot, and drive an app on a remote EAS cloud simulator - especially when no local simulator is available (Linux, CI, cloud agents) or a shareable browser preview is needed."