vybekiit 0.7.29 → 0.7.32

package/dist/global-skills/vybekiitReferences/web/agent/goal-routes.json

@@ -0,0 +1,366 @@
+{
+  "routes": [
+    {
+      "skill": "onboarding",
+      "path": ".agents/skills/onboarding/SKILL.md",
+      "phrases": [
+        "set up my app",
+        "let's start",
+        "get me going",
+        "just bought"
+      ],
+      "wholeRequestPhrases": [
+        "hi",
+        "help",
+        "hello",
+        "hey",
+        "what is this",
+        "what can you do",
+        "where do i start"
+      ]
+    },
+    {
+      "skill": "plan-my-idea",
+      "path": ".agents/skills/plan-my-idea/SKILL.md",
+      "phrases": [
+        "help me plan",
+        "figure out my idea",
+        "think it through",
+        "marketplace",
+        "like airbnb"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "setup-payments",
+      "path": ".agents/skills/setup-payments/SKILL.md",
+      "phrases": [
+        "add payments",
+        "take money",
+        "sell something",
+        "charge people"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "go-live",
+      "path": ".agents/skills/go-live/SKILL.md",
+      "phrases": [
+        "put it online",
+        "publish",
+        "make it live",
+        "ship it",
+        "deploy"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-signin",
+      "path": ".agents/skills/add-signin/SKILL.md",
+      "phrases": [
+        "sign in",
+        "log in",
+        "create accounts",
+        "add users"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "reset-password",
+      "path": ".agents/skills/reset-password/SKILL.md",
+      "phrases": [
+        "forgot password",
+        "reset password",
+        "lost password",
+        "change password email"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "sign-in-with-email-link",
+      "path": ".agents/skills/sign-in-with-email-link/SKILL.md",
+      "phrases": [
+        "magic link",
+        "email link sign in",
+        "sign in without password",
+        "passwordless email"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "sign-in-with-phone",
+      "path": ".agents/skills/sign-in-with-phone/SKILL.md",
+      "phrases": [
+        "sign in with phone",
+        "text me a code",
+        "sms login",
+        "phone number login"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "setup-sms",
+      "path": ".agents/skills/setup-sms/SKILL.md",
+      "phrases": [
+        "set up sms",
+        "text messages",
+        "twilio",
+        "whatsapp messages",
+        "send texts"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "save-data",
+      "path": ".agents/skills/save-data/SKILL.md",
+      "phrases": [
+        "save my data",
+        "remember this",
+        "store info",
+        "add a database",
+        "book my classes",
+        "yoga booking",
+        "cancel a reservation",
+        "class scheduling",
+        "booking",
+        "reservations",
+        "appointments",
+        "student accessibility"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "design-my-data",
+      "path": ".agents/skills/design-my-data/SKILL.md",
+      "phrases": [
+        "design my database",
+        "what data do i need",
+        "what should my app remember"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-files",
+      "path": ".agents/skills/add-files/SKILL.md",
+      "phrases": [
+        "upload",
+        "store files",
+        "attachments"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "setup-email",
+      "path": ".agents/skills/setup-email/SKILL.md",
+      "phrases": [
+        "send emails",
+        "email my users",
+        "set up email"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "vybekiit-feedback",
+      "path": ".agents/skills/vybekiit-feedback/SKILL.md",
+      "phrases": [
+        "send feedback",
+        "report a kit bug",
+        "suggest a kit improvement",
+        "the kit is confusing"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "doctor",
+      "path": ".agents/skills/doctor/SKILL.md",
+      "phrases": [
+        "it's broken",
+        "nothing works",
+        "get an error",
+        "check my app"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "update-kit",
+      "path": ".agents/skills/update-kit/SKILL.md",
+      "phrases": [
+        "update the kit",
+        "get the latest",
+        "upgrade"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "harden",
+      "path": ".agents/skills/harden/SKILL.md",
+      "phrases": [
+        "lock down",
+        "make it safe",
+        "protect from abuse"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-images",
+      "path": ".agents/skills/add-images/SKILL.md",
+      "phrases": [
+        "add my logo",
+        "hero image",
+        "app icon",
+        "add images"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-teams",
+      "path": ".agents/skills/add-teams/SKILL.md",
+      "phrases": [
+        "invite teammates",
+        "add my team",
+        "organizations"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-notifications",
+      "path": ".agents/skills/add-notifications/SKILL.md",
+      "phrases": [
+        "notify users",
+        "send alerts"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-analytics",
+      "path": ".agents/skills/add-analytics/SKILL.md",
+      "phrases": [
+        "visitor stats",
+        "analytics",
+        "track usage"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-ai",
+      "path": ".agents/skills/add-ai/SKILL.md",
+      "phrases": [
+        "add ai",
+        "chatbot",
+        "smart replies"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-search",
+      "path": ".agents/skills/add-search/SKILL.md",
+      "phrases": [
+        "let users search",
+        "find things",
+        "search my data"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-realtime",
+      "path": ".agents/skills/add-realtime/SKILL.md",
+      "phrases": [
+        "live updates",
+        "real time",
+        "push changes instantly",
+        "refresh without reload"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-blog",
+      "path": ".agents/skills/add-blog/SKILL.md",
+      "phrases": [
+        "add a blog",
+        "write articles",
+        "changelog"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "buy-domain",
+      "path": ".agents/skills/buy-domain/SKILL.md",
+      "phrases": [
+        "get a domain",
+        "buy a web address",
+        "my own url"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "sign-in-with-google",
+      "path": ".agents/skills/sign-in-with-google/SKILL.md",
+      "phrases": [
+        "sign in with google",
+        "continue with google"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "check-safety",
+      "path": ".agents/skills/check-safety/SKILL.md",
+      "phrases": [
+        "am i ready to ship",
+        "is my app safe",
+        "did we cover security"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "track-errors",
+      "path": ".agents/skills/track-errors/SKILL.md",
+      "phrases": [
+        "tell me when things break",
+        "error alerts",
+        "app crashes"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "watch-my-app",
+      "path": ".agents/skills/watch-my-app/SKILL.md",
+      "phrases": [
+        "watch my app",
+        "check if my app is working",
+        "tell me when my app is down"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "back-up-my-code",
+      "path": ".agents/skills/back-up-my-code/SKILL.md",
+      "phrases": [
+        "save my code",
+        "back up",
+        "put it on github"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "validate-my-idea",
+      "path": ".agents/skills/validate-my-idea/SKILL.md",
+      "phrases": [
+        "validate my idea",
+        "test demand",
+        "start a waitlist",
+        "test my offer"
+      ],
+      "wholeRequestPhrases": []
+    },
+    {
+      "skill": "add-language",
+      "path": ".agents/skills/add-language/SKILL.md",
+      "phrases": [
+        "translate my app",
+        "add spanish",
+        "make it hebrew"
+      ],
+      "wholeRequestPhrases": []
+    }
+  ]
+}

package/dist/global-skills/vybekiitReferences/web/agent/mcp-setup.md

@@ -1,4 +1,4 @@
-# MCP setup — Cursor, Claude Desktop, Codex (agent-only)
+# MCP setup — Cursor, Claude Code, Claude Desktop, Codex (agent-only)
 
 Merge provider snippets from `.vybekiit/agent/mcp-*.json` into the buyer's AI client config. **Preserve existing servers** — never replace the whole file.
 
@@ -10,6 +10,15 @@ Merge provider snippets from `.vybekiit/agent/mcp-*.json` into the buyer's AI cl
 2. Merge each needed fragment's `mcpServers` block into the top-level `mcpServers` object.
 3. Restart Cursor or open **Settings → Tools & MCP** and confirm each server is connected.
 
+## Claude Code
+
+**Config:** project `.mcp.json`, or `claude mcp add --scope project <name> ...`
+
+Add a server only when the skill you are following needs it. Every connected server adds its tools
+to each session, so an idle server costs the vibe coder time and money. Merge the needed fragment's
+`mcpServers` block into `.mcp.json` (same JSON shape as Cursor), run `/mcp` to confirm it is
+connected, and remove servers the app no longer uses.
+
 ## Claude Desktop
 
 **Config (macOS):** `~/Library/Application Support/Claude/claude_desktop_config.json`
@@ -162,4 +171,4 @@ Never connect MCP to production buyer data without `read_only=true` or a dev bra
 
 ### MongoDB (agent/maintainer only)
 
-When `.env` has `DATA_PROVIDER=mongodb`, merge `mcp-mongodb.json` and copy `MONGODB_URI` into `MDB_MCP_CONNECTION_STRING`. Keep `MDB_MCP_READ_ONLY=true` unless a maintainer explicitly needs write tools. Buyers never see provider names — see `BUILDER-VOICE.md`.
+When `settings.env` has `DATA_PROVIDER=mongodb`, merge `mcp-mongodb.json` and copy `MONGODB_URI` into `MDB_MCP_CONNECTION_STRING`. Keep `MDB_MCP_READ_ONLY=true` unless a maintainer explicitly needs write tools. Buyers never see provider names — see `BUILDER-VOICE.md`.

package/dist/global-skills/vybekiitReferences/web/agent/session-bootstrap.md

@@ -1,7 +1,7 @@
 # Session bootstrap (agent-only)
 
 <!-- vybekiit:generated:start session-bootstrap -->
-Reuse instructions already loaded in this conversation. Simple questions need brief answers, not setup. Inspect before project-specific claims; execute requests for work.
+Reuse instructions already loaded in this conversation. A greeting, a plain "help", or "what is this" in a project whose `checklist.md` Decision log has no dated entries starts the onboarding skill. Other simple questions need brief answers. Inspect before project-specific claims; execute requests for work.
 
 ## Read order (when needed)
 

package/dist/global-skills/vybekiitReferences/web/language.md

@@ -67,16 +67,6 @@ read a definition aloud.
 | transactional email | the emails your app sends automatically | receipts, sign-in codes, confirmations |
 | SMTP / mail provider | your email | the service that delivers their app's emails |
 
-## Payments & tax
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| Merchant of Record / MoR | the service that handles tax for you | removes VAT/sales-tax fear — the default handles it |
-| VAT / sales tax | tax on sales (handled for you when MoR is on) | they never need to file tax themselves on the default path |
-| variant / product id | the product's ID in the payment dashboard (agent handles) | they pick a price; you wire the id |
-| subscription | recurring charge | money that repeats on a schedule |
-| refund / chargeback | money returned / disputed charge | when a customer gets money back or disputes a charge |
-
 ## Building blocks (rarely needed, but translate if it slips out)
 
 | Don't say (jargon) | Say instead (plain) | Why it matters to them |
@@ -95,24 +85,6 @@ read a definition aloud.
 | frontend | the part people see and click | the screens, buttons, and text |
 | backend | the part that does the work behind the scenes | saving data, sending email, taking payment |
 
-## Quality and saving your work
-
-<!-- source: @vybekiit/agent-kit renderSdlcVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| test / unit test | I checked it still works | reassures them without test-suite vocabulary |
-| TDD / tests-first | *(agent-internal — never say)* | agent-internal — never say |
-| linter / formatter / Biome | tidying the code | usually invisible; only mention if they ask why you paused |
-| quality smoke / typecheck | everything checks out | onboarding and pre-ship reassurance |
-| pull request / PR | a safe copy for the checker to review | when saving via branch before merge |
-| CI / GitHub Actions | the automatic checker online | never name GitHub Actions |
-| CD / deploy pipeline | putting updates online automatically | only if they overhear pipeline talk |
-| Playwright / E2E / headless browser | I walked through your app like a visitor would | UI walkthrough without tool names |
-| back up / save progress online | I saved your progress online | never say GitHub — stays in service ban list |
-| worktree | *(agent-internal — never say)* | agent-internal — never say |
-| husky / hook / pre-push | *(agent-internal — never say)* | agent-internal — never say |
-
 ## Planning together (before big builds)
 
 | Don't say (jargon) | Say instead (plain) | Why it matters to them |
@@ -175,65 +147,6 @@ read a definition aloud.
 | locale | the visitor's language and region | so the app speaks each visitor's language |
 | RTL / right-to-left | apps that read right-to-left (Hebrew, Arabic) | the layout flips automatically for them |
 
-## Your app's layout
-
-<!-- source: @vybekiit/agent-kit renderUiVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| navbar / header / top nav | the top menu | matches what they see at the top of the screen |
-| sidebar / side nav | the side menu | matches what they see along the side |
-| admin dashboard / dashboard | your dashboard / signed-in area | the part only logged-in users see |
-| cloud / hosting / serverless | your app's home online | where the live app runs — never name the provider |
-| analytics | visitor stats | who uses the app without analytics jargon |
-| SEO | how search engines find you | discoverability in plain words |
-| GEO / JSON-LD / structured data | extra details search engines read | structured metadata without crawler jargon |
-| streaming (AI) | the reply appears word by word | explains live AI text without "streaming" |
-| chat with AI / AI chat | talk to the assistant inside your app | in-app AI without product names |
-| sign in / log in | sign in | explicit row — complements "authentication / auth" |
-| deeplink / URI scheme | I sent that to your assistant | Report Mode handoff — never expose URL schemes |
-| Report mode / inspect mode | point at what's wrong | only if they ask about the hotkey overlay |
-
-## When something breaks
-
-<!-- source: @vybekiit/agent-kit renderFailureVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| bug | something isn't working right | plain framing before the fix |
-| error / exception | something went wrong — here's the one fix | one clear next step, never a wall of red |
-| not working / broken | something broke — I'll figure it out | routes to doctor without debug vocabulary |
-
-## Agent-internal — never say
-
-<!-- source: @vybekiit/agent-kit renderAgentInternalVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| middleware | *(agent-internal — never say)* | agent-internal — never say |
-| idempotency | *(agent-internal — never say)* | agent-internal — never say |
-| race condition | *(agent-internal — never say)* | agent-internal — never say |
-| DOM / CSS selector / element selector | *(agent-internal — never say)* | agent-internal — say "what you clicked" to the vibe coder |
-
-## Talking about the tools themselves
-
-The vibe coder also overhears you reasoning about your own tooling. Those terms break the illusion just
-as badly as "env var" does — never name a tool, just say what it does for them.
-
-<!-- source: @vybekiit/agent-kit renderToolVocabularyTable() — keep in sync -->
-
-| Don't say (jargon) | Say instead (plain) | Why it matters to them |
-|---|---|---|
-| Claude Code / Codex / Cursor | your assistant | they picked an outcome, not a tool — naming the product breaks the "I just talk to one helper" feel |
-| the CLI / the terminal / the command line | the part I work in (you don't need to touch it) | the black text screen is mine to drive; surfacing it invites them to poke and get stuck |
-| the IDE / the editor | where your app is being built | the window they have open — call it by what it does, not its product name |
-| agent / the model / the LLM | me / your assistant | they are talking to one helper, not a "model" — keep it personal and singular |
-| prompt | what you tell me / your request | their plain words to me — never frame it as a technical input they must craft |
-| context window | how much I can keep in mind at once | why I sometimes recap or ask them to confirm where we are — not a setting they manage |
-| rules file / AGENTS.md / CLAUDE.md / .cursor/rules | my instructions for your project | the file that tells me how to behave here — they never need to open or edit it |
-| slash command | a shortcut I can run | a quick action I trigger for them — frame it as something I do, not something they type |
-| MCP / MCP server | a tool I can use for you | an extra capability I plug in on their behalf — the plumbing stays invisible |
-
 ## Service names — never speak these
 
 The kit can run on different services under the hood. **Never name the underlying service to the
@@ -246,16 +159,6 @@ vibe coder.** They chose a goal, not a technology — you pick the service and k
 - This holds even when a provider's own screen is open in front of the vibe coder — guide them by what
   they see and click ("the blue Authorize button"), not by the service's name.
 
-## Tone
-
-<!-- source: @vybekiit/agent-kit renderToneSection() — keep in sync -->
-
-- Warm, confident, brief. You're the expert handling the hard parts.
-- One step at a time. Never a wall of instructions.
-- Always end a manual step by telling them **exactly** what to click/copy and what you'll do next.
-- Celebrate wins.
-- **No em dashes (`—`).** They read like AI filler. In chat and body copy, use a period, comma, colon, or parentheses instead. **UI titles, nav labels, and section headings:** short phrases only; no em dash and no trailing period, comma, or ellipsis. Split into two lines or two i18n keys instead. Hyphens in compound words (`build-time`) are fine.
-
 ## Right-to-left languages
 
 If the vibe coder writes to you in Hebrew or Arabic, reply in their language. Their app already mirrors
@@ -321,10 +224,16 @@ its layout automatically for RTL visitors — you don't need to do anything spec
 | agent / the model / the LLM | me / your assistant | they are talking to one helper, not a "model" — keep it personal and singular |
 | prompt | what you tell me / your request | their plain words to me — never frame it as a technical input they must craft |
 | context window | how much I can keep in mind at once | why I sometimes recap or ask them to confirm where we are — not a setting they manage |
-| rules file / AGENTS.md / CLAUDE.md / .cursor/rules | my instructions for your project | the file that tells me how to behave here — they never need to open or edit it |
+| rules file / AGENTS.md / .cursor/rules | my instructions for your project | the file that tells me how to behave here — they never need to open or edit it |
 | slash command | a shortcut I can run | a quick action I trigger for them — frame it as something I do, not something they type |
 | MCP / MCP server | a tool I can use for you | an extra capability I plug in on their behalf — the plumbing stays invisible |
 | pnpm / npm / package manager | getting the building blocks ready | one-time install wait — never name the package manager |
+| Terminal app (when they must open it) | the Terminal app: the window where you paste the one line I give you | only for a one-time setup step; give the exact line to paste and what they should see after |
+| JSON / .json file | a settings file | plain text the app reads; they never edit it by hand |
+| API / endpoint / REST | the connection to [service] | how the app talks to another service; name what it does, not the plumbing |
+| GitHub / repo / repository | your online copy of the code | where their work is saved online; the service name stays invisible |
+| Chrome profile / debugging port / Chromium | your Chrome browser | the browser they already use; the setup details stay invisible |
+| browser automation / CDP / headless browser | the browser helper: I open Chrome and copy the keys for you | they only sign in when asked; keys go straight into the app settings and are never shown |
 | GitHub Copilot / Copilot | your assistant | deliberately out of scope — collapse like other assistant products if it slips out |
 <!-- vybekiit:generated:end tool-vocabulary -->
 
@@ -435,9 +344,5 @@ its layout automatically for RTL visitors — you don't need to do anything spec
 | idempotency | *(agent-internal — never say)* | agent-internal — never say |
 | race condition | *(agent-internal — never say)* | agent-internal — never say |
 | DOM / CSS selector / element selector | *(agent-internal — never say)* | agent-internal — say "what you clicked" or "location in code" in the handoff only |
-| sandbox | *(agent-internal — never say)* | agent-internal — never say |
-| ask mode / agent mode | *(agent-internal — never say)* | agent-internal — never say |
-| skills CLI / skills.sh | *(agent-internal — never say)* | agent-internal — never say |
-| *-vybekiit.md (Layer B wrapper paths) | *(agent-internal — never say)* | agent-internal file paths — never spoken aloud |
 | JWT / JWKS | *(agent-internal — never say)* | agent-internal — never say |
 <!-- vybekiit:generated:end agent-internal-vocabulary -->

package/dist/global-skills/vybekiitReferences/web/platform-skills/ai-vybekiit.md

@@ -1,3 +1,3 @@
 # ai-vybekiit
 
-Use `resolve*Provider()` from `@vybekiit/ai` — see package README and ADR-0012.
+Use `resolve*Provider()` from `@vybekiit/ai` — see package README.

package/dist/global-skills/vybekiitReferences/web/platform-skills/analytics-vybekiit.md

@@ -12,7 +12,7 @@
 ## Kit wiring
 
 1. Analytics via `@vybekiit/analytics` → `resolveAnalyticsProvider()`
-2. PostHog: set `POSTHOG_API_KEY`, `POSTHOG_HOST` in `.env`; use pinned skills + MCP for instrumentation
+2. PostHog: set `POSTHOG_API_KEY`, `POSTHOG_HOST` in `settings.env`; use pinned skills + MCP for instrumentation
 3. Plausible: script tag / API per docs; no pinned upstream skills
 
 ## Verify-before-advance

package/dist/global-skills/vybekiitReferences/web/platform-skills/assets-vybekiit.md

@@ -1,4 +1,4 @@
-# Platform wrapper: asset optimization + CDN (ADR-0010)
+# Platform wrapper: asset optimization + CDN
 
 **Agent-only.** Used by `add-images`, `add-files`, build hooks, and `VybeImage`.
 

package/dist/global-skills/vybekiitReferences/web/platform-skills/better-auth-vybekiit.md

@@ -11,7 +11,7 @@
 
 1. Requires database first — run `save-data` / `supabase-vybekiit.md` if not ready
 2. Auth via `@vybekiit/auth` → `resolveAuthProvider()` (better-auth when `AUTH_PROVIDER` default)
-3. Set `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `DATABASE_URL` in `.env` (agent generates secrets)
+3. Set `BETTER_AUTH_SECRET` and `DATABASE_URL` in `.env` (agent generates secrets), and `BETTER_AUTH_URL` in `settings.env`
 4. Mount handler at `app/api/auth/[...all]/route.ts`
 5. Wire `src/lib/auth-client.ts` stubs marked `TODO(vybekiit): … — skill: add-signin`
 

package/dist/global-skills/vybekiitReferences/web/platform-skills/browser-automation-vybekiit.md

@@ -12,6 +12,13 @@
 | `cws` | `$HOME/.cws-chrome-profile` | Chrome Web Store extension publish |
 | `nc` | `$HOME/.nc-chrome-profile` | Namecheap API key setup |
 | `gd` | `$HOME/.gd-chrome-profile` | GoDaddy API key setup |
+| `cf` | `$HOME/.cf-chrome-profile` | Cloudflare access key |
+| `db` | `$HOME/.supabase-chrome-profile` | Supabase project keys (reads them with the `supabase` CLI) |
+| `google` | `$HOME/.google-chrome-profile` | Google sign-in client (`google oauth`) |
+
+Key-paste helpers (no browser): `openai`, `anthropic`, `resend`, `sentry` (`setup`), and `github` (reads the `gh` token).
+The paste ones need the builder: ask them to run `vybekiit-automate <name> setup` in their own terminal.
+It asks for the key with hidden typing. With `--json` and no key it stops and says so.
 
 ## CLI modes
 
@@ -31,8 +38,9 @@ Flags: `--json` (never prompt), `--yes` (skip confirms), `CI=1` or non-TTY requi
 
 ## Rules
 
+- Every `setup` saves keys straight into the app `.env` (nearest folder with `package.json`) and prints only the key names. Never print, read back or paste key values into chat.
 - **Blind navigation only** — selectors/DOM; never send dashboard screenshots to the model
-- Builder **signs in only** for LS; agent runs all other steps
+- Chrome starts on its own in the right profile. The builder **only signs in** (LS, Cloudflare, Google); the agent runs all other steps
 - Never say "Playwright", "DOM", "browser automation", or "fresh-squeezy" to the builder
 
 ## Legacy

package/dist/global-skills/vybekiitReferences/web/platform-skills/cms-vybekiit.md

@@ -1,3 +1,3 @@
 # cms-vybekiit
 
-Use `resolve*Provider()` from `@vybekiit/cms` — see package README and ADR-0012.
+Use `resolve*Provider()` from `@vybekiit/cms` — see package README.

package/dist/global-skills/vybekiitReferences/web/platform-skills/compliance-vybekiit.md

@@ -1,3 +1,3 @@
 # compliance-vybekiit
 
-Use `resolve*Provider()` from `@vybekiit/compliance` — see package README and ADR-0012.
+Use `resolve*Provider()` from `@vybekiit/compliance` — see package README.

package/dist/global-skills/vybekiitReferences/web/platform-skills/deploy-github-pages-vybekiit.md

@@ -1,6 +1,6 @@
 # Platform wrapper: GitHub Pages deploy (free static host)
 
-**Agent-only.** Invoked by buyer skill `go-live` when `HOSTING_PROVIDER=github-pages` (ADR-0040).
+**Agent-only.** Invoked by buyer skill `go-live` when `HOSTING_PROVIDER=github-pages`.
 The free, zero-cold-start static host tied to the buyer's own repo — best for the spa, extension
 popup, and static web targets. Static only: no SSR/backend (use cloudflare or deno-deploy for those).
 
@@ -8,7 +8,7 @@ popup, and static web targets. Static only: no SSR/backend (use cloudflare or de
 
 - Docs: https://docs.github.com/en/pages
 - CLI: `gh` (installed + probed by `vybekiit doctor`) — GitHub Pages needs no extra host CLI
-- Auth: `gh auth login` (browser once) or `GITHUB_TOKEN`/`GH_TOKEN` in CI — never stored in `.env` (ADR-0001)
+- Auth: `gh auth login` (browser once) or `GITHUB_TOKEN`/`GH_TOKEN` in CI — never stored in `.env`
 
 ## Kit wiring
 

package/dist/global-skills/vybekiitReferences/web/platform-skills/deploy-railway-vybekiit.md

@@ -11,12 +11,12 @@
 
 ## Kit wiring
 
-1. Set **coupled stack** in `.env`: `HOSTING_PROVIDER=railway` and `DATA_PROVIDER=railway` (agent decides — builder never picks hosts)
+1. Set **coupled stack** in `settings.env`: `HOSTING_PROVIDER=railway` and `DATA_PROVIDER=railway` (agent decides — builder never picks hosts)
 2. Run `vybekiit doctor` — installs `railway`, runs `railway setup agent -y`, checks auth
 3. Call `resolveHosting()` from `@vybekiit/deploy` — returns Railway adapter
 4. Supply a `RailwayRunner` that executes the adapter's railway action (go-live skill owns the shell)
 5. Optional secret settings after link: `RAILWAY_PROJECT_ID`, `RAILWAY_SERVICE_ID`
-6. CLI auth: `railway login` (browser flow) — no token in `.env` (ADR-0001)
+6. CLI auth: `railway login` (browser flow) — no token in `.env`
 
 ## Verify-before-advance