cm-project-bootstrap

Name: cm-project-bootstrap
Author: tody-agent

47stars23forks

How to install cm-project-bootstrap?

tody-agent/codymaster/cm-project-bootstrap

$npx -y skills add tody-agent/codymaster --skill cm-project-bootstrap

Installs into the current project.

Summary

Use when starting any new project from scratch. Asks for project identity (name, GitHub org, Cloudflare account), detects project type, sets up design system, staging+production, i18n from day 1, SEO foundation, AGENTS.md manifest, test infrastructure, 8-gate deploy pipeline, and

Files · 1

View on GitHub

SKILL.md

1	# 🏗️ Cody Master Project Bootstrap v2.0
2
3	> Every project starts here. No exceptions.
4	> Inspired by best practices from Amp, Codex, Cursor, Lovable, and Manus agents.
5
6	## Core Principles
7
8	```
9	ASK FIRST. BUILD SECOND. NEVER ASSUME IDENTITY.
10	STAGING IS MANDATORY. PRODUCTION IS EARNED.
11	I18N FROM DAY 1. NOT "LATER."
12	DESIGN SYSTEM BEFORE COMPONENTS. TOKENS BEFORE PIXELS.
13	SEO IS NOT AN AFTERTHOUGHT. IT'S INFRASTRUCTURE.
14	EVERY PROJECT GETS AN AGENTS.MD. NO EXCEPTIONS.
15	```
16
17	---
18
19	## 11-Phase Bootstrap Process
20
21	```
22	Phase 0: Identity Lock — WHO are you deploying as?
23	Phase 0.5: Security Foundation — HOW do we prevent secret leaks?
24	Phase 1: Project Type Detection — WHAT kind of project?
25	Phase 2: Repository & Environments — WHERE does code live?
26	Phase 3: Design System Foundation — HOW does it look?
27	Phase 4: i18n From Day 1 — WHICH languages?
28	Phase 5: SEO Foundation — HOW will people find it?
29	Phase 6: AGENTS.md + Git Safety — HOW do agents collaborate?
30	Phase 7: Test Infrastructure — HOW do we catch bugs?
31	Phase 8: Deploy Pipeline (8 Gates) — HOW does code ship?
32	Phase 9: Development Workflow — HOW do we work daily?
33	```
34
35	---
36
37	## Phase 0: Identity Lock 🔐
38
39	> MANDATORY. Cannot proceed without this.
40	> Values are NOT hardcoded — check history, suggest, let user confirm.
41
42	### Step 1: Check Identity History
43
44	Before asking anything, check if `~/.cm-identity-history.json` exists.
45	If it does, load previous identities and suggest the most recently used values.
46
47	```json
48	// ~/.cm-identity-history.json — Auto-maintained across projects
49	{
50	"lastUsed": "2026-03-17",
51	"identities": [
52	{
53	"github": { "org": "my-work-org" },
54	"cloudflare": { "accountId": "abc123def456ghi789jkl012mno345pqr" },
55	"i18n": { "primary": "en", "targets": ["es", "fr", "de"] },
56	"usedCount": 5,
57	"lastProject": "my-awesome-project",
58	"lastUsed": "2026-03-17"
59	}
60	]
61	}
62	```
63
64	### Step 2: Ask with Suggestions
65
66	Present the 6 questions, pre-filling from history where available.
67	User only needs to confirm or change:
68
69	```
70	📋 NEW PROJECT — Identity Setup
71	(Values from your last project shown as suggestions)
72
73	1. Project name (kebab-case): ___________
74	2. GitHub org [my-work-org]: → Enter to keep, or type new
75	3. Cloudflare ID [abc12...5pqr]: → Enter to keep, or type new
76	4. Domain: ___________
77	5. Primary language [en]: → Enter to keep, or type new
78	6. Target languages [es, fr, de]: → Enter to keep, or type new
79	```
80
81	> RULE: Never assume. Always show. Let user confirm.
82	> If no history exists, ask all 6 from scratch.
83
84	### Step 3: Verify Identity
85
86	```
87	⚠️ BEFORE PROCEEDING — CONFIRM:
88	🔐 GitHub Org: {org}
89	☁️ Cloudflare: {accountId}
90	🌐 Domain: {domain}
91	🗣️ Languages: {primary} (primary), {targets}
92	✅ Correct? → proceed
93	❌ Wrong? → fix before continuing
94	```
95
96	### Step 4: Create `.project-identity.json`
97
98	```json
99	{
100	"projectName": "{name}",
101	"github": {
102	"org": "{org}",
103	"repo": "{name}"
104	},
105	"cloudflare": {
106	"accountId": "{accountId}",
107	"projectName": "{name}",
108	"productionBranch": "production"
109	},
110	"domain": {
111	"production": "{domain}",
112	"staging": "staging.{domain}"
113	},
114	"i18n": {
115	"primary": "{primary}",
116	"targets": ["{targets}"]
117	},
118	"createdAt": "{date}",
119	"bootstrapVersion": "2.0"
120	}
121	```
122
123	### Step 5: Save to History
124
125	After creating `.project-identity.json`, update `~/.cm-identity-history.json`:
126	- Add or update the identity entry
127	- Increment `usedCount`
128	- Update `lastProject` and `lastUsed`
129	- This ensures next project gets pre-filled suggestions automatically
130
131	> Call `cm-identity-guard` to verify git config matches the GitHub org BEFORE any git push.
132
133	---
134
135	## Phase 0.5: Security Foundation 🛡️
136
137	> NEW — Defense-in-depth from day 0. Secrets leak at project start when security is "later."
138	> Calls `cm-secret-shield` for setup.
139
140	### Step 1: Create `.gitleaks.toml`
141
142	Create project-level Gitleaks configuration:
143
144	```toml
145	# .gitleaks.toml — Secret Shield Config
146	title = "CM Secret Shield"
147
148	[extend]
149	useDefault = true
150
151	[[rules]]
152	id = "supabase-service-key"
153	description = "Supabase Service Role Key"
154	regex = '''eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+'''
155	tags = ["supabase", "jwt"]
156
157	[[rules]]
158	id = "generic-high-entropy"
159	description = "High entropy string that may be a secret"
160	regex = '''(?i)(api[_-]?key\|secret[_-]?key\|access[_-]?token\|private[_-]?key\|auth[_-]?token)\s[=:]\s['"][a-zA-Z0-9/+

People who liked this also viewed

6 picks

Type

cm-project-bootstrap

47stars23forks

View on GitHub

How to install cm-project-bootstrap?

tody-agent/codymaster/cm-project-bootstrap

$npx -y skills add tody-agent/codymaster --skill cm-project-bootstrap

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# 🏗️ Cody Master Project Bootstrap v2.0
2
3	> Every project starts here. No exceptions.
4	> Inspired by best practices from Amp, Codex, Cursor, Lovable, and Manus agents.
5
6	## Core Principles
7
8	```
9	ASK FIRST. BUILD SECOND. NEVER ASSUME IDENTITY.
10	STAGING IS MANDATORY. PRODUCTION IS EARNED.
11	I18N FROM DAY 1. NOT "LATER."
12	DESIGN SYSTEM BEFORE COMPONENTS. TOKENS BEFORE PIXELS.
13	SEO IS NOT AN AFTERTHOUGHT. IT'S INFRASTRUCTURE.
14	EVERY PROJECT GETS AN AGENTS.MD. NO EXCEPTIONS.
15	```
16
17	---
18
19	## 11-Phase Bootstrap Process
20
21	```
22	Phase 0: Identity Lock — WHO are you deploying as?
23	Phase 0.5: Security Foundation — HOW do we prevent secret leaks?
24	Phase 1: Project Type Detection — WHAT kind of project?
25	Phase 2: Repository & Environments — WHERE does code live?
26	Phase 3: Design System Foundation — HOW does it look?
27	Phase 4: i18n From Day 1 — WHICH languages?
28	Phase 5: SEO Foundation — HOW will people find it?
29	Phase 6: AGENTS.md + Git Safety — HOW do agents collaborate?
30	Phase 7: Test Infrastructure — HOW do we catch bugs?
31	Phase 8: Deploy Pipeline (8 Gates) — HOW does code ship?
32	Phase 9: Development Workflow — HOW do we work daily?
33	```
34
35	---
36
37	## Phase 0: Identity Lock 🔐
38
39	> MANDATORY. Cannot proceed without this.
40	> Values are NOT hardcoded — check history, suggest, let user confirm.
41
42	### Step 1: Check Identity History
43
44	Before asking anything, check if `~/.cm-identity-history.json` exists.
45	If it does, load previous identities and suggest the most recently used values.
46
47	```json
48	// ~/.cm-identity-history.json — Auto-maintained across projects
49	{
50	"lastUsed": "2026-03-17",
51	"identities": [
52	{
53	"github": { "org": "my-work-org" },
54	"cloudflare": { "accountId": "abc123def456ghi789jkl012mno345pqr" },
55	"i18n": { "primary": "en", "targets": ["es", "fr", "de"] },
56	"usedCount": 5,
57	"lastProject": "my-awesome-project",
58	"lastUsed": "2026-03-17"
59	}
60	]
61	}
62	```
63
64	### Step 2: Ask with Suggestions
65
66	Present the 6 questions, pre-filling from history where available.
67	User only needs to confirm or change:
68
69	```
70	📋 NEW PROJECT — Identity Setup
71	(Values from your last project shown as suggestions)
72
73	1. Project name (kebab-case): ___________
74	2. GitHub org [my-work-org]: → Enter to keep, or type new
75	3. Cloudflare ID [abc12...5pqr]: → Enter to keep, or type new
76	4. Domain: ___________
77	5. Primary language [en]: → Enter to keep, or type new
78	6. Target languages [es, fr, de]: → Enter to keep, or type new
79	```
80
81	> RULE: Never assume. Always show. Let user confirm.
82	> If no history exists, ask all 6 from scratch.
83
84	### Step 3: Verify Identity
85
86	```
87	⚠️ BEFORE PROCEEDING — CONFIRM:
88	🔐 GitHub Org: {org}
89	☁️ Cloudflare: {accountId}
90	🌐 Domain: {domain}
91	🗣️ Languages: {primary} (primary), {targets}
92	✅ Correct? → proceed
93	❌ Wrong? → fix before continuing
94	```
95
96	### Step 4: Create `.project-identity.json`
97
98	```json
99	{
100	"projectName": "{name}",
101	"github": {
102	"org": "{org}",
103	"repo": "{name}"
104	},
105	"cloudflare": {
106	"accountId": "{accountId}",
107	"projectName": "{name}",
108	"productionBranch": "production"
109	},
110	"domain": {
111	"production": "{domain}",
112	"staging": "staging.{domain}"
113	},
114	"i18n": {
115	"primary": "{primary}",
116	"targets": ["{targets}"]
117	},
118	"createdAt": "{date}",
119	"bootstrapVersion": "2.0"
120	}
121	```
122
123	### Step 5: Save to History
124
125	After creating `.project-identity.json`, update `~/.cm-identity-history.json`:
126	- Add or update the identity entry
127	- Increment `usedCount`
128	- Update `lastProject` and `lastUsed`
129	- This ensures next project gets pre-filled suggestions automatically
130
131	> Call `cm-identity-guard` to verify git config matches the GitHub org BEFORE any git push.
132
133	---
134
135	## Phase 0.5: Security Foundation 🛡️
136
137	> NEW — Defense-in-depth from day 0. Secrets leak at project start when security is "later."
138	> Calls `cm-secret-shield` for setup.
139
140	### Step 1: Create `.gitleaks.toml`
141
142	Create project-level Gitleaks configuration:
143
144	```toml
145	# .gitleaks.toml — Secret Shield Config
146	title = "CM Secret Shield"
147
148	[extend]
149	useDefault = true
150
151	[[rules]]
152	id = "supabase-service-key"
153	description = "Supabase Service Role Key"
154	regex = '''eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+'''
155	tags = ["supabase", "jwt"]
156
157	[[rules]]
158	id = "generic-high-entropy"
159	description = "High entropy string that may be a secret"
160	regex = '''(?i)(api[_-]?key\|secret[_-]?key\|access[_-]?token\|private[_-]?key\|auth[_-]?token)\s[=:]\s['"][a-zA-Z0-9/+

People who liked this also viewed

6 picks

Type