hypervibe

Plugin hypervibe from marketplace hypervibe-harness in flavien-ia/hypervibe-craft. Commands read from the repo's manifest — yesterday.

Skills (90)

• _add-keyring

  Internal. Sets up the access-key vault (Bitwarden) on the machine: installs the tool, connects the account, opens the daily session. Invoked by /start (Step 3bis) and by skills that discover a missing vault (_ensure-vault, _get-secret...). Not meant to be invoked directly by users.

• _check-deps

  Internal helper to check project dependencies (DB, email, etc.) with robust heuristics that don't fall for T3 bootstrap placeholders or localhost defaults. Delegates to bundled scripts/check-deps.mjs. Returns JSON. Triggered by add-auth, add-backup-db, and any skill that needs to verify a real cloud

• _collect-secret

  Internal pattern helper for every skill that needs a value the user must fetch from an external provider (API key, token, OAuth secret, measurement ID...). Defines the plugin-wide convention - a SECRET is always typed into a masked OS window and lands either in the vault (global key) or in the proje

• _convert-to-turborepo

  Internal helper to convert a single Next.js project into a Turborepo monorepo. Idempotent - if the project is already a monorepo (apps/web/ exists), returns immediately. Moves the existing project into apps/web/, creates root package.json with workspaces, pnpm-workspace.yaml, turbo.json, and adds tu

• _create-agent

  Internal - scaffolds an autonomous AI agent on its own worker: a capped key, a budget circuit breaker, tools, optional memory and a full trace. Invoked by add-automation or add-ai with a routing brief. Not for direct use.

• _create-cloudflare-worker

  Internal helper invoked by /add-automation once Wrangler is installed and the project is a monorepo. Creates the apps/worker/ directory, scaffolds a Cloudflare Worker via wrangler init, optionally adds CRON triggers natively in wrangler.toml, implements scheduled+fetch handlers, and deploys. Returns

• _create-contact-page

  Internal helper - creates a functional /contact page with a secured form (honeypot anti-spam, rate limiting delegated to the tRPC procedure, HTML injection protection). Detects i18n, email provider (Resend vs Brevo), and shadcn/ui + react-hook-form deps. Invoked by /add-email or any future skill tha

• _create-render-worker

  Internal helper invoked by /add-automation once the Render API key is in the vault (Render is driven via its REST API, no CLI) and the project is a monorepo. Creates the apps/worker/ directory with a background-process template deployed as a Render web service on the free plan (the free instance typ

• _create-routine

  Internal helper that turns an operator-side agentic task ("brief me every morning", "analyze my week every Friday", "watch X and alert me") into a Claude routine - a scheduled AI run on the user's own Claude account (cloud routine) or on their machine (local scheduled task). Detects which mechanism

• _create-workflow

  Internal - builds an event-triggered pipeline inside the app: when X happens, do A then B then C, with per-step retries and a run log. Invoked by add-automation or add-ai with a routing brief. Not meant to be invoked directly by users.

• _detect-project-root

  Internal helper to detect the basic structure of the current project (project name, monorepo vs single app, web directory path, Next.js detection). Returns a minimal set of 4 variables that most add-* skills need at the very beginning of their execution. Idempotent and fast. Not meant to be invoked

• _dns-brevo

  Internal skill called by /add-domain. Configures a custom domain in Brevo for professional email sending: the records Brevo asks for, published in the Cloudflare zone, the sender, then a test message whose signature is checked. Not meant to be called directly by users.

• _dns-cloudflare

  Internal - handle the case where the user's domain registrar IS Cloudflare (Cloudflare Registrar). No nameserver change needed; just verify the zone exists via CF REST API. Triggered by /add-domain when the registrar is Cloudflare.

• _dns-gandi

  Internal - change a Gandi-registered domain's nameservers to point to Cloudflare. Uses Gandi's REST API v5 directly with a Personal Access Token (no CLI install). Triggered by /add-domain when the registrar is Gandi.

• _dns-godaddy-manual

  Internal - guide the user click-by-click to change a GoDaddy-registered domain's nameservers manually. GoDaddy's MCP is search-only (cannot manage DNS), and their Domains API is gated for new users since 2024 - manual mode is the only option. Triggered by /add-domain when the registrar is GoDaddy.

• _dns-hostinger

  Internal - change a Hostinger-registered domain's nameservers to point to Cloudflare, via the Hostinger REST API (curl + API token from the Bitwarden vault). No MCP. Triggered by /add-domain when the registrar is Hostinger.

• _dns-infomaniak-manual

  Internal - guide the user click-by-click to change an Infomaniak-registered domain's nameservers manually. Infomaniak has a clean REST API for DNS records but the registry-level nameserver change endpoint is not publicly documented - manual mode is the only reliable option as of 2026-05. Triggered b

• _dns-ionos-manual

  Internal - guide the user click-by-click to change an IONOS-registered domain's nameservers manually. IONOS has a clean DNS API but no publicly documented endpoint for changing nameservers at the registry level - manual mode is the only reliable option as of 2026-05. Triggered by /add-domain when th

• _dns-lws

  Internal - change an LWS-registered domain's nameservers to point to Cloudflare, via the LWS Client API (curl, the LWS identifier and an API key from the vault, the machine's address allowed at LWS). Triggered by /add-domain for an LWS domain.

• _dns-namecheap

  Internal - change a Namecheap-registered domain's nameservers to point to Cloudflare. Uses Namecheap's REST API directly via curl (no CLI install). Triggered by /add-domain when the registrar is Namecheap.

• _dns-ovh

  Internal - change an OVH-registered domain's nameservers to point to Cloudflare. Uses OVH's REST API v1 directly with signed headers (no CLI install). Triggered by /add-domain when the registrar is OVH.

• _dns-porkbun

  Internal - change a Porkbun-registered domain's nameservers to point to Cloudflare. Uses Porkbun's REST API v3 directly via curl with API key + secret (no CLI install). Triggered by /add-domain when the registrar is Porkbun.

• _dns-resend

  Internal skill called by /add-domain. Configures a custom domain in Resend for professional email sending via the Resend REST API (curl + key from the vault). Adds the DNS records (SPF, DKIM, MX bounce) via the Cloudflare REST API (curl + Cloudflare token from the vault). No Resend CLI. Not meant to

• _dns-squarespace-manual

  Internal - guide the user click-by-click to change a Squarespace-registered domain's nameservers manually. Squarespace shut down the Google Domains API after the 2024 acquisition - there is no public API for nameserver changes. Triggered by /add-domain when the registrar is Squarespace (typically a

• _ensure-ai

  Internal - guarantees the project can call a model through its single AI brick (src/server/ai.ts, OpenRouter): a validated budget, a provider-side spending cap, and the no-training routing. Not meant to be invoked directly by users.

• _ensure-vault

  Internal preflight - make sure the Bitwarden vault is unlocked before a skill reads any global key. Run at the start of every skill that will consume a vault secret (Cloudflare, Neon, Resend/Brevo, Hostinger, Anthropic…), so the unlock window pops once up-front instead of a key-read silently failing

• _generate-secret

  Internal helper to generate a cryptographically secure random secret (API key, JWT secret, webhook secret, CRON_SECRET, etc.). Delegates to the bundled scripts/generate-secret.mjs. Shell-safe by default. Invoked by skills that need a fresh secret (add-auth AUTH_SECRET, add-cron CRON_SECRET, webhook

• _get-secret

  Internal pattern for reading a secret from the user's Bitwarden vault inside any skill. Defines the canonical Bash idiom (read into a shell variable, never print) plus the auto-unlock orchestration (if the vault is locked or the 6h session expired, open the unlock window, then retry). Referenced by

• _hash-password

  Internal helper to hash a password with Node's native scrypt (NOT bcrypt - bcrypt hashes contain $ characters that break shell and env var handling). Delegates to the bundled scripts/hash-password.mjs. Can hash a provided password or generate + hash a random one. Output format is `salt:hash` (hex:he

• _migrate-workers

  Internal helper invoked by /start. One-time migration for users coming from a Hypervibe version older than 2.5: consolidates the old separate background mechanisms (db-backup, quota-monitor, cron-dispatcher, each a loose Cloudflare worker) into the new unified shared worker hypervibe-jobs (one worke

• _pull-env-vars

  Internal helper to pull environment variables from Vercel for a given target (production, preview, development) and return them as JSON or merge them into the local .env.local. Delegates to the bundled scripts/pull-env-vars.mjs. Used by skills that need to read current Vercel state - rotate-secret (

• _push-env-vars

  Internal helper to push environment variables safely to the local .env AND to Vercel (production + preview + development). Delegates to the bundled scripts/push-env-vars.mjs. Triggered by any skill that needs to set env vars (add-db, add-auth, add-stripe, add-email, add-google-auth, add-github-auth,

• _setup-2fa-admin

  Internal. Sets up 2FA (TOTP) on a hypervibe admin-credentials login - mandatory for the single admin. TOTP code after the password, trusted-device cookie (24h), backup codes, idle auto-logout. The TOTP secret + backup codes are written to the Bitwarden vault (never the chat). Invoked by /add-2fa whe

• _setup-2fa-users

  Internal. Sets up optional per-user 2FA (TOTP) on a hypervibe user-accounts auth. Each user enables 2FA from their account page (scan a QR, confirm a code), with the secret + one-off backup codes stored per-user in the database. Login asks for the code after the password only for users who enabled i

• _setup-auth-admin

  Internal helper - sets up NextAuth in admin-credentials mode (fixed login via env vars, no DB, no OAuth). Invoked by add-auth when the user chose the "admin-only interface" option. Installs NextAuth core, configures the CredentialsProvider with a single hardcoded admin, generates dev + prod password

• _setup-auth-users

  Internal helper - sets up NextAuth in user-credentials mode (DB-backed email+password auth with signup, signin, account page with delete, and optional forgot/reset password if email is configured). Invoked by add-auth when the user chose the "system for users" option. Also offers OAuth add-ons (Goog

• _setup-github-deploy

  Internal helper invoked by /add-collab. Sets up GitHub Actions to deploy a Vercel-linked project, replacing Vercel's native Git integration. Configures Vercel token, GitHub secrets, the deploy workflow file, updates CLAUDE.md, and tells the user to suspend Vercel's native integration. Not meant to b

• _setup-gsc

  Internal helper to connect Google Search Console via a service account stored in the Bitwarden vault (no MCP, no Python, no restart). Guides the one-time creation of a Google service account, stores its JSON key in the vault (item GSC_SERVICE_ACCOUNT), and grants it owner access on the GSC property.

• _setup-indexnow

  Internal helper to set up IndexNow (proactive URL submission to Bing, Yandex, Seznam) on a Next.js project. Generates the proof key, drops the verification file in /public, creates a reusable helper, and wires the ping to the project's publication event (cron, postbuild, webhook, or manual CLI). Tri

• _setup-render

  Internal helper that ensures the Render API key lives in the Bitwarden vault (item RENDER, field api_key). Triggered by /add-automation and _create-agent before any Render REST API call. No CLI install - Render is driven 100% via its REST API (api.render.com/v1). Not meant to be invoked directly by

• _setup-stripe-cli

  Internal helper to install and authenticate the Stripe CLI on the user's machine. Triggered automatically by /add-stripe (and any other skill that needs Stripe CLI access) when `stripe --version` fails or when the user is not logged in. Not meant to be invoked directly by users.

• _setup-wrangler

  Internal helper to install and authenticate Wrangler (the Cloudflare CLI). Triggered automatically by /add-storage (and any other skill that needs Wrangler) when `wrangler --version` fails or when `wrangler whoami` reports the user is not logged in. Not meant to be invoked directly by users.

• _track-resource

  Internal helper - records a cloud resource in the project's resource manifest (`.hypervibe/resources.json`), right after a skill creates or adopts it. The manifest is what /save-project and /delete-project read first, instead of guessing resources by name similarity. Triggered by every provisioning

• _update-claude-md

  Internal helper to add or update entries in the project CLAUDE.md file idempotently. Accepts a target section (Stack, Key Commands, Conventions, Environment Variables, or a custom heading) and one or more lines to add. Detects and skips duplicates so re-running a skill doesn't add the same line twic

• _update-privacy-policy

  Internal helper to add or remove subprocessors in the project's RGPD privacy policy registry idempotently. Delegates to the bundled scripts/update-privacy-policy.mjs. Triggered by every add-* skill that introduces a third-party data processor (add-db, add-auth, add-google-auth, add-github-auth, add-

• accessibility

  Accessibility audit of a Next.js app: reads the code (images, buttons, links, form fields, keyboard, focus, zoom, motion), measures the live pages with PageSpeed Insights, explains each problem plainly, then applies the fixes the user approves.

• add-2fa

  Add two-factor authentication (2FA TOTP) to an existing T3 project's login. Orchestrator - asks which authenticator app the user wants, detects whether the project uses admin auth (single fixed login) or user accounts, and delegates to the right setup. Admin mode - 2FA is mandatory for the single ad

• add-agent-dashboard

  Add a monitoring screen for AI agents in the project admin: cost, run history, turn-by-turn traces, and a button to launch a run by hand. Installed when an agent is created, safe to re-run.

• add-ai

  Add AI to an existing Next.js project: chat assistant, content processing, or generation. Estimates the cost from live prices and provisions a spending-capped key before writing any code. Model-independent through OpenRouter.

• add-analytics

  Add Google Analytics (GA4) to an existing Next.js project. Includes RGPD cookie consent banner.

• add-auth

  Add NextAuth (Auth.js) authentication to an existing T3 project. One structured question decides the mode - admin (fixed login in env vars) or users (DB-backed email+password with signup, signin, account page, delete account, and optional forgot-password if email is configured). OAuth providers (Goo

• add-automation

  Route an automation need to the right shape: scheduled task, event-triggered pipeline, background worker, autonomous agent, or a personal recurring mission. Start here when you are not sure which one you want.

• add-backup-db

  Add automated Neon database backups to the current project. Registers the project as a snapshot target of the unified shared Cloudflare Worker "hypervibe-jobs" (one Worker per account for ALL background jobs, reused across projects) that creates point-in-time Neon branch snapshots every 2 weeks. Ret

• add-collab

  Manage GitHub collaborators on a project that uses the GitHub Actions deploy setup. Lists current collaborators, lets the user add or remove them, and explains how to do it manually. On first use (when the GitHub Actions deploy is not yet configured), it triggers the internal _setup-github-deploy he

• add-cron

  Add a scheduled task (cron) to the project: a protected /api/cron route registered on the shared Hypervibe clock, a dedicated Cloudflare Worker, or a GitHub Action. Triggered by an event rather than a clock? /add-automation.

• add-dark-mode

  Add dark mode support (light / dark / system) to an existing Next.js + Tailwind v4 project using next-themes. Configures the dark variant in globals.css, audits existing colors and proposes dark-mode tokens, mounts ThemeProvider in the root layout (and in the [locale] layout if i18n is detected), an

• add-db

  Add a Neon Postgres database to an existing T3 project. Provisions the database, configures Drizzle ORM, and pushes the schema. In a monorepo, creates a shared packages/db package.

• add-domain

  Guide the user to connect a custom domain to their Vercel-deployed app. Target architecture: the registrar, then Cloudflare (DNS + Email Routing), then Vercel (hosting). Supports Hostinger, Cloudflare, OVH, Namecheap, Gandi, Porkbun, Infomaniak, IONOS, Squarespace (ex-Google Domains), GoDaddy, and L

• add-email

  Add transactional email support (Resend or Brevo) to an existing T3 project. The skill auto-detects which provider to use based on env vars - no question asked when the choice is unambiguous. Can be called by /bootstrap or standalone.

• add-github-auth

  Add GitHub OAuth login to an existing project. Guides through GitHub OAuth App setup and configures env vars automatically. Can be used standalone or called by /add-auth.

• add-google-auth

  Add Google OAuth login to an existing project. Guides through Google Cloud Console setup and configures env vars automatically. Can be used standalone or called by /add-auth.

• add-i18n

  Add internationalization (i18n) to an existing T3/Next.js project using next-intl with sub-path routing. Uses `localePrefix: \"as-needed\"` so the default locale keeps its URLs unprefixed (preserving existing SEO and backlinks), and only non-default locales get a prefix.

• add-map

  Add an interactive vector map to a Next.js project using MapLibre GL JS + OpenFreeMap (free, no API key, no cookies, EU servers). Supports single pin, multi-pin, route, or full map-first layouts. Can be called by /bootstrap or standalone.

• add-notification-center

  Adds an in-app notification center to a Next.js app: a bell in the navigation bar, with a badge showing the number of unread notifications, a dropdown panel that lists the notifications, and read/unread state. Creates the `notification` table, the `notifyUser` server helper, the tRPC router, and the

• add-push-notification

  Adds push notifications (Web Push) to a Next.js app. Generates the VAPID keys, creates the subscriptions table, extends the PWA service worker with the push handlers, and adds an 'Enable notifications' button on the user side plus a server-side send helper. DEPENDS on /add-pwa (web push needs the se

• add-pwa

  Turns a Next.js app into an installable PWA (Progressive Web App) on mobile and desktop. Adds the manifest, a service worker (Serwist) with a minimal offline cache, icons generated from the project favicon, the iOS meta tags, and a small window inviting the user to install the app (native Android pr

• add-role

  Adds a user roles system (member, editor, moderator...) to the project. Creates the mechanics (hasRole/getRoles helpers, roles[] column on the users table, admin management page). Prerequisite: /add-auth in users mode. If admin auth is missing, the skill sets it up beforehand automatically to protec

• add-routine

  Create a recurring AI mission for YOURSELF, on your own Claude account: a morning brief, a Friday analysis, a watch that alerts you. Zero code, zero deployment, nothing added to the app.

• add-storage

  Add Cloudflare R2 file/image storage to an existing T3 project. Asks upfront what will be stored to infer public/private + propose UI build at the end.

• add-stripe

  Add Stripe Checkout payments to an existing T3 project. Creates server client, webhook endpoint, tRPC example, and local dev setup.

• add-test

  Add vitest tests and a human-readable cahier de recette (docs/recette.md) to a T3 project, with a pre-push hook and CI that refuse to publish a feature without its verification.

• bootstrap

  Bootstrap a T3 stack project. Describe what you want to build and Claude infers the right stack.

• clean

  Audit the project to find what is no longer used - orphan files, dead code, AI leftovers, unused dependencies, orphan env vars, DB tables with no caller, obsolete migrations. Produces a report with a certainty level and a danger level for each finding, then applies the validated deletions on a separ

• delete-project

  Cleanly deletes a Hypervibe project and all of its cloud infrastructure - Vercel, Neon, Cloudflare R2 (global + EU), Workers, DNS, db-backup, scheduled crons on the shared worker, Stripe webhook, Render services, OAuth clients, Upstash, etc. First, it displays a BIG warning and asks for a double con

• eco-audit

  Eco-responsibility audit of a deployed Next.js site. Measures representative pages via the PageSpeed Insights API, computes the EcoIndex score (open French methodology, grade A to G) and the per-visit impact estimate (gCO2e, water), identifies waste (images, unused JS, cache, third-party scripts), t

• geo

  Audit and optimize a Next.js site for AI answer engines (ChatGPT, Claude, Perplexity, Gemini, Copilot). First whether AI robots can read its pages at all (text without JavaScript, firewall, robots.txt), then what makes them citable. Complementary to /seo.

• gsc

  Connect a Next.js project to Google Search Console and audit the real Google data - indexing coverage, search queries, clicks, positions, and sitemap status. Complements /seo (on-page audit) with what Google actually sees. Use after the site has been deployed on a custom domain and has had a few wee

• new-email-address

  Create a new receiving address on a domain already connected via /add-domain. Uses Cloudflare Email Routing to forward messages (e.g. [email protected]) to an existing mailbox (Gmail, Outlook, etc.). Can take a destination address as an argument (typical case: called from /add-domain). The first

• optimize

  Audit what the app does on the server and what it costs, then fix it. Finds unbounded queries, polling that never stops, missing caching, binaries served from the database, N+1 reads, and work redone on every request. Cross-references the code with the real consumption of the free plans (Neon egress

• prof

  Explains how Hypervibe works in simple, non-technical terms. Use when the user wants to understand the system, the stack, or how things work under the hood.

• quotas
• rgpd-audit
• rotate-secret
• save-project
• security
• seo-perf
• seo
• spec
• start
• update-hypervibe

MCP servers (1)

• context7

  connects to: https://mcp.context7.com/mcp

Hooks (2)

• SessionStart

  node "${CLAUDE_PLUGIN_ROOT}/scripts/vault/session.mjs" sweep

• PreToolUse

  node "${CLAUDE_PLUGIN_ROOT}/hooks/guard-bash.mjs"

Similar plugins