UNPKG

create-hokage-js-app

Version:

🔥 Best CLI tool to create a MERN stack template. Quick, clean, and customizable.

github.com/hassaammgl/create-hokage-js-app

hassaammgl/create-hokage-js-app

127 lines (91 loc) • 2.98 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
# Workflow: Code Review Procedure for reviewing a diff (human PR or agent self-review). Use after every implementation. --- ## Review Order 1. Purpose & acceptance criteria 2. Security 3. Correctness / bugs 4. Architecture & boundaries 5. Performance 6. Tests 7. Readability & duplication 8. Docs & ops (API, migrations, flags) Do not bikeshed formatting if a formatter owns it. --- ## Security Checklist - [ ] No secrets committed - [ ] Input validated at boundary - [ ] Parameterized SQL / no injection sinks - [ ] XSS sinks safe - [ ] Authn present; authz object-level checks correct - [ ] No IDOR (resource ownership checked) - [ ] Sensitive data not logged - [ ] CSRF/CORS correct for the auth model - [ ] File upload constraints if applicable - [ ] Dependency additions justified and audited --- ## Correctness Checklist - [ ] Edge cases handled (empty, null, max length, retries) - [ ] Error paths return correct status codes - [ ] Transactions correct; no partial writes on failure - [ ] Idempotency for retried mutations - [ ] Backwards compatible or migration plan present - [ ] Feature flags default safe if used --- ## Architecture Checklist - [ ] Dependency direction preserved - [ ] Controllers thin; no business logic in adapters - [ ] No new cross-module deep imports - [ ] No duplicate utilities / parallel abstractions - [ ] Right layer for the change - [ ] OOP preferred over procedural for business logic (`oop.md`) - [ ] SOLID not violated without documented exception - [ ] Domain invariants on entities; not anemic get/set mutation - [ ] Pattern used when `architecture/patterns.md` criteria match (or N/A) --- ## Performance Checklist - [ ] No N+1 queries - [ ] Lists paginated / bounded - [ ] Timeouts on external calls - [ ] No unbounded memory buffering - [ ] Hot-path work not doing unnecessary sync I/O --- ## Tests Checklist - [ ] Tests match changed behavior - [ ] Regression test for fixes - [ ] No flaky patterns (sleep-based waits without need) - [ ] No `.only` / skipped tests left behind --- ## Readability & Dead Code - [ ] Names clear; functions within size limits - [ ] No commented-out code - [ ] No unused imports/exports introduced - [ ] Diff free of unrelated churn --- ## API / Data - [ ] OpenAPI updated - [ ] Migration safe for rolling deploys - [ ] Error envelope consistent - [ ] No invented tables/fields --- ## Review Output Format ```markdown ## Verdict Approve | Request changes | Block (security) ## Findings ### Blockers - ... ### Major - ... ### Minor - ... ### Notes - ... ``` Severity: - **Blocker** — security issue, data loss, broken auth, broken prod deploy - **Major** — incorrect behavior, missing tests for critical logic, architecture violation - **Minor** — naming, small cleanups, non-blocking gaps --- ## Agent Self-Review Rule Agents must run this workflow on their own diff and fix blockers/majors before presenting work as done. Surface residual risks explicitly.