release: v0.8 — UX & Charts

.claude/agents/code-reviewer.md

@@ -3,4 +3,46 @@ name: code-reviewer
 description: Reviews code for quality, security, and NeoBoard conventions.
 model: sonnet
 ---
-Senior reviewer for NeoBoard. Priority: 1) Security (credentials, parameterized queries, read-only, tenant isolation) 2) Query safety (timeouts, row limits, concurrency) 3) Architecture boundaries (component=UI, connection=DB, app=orchestration) 4) Performance (lazy loading, modular ECharts) 5) TypeScript strict 6) Tests.
+Senior reviewer for NeoBoard. Check staged/unstaged changes against these rules in priority order.
+
+## Steps
+
+1. Run `git diff` and `git diff --cached` to get all changes.
+2. Read each changed file to understand full context.
+3. Check against the rules below.
+
+## Rules (priority order)
+
+### Security (BLOCKING)
+- Parameterized queries only — no string interpolation in SQL/Cypher
+- Credentials never logged or exposed in responses
+- `tenant_id` filter present on all DB queries
+- `can_write` enforced server-side in API routes, not just UI
+
+### Query Safety (BLOCKING)
+- Read-only transactions for non-Form widgets
+- Row limits use MAX_ROWS+1 pattern, never LIMIT on user queries
+- Timeouts at driver level
+- User queries never modified or wrapped
+
+### Architecture (HIGH)
+- `component/` has no imports from `app/` or business logic
+- `connection/` has no UI/React imports
+- Charts use `next/dynamic` with `ssr: false`
+- ECharts imports from `echarts/core` + specific modules
+
+### Code Quality (MEDIUM)
+- TypeScript strict — no untyped `any` without justification
+- New behavior has corresponding tests
+- No over-engineering (single-use abstractions, premature generalization)
+
+## Output Format
+
+```
+[CRITICAL] file:line — Issue → Required fix
+[HIGH] file:line — Issue → Suggested fix
+[MEDIUM] file:line — Issue → Suggested fix
+
+Verdict: APPROVE | REQUEST CHANGES (N critical, N high)
+Summary: One-line summary.
+```

.claude/agents/project-architect.md

@@ -3,11 +3,15 @@ name: project-architect
 description: Analyze feature requests and produce implementation plans with file impact analysis, dependency mapping, and risk assessment. Use before starting complex features.
 model: opus
 ---
+
 You are a software architect for the NeoBoard monorepo — an open-source dashboarding tool for hybrid database architectures (for now Neo4j + PostgreSQL, in the future many more).
 
+**Note:** This agent is for feature-level planning with requirement briefs. For general architecture planning without a requirements brief, use the `/plan` skill instead.
+
 ## Context
 
 Read these files for project rules and architecture:
+
 - `CLAUDE.md` — Working rules, architecture boundaries, query safety, credentials
 - `claude_code_docs/` — Detailed docs on testing, widget architecture, performance
 
@@ -21,22 +25,39 @@ Next.js 15 (App Router), React 19, TypeScript, shadcn/ui, Tailwind CSS, ECharts,
 - `component/` — React UI library. NO business logic, NO API calls, NO stores.
 - `connection/` — DB connector library. NO UI, NO React.
 
+## Input
+
+You may receive:
+
+- An issue number to fetch
+- A `REQUIREMENTS BRIEF` from a `/grill` session — if provided, this is your primary source of truth for what the user wants. It contains answers to detailed clarifying questions about scope, UX, data model, security, edge cases, and testing.
+
 ## Steps
 
 1. If given an issue number, fetch it: `gh issue view <number>`
-2. Read `CLAUDE.md` and relevant docs in `claude_code_docs/`.
-3. Search the codebase to understand existing patterns related to the feature.
-4. Produce a structured implementation plan.
+2. If a `REQUIREMENTS BRIEF` is provided, read it carefully — it supersedes the issue body for specifics.
+3. Read `CLAUDE.md` and relevant docs in `claude_code_docs/`.
+4. Search the codebase thoroughly to understand existing patterns related to the feature:
+   - Find files that will need modification
+   - Identify interfaces and types to extend
+   - Find similar features already implemented to reuse patterns
+   - Check for potential conflicts with ongoing work
+5. Produce a structured implementation plan.
+6. Save the plan to `claude_code_docs/plans/issue-<number>.md`.
 
 ## Output Format
 
 ```
 # Implementation Plan: <Feature Name>
 
+## Requirements Summary
+<2-3 sentences summarizing what was agreed during the grilling session — scope, MVP, key decisions>
+
 ## Impact Analysis
 - Packages affected: [app, component, connection]
 - Files to modify: [path — what changes]
 - Files to create: [path — purpose]
+- Estimated size: S / M / L / XL
 
 ## Existing Patterns to Reuse
 - `path/to/file.ts:line` — Pattern description
@@ -62,13 +83,18 @@ Next.js 15 (App Router), React 19, TypeScript, shadcn/ui, Tailwind CSS, ECharts,
 1. **[Step name]** (S/M/L) — Description
    - Files: [paths]
    - Tests: [what to test]
+   - Acceptance: [how to verify this step is done]
 ...
 
 ## Testing Strategy
-- Unit tests: [what to cover]
+- Unit tests: [what to cover, which files]
 - Integration tests: [what to cover]
-- E2E tests: [what to cover]
+- E2E tests: [critical user flows to cover]
+- Edge cases from brief: [list specific edge cases identified during grilling]
 
 ## Risks
 - [Risk] — Mitigation
+
+## Open Questions
+- [Any remaining ambiguity not resolved during grilling]
 ```

.claude/agents/test-runner.md

@@ -10,7 +10,7 @@ You are a test runner agent for the NeoBoard monorepo.
 1. Run `git diff --name-only HEAD` and `git diff --cached --name-only` to detect changed files.
 2. Check that Docker is running.
 3. Determine which packages are affected:
-   - Files under `app/` → run `cd app && npm test` and `cd app && npm test:test:e2e` (only if Docker is available)
+   - Files under `app/` → run `cd app && npm test` and `cd app && npx playwright test` (only if Docker is available)
    - Files under `component/` → run `cd component && npm test`
    - Files under `connection/` → run `cd connection && npm test` (only if Docker is available)
 4. If no changes detected, ask which package to test or run all.

.claude/settings.json

@@ -1,17 +1,28 @@
 {
   "permissions": {
     "allow": [
-      "Bash(npm *)", "Bash(npx *)", "Bash(gh *)", "Bash(git *)",
-      "Bash(node *)", "Bash(cat *)", "Bash(ls *)", "Bash(find *)",
-      "Bash(grep *)", "Bash(head *)", "Bash(tail *)", "Bash(wc *)",
-      "Bash(echo *)", "Bash(mkdir *)", "Bash(cp *)", "Bash(mv *)",
+      "Bash(npm *)",
+      "Bash(npx *)",
+      "Bash(gh *)",
+      "Bash(git *)",
+      "Bash(node *)",
+      "Bash(cat *)",
+      "Bash(ls *)",
+      "Bash(find *)",
+      "Bash(grep *)",
+      "Bash(head *)",
+      "Bash(tail *)",
+      "Bash(wc *)",
+      "Bash(echo *)",
+      "Bash(mkdir *)",
+      "Bash(cp *)",
+      "Bash(mv *)",
       "Bash(docker compose *)",
-      "Read(*)", "Edit(*)", "Write(*)"
+      "Read(*)",
+      "Edit(*)",
+      "Write(*)"
     ],
-    "deny": [
-      "Bash(rm -rf /)", "Bash(rm -rf ~)",
-      "Edit(.env*)", "Write(.env*)"
-    ]
+    "deny": ["Bash(rm -rf /)", "Bash(rm -rf ~)", "Edit(.env*)", "Write(.env*)"]
   },
   "hooks": {
     "PreToolUse": [
@@ -60,7 +71,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "printf 'CRITICAL RULES (re-injected after compaction):\\n- TDD mandatory: write failing test FIRST, then implement\\n- Package boundaries: component/ has NO business logic/API/stores; connection/ has NO React/UI\\n- Query safety: NEVER interpolate user input, ALWAYS parameterized queries\\n- Run cd app && npx next lint --fix after app/ changes\\n- Run npm run build before committing\\n- PRs target dev branch, not main\\n- Coverage target: 80%% per package'"
+            "command": "printf 'CRITICAL RULES (re-injected after compaction):\\n- TDD mandatory: write failing test FIRST, then implement\\n- Package boundaries: component/ has NO business logic/API/stores; connection/ has NO React/UI\\n- Query safety: NEVER interpolate user input, ALWAYS parameterized queries\\n- Run cd app && npx next lint --fix after app/ changes\\n- Run npm run build before committing\\n- PRs target dev branch, not main\\n- Coverage target: 80%% per package\\n- WORKTREE AGENTS: tests are safe to run locally (dynamic ports). CI is the source of truth.\\n- ORCHESTRATOR: max 3 concurrent workers. Never auto-merge. Track CONFLICT_FILES across workers.'"
           }
         ]
       }

.claude/skills/code/SKILL.md

@@ -14,7 +14,7 @@ allowed-tools: Read, Write, Edit, MultiEdit, Bash(npm *), Bash(npx *), Bash(git
 1. If issue number: `gh issue view <number>`
 2. If existing PR: `gh pr view <number> --comments` — check CodeRabbit & SonarQube feedback
 3. Identify package: component/ (UI only), connection/ (DB only), app/ (orchestration)
-4. Read relevant docs in `claude_code_docs/` (especially `v04-widget-power.md` for v0.4 issues)
+4. Read relevant docs in `claude_code_docs/`
 
 ## TDD Workflow (mandatory — no exceptions)
 1. **Red** — Write a failing test describing the expected behavior. Run it. Confirm it fails.

.claude/skills/components/SKILL.md

@@ -20,7 +20,7 @@ find component/src -name '*.tsx' -not -name '*.test.*' -not -name '*.stories.*'
 find component/src -name '*.stories.tsx' | head -40
 
 # Read a story to understand a component's API and variants
-cat component/src/charts/BarChart.stories.tsx
+# (pick a relevant story from the list above)
 ```
 
 ## Step 2 — Check before creating

.claude/skills/next/SKILL.md

@@ -27,7 +27,7 @@ If $ARGUMENTS is a number, use that issue instead of picking.
 
 ```bash
 gh issue edit <number> --add-assignee @me
-git checkout main && git pull origin main
+git checkout dev && git pull origin dev
 git checkout -b <type>/<short-description>
 ```
 
@@ -64,6 +64,7 @@ Reference the issue: `Closes #<number>`
 git push -u origin HEAD
 gh pr create \
   --title '<conventional commit title>' \
+  --base dev \
   --body '## Summary\n...\n\n## Changes\n...\n\n## Testing\n- [x] Unit tests\n- [x] Lint passes\n- [x] Build passes\n\nCloses #<number>' \
   --label '<labels from the issue>'
 ```

.claude/skills/plan/SKILL.md

@@ -3,14 +3,23 @@ name: plan
 description: Architecture plan for complex features. Analyzes impact, security, scalability, breaks into tasks.
 model: opus
 context: fork
-allowed-tools: Read, Bash(cat *), Bash(ls *), Bash(find *), Bash(grep *), Bash(gh *), Bash(git log *)
+allowed-tools: Read, Write, Bash(cat *), Bash(ls *), Bash(find *), Bash(grep *), Bash(gh *), Bash(git log *)
 ---
 # Plan — Opus
+
+You are a **planning-only** agent. You must NEVER write implementation code, modify source files, create tests, or make any changes to the codebase. Your ONLY job is to read, analyze, and produce a thorough written plan.
+
 Use ultrathink. Analyze: requirements, architecture impact, security, scalability, dependencies.
-Read relevant docs in `claude_code_docs/`.
+Read relevant source files and docs in `claude_code_docs/` to understand the current state.
+
+For each task in the plan, provide:
+- The exact file(s) to modify and what to change (with code snippets showing the before/after)
+- Why the change is needed
+- What tests to write and what they should assert
+- Dependencies on other tasks
 
-Output a plan with: Summary, Architecture Decision, Affected Packages, Ordered Tasks (S/M/L), Migration needed?, Security Checklist, Testing Strategy, Risks, Suggested GitHub Issues.
+Output a plan with: Summary, Architecture Decision, Affected Packages, Ordered Tasks (S/M/L sized), Migration needed?, Security Checklist, Testing Strategy, Risks, Suggested GitHub Issues.
 
-Save to `claude_code_docs/plans/`.
+Save the plan to `claude_code_docs/plans/` using the Write tool. Do NOT modify any other files.
 
 $ARGUMENTS = feature or change to plan.

.claude/skills/pr/SKILL.md

@@ -7,11 +7,11 @@ allowed-tools: Bash(gh *), Bash(git *), Bash(npm *)
 ---
 ## State
 - Branch: !`git branch --show-current`
-- Commits: !`git log origin/main..HEAD --oneline 2>/dev/null || echo 'No upstream'`
-- Changed: !`git diff origin/main --name-only 2>/dev/null || git diff --name-only`
+- Commits: !`git log origin/dev..HEAD --oneline 2>/dev/null || echo 'No upstream'`
+- Changed: !`git diff origin/dev --name-only 2>/dev/null || git diff --name-only`
 
 ## Pre-flight (fix failures before creating PR)
-1. `git fetch origin && git rebase origin/dev`
+1. `git fetch origin && git rebase origin/dev` (PRs always target `dev`)
 2. `npm run lint`
 3. `npm run build`
 4. Run tests for affected packages (`cd app && npm test`, `cd component && npm test`)

.claude/skills/release-plan/SKILL.md

@@ -3,7 +3,6 @@ name: release-plan
 description: Read a product spec or feature doc, break it into milestones and GitHub issues with proper labels, dependencies, and ordering. Use when turning a product spec into an actionable backlog.
 model: opus
 context: fork
-disable-model-invocation: true
 allowed-tools: Read, Bash(gh *), Bash(cat *), Bash(find *), Bash(grep *), Bash(ls *)
 ---
 # Release Plan — Opus

.claude/skills/review/SKILL.md

@@ -3,7 +3,7 @@ name: review
 description: Review changes for code quality, security, and NeoBoard conventions.
 model: sonnet
 context: fork
-allowed-tools: Read, Bash(gh *), Bash(git *), Grep(*), Glob(*)
+allowed-tools: Read, Write, Bash(gh *), Bash(git *), Grep(*), Glob(*)
 ---
 ## State
 - Branch: !`git branch --show-current`

.claude/skills/test/SKILL.md

@@ -38,7 +38,7 @@ cd app && npm test
 
 **App integration tests** (if app/ changed):
 ```bash
-cd app && npm test:e2e
+cd app && npx playwright test
 ```
 
 **Component tests** (if component/ changed):