adding startupkit make ralph wiggum helper

[ian]

Summary by cubic

Adds the make (alias ralph) CLI command for iterative, spec-driven work from a spec file, plus make:init to bootstrap .startupkit/ralph.json. Implements startup-122 by adding the Ralph script, defaults, and tests.

• New Features

  • make [specfile] with --iterations and --progress; streams model output and stops when .ralph-complete exists.
  • make:init creates .startupkit/ralph.json with sensible defaults and a prompt.
  • Config loader merges user config with defaults; prompt builder replaces SPEC.md and progress.txt with custom paths.

• Migration

  • Run startupkit make:init to create .startupkit/ralph.json.
  • Add SPEC.md and (optionally) progress.txt to the repo.
  • Run startupkit make [specfile] --iterations --progress as needed.

^{Written for commit 3196fb4. Summary will update on new commits.}

[linear]

STARTUP-122 Add ralph script

[cloudflare-workers-and-pages]

Deploying startupkit with    Cloudflare Pages

Latest commit:	3196fb4
Status:	✅  Deploy successful!
Preview URL:	https://6d50959b.startupkit-975.pages.dev
Branch Preview URL:	https://ian-startup-122-add-ralph-sc.startupkit-975.pages.dev

View logs

[cubic-dev-ai]

2 issues found across 5 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/cli/src/cli.ts">

<violation number="1" location="packages/cli/src/cli.ts:56">
P1: Using `Number.parseInt` directly as a coercion function can result in `NaN` for invalid input, which bypasses the fallback chain and causes silent failures. Use a custom parser that returns `undefined` on invalid input.</violation>
</file>

<file name="packages/cli/src/cmd/make.ts">

<violation number="1" location="packages/cli/src/cmd/make.ts:140">
P1: Stream data handler may lose or corrupt data when JSON objects span multiple buffer chunks. Need to accumulate partial lines between chunks.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/cli/src/cmd/make.test.ts">

<violation number="1" location="packages/cli/src/cmd/make.test.ts:422">
P2: Global `process.stdout.write` mutation lacks proper cleanup. Wrap the test logic in try-finally to ensure restoration even if the test fails.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

3 issues found across 4 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/cli/src/cmd/make.ts">

<violation number="1" location="packages/cli/src/cmd/make.ts:173">
P1: The stdout buffering doesn't flush remaining buffer content when the stream ends. Any incomplete final line without a trailing newline will be silently lost.</violation>
</file>

<file name="packages/cli/src/cmd/make.integration.test.ts">

<violation number="1" location="packages/cli/src/cmd/make.integration.test.ts:31">
P2: Contradictory instructions in SPEC.md: "Do not create any files" followed by "create .ralph-complete". Remove the "Do not create any files" phrase for clarity.</violation>

<violation number="2" location="packages/cli/src/cmd/make.integration.test.ts:113">
P1: Timeout is never cleared when child process completes successfully, causing a resource leak. Store the timeout ID and call clearTimeout() in the close event handler.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

2 issues found across 4 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name=".github/workflows/test-cli.yml">

<violation number="1" location=".github/workflows/test-cli.yml:9">
P2: API key exposed to all workflow jobs unnecessarily. Scope ANTHROPIC_API_KEY to only the test-cli job that runs make.integration.test.ts, not workflow-level. This follows the principle of least privilege for secret management.</violation>

<violation number="2" location=".github/workflows/test-cli.yml:10">
P1: Integration tests will fail on fork PRs because ANTHROPIC_API_KEY is unavailable. GitHub doesn't expose secrets to fork PRs for security, but make.integration.test.ts throws an error if the key is missing. Use conditional test execution (vitest.skipIf) or move API-dependent tests to a separate workflow that only runs on trusted branches.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}