Repository Guide

Language

Write repository content, code comments, commit messages, issues, and pull requests in English.

Keep this repository focused on the native stack command, host I/O, exit codes, configuration discovery, provider-pack import, and notice output.
Link stack-engine as a native Rust dependency; do not duplicate compiler, formatter, layout, or SVG-rendering logic.
Keep provider-pack import, local cache behavior, provenance display, and notice output at the CLI boundary. Do not make the engine read the filesystem or network.
Import only audited local archives with pinned complete-file hashes and allowlisted entries. Bound archive and entry sizes, reject unsafe paths and active SVG content, and write new pack directories atomically without overwriting existing data.
Do not add authentication, billing, entitlement, or proprietary-theme delivery behavior; they are outside the product roadmap.

Repository-authored work is Apache-2.0. Record every distributed dependency and asset in THIRD_PARTY_LICENSES.md before release.
Do not bundle vendor icons unless their exact terms permit the relevant source, binary, and generated-output distribution channels. Preserve upstream artwork, provenance, and notices.
Never commit credentials, tokens, private keys, signing material, customer data, or local auth state.
Report security vulnerabilities privately through the process in SECURITY.md.

Agent guidance is generated from the pinned stack-sh/docs source. Edit shared instructions there, then update skills/docs-source.json and run npm run skills:sync. Never hand-edit the generated skill; verify with npm run skills:check and the CLI integration tests.
Use a topic branch and pull request; squash merge after approval.
Write pull request titles and bodies in English, and follow .github/pull_request_template.md without removing or renaming its sections.
Work in small increments and add repository-specific formatting, linting, tests, and release checks with the code that needs them.