si-coder

---
name: si-coder
description: "Zero human involvement full-stack deployment. Umbrella skill that points to modular sc-* sub-skills (sc-all, sc-dokploy, sc-convex, sc-convex-cloud, sc-vercel, sc-git, sc-onboarding) plus the legacy monolithic deploy.js. Two deploy paths share one flow shape: self-hosted (Dokploy app + self-hosted Convex) and online (Vercel frontend + Convex Cloud). The user can invoke /sc-all for end-to-end (--target dokploy|vercel), /sc-convex/-cloud, /sc-vercel, or /sc-dokploy for narrower domain ops, /sc-git for GitHub repo/Actions ops, or /sc-onboarding to set up credentials."
---

# si-coder-agent — Umbrella

This is the parent skill for the SI Coder family. After installing (see `install.sh`), the following slash commands are available:

**Implemented (8):**

| Command | Domain | Purpose |
|---|---|---|
| `/sc-all` | Orchestrator | End-to-end full-stack deploy; `--target dokploy` (default, self-hosted) or `--target vercel` (online) |
| `/sc-dokploy` | Dokploy | CRUD on projects/apps/compose/domains, audit, debug, stale-domain detection |
| `/sc-convex` | Convex self-hosted | Deploy on Dokploy, rotate admin key, set JWT auth env, probe `api-/site-/dash-` |
| `/sc-convex-cloud` | Convex Cloud | Managed Convex deploy; coupled build injects `NEXT_PUBLIC_CONVEX_URL`, probes `*.convex.cloud` |
| `/sc-vercel` | Vercel | Online frontend bound to a GitHub repo; build couples Convex Cloud deploy, custom domain/subdomain, Hostinger DNS (CNAME sub / A apex) |
| `/sc-git` | GitHub | Repo CRUD + Actions cost reduction (audit burn, disable YAML, local CI, pre-push hook, self-hosted runner, commit status, VPS cron) |
| `/sc-onboarding` | Setup | Scan env, prompt only for missing credentials, write to `~/.bashrc` (merge-in-place, single-quote escaped) |
| `/sc-sync` | Sync | rsync gitignored files between a VPS and local machine over Tailscale (same repo, mirrored checkout); dry-run first, `--apply` to copy |

### Two deploy paths (same flow shape)

- **(A) Self-hosted** — GitHub → Dokploy app + self-hosted Convex compose → Hostinger A-record → verify. `/sc-all --target dokploy`
- **(B) Online** — GitHub → Vercel frontend + Convex Cloud backend → Hostinger CNAME/A to Vercel → verify. `/sc-all --target vercel`

```mermaid
flowchart TD
    O["/sc-all"] --> G["/sc-git<br/>repo create + push"]
    G --> T{"--target?"}
    T -->|dokploy| H1["/sc-dokploy<br/>project · app · compose · domains"]
    H1 --> C1["/sc-convex<br/>self-hosted backend + admin key + JWT"]
    C1 --> D1["Hostinger A → VPS"]
    T -->|vercel| H2["/sc-convex-cloud<br/>managed backend (coupled build)"]
    H2 --> C2["/sc-vercel<br/>GitHub-bound project + domain"]
    C2 --> D2["Hostinger CNAME / A → Vercel"]
    D1 --> V["verify live URL"]
    D2 --> V
    SY["/sc-sync<br/>aux · rsync gitignored files<br/>between VPS and local (out-of-band)"]
```

**Stubs (5, exit code 2 until implemented):** `/sc-cf` (Cloudflare), `/sc-stripe` (payments), `/sc-resend` (email), `/sc-clerk` (auth alt), `/sc-supabase` (backend alt).

The **legacy `/use-si-coder`** continues to work in parallel — it runs the monolithic `scripts/deploy.js` which still bundles GitHub + Dokploy + Convex + Hostinger DNS.

## Why modular?

- **Surgical ops** — change a Convex admin key without re-deploying the world
- **Discoverable** — `/sc-dokploy` makes Dokploy CRUD a first-class skill, not buried inside deploy.js
- **Composable** — `/sc-all` is the only consumer that pulls everything together
- **Onboarding-aware** — `/sc-onboarding` knows which `/sc-*` you ticked and asks for only what's missing

## CORE MANDATES (shared)

These apply across every sub-skill:

1. **Self-Hosted Convex by default**: never silently swap to Clerk. Use `@convex-dev/auth`.
2. **`convex/_generated` is committed**: don't run codegen inside Dockerfile.
3. **`npm install --yes --legacy-peer-deps`** — no interactive prompts.
4. **Idempotency**: duplicate domain creation = no-op, not error.
5. **Admin key sync rule**: Dokploy compose env + repo env file always match.
6. **Preserve your Dokploy control host** (the one in `DOKPLOY_API_URL`) — never rewrite it inside scripts.
7. **Clerk MCP for Clerk apps**: if target uses Clerk, preserve it; use Clerk MCP (`clerk` at `https://mcp.clerk.com/mcp`).
8. **Exact cloning**: if user wants a clone of an existing site, fetch and replicate layout, not a generic dashboard.

## Output styles (optional)

Owner-selectable token-savers that trim how much the agent *says*, never what a skill *does*.
Set `SC_OUTPUT_STYLE` before running any `sc-*` skill:

| `SC_OUTPUT_STYLE` | The agent should… |
|---|---|
| `off` (default) | use normal phrasing |
| `caveman` | be terse — drop articles/filler/pleasantries, fragments OK — while keeping **all** technical substance and exact code/errors verbatim |
| `ponytail` | act as a lazy senior dev — the shortest solution that works, no unrequested abstractions, code first, then ≤3 short lines of explanation |

When `SC_OUTPUT_STYLE` is `caveman` or `ponytail`, adopt that style for all `sc-*` output. An
unknown/empty value means `off`. This only affects phrasing — every mandate above still holds.
Full text + a resolver CLI live in `references/output-styles.md` and `lib/output-styles.js`
(ported from the MSO project's `OsConfig.tokenSaver`).

## Repo layout

```
si-coder-agent/
├── SKILL.md           ← this file
├── README.md
├── .env.example
├── install.sh         ← symlinks skills/* (sc-*, use-si-coder, stubs) into ~/.claude/skills/
├── lib/               ← shared modules
│   ├── dokploy.js     ← Dokploy REST
│   ├── hostinger.js   ← Hostinger DNS (A/CNAME)
│   ├── convex.js      ← Convex self-hosted (Dokploy compose)
│   ├── convex-cloud.js← Convex Cloud (managed) deploy
│   ├── vercel.js      ← Vercel projects/domains/deploys
│   ├── proc.js        ← no-shell execFileSync process runner
│   ├── tls.js         ← TLS verification helpers (always on)
│   └── env.js         ← env scan + ~/.bashrc merge writer
├── skills/
│   ├── sc-all/SKILL.md
│   ├── sc-dokploy/{SKILL.md, scripts/}
│   ├── sc-convex/{SKILL.md, scripts/}
│   ├── sc-convex-cloud/{SKILL.md, scripts/}
│   ├── sc-vercel/{SKILL.md, scripts/}
│   ├── sc-git/{SKILL.md, scripts/}
│   ├── sc-onboarding/{SKILL.md, scripts/, steps/}
│   └── sc-sync/{SKILL.md, scripts/}
├── scripts/
│   └── deploy.js      ← legacy monolith, still functional
└── bin/
    └── onboard.js     ← one-shot CLI wizard (no AI needed)
```

## Security posture (hardened 2026-06-14)

All `sc-*` skills: no-shell `execFileSync` (no command injection), TLS verification always on, no secrets in logs / build-args / git-URLs, `~/.bashrc` writes single-quote escaped. Requires **Node >=18** (native `fetch`), no runtime deps, CommonJS. Legacy one-shot `scripts/deploy.js` remains available.

## Deployment profile (placeholders only)

```bash
# GitHub
GITHUB_TOKEN=ghp_<your_token>

# Dokploy
DOKPLOY_API_URL=https://<your-dokploy-host>/api
DOKPLOY_API_KEY=<your_dokploy_api_key>

# Hostinger DNS (optional)
HOSTINGER_API_TOKEN=<your_hostinger_token>

# Clerk (only for explicitly-Clerk apps)
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_live_<clerk_publishable_key>
CLERK_SECRET_KEY=sk_live_<clerk_secret_key>
NEXT_PUBLIC_CLERK_FRONTEND_API_URL=https://<clerk-issuer-domain>

# Convex self-hosted (filled in by deploy)
CONVEX_SELF_HOSTED_URL=https://<convex-api-domain>
CONVEX_SELF_HOSTED_ADMIN_KEY=<convex_admin_key>
NEXT_PUBLIC_CONVEX_URL=https://<convex-api-domain>
NEXT_PUBLIC_CONVEX_SITE_URL=https://<convex-site-domain>
```

Never store real keys or live hostnames inside skill examples or agent instructions — always placeholders.

## Existing domain vs public-IP fallback

For a port-exposed managed service or webapp that can run without DNS, domain configuration is an enhancement, not an install dependency:

1. If the deployment/app already has a canonical domain and its DNS/TLS route is configured, **preserve and prefer that domain for browser/UI access**. Never replace a working existing domain with a newly invented subdomain.
2. If no domain is configured, do not block a healthy install solely for DNS. Keep the declared public port reachable on the server public IP when the app's security model allows it, and report `http://<public-ip>:<port>` as the fallback.
3. When both exist, the domain is the primary UI/embedded origin; public IP is fallback/diagnostic only.
4. Domain provider automation runs only for an explicit desired domain or an existing project domain that needs repair. Missing Hostinger/Cloudflare credentials must not cause an unrelated port-based runtime install to fail.
5. Existing-domain creation errors are idempotent no-ops. Do not delete or recreate a working route merely to make the automation own it.