feat: complete plugin-clipper restructure and v0.1.0 feature set

.github/ISSUE_TEMPLATE/bug_report.md

@@ -18,4 +18,4 @@ labels: bug
 
 - Node.js version:
 - OS:
-- Clipper version (`npm ls @yesterday-ai/paperclipper`):
+- Plugin version (from `package.json`):

.github/workflows/ci.yml

@@ -6,18 +6,47 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
+  secret-scan:
+    name: Gitleaks Secret Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install Gitleaks
+        run: |
+          VERSION=$(curl -sI https://github.com/gitleaks/gitleaks/releases/latest | grep -i '^location:' | sed 's/.*tag\/v//' | tr -d '\r')
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" | tar xz
+          chmod +x gitleaks
+      - name: Scan for secrets
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            ./gitleaks detect --source . --log-opts "${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" --verbose
+          else
+            ./gitleaks detect --source . --log-opts "${{ github.event.before }}..${{ github.sha }}" --verbose
+          fi
+
   test:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         node-version: [20, 22]
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: latest
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-          cache: npm
-      - run: npm ci
-      - run: npm run build
-      - run: npm test
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm typecheck
+      - run: pnpm build
+      - run: pnpm test
+      - run: pnpm test:logic

.gitignore

@@ -1,4 +1,18 @@
-# Company workspace folders
+# Install & Build artifacts
+dist/
+node_modules/
+
+# Paperclip SDK
+.paperclip-sdk
+
+# Secrets
+.env*
+!.env*.example
+
+# Build artifacts
+*.tsbuildinfo
+
+# Company workspace folders (runtime data, not version-controlled)
 companies/
 
 # Draft files & folders
@@ -8,16 +22,7 @@ companies/
 # System files
 .DS_Store
 
-# Secrets
-.env*
-!.env*.example
-
-# Install & Build artifacts
-web/dist/
-node_modules/
-*.tsbuildinfo
-
-# Claude user settings (local only)
+# Claude local settings
 .claude/settings.local.json
 .mcp.json
 

.husky/pre-commit

@@ -1 +1 @@
-npm install && npm run build && npm test && npx lint-staged
+npx lint-staged

AGENTS.md

@@ -1,93 +1,72 @@
-# Clipper — Project Vision
+# Company Wizard — Project Vision
 
 ## What
 
-Clipper is a company-as-code bootstrapping CLI for the [Paperclip](https://github.com/paperclipai/paperclip) AI agent platform. It assembles ready-to-run company workspaces from modular, composable templates — turning the messy process of configuring agent roles, workflows, and processes into a single command.
+Company Wizard is a [Paperclip](https://github.com/paperclipai/paperclip) plugin for bootstrapping agent company workspaces from modular, composable templates. It provides an interactive wizard (manual and AI-powered paths) that assembles ready-to-run companies — roles, workflows, skills, process docs, heartbeat sections, and Paperclip API provisioning — all from a single UI.
 
-Clipper supports two usage modes:
-- **Interactive** — An Ink-based terminal wizard that walks through each configuration step (requires TTY).
-- **Headless** — Pass `--name` and `--preset` (minimum) as CLI flags to skip the wizard entirely. Runs assembly and optional API provisioning with plain stdout. Designed for scripting, CI pipelines, and programmatic use by other agents.
-- **AI wizard** — Pass `--ai "description"` to describe your company in natural language. Claude analyzes the description and auto-selects the best preset, modules, and roles. Requires `ANTHROPIC_API_KEY`.
+The plugin runs inside the Paperclip board UI and ships with a complete template library: 14 presets, 22 modules, 17 optional roles (CEO is the only base role).
 
 ## Why
 
 The default Paperclip company setup is a blank slate: one CEO with a bootstrap prompt, no defined workflows, no process for generating issues, no review cycles. Every company starts from zero and reinvents the same patterns.
 
-Clipper encodes organizational knowledge into reusable templates. Instead of hoping agents figure out how to collaborate, you start with proven structures — issue generation from roadmaps, auto-assignment of idle agents, stall detection, PR review flows — all wired up and ready.
+Company Wizard encodes organizational knowledge into reusable templates. Instead of hoping agents figure out how to collaborate, you start with proven structures — issue generation from roadmaps, auto-assignment of idle agents, stall detection, PR review flows — all wired up and ready.
 
 ## Core Idea: Gracefully Optimistic Architecture
 
 Inspired by the [OpenClaw gateway architecture](https://x.com/cosmo_kappa/status/2023872554457591971) where channel adapters declare what they CAN do rather than what they MUST do, and the system degrades gracefully when features are absent.
 
-Clipper applies the same principle to organizational capabilities: **the system never asks "which preset is this?" — it asks "which roles are present, and what can they do?"**
+Company Wizard applies the same principle to organizational capabilities: **the system never asks "which preset is this?" — it asks "which roles are present, and what can they do?"**
 
-| OpenClaw Pattern | Clipper Equivalent |
-| ---------------- | ------------------ |
+| OpenClaw Pattern | Company Wizard Equivalent |
+| ---------------- | ------------------------- |
 | Channel declares capabilities | Module declares `capabilities` with `owners[]` chain |
 | Missing feature → graceful degrade | Missing role → fallback owner takes over |
 | Core is channel-agnostic | Assembly is preset-agnostic |
 | Adapter is optional | Role is optional — base always works |
 
-A company with just CEO + Engineer works fine — the CEO handles backlog, auto-assign, and stall detection. Add a Product Owner, and it automatically takes over backlog management as primary owner while the CEO becomes the fallback safety net. Add a Code Reviewer, and PR review workflows activate.
+A company with just the CEO works fine — they handle backlog, auto-assign, and stall detection. Add an Engineer and they take over implementation. Add a Product Owner, and it automatically takes over backlog management as primary owner while the CEO becomes the fallback safety net. Add a Code Reviewer, and PR review workflows activate.
 
 Every company starts functional and gets better as you add roles. No capability is ever "missing" — there's always someone responsible.
 
 ## Design Principles
 
 - **Files, not config servers** — Company structure is markdown files on disk. Agents read them fresh every heartbeat. Edit a file, behavior changes next cycle.
 - **Composable, not monolithic** — Modules are independent building blocks. Presets are just curated module combinations. Everything can be mixed, matched, and extended.
-- **Opinionated defaults, easy overrides** — Templates encode best practices but every file is editable after generation. Clipper gets you started; you own the result.
+- **Opinionated defaults, easy overrides** — Templates encode best practices but every file is editable after generation (including in the wizard's preview step). Company Wizard gets you started; you own the result.
 - **Capability-based, not identity-based** — The system resolves "what can this company do?" based on present roles, not "which template was selected?" Roles declare capabilities, modules declare ownership chains, the assembly resolves at build time.
 - **Primary/fallback ownership** — Every capability has an ownership chain. The most qualified present role owns it; less specialized roles serve as safety nets.
 - **Shared skills, role-specific overrides** — Primary skills live in a shared `skills/` folder unless a role brings a genuinely different approach. Fallbacks are always role-specific.
 
 ## Architecture
 
 ```text
-clipper/
-├── src/
-│   ├── cli.jsx                 # Entry point, flag parsing, renders <App>
-│   ├── app.jsx                 # Wizard state machine (NAME → ... → DONE)
-│   ├── components/             # One Ink component per wizard step
-│   ├── logic/                  # Pure functions (assembly, resolution, loading)
-│   └── api/                    # Paperclip API client + provisioning
-├── templates/
-│   ├── base/                   # Always-present roles (ceo, engineer)
-│   ├── roles/                  # Optional roles (9: product-owner, code-reviewer, ui-designer, ux-researcher, cto, cmo, cfo, devops, qa)
-│   ├── modules/                # Composable capabilities (14 modules)
-│   │   ├── vision-workshop/    # Strategic foundation
-│   │   ├── market-analysis/    # Market research
-│   │   ├── hiring-review/      # Team gap analysis
-│   │   ├── tech-stack/         # Technology evaluation
-│   │   ├── architecture-plan/  # System + design system architecture
-│   │   ├── github-repo/        # Git workflow
-│   │   ├── pr-review/          # PR-based code review
-│   │   ├── backlog/            # Backlog lifecycle and health
-│   │   ├── auto-assign/        # Idle agent → issue matching
-│   │   ├── stall-detection/    # Stuck handover detection
-│   │   ├── brand-identity/     # Brand guidelines and visual identity
-│   │   ├── user-testing/       # Usability evaluations
-│   │   ├── ci-cd/              # CI/CD pipeline
-│   │   └── monitoring/         # Observability and alerting
-│   ├── presets/                # Curated combinations (fast, quality, rad, startup, research, full)
-│   └── ai-wizard/             # Configurable prompts for --ai mode
-│       ├── config-format.md   # JSON output format + selection rules
-│       ├── single-shot-system.md  # System prompt for --ai "description"
-│       ├── interview-system.md    # System prompt for --ai interview
-│       └── messages.json      # User-turn instructions (interview flow)
-├── dist/cli.mjs                # Built CLI (esbuild bundle)
-└── esbuild.config.mjs          # Build config
+src/
+├── worker.ts                  # Plugin worker (actions: preview-files, start-provision, check-auth)
+├── manifest.ts                # Plugin manifest (id, displayName, sidebar slot)
+├── logic/                     # Pure functions (assembly, resolution, template loading, AI wizard)
+├── api/                       # Paperclip REST API client + provisioning
+└── ui/
+    ├── context/               # WizardContext — state machine + reducer
+    └── components/            # WizardShell, step components, ConfigReview (file preview)
+
+templates/
+├── roles/                     # All roles with role.meta.json
+├── modules/                   # Composable capabilities (22 modules)
+│   └── <module>/
+│       ├── module.meta.json   # capabilities[], activatesWithRoles[], tasks[], goal?, adapterOverrides?
+│       ├── skills/            # Shared primary skills
+│       ├── agents/<role>/     # Role-specific overrides, fallbacks, heartbeat sections
+│       └── docs/              # Shared docs injected into all agents
+└── presets/                   # Curated combinations (14 presets, may include goals[])
 ```
 
 Each module contains:
-- `module.meta.json` — Capability ownership chains, activation rules, initial tasks, dependencies, permissions
+- `module.meta.json` — Capability ownership chains, activation rules, initial tasks, inline goal
 - `skills/<skill>.md` — Shared primary skill (used by any primary owner)
 - `agents/<role>/skills/` — Role-specific overrides and fallback variants
 - `docs/` — Shared documentation injected into all agents
 
 ## Where This Is Going
 
-See [ROADMAP.md](ROADMAP.md) for the full backlog. Key areas:
-
-- **Excalidraw MCP integration** — Visual diagram generation as an agent skill
-- **Process docs for more modules** — `auto-assign`, `hiring-review`, and others need `*-process.md` workflow guides (backlog done)
+See [ROADMAP.md](ROADMAP.md) for the full backlog.