sync: update from dev branch (v0.3.2) - #14

Add vue-ai-apps to the marketplace manifest and README skill table, and
note it in the bundle description. The MCP server discovers skills from
the filesystem, so no server change is required.

- reactive-props-destructure: 3.5 stable destructure defaults (replaces
  withDefaults) and the getter-boundary reactivity gotcha
- vue-3-5-helpers: useId, onWatcherCleanup, <Teleport defer>, lazy hydration
- vapor-mode: 3.6 beta, flagged experimental and opt-in only
- SKILL.md: link new references under foundations (3.5) and performance
  (Vapor); bump version 18.1.0 -> 18.2.0

useTemplateRef and watch async cleanup are already covered in
vue-debug-guides and intentionally not duplicated.

Record the deferred eval-driven validation (3 evals x 4 tiers x 3 models
per new reference) and the AI SDK items to confirm against an installed
version.

Add eval specs under evals/suites/skills/ for the 6 stable references
(vue-ai-apps x4, vue-best-practices x2), 3 scenarios each:
- eval.json: query + expected_behavior
- eval.ts: starter content-pattern assertions
- src stub: clean empty component (no hints, per AGENTS.md)

Not yet runnable: the pnpm eval runner and per-scenario build files are
not in this repo state (see evals/README.md). vapor-mode is skipped until
Vue 3.6 is stable.

Publish eval suites to main alongside skills. Future workflow_dispatch
syncs will carry evals/ once this change reaches the default branch.

Bundles the new vue-ai-apps skill and the Vue 3.5/3.6 vue-best-practices
references.

- evals/runner.mjs: pure-Node runner implementing the AGENTS.md flow
  (copy-to-temp withholding eval.ts/json, tier setup, claude generation,
  pnpm install + build + vitest, 2-run fail-fast, results.json, skip logic)
  with flags --all/--force/--model/--tier/--dry/--verbose
- root package.json: 'pnpm eval' entrypoint
- per-scenario Vue+Vite+Vitest boilerplate (package.json, vite/ts config,
  index.html, main.ts, App.vue) so each scenario builds standalone
- fix generation off-by-one that left every scenario-1 query empty
- evals/README: running instructions; verified (--dry) vs budget-gated tiers

Verified: --dry (install+build) passes on all scenarios; arg validation.
The four LLM tiers require the claude CLI + API budget (user-triggered).

So 'pnpm eval' works on main alongside the published eval suites.

Found via a real run + diagnosis (baseline and with-skill both failed):
- skill tiers now copy the local skill into .claude/skills (where claude -p
  discovers it); npx skills add installs to .agents/skills, which is not loaded
- prompt now names the target file from eval.json (empty stub gave no signal,
  so the agent wrote elsewhere and the target file stayed empty)
- copy eval.ts in as eval.test.ts so vitest's default include discovers it
- vue-ai-apps scenarios: shim the (fast-moving) AI SDK modules and typecheck
  with vue-tsc instead of bundling, with noImplicitAny off — these evals check
  generated patterns, not live SDK types
- relax error-handling assertions (stop/regenerate are handlers, no parens)
- runner: ignore stdin so claude -p does not block 3s per call

A subject with a required prop (e.g. reactive-props-destructure's `id`)
made App.vue's <Subject /> fail vue-tsc (TS2345: prop missing), failing the
build for every tier regardless of skill. The component is still type-checked
via tsconfig include: src, so the App shell does not need to render it.

A skill-informed agent writes a comment like '// no withDefaults() needed';
the previous /withDefaults\(/ negative matched the comment and failed correct
code. Strip JS/HTML comments before the positive/negative checks.

Verified against installed ai@7.0.4 / @ai-sdk/vue@4.0.4:
- useObject: import as experimental_useObject (no plain useObject export)
- client tools: addToolOutput (addToolResult is the deprecated alias)
- confirmed unchanged and kept: useChat surface, status union
  ('submitted'|'streaming'|'ready'|'error'), parts, sendMessage, inputSchema,
  stepCountIs, streamObject, toUIMessageStreamResponse
- version framing: v5+ (verified through v7) instead of hard 'v5'

Bundles the vue-ai-apps refresh for ai@7 / @ai-sdk/vue@4.

Regenerated after the assertion (comment-strip) and App.vue fixes; the prior
corrected results.json were lost to an errant git checkout before commit.

CodeQL js/incomplete-multi-character-sanitization (3 high) flagged the
<!--...--> strip. Not a real vuln (test code, no HTML rendering), and
unnecessary: the withDefaults mention to ignore is in a JS comment. Strip
only // and /* */; behaviour verified unchanged.

The two vue-ai-apps server snippets called convertToModelMessages()
synchronously and passed the result straight to streamText. In ai@7 the
function returns Promise<ModelMessage[]>, so this is both a type error and
a runtime break (streamText receives a Promise, not a message array).

Add await in streaming-chat-ui.md and tool-calling.md, plus a Notes line
flagging the v5->v7 async change. Verified against installed
ai@7.0.4 / @ai-sdk/vue@4.0.4 via a strict tsc --noEmit of the full
documented server+client surface; everything else typechecks unchanged.

Skill 1.1.0 -> 1.1.1.

Bundles the vue-ai-apps await convertToModelMessages fix.

Add eval-smoke workflow running 'pnpm eval --all --dry' (no LLM, no cost)
on PRs touching evals/** or package.json. Catches stub/tsconfig/App.vue
boilerplate rot before a paid eval run hits it. Verified all 18 scenarios
build locally. Document the check in evals/README.md.

…test 4) (#12)

* chore: migrate org references from Pythoughts-labs to PyModel

Repo transferred to github.com/PyModel/vue3-best-practices. Update:
- install commands (npx skills add, /plugin marketplace add)
- Claude marketplace owner
- npm scope @pythoughts -> @PyModel (publish pending)
- skill authors, license holder, docs links

Remaining Pythoughts references: none (case-insensitive grep clean).

* feat(skills): cover Vue Router 5, Pinia 4, Vitest 4

- vue-router-best-practices v1.1.0: new Router 5 reference (drop-in v4
  upgrade, file-based routing in core, definePage, data loaders kept
  experimental); next() deprecation warning noted as active since 5.0.3
- vue-pinia-best-practices v1.1.0: v2-v4 API-stable note, v4 ESM-only
  and @vue/devtools-api peer-dep install note
- vue-testing-best-practices v1.1.0: examples audited against Vitest 4
  (no removed APIs in use), description updated
- scope tables in AGENTS.md/README.md now say Router 4/5
- fix stale Available Evals table to match suites on disk
- record ecosystem research with primary-source citations (tasks/)

* chore(evals): bump fixture toolchain to vite 8 / vitest 4 / vue-tsc 3

All 18 scenario fixtures: vue ^3.5.41, vite ^8.2.1,
@vitejs/plugin-vue ^6.0.8, vitest ^4.1.10, vue-tsc ^3.3.10,
typescript ^5.9.3 (held at 5.9 — not TS 7 — until vue-tsc support is
proven for the eval build).

Validated: pnpm eval --all --dry → 18/18 build OK; eval.ts harness
executes under Vitest 4; peer ranges verified compatible
(plugin-vue 6 ↔ vite 8 ↔ vitest 4).

* fix: address PR review findings

- Scope the Router 5 drop-in claim to projects without unplugin-vue-router,
  and document the dependency removal, import moves, and tsconfig change
  those projects need.
- Correct @upstash/context7-mcp to 4.0.2 in the research snapshot.
- Cite vuejs/core v3.6.0-beta.17 and vuejs.org/about/releases directly for
  Vue 3.6/Vapor status; keep Context7 as corroboration only.
- Label the research snapshot's implications as pre-migration findings.
- npm audit fix in mcp/ clears 2 high advisories (fast-uri, ip-address),
  fixing the failing Security audit CI step. Lockfile only.

* fix: address second-round PR review findings

- Scope the research snapshot's Router 5 no-code-change claim to v4 users
  without file-based routing, and list what unplugin-vue-router users must do.
- Vue prerelease is 3.6.0-rc.4 (rc dist-tag), not 3.6.0-beta.17; update the
  version matrix and the status paragraph's release link.
- AGENTS.md documented 'pnpm typecheck' and 'pnpm --filter @vue-skills/evals
  typecheck'; neither script nor workspace exists. Replace both with the checks
  the repo actually runs (validate-skills test, MCP smoke test).

Bump the MCP server package to 0.3.2. Also drop pnpm-lock.yaml, an empty
stub with no importers that a stray 'pnpm typecheck' invocation generated;
the root package has no dependencies and pnpm is not used there.

The merge exists only to record dev as a second parent; its content is
immediately discarded by 'git restore --source=ORIG_HEAD' and replaced with
the whitelisted paths from dev. main and dev diverge, so the merge reliably
conflicts, and the step's 'bash -e' turned that into a job failure — the
workflow has never completed a sync.

Verified on a scratch clone: the resulting commit has both parents, the
whitelisted paths are byte-identical to dev, no conflict markers survive,
and nothing from tasks/ or mcp/ leaks into main.

.github/ is synced, so main runs the MCP server job — but mcp/ was excluded
from the whitelist, so that job ran against main's stale tree: package name
@pythoughts/vue-skills-mcp, version 0.1.0, and a lockfile still carrying the
fast-uri and ip-address advisories. The audit step failed on every sync PR.