Add test infrastructure, utility modules, comprehensive error handling, AI directions generator, and CI/CD workflows

[Copilot]

This PR addresses missing test coverage, weak input validation, inadequate error handling, cross-platform compatibility, adds a new AI directions generator, and establishes proper package structure with CI/CD for library development.

Test Infrastructure

• Added Jest with 107 tests across 4 suites covering validation, file operations, generator behavior, and AI directions
• Test commands: npm test, npm run test:watch, npm run test:coverage

Utility Modules

utils/validation.js

• Component name validation: rejects filesystem-invalid characters (< > : " | ? * / \), path traversal attempts, enforces 255 char limit
• Base path validation: rejects absolute paths (Unix/Windows), prevents directory traversal, normalizes paths to forward slashes for cross-platform consistency

utils/fileSystem.js

• Safe JSON read/write with structured error responses
• Template file existence validation
• Directory creation with permission error handling

Error Handling

• Replaced silent failures with actionable error messages and proper exit codes
• Config file parsing errors now provide recovery instructions
• Template file validation at generator initialization
• Replaced weak regex validation (/.+/) with comprehensive sanitization

Cross-Platform OS Support

• utils/validation.js: normalized paths always use forward slashes regardless of OS (.replace(/\\/g, '/'))
• Validation tests cover Windows drive-letter paths (C:/, C:\), backslash-separated paths, and guarantee forward-slash output on all platforms
• Generator tests use OS-agnostic path regex ([/\\]) instead of hardcoded /

AI Directions Generator (npx rorg ai)

A new modular generator that creates AI assistant configuration files pre-populated with the project's architectural pattern, base path, naming conventions, and React/TypeScript guidelines.

Supported tools:

AI Tool	Generated File
Cursor	.cursorrules
GitHub Copilot	.github/copilot-instructions.md
Windsurf	.windsurfrules
AGENTS.md (OpenAI/general)	AGENTS.md
Continue.dev	.continuerules

Run npx rorg ai after initialization to pick one or more tools via a checkbox prompt. Each file is automatically tailored to your project's settings.

Package Structure & npm Publishing

• package.json now includes a files field (publishes only bin/, generators/, plop-templates/, utils/, plopfile.js, README.md, LICENSE)
• publishConfig set to { "access": "public", "registry": "https://registry.npmjs.org/" } — ensures the package is always published as the unscoped rorg, never as @llxd/rorg
• engines: { "node": ">=18.0.0" } makes Node.js requirements explicit
• prepublishOnly: "npm test" blocks publishing if tests fail
• Added homepage and bugs fields; structured repository object

CI/CD Workflows

.github/workflows/ci.yml — runs on every push to main/master and every PR:

• Matrix: Node 18, 20, 22 × Ubuntu, Windows, macOS (9 jobs)

.github/workflows/release.yml — two release modes:

1. Push a v* tag → tests run → publish to npm → GitHub Release created with auto-generated notes
2. Manual workflow_dispatch with patch/minor/major or exact version → bumps package.json, creates and pushes tag, publishes to npm, creates GitHub Release

Requires an NPM_TOKEN secret set in repository settings.

Developer Quality of Life

• CONTRIBUTING.md fully rewritten: npm setup (replaces pnpm), project structure map, versioning guide using the new workflows, instructions for adding generators and AI tools
• CHANGELOG.md added (Keep a Changelog format)
• README.md now shows CI, npm version, and MIT badges; documents both npx rorg and npm install -g rorg

Bug Fixes

• pages-components.js: Now respects separateCss config flag (was always creating CSS files)
• All generators: Template data now properly passed to Handlebars (fixes conditional rendering)
• Path handling: Replaced string concatenation with path.join() for cross-platform compatibility

Security

• Fixed npm audit vulnerabilities (0 remaining)
• Added path traversal protection on all user inputs
• Input sanitization prevents filesystem attacks

Example

Before:

validate: (value) => /.+/.test(value) ? true : "Name required"
// Accepts: "../../../etc/passwd", "My/Component", "   "

After:

validate: createPromptValidator(validateComponentName)
// Rejects: path traversal, invalid chars, whitespace-only
// Returns: {valid: boolean, error?: string, sanitized?: string}

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[LLxD]

@copilot make sure we're well covered for multiple operational systems
also, let's add some improvements to this lib giving to it a new modular thing to add: AI directions

with this, users might add multiple skills and front-end guidances as they see fit, based on their AI of choice and it's configuration (e.g. cursorrules, copilot-instructions, AGENTS.md, etc)

[LLxD]

@copilot also, properly structure this project so that it's always installed and used like rorg, instead of @llxd/rorg or anything like that. structure proper CI versioning and all necessary for quality of life in this library development

[Copilot]

@copilot make sure we're well covered for multiple operational systems
also, let's add some improvements to this lib giving to it a new modular thing to add: AI directions

...

Done in commit eae74d1.

Cross-platform OS coverage:

• utils/validation.js now normalizes all returned paths to forward slashes regardless of OS (.replace(/\\/g, '/')) — the right default for web tooling
• Added explicit tests for Windows drive-letter paths (C:/Users/src, C:\Users\src), backslash-separated relative paths, and a guarantee that normalized never contains \ on any platform
• Generator tests now use [/\\] regex instead of hardcoded / for path fragment checks

AI Directions (npx rorg ai):

• New generators/ai-directions.js + plopfile.js registration
• Run npx rorg ai to pick one or more AI tools via checkbox; each generates a config file pre-populated with your project's pattern, base path, naming rules, and React/TypeScript conventions:

Tool	File
Cursor	.cursorrules
GitHub Copilot	.github/copilot-instructions.md
Windsurf	.windsurfrules
AGENTS.md	AGENTS.md
Continue.dev	.continuerules

27 new tests added (107 total, all green). 0 security vulnerabilities.

[Copilot]

@copilot also, properly structure this project so that it's always installed and used like rorg, instead of @llxd/rorg or anything like that. structure proper CI versioning and all n...

Done in commit c862564. Here's what was added:

Package always installs as rorg:

• package.json now has "name": "rorg" (unscoped), publishConfig.access: "public" and publishConfig.registry: "https://registry.npmjs.org/" — prevents any accidental scoped/private publish.
• files field controls exactly what's shipped to npm: bin/, generators/, plop-templates/, utils/, plopfile.js, README.md, LICENSE — no tests, no dev configs.
• engines: { node: ">=18.0.0" } makes Node requirements explicit.
• prepublishOnly: "npm test" ensures tests must pass before any publish.

CI — .github/workflows/ci.yml:
Runs on every push to main/master and every PR:

Node 18 × Ubuntu / Windows / macOS
Node 20 × Ubuntu / Windows / macOS
Node 22 × Ubuntu / Windows / macOS

Release — .github/workflows/release.yml:
Two ways to cut a release:

1. Push a v* tag → tests run → publish to npm → GitHub Release auto-generated
2. Actions → Release → Run workflow with patch/minor/major or an exact version → bumps package.json, creates+pushes tag, publishes, creates release

Requires an NPM_TOKEN secret in repo settings.

Dev QoL:

• CONTRIBUTING.md fully rewritten: npm setup, project structure map, how to add a generator/AI tool, versioning step-by-step
• CHANGELOG.md added (Keep a Changelog format)
• README.md now has CI + npm version + MIT badges, and explicitly shows npx rorg / npm install -g rorg