Index: src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/references/addon-checklist.md.stub
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/references/addon-checklist.md.stub b/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/references/addon-checklist.md.stub
--- a/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/references/addon-checklist.md.stub (revision 704580f74a79782ae09034bc184da5a87fcb2574)
+++ b/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/references/addon-checklist.md.stub (revision 4fc88d8f0f0ad7e2750890a8f43a703303341a5d)
@@ -13,6 +13,9 @@
3. Use the add-on's existing abstractions and naming. Do not introduce a parallel architecture for one feature.
4. Check permissions and ownership at the controller/service boundary for user-triggered operations.
5. Account for enable, disable, uninstall, and upgrade behavior where the feature stores data or registers handlers.
+6. Prefer Finder/entity APIs for database work. If a direct query is justified, use the default XF database adapter with prepared statements, constrain its conditions, and check that loops or relations do not introduce unexpected query growth.
+7. Filter user input through the XF input filterer and preserve automatic output escaping. Check HTML, JavaScript, template modifications, and any explicitly unescaped output for XSS risks.
+8. Use the framework's HTTP client, filesystem, mail, image, and other relevant services rather than manual replacements. Escape arguments passed to `exec`-style functions.
## Setup.php Upgrade Steps
@@ -32,6 +35,21 @@
4. Treat execution order as a compatibility tool, not a substitute for composable behavior.
5. Add entity relations through an entity class extension. Pair added columns with `Setup.php` schema changes and the supported entity-structure extension mechanism.
+When deciding between a class extension and a code-event listener, use the complete behavior as the test: a listener is preferable for a self-contained action at a documented event point; a class extension is preferable when related behavior spans methods or needs entity structure, validation, save lifecycle, or return/control-flow changes. The existence of an event alone does not make a listener mandatory.
+
+## Public Resource Manager Release
+
+When the add-on will be distributed through the public Resource Manager, review the current [resource standards](https://xenforo.com/community/help/resource-standards/) and [resource guidelines](https://xenforo.com/community/help/resource-guidelines/) in addition to this checklist. The published wording distinguishes hard requirements such as "must" from defaults or recommendations such as "should" and "where possible": follow the recommendation by default, and document a concrete framework or design reason when departing from it.
+
+At minimum, verify the following release-specific concerns:
+
+1. The add-on is installable, free of obvious errors, and not encrypted, encoded, or otherwise obfuscated except for a permitted time-limited demo or trial.
+2. New tables and core-table columns use the required add-on prefixes, nullable/defaulted columns, and uninstall cleanup. Do not change core column definitions without a strong reason.
+3. Code events, handlers, data, unique keys, and other registrations are associated with this add-on and use add-on-identifying names. Use the documented handler system where one exists.
+4. Template changes use template modifications rather than rendered-template manipulation, and modifications replace no more of the target than necessary.
+5. Third-party libraries are appropriately licensed. Any license callback, installation dependency, or lifecycle call to an external server is disclosed as required. Uninstallation cannot be blocked by an external server or failed request, and installation/uninstallation does not download executable code.
+6. Release notes identify issues resolved by each Resource Manager update.
+
## Registered Data
Content-type fields, permissions, widget definitions, and several other development-output types may not have a make command in the installed version. Check `xf list xf-make`, then follow the UI-first fallback in `xf-shared-policy/references/development-output.md`.
Index: src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/SKILL.md.stub
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/SKILL.md.stub b/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/SKILL.md.stub
--- a/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/SKILL.md.stub (revision 704580f74a79782ae09034bc184da5a87fcb2574)
+++ b/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-addon-dev/SKILL.md.stub (revision 4fc88d8f0f0ad7e2750890a8f43a703303341a5d)
@@ -16,12 +16,29 @@
## Extension Choices
-- Use class extensions when adapting an extensible class's behavior.
-- Use code events for the documented event surface and cross-cutting hooks.
-- Add entity columns or tables in `Setup.php`; add entity structure definitions through the supported extension/event mechanism.
+Choose an extension mechanism based on the behavior that must change, not merely on whether a code event exists.
+
+- Use a code-event listener when a documented event provides the complete hook needed for a focused action at one execution point, especially for cross-cutting behavior that does not need to change the owning class's implementation.
+- Use a class extension when behavior belongs to one class and requires coordinated changes across methods, entity structure or relations, validation, the save lifecycle, or return/control flow. Extend the generated `XFCP_<ClassName>` proxy and compose with `parent` as required by the method contract.
+- Use a framework handler system when it is the documented extension contract for the feature, such as spam checking. Do not extend several unrelated classes to simulate a handler.
+- If either a listener or a class extension can express the complete behavior, prefer the least intrusive mechanism that keeps related logic cohesive. Do not split one entity change across several listeners merely because pre-save, post-save, or structure events exist.
+- The public Resource Manager standard that a listener "should" be used where a specific event exists is a default preference when that event is sufficient, not an unconditional requirement. A class extension is appropriate when it is needed for cohesive class-specific behavior; record a non-obvious departure from the preference in the implementation or review notes.
+- Add entity columns or tables in `Setup.php`; add entity structure definitions through the supported entity extension or event mechanism, using the same extension choice for related entity behavior where practical.
- Prefer services for multi-step writes and repositories/finders for reusable queries.
- Create factories with native class strings, never legacy short names.
+## Framework and Resource Standards
+
+Use XenForo's framework facilities and the current public resource standards when they apply:
+
+- Read and write through Finder/entity APIs where possible. If a direct query is justified, use the default XF database adapter and prepared statements, constrain reads and writes, and check for accidental N+1 query growth.
+- Filter request input through XenForo's input filterer and preserve the framework's escaping. Do not introduce XSS through templates, HTML, JavaScript, or deliberately unescaped output.
+- Use template modifications for changes to existing templates, keep modifications narrow, and use a callback or regular expression when a simple replacement would consume too much of the template.
+- Use the XF HTTP client, filesystem, mail, image, and other framework services rather than reimplementing them. Escape arguments passed to process or exec-style functions.
+- Keep third-party libraries appropriately licensed. Do not obscure released code except for an explicitly permitted, time-limited demo or trial.
+- Public resources must not register listeners or add data unrelated to their add-on. Prefix add-on-owned tables, core columns, template modifications, phrases, and other unique keys according to the published standards.
+- Do not download executable code during installation or uninstallation. Uninstallation must remain possible if an external request fails, and installation or lifecycle calls to external services must be disclosed as required by the resource guidelines.
+
## Installation and Upgrades
- Keep fresh-install schema in `installStep*()` or reusable schema methods and changes for installed sites in `upgrade<versionId>Step<n>()`.
Index: src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-template-phrase/SKILL.md.stub
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-template-phrase/SKILL.md.stub b/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-template-phrase/SKILL.md.stub
--- a/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-template-phrase/SKILL.md.stub (revision 704580f74a79782ae09034bc184da5a87fcb2574)
+++ b/src/XF/Cli/Command/Development/stubs/ai-agents/skills/xf-template-phrase/SKILL.md.stub (revision 4fc88d8f0f0ad7e2750890a8f43a703303341a5d)
@@ -17,7 +17,8 @@
2. Reuse the established structural component, form row, macro, CSS class, responsive utility, and JavaScript behavior before adding markup or LESS.
3. Use `xf-make:template` and `xf-make:phrase` for new artifacts.
4. Keep authorization, queries, and domain decisions out of templates. Prepare view data in PHP.
-5. Verify the rendered result at narrow and wide widths, including empty, error, disabled, and long-content states that the change affects.
+5. Use template modifications to inject changes into existing templates rather than manipulating rendered output in PHP. Keep modifications narrow and use a callback or regular expression when a simple replacement would replace too much.
+6. Verify the rendered result at narrow and wide widths, including empty, error, disabled, and long-content states that the change affects.
Read [template-language-semantics.md](references/template-language-semantics.md) before writing expressions or macros. Read [ui-patterns.md](references/ui-patterns.md) before creating or restyling a form, list, menu, overlay, or content block.
xenforo.com
