Epic Stack catch-up: tracking

[cursor]

Goal

Catch goodeats/patn-dev-stack up with worthwhile updates from epicweb-dev/epic-stack since this site last moved (2025-06-24, 5712343 / “faster healthcheck”), without a blind merge and without losing this site’s customizations.

Epic Stack is a copy-paste template, not a git remote we can merge. Port by hand, one package at a time.

Ignore issue #22 (accidental permission probe).

Prerequisite before any implementing PR

origin/dev is 2 commits behind origin/main and 0 ahead. Fast-forward dev to main first so staging is not behind production:

git fetch origin
git checkout dev
git merge --ff-only origin/main
git push origin dev

Do not use stale PR #21 (p/patn-dev-stack-updater, 79 files) as a base.

Workflow (every child issue)

1. One Cursor Cloud Agent per child issue. Cheaper model is fine when the issue body is this complete.
2. Branch off current origin/dev.
3. Implement only that issue. Do not start the next package in the same PR.
4. Open a PR into dev (never main).
5. CI must pass: lint, typecheck, vitest, Playwright (existing deploy workflow).
6. Merge to dev → auto-deploys patn-dev-stack-staging.
7. Human smoke-test staging, then close the child issue.
8. Next issue, new agent, fresh context, same rules.

Production: after a slice looks good on staging, PR dev → main as usual. Package 1 (CVEs) is worth shipping to production on its own. Packages 5–7 should stay on staging longer.

Do not touch (every agent, every PR)

• app/routes/dashboard+/** (projects / skills / about / contacts CRUD) except package 7, which only renames/moves those files to the new routing convention
• Extra UI packages this site added: @dnd-kit/*, @tanstack/react-table, lucide-react, recharts, vaul, next-themes, extra Radix packages, @tabler/icons-react
• Localtunnel: LOCAL_TUNNEL_SUBDOMAIN, allowedHosts in vite.config.ts, localtunnel npm script
• Custom .env.example keys (DEV_*, CONTACT_*, Resend, localtunnel)
• Healthcheck behavior this site already chose: SELECT 1, no self-HEAD request (app/routes/resources+/healthcheck.tsx)
• fly.toml app = "patn-dev-stack" and primary_region = "bos"
• my-docs/, react-scan, custom marketing copy, README.md
• Package name / author in package.json

Implementing issues (filed immediately after this one, in order)

Search titles Epic Stack catch-up N/7.

#	Title	Why this order
1	React Router 7.18+ CVE bump	Security; small; ship to prod after staging
2	Sentry hidden maps + event filters	This site already has Sentry
3	Small bugfix batch	Low risk, good cheap-model PR
4	LiteFS 2 + multi-region cache + asset fallthrough	Production correctness
5	Server index.ts / drop server-build / Express 5	Medium-high risk; after 1–4
6	Vite 7 + Vitest 4 + remaining majors	After server boot is stable
7	react-router-auto-routes + dashboard+ rename	Largest; last; stronger model

Skip unless we explicitly ask later

• Epic Stack skills markdown dump
• Mailtrap / Varlock example-page links
• Getting-started seed wording
• Cosmetic resend.svg refresh

Anti-hallucination rules for implementing agents

• The child issue body is the entire spec. Do not invent extra upgrades.
• Do not “also upgrade unrelated deps while we are here.”
• Do not copy Epic Stack files that would wipe customizations listed above.
• Catching up to Epic Stack HEAD is not enough for React Router CVEs: Epic Stack is on 7.16.0; we need 7.18.0+.
• If a file is not in the child’s “Files allowed” list, do not edit it unless required for the build to compile, and say so in the PR.