to main

.circleci/config.yml

@@ -5,9 +5,23 @@ jobs:
       # App targets Node 24.18 (engines/.nvmrc); the matching browsers image is
       # now published, so CI runs on the same Node line as the app + local dev.
       - image: cimg/node:24.18-browsers
+        environment:
+          DB_URL: mongodb://127.0.0.1:27017/web-jam-test
+          NODE_ENV: test
+      - image: mongo:7.0
     working_directory: ~/repo
     steps:
       - checkout
+      - run:
+          name: PR base branch verification (main requires dev head)
+          command: |
+            TARGET="${CIRCLE_TARGET_BRANCH:-${GITHUB_BASE_REF:-}}"
+            SOURCE="${CIRCLE_BRANCH:-$(git rev-parse --abbrev-ref HEAD)}"
+            if [ -n "$TARGET" ] && [ "$TARGET" = "main" ] && [ "$SOURCE" != "dev" ]; then
+              echo "FAIL: PRs targeting main must originate from dev branch (got: $SOURCE)." >&2
+              exit 1
+            fi
+            echo "OK: PR base/head branch verification passed (Target: ${TARGET:-default}, Source: $SOURCE)"
       - run:
           name: Test install (skip postinstall — frontend not needed for tests)
           command: npm install --ignore-scripts

.nvmrc

@@ -1 +1 @@
-24.18.0
+24.18.1

AGENTS.md

@@ -1,16 +1,23 @@
 # Gemini Context: web-jam-back
 
 ## Tech Stack
-- **Runtime:** Node.js
+- **Runtime:** Node.js v24.18.1
 - **Framework:** Express
 - **Testing:** Vitest (vitest.config.ts)
 - **Linting:** ESLint (eslint.config.mjs)
 
 ## Development Workflow
 - **Build:** Check package.json for build scripts.
+- **Node Engine Version Bumps:** When bumping Node.js in `package.json` `engines.node`, always run `npm install --package-lock-only --ignore-scripts` (or `npm install --ignore-scripts`) to update `package-lock.json` root engine definition without triggering `postinstall` build scripts, so both files are committed together.
 - **Standards:** Follow existing ESM patterns.
 - **Merging:** Gemini is **NOT** allowed to merge PR changes to the `dev` or `main` branches. The user is the reviewer.
 
+## Quota & Token Hygiene
+- **Sliding Window Quota Preservation:** Google Antigravity (`agy`) tracks model token usage on a rolling 5-hour sliding window. To preserve quota and avoid 3+ hour lockouts during heavy or multi-repo tasks:
+  - Keep command outputs compact: avoid printing thousands of lines of raw test logs directly into main turn outputs.
+  - Redirect large multi-line summaries, test plans, and evidence to scratch files (`--summary-file`, `--test-plan-file`, `--test-evidence-file`) when calling `create-draft-pr.sh`.
+  - **Automatic Flash Med Subagent Handoff on "Go":** Once requirements and implementation steps are aligned interactively on `Flash High`, automatically delegate contained execution work (coding, running test suites, branch/PR creation) down to a `Flash Med` subagent without waiting for Josh to explicitly request delegation.
+
 ## Routes & Verbs
 - **Venue Updates (`/venue/:id`)**: `PATCH /venue/:id` is the standard partial-merge update verb. `PUT /venue/:id` is maintained alongside `PATCH` for backward compatibility, both routing to `controller.updateVenue`. Address updates enforce immutability once set (`400: address cannot be removed`).
 - **Setlist API Sorting (`GET /setlist` and `GET /setlist/:id`)**: Accepts `?sort=title` (or `sort=artist` / `sort=order`) to return items in alphabetical or specified order. Sorting is read-time view only and strips `sort` from Mongoose query params so stored MongoDB item order is never mutated.

package.json

@@ -1,11 +1,11 @@
 {
   "name": "web-jam-back",
-  "version": "2.11.1",
+  "version": "2.11.4",
   "description": "web-jam.com",
   "type": "module",
   "main": "build/src/index.js",
   "engines": {
-    "node": "24.18.0"
+    "node": "24.18.1"
   },
   "files": [
     "src/"