shiplisted

# Ship Workflow > **Browser access.** Prefer the built-in browser tools (`mcp__Claude_Browser__*`) > when the session has them — that is the default in the desktop app. The > `agent-browser` commands below are the terminal-only fallback. The `browser` > skill owns the driver-selection rule; follow it before running either. Complete deployment pipeline: pre-flight → security → deploy → verify → report. ## Step 1: Blocking Quality Gates ALL must pass before deploying. Run in parallel: ```bash npm run typecheck # BLOCKING — zero errors npm run build # BLOCKING — zero errors npm run test -- --watchAll=false # BLOCKING — all pass npm audit --production 2>/dev/null | grep -E "critical|high" # BLOCKING — zero critical/high git status --short # Warn if uncommitted changes ``` | Result | Action | |--------|--------| | Build fails | Stop — fix errors first | | Typecheck fails | Stop — fix types first | | Tests fail | Stop — fix tests first | | npm audit critical/high | Stop — fix vulnerabilities first | | Uncommitted changes | Warn user, ask if they want to commit (use git directly, do not invoke the commit skill) | | All pass | Continue to Step 2 | ## Step 2: Security Scan Run before every deploy (uses `security` skill): - [ ] No hardcoded API keys, tokens, or secrets in code - [ ] `.env` files not committed (check `.gitignore`) - [ ] Supabase RLS enabled on all public tables - [ ] Input validation on all user-facing forms - [ ] No `dangerously