Every framework is racing to help an agent write your app. stk is built around the other half: knowing whether what came out still works. Five commands, one loop, and a gate that measures the app in a real browser instead of trusting it.
stk doctor answers the nine questions you would otherwise discover one failed command at a time. Every line that is not a tick carries the command that fixes it.
Real output. That failing line was a genuine problem in the repo, found by the command on its first run.
Not a four-step checklist. stk new writes the model, views, and template as an extension package inside your app, adds it to the app's extensions, generates the migration, applies it, and hands you the URL. Not one stk file changes.
--no-migrate if you would rather write the migration by hand.
Leave stk verify --watch in a split pane. It re-runs only what your change can break: touching a model re-checks migration drift, touching a template does not. Every failure prints the command that fixes it.
Migration drift is measured, not guessed. stk runs your migrations onto a throwaway database and diffs the result against your models, so the answer never depends on the state of your own machine. It runs in CI too, which means a model edited without a migration cannot merge.
Remedies land in --json as well, so an agent reads the fix instead of inventing one.
stk shell is an async REPL with the app, a live database session and every model already in scope. Top-level await works, so code copied out of a view runs unchanged.
Auth is read from the real guard chain, not guessed from URL prefixes, and a sanity check fires a genuine anonymous request at every route the report calls guarded. When that check was written it found seven security routes, including 2FA setup and passkey registration, reported as public.
stk smoke boots a throwaway app on a free port, logs in through a development-only token route and drives Chromium across the app. It fails on any 4xx or 5xx response, a console error, a failed request, or text that does not contrast with its background.
One command, every page it can reach, a screenshot written to .stk/smoke/, and the same command runs in CI on every push.
Four real defects in stk itself, all invisible to a passing test suite and a clean console. This is the argument for the whole approach, so the list is specific rather than impressive.
/change, /tf-setup, /wan-register and friends. An agent asking "what is exposed?" was pointed straight at 2FA and passkey management.
Vuetify 4 ships its CSS in cascade layers, so an unlayered link colour won over the button's text colour. No console error, no failed request, nothing for a test to catch.
Nav filtering mutated state inside a computed. Vue's development build only warns; the production reactivity loops. The app had been shipping the development build, which hid it.
A recovery-code template asked for a form variable the library passes under a different name. A security route, unauthenticated, broken in production.
The rule behind the list: every failure becomes a check that cannot pass silently again. All four now have one.
