Enterprise Essentials Dev Stack

Curated Claude Code skills and guardrail hooks for Salesforce consulting work. Curated and supported by Mike Carter, Enterprise Essentials.

Install (or update): one line

npx ee-dev-stack

That installs/refreshes BOTH streams:

1. Vendor stream: the official Salesforce skills library (forcedotcom/sf-skills, 69 skills, maintained by Salesforce)
2. Enterprise Essentials stream: house skills and enforcement hooks (below)

Re-running the same command is the update mechanism. It is idempotent and safe.

What the Enterprise Essentials stream adds

Skills (knowledge that fires automatically)

| Skill | What it protects | |---|---| | ee-conventions | House standards: deploy discipline, FLS pairing rule, Apex standards, "the org must never be ahead of git" | | ee-test-discipline | Never mutate production business logic to make a failing Apex test pass. Diagnose test-side first; production changes need explicit human approval | | ee-org-guard | Companion to the org-guard hook: explains blocks, builds verified org-lock files | | ee-deploy-error-translator | Translates cryptic Salesforce deploy errors into plain English + a fix | | ee-permset-watcher | Catches "deployed-but-invisible": new metadata missing FLS/permset grants | | ee-datapack-guard | OmniStudio DataPack import chunking; Dev Edition timeout-rollback protection | | ee-kill-images | Strips base64 images from conversation history to control context bloat |

Hooks (deterministic enforcement, not suggestions)

| Hook | Event | What it enforces | |---|---|---| | ee-org-guard | Before every sf command | Blocks destructive commands unless the target org is allow-listed in the project's .claude/org-lock.json AND its real org ID (via sf org display) matches the lock. No lock file = no deploys. No --target-org = blocked | | ee-git-sync | After every deploy | The org must never be ahead of git: warns when a deploy lands with uncommitted/unpushed changes | | ee-fls-audit | After every deploy | Scans deployed metadata for missing canonical-permset grants | | ee-commit-cadence | End of each turn | Nudges for a checkpoint commit when uncommitted work outlives the cadence window (default 90 min, configurable) | | ee-precompact-images | Before compaction | Strips image payloads from the transcript |

The org-lock file (required for deploys)

Each project gets <project root>/.claude/org-lock.json:

{
  "write":    { "my-sandbox": "00Dxx0000000001" },
  "readonly": { "my-prod":    "00Dxx0000000002" },
  "canonicalPermset": "My_Project_Admin",
  "commitCadenceMinutes": 90
}

Easiest path: open Claude Code in the project and say "set up my org lock file". The ee-org-guard skill runs the verified flow (real org IDs from sf org display, human confirmation before anything enters the write list).

Requirements

• Node 18+ (for npx)
• Claude Code
• sf CLI (for org verification)
• macOS/Linux (hooks use python3, present by default on macOS)

Architecture: two streams, zero merges

Vendor skills are never edited, so Salesforce updates always apply cleanly. Enterprise Essentials skills are prefixed ee- and live alongside them; at runtime Claude composes both (vendor = the textbook, Enterprise Essentials = the house style and the tripwires). Per-project specifics stay in each repo's .claude/org-lock.json and CLAUDE.md.

Support

Questions, false positives, new tripwire candidates: Mike Carter.