Skip to main content
Lattice logo

Lattice

Back to Core
Complete Documentation

Lattice Core - User Guide

Everything you need to know about using Lattice Core to keep your code quality high and guide AI assistants correctly.

What Does Lattice Core Do?

Think of Lattice Core as a quality checker that runs in the background. It:

  • Checks your code - Runs linting, type checking, tests, and builds
  • Guides AI assistants - Creates rules so AI uses the right package versions
  • Finds security issues - Scans for exposed secrets and API keys
  • Tracks changes - Monitors if your code drifts from standards
  • Sets up CI/CD - Generates GitHub Actions workflows
  • Shows project health - Displays compliance scores and status

Quick Start

First Time Setup

Just run this in your project directory:

npx latticeai

This will:

  1. Ask a few questions about your project
  2. Set up Lattice configuration
  3. Generate quality rules for AI assistants
  4. Add verification scripts to your project

That's it! You're ready to go.

Commands Overview

Getting Started

lattice - Interactive Setup

The easiest way to get started. Just run:

npx latticeai

It will guide you through setup with questions.

lattice setup - Quick Setup

If you know what you want, use flags:

# For a Next.js project
npx latticeai setup --projectType nextjs --preset startup
# For an Expo project
npx latticeai setup --projectType expo-eas --preset pro
# With integrations
npx latticeai setup --projectType nextjs --preset pro --billing stripe --analytics posthog

Options:

  • --projectType - Choose nextjs or expo-eas
  • --preset - Choose startup, pro, or enterprise (see Presets below)
  • --preview - See what will change before applying
  • --billing - Payment integration: stripe, paddle, or none
  • --analytics - Analytics: posthog, mixpanel, or none
  • --observability - Monitoring: sentry, datadog, or none
  • --testing - Testing framework: jest, vitest, or none

Using a Bundle:

npx latticeai setup --bundle nextjs-saas
npx latticeai setup --bundle <url> # Or use a URL

Available bundles: nextjs-saas, nextjs-landing, nextjs-trpc, expo-mobile, expo-supabase

lattice init - Initialize Configuration Only

Create Lattice configuration without generating the pack:

npx latticeai init --projectType nextjs --preset startup
npx latticeai init --detect # Auto-detect project type
npx latticeai init --force # Overwrite existing config

Flags:

  • --projectType <nextjs|expo-eas> - Framework type
  • --preset <startup|pro|enterprise> - Strictness preset
  • --detect - Auto-detect from package.json
  • --force - Overwrite existing config
  • --billing, --analytics, --observability, --testing - Integration options

lattice generate - Generate Pack

Generate the Lattice pack (rules, configs, workflows) without applying:

npx latticeai generate
npx latticeai generate --output ./custom-pack
npx latticeai generate --config ./custom-config.json

What it creates:

  • .cursor/rules.md - AI assistant instructions
  • prompts/ - Reusable prompt templates
  • .github/workflows/ - CI/CD workflows
  • .vscode/tasks.json - Editor integration
  • package.json scripts - Verification commands

Flags:

  • --output <dir> - Output directory (default: ./lattice-pack)
  • --config <path> - Custom config file (default: .lattice/config.json)

lattice apply - Apply Pack to Project

Apply a generated pack to your project:

npx latticeai apply
npx latticeai apply --pack ./lattice-pack --target .
npx latticeai apply --preview # Preview changes
npx latticeai apply --confirm # Show preview and ask for confirmation
npx latticeai apply --force # Reset to baseline (overwrites changes)

What it does:

  • Merges rules into existing .cursor/rules.md (preserves your custom sections)
  • Adds/updates package.json scripts
  • Creates CI workflows
  • Updates editor configs

Flags:

  • --pack <dir> - Pack directory (default: ./lattice-pack)
  • --target <dir> - Target directory (default: .)
  • --preview - Show what would change without applying
  • --confirm - Show preview and ask for confirmation
  • --force - Reset to baseline (overwrites your changes)

Checking Your Code

lattice verify - Run Quality Checks

This is the command you'll use most often. It runs your linting, type checking, tests, and builds.

# Run all checks for your preset
npx latticeai verify
# Run only specific checks
npx latticeai verify --only lint,typecheck
# Run all checks (ignore preset)
npx latticeai verify --full
# Watch mode - runs automatically when files change
npx latticeai verify --watch

What gets checked:

  • startup preset: lint, typecheck
  • pro preset: lint, typecheck, test
  • enterprise preset: lint, typecheck, test, build

Useful flags:

  • --only <checks> - Run only specific checks (comma-separated)
  • --full - Run all checks regardless of preset
  • --quality - Run quality checks (Lighthouse, axe accessibility) - Next.js only
  • --watch - Keep running and check on file changes
  • --install - Install dependencies if needed
  • --json - Get results as JSON (for scripts)

lattice verify-rules - Check Rules File

Makes sure your AI assistant rules are up to date:

npx latticeai verify-rules
npx latticeai verify-rules --rules .cursor/rules.md # Custom rules file
npx latticeai verify-rules --stack nextjs # Verify stack matches

Flags:

  • --rules <path> - Custom rules file path (default: .cursor/rules.md)
  • --stack <stack> - Expected stack (nextjs, expo, etc.)

lattice release-check - Pre-Launch Checklist

Before releasing, run this to make sure everything is ready:

npx latticeai release-check
npx latticeai release-check --fix # Auto-fix what it can

Checks for:

  • Documentation (README, CHANGELOG)
  • Environment variables documented
  • No exposed secrets
  • All tests passing
  • Version numbers updated

Security

lattice security-scan / lattice scan - Find Exposed Secrets

Scans your code for accidentally committed API keys, passwords, and other secrets:

# Just scan
npx latticeai security-scan
# Scan and automatically fix issues
npx latticeai security-scan --fix
# Also check git history
npx latticeai security-scan --scan-git-history
# Install a pre-commit hook to prevent secrets
npx latticeai security-scan --install-hook
# Get JSON output (for scripts)
npx latticeai security-scan --json
# Export SARIF format (for CI/CD tools)
npx latticeai security-scan --sarif
# Export report to file
npx latticeai security-scan --export report.json
# Skip .env file validation
npx latticeai security-scan --skip-env-check

What it finds:

  • API keys (OpenAI, Anthropic, AWS, Stripe, etc.)
  • Database passwords and connection strings
  • JWT secrets and tokens
  • Private keys (PEM format)
  • OAuth tokens and client secrets
  • Cloud service credentials (Vercel, Netlify, Heroku, etc.)
  • Payment service keys (Stripe, PayPal, Square)
  • Email service keys (SendGrid, Mailgun, Resend)
  • Monitoring keys (Sentry, Datadog, New Relic)
  • And 50+ other secret patterns

Severity levels:

  • Critical: API keys, passwords, private keys, database connections
  • High: Tokens, webhook URLs, service credentials
  • Medium: Email addresses in config, potential keys

Auto-fix (--fix):

  • Moves secrets to .env.local
  • Updates code to use process.env variables
  • Updates .gitignore to exclude .env files
  • Validates secret formats before fixing

Export formats:

  • --json - JSON output for programmatic use
  • --sarif - SARIF format for CI/CD integration (GitHub Security, etc.)
  • --export <path> - Save report to file (JSON or SARIF)

Additional features:

  • Validates .env files are properly gitignored
  • Scans git history for secrets that were committed in the past
  • Pre-commit hook prevents committing secrets
  • Secret format validation (checks if keys match expected patterns)

Project Status

lattice status - See How You're Doing

Get a quick overview of your project's health:

npx latticeai status

Shows:

  • Compliance score (0-100%)
  • Configuration status
  • Rules file status
  • Last verification results
  • Drift percentage

lattice drift - See What Changed

Check if your Lattice-managed files have been modified:

npx latticeai drift

Shows:

  • Files you've modified
  • Files that were deleted
  • New files added

To reset to baseline:

npx latticeai apply --force

lattice progress - Track Project Phases

If you have a PROJECT_GUIDE.md with checkboxes, see your progress:

npx latticeai progress

Requires PROJECT_GUIDE.md with checkboxes like:

- [x] Phase 1: Setup
- [ ] Phase 2: Build features
- [ ] Phase 3: Launch

lattice diff - See Changes

See what's changed since Lattice last generated files:

npx latticeai diff
npx latticeai diff --json # JSON output

Configuration

lattice config show - View Settings

See your current Lattice configuration:

npx latticeai config show
npx latticeai config show --json # JSON format

lattice rules explain - Understand Rules File

Get an explanation of what your .cursor/rules.md file does:

npx latticeai rules explain

Updates

lattice check - Check for Updates

See if a new version of Lattice is available:

npx latticeai check

lattice update - Update Lattice

Update your Lattice rules to the latest version:

npx latticeai update
npx latticeai update --preview # Preview changes first

This preserves your custom changes while updating Lattice-generated content.

Bundle Management

lattice bundle update - Check Bundle Version

See if your Lattice bundle is up to date:

npx latticeai bundle update

lattice bundle diff - Preview Bundle Changes

See what would change if you regenerated:

npx latticeai bundle diff

lattice bundle rollback - Undo Changes

Revert to a previous bundle version (if backup exists):

npx latticeai bundle rollback

CI/CD

lattice ci - Generate CI Workflow

Create a GitHub Actions or GitLab CI workflow:

# GitHub Actions (default)
npx latticeai ci
# GitLab CI
npx latticeai ci --provider gitlab
# Preview without writing
npx latticeai ci --dry-run

Creates workflows that run lint, typecheck, test, and build on every push.

Advanced Commands

These commands are used internally by setup, but you can use them directly if needed:

See lattice generate and lattice apply above in the "Getting Started" section.

Utilities

lattice doctor - Fix Common Issues

Check your environment and fix common problems:

# Just check
npx latticeai doctor
# Check and fix automatically
npx latticeai doctor --fix
# Preview fixes without applying
npx latticeai doctor --fix --dry-run

Checks:

  • Node.js and npm versions
  • Git setup
  • Missing scripts in package.json
  • Missing .gitignore
  • TypeScript configuration

lattice completions - Shell Autocomplete

Get tab completion for Lattice commands:

# Bash
eval "$(lattice completions bash)"
# Add to ~/.bashrc
# Zsh
eval "$(lattice completions zsh)"
# Add to ~/.zshrc
# Fish
lattice completions fish > ~/.config/fish/completions/lattice.fish
# PowerShell
Invoke-Expression (lattice completions powershell | Out-String)
# Add to $PROFILE

Presets Explained

Lattice has three strictness levels:

startup (Recommended for Most)

Light and fast - Good for MVPs and side projects

  • Checks: lint, typecheck
  • Fast feedback
  • Minimal overhead

pro

Balanced - Good for production apps

  • Checks: lint, typecheck, test
  • Ensures you have tests
  • Good for freelance work

enterprise

Comprehensive - For critical systems

  • Checks: lint, typecheck, test, build
  • Full build verification
  • Best for large teams

What Gets Created

After running lattice setup, you'll have:

your-project/
├── .lattice/
│   ├── config.json          # Your Lattice settings
│   ├── manifest.json        # What Lattice generated
│   └── compliance.json      # Verification history
├── .cursor/
│   └── rules.md            # Rules for AI assistants
├── prompts/                # Reusable prompt templates
│   ├── 01-feature-implementation.md
│   ├── 02-bug-fix.md
│   ├── 03-safe-refactor.md
│   ├── 04-test-first.md
│   ├── 05-ui-polish.md
│   └── 06-security-review.md
├── .github/
│   └── workflows/
│       └── ci.yml          # CI workflow
├── .vscode/
│   └── tasks.json          # Editor tasks
└── package.json            # Updated with verify scripts

Common Workflows

Daily Development

# Before committing
npx latticeai verify
# While coding (runs automatically on save)
npx latticeai verify --watch
# Run quality checks (Lighthouse, accessibility)
npx latticeai verify --quality
# Check for security issues
npx latticeai security-scan

Before Releasing

# Full production check
npx latticeai release-check --fix
# Make sure everything passes
npx latticeai verify --full
# Check if anything drifted
npx latticeai drift

Updating Lattice

# Check for updates
npx latticeai check
# See what would change
npx latticeai update --preview
# Apply update
npx latticeai update

Setting Up CI/CD

# Generate GitHub Actions workflow
npx latticeai ci
# Or GitLab CI
npx latticeai ci --provider gitlab

How It Works with AI Assistants

Cursor

Lattice creates .cursor/rules.md that tells Cursor:

  • What package versions to use
  • Your project structure
  • How to verify code quality
  • Framework-specific patterns

Cursor automatically reads and follows these rules.

Claude Code

Lattice also creates CLAUDE.md for Claude Code compatibility.

Troubleshooting

"No Lattice configuration found"

Run setup:

npx latticeai setup

"Verify failed - missing scripts"

Fix automatically:

npx latticeai doctor --fix

"Drift detected"

See what changed:

npx latticeai drift

Reset to baseline:

npx latticeai apply --force

"Security scan found secrets"

Auto-fix:

npx latticeai security-scan --fix

Then:

  1. Review the changes
  2. Update your deployment environment variables
  3. Rotate any exposed secrets

Tips & Tricks

Custom Rules

You can add your own rules to .cursor/rules.md. Lattice won't overwrite anything outside the <!-- LATTICE:START --> and <!-- LATTICE:END --> markers:

<!-- LATTICE:START ... -->
... Lattice-generated content ...
<!-- LATTICE:END -->

## My Custom Rules

Add your own rules here - they'll be preserved!

Customizing Bundles

  1. Run lattice generate to create a pack
  2. Modify files in lattice-pack/
  3. Apply with lattice apply

Viewing Compliance History

Check .lattice/compliance.json or run lattice status to see your verification history and compliance scores.

Getting Help

  • Run lattice help for command overview
  • Run lattice <command> --help for specific command help
  • Check the docs/ directory for more documentation

Summary

Lattice Core is free and helps you:

  • Keep code quality high
  • Guide AI assistants correctly
  • Find security issues
  • Track project health
  • Set up CI/CD easily

Just run npx latticeai to get started!