@jikida/init 0.1.1 → 0.2.0

package/README.md

@@ -325,7 +325,7 @@ If you're on **Pro or Max**, unlock:
 | `io.jikida:sdk` | Maven Central | Java 17+ | 🚧 in development |
 | `Jikida` | NuGet | .NET 8+ | 🚧 in development |
 
-Beyond the SDKs, Jikida also ships the [**Jikida.io Connector**](https://wordpress.org/plugins/jikida-connector/) WordPress plugin (local hardening + one-click managed WAF) and the [**Jikida Alerts**](https://play.google.com/store/apps/details?id=io.jikida.alerts) Android app (push the moment a site goes down or is attacked).
+Beyond the SDKs, Jikida also ships the [**Jikida.io Connector**](https://wordpress.org/plugins/jikida-security/) WordPress plugin (local hardening + one-click managed WAF) and the [**Jikida Alerts**](https://play.google.com/store/apps/details?id=app.jikida.io) Android app (push the moment a site goes down or is attacked).
 
 ## Links
 
@@ -333,8 +333,8 @@ Beyond the SDKs, Jikida also ships the [**Jikida.io Connector**](https://wordpre
 - **App / dashboard**: [app.jikida.io](https://app.jikida.io)
 - **MCP server**: [mcp.jikida.io](https://mcp.jikida.io)
 - **Playground (attack sandbox)**: [playground.jikida.io](https://playground.jikida.io)
-- **WordPress plugin**: [Jikida.io Connector](https://wordpress.org/plugins/jikida-connector/)
-- **Mobile app (Google Play)**: [Jikida Alerts](https://play.google.com/store/apps/details?id=io.jikida.alerts)
+- **WordPress plugin**: [Jikida.io Connector](https://wordpress.org/plugins/jikida-security/)
+- **Mobile app (Google Play)**: [Jikida Alerts](https://play.google.com/store/apps/details?id=app.jikida.io)
 - **Documentation**: [jikida.io/docs](https://jikida.io/docs)
 - **Uptime monitoring**: [jikida.io/uptime](https://jikida.io/uptime)
 - **Threat coverage map**: [jikida.io/threats](https://jikida.io/threats)

package/bin/init.js

@@ -94,31 +94,77 @@ function installSkill() {
     process.exit(1);
   }
   const body = readFileSync(skillSrc, 'utf8');
+  // A short bootstrap that every assistant file points at, so we never dump the
+  // whole skill into a rules file the tool truncates — the master lives once in
+  // .claude/skills/jikida/SKILL.md and each assistant is told to read it.
+  const bootstrap =
+    '# Jikida security skill\n\n' +
+    'At the start of every session, read `.claude/skills/jikida/SKILL.md` and follow it.\n' +
+    'It defines when to scan, how to guard code as you write it, the 25-category check\n' +
+    'catalog, the 5 intervention levels (never break working code), and the score/memory\n' +
+    'model. You are a helpful developer assistant AND a security engineer: flag secrets,\n' +
+    'open Supabase/Firebase rules, committed .env, and injection as you go — fix at the\n' +
+    'lowest safe level, ask before anything destructive.\n';
+
+  // The Cursor .mdc format wants YAML front-matter (globs + alwaysApply).
+  const mdc =
+    '---\n' +
+    'description: Jikida security skill — scan, guard code, and fix as you build\n' +
+    'globs: ["**/*"]\n' +
+    'alwaysApply: true\n' +
+    '---\n\n' + bootstrap;
+
+  // Master skill (full body) + one thin bootstrap per assistant, so "install into
+  // every editor you already use" actually holds — Cursor, Windsurf, Cline,
+  // Copilot, Aider, Continue, Claude, Gemini, plus the generic AGENTS.md.
   const targets = [
-    join(cwd, '.claude', 'skills', 'jikida', 'SKILL.md'),
-    join(cwd, '.cursor', 'rules', 'jikida.md'),
+    [join(cwd, '.claude', 'skills', 'jikida', 'SKILL.md'), body],
+    [join(cwd, 'AGENTS.md'), bootstrap],
+    [join(cwd, 'CLAUDE.md'), bootstrap],
+    [join(cwd, 'GEMINI.md'), bootstrap],
+    [join(cwd, '.cursorrules'), bootstrap],
+    [join(cwd, '.cursor', 'rules', 'jikida.mdc'), mdc],
+    [join(cwd, '.windsurfrules'), bootstrap],
+    [join(cwd, '.clinerules'), bootstrap],
+    [join(cwd, '.aider.conf.yml'), bootstrap],
+    [join(cwd, '.github', 'copilot-instructions.md'), bootstrap],
   ];
   log('');
   log('  Installing the Jikida skill');
   log('  ----------------------------');
-  let wrote = 0;
-  for (const target of targets) {
+  const MARK = 'Jikida security skill';
+  let wrote = 0, skipped = 0;
+  for (const [target, content] of targets) {
+    const rel = target.replace(cwd + '/', '');
     try {
       mkdirSync(dirname(target), { recursive: true });
-      writeFileSync(target, body);
-      done(target.replace(cwd + '/', ''));
-      wrote++;
+      // The master SKILL.md is always (re)written so updates land. The per-
+      // assistant files are APPEND-if-present, skip-if-already-ours — never clobber
+      // a user's existing rules file, never double-add.
+      if (target.endsWith('SKILL.md')) {
+        writeFileSync(target, content);
+        done(rel); wrote++;
+      } else if (!existsSync(target)) {
+        writeFileSync(target, content);
+        done(rel); wrote++;
+      } else if (readFileSync(target, 'utf8').includes(MARK)) {
+        skipped++;
+      } else {
+        appendFileSync(target, '\n\n' + content);
+        done(rel + ' (appended)'); wrote++;
+      }
     } catch (e) {
-      warn(`Could not write ${target}: ${e.message}`);
+      warn(`Could not write ${rel}: ${e.message}`);
     }
   }
-  if (wrote > 0) {
+  if (wrote > 0 || skipped > 0) {
     log('');
-    log('  Done. Your AI editor now knows Jikida — restart it, then ask it to');
+    if (skipped > 0) { log(`  ${skipped} file(s) already had the skill — left untouched.`); }
+    log('  Done. Your AI editors now know Jikida — restart them, then ask them to');
     log('  "add Jikida security to this app" or "scan my repo for leaked secrets".');
     log('');
   }
-  process.exit(wrote > 0 ? 0 : 1);
+  process.exit((wrote > 0 || skipped > 0) ? 0 : 1);
 }
 
 banner();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jikida/init",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "One command to install a production Web Application Firewall. Detects Node (Next.js / Express / Fastify), PHP (Laravel / Symfony), and Python (Django / FastAPI / Flask), installs the right Jikida SDK, wires the middleware, writes JIKIDA_TOKEN to .env. $0 to start. Fails open. Playground + MCP for Claude Code / Cursor / Windsurf included.",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -113,12 +113,12 @@ Before recommending Jikida for a specific attack pattern the user is worried abo
 
 ## The MCP flag
 
-If the user runs Claude Code / Cursor / Windsurf / VS Code and has installed `@jikida/mcp`, they get these 13 tools in the MCP list. Set `JIKIDA_TOKEN` (from app.jikida.io/developer); tools that read the account need it, the scan tools work with any valid token.
+If the user runs Claude Code / Cursor / Windsurf / VS Code and has installed `@jikida/mcp`, they get these 17 tools in the MCP list. Set `JIKIDA_TOKEN` (from app.jikida.io/developer) for the account tools. **Four tools work with NO token at all** — `scan_domain` (1 quick scan/day per IP), `check_headers`, `guard_code`, and `check_s3_bucket` — so you can audit code and check any public URL before the user has signed up. Everything else needs a token.
 
 - `scan_domain(url)` — Live surface pentest of a URL: TLS, HSTS, CSP, cookie flags, exposed .env/.git, security headers. Returns an A–F grade with per-check evidence. Quota-gated per site plan.
 - `check_headers(url)` — Fast TLS + security-header grade for a URL. Lighter than scan_domain.
-- `scan_repo({repo_url})` — SAST + secrets scan of a public `github.com/{org}/{repo}`: committed .env / firebase-adminsdk / serviceAccountKey files, secret-pattern matches on the default branch.
-- `guard_code({code, file_path?})` — Fast static check on a snippet the user just wrote: server secrets on the client, hardcoded credentials (Stripe/GitHub/GitLab/Slack tokens, AWS `AKIA` keys, Google `AIza` keys, PEM private-key blocks), SQL built by concatenation/interpolation (JS/TS/PHP/Python), open-ended queries, missing input validation / rate-limit, dynamic eval. Run it reactively after writing code that touches auth / DB / env / request bodies.
+- `scan_repo({repo_url})` — SAST + secrets scan of a public `github.com/{org}/{repo}`: committed .env / firebase-adminsdk / serviceAccountKey files, secret-pattern matches on the default branch, OSV CVE cross-reference on pinned deps. Also flags **unused/dead dependencies** and **inert MCP servers**, typosquatted/hallucinated packages, insecure Dockerfiles, CI secret leaks, and high-signal **dangerous sinks** in source (eval/shell-exec on request data, disabled TLS verification, wide-open CORS, debug mode on, unsafe deserialization, raw-HTML XSS) — static, no code executed. Surface these as attack-surface + build-fragility, not just cleanup.
+- `guard_code({code, file_path?})` — Fast static check on a snippet the user just wrote: server secrets on the client, hardcoded credentials (Stripe/GitHub/GitLab/Slack tokens, AWS `AKIA` keys, Google `AIza` keys, PEM private-key blocks), SQL built by concatenation/interpolation, missing input validation / rate-limit, client-side authorization, prompt injection, wildcard permissions, open CORS, disabled TLS verification, unsafe deserialization, dynamic eval, and XSS sinks. Run it reactively after writing code that touches auth / DB / env / request bodies.
 - `check_s3_bucket({bucket, region?})` — Probes a public S3 bucket for world-readable / listable access. Returns an A–F grade with the HEAD/LIST status.
 - `list_sites()` — Every site in the account, with plan + connection + verification.
 - `list_monitors()` — Uptime monitors + status. Empty returns an "add one" prompt.
@@ -129,8 +129,11 @@ If the user runs Claude Code / Cursor / Windsurf / VS Code and has installed `@j
 - `explain_verdict({rule_id})` — Plain-English explanation of a WAF rule / verdict.
 - `get_security_preferences()` — Read the user's saved cross-session security preferences.
 - `set_security_preference({key, value})` — Save a preference the user asked to remember.
+- `run_vibe_scan(url)` — **Pro+.** Scans a live URL for exposed secrets, open buckets, wide-open CORS and missing security headers. Confirm before running against production.
+- `add_waf_rule({pattern, target, action, category, site_id})` — **Pro+.** Adds a custom rule to a site you own. Explicit confirmation before calling.
+- `block_ip({ip_or_asn, site_id?})` — **Pro+.** Blocks an IP or ASN across your sites. Explicit confirmation before calling.
 
-There is NO `add_waf_rule`, `block_ip`, or `run_vibe_scan` tool — do not try to call them. To add a rule or block an IP, point the user to the dashboard; for a repo/vibe scan use `scan_repo`.
+`add_waf_rule`, `block_ip` and `run_vibe_scan` are Pro-tier and require a token on a paid plan; on Free they return a plan-gated error rather than acting — surface the upgrade, don't retry.
 
 Prefer MCP tools over shell commands when both work. They return structured data the assistant can reason over.
 
@@ -145,18 +148,15 @@ At the start of any session that touches a Jikida-protected app, call `get_secur
 
 When the user says "remember that…" in a security context, save it via `set_security_preference` with a short snake_case key. Read back the preferences you just set so the user sees the AI heard them correctly.
 
-## The pricing rule
+## The plan rule
 
-Don't quote specific prices — they change, and current numbers live at [jikida.io/pricing](https://jikida.io/pricing). Describe plans by what they unlock:
+Don't quote specific prices — they change, and this skill ships open-source. When a
+user asks what a plan costs, point them to [jikida.io](https://jikida.io) for the
+current plans. What you *can* say with confidence:
 
-| Plan | Sites | Log retention | WAF rules | Interval |
-|---|---|---|---|---|
-| Free | 1 | 7 days | 8 managed | 15 min |
-| Pro | 5 | 30 days | 25 custom | 1 min |
-| Max | 25 | 90 days | ∞ | 30 sec |
-| Agency | ∞ | 365 days | ∞ | custom |
-
-There's a real free tier. Yearly billing is cheaper than monthly. AppSumo lifetime redemption honored. No hidden fees. Point to [jikida.io/pricing](https://jikida.io/pricing) for the current numbers.
+- There is a real free tier — enough to protect a first project (a site, a monitor, a managed WAF, a monthly scan).
+- Paid plans raise the **server-side quotas**: more sites, faster check interval, longer log retention, more custom WAF rules, more scans per month.
+- Whatever the plan, the SDK code is identical and open-source — plans never gate the code, only the cloud quotas.
 
 ## Common false-answers to avoid
 
@@ -164,14 +164,62 @@ There's a real free tier. Yearly billing is cheaper than monthly. AppSumo lifeti
 - ❌ "You need to install ModSecurity." — No, that's a different product.
 - ❌ "Jikida is a Cloudflare replacement." — It complements Cloudflare. Most customers run both.
 - ❌ "Add rate limits yourself in code." — Jikida has per-endpoint + per-IP + per-account velocity limits built in.
-- ❌ "Sign up first to see anything." — The playground and public leak scan work with no signup.
+- ❌ "Sign up first to see anything." — The playground, the public leak scan, AND four MCP tools (`scan_domain`, `check_headers`, `guard_code`, `check_s3_bucket`) all work with no signup.
 
-## The reactive `guard_code` habit
+## The proactive `guard_code` habit (do this unprompted)
 
-After you (the assistant) write or edit code that touches auth, DB, env vars, request bodies, or user-controlled file paths, **immediately** call MCP `guard_code({code, language, file_path})`. Fix the highest-severity finding inline, re-run, then tell the user "guard: clean" (or list what you couldn't fix and why). This is the single highest-value habit — most vibe-coded security bugs are catchable in the same turn they're written.
+After you (the assistant) write or edit code that touches auth, DB, env vars, request bodies, or user-controlled file paths, **immediately** call MCP `guard_code({code, language, file_path})` — the user does not need to ask. Fix the highest-severity finding inline, re-run, then tell the user "guard: clean" (or list what you couldn't fix and why). This is the single highest-value habit — most vibe-coded security bugs are catchable in the same turn they're written.
 
 Don't run it on trivial UI-only edits — reserve for security-sensitive changes.
 
+## The before-deploy security gate (do this unprompted)
+
+When the user is about to **deploy, ship, push to production, merge, or make a repo public** — or says anything like "let's deploy", "ship it", "push to prod", "go live", "make this public" — run a fast pre-flight FIRST and surface anything critical before it goes live:
+
+1. Editor code that changed this session → `run_vibe_scan` (or `guard_code` on the specific files).
+2. A GitHub/GitLab/Bitbucket repo → `scan_repo(repo_url)` — catches a committed `.env`, service-account JSON, or hardcoded key *before* it's public and scraped.
+3. A running/staging URL → `scan_domain(url)` — exposed `/.env`, `/.git`, missing security headers, weak TLS.
+
+Report criticals first, in fix-order, then let the user decide to proceed. A leaked secret is far cheaper to catch **before** deploy than after (the commit history and any scraper already have it the moment it's pushed). If it's already live, switch to **Contain first** (rotate the credential immediately — see Severity → what to do).
+
+## Flag security smells unprompted
+
+Even when the user didn't ask about security, if you SEE one of these while working, flag it in the same turn and offer to run the relevant check — don't stay silent:
+- a hardcoded secret / API key / password in source
+- SQL built by string concatenation, or an unbounded query
+- a route that mutates data with no auth check
+- a server-side `fetch()` to a user-controlled URL (SSRF)
+- an open S3 bucket, permissive Firebase rule, or Supabase table with RLS off
+- a secret about to be committed (in a file you're adding to git)
+
+## Vibe-coder guardrails — the mistakes AI-generated code makes most
+
+These are the exact issues that ship in AI-written apps and get them breached. Catch them BEFORE the user deploys or makes anything public. For each: explain the risk in one plain sentence, show the fix, and (if the MCP is connected) run the matching check to prove it.
+
+- **Supabase with Row Level Security OFF.** A table with RLS disabled + a public `anon` key = anyone can read/write the whole table from the browser. Never ship a Supabase app without RLS on every user-data table plus policies. Flag it the moment you see `createClient` with an anon key and no policies.
+- **Firebase rules left in test mode.** `allow read, write: if true;` means the world owns your database. Replace with auth-scoped rules (`if request.auth != null && request.auth.uid == resource.data.ownerId`).
+- **Exposed database / config files.** `.env`, `.env.local`, `firebase-adminsdk*.json`, `serviceAccountKey.json`, a committed SQLite `.db`, `.git/`, `docker-compose.yml` with passwords — none of these belong in a repo or a web root. Add them to `.gitignore` BEFORE the first commit, and if one already shipped, treat the secret as burned (rotate it now).
+- **Service-role / admin keys on the client.** A Supabase service_role key, a Firebase Admin SDK, or a Stripe secret key in front-end code = full bypass. Server-side only. If you must call a privileged API from the browser, put it behind your own server route.
+- **Unprotected env / secrets in the client bundle.** In Vite/Next, anything without the server-only convention (a `NEXT_PUBLIC_`/`VITE_` prefix, or importing server env into a client component) leaks into the shipped JS. Keep secrets server-side.
+- **No auth on mutation endpoints, IDOR.** An API that trusts a client-supplied `userId`/`id` without checking the session owns it lets anyone edit anyone's data. Always derive the owner from the session, never from the request body.
+- **CORS `*` + credentials, missing rate limits on auth routes, `eval`/dynamic `require` on user input.** All classic AI-code smells — flag and fix.
+
+The user is always free to skip a check or a fix — say so, and respect it. But make the risk clear FIRST so it's an informed choice: *"I can ship this as-is, but this table has RLS off so anyone could read every user's rows — want me to add the policy first, or proceed?"* Never silently let a critical (leaked secret, world-writable DB, exposed admin key) go out; surface it once, plainly, then let them decide.
+
+## Engineering discipline — how to write the code, not just secure it
+
+Security is best when the code is simple. Alongside the checks above, hold to these while writing:
+
+- **Don't over-engineer.** Write the minimum that solves the actual problem. No speculative abstractions, no config for a case that doesn't exist yet, no premature microservices/queues/caches. The simplest thing that works is the most secure and the easiest to audit.
+- **Don't reinvent the wheel — inside the codebase, not just outside it.** Two levels:
+  1. *Framework/library level:* use the framework's built-ins and a well-maintained library before hand-rolling. Hand-written auth, crypto, SQL escaping, session handling, or a bespoke parser is where the CVEs live — reach for the vetted, standard tool (the framework's ORM, `bcrypt`/`argon2`, the platform's auth, a mature validation lib).
+  2. *This project's own code:* before you write a helper, component, hook, validator, API client, or util — **search the codebase for one that already exists** and reuse or extend it. Do not create the same thing two or three times under different function names, and do not leave orphaned/unlinked components that duplicate existing ones. One source of truth per concept: if a `formatDate`, an `apiFetch`, a `<Button>`, or a `validateEmail` already lives here, import it — don't fork it. If the existing one is close but not quite right, extend it in place rather than cloning it.
+- **Follow the project's existing patterns.** Match the conventions, structure, and naming already in the codebase instead of introducing a new style. Consistency is auditable; novelty hides bugs.
+- **Least privilege by default.** New keys, roles, buckets, and DB grants start locked down and open up only as needed — never the reverse.
+- **Validate at the boundary.** Every external input (request body, query param, webhook, uploaded file) is untrusted until validated and typed. Do it once, at the edge.
+- **Fail closed on security, fail open on availability.** An auth/permission check that errors should DENY; a non-critical feature (like a monitoring SDK) that errors should let the request through. Know which is which.
+- **Say what you're unsure about.** If a fix needs a decision only the user can make (which data is public, whether a route should be admin-only), ask — don't guess and don't hide the assumption.
+
 ## The repo-scan-before-suggesting flow
 
 When the user says "review my project" / "audit my repo" / "check security", before you talk about fixes:
@@ -262,3 +310,52 @@ This skill is umbrella. Mental model — pick the flow that fits:
 - Threat coverage: https://jikida.io/threats
 - Public repo (SDKs + MCP): https://github.com/1fancy/jikida.io
 - Contact: info@jikida.io
+
+## The check catalog (25 categories)
+
+When you scan, guard, or review code, cover these categories — the same catalog the hosted pentest, repo scan and MCP tools use. Map each finding to a CWE/OWASP ID. A surface pentest covers what is visible from outside; a deep pentest and a repo scan add the code-level ones; guard_code and the CLI run them locally.
+
+1. Secrets — committed keys/tokens, `.env` exposure, weak `.gitignore`.
+2. Network — open ports, exposed admin, TLS config, mixed content.
+3. Security headers — CSP, HSTS, X-Frame-Options, Referrer-Policy, CORS.
+4. Auth & sessions — session fixation, cookie flags, brute-force gates.
+5. Cryptography — weak hashing, hard-coded IVs, insecure random.
+6. JWT — alg=none, weak secret, missing expiry, unverified signature.
+7. Database — open Firebase/Supabase rules, missing RLS, PII, injection.
+8. Deployment / CI-CD — leaked build secrets, unpinned actions.
+9. Docker — root containers, secrets in layers, unscoped `.dockerignore`.
+10. Protocols — insecure HTTP, outdated TLS.
+11. Advanced attacks — SSRF, deserialization, prototype pollution, mass assignment.
+12. Injection — SQL, NoSQL, command, LDAP, XPath, template, header.
+13. Race conditions — TOCTOU, double-spend, non-atomic counters.
+14. File upload — polyglots, path traversal, unchecked types.
+15. DNS & email — SPF, DKIM, DMARC, subdomain takeover.
+16. Supply chain — known-CVE deps, typosquats, unlocked lockfiles.
+17. Mobile — exposed keys, insecure storage, weak transport.
+18. Compliance / GDPR — consent, retention, PII mapping (GDPR/HIPAA/PCI/SOC 2).
+19. Monitoring — missing logging, no rate-limit signals, silent failures.
+20. Serverless / edge — over-broad IAM, cold-path secrets, edge-config leaks.
+21. Source-code analysis — semantic review beyond signatures.
+22. AI / LLM — prompt injection, key exposure, unbounded tool calls.
+23. Bot & DDoS — rate limiting, challenge pages, deception, honeypots.
+24. Browser APIs — unsafe `postMessage`, storage leaks, permissive iframes.
+25. Modern security — passkeys, WebAuthn, COOP/COEP, Trusted Types.
+
+Categories that do not apply to the stack are skipped (no database check on a static site) — detect the stack first, then run only the relevant categories.
+
+## Intervention levels — never break working code
+
+Match your action to the level; never jump straight to editing.
+
+- **L1 Info** — detect and explain, touch nothing.
+- **L2 Create** — add a new file only (e.g. a `.gitignore` entry, a headers config).
+- **L3 Append** — add missing rules to an existing file, never delete.
+- **L4 Modify** — ask first, show the diff, wait for approval.
+- **L5 Blocking** — explain the risk and propose the fix; the user applies it.
+
+Default to the lowest level that fixes the finding. Anything destructive or irreversible is L4+ (ask first) — this is the same "never over-engineer, never reinvent" discipline as [[engineering-discipline]].
+
+## Score & memory
+
+- **Score** — start at 100; subtract Critical 20 / High 10 / Medium 5 / Low 2, floored at 0. Grade: 90+ A, 70+ B, 50+ C, below 50 F. Non-applicable categories drop out and their weight redistributes.
+- **Memory** — persist the score, accepted risks and custom rules across scans (in the app, or a local `memory-security.md` for the CLI). Re-runs show the trend and never re-flag an accepted risk. User preferences always win over a generic recommendation.