@jikida/init 0.3.0 → 0.4.0

package/bin/init.js

@@ -117,13 +117,42 @@ function installSkill() {
   // Master skill (full body) + one thin bootstrap per assistant, so "install into
   // every editor you already use" actually holds — Cursor, Windsurf, Cline,
   // Copilot, Aider, Continue, Claude, Gemini, plus the generic AGENTS.md.
+  // The Continue.dev config is YAML with a `rules:` block, not free prose — wrap
+  // the bootstrap so it drops in as a valid rule instead of breaking the parser.
+  const continueYaml =
+    'name: Jikida security\n' +
+    'version: 0.0.1\n' +
+    'rules:\n' +
+    '  - >\n' +
+    bootstrap.split('\n').map((l) => '    ' + l).join('\n') + '\n';
+
+  // A Claude Code slash command: `/jikida-scan` in the editor kicks off the
+  // guided repo scan without the user remembering the phrasing.
+  const scanCommand =
+    '---\n' +
+    'description: Scan this repo for leaked secrets, exposed rules, and vulnerabilities (Jikida)\n' +
+    '---\n\n' +
+    'Read `.claude/skills/jikida/SKILL.md`, then run a full security pass on this\n' +
+    'repository: committed secrets (.env, serviceAccountKey.json, *.pem, API keys),\n' +
+    'open Supabase/Firebase rules, missing auth checks, injection, and out-of-date\n' +
+    'dependencies with known CVEs. Walk the 25-category catalog. Report findings\n' +
+    'worst-first with a one-line fix each, and apply fixes at the lowest safe\n' +
+    'intervention level. Ask before anything destructive. Record what you find in\n' +
+    '`memory-security.md`.\n';
+
+  // `managed: true` = a Jikida-owned file we fully (re)write on every run so
+  // updates land and re-running never appends a duplicate (SKILL.md, our own
+  // .mdc/command/continue files). The rest are shared assistant files we only
+  // append-if-missing so we never clobber a user's own rules.
   const targets = [
-    [join(cwd, '.claude', 'skills', 'jikida', 'SKILL.md'), body],
+    [join(cwd, '.claude', 'skills', 'jikida', 'SKILL.md'), body, true],
+    [join(cwd, '.claude', 'commands', 'jikida-scan.md'), scanCommand, true],
+    [join(cwd, '.cursor', 'rules', 'jikida.mdc'), mdc, true],
+    [join(cwd, '.continue', 'config.yaml'), continueYaml, true],
     [join(cwd, 'AGENTS.md'), bootstrap],
     [join(cwd, 'CLAUDE.md'), bootstrap],
     [join(cwd, 'GEMINI.md'), bootstrap],
     [join(cwd, '.cursorrules'), bootstrap],
-    [join(cwd, '.cursor', 'rules', 'jikida.mdc'), mdc],
     [join(cwd, '.windsurfrules'), bootstrap],
     [join(cwd, '.clinerules'), bootstrap],
     [join(cwd, '.aider.conf.yml'), bootstrap],
@@ -134,14 +163,14 @@ function installSkill() {
   log('  ----------------------------');
   const MARK = 'Jikida security skill';
   let wrote = 0, skipped = 0;
-  for (const [target, content] of targets) {
+  for (const [target, content, managed] of targets) {
     const rel = target.replace(cwd + '/', '');
     try {
       mkdirSync(dirname(target), { recursive: true });
-      // The master SKILL.md is always (re)written so updates land. The per-
-      // assistant files are APPEND-if-present, skip-if-already-ours — never clobber
-      // a user's existing rules file, never double-add.
-      if (target.endsWith('SKILL.md')) {
+      // Managed (Jikida-owned) files are always (re)written so updates land and
+      // re-runs never duplicate. Shared assistant files are APPEND-if-present,
+      // skip-if-already-ours — never clobber a user's own rules, never double-add.
+      if (managed) {
         writeFileSync(target, content);
         done(rel); wrote++;
       } else if (!existsSync(target)) {
@@ -171,11 +200,53 @@ function installSkill() {
     }
   } catch (e) { warn(`Could not copy checklists: ${e.message}`); }
 
+  // Harden .gitignore: a security skill install should also stop the classic
+  // leaks it scans for from ever being committed. Append only the lines that are
+  // missing, under one clearly-marked block — never duplicate, never reorder the
+  // user's file.
+  try {
+    const giPath = join(cwd, '.gitignore');
+    const current = existsSync(giPath) ? readFileSync(giPath, 'utf8') : '';
+    const wanted = [
+      '.env', '.env.*', '!.env.example',
+      '*.pem', '*.key', '*.p8', '*.p12', '*.keystore',
+      'serviceAccountKey.json', '*-firebase-adminsdk-*.json', 'google-services.json',
+      '*.mobileprovision', 'secrets.*', '.jikida/',
+    ];
+    const missing = wanted.filter((line) => {
+      const re = new RegExp('^' + line.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '\\s*$', 'm');
+      return !re.test(current);
+    });
+    if (missing.length) {
+      const block = (current && !current.endsWith('\n') ? '\n' : '')
+        + '\n# Jikida security — do not commit secrets\n' + missing.join('\n') + '\n';
+      appendFileSync(giPath, block);
+      done(`.gitignore (+${missing.length} security entr${missing.length === 1 ? 'y' : 'ies'})`); wrote++;
+    }
+  } catch (e) { warn(`Could not update .gitignore: ${e.message}`); }
+
+  // A persistent findings log the assistant appends to across sessions, so a
+  // scan's results and the "still to fix" list survive context resets.
+  try {
+    const memPath = join(cwd, 'memory-security.md');
+    if (!existsSync(memPath)) {
+      writeFileSync(memPath,
+        '# Security memory (Jikida)\n\n' +
+        'The assistant appends findings and their status here as it scans and fixes.\n' +
+        'Read this at the start of a security pass so nothing is re-flagged or lost.\n\n' +
+        '## Open findings\n\n_none yet — run `/jikida-scan` or ask your AI to scan the repo._\n\n' +
+        '## Fixed\n\n');
+      done('memory-security.md'); wrote++;
+    }
+  } catch (e) { warn(`Could not write memory-security.md: ${e.message}`); }
+
   if (wrote > 0 || skipped > 0) {
     log('');
     if (skipped > 0) { log(`  ${skipped} file(s) already had the skill — left untouched.`); }
-    log('  Done. Your AI editors now know Jikida — restart them, then ask them to');
-    log('  "add Jikida security to this app" or "scan my repo for leaked secrets".');
+    log('  Done. Your AI editors now know Jikida. Restart them, then:');
+    log('');
+    log('  ⚡ Run /jikida-scan in Claude Code — or ask any AI to');
+    log('     "scan my repo for leaked secrets and open rules".');
     log('');
   }
   process.exit((wrote > 0 || skipped > 0) ? 0 : 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jikida/init",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "One command to install a production Web Application Firewall. Detects Node (Next.js / Express / Fastify), PHP (Laravel / Symfony), and Python (Django / FastAPI / Flask), installs the right Jikida SDK, wires the middleware, writes JIKIDA_TOKEN to .env. $0 to start. Fails open. Playground + MCP for Claude Code / Cursor / Windsurf included.",
   "type": "module",
   "bin": {