@rune-kit/rune 2.8.0 → 2.11.0

package/extensions/security/skills/pentest-patterns.md

@@ -1,77 +1,77 @@
----
-name: "pentest-patterns"
-pack: "@rune/security"
-description: "Penetration testing methodology — attack surface mapping, vulnerability identification, proof-of-concept construction, automated fuzzing setup, JWT attack pattern detection, GraphQL hardening, and remediation verification."
-model: opus
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# pentest-patterns
-
-Penetration testing methodology — attack surface mapping, vulnerability identification, proof-of-concept construction, automated fuzzing setup, JWT attack pattern detection, GraphQL hardening, and remediation verification. Outputs actionable PoC code, not just advisories.
-
-#### Workflow
-
-**Step 1 — Map Attack Surface**
-Use Grep to enumerate all HTTP endpoints, WebSocket handlers, file upload paths, and external-facing inputs. List trust boundaries: what data crosses from client to server without validation? Identify highest-value targets (auth endpoints, admin APIs, payment flows). Note GraphQL endpoints — they require separate analysis.
-
-**Step 2 — Identify and Construct PoC**
-For each attack vector, use Read to inspect input handling. Write minimal PoC code (curl command, script, or payload) that demonstrates the vulnerability — SSRF via URL parameter, SQL injection via unsanitized filter, IDOR via predictable ID enumeration. Keep PoCs minimal and clearly scoped to the finding.
-
-**Step 3 — JWT Attack Pattern Review**
-Inspect all JWT creation and validation code. Check for:
-- **Algorithm confusion (alg:none)** — does the validator accept `"alg":"none"` tokens?
-- **Key confusion (RS256 → HS256)** — if the public key is accessible, can an attacker sign HS256 tokens with it?
-- **Token replay** — is `jti` (JWT ID) tracked and blacklisted on logout? Is token expiry enforced server-side, not just client-side?
-- **Audience/issuer validation** — are `aud` and `iss` claims verified to prevent cross-service token reuse?
-
-**Step 4 — Automated Fuzzing Setup**
-Use property-based testing to fuzz input boundaries. Set up `fast-check` (TypeScript) or `hypothesis` (Python) to generate adversarial inputs for parsers, validators, and business logic. Focus on: integer overflows in numeric fields, Unicode normalization in string comparisons, path traversal in file name parameters, prototype pollution in object merge operations.
-
-**Step 5 — GraphQL Security Review**
-If a GraphQL endpoint exists: Is introspection disabled in production? Are deeply nested queries limited (max depth/complexity)? Are batch queries rate-limited independently? Check for field-level authorization — a resolver that returns user data must enforce the same ownership checks as a REST equivalent.
-
-**Step 6 — Suggest Remediation and Verify Fix**
-Pair each PoC with a concrete fix. After fix is applied, use Bash to re-run the PoC and confirm it no longer succeeds. Document the before/after in the security report.
-
-#### Example
-
-```typescript
-// FINDING: SSRF — user-supplied URL fetched server-side without allowlist
-// File: src/api/webhook.ts, Line: 34
-
-// VULNERABLE: attacker can probe internal services
-const response = await fetch(req.body.callbackUrl)
-// POC: curl -X POST /api/webhook -d '{"callbackUrl":"http://169.254.169.254/latest/meta-data/"}'
-
-// REMEDIATION: validate against allowlist before fetching
-const ALLOWED_HOSTS = new Set(['api.partner.com', 'hooks.stripe.com'])
-const parsed = new URL(req.body.callbackUrl)
-if (!ALLOWED_HOSTS.has(parsed.hostname)) {
-  throw new ForbiddenError('callbackUrl host not in allowlist')
-}
-
-// FINDING: JWT algorithm confusion
-// File: src/middleware/auth.ts, Line: 19
-// VULNERABLE: accepts any algorithm the token declares
-import jwt from 'jsonwebtoken'
-const payload = jwt.verify(token, secret) // no algorithm pin
-
-// REMEDIATION: pin algorithm explicitly
-const payload = jwt.verify(token, secret, { algorithms: ['HS256'] })
-
-// FUZZING SETUP: fast-check for path traversal in file name param
-import * as fc from 'fast-check'
-fc.assert(
-  fc.property(fc.string(), (filename) => {
-    const result = sanitizeFilename(filename)
-    return !result.includes('..') && !result.includes('/')
-  })
-)
-
-// GRAPHQL: max depth guard (graphql-depth-limit)
-import depthLimit from 'graphql-depth-limit'
-const server = new ApolloServer({
-  validationRules: [depthLimit(5)],
-})
-```
+---
+name: "pentest-patterns"
+pack: "@rune/security"
+description: "Penetration testing methodology — attack surface mapping, vulnerability identification, proof-of-concept construction, automated fuzzing setup, JWT attack pattern detection, GraphQL hardening, and remediation verification."
+model: opus
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# pentest-patterns
+
+Penetration testing methodology — attack surface mapping, vulnerability identification, proof-of-concept construction, automated fuzzing setup, JWT attack pattern detection, GraphQL hardening, and remediation verification. Outputs actionable PoC code, not just advisories.
+
+#### Workflow
+
+**Step 1 — Map Attack Surface**
+Use Grep to enumerate all HTTP endpoints, WebSocket handlers, file upload paths, and external-facing inputs. List trust boundaries: what data crosses from client to server without validation? Identify highest-value targets (auth endpoints, admin APIs, payment flows). Note GraphQL endpoints — they require separate analysis.
+
+**Step 2 — Identify and Construct PoC**
+For each attack vector, use Read to inspect input handling. Write minimal PoC code (curl command, script, or payload) that demonstrates the vulnerability — SSRF via URL parameter, SQL injection via unsanitized filter, IDOR via predictable ID enumeration. Keep PoCs minimal and clearly scoped to the finding.
+
+**Step 3 — JWT Attack Pattern Review**
+Inspect all JWT creation and validation code. Check for:
+- **Algorithm confusion (alg:none)** — does the validator accept `"alg":"none"` tokens?
+- **Key confusion (RS256 → HS256)** — if the public key is accessible, can an attacker sign HS256 tokens with it?
+- **Token replay** — is `jti` (JWT ID) tracked and blacklisted on logout? Is token expiry enforced server-side, not just client-side?
+- **Audience/issuer validation** — are `aud` and `iss` claims verified to prevent cross-service token reuse?
+
+**Step 4 — Automated Fuzzing Setup**
+Use property-based testing to fuzz input boundaries. Set up `fast-check` (TypeScript) or `hypothesis` (Python) to generate adversarial inputs for parsers, validators, and business logic. Focus on: integer overflows in numeric fields, Unicode normalization in string comparisons, path traversal in file name parameters, prototype pollution in object merge operations.
+
+**Step 5 — GraphQL Security Review**
+If a GraphQL endpoint exists: Is introspection disabled in production? Are deeply nested queries limited (max depth/complexity)? Are batch queries rate-limited independently? Check for field-level authorization — a resolver that returns user data must enforce the same ownership checks as a REST equivalent.
+
+**Step 6 — Suggest Remediation and Verify Fix**
+Pair each PoC with a concrete fix. After fix is applied, use Bash to re-run the PoC and confirm it no longer succeeds. Document the before/after in the security report.
+
+#### Example
+
+```typescript
+// FINDING: SSRF — user-supplied URL fetched server-side without allowlist
+// File: src/api/webhook.ts, Line: 34
+
+// VULNERABLE: attacker can probe internal services
+const response = await fetch(req.body.callbackUrl)
+// POC: curl -X POST /api/webhook -d '{"callbackUrl":"http://169.254.169.254/latest/meta-data/"}'
+
+// REMEDIATION: validate against allowlist before fetching
+const ALLOWED_HOSTS = new Set(['api.partner.com', 'hooks.stripe.com'])
+const parsed = new URL(req.body.callbackUrl)
+if (!ALLOWED_HOSTS.has(parsed.hostname)) {
+  throw new ForbiddenError('callbackUrl host not in allowlist')
+}
+
+// FINDING: JWT algorithm confusion
+// File: src/middleware/auth.ts, Line: 19
+// VULNERABLE: accepts any algorithm the token declares
+import jwt from 'jsonwebtoken'
+const payload = jwt.verify(token, secret) // no algorithm pin
+
+// REMEDIATION: pin algorithm explicitly
+const payload = jwt.verify(token, secret, { algorithms: ['HS256'] })
+
+// FUZZING SETUP: fast-check for path traversal in file name param
+import * as fc from 'fast-check'
+fc.assert(
+  fc.property(fc.string(), (filename) => {
+    const result = sanitizeFilename(filename)
+    return !result.includes('..') && !result.includes('/')
+  })
+)
+
+// GRAPHQL: max depth guard (graphql-depth-limit)
+import depthLimit from 'graphql-depth-limit'
+const server = new ApolloServer({
+  validationRules: [depthLimit(5)],
+})
+```

package/extensions/security/skills/secret-mgmt.md

@@ -1,65 +1,65 @@
----
-name: "secret-mgmt"
-pack: "@rune/security"
-description: "Secret management patterns — audit current secret handling, design vault or environment strategy, implement rotation policies, detect secrets in pre-commit hooks, and verify zero leaks in logs, errors, and source history."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# secret-mgmt
-
-Secret management patterns — audit current secret handling, design vault or environment strategy, implement rotation policies, detect secrets in pre-commit hooks, and verify zero leaks in logs, errors, and source history.
-
-#### Workflow
-
-**Step 1 — Scan Current Secret Handling**
-Use Grep to search for hardcoded credentials, API keys, connection strings, and JWT secrets across all source files and config files. Check git history with Bash (`git log -S 'password' --source --all`) to surface secrets ever committed. Catalog every secret by type and location. Check for base64-encoded secrets (`grep -r 'base64' | grep -i 'key\|secret\|pass'`).
-
-**Step 2 — Design Vault or Env Strategy**
-Based on project type (serverless, container, bare metal), prescribe a secret backend: AWS Secrets Manager, HashiCorp Vault, Doppler, or `.env` + CI/CD injection. Define which secrets are per-environment vs per-service. Write the access pattern (IAM role, token scope, least privilege).
-
-**Step 3 — .env File Safety Audit**
-Verify `.env` and `.env.*` files are in `.gitignore`. Check that a `.env.example` exists with placeholder values (not real secrets). Audit CI/CD environment variable lists — flag any variable that contains `SECRET`, `KEY`, `TOKEN`, or `PASSWORD` that is not masked. Verify `.env.example` is kept in sync with application startup validation schema.
-
-**Step 4 — Secret Rotation Automation**
-Document rotation schedule per secret type. For AWS: use Secrets Manager rotation Lambda triggered on schedule. For GitHub Actions: document secret rotation runbook (rotate in provider → update in repo Settings → verify deployment). Add startup validation that fails fast if any required env var is absent or malformed. Set up gitleaks or trufflehog as pre-commit hook to catch accidental commits before they hit remote.
-
-**Step 5 — Verify No Leaks in Runtime**
-Use Grep to confirm secrets never appear in log statements, error responses, or exception stack traces. Check error serialization — does the global error handler accidentally serialize `process.env` or full request headers into the response body?
-
-#### Example
-
-```typescript
-// PATTERN: startup validation — fail fast on missing secrets
-import { z } from 'zod'
-
-const SecretsSchema = z.object({
-  DATABASE_URL:    z.string().url(),
-  JWT_SECRET:      z.string().min(32),
-  STRIPE_SECRET:   z.string().startsWith('sk_'),
-  OPENAI_API_KEY:  z.string().startsWith('sk-'),
-})
-
-export const secrets = SecretsSchema.parse(process.env) // throws at boot if absent/malformed
-
-// NEVER log secrets — use masked representation
-logger.info(`DB connected to ${new URL(secrets.DATABASE_URL).hostname}`)
-
-// PRE-COMMIT: .gitleaks.toml — scan for secrets before commit
-// [[rules]]
-// id = "generic-api-key"
-// description = "Generic API Key"
-// regex = '''(?i)(api_key|apikey|secret)[^\w]*[=:]\s*['"]?[0-9a-zA-Z\-_]{16,}'''
-// entropy = 3.5
-
-// ROTATION LAMBDA: AWS Secrets Manager rotation handler skeleton
-export async function handler(event: SecretsManagerRotationEvent) {
-  const { SecretId, ClientRequestToken, Step } = event
-  switch (Step) {
-    case 'createSecret':  await createNewVersion(SecretId, ClientRequestToken); break
-    case 'setSecret':     await updateDownstreamService(SecretId, ClientRequestToken); break
-    case 'testSecret':    await validateNewSecret(SecretId, ClientRequestToken); break
-    case 'finishSecret':  await finalizeRotation(SecretId, ClientRequestToken); break
-  }
-}
-```
+---
+name: "secret-mgmt"
+pack: "@rune/security"
+description: "Secret management patterns — audit current secret handling, design vault or environment strategy, implement rotation policies, detect secrets in pre-commit hooks, and verify zero leaks in logs, errors, and source history."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# secret-mgmt
+
+Secret management patterns — audit current secret handling, design vault or environment strategy, implement rotation policies, detect secrets in pre-commit hooks, and verify zero leaks in logs, errors, and source history.
+
+#### Workflow
+
+**Step 1 — Scan Current Secret Handling**
+Use Grep to search for hardcoded credentials, API keys, connection strings, and JWT secrets across all source files and config files. Check git history with Bash (`git log -S 'password' --source --all`) to surface secrets ever committed. Catalog every secret by type and location. Check for base64-encoded secrets (`grep -r 'base64' | grep -i 'key\|secret\|pass'`).
+
+**Step 2 — Design Vault or Env Strategy**
+Based on project type (serverless, container, bare metal), prescribe a secret backend: AWS Secrets Manager, HashiCorp Vault, Doppler, or `.env` + CI/CD injection. Define which secrets are per-environment vs per-service. Write the access pattern (IAM role, token scope, least privilege).
+
+**Step 3 — .env File Safety Audit**
+Verify `.env` and `.env.*` files are in `.gitignore`. Check that a `.env.example` exists with placeholder values (not real secrets). Audit CI/CD environment variable lists — flag any variable that contains `SECRET`, `KEY`, `TOKEN`, or `PASSWORD` that is not masked. Verify `.env.example` is kept in sync with application startup validation schema.
+
+**Step 4 — Secret Rotation Automation**
+Document rotation schedule per secret type. For AWS: use Secrets Manager rotation Lambda triggered on schedule. For GitHub Actions: document secret rotation runbook (rotate in provider → update in repo Settings → verify deployment). Add startup validation that fails fast if any required env var is absent or malformed. Set up gitleaks or trufflehog as pre-commit hook to catch accidental commits before they hit remote.
+
+**Step 5 — Verify No Leaks in Runtime**
+Use Grep to confirm secrets never appear in log statements, error responses, or exception stack traces. Check error serialization — does the global error handler accidentally serialize `process.env` or full request headers into the response body?
+
+#### Example
+
+```typescript
+// PATTERN: startup validation — fail fast on missing secrets
+import { z } from 'zod'
+
+const SecretsSchema = z.object({
+  DATABASE_URL:    z.string().url(),
+  JWT_SECRET:      z.string().min(32),
+  STRIPE_SECRET:   z.string().startsWith('sk_'),
+  OPENAI_API_KEY:  z.string().startsWith('sk-'),
+})
+
+export const secrets = SecretsSchema.parse(process.env) // throws at boot if absent/malformed
+
+// NEVER log secrets — use masked representation
+logger.info(`DB connected to ${new URL(secrets.DATABASE_URL).hostname}`)
+
+// PRE-COMMIT: .gitleaks.toml — scan for secrets before commit
+// [[rules]]
+// id = "generic-api-key"
+// description = "Generic API Key"
+// regex = '''(?i)(api_key|apikey|secret)[^\w]*[=:]\s*['"]?[0-9a-zA-Z\-_]{16,}'''
+// entropy = 3.5
+
+// ROTATION LAMBDA: AWS Secrets Manager rotation handler skeleton
+export async function handler(event: SecretsManagerRotationEvent) {
+  const { SecretId, ClientRequestToken, Step } = event
+  switch (Step) {
+    case 'createSecret':  await createNewVersion(SecretId, ClientRequestToken); break
+    case 'setSecret':     await updateDownstreamService(SecretId, ClientRequestToken); break
+    case 'testSecret':    await validateNewSecret(SecretId, ClientRequestToken); break
+    case 'finishSecret':  await finalizeRotation(SecretId, ClientRequestToken); break
+  }
+}
+```

package/extensions/security/skills/supply-chain.md

@@ -1,65 +1,65 @@
----
-name: "supply-chain"
-pack: "@rune/security"
-description: "Supply chain security analysis — detect dependency confusion attacks, typosquatting, lockfile injection, manifest confusion, and verify SLSA provenance attestations. Generates a complete supply chain risk report."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# supply-chain
-
-Supply chain security analysis — detect dependency confusion attacks, typosquatting, lockfile injection, manifest confusion, and verify SLSA provenance attestations. Generates a complete supply chain risk report.
-
-#### Workflow
-
-**Step 1 — Inventory Dependencies**
-Use Read on `package.json` / `requirements.txt` / `go.mod` / `Cargo.toml`. Build a complete dependency graph including devDependencies and indirect (transitive) dependencies via `npm ls --all --json` or `pip-audit --format json`. Flag phantom dependencies — packages used in source code (via import) but not declared in the manifest.
-
-**Step 2 — Check Naming Collisions (Dependency Confusion)**
-For any private/internal package names (scoped like `@company/internal-lib` OR unscoped names that look internal), verify they also exist on the public registry (npm, PyPI, RubyGems). If a package name is registered internally but NOT on the public registry, an attacker can register it there — package managers may prefer the public version depending on configuration. Flag all such packages for private registry enforcement.
-
-**Step 3 — Typosquatting Detection**
-Compare each dependency name against a known-popular packages list. Flag names with edit distance ≤ 2 from a popular package: `lodas` (lodash), `requets` (requests), `coloers` (colors), `expres` (express). Also flag: packages with unusual character substitution (zero vs letter o, l vs 1), recently published packages with very high download counts but no GitHub stars, and packages with install scripts that execute shell commands.
-
-**Step 4 — Verify Lockfile Integrity**
-Check that `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` exists and is committed. Verify resolved hashes match between manifest and lockfile. Detect lockfile injection: compare resolved URLs — any `file:`, `git+`, or non-registry URL in the lockfile for a package expected to come from the registry is a red flag. Run `npm audit signatures` (npm ≥ 9.5) to verify package signatures against the registry's public key.
-
-**Step 5 — Audit Transitive Dependencies and Known Malicious Packages**
-Run `npm audit --all` / `pip-audit` / `cargo audit`. Cross-reference against OSV (Open Source Vulnerabilities) database. Check install scripts: `cat node_modules/<pkg>/package.json | jq '.scripts.install,.scripts.postinstall'` — any install script running `curl | sh` or spawning child processes is HIGH severity.
-
-**Step 6 — SLSA Provenance and Report**
-For critical dependencies, check if SLSA provenance attestations are available (`npm install @sigstore/bundle` / cosign verify-attestation). Emit `.rune/security/supply-chain-report.md` with: dependency inventory, collision risks, typosquatting flags, lockfile anomalies, install script warnings, and remediation steps.
-
-#### Example
-
-```bash
-# STEP 1: Full dependency inventory with phantom dep check
-npm ls --all --json 2>/dev/null | jq '[.. | objects | select(.version) | {name: .name, version: .version}]' > deps-inventory.json
-
-# STEP 2: Check if internal package exists on public registry
-# VULNERABLE: @company/utils exists internally but NOT on npm → dependency confusion risk
-curl -s https://registry.npmjs.org/@company/utils | jq '.error'
-# If returns null (package exists publicly) → verify it's YOUR package, not an attacker's
-
-# STEP 3: Detect install scripts in dependencies
-for pkg in node_modules/*/package.json; do
-  scripts=$(jq -r '(.scripts.install // "") + " " + (.scripts.postinstall // "")' "$pkg")
-  if echo "$scripts" | grep -qE 'curl|wget|exec|spawn|child_process'; then
-    echo "WARN: install script in $pkg: $scripts"
-  fi
-done
-
-# STEP 4: Verify lockfile integrity (npm ≥ 9.5)
-npm audit signatures
-# Expected: "audited X packages, 0 packages have invalid signatures"
-```
-
-```typescript
-// PATTERN: enforce private registry for scoped packages (.npmrc)
-// @company:registry=https://npm.company.internal
-// //npm.company.internal/:_authToken=${NPM_INTERNAL_TOKEN}
-
-// PATTERN: detect phantom dependencies in TypeScript
-// Any import from a package not in dependencies/devDependencies = phantom dep
-// Tool: depcheck → npx depcheck --json | jq '.missing'
-```
+---
+name: "supply-chain"
+pack: "@rune/security"
+description: "Supply chain security analysis — detect dependency confusion attacks, typosquatting, lockfile injection, manifest confusion, and verify SLSA provenance attestations. Generates a complete supply chain risk report."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# supply-chain
+
+Supply chain security analysis — detect dependency confusion attacks, typosquatting, lockfile injection, manifest confusion, and verify SLSA provenance attestations. Generates a complete supply chain risk report.
+
+#### Workflow
+
+**Step 1 — Inventory Dependencies**
+Use Read on `package.json` / `requirements.txt` / `go.mod` / `Cargo.toml`. Build a complete dependency graph including devDependencies and indirect (transitive) dependencies via `npm ls --all --json` or `pip-audit --format json`. Flag phantom dependencies — packages used in source code (via import) but not declared in the manifest.
+
+**Step 2 — Check Naming Collisions (Dependency Confusion)**
+For any private/internal package names (scoped like `@company/internal-lib` OR unscoped names that look internal), verify they also exist on the public registry (npm, PyPI, RubyGems). If a package name is registered internally but NOT on the public registry, an attacker can register it there — package managers may prefer the public version depending on configuration. Flag all such packages for private registry enforcement.
+
+**Step 3 — Typosquatting Detection**
+Compare each dependency name against a known-popular packages list. Flag names with edit distance ≤ 2 from a popular package: `lodas` (lodash), `requets` (requests), `coloers` (colors), `expres` (express). Also flag: packages with unusual character substitution (zero vs letter o, l vs 1), recently published packages with very high download counts but no GitHub stars, and packages with install scripts that execute shell commands.
+
+**Step 4 — Verify Lockfile Integrity**
+Check that `package-lock.json` / `yarn.lock` / `pnpm-lock.yaml` exists and is committed. Verify resolved hashes match between manifest and lockfile. Detect lockfile injection: compare resolved URLs — any `file:`, `git+`, or non-registry URL in the lockfile for a package expected to come from the registry is a red flag. Run `npm audit signatures` (npm ≥ 9.5) to verify package signatures against the registry's public key.
+
+**Step 5 — Audit Transitive Dependencies and Known Malicious Packages**
+Run `npm audit --all` / `pip-audit` / `cargo audit`. Cross-reference against OSV (Open Source Vulnerabilities) database. Check install scripts: `cat node_modules/<pkg>/package.json | jq '.scripts.install,.scripts.postinstall'` — any install script running `curl | sh` or spawning child processes is HIGH severity.
+
+**Step 6 — SLSA Provenance and Report**
+For critical dependencies, check if SLSA provenance attestations are available (`npm install @sigstore/bundle` / cosign verify-attestation). Emit `.rune/security/supply-chain-report.md` with: dependency inventory, collision risks, typosquatting flags, lockfile anomalies, install script warnings, and remediation steps.
+
+#### Example
+
+```bash
+# STEP 1: Full dependency inventory with phantom dep check
+npm ls --all --json 2>/dev/null | jq '[.. | objects | select(.version) | {name: .name, version: .version}]' > deps-inventory.json
+
+# STEP 2: Check if internal package exists on public registry
+# VULNERABLE: @company/utils exists internally but NOT on npm → dependency confusion risk
+curl -s https://registry.npmjs.org/@company/utils | jq '.error'
+# If returns null (package exists publicly) → verify it's YOUR package, not an attacker's
+
+# STEP 3: Detect install scripts in dependencies
+for pkg in node_modules/*/package.json; do
+  scripts=$(jq -r '(.scripts.install // "") + " " + (.scripts.postinstall // "")' "$pkg")
+  if echo "$scripts" | grep -qE 'curl|wget|exec|spawn|child_process'; then
+    echo "WARN: install script in $pkg: $scripts"
+  fi
+done
+
+# STEP 4: Verify lockfile integrity (npm ≥ 9.5)
+npm audit signatures
+# Expected: "audited X packages, 0 packages have invalid signatures"
+```
+
+```typescript
+// PATTERN: enforce private registry for scoped packages (.npmrc)
+// @company:registry=https://npm.company.internal
+// //npm.company.internal/:_authToken=${NPM_INTERNAL_TOKEN}
+
+// PATTERN: detect phantom dependencies in TypeScript
+// Any import from a package not in dependencies/devDependencies = phantom dep
+// Tool: depcheck → npx depcheck --json | jq '.missing'
+```

package/extensions/trading/PACK.md

@@ -1,80 +1,80 @@
----
-name: "@rune/trading"
-description: Fintech and trading patterns — real-time data, financial dashboards, technical indicators, WebSocket architecture, and experiment-driven strategy development.
-metadata:
-  author: runedev
-  version: "0.3.0"
-  layer: L4
-  price: "$15"
-  target: Fintech developers
-  format: split
----
-
-# @rune/trading
-
-## Purpose
-
-Fintech applications demand precision that general-purpose patterns cannot guarantee. This pack groups five tightly-coupled concerns — safe money arithmetic, WebSocket reliability, financial chart rendering, streaming indicator computation, and experiment-driven strategy development — because a gap in any one layer breaks the entire trading surface. It solves the recurring problem of developers accidentally using JavaScript floats for currency, missing auto-reconnect logic, or computing indicators on stale snapshots. Activates automatically when trading or financial project signals are detected.
-
-## Triggers
-
-- Auto-trigger: when `TradingView`, `Lightweight Charts`, `decimal.js`, `ccxt`, or `ws` detected in `package.json`
-- Auto-trigger: when files matching `**/price*.ts`, `**/ticker*.ts`, `**/orderbook*.ts` exist in project
-- `/rune trading` — manual invocation
-- Called by `cook` (L1) when fintech or trading project context detected
-
-## Skills Included
-
-| Skill | Model | Description |
-|-------|-------|-------------|
-| [fintech-patterns](skills/fintech-patterns.md) | sonnet | Safe money handling with Decimal/BigInt, transaction processing, audit trails, regulatory compliance, and PnL calculations. |
-| [realtime-data](skills/realtime-data.md) | sonnet | WebSocket lifecycle management, auto-reconnect with exponential backoff, event normalization, rate limiting, and TanStack Query cache invalidation. |
-| [chart-components](skills/chart-components.md) | sonnet | Candlestick, line, and area charts using TradingView Lightweight Charts with real-time updates, crosshair sync, indicator overlays, and reduced-motion support. |
-| [indicator-library](skills/indicator-library.md) | sonnet | SMA, EMA, RSI, MACD, Bollinger Bands, VWAP — streaming calculation patterns that update incrementally on each new tick. |
-| [trade-logic](skills/trade-logic.md) | sonnet | Entry/exit spec management, indicator parameter registry, strategy state tracking, and backtest result linkage. |
-| [experiment-loop](skills/experiment-loop.md) | sonnet | Scientific method for strategy development — hypothesize → implement → backtest → analyze → refine. |
-| [quant-analysis](skills/quant-analysis.md) | sonnet | Portfolio metrics, risk calculations, statistical edge detection, Monte Carlo simulation, and position sizing models. |
-
-## Tech Stack Support
-
-| Framework | Library | Notes |
-|-----------|---------|-------|
-| React 19 / Vite | Lightweight Charts 5.x | Preferred for custom dashboards |
-| React 19 / Next.js | TradingView Charting Library | For advanced trading terminals |
-| Any | Decimal.js 10.x | Required for all money arithmetic |
-| Any | ws / native WebSocket | Auto-reconnect via `realtime-data` skill |
-| React 19 | TanStack Query v5 | WebSocket → cache invalidation bridge |
-| Any | date-fns-tz | Timezone-safe candle timestamp handling |
-
-## Connections
-
-```
-Calls → @rune/ui (L4): chart component styling, color tokens, responsive layout
-Called By ← cook (L1): when trading project detected
-Called By ← launch (L1): pre-flight check for financial dashboards
-Called By ← logic-guardian (L2): when project is classified as trading domain
-```
-
-## Sharp Edges
-
-| Failure Mode | Severity | Mitigation |
-|---|---|---|
-| Float arithmetic on price (`0.1 + 0.2 !== 0.3`) silently corrupts PnL | HIGH | Enforce Decimal.js at parse boundary; lint rule banning `*`, `+`, `-` on raw number price fields |
-| WebSocket silently stops receiving after network blip with no reconnect | HIGH | Always attach `onclose` handler; test disconnect/reconnect in CI with a mock server |
-| Chart series not removed on symbol change causes memory leak and ghost lines | HIGH | Track series refs; call `chart.removeSeries(s)` in cleanup / `useEffect` return |
-| Indicator computed on float prices accumulates rounding drift over 1000+ ticks | MEDIUM | Feed Decimal-converted `toNumber()` only at the indicator boundary; document precision loss |
-| `localStorage` used for auth token or balance cache exposes data to XSS | HIGH | Use `httpOnly` cookies or in-memory store; audit with `Grep pattern="localStorage" glob="**/*.ts"` |
-| Candlestick timestamps in local timezone cause gaps on DST transitions | MEDIUM | Normalize all timestamps to UTC unix seconds at the WebSocket boundary |
-
-## Done When
-
-- All price/quantity/fee fields are wrapped in `Decimal` with no raw float arithmetic reachable by Grep
-- WebSocket reconnects automatically after 5-second disconnect in manual or automated test
-- Chart renders candlesticks and at least one indicator overlay without layout shift on resize
-- Streaming indicator values match reference batch output within floating-point display tolerance
-- `prefers-reduced-motion` disables chart animations (verified via browser devtools emulation)
-- No `localStorage` usage for financial data (confirmed by Grep audit)
-
-## Cost Profile
-
-~2,000–4,000 tokens per skill activation. `sonnet` default for code generation; `haiku` for Grep/file-scan steps; `opus` if regulatory compliance or security audit context is detected. Full pack activation (all 7 skills) runs ~14,000–28,000 tokens end-to-end.
+---
+name: "@rune/trading"
+description: Fintech and trading patterns — real-time data, financial dashboards, technical indicators, WebSocket architecture, and experiment-driven strategy development.
+metadata:
+  author: runedev
+  version: "0.3.0"
+  layer: L4
+  price: "$15"
+  target: Fintech developers
+  format: split
+---
+
+# @rune/trading
+
+## Purpose
+
+Fintech applications demand precision that general-purpose patterns cannot guarantee. This pack groups five tightly-coupled concerns — safe money arithmetic, WebSocket reliability, financial chart rendering, streaming indicator computation, and experiment-driven strategy development — because a gap in any one layer breaks the entire trading surface. It solves the recurring problem of developers accidentally using JavaScript floats for currency, missing auto-reconnect logic, or computing indicators on stale snapshots. Activates automatically when trading or financial project signals are detected.
+
+## Triggers
+
+- Auto-trigger: when `TradingView`, `Lightweight Charts`, `decimal.js`, `ccxt`, or `ws` detected in `package.json`
+- Auto-trigger: when files matching `**/price*.ts`, `**/ticker*.ts`, `**/orderbook*.ts` exist in project
+- `/rune trading` — manual invocation
+- Called by `cook` (L1) when fintech or trading project context detected
+
+## Skills Included
+
+| Skill | Model | Description |
+|-------|-------|-------------|
+| [fintech-patterns](skills/fintech-patterns.md) | sonnet | Safe money handling with Decimal/BigInt, transaction processing, audit trails, regulatory compliance, and PnL calculations. |
+| [realtime-data](skills/realtime-data.md) | sonnet | WebSocket lifecycle management, auto-reconnect with exponential backoff, event normalization, rate limiting, and TanStack Query cache invalidation. |
+| [chart-components](skills/chart-components.md) | sonnet | Candlestick, line, and area charts using TradingView Lightweight Charts with real-time updates, crosshair sync, indicator overlays, and reduced-motion support. |
+| [indicator-library](skills/indicator-library.md) | sonnet | SMA, EMA, RSI, MACD, Bollinger Bands, VWAP — streaming calculation patterns that update incrementally on each new tick. |
+| [trade-logic](skills/trade-logic.md) | sonnet | Entry/exit spec management, indicator parameter registry, strategy state tracking, and backtest result linkage. |
+| [experiment-loop](skills/experiment-loop.md) | sonnet | Scientific method for strategy development — hypothesize → implement → backtest → analyze → refine. |
+| [quant-analysis](skills/quant-analysis.md) | sonnet | Portfolio metrics, risk calculations, statistical edge detection, Monte Carlo simulation, and position sizing models. |
+
+## Tech Stack Support
+
+| Framework | Library | Notes |
+|-----------|---------|-------|
+| React 19 / Vite | Lightweight Charts 5.x | Preferred for custom dashboards |
+| React 19 / Next.js | TradingView Charting Library | For advanced trading terminals |
+| Any | Decimal.js 10.x | Required for all money arithmetic |
+| Any | ws / native WebSocket | Auto-reconnect via `realtime-data` skill |
+| React 19 | TanStack Query v5 | WebSocket → cache invalidation bridge |
+| Any | date-fns-tz | Timezone-safe candle timestamp handling |
+
+## Connections
+
+```
+Calls → @rune/ui (L4): chart component styling, color tokens, responsive layout
+Called By ← cook (L1): when trading project detected
+Called By ← launch (L1): pre-flight check for financial dashboards
+Called By ← logic-guardian (L2): when project is classified as trading domain
+```
+
+## Sharp Edges
+
+| Failure Mode | Severity | Mitigation |
+|---|---|---|
+| Float arithmetic on price (`0.1 + 0.2 !== 0.3`) silently corrupts PnL | HIGH | Enforce Decimal.js at parse boundary; lint rule banning `*`, `+`, `-` on raw number price fields |
+| WebSocket silently stops receiving after network blip with no reconnect | HIGH | Always attach `onclose` handler; test disconnect/reconnect in CI with a mock server |
+| Chart series not removed on symbol change causes memory leak and ghost lines | HIGH | Track series refs; call `chart.removeSeries(s)` in cleanup / `useEffect` return |
+| Indicator computed on float prices accumulates rounding drift over 1000+ ticks | MEDIUM | Feed Decimal-converted `toNumber()` only at the indicator boundary; document precision loss |
+| `localStorage` used for auth token or balance cache exposes data to XSS | HIGH | Use `httpOnly` cookies or in-memory store; audit with `Grep pattern="localStorage" glob="**/*.ts"` |
+| Candlestick timestamps in local timezone cause gaps on DST transitions | MEDIUM | Normalize all timestamps to UTC unix seconds at the WebSocket boundary |
+
+## Done When
+
+- All price/quantity/fee fields are wrapped in `Decimal` with no raw float arithmetic reachable by Grep
+- WebSocket reconnects automatically after 5-second disconnect in manual or automated test
+- Chart renders candlesticks and at least one indicator overlay without layout shift on resize
+- Streaming indicator values match reference batch output within floating-point display tolerance
+- `prefers-reduced-motion` disables chart animations (verified via browser devtools emulation)
+- No `localStorage` usage for financial data (confirmed by Grep audit)
+
+## Cost Profile
+
+~2,000–4,000 tokens per skill activation. `sonnet` default for code generation; `haiku` for Grep/file-scan steps; `opus` if regulatory compliance or security audit context is detected. Full pack activation (all 7 skills) runs ~14,000–28,000 tokens end-to-end.