@thedecipherist/claude-packs 0.0.0-stage → 1.0.0

package/packs/host-agent/checks/tmp-path-predictable.json

@@ -0,0 +1,27 @@
+{
+  "id": "tmp-path-predictable",
+  "why": "A fixed path in /tmp can be planted or read by another user.",
+  "rule": ".claude/rules/root-on-other-machines.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs",
+    "**/*.go"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "['\"`]/tmp/[\\w.${}-]+",
+  "bad": "const keyFile = `/tmp/swk-${id}-key.pem`;",
+  "good": "const dir = await mkdtemp(join(tmpdir(), 'swk-'));\nconst keyFile = join(dir, 'key.pem');",
+  "kind": "security"
+}

package/packs/host-agent/pack.json

@@ -0,0 +1,22 @@
+{
+  "name": "host-agent",
+  "version": "1.0.0",
+  "description": "Software that runs as root on machines it does not own: updates are verified, secrets stay off the command line, system files are replaced atomically, and generated config is escaped.",
+  "type": "stock",
+  "author": "claude-packs",
+  "license": "MIT",
+  "homepage": "https://github.com/TheDecipherist/claude-packs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TheDecipherist/claude-packs.git",
+    "directory": "packs/host-agent"
+  },
+  "keywords": [
+    "agent",
+    "daemon",
+    "security"
+  ],
+  "engines": {
+    "claude-packs": ">=0.25.0"
+  }
+}

package/packs/host-agent/rules/root-on-other-machines.md

@@ -0,0 +1,27 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.go"
+  - "**/*.mjs"
+---
+
+# Root on someone else's machine: verify, keep secrets off the command line, replace atomically
+
+<constraints>
+Always do:
+- Sign updates, verify before writing, swap by rename, and keep the last good version.
+- Pass secrets through stdin, a file with tight permissions, or the environment of the one process.
+- Make temp files with `mkdtemp`.
+- Verify SSH host keys.
+- Write a system file to a temp path, validate it, then rename it over the old one.
+- Revoke the old key only after the new one is proven.
+- Escape every value written into another program's config, with an escaper for that format.
+
+Never do:
+- Make an integrity check optional.
+- Pipe a download into a shell, in a script or in a string a program builds.
+- Build a path from a parameter without checking it stays in its folder.
+</constraints>
+
+## Check
+`integrity-check-optional`, `secret-on-argv`, `tmp-path-predictable`, `ssh-verifies-host-key`, `system-file-written-in-place`, `file-path-from-param`, `quoted-value-into-config`.

package/packs/html-ui/checks/email-html-escapes.json

@@ -0,0 +1,25 @@
+{
+  "id": "email-html-escapes",
+  "why": "Mail clients render it, so one contact form submission can put a phishing link in staff mail under your own domain.",
+  "rule": ".claude/rules/email-html-escapes.md",
+  "globs": [
+    "**/email/**/*.ts",
+    "**/mail/**/*.ts",
+    "**/emails/**/*.ts"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "strings": true,
+  "pattern": "</?(?:p|td|div|span|strong|b|h[1-6]|li|a)\\b[^>\\n]*>[^<\\n`]*\\$\\{\\s*(?!esc\\w*\\(|encodeURIComponent)[\\w.]+\\s*\\}",
+  "bad": "const html = `<p><strong>Name:</strong> ${name}</p>`;",
+  "good": "const html = `<p><strong>Name:</strong> ${escapeHtml(name)}</p>`;"
+}

package/packs/html-ui/checks/external-link-rel.json

@@ -0,0 +1,21 @@
+{
+  "id": "external-link-rel",
+  "why": "rel=\"noreferrer\" without noopener leaves window.opener to the target page. Both, always.",
+  "rule": ".claude/rules/server-html-escapes-everything.md",
+  "concepts": [
+    "ui-templates"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/test/**"
+  ],
+  "code": false,
+  "pattern": "rel\\s*=\\s*[\\\"'](?![^\\\"']*noopener)[^\\\"']*noreferrer[^\\\"']*[\\\"']",
+  "bad": "<a href=\"${url}\" rel=\"noreferrer\">",
+  "good": "<a href=\"${url}\" target=\"_blank\" rel=\"noopener noreferrer\">"
+}

package/packs/html-ui/checks/no-duplicate-escape.json

@@ -0,0 +1,26 @@
+{
+  "id": "no-duplicate-escape",
+  "why": "A second escapeHtml (in auth, oauth, email) is the one that misses a character. One in html.ts, imported everywhere.",
+  "rule": ".claude/rules/server-html-escapes-everything.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/test/**",
+    "**/html.*",
+    "**/ui/html.*",
+    "**/lib/html.*"
+  ],
+  "code": true,
+  "pattern": "\\b(?:function|const)\\s+(?:escapeHtml|escapeHTML|htmlEscape|escapeAttr)\\b",
+  "bad": "function escapeHtml(s: string): string { return s.replace(/&/g, '&'); }",
+  "good": "import { escapeHtml } from '../ui/html.js';"
+}

package/packs/html-ui/checks/no-inline-client-script.json

@@ -0,0 +1,21 @@
+{
+  "id": "no-inline-client-script",
+  "why": "Browser JavaScript inside a .ts template string is untyped, unlinted and untested, and every edit risks the CSP nonce. Serve a static client file.",
+  "rule": ".claude/rules/server-html-escapes-everything.md",
+  "concepts": [
+    "ui-templates"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/test/**"
+  ],
+  "code": false,
+  "pattern": "<script\\b(?![^>]*\\b(?:src=|type=[\"']application/(?:ld\\+)?json))[^>]*>[\\s\\S]{300,}?</script>",
+  "bad": "<script>a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()x<y;a()</script>\n",
+  "good": "<script src=\"/app.js\" nonce=\"${nonce}\"></script>\n<script>boot();</script>\n"
+}

package/packs/html-ui/checks/no-inline-style.json

@@ -0,0 +1,23 @@
+{
+  "id": "no-inline-style",
+  "why": "style=\"\u2026\" in server HTML is dropped by a nonce-only production CSP, so prod renders differently from dev. Put it in the nonce'd stylesheet.",
+  "rule": ".claude/rules/server-html-escapes-everything.md",
+  "concepts": [
+    "ui-templates"
+  ],
+  "exclude": [
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    ".claude/**",
+    "**/.claude/**",
+    "**/*.test.*",
+    "**/test/**",
+    "**/css.*",
+    "**/styles.*"
+  ],
+  "code": false,
+  "pattern": "\\bstyle\\s*=\\s*[\\\"']",
+  "bad": "<span style=\"color: var(--muted)\">",
+  "good": "<span class=\"muted\">"
+}

package/packs/html-ui/pack.json

@@ -0,0 +1,33 @@
+{
+  "name": "html-ui",
+  "version": "1.0.0",
+  "description": "Server-rendered HTML (template strings, views): every value escaped, no inline style or script, safe links.",
+  "type": "stock",
+  "author": "claude-packs",
+  "license": "MIT",
+  "homepage": "https://github.com/TheDecipherist/claude-packs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TheDecipherist/claude-packs.git",
+    "directory": "packs/html-ui"
+  },
+  "keywords": [
+    "html",
+    "ssr"
+  ],
+  "engines": {
+    "claude-packs": ">=0.19.0"
+  },
+  "folders": {},
+  "concepts": {
+    "ui-templates": [
+      "**/ui/**/*.ts",
+      "**/views/**/*.ts",
+      "**/templates/**/*.ts",
+      "**/render*.ts",
+      "**/*.view.ts"
+    ]
+  },
+  "skillsIn": null,
+  "hooks": {}
+}

package/packs/html-ui/rules/email-html-escapes.md

@@ -0,0 +1,19 @@
+---
+paths:
+  - "**/email/**"
+  - "**/mail/**"
+  - "**/emails/**"
+---
+
+# HTML email escapes every value, as a page does
+
+<constraints>
+Always do:
+- Pass every value through the escaper when building HTML mail.
+
+Never do:
+- Put a name, a subject or any stored text into mail HTML unescaped.
+</constraints>
+
+## Check
+`email-html-escapes`.

package/packs/html-ui/rules/server-html-escapes-everything.md

@@ -0,0 +1,22 @@
+---
+# concepts: ui-templates
+paths:
+  - "placeholder"
+---
+
+# Every value in server-rendered HTML is escaped; styling and script are never inline
+
+<constraints>
+Always do:
+- One `html.ts` exports `escapeHtml`, `attr`, and a tagged template `html\`…\`` that escapes every interpolation by default; raw insertion is an explicit `raw(trustedFragment)`. There is **one** `escapeHtml` in the project (`no-duplicate-escape`).
+- Enum values from the database (`session.state`, `goal.status`) go through it too: today they are enums, tomorrow one is free text.
+- Styling lives in one nonce'd stylesheet; an inline `style="…"` is silently dropped by the production CSP (`no-inline-style`), so dev and prod render differently.
+- Client JavaScript is a static file served with the nonce or a hash in CSP, type-checked and tested; never a 50-line string inside a `.ts` template.
+- External links: `rel="noopener noreferrer"` and an `https://` check on the href (`external-link-rel`).
+- Polling partials render only what changed; the full page data fan-out does not run every 4 seconds per open tab.
+
+Never do:
+- `${value}` inside a template that contains `<` unless the tag escapes it.
+- A second `escapeHtml` in an auth or oauth module.
+- `rel="noreferrer"` alone.
+</constraints>

package/packs/http-api/checks/api-path-versioned.json

@@ -0,0 +1,31 @@
+{
+  "id": "api-path-versioned",
+  "why": "An unversioned API route cannot change without breaking every client.",
+  "rule": ".claude/rules/apis-are-versioned.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/data/**",
+    "**/docs/**"
+  ],
+  "pattern": "\\.(?:use|all|get|post|put|patch|delete|route)\\s*\\(\\s*['\"`]/(?:[\\w-]+/)?api/(?!v\\d+(?:/|['\"`]))",
+  "bad": "app.use('/api/sessions', router);\napp.get('/api/orders', handler);\nrouter.get('/adminTools/api/config', handler);",
+  "good": "app.use('/api/v1/sessions', router);\napp.get('/api/v2/orders', handler);",
+  "replaces": [
+    "api-routes-versioned"
+  ]
+}

package/packs/http-api/checks/authz-from-request-body.json

@@ -0,0 +1,26 @@
+{
+  "id": "authz-from-request-body",
+  "why": "What a caller may do comes from what the server stored, never from the request.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "req\\.body\\??\\.(?:applied_to|role|company_id|tenant_id|owner_id|is_admin)\\b",
+  "bad": "const appliedTo = req.body?.applied_to ?? [];",
+  "good": "const appliedTo = stored.applied_to;",
+  "kind": "security"
+}

package/packs/http-api/checks/client-calls-a-version.json

@@ -0,0 +1,28 @@
+{
+  "id": "client-calls-a-version",
+  "why": "A client that calls an unversioned path breaks the day the API changes.",
+  "rule": ".claude/rules/apis-are-versioned.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**",
+    "**/data/**",
+    "**/docs/**"
+  ],
+  "pattern": "\\b(?:fetch|axios(?:\\.\\w+)?|api\\.\\w+)\\(\\s*['\"`]/api/(?!v\\d+(?:/|['\"`])|auth/|health)",
+  "bad": "const r = await fetch('/api/orders');",
+  "good": "const r = await fetch(`${API}/orders`);\nconst s = await fetch('/api/v1/orders');\nawait fetch('/api/auth/session');"
+}

package/packs/http-api/checks/client-ip-not-leftmost-xff.json

@@ -0,0 +1,28 @@
+{
+  "id": "client-ip-not-leftmost-xff",
+  "why": "The left end of that header is written by the client unless the proxy says otherwise, and the code should not depend on a proxy setting nobody can see.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "strings": true,
+  "pattern": "x-forwarded-for['\\\"]\\]?\\)?[^\\n]{0,40}\\.split\\(|\\bforwarded\\??\\.split\\(|['\\\"]x-forwarded-for['\\\"]\\)\\s*\\|\\||\\.get\\(['\\\"]x-forwarded-for['\\\"]\\)\\s*\\|\\|",
+  "bad": "const ip = req.headers['x-forwarded-for']?.toString().split(',')[0];",
+  "good": "const ip = clientIp(req);",
+  "kind": "security"
+}

package/packs/http-api/checks/cors-needs-origin.json

@@ -0,0 +1,26 @@
+{
+  "id": "cors-needs-origin",
+  "why": "The default branch of a security decision must deny. CORS with credentials and no origin list trusts any site.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "\\bcors\\(\\s*(?:\\)|\\{\\s*credentials\\s*:\\s*true\\s*\\}\\s*\\)|\\{\\s*origin\\s*:\\s*(?:true|'\\*')\\b)",
+  "bad": "app.use(cors({ credentials: true }));",
+  "good": "app.use(cors({ origin: env.ALLOWED_ORIGINS, credentials: true }));",
+  "kind": "security"
+}

package/packs/http-api/checks/csp-not-switched-off.json

@@ -0,0 +1,28 @@
+{
+  "id": "csp-not-switched-off",
+  "why": "A Content Security Policy is what stops injected script from running. Switched off, one XSS bug is the whole site.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "kind": "security",
+  "code": true,
+  "pattern": "\\bcontentSecurityPolicy\\s*:\\s*false\\b",
+  "bad": "app.use(helmet({ contentSecurityPolicy: false }));",
+  "good": "app.use(helmet({ contentSecurityPolicy: { directives: POLICY } }));"
+}

package/packs/http-api/checks/debug-route-not-shipped.json

@@ -0,0 +1,26 @@
+{
+  "id": "debug-route-not-shipped",
+  "why": "Temporary access paths are never removed, and an AI writes the comment instead of the check because the comment passes every test.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/app/api/**/debug/route.ts",
+    "**/app/api/**/test/route.ts",
+    "**/app/api/**/*-test/route.ts"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "export\\s+async\\s+function\\s+(?:GET|POST|PUT|PATCH|DELETE)\\b",
+  "bad": "export async function GET() {}",
+  "good": "const x = 1;",
+  "kind": "security"
+}

package/packs/http-api/checks/encrypted-name-plaintext-value.json

@@ -0,0 +1,26 @@
+{
+  "id": "encrypted-name-plaintext-value",
+  "why": "A field named encrypted that holds plain text tells every reader it is safe.",
+  "rule": ".claude/rules/credentials-handled-safely.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "['\"]?[\\w.]*_encrypted['\"]?\\s*:\\s*(?!encrypt\\b|await\\s+encrypt\\b)[a-z]\\w*\\.",
+  "bad": "'config.access_token_encrypted': tokens.access_token,",
+  "good": "'config.access_token_encrypted': encrypt(tokens.access_token, key),",
+  "kind": "security"
+}

package/packs/http-api/checks/err-text-stays-server-side.json

@@ -0,0 +1,27 @@
+{
+  "id": "err-text-stays-server-side",
+  "why": "Driver and stack text tells an attacker what is behind the API.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/app/api/**/route.ts",
+    "**/app/api/**/route.js",
+    "**/routes/**/*.ts",
+    "**/routes/**/*.js"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "\\b(?:error|message|detail|details)\\s*:\\s*(?:(?:err|error|e)\\s+instanceof\\s+Error\\s*\\?\\s*)?\\(?(?:err|error|e)(?:\\s+as\\s+Error\\))?\\.message\\b",
+  "bad": "return json({ error: 'x', detail: error instanceof Error ? error.message : String(error) });",
+  "good": "return json({ error: 'x' });",
+  "kind": "security"
+}

package/packs/http-api/checks/failure-is-not-empty.json

@@ -0,0 +1,28 @@
+{
+  "id": "failure-is-not-empty",
+  "why": "A route that answers an empty 200 when its database is down tells every client there is no data. A failure and nothing to report must never look the same.",
+  "rule": ".claude/rules/one-error-contract.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "kind": "failures and lost data",
+  "code": true,
+  "pattern": "\\bif\\s*\\(\\s*!\\s*(?:db|client|conn|connection|pool)\\s*\\)\\s*(?:\\{\\s*)?return\\s+res\\.(?:json|send)\\(|\\bcatch\\b[^{]*\\{\\s*(?:return\\s+)?res\\.json\\(\\s*(?:\\[\\s*\\]|\\{\\s*\\w+\\s*:\\s*\\[\\s*\\])",
+  "bad": "if (!db) return res.json({ comments: [], total: 0 });\ntry { list(); } catch (e) { return res.json([]); }",
+  "good": "if (!db) return res.status(503).json({ code: 'unavailable' });"
+}

package/packs/http-api/checks/gate-is-not-a-todo.json

@@ -0,0 +1,27 @@
+{
+  "id": "gate-is-not-a-todo",
+  "why": "Temporary access paths are never removed, and an AI writes the comment instead of the check because the comment passes every test.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.tsx",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "(?:TODO|FIXME|XXX|[Ff]or now|[Ii]n production|[Ll]ater)\\b[^\\n]*\\b(?:auth\\w*|admin|role|plan|permission|signature|ownership|access control|tenant)\\b",
+  "bad": "// for now allow any user; in production add admin role check",
+  "good": "// admins only: adminGuard above",
+  "kind": "security"
+}

package/packs/http-api/checks/guard-fails-open.json

@@ -0,0 +1,28 @@
+{
+  "id": "guard-fails-open",
+  "why": "A guard that needs its input to exist before it refuses anything turns a missing value into full access.",
+  "rule": ".claude/rules/routes-scope-to-the-caller.md",
+  "globs": [
+    "**/app/api/**/route.ts",
+    "**/app/api/**/route.js",
+    "**/routes/**/*.ts",
+    "**/routes/**/*.js",
+    "**/middleware*"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "code": true,
+  "pattern": "\\.length\\s*>\\s*0\\s*&&\\s*!\\s*[\\w.]+\\.(?:includes|has|some)\\(|\\bif\\s*\\(\\s*!?[A-Za-z_]*(?:SECRET|TOKEN|ALLOWED|API_KEY)\\w*\\s*&&\\s*[^\\n]*(?:!==?|!\\s*[A-Z_a-z]+\\.)",
+  "bad": "if (ids.length > 0 && !ids.includes(siteId)) return forbidden();\nif (CRON_SECRET && header !== expected) return unauthorized();",
+  "good": "if (!ids.includes(siteId)) return forbidden();\nif (!CRON_SECRET) throw new Error('CRON_SECRET unset');",
+  "kind": "security"
+}

package/packs/http-api/checks/hmac-over-reserialised-body.json

@@ -0,0 +1,26 @@
+{
+  "id": "hmac-over-reserialised-body",
+  "why": "A signature covers bytes, and JSON.stringify of the parsed body is not those bytes.",
+  "rule": ".claude/rules/routes-validate-and-answer.md",
+  "globs": [
+    "**/*.ts",
+    "**/*.js",
+    "**/*.mjs",
+    "**/*.cjs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+    "**/e2e/**",
+    "**/node_modules/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/.next/**"
+  ],
+  "pattern": "(?:[Hh]mac|[Ss]ignature)[\\s\\S]{0,200}JSON\\.stringify\\(\\s*req(?:uest)?\\.body\\s*\\)|JSON\\.stringify\\(\\s*req(?:uest)?\\.body\\s*\\)[\\s\\S]{0,200}(?:[Hh]mac|[Ss]ignature)",
+  "bad": "const rawBody = JSON.stringify(req.body);\nconst sig = createHmac('sha256', key).update(rawBody).digest('hex');",
+  "good": "const sig = createHmac('sha256', key).update(req.rawBody).digest('hex');",
+  "kind": "security"
+}