@thedecipherist/claude-packs 1.0.0 → 1.1.0

package/packs/postgres/hooks/db-wipe-guard.mjs

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+// db-wipe-guard (PreToolUse, Bash): a command that wipes a database runs only against a database this machine holds. Two public reports of an agent
+// running a forced reset against a live database lost 60 and 87 tables; in the second, .env pointed at production. A reset is ordinary work on a local
+// database, so the guard judges the target, in this order: the host named in the command, then DATABASE_URL or POSTGRES_URL in the checkout's .env
+// files. A target it cannot find is refused, because a guard that cannot judge must not pass a wipe: name a local host in the command and it can.
+// Only the host is read and shown, never a password. `--selftest` proves it.
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { checkoutRoot } from './lib/project.mjs';
+import { bashOf, runHook, scratchProject, verdicts } from './lib/selftest.mjs';
+import { judgeEvent } from './lib/writes.mjs';
+import { asHook, isMain } from './lib/hook-log.mjs';
+
+const WIPES = [
+  [/\bprisma\s+migrate\s+reset\b/, 'prisma migrate reset'],
+  [/\bprisma\s+db\s+push\b[^\n;&|]*--(?:force-reset|accept-data-loss)\b/, 'prisma db push with a forced reset'],
+  [/\bdrizzle-kit\s+push\b[^\n;&|]*--force\b/, 'drizzle-kit push --force'],
+  [/\b(?:rails|rake)\s+db:(?:drop|reset)\b/, 'db:drop or db:reset'],
+  [/\bmanage\.py\s+flush\b/, 'manage.py flush'],
+  [/(?:^|[\s;&|])dropdb\s/, 'dropdb'],
+  [/\bsqlx\s+database\s+(?:drop|reset)\b/, 'sqlx database drop or reset'],
+  [/\bdiesel\s+database\s+reset\b/, 'diesel database reset'],
+];
+const RAW_WIPE = /\bpsql\b[^\n|]*\bDROP\s+(?:DATABASE|SCHEMA)\b/i;
+const LOCAL = new Set(['localhost', '127.0.0.1', '::1', '[::1]', 'host.docker.internal', 'db', 'postgres', 'database']);
+const URL_HOST = /\b(?:postgres(?:ql)?|mysql|mariadb):\/\/(?:[^@\s/'"]*@)?(\[[^\]]+\]|[^:/?\s'"]+)/i;
+const ENV_URL = /^\s*(?:export\s+)?(?:DATABASE_URL|POSTGRES_URL|POSTGRESQL_URL|DB_URL)\s*=\s*['"]?([^\s'"]+)/m;
+const HOST_FLAG = /(?:\s-h\s*|\s--host[=\s])(\S+)/;
+const ENV_FILES = ['.env.local', '.env.development', '.env'];
+
+const hostIn = (text) => text.match(URL_HOST)?.[1] ?? null;
+
+function hostOfEnv(root) {
+  for (const f of ENV_FILES) {
+    const file = join(root, f);
+    if (!existsSync(file)) continue;
+    const url = readFileSync(file, 'utf8').match(ENV_URL)?.[1];
+    if (url) return { host: hostIn(url), from: f };
+  }
+  return null;
+}
+
+// The host a command names, then the host its checkout's .env names.
+function targetOf(command, cwd) {
+  const named = hostIn(command) ?? command.match(HOST_FLAG)?.[1];
+  if (named) return { host: named, from: 'the command' };
+  return hostOfEnv(checkoutRoot(resolve(cwd, 'x'))) ?? { host: null, from: null };
+}
+
+export function refusal(command, cwd) {
+  const body = command.replace(/<<-?\s*['"]?(\w+)['"]?[\s\S]*?\n\1\b/g, '').replace(/'[^']*'|"(?:\\.|[^"\\])*"/g, "''");
+  const wipe = WIPES.find(([re]) => re.test(body))?.[1] ?? (RAW_WIPE.test(command) ? 'psql with DROP' : null);
+  if (!wipe) return null;
+  const { host, from } = targetOf(command, cwd);
+  if (host && LOCAL.has(host.toLowerCase())) return null;
+  const where = host ? `its target is ${host} (from ${from}), which is not this machine` : 'nothing says which database it would hit';
+  return `\`${wipe}\` wipes a database, and ${where}.\n` +
+    'A wipe runs only against a local database. If this one is local, name it in the command: `DATABASE_URL=postgres://localhost/<db> <command>`, or `-h localhost`.\n' +
+    'If it is not, this is the user\'s to run, not Claude\'s: stop and ask.\n';
+}
+
+const main = (text) => judgeEvent(text, { name: 'db-wipe-guard', command: refusal });
+
+function selftest() {
+  const hook = fileURLToPath(import.meta.url);
+  const live = scratchProject({ '.env': 'DATABASE_URL=postgres://app@db.prod.example.com:5432/app\n' });
+  const local = scratchProject({ '.env': 'DATABASE_URL="postgresql://app@localhost:5432/app"\n' });
+  const compose = scratchProject({ '.env.local': 'export POSTGRES_URL=postgres://app@db/app\n' });
+  const unknown = scratchProject({});
+  const sh = (dir, cmd) => runHook(hook, dir, bashOf(cmd, dir));
+  return verdicts('db-wipe-guard', [
+    ['a reset, with .env on a live host', sh(live, 'npx prisma migrate reset --force'), 2],
+    ['a forced push there', sh(live, 'npx prisma db push --force-reset'), 2],
+    ['data loss accepted there', sh(live, 'prisma db push --accept-data-loss'), 2],
+    ['drizzle there', sh(live, 'npx drizzle-kit push --force'), 2],
+    ['rails there', sh(live, 'bin/rails db:drop'), 2],
+    ['django there', sh(live, 'python manage.py flush --no-input'), 2],
+    ['psql dropping a database', sh(live, 'psql "$URL" -c "DROP DATABASE app"'), 2],
+    ['after other steps', sh(live, 'git status && dropdb app'), 2],
+    ['a live host named in the command beats a local .env', sh(local, 'DATABASE_URL=postgres://u@db.prod.example.com/app npx prisma migrate reset'), 2],
+    ['a reset with .env on localhost', sh(local, 'npx prisma migrate reset --force'), 0],
+    ['a compose service in .env.local', sh(compose, 'npx prisma migrate reset --force'), 0],
+    ['no target anywhere', sh(unknown, 'dropdb app'), 2],
+    ['a local host named in the command', sh(unknown, 'dropdb -h localhost app'), 0],
+    ['a local url named in the command', sh(live, 'DATABASE_URL=postgres://localhost/app npx prisma migrate reset'), 0],
+    ['a safe migrate', sh(live, 'npx prisma migrate deploy'), 0],
+    ['a push with no force', sh(live, 'npx drizzle-kit push'), 0],
+    ['words about a wipe', sh(live, "echo 'npx prisma migrate reset'"), 0],
+    ['a heredoc body', sh(live, "cat <<'EOF'\nprisma migrate reset\nEOF"), 0],
+  ]);
+}
+
+export const hook = main; // run-hooks.mjs calls it with the event's text (KWB-24)
+if (isMain(import.meta.url)) process.exit(process.argv.includes('--selftest') ? selftest() : await asHook('db-wipe-guard', main));

package/packs/postgres/pack.json

@@ -0,0 +1,48 @@
+{
+  "name": "postgres",
+  "version": "1.0.0",
+  "description": "PostgreSQL: migrations that never stop traffic, values always bound, types that say what they hold, and no database wiped by mistake.",
+  "type": "stock",
+  "author": "claude-packs",
+  "license": "MIT",
+  "homepage": "https://github.com/TheDecipherist/claude-packs",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/TheDecipherist/claude-packs.git",
+    "directory": "packs/postgres"
+  },
+  "keywords": [
+    "postgres",
+    "postgresql",
+    "sql",
+    "migrations"
+  ],
+  "engines": {
+    "claude-packs": ">=1.1.0"
+  },
+  "concepts": {
+    "postgres": [
+      "**/*.sql",
+      "**/*.prisma"
+    ]
+  },
+  "optIn": [
+    "checks/pg-index-concurrently.json",
+    "checks/pg-fk-not-valid.json",
+    "checks/pg-timestamptz.json"
+  ],
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR/.claude/hooks/db-wipe-guard.mjs\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}

package/packs/postgres/rules/postgres-migrations-never-stop-traffic.md

@@ -0,0 +1,28 @@
+---
+paths:
+  - "**/*.sql"
+  - "**/migrations/**"
+  - "**/migrate/**"
+  - "**/*.prisma"
+---
+
+# A migration never stops traffic
+
+A new table is free. A live table is not: a lock held for one long statement queues every query behind it.
+
+<constraints>
+Always do:
+- On a live table, build an index with `CONCURRENTLY`, outside a transaction. Check how the migration tool leaves its transaction first.
+- Add a foreign key or a check `NOT VALID`, then `VALIDATE` it in a later transaction.
+- Add a required column in three steps: nullable, backfill in batches, then tighten. The `postgres-safe-migration` skill walks it.
+- Change a column by expand and contract: a new column, both written, a backfill, then the old one dropped.
+- Set `lock_timeout` on a migration that takes a strong lock.
+
+Never do:
+- Add a column with a volatile default (`gen_random_uuid()`, `clock_timestamp()`, `random()`, `nextval()`) to a live table. `now()` and a constant are safe.
+- Add a `NOT NULL` column with no default to a table with rows.
+- Run a wipe (`prisma migrate reset`, `db push --force-reset`, `drizzle-kit push --force`, `db:drop`, `flush`, `dropdb`) on anything but a local database. `db-wipe-guard` refuses it.
+</constraints>
+
+## Check
+`pg-no-volatile-default`, `pg-no-required-column`, `pg-concurrently-in-txn`, and the hook `db-wipe-guard`. On a project with large live tables, name these in `"enable"`: `checks/pg-index-concurrently.json`, `checks/pg-fk-not-valid.json`. A line that is right anyway says so at its end: `-- pg: allow <reason>`.

package/packs/postgres/rules/postgres-one-pool-per-process.md

@@ -0,0 +1,21 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.py"
+  - "**/*.go"
+  - "**/*.rs"
+---
+
+# One pool per process, in one place
+
+<constraints>
+Always do:
+- Make one pool per process, in one module, and hand it to everything that needs it.
+- Size it so every process together stays under `max_connections`, with room for a migration.
+- Give back every client you take, on every path.
+- Keep a transaction short, and do no network call inside one.
+
+Never do:
+- Open a connection per request.
+- Use session state (`SET`, `LISTEN`, session advisory locks, `PREPARE`) through PgBouncer in transaction mode.
+</constraints>

package/packs/postgres/rules/postgres-queries-are-null-safe-and-bounded.md

@@ -0,0 +1,26 @@
+---
+paths:
+  - "**/*.sql"
+  - "**/*.ts"
+  - "**/*.py"
+  - "**/*.go"
+  - "**/*.rs"
+---
+
+# A query survives NULLs, and reads a bounded amount
+
+<constraints>
+Always do:
+- Write `NOT EXISTS` in place of `NOT IN (SELECT ...)`: one NULL in the subquery returns no rows at all.
+- Page with a key (`WHERE id > $1 ORDER BY id LIMIT n`). `OFFSET` still computes every row it skips.
+- Index a foreign key's referencing column when rows are looked up or deleted through it. Postgres does not do it for you.
+- Name the columns a query needs in code that ships.
+- Read `EXPLAIN (ANALYZE, BUFFERS)` on a query a hot path runs.
+
+Never do:
+- Run a query with no `LIMIT` on a table that grows, from a request.
+- Use `BETWEEN` on a `timestamptz`: write `>=` and `<`.
+</constraints>
+
+## Check
+`pg-not-exists`.

package/packs/postgres/rules/postgres-types-say-what-they-hold.md

@@ -0,0 +1,22 @@
+---
+paths:
+  - "**/*.sql"
+  - "**/*.prisma"
+---
+
+# A column's type says what it holds
+
+<constraints>
+Always do:
+- Use `timestamptz` for a moment in time, and `timestamp` only for a wall-clock time with no zone. Prisma and Rails default to `timestamp`: say `@db.Timestamptz` or `timestamptz` yourself.
+- Use `text`, with a `CHECK` where a length is a real rule.
+- Use `GENERATED ALWAYS AS IDENTITY` in place of `serial`.
+- Use `numeric`, or an integer count of the smallest unit, for money.
+
+Never do:
+- Use `money`, or a float for an amount.
+- Use `char(n)`.
+</constraints>
+
+## Check
+`pg-no-money`, `pg-no-float-money`. `checks/pg-timestamptz.json` is opt-in, through `"enable"`.

package/packs/postgres/rules/postgres-values-are-bound.md

@@ -0,0 +1,130 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "bin/claude-packs.mjs"
+  - "lib/backup.mjs"
+  - "lib/build-queue.mjs"
+  - "lib/claude-md.mjs"
+  - "lib/config-cli.mjs"
+  - "lib/configs.mjs"
+  - "lib/coverage.mjs"
+  - "lib/custom-packs.mjs"
+  - "lib/doctor.mjs"
+  - "lib/fix-plan.mjs"
+  - "lib/git-tokens.mjs"
+  - "lib/global.mjs"
+  - "lib/hook-proof.mjs"
+  - "lib/hook-timing.mjs"
+  - "lib/hover-gate.mjs"
+  - "lib/kit-command.mjs"
+  - "lib/kit-lock.mjs"
+  - "lib/layout.mjs"
+  - "lib/logs.mjs"
+  - "lib/manifest.mjs"
+  - "lib/new.mjs"
+  - "lib/once-only-report.mjs"
+  - "lib/pack-manifest.mjs"
+  - "lib/packs.mjs"
+  - "lib/planner.mjs"
+  - "lib/repeats.mjs"
+  - "lib/repo-weight.mjs"
+  - "lib/rule-tests.mjs"
+  - "lib/rules.mjs"
+  - "lib/scan-detect.mjs"
+  - "lib/scan.mjs"
+  - "lib/selftest-cache.mjs"
+  - "lib/settings.mjs"
+  - "lib/shape-cli.mjs"
+  - "lib/shape.mjs"
+  - "lib/suggest.mjs"
+  - "lib/switches.mjs"
+  - "lib/symmetry-doctor.mjs"
+  - "lib/sync.mjs"
+  - "scripts/test-changed.mjs"
+  - "test/audio-packs.test.mjs"
+  - "test/base-laws.test.mjs"
+  - "test/base-neutral.test.mjs"
+  - "test/check-speed.test.mjs"
+  - "test/configs.test.mjs"
+  - "test/configurations.test.mjs"
+  - "test/content-sites.test.mjs"
+  - "test/cpp-pack.test.mjs"
+  - "test/custom-packs.test.mjs"
+  - "test/doctor-cache.test.mjs"
+  - "test/doctor-timeout.test.mjs"
+  - "test/every-language.test.mjs"
+  - "test/example-line.test.mjs"
+  - "test/file-size.test.mjs"
+  - "test/fix-plan.test.mjs"
+  - "test/frame-bench.test.mjs"
+  - "test/fresh-tmp.mjs"
+  - "test/full-stack.test.mjs"
+  - "test/gitignore.test.mjs"
+  - "test/global.test.mjs"
+  - "test/hook-proof.test.mjs"
+  - "test/hook-timing.test.mjs"
+  - "test/house.test.mjs"
+  - "test/hover.test.mjs"
+  - "test/install-fixes.test.mjs"
+  - "test/install.test.mjs"
+  - "test/instances.test.mjs"
+  - "test/kf-build-laws.test.mjs"
+  - "test/kf-fail-open.test.mjs"
+  - "test/kf-new-projects.test.mjs"
+  - "test/kf-refusals.test.mjs"
+  - "test/kit-cli.mjs"
+  - "test/kit-guards.test.mjs"
+  - "test/kit-lock.test.mjs"
+  - "test/layout-owned.test.mjs"
+  - "test/lock-release.test.mjs"
+  - "test/logging.test.mjs"
+  - "test/lookup.test.mjs"
+  - "test/micro.test.mjs"
+  - "test/names-sweep.test.mjs"
+  - "test/new.test.mjs"
+  - "test/no-personal-name.test.mjs"
+  - "test/noop.test.mjs"
+  - "test/npx-name.test.mjs"
+  - "test/once-only.test.mjs"
+  - "test/other-projects.test.mjs"
+  - "test/pack-manifest.test.mjs"
+  - "test/readme.test.mjs"
+  - "test/review-packs.test.mjs"
+  - "test/routes.test.mjs"
+  - "test/rule-tests.test.mjs"
+  - "test/rust-pack.test.mjs"
+  - "test/scan.test.mjs"
+  - "test/shape.test.mjs"
+  - "test/stored-text.test.mjs"
+  - "test/structure.test.mjs"
+  - "test/sub37-wb.test.mjs"
+  - "test/symmetry.test.mjs"
+  - "test/test-changed.test.mjs"
+  - "test/ui-craft.test.mjs"
+  - "test/ui-depth.test.mjs"
+  - "test/what-the-kit-finds.test.mjs"
+  - "test/worktrees.test.mjs"
+  - "test/writing.test.mjs"
+  - "**/*.py"
+  - "**/*.go"
+  - "**/*.rs"
+  - "**/*.rb"
+---
+
+# A value is bound, never written into the SQL text
+
+<constraints>
+Always do:
+- Pass every value as a parameter: `$1`, `%s`, or the driver's tagged form (`` sql`...` ``, `$queryRaw`).
+- Take a table or column name from an allow-list in the code, and quote it with the driver's identifier helper.
+- Connect read-only work as a database role that can only read. A wrapper that promises read-only is no boundary.
+
+Never do:
+- Build SQL from a value with a template string, an f-string, `%`, `.format`, `Sprintf` or `format!`.
+- Trust a value because it came from your own database or a form with validation.
+</constraints>
+
+## Check
+`pg-bind-values`. A line that is right anyway says so: `// pg: allow <reason>`.

package/packs/postgres/skills/postgres-safe-migration/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: postgres-safe-migration
+description: Use when writing a migration for a table that holds data, when changing a column, adding a required column, an index or a constraint, or when a pg- check refuses a migration.
+---
+
+# Change a live Postgres table (one job: the change lands, and no query waits for it)
+
+<constraints>
+Always do:
+1. Find out how big the table is and how busy, or ask. A new or empty table needs none of this.
+2. Find out how the migration tool leaves a transaction, before writing `CONCURRENTLY`. Each has its own way:
+   | Tool | How |
+   |---|---|
+   | Rails | `disable_ddl_transaction!` |
+   | Django | `atomic = False` |
+   | Diesel | `run_in_transaction = false` in `metadata.toml` |
+   | goose | `-- +goose NO TRANSACTION` |
+   | dbmate | `-- migrate:up transaction:false` |
+   | sqlx | `-- no-transaction` on the first line |
+   | Alembic | `autocommit_block()` |
+   | Knex | `exports.config = { transaction: false }` |
+   | node-pg-migrate | `pgm.noTransaction()` |
+
+   Drizzle runs every pending migration in one transaction: take the index out of its migrations and run it apart.
+3. Add a required column:
+   ```sql
+   ALTER TABLE t ADD COLUMN owner_id bigint;              -- 1. nullable, instant
+   -- 2. the code writes it, and a backfill runs in batches
+   ALTER TABLE t ADD CONSTRAINT t_owner CHECK (owner_id IS NOT NULL) NOT VALID;
+   ALTER TABLE t VALIDATE CONSTRAINT t_owner;             -- 3. a later transaction, no write lock
+   ALTER TABLE t ALTER COLUMN owner_id SET NOT NULL;      -- 4. the valid check skips the scan
+   ALTER TABLE t DROP CONSTRAINT t_owner;
+   ```
+4. Add a foreign key: `ADD CONSTRAINT ... NOT VALID`, then `VALIDATE CONSTRAINT` in a later transaction. In one transaction it gains nothing.
+5. Add a unique constraint: `CREATE UNIQUE INDEX CONCURRENTLY`, then `ADD CONSTRAINT ... UNIQUE USING INDEX`.
+6. Change a type: check first whether it rewrites. `varchar` to `text` does not. Most others do: add a new column, write both, backfill, switch reads, drop the old one.
+7. A failed `CONCURRENTLY` leaves an invalid index: drop it, then build it again.
+8. Set a short `lock_timeout` on a statement that takes a strong lock, and retry it.
+9. Deploy the code that can read both shapes first, and drop what is old only after nothing reads it.
+
+Never do:
+- Backfill a large table in one `UPDATE`.
+- Rename a column in one step while old code still runs.
+- Refuse `now()` or a constant default as unsafe: since PostgreSQL 11 both are instant.
+</constraints>

package/packs/reverse-engineering/rules/addresses-name-their-space.md

@@ -7,6 +7,7 @@
 <constraints>
 Always do:
 - Say what each address is: a file offset, a CPU address, a physical address, `seg:off`, a DSP `P:`, `X:` or `Y:` address, or a word index. Record the load map, and prove a base by scoring.
+- Read a strictly rising run of 16-bit values as a pointer table or paired bytes until shown otherwise, never as a curve: check whether its values are CPU addresses in its own bank first.
 - Find a table's own start and end before reading it. A `[FW]` tag covers the bytes, the boundary and the role separately.
 - Index records by their marker over the whole image, and state the count and the gaps. A scan of one range found 47 of 174.
 - Make an unpacked image answer "was this address ever written?". A zero read past where the loader stopped is unknown, and one blocked a law for a whole phase.

package/packs/reverse-engineering/rules/reproduction-or-original.md

@@ -14,5 +14,5 @@ Always do:
 
 Never do:
 - Invent a global control on a reproduction. It rewrites every preset.
-- Copy the machine's artwork: same sections, positions and labels, drawn your own way.
+- Copy the machine's artwork, unless the brief asks for it and `"guards": { "instrument": { "artwork": "verbatim" } }` says so. By default a reproduction has the same sections, positions and labels, drawn your own way. With `"artwork": "verbatim"` the picture is the spec, and whoever ships it decides whether they may: log that as an open question.
 </constraints>

package/packs/reverse-engineering/skills/gather-sources/SKILL.md

@@ -15,6 +15,7 @@ Always do:
 6. Read the disk OS's own strings.
 7. Check the tool table before writing a disassembler.
 8. Take ratios from a redrawn trace, never absolutes.
+9. A source that exists and cannot be fetched (the host refuses automated access, the file is behind a login): record its name, where it is, what refused, and what it would have settled, in the project's decisions. Mark what rests on its absence as a `[gap]`, ask the user for the file when a person is there, and go on with the next source.
 
 Never do:
 - Start the disassembly before steps 1 to 4.

package/packs/rust/checks/rust-allow-needs-reason.json

@@ -0,0 +1,16 @@
+{
+  "id": "rust-allow-needs-reason",
+  "why": "A lint turned off with no reason stays off long after the reason is gone.",
+  "rule": ".claude/rules/rust-lints-are-the-gate.md",
+  "globs": [
+    "**/*.rs"
+  ],
+  "exclude": [
+    "**/target/**",
+    "**/vendor/**"
+  ],
+  "language": "rust",
+  "pattern": "#!?\\[\\s*(?:allow|expect)\\s*\\((?![^\\]]*\\breason\\s*=)",
+  "bad": "#[allow(dead_code)]\nfn old() {}",
+  "good": "#[expect(dead_code, reason = \"called from the FFI side\")]\nfn old() {}"
+}

package/packs/rust/checks/rust-blocking-in-async.json

@@ -0,0 +1,32 @@
+{
+  "id": "rust-blocking-in-async",
+  "why": "A blocking call in an async fn stops every task on that thread. Hand it to spawn_blocking, or use the runtime's own version.",
+  "rule": ".claude/rules/rust-async-never-blocks.md",
+  "globs": [
+    "**/*.rs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/benches/**",
+    "**/examples/**",
+    "**/fixtures/**",
+    "**/test_data/**",
+    "**/testdata/**",
+    "**/fuzz/**",
+    "**/xtask/**",
+    "**/target/**",
+    "**/vendor/**",
+    "**/build.rs",
+    "**/tests.rs",
+    "**/test.rs",
+    "**/*_test.rs",
+    "**/*_tests.rs",
+    "**/test_*.rs"
+  ],
+  "language": "rust",
+  "notInTests": true,
+  "pattern": "\\basync\\s+fn\\b[^{;]*\\{(?:(?!\\bfn\\b|\\|\\||\\bmove\\s*\\||\\bspawn\\w*\\s*\\(|\\bunblock\\s*\\()[^}])*?\\b(?:thread::sleep|std::fs::\\w+|std::process::Command::new)\\s*\\(",
+  "bad": "async fn wait() {\n    std::thread::sleep(ONE_SECOND);\n}",
+  "good": "async fn wait() {\n    tokio::time::sleep(ONE_SECOND).await;\n}"
+}

package/packs/rust/checks/rust-if-chain-is-a-match.json

@@ -0,0 +1,32 @@
+{
+  "id": "rust-if-chain-is-a-match",
+  "why": "Three branches on one value are a match, which the compiler can hold to every case. A comparison a pattern cannot express is left alone.",
+  "rule": ".claude/rules/rust-repeats-become-templates.md",
+  "globs": [
+    "**/*.rs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/benches/**",
+    "**/examples/**",
+    "**/fixtures/**",
+    "**/test_data/**",
+    "**/testdata/**",
+    "**/fuzz/**",
+    "**/xtask/**",
+    "**/target/**",
+    "**/vendor/**",
+    "**/build.rs",
+    "**/tests.rs",
+    "**/test.rs",
+    "**/*_test.rs",
+    "**/*_tests.rs",
+    "**/test_*.rs"
+  ],
+  "language": "rust",
+  "notInTests": true,
+  "pattern": "\\bif\\s+([\\w.]+)\\s*==\\s*(?:[A-Z]\\w*::[A-Z]\\w*|\"\\s*\"|-?\\d[\\w.]*)\\s*\\{(?:[^{}]|\\{[^{}]*\\})*\\}\\s*else\\s+if\\s+\\1\\s*==\\s*(?:[A-Z]\\w*::[A-Z]\\w*|\"\\s*\"|-?\\d[\\w.]*)\\s*\\{(?:[^{}]|\\{[^{}]*\\})*\\}\\s*else\\s+if\\s+\\1\\s*==\\s*(?:[A-Z]\\w*::[A-Z]\\w*|\"\\s*\"|-?\\d[\\w.]*)\\s*\\{",
+  "bad": "if kind == Kind::A {\n    1\n} else if kind == Kind::B {\n    2\n} else if kind == Kind::C {\n    3\n}",
+  "good": "match kind {\n    Kind::A => 1,\n    Kind::B => 2,\n    Kind::C => 3,\n    _ => 0,\n}"
+}

package/packs/rust/checks/rust-static-mut.json

@@ -0,0 +1,32 @@
+{
+  "id": "rust-static-mut",
+  "why": "A static mut is a data race the compiler stopped checking. An extern declaration has no initializer and is left alone.",
+  "rule": ".claude/rules/rust-unsafe-is-proved.md",
+  "globs": [
+    "**/*.rs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/benches/**",
+    "**/examples/**",
+    "**/fixtures/**",
+    "**/test_data/**",
+    "**/testdata/**",
+    "**/fuzz/**",
+    "**/xtask/**",
+    "**/target/**",
+    "**/vendor/**",
+    "**/build.rs",
+    "**/tests.rs",
+    "**/test.rs",
+    "**/*_test.rs",
+    "**/*_tests.rs",
+    "**/test_*.rs"
+  ],
+  "language": "rust",
+  "notInTests": true,
+  "pattern": "(?<!')\\bstatic\\s+mut\\s+\\w+\\s*:[^;=]*=",
+  "bad": "static mut COUNT: u32 = 0;",
+  "good": "static COUNT: AtomicU32 = AtomicU32::new(0);"
+}

package/packs/rust/checks/rust-string-as-error.json

@@ -0,0 +1,34 @@
+{
+  "id": "rust-string-as-error",
+  "why": "An error the caller cannot match on can only be printed. A public function returns a type of its own.",
+  "rule": ".claude/rules/rust-errors-are-returned.md",
+  "globs": [
+    "**/*.rs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/benches/**",
+    "**/examples/**",
+    "**/fixtures/**",
+    "**/test_data/**",
+    "**/testdata/**",
+    "**/fuzz/**",
+    "**/xtask/**",
+    "**/target/**",
+    "**/vendor/**",
+    "**/build.rs",
+    "**/tests.rs",
+    "**/test.rs",
+    "**/*_test.rs",
+    "**/*_tests.rs",
+    "**/test_*.rs",
+    "**/main.rs",
+    "**/bin/**"
+  ],
+  "language": "rust",
+  "notInTests": true,
+  "pattern": "\\bpub\\s+(?:async\\s+)?fn\\b[^{;]*?->\\s*(?:std::result::)?Result<(?:[^<>(),;{]|\\([^()]*\\)|<(?:[^<>]|<(?:[^<>]|<[^<>]*>)*>)*>)*,\\s*(?:String|&\\'static\\s+str|Box<dyn\\s+(?:std::error::)?Error\\b[^>]*>)\\s*>",
+  "bad": "pub fn parse(s: &str) -> Result<Port, String> { Err(s.to_string()) }",
+  "good": "pub fn parse(s: &str) -> Result<Port, ParseError> { Err(ParseError::Empty) }"
+}

package/packs/rust/checks/rust-stub-left-in.json

@@ -0,0 +1,32 @@
+{
+  "id": "rust-stub-left-in",
+  "why": "A stub or a debug print compiles, so it ships. `unimplemented!` stays allowed: it is a decision, not a leftover.",
+  "rule": ".claude/rules/rust-lints-are-the-gate.md",
+  "globs": [
+    "**/*.rs"
+  ],
+  "exclude": [
+    "**/tests/**",
+    "**/test/**",
+    "**/benches/**",
+    "**/examples/**",
+    "**/fixtures/**",
+    "**/test_data/**",
+    "**/testdata/**",
+    "**/fuzz/**",
+    "**/xtask/**",
+    "**/target/**",
+    "**/vendor/**",
+    "**/build.rs",
+    "**/tests.rs",
+    "**/test.rs",
+    "**/*_test.rs",
+    "**/*_tests.rs",
+    "**/test_*.rs"
+  ],
+  "language": "rust",
+  "notInTests": true,
+  "pattern": "\\b(?:todo|dbg)!\\s*[(\\[{]",
+  "bad": "fn load() -> Config { todo!() }",
+  "good": "fn load() -> Result<Config> { read_config() }"
+}