create-pracht 0.7.0 → 0.7.2

package/README.md

@@ -17,7 +17,7 @@ npm run dev
 - Detects the active package manager from the current environment.
 - Lets the user choose between the Node.js, Cloudflare, Vercel, Netlify, and static adapters.
 - Optionally wires up Tailwind CSS (`tailwindcss` + `@tailwindcss/vite`, a global stylesheet, and the shell import).
-- Scaffolds a minimal app with a route manifest or pages router, shell, home route, not-found page, a sample API route for serverful adapters, runnable project README, TypeScript typecheck script, and (with agent tooling enabled) agent instructions.
+- Scaffolds a minimal app with a route manifest or pages router, shell, home route, not-found page, a sample API route for serverful adapters, runnable project README, TypeScript typecheck script, browser-aware package resolution that rejects server-only root exports in client code, and (with agent tooling enabled) agent instructions.
 - Manifest scaffolds include a commented-out `constraints` example in `src/routes.ts`, ready for `pracht verify`.
 - The generated `.gitignore` keeps `.pracht/app-graph.json` committable, and the README and agent instructions cover the `pracht verify` / `pracht plan` / `pracht report` loop.
 - Every standalone pnpm scaffold includes a narrow lifecycle-script policy for
@@ -100,7 +100,7 @@ writing it would leave a config in the repo that nothing in the repo reads.
 
 - `dev` -> `pracht dev`
 - `build` -> `pracht build`
-- `typecheck` -> `tsc --noEmit`
+- `typecheck` -> checks the server-capable base TypeScript program, then the browser-conditioned routes, shells, and islands in `tsconfig.client.json`
 
 Node starters also include:
 

package/fallback-versions.json

@@ -0,0 +1,20 @@
+{
+  "@pracht/adapter-cloudflare": "^0.8.0",
+  "@pracht/adapter-netlify": "^0.3.0",
+  "@pracht/adapter-node": "^0.5.0",
+  "@pracht/adapter-static": "^0.2.0",
+  "@pracht/adapter-vercel": "^0.4.0",
+  "@pracht/capabilities": "^0.6.0",
+  "@pracht/cli": "^1.15.0",
+  "@pracht/content": "^0.1.4",
+  "@pracht/core": "^0.19.0",
+  "@pracht/i18n": "^0.1.5",
+  "@pracht/image": "^0.5.0",
+  "@pracht/markdown": "^0.1.4",
+  "@pracht/openapi": "^0.2.6",
+  "@pracht/preact-ssr-precompile": "^0.1.4",
+  "@pracht/query": "^0.1.0",
+  "@pracht/session": "^0.1.2",
+  "@pracht/test": "^0.3.0",
+  "@pracht/vite-plugin": "^0.14.0"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pracht",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Interactive and scriptable starter CLI for creating full-stack Preact apps with Pracht.",
   "keywords": [
     "pracht",
@@ -30,6 +30,7 @@
     "bin",
     "src",
     "skills",
+    "fallback-versions.json",
     "README.md"
   ],
   "type": "module",
@@ -40,6 +41,6 @@
     "provenance": true
   },
   "scripts": {
-    "build": "node ./scripts/sync-skills.js"
+    "build": "node ./scripts/sync-skills.js && node ./scripts/sync-versions.js"
   }
 }

package/skills/add-auth/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: add-auth
-version: 2.1.0
+version: 2.1.1
 description: |
   Wire session-based auth into a pracht app with `@pracht/session`: encrypted
   cookie sessions, gate middleware, login/logout/signup API routes, `<Form>`
@@ -170,23 +170,40 @@ Workers, measure a login against the plan's CPU limit.
 
 ## Step 5: Auth API routes
 
+`src/server/redirects.ts` — the one gate for every request-derived redirect
+target. Never use a `startsWith("/") && !startsWith("//")` prefix check: URL
+parsing turns `\` into `/`, so `/\evil.com` passes it and lands off-origin.
+
+```ts
+export function safeRedirectPath(value: unknown, base: URL, fallback: string): string {
+  if (typeof value !== "string" || !value.startsWith("/")) return fallback;
+  try {
+    const target = new URL(value, base);
+    return target.origin === base.origin
+      ? `${target.pathname}${target.search}${target.hash}`
+      : fallback;
+  } catch {
+    return fallback;
+  }
+}
+```
+
 `src/api/auth/login.ts`:
 
 ```ts
 import { redirect, type ApiRouteArgs } from "@pracht/core";
 
+import { safeRedirectPath } from "../../server/redirects.ts";
 import { sessions } from "../../server/session.ts";
 import { verifyCredentials } from "../../server/users.ts";
 
-export async function POST({ request }: ApiRouteArgs) {
+export async function POST({ request, url }: ApiRouteArgs) {
   const form = await request.formData();
   const email = String(form.get("email") ?? "");
   const password = String(form.get("password") ?? "");
 
   // The redirect field is user input — gate it, or this is an open redirect.
-  const requested = String(form.get("redirect") ?? "/dashboard");
-  const target =
-    requested.startsWith("/") && !requested.startsWith("//") ? requested : "/dashboard";
+  const target = safeRedirectPath(form.get("redirect"), url, "/dashboard");
 
   const user = await verifyCredentials(email, password);
   if (!user) {
@@ -226,11 +243,12 @@ export async function POST({ request }: ApiRouteArgs) {
 ```tsx
 import { Form, type LoaderArgs, type RouteComponentProps } from "@pracht/core";
 
+import { safeRedirectPath } from "../server/redirects.ts";
+
 export async function loader({ url }: LoaderArgs) {
-  const requested = url.searchParams.get("redirect") ?? "/dashboard";
   return {
     error: url.searchParams.get("error") === "1",
-    redirect: requested.startsWith("/") && !requested.startsWith("//") ? requested : "/dashboard",
+    redirect: safeRedirectPath(url.searchParams.get("redirect"), url, "/dashboard"),
   };
 }
 

package/skills/add-capabilities/SKILL.md

@@ -176,11 +176,15 @@ export const CAPABILITIES = ["notes.search"];
 
 `CAPABILITIES` must be an inline array of non-empty registered names and cannot
 appear on `_app` or `404`. In a manifest, group capability lists are additive.
+
 Unknown names, capabilities without `expose.webmcp`, and activation on
 `hydration: "none"` routes are rejected. Initial hydration registers the matched
 route's set; every committed client navigation replaces it, so never assume a
 tool exposed on one page persists globally.
 
+In dev, the tab's `pracht_page_tools` WebMCP tool lists the tools active on
+the route and why a declared capability is not one.
+
 Each `agents` sub-option is independent — add only what the app uses. Web Bot
 Auth `policy: "require"` gates capability HTTP endpoints (not pages or API
 routes) with `401 agent_required`; `agentPolicy: "require"` on a capability
@@ -381,14 +385,13 @@ same prepare/commit round trip as HTTP, with the token in the call's
 `createCapabilityTestHost()` from `@pracht/core` covers the same pipeline in
 unit tests, without a server.
 
-WebMCP specifics `pracht verify` checks: tool names must fit the spec's
-grammar (1–128 ASCII `[a-zA-Z0-9_.-]`); an effective `agentPolicy: "require"`
-makes a page tool dead (unsigned browser fetches always 401 — warned);
-descriptions have advisory budgets (~500 chars per tool, ~150 per schema
-parameter). Hosts: the ChatGPT desktop browser enables the API itself, but
-stable Chrome/Edge visitors only get `document.modelContext` if the page head
-carries an origin-trial token — the docs site's capabilities page shows the
-shell `head()` recipe.
+WebMCP: names must fit the draft's 1–128 ASCII `[a-zA-Z0-9_.-]` grammar;
+Chrome advises 30 chars/name, 500/tool description, 150/parameter description,
+and 1.5K/result. `pracht verify` checks static limits; bound outputs yourself.
+Stable Chrome needs an origin-trial token. No mainstream production agent
+consumes these tools yet, so retain HTTP or remote MCP. See the capabilities
+site page for current compatibility. An effective `agentPolicy: "require"`
+always 401s unsigned page-tool calls and is warned.
 
 To audit what the whole agent surface exposes, run `/audit-agent-surface`.
 

package/skills/add-db/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: add-db
-version: 1.2.0
+version: 1.2.1
 description: |
   Wire Drizzle ORM into a pracht app: pick the target (D1, PlanetScale, Neon,
   Supabase, Turso, Postgres, MySQL, SQLite), then generate driver setup, schema,
@@ -93,11 +93,13 @@ export const db = drizzle(pool, { schema });
 ```
 
 For Cloudflare D1, register the Cloudflare context type once via the `Register`
-augmentation (the pattern in
-`examples/docs/src/routes/docs/recipes-fullstack-cloudflare.md`):
+augmentation. Keep the `import`: without it the file is a global script and the
+declaration replaces `@pracht/core`'s types instead of extending them.
 
 ```ts
 // src/env.d.ts
+import "@pracht/core";
+
 declare module "@pracht/core" {
   interface Register {
     context: {

package/skills/add-images/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: add-images
-version: 1.0.1
+version: 1.1.0
 description: |
   Wire `@pracht/image`: the CLS-safe zero-runtime `<Image>`, the loader for your
-  target (sharp endpoint, Cloudflare, Vercel, passthrough), `?pracht` build-time
+  target (sharp endpoint, Cloudflare, Vercel, Netlify, passthrough), `?pracht` build-time
   imports with blur placeholders, prebuilt WebP variants, and the optimization
   endpoint's security settings.
   Use for "add images", "optimize images", "responsive images", "next/image
@@ -39,6 +39,7 @@ pracht inspect build --json   # adapterTarget (requires a prior `pracht build`)
 | Node | `defaultLoader` + the built-in endpoint | needs `sharp`; put a CDN in front |
 | Cloudflare | `cloudflareLoader` | Image Resizing must be enabled on the zone; sharp does not run on Workers |
 | Vercel | `vercelLoader` | needs an `images` section in the project config; Vercel only serves widths listed in `images.sizes` |
+| Netlify | `netlifyLoader` | Image CDN; remote sources need `images.remote_images` in `netlify.toml`; no sharp endpoint |
 | Static host | `passthroughLoader` | no image service — srcset is omitted |
 | Any target, no runtime service | `?pracht&pracht-static` imports | prebuilt WebP variants, no loader involved |
 
@@ -76,9 +77,22 @@ configureImage({
 
 `createDefaultLoader("/my/endpoint")` builds a default-style loader for a custom
 endpoint path. Root-absolute endpoints pick up Vite's deploy `base`
-automatically; provider loaders (`cloudflareLoader`, `vercelLoader`)
+automatically; provider loaders (`cloudflareLoader`, `vercelLoader`, `netlifyLoader`)
 deliberately stay at the origin root.
 
+For Netlify, use `configureImage({ loader: import.meta.env.DEV ?
+passthroughLoader : netlifyLoader })` so `pracht dev` renders original images.
+Import both loaders from `@pracht/image`. For remote sources, merge the
+allowed URL patterns into the existing `netlify.toml`:
+
+```toml
+[images]
+remote_images = ['https://images\.example\.com/.*']
+```
+
+Local source files need no image-service configuration; Netlify negotiates
+the output format and caches resized images. Skip the Node endpoint step.
+
 ## Step 4: Render images
 
 ```tsx

package/skills/add-observability/SKILL.md

@@ -48,6 +48,12 @@ but trivial.
 
 ## Step 2: Server error tracking
 
+Pracht already prints one line per 5xx to the server console — phase, route id,
+source file, request path, message, and the stack — so the app is not silent
+before any of this is wired. What that default does not give you is a request
+id, a duration, the successful requests, or delivery to a sink off the box.
+Say so when the user only wants "errors in my logs": they may already have it.
+
 ### Sentry path (Node adapter)
 
 The pattern below uses `@sentry/node` and works on the **Node adapter only**
@@ -274,10 +280,13 @@ Key properties to state when scaffolding this:
 - Delivery snapshots the registered sinks before callbacks run. Adding or
   replacing a sink from inside a callback takes effect on the next dispatch,
   so the current event is never delivered twice to one name.
-- On Cloudflare Workers, a batching exporter must flush within the request or
-  be handed the execution context by app code
-  (`context.executionContext.waitUntil(exporter.flush())`). Pracht does not
-  call `ctx.waitUntil()` for a sink.
+- A sink's returned promise is handed to the request's `waitUntil()`, so an
+  `async` sink finishes after the response on every adapter (Cloudflare
+  `ctx.waitUntil`, Netlify/Vercel `context.waitUntil`, Node's shutdown drain)
+  and its rejection is reported. A batching exporter that flushes on its own
+  schedule should be flushed from middleware with
+  `args.waitUntil(exporter.flush())` — never reach for
+  `context.executionContext.waitUntil`.
 - Audit events cover *dispatch* only. A cross-origin 403, an unknown-capability
   404, and an unknown MCP tool name all return before dispatch and emit
   nothing, so do not build a reconnaissance alert on these events — use the

package/skills/audit-agent-surface/SKILL.md

@@ -89,7 +89,8 @@ For every exposed capability, ask whether the exposure is deliberate:
   the tool is dead — every call 401s. Also check that capabilities returning
   user-generated or third-party content set
   `expose.webmcp: { untrustedContent: true }` so hosts treat the output as
-  untrusted.
+  untrusted. Flag `exposedTo` and outputs above 1.5K. Consequential work is
+  `destructive`, so never WebMCP.
 - Private capabilities used as building blocks: `invokeCapability()` runs their
   named middleware but **not** app-level `api.middleware`. Their named
   middleware is the only authorization seam — flag private capabilities with an

package/skills/audit-auth/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: audit-auth
-version: 1.4.0
+version: 1.5.0
 description: |
   Find pracht routes that look protected but aren't: missing auth middleware,
   middleware that augments context but never gates, client-only checks, and
@@ -87,6 +87,13 @@ auth is enforced because `request.headers.get('x-user-id')` returns a value
 when present, but unauthenticated requests just get `null` and the loader has
 to handle it. Flag every loader downstream of an Augmenter that doesn't.
 
+A shell `loader` that redirects anonymous users is **not** a gate either. A
+client that already holds the shell's data sends `x-pracht-shell-data: <shell>`
+on route-state requests and the server skips the shell loader, so the route's
+data comes back without it running. Flag any shell whose loader is the only
+thing between an anonymous request and the routes under it; the gate belongs
+in middleware.
+
 ## Step 2: Identify protected routes
 
 A route is "expected protected" if any of:
@@ -165,6 +172,27 @@ target. From `pracht inspect api --json`:
 - Common bug: dashboard route is protected by middleware, but
   `POST /api/items` is not — attacker bypasses the UI entirely.
 
+### Server islands
+
+Every module in `src/server-islands/` (or `pracht({ serverIslandsDir })`) is
+reachable at `GET /__pracht/server-island` with the visitor's cookies, for any
+page whose route or shell lists it in `export const serverIslands = [...]` —
+with that route's middleware
+(see <https://pracht.resynapse.dev/docs/server-islands#security>). Map each
+server island to the routes that list it, directly or through their shell.
+
+- Flag a server island listed by both gated and ungated routes whose loader
+  returns user-specific data without checking `context` itself — `error`: the
+  ungated route serves it to anyone.
+- Flag pages that gate a server island only at render time
+  (`{isAdmin && <AdminStats />}` behind a loader check, not middleware) —
+  `error`: the endpoint runs it for anyone who passes that route's middleware.
+- Flag server island loaders that pick *whose* data to load from `props`
+  (`userId`, `orderId`, `accountId`) — the caller controls the query string
+  (`error`, IDOR). Identity must come from `context`.
+- Flag server island loaders with side effects (writes, sends) — the endpoint is
+  a `GET` (`warn`).
+
 ## Step 5: Client/server enforcement parity
 
 Grep client components for patterns like `if (!user) return <Login />`. For

package/skills/audit-bundles/SKILL.md

@@ -56,6 +56,14 @@ reference with `dist/client/.vite/manifest.json` for chunk metadata
 (file, imports, dynamicImports, css, isEntry) — needed for vendor fan-in
 analysis (Step 4) and CSS sizing, which the analyze report does not cover.
 
+Size CSS from the `cssManifest` this command reports, never from
+`dist/client/.vite/manifest.json`. A `hydration: "none"` or `"islands"` route is
+absent from the client manifest by construction, so reading it directly reports
+no CSS for a page whose document links a stylesheet — under-reporting exactly
+the routes pracht recommends. `inspect` merges `dist/server/css-manifest.json`,
+the build's own record, over the client manifest; an older build without that
+file is client-only, and the CSS column should say so rather than read as zero.
+
 ## Step 3: Interpret per-route payload
 
 From the Step 1 JSON, report:
@@ -181,6 +189,23 @@ pracht injects per route. Compare `<link rel="stylesheet">` tags in
 that wants Preact inside its own chunks or places `frameworkChunkGroups()`
 itself.
 
+Pracht contributes one group to the **server** build too: each island becomes
+its own chunk, so a route that does not fully hydrate can resolve its CSS from
+that build without inheriting the server entry's merged stylesheet. An app that
+configures SSR chunking composes with it the same way the client side does; a
+group that pulls islands back into the entry shows up as extra `<link
+rel="stylesheet">` tags on static pages, and the build warns.
+
+`build.cssCodeSplit: false` is rejected outright — there is no `index.html` to
+link the single stylesheet it produces, so every page would ship without one.
+
+When a route's CSS is small and the site is entered cold — a static export, a
+content site arriving from search — the stylesheet link is often the only
+render-blocking request left on a page that ships no JavaScript. Report
+`pracht({ inlineCss: true })` as a suggestion there, with the cost: the same
+bytes in every document and no shared stylesheet cache. An app whose visitors
+move between pages should keep the link.
+
 ## Step 7: Report
 
 Three sections:

package/skills/audit-headers/SKILL.md

@@ -121,6 +121,10 @@ into `speculation` (they emit an inline
    `<script id="pracht-state" type="application/json">` — it does not need
    `'unsafe-inline'`. Do not add `'unsafe-inline'` unless the app truly emits
    executable inline scripts and the tradeoff is documented.
+5. Routes with `streaming: true` emit executable inline scripts for deferred
+   data and boundary swaps. Under a nonce policy, return the request nonce as
+   `scriptNonce` from the shell `head()` and allow it in `script-src`; it also
+   covers the speculation rules script.
 
 Output a draft CSP referencing `docs/CSP.md` and explain what each origin is
 for. Do not hand the user a CSP that breaks their site — present as draft.

package/skills/audit-islands/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: audit-islands
-version: 1.0.1
+version: 1.1.0
 description: |
   Audit pracht hydration: over-hydrated routes that should be `hydration:
   "islands"` or `"none"`, dead interactivity outside the islands directory,
@@ -89,9 +89,22 @@ there is no wrapper to mark a component elsewhere as an island.
 Island props are serialized to JSON in the HTML. At each island call site on
 an islands route, flag props that are functions, symbols, bigints, class
 instances (`Date`, `Map`, ...), JSX elements, or circular — rendering throws a
-descriptive error naming the offending prop path. Passing children into an
-island from a server component also throws (unsupported in v1): move the
-content inside the island or pass a serializable prop.
+descriptive error naming the offending prop path. Children passed into an
+island are fine: markup renders once on the server as static HTML, and plain
+text arrives as a string value. Flag:
+
+- a render function passed as children (it throws);
+- children the island expects to re-render or pass props into, and islands
+  among the children that read context the outer island provides (the browser
+  gives them the default) — those belong inside the island or need a prop;
+- an island that splits markup children with `toChildArray`, `Children.map`, or
+  `Children.count` (tabs, carousels): it receives one opaque node, so labels
+  belong in props and panels are toggled through a ref (`hidden`);
+- an island that renders `children` inside `<p>`, `<a>`, or `<button>` while
+  call sites pass block elements, links, or buttons (the dev server throws
+  when it sees this), or raw HTML in children that may be malformed: the
+  browser moves those nodes out of the slot and the island is left unhydrated
+  with a console error.
 
 ### 3d. Hydration strategy tuning (`info`)
 
@@ -115,7 +128,28 @@ navigation to, from, and between them is full-document (MPA-style), and
 route-state prefetching is skipped for them. Flag apps that rely on
 client-side state surviving navigation across such routes (in-memory stores,
 module-level caches shared between pages) — every navigation is a fresh
-document.
+document, unless `pracht({ client: { islandsNavigation: true } })` is set. With
+it, links between islands pages (and from them to `none` pages) swap the page
+into the same document and an island rendered with identical props on both
+pages keeps its state; module state survives too. Still flag state that must
+survive a link to a full-hydration route, a reload, or a browser without the
+Navigation API, since those remain full loads. Page-change animation does not need the client router: with
+`defineApp({ viewTransitions: true })` these documents carry a
+`@view-transition` rule and animate as cross-document view transitions, so
+flag only apps that load extra JavaScript to animate such navigations.
+
+### 3g. Personal data in islands on cached pages (`warn`)
+
+Island props on an `ssg`/`isg` route are fixed at build or regeneration time
+and shared by every visitor. Flag islands that exist only to fetch per-visitor
+content after load (a hand-rolled `fetch` of the session, cart, or "signed in
+as" data in `useEffect`) and islands whose props look personal. Suggest a
+server island instead (`src/server-islands/`, see
+<https://pracht.resynapse.dev/docs/server-islands>): its
+loader runs per request with the route's middleware context, and it may
+contain islands, which hydrate once the server island is swapped in. On
+full-hydration pages islands inside a server island stay static HTML — flag those
+(`warn`) if they are expected to be interactive.
 
 ## Step 4: Report
 
@@ -139,5 +173,7 @@ finding.
    routes.
 4. Verify hydration in a running app via `html[data-pracht-islands-hydrated="true"]`
    (set after all `load` islands hydrate) and per-island `data-hydrated="true"`.
+   Server islands report `html[data-pracht-server-islands-ready="true"]` once every server
+   island fetch the page started has settled, on every hydration mode.
 
 $ARGUMENTS

package/skills/audit-loaders/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: audit-loaders
-version: 1.1.1
+version: 1.2.0
 description: |
   Audit pracht route loaders for serializability, leaked secrets, unsafe
   `loaderCache`, browser-only API use, and missing `AbortSignal` plumbing.
@@ -38,13 +38,22 @@ manifest (`RouteConfig.loader`); the inspect JSON surfaces that as
 `loaderFile` (null when the loader lives in the route module itself). Reading
 only `file` misses every externalized loader.
 
+Shells can export a `loader` too. Read each distinct `shellFile` from the same
+JSON and audit its `loader` like a route's: its return value reaches the
+browser as `shellData` on every page under that shell.
+
 ## Step 2: Run the five checks
 
 For each `loader` (and `getStaticPaths` when present):
 
 ### 2a. Serializability
 
-Flag returns that contain any of:
+Skip this check for `hydration: "islands"` and `"none"` routes: they ship no
+loader data. Otherwise, check `vite.config.*` for
+`pracht({ client: { richData: true } })` first.
+
+Without `richData` (the default), loader data is `JSON.stringify`'d while the
+component's types still promise the original. Flag returns that contain any of:
 
 | Construct                    | Why it breaks                       |
 | ---------------------------- | ----------------------------------- |
@@ -57,6 +66,13 @@ Flag returns that contain any of:
 | `bigint`                     | `JSON.stringify` throws             |
 | `undefined` in arrays/object | Drops keys; arrays become `null`    |
 
+With `richData`, `Date`, `Map`, `Set`, `URL`, `RegExp`, `bigint`, `undefined`,
+and shared or circular references arrive intact: do not flag them. Flag
+functions, symbols, typed arrays, and class instances without `toJSON()`
+(`Error` included) instead: each fails the request with a 500 naming the path,
+in production too. A class instance with `toJSON()` arrives as its output, so
+its type lies.
+
 A bare promise in loader data is always a bug — it serializes to `{}`. The fix
 is `defer(promise)`, which marks the field as deferred and is read in the
 component with `use()` inside a `<Suspense>` boundary. Flag a bare promise as an
@@ -73,7 +89,8 @@ Two `defer()` rules worth checking while you are in the loader:
   behind a getter. An unresolved marker throws during serialization.
 
 Recommend converting to `string` (ISO for dates), plain arrays, or plain objects
-before return.
+before return, or turning on `client.richData` when an app returns many dates
+or maps.
 
 ### 2b. Secret leaks
 

package/skills/audit-redirects/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: audit-redirects
-version: 1.1.1
+version: 1.1.2
 description: |
   Find open redirects in pracht loaders, middleware, and navigation. The framework
   rejects unsafe schemes and CRLF at both ends, but a hand-rolled 3xx Response
@@ -86,16 +86,18 @@ For each request-derived target, look for one of:
 | Gate                                   | Safe? |
 | -------------------------------------- | ----- |
 | Hardcoded allowlist of paths/origins   | Yes   |
-| `target.startsWith('/')` AND `!target.startsWith('//')` | Yes — same-origin path only |
 | `new URL(target, base).origin === url.origin`           | Yes — origin comparison |
+| `target.startsWith('/')` AND `!target.startsWith('//')` | **Bypassable** (`/\evil.example`) |
 | `new URL(target).hostname === expected` | Yes if `expected` is trusted |
 | No check                                | **Open redirect** |
 | `target.includes(domain)` (substring)   | **Bypassable** (`evil.com#yourdomain.com`) |
 | Regex without anchors                   | **Likely bypassable** |
 
-`startsWith('/')` alone is **not** sufficient — `//evil.example/path` parses
-as a protocol-relative URL and most browsers treat it as cross-origin. Require
-both `startsWith('/')` AND `!startsWith('//')`, or use `URL` parsing.
+Prefix checks are **not** sufficient. `//evil.example/path` is
+protocol-relative, and URL parsing turns `\` into `/` and strips tabs and
+newlines, so `/\evil.example` and `/\t/evil.example` pass
+`startsWith('/') && !startsWith('//')` yet land on another origin. Only an
+origin comparison after `new URL(target, url)` is a real gate.
 
 Remember: `redirect()`'s built-in validation covers scheme and CRLF only — it
 happily redirects to any well-formed `http(s)` origin, so Class A sites still
@@ -118,9 +120,21 @@ Severity is the primary scale; the verdict is a secondary domain label:
 For each `open`/`risky` finding, propose a fix snippet, e.g.:
 
 ```ts
-const raw = url.searchParams.get("redirect") ?? "/dashboard";
-const safe = raw.startsWith("/") && !raw.startsWith("//") ? raw : "/dashboard";
-return redirect(safe, { request });
+function safeRedirectPath(value: unknown, base: URL, fallback: string): string {
+  if (typeof value !== "string" || !value.startsWith("/")) return fallback;
+  try {
+    const target = new URL(value, base);
+    return target.origin === base.origin
+      ? `${target.pathname}${target.search}${target.hash}`
+      : fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+return redirect(safeRedirectPath(url.searchParams.get("redirect"), url, "/dashboard"), {
+  request,
+});
 ```
 
 ## Step 5: Cross-check with the framework guards

package/skills/audit-secrets/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: audit-secrets
-version: 1.1.1
+version: 1.2.0
 description: |
   Detect environment variables and secrets reaching the client bundle via loader
   return values, hydration state, or server-only modules imported from client code
@@ -74,8 +74,9 @@ risk in the report.
 
 ## Step 3: Module import boundaries
 
-Grep client-rendered files (route components, shells, anything imported from
-them) for imports of:
+Grep client-rendered files (route components, shells, the app root registered
+as `defineApp({ root })` or `pages/_root.tsx`, anything imported from them) for
+imports of:
 
 - `node:*` builtins
 - `@pracht/adapter-*`
@@ -87,12 +88,22 @@ The Vite plugin strips the server-only exports `loader`, `head`, `headers`,
 query (`middleware` is not a route-file export — middleware lives in the
 manifest); see the client module transform notes in `docs/ARCHITECTURE.md`
 and `docs/ENV.md`. But a component that imports `../server/db` will still
-pull `db` into the client bundle. Flag those imports.
+pull `db` into the client bundle. Flag those imports. The app root's browser
+copy loses only `dehydrate` and the imports nothing else uses; `setup()`,
+`Root`, `hydrate()`, and everything they import ship. A `dehydrate` bound in
+the same destructuring as those (`export const { setup, Root, dehydrate,
+hydrate } = createRoot(…)`) or reached through `export *` ships with them, so
+flag a server-only value passed into that call. A root whose other code calls
+or re-exports `dehydrate` ships whole; flag its server-only imports too.
 
 ## Step 4: Hidden surfaces
 
 Check for accidental exposure outside loaders:
 
+- The app root's `dehydrate()` snapshot: it lands in `pracht-state` as `root`
+  and in every route-state response, like loader data. For `@pracht/query`
+  that is every successful query cached during the request, so flag a
+  `queryFn` or `setQueryData` in a loader that caches a secret-bearing value.
 - `head()` returns: rare, but a `meta` value containing a token leaks into HTML.
 - `headers()` returns: flag values that look like secrets. For SSG/ISG pages,
   document headers enter `dist/server/headers-manifest.json`; every serverful

package/skills/audit-shells/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: audit-shells
-version: 1.3.0
+version: 1.4.0
 description: |
   Audit pracht shells: missing `Loading()` on SPA routes, `<html>`/`<head>`/
   `<body>` rendered inside a shell, shells that never render `children`, unused
@@ -92,6 +92,22 @@ route `headers()`). Optional, but if present:
 - Flag shells whose `headers()` returns `undefined` unconditionally — delete
   the export.
 
+### 2g. `loader` export
+
+Shells may export `loader(args)` for layout-level data, read with
+`useShellData()` in the shell and its routes. If present:
+- Run the audit-loaders checks on it: its return value is serialized into
+  every page under the shell (`shellData` in the hydration state and the
+  route-state JSON).
+- `useShellData()` returns `undefined` while the shell renders without its
+  data (SPA loading state, an error boundary after the shell loader failed).
+  Flag a shell that dereferences it unguarded.
+- Flag a shell loader used as an auth gate (redirecting anonymous users) with
+  no gating middleware on its routes: navigations inside the shell ask the
+  server to skip it. Gate in middleware.
+- Flag several routes under one shell whose loaders each fetch the same
+  layout-level value (the current user): that belongs in the shell loader.
+
 ## Step 3: Coverage and waste
 
 Shell registration is mode-aware — check the `mode` field from the Step 1