liteagents 2.8.0 → 2.8.1

package/CHANGELOG.md

@@ -17,6 +17,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.8.1] - 2026-05-22
+
+### Changed
+- **`/security` and `/ship` rewritten across all four tools (claude, opencode, ampcode, droid).** Both were thin stubs; they're now substantive, stack-agnostic gates that apply to libraries, CLIs, web apps, and services alike.
+  - `/security` leads with the six failure classes that recur in nearly every quickly-built app — secrets committed to the repo, data-access / tenant isolation, rate limiting (including authenticated write routes), error handling past the happy path, authorization-beyond-authentication (IDOR / privilege), and N+1 / unindexed data access — plus a trust-boundary pass (spoofable headers like `X-Forwarded-For`, services bound to `0.0.0.0`, unvalidated untrusted input) and severity-ranked, coverage-auditable output.
+  - `/ship` is now stack-adaptive: it detects the toolchain (`package.json`, `pyproject.toml`, `go.mod`, `Cargo.toml`, `Makefile`) and runs only the checks that exist instead of assuming `npm run lint`/`build`/`migrate`, and adds gates for authorization, rate limiting, data-access scoping, error handling, and secret-scanning before deploy.
+
+### Fixed
+- **`allowed-tools` permission syntax normalized to the canonical colon form** (`Bash(git:*)`) in the claude package's `ship.md`, `security.md`, and `git-commit.md` — the space form (`Bash(git *)`) is not a valid Claude Code permission wildcard. The opencode/ampcode/droid packages retain their existing space-form syntax (their runners parse `allowed-tools` differently, if at all), so there is no behavior change there.
+
+---
+
 ## [2.8.0] - 2026-05-18
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "liteagents",
-  "version": "2.8.0",
+  "version": "2.8.1",
   "description": "AI development toolkit with 11 specialized agents and 23 commands including live-canvas UI design with click-to-annotate feedback. Simple one-question installer for Claude, Opencode, Ampcode, and Droid.",
   "main": "index.js",
   "bin": {

package/packages/ampcode/commands/security.md

@@ -3,19 +3,57 @@ name: security
 description: Scan security [target]
 usage: /security
 argument-hint: [file, directory, or leave empty for full scan]
-allowed-tools: Read, Grep, Glob
+allowed-tools: Read, Grep, Glob, Bash(git log *), Bash(git grep *), Bash(rg *)
 ---
-Audit $ARGUMENTS for security vulnerabilities.
+Audit $ARGUMENTS for security vulnerabilities. Adapt scope to what the target
+actually is — a library, CLI, web app, and service won't all have every
+category. Skip what genuinely doesn't apply; never invent findings to fill a
+section.
 
-## Check For
-- Injection: SQL, command, XSS, template
-- Auth: Weak passwords, session issues, CSRF
-- Data: Exposure, logging secrets, insecure storage
-- Config: Debug mode, default creds, missing headers
-- Dependencies: Known CVEs
+## The recurring six (check every project, where applicable)
+These show up in nearly every quickly-built app regardless of stack:
+
+1. **Secrets in the repo.** Tokens / API keys / `.env` files committed to
+   tracked files or anywhere in git history. Verify `.env` is gitignored and
+   only a value-less `.env.example` is tracked; scan history (`git log -p`,
+   `git grep`) for leaked keys. Secrets must load from env / a secret store at
+   runtime — never hardcoded, never logged.
+2. **Data-access authorization (tenant isolation).** Every record read or
+   written must be scoped to the requesting principal — via DB-level rules
+   (RLS / row policies) and/or application-layer ownership checks. Flag any
+   query that trusts a client-supplied id without an ownership or role gate,
+   and any table/collection with a policy that's too broad or missing.
+3. **Rate limiting.** Every externally reachable endpoint and abuse-prone
+   inbound path is bounded — including **authenticated mutation/write routes**,
+   not just the obvious public GETs. Note any unbounded route.
+4. **Error handling past the happy path.** Third-party / IO / DB failures are
+   caught; nothing fails silently; no internal detail (stack traces, queries,
+   secrets) leaks to the client. Background/async work has its own catch.
+5. **Authorization beyond authentication (IDOR / privilege).** "Logged in" is
+   not "allowed to do this". Confirm ownership AND role/permission checks on
+   every state-changing or privileged action. Mentally swap an id in a request
+   — does it return 403, or does it leak/modify another user's data?
+6. **Inefficient data access (N+1 / unindexed).** Queries inside loops,
+   per-render repeated calls, missing indexes on filtered/joined columns.
+   Correct but falls over under load — a real availability risk.
+
+## Also scan for
+- **Injection:** SQL, command, XSS, template, path traversal.
+- **Auth/session:** weak token handling, CSRF, session fixation, predictable ids.
+- **Trust boundaries:** spoofable headers (e.g. `X-Forwarded-For`) trusted
+  without a vetted proxy; unvalidated untrusted input (uploads, inbound mail,
+  webhooks); services bound to `0.0.0.0` that should be loopback-only.
+- **Config:** debug mode on in prod, default creds, missing security headers,
+  permissive CORS.
+- **Dependencies:** known CVEs; unmaintained or single-maintainer deps in
+  security-critical paths.
 
 ## Output
-Severity-ranked findings with:
-- Location (file:line)
-- Risk explanation
-- Remediation steps
+Severity-ranked findings (Critical → High → Medium → Low), each with:
+- **Location** (`file:line`)
+- **Risk** — what an attacker actually gains
+- **Remediation** — concrete, minimal fix
+
+End with: which of the six classes were checked and found **clean**, and any
+marked **N/A** for this target — so the scan's coverage is auditable, not just
+its hits.

package/packages/ampcode/commands/ship.md

@@ -2,17 +2,39 @@
 name: ship
 description: Check pre-deployment
 usage: /ship
-allowed-tools: Bash(npm *), Bash(git *)
+allowed-tools: Read, Grep, Glob, Bash(git *), Bash(npm *), Bash(pnpm *), Bash(yarn *), Bash(pytest *), Bash(python *), Bash(go *), Bash(cargo *), Bash(make *)
 ---
-Pre-deploy checklist:
+Pre-deploy / pre-merge gate. **Detect the stack first** (look for
+`package.json`, `pyproject.toml`/`setup.cfg`, `go.mod`, `Cargo.toml`,
+`Makefile`) and run only the checks that actually exist — never assume a
+script (`lint`, `build`, `migrate`) is present. Report each item as
+**pass / fail / N/A**.
 
-- [ ] Tests pass (`npm test`)
-- [ ] Lint clean (`npm run lint`)
-- [ ] Build succeeds (`npm run build`)
-- [ ] No console.log/debugger statements
-- [ ] Env vars documented
-- [ ] No hardcoded secrets
-- [ ] Error handling complete
-- [ ] Migrations ready
+## Checklist
+- [ ] **Tests pass** — run the project's real test command (`npm test`,
+      `pytest`, `go test ./...`, `cargo test`, `make test`).
+- [ ] **Lint / format clean** — only if a linter or formatter is configured.
+- [ ] **Build succeeds** — only if the project has a build step.
+- [ ] **No debug leftovers** — stray `console.log` / `print` / `debugger` /
+      `dbg!` / commented-out blocks / blocker `TODO`s in the changed files.
+- [ ] **No hardcoded secrets** — scan the diff. Secrets load from env / a
+      secret store; `.env` is gitignored and only a value-less `.env.example`
+      is tracked.
+- [ ] **Error handling complete** — every new IO / network / DB call has a
+      failure path; nothing fails silently; no internal detail leaks to clients.
+- [ ] **Authorization** — new endpoints/actions check **ownership + role**,
+      not just authentication (no IDOR via id-swapping).
+- [ ] **Rate limiting** — new externally reachable routes, including
+      authenticated writes, are bounded.
+- [ ] **Data access scoped & scales** — new queries are constrained to the
+      requesting principal (no cross-tenant leak) and avoid obvious N+1 /
+      unindexed scans on hot paths.
+- [ ] **Migrations ready** — only if the project has a schema / migrations.
+- [ ] **Docs & config in sync** — `.env.example`, README, and any
+      threat-model / PRD updated for new config or new attack surface.
+- [ ] **Clean tree, correct branch, in sync with `origin`.**
 
-Run checks and report: Ready 🚀 or Blocked 🛑 with issues.
+For any security-sensitive change in the diff, run **`/security`** on the
+changed files before shipping.
+
+Report: **Ready 🚀** or **Blocked 🛑** with the specific failing items.

package/packages/claude/commands/git-commit.md

@@ -2,7 +2,7 @@
 name: git-commit
 description: Analyze changes and commit
 usage: /git-commit
-allowed-tools: Bash(git *)
+allowed-tools: Bash(git:*)
 ---
 1. Run `git diff --staged` to see changes
 2. Analyze what was changed and why

package/packages/claude/commands/security.md

@@ -3,19 +3,57 @@ name: security
 description: Scan security [target]
 usage: /security
 argument-hint: [file, directory, or leave empty for full scan]
-allowed-tools: Read, Grep, Glob
+allowed-tools: Read, Grep, Glob, Bash(git log:*), Bash(git grep:*), Bash(rg:*)
 ---
-Audit $ARGUMENTS for security vulnerabilities.
+Audit $ARGUMENTS for security vulnerabilities. Adapt scope to what the target
+actually is — a library, CLI, web app, and service won't all have every
+category. Skip what genuinely doesn't apply; never invent findings to fill a
+section.
 
-## Check For
-- Injection: SQL, command, XSS, template
-- Auth: Weak passwords, session issues, CSRF
-- Data: Exposure, logging secrets, insecure storage
-- Config: Debug mode, default creds, missing headers
-- Dependencies: Known CVEs
+## The recurring six (check every project, where applicable)
+These show up in nearly every quickly-built app regardless of stack:
+
+1. **Secrets in the repo.** Tokens / API keys / `.env` files committed to
+   tracked files or anywhere in git history. Verify `.env` is gitignored and
+   only a value-less `.env.example` is tracked; scan history (`git log -p`,
+   `git grep`) for leaked keys. Secrets must load from env / a secret store at
+   runtime — never hardcoded, never logged.
+2. **Data-access authorization (tenant isolation).** Every record read or
+   written must be scoped to the requesting principal — via DB-level rules
+   (RLS / row policies) and/or application-layer ownership checks. Flag any
+   query that trusts a client-supplied id without an ownership or role gate,
+   and any table/collection with a policy that's too broad or missing.
+3. **Rate limiting.** Every externally reachable endpoint and abuse-prone
+   inbound path is bounded — including **authenticated mutation/write routes**,
+   not just the obvious public GETs. Note any unbounded route.
+4. **Error handling past the happy path.** Third-party / IO / DB failures are
+   caught; nothing fails silently; no internal detail (stack traces, queries,
+   secrets) leaks to the client. Background/async work has its own catch.
+5. **Authorization beyond authentication (IDOR / privilege).** "Logged in" is
+   not "allowed to do this". Confirm ownership AND role/permission checks on
+   every state-changing or privileged action. Mentally swap an id in a request
+   — does it return 403, or does it leak/modify another user's data?
+6. **Inefficient data access (N+1 / unindexed).** Queries inside loops,
+   per-render repeated calls, missing indexes on filtered/joined columns.
+   Correct but falls over under load — a real availability risk.
+
+## Also scan for
+- **Injection:** SQL, command, XSS, template, path traversal.
+- **Auth/session:** weak token handling, CSRF, session fixation, predictable ids.
+- **Trust boundaries:** spoofable headers (e.g. `X-Forwarded-For`) trusted
+  without a vetted proxy; unvalidated untrusted input (uploads, inbound mail,
+  webhooks); services bound to `0.0.0.0` that should be loopback-only.
+- **Config:** debug mode on in prod, default creds, missing security headers,
+  permissive CORS.
+- **Dependencies:** known CVEs; unmaintained or single-maintainer deps in
+  security-critical paths.
 
 ## Output
-Severity-ranked findings with:
-- Location (file:line)
-- Risk explanation
-- Remediation steps
+Severity-ranked findings (Critical → High → Medium → Low), each with:
+- **Location** (`file:line`)
+- **Risk** — what an attacker actually gains
+- **Remediation** — concrete, minimal fix
+
+End with: which of the six classes were checked and found **clean**, and any
+marked **N/A** for this target — so the scan's coverage is auditable, not just
+its hits.

package/packages/claude/commands/ship.md

@@ -2,17 +2,39 @@
 name: ship
 description: Check pre-deployment
 usage: /ship
-allowed-tools: Bash(npm *), Bash(git *)
+allowed-tools: Read, Grep, Glob, Bash(git:*), Bash(npm:*), Bash(pnpm:*), Bash(yarn:*), Bash(pytest:*), Bash(python:*), Bash(go:*), Bash(cargo:*), Bash(make:*)
 ---
-Pre-deploy checklist:
+Pre-deploy / pre-merge gate. **Detect the stack first** (look for
+`package.json`, `pyproject.toml`/`setup.cfg`, `go.mod`, `Cargo.toml`,
+`Makefile`) and run only the checks that actually exist — never assume a
+script (`lint`, `build`, `migrate`) is present. Report each item as
+**pass / fail / N/A**.
 
-- [ ] Tests pass (`npm test`)
-- [ ] Lint clean (`npm run lint`)
-- [ ] Build succeeds (`npm run build`)
-- [ ] No console.log/debugger statements
-- [ ] Env vars documented
-- [ ] No hardcoded secrets
-- [ ] Error handling complete
-- [ ] Migrations ready
+## Checklist
+- [ ] **Tests pass** — run the project's real test command (`npm test`,
+      `pytest`, `go test ./...`, `cargo test`, `make test`).
+- [ ] **Lint / format clean** — only if a linter or formatter is configured.
+- [ ] **Build succeeds** — only if the project has a build step.
+- [ ] **No debug leftovers** — stray `console.log` / `print` / `debugger` /
+      `dbg!` / commented-out blocks / blocker `TODO`s in the changed files.
+- [ ] **No hardcoded secrets** — scan the diff. Secrets load from env / a
+      secret store; `.env` is gitignored and only a value-less `.env.example`
+      is tracked.
+- [ ] **Error handling complete** — every new IO / network / DB call has a
+      failure path; nothing fails silently; no internal detail leaks to clients.
+- [ ] **Authorization** — new endpoints/actions check **ownership + role**,
+      not just authentication (no IDOR via id-swapping).
+- [ ] **Rate limiting** — new externally reachable routes, including
+      authenticated writes, are bounded.
+- [ ] **Data access scoped & scales** — new queries are constrained to the
+      requesting principal (no cross-tenant leak) and avoid obvious N+1 /
+      unindexed scans on hot paths.
+- [ ] **Migrations ready** — only if the project has a schema / migrations.
+- [ ] **Docs & config in sync** — `.env.example`, README, and any
+      threat-model / PRD updated for new config or new attack surface.
+- [ ] **Clean tree, correct branch, in sync with `origin`.**
 
-Run checks and report: Ready 🚀 or Blocked 🛑 with issues.
+For any security-sensitive change in the diff, run **`/security`** on the
+changed files before shipping.
+
+Report: **Ready 🚀** or **Blocked 🛑** with the specific failing items.

package/packages/droid/commands/security.md

@@ -3,19 +3,57 @@ name: security
 description: Scan security [target]
 usage: /security
 argument-hint: [file, directory, or leave empty for full scan]
-allowed-tools: Read, Grep, Glob
+allowed-tools: Read, Grep, Glob, Bash(git log *), Bash(git grep *), Bash(rg *)
 ---
-Audit $ARGUMENTS for security vulnerabilities.
+Audit $ARGUMENTS for security vulnerabilities. Adapt scope to what the target
+actually is — a library, CLI, web app, and service won't all have every
+category. Skip what genuinely doesn't apply; never invent findings to fill a
+section.
 
-## Check For
-- Injection: SQL, command, XSS, template
-- Auth: Weak passwords, session issues, CSRF
-- Data: Exposure, logging secrets, insecure storage
-- Config: Debug mode, default creds, missing headers
-- Dependencies: Known CVEs
+## The recurring six (check every project, where applicable)
+These show up in nearly every quickly-built app regardless of stack:
+
+1. **Secrets in the repo.** Tokens / API keys / `.env` files committed to
+   tracked files or anywhere in git history. Verify `.env` is gitignored and
+   only a value-less `.env.example` is tracked; scan history (`git log -p`,
+   `git grep`) for leaked keys. Secrets must load from env / a secret store at
+   runtime — never hardcoded, never logged.
+2. **Data-access authorization (tenant isolation).** Every record read or
+   written must be scoped to the requesting principal — via DB-level rules
+   (RLS / row policies) and/or application-layer ownership checks. Flag any
+   query that trusts a client-supplied id without an ownership or role gate,
+   and any table/collection with a policy that's too broad or missing.
+3. **Rate limiting.** Every externally reachable endpoint and abuse-prone
+   inbound path is bounded — including **authenticated mutation/write routes**,
+   not just the obvious public GETs. Note any unbounded route.
+4. **Error handling past the happy path.** Third-party / IO / DB failures are
+   caught; nothing fails silently; no internal detail (stack traces, queries,
+   secrets) leaks to the client. Background/async work has its own catch.
+5. **Authorization beyond authentication (IDOR / privilege).** "Logged in" is
+   not "allowed to do this". Confirm ownership AND role/permission checks on
+   every state-changing or privileged action. Mentally swap an id in a request
+   — does it return 403, or does it leak/modify another user's data?
+6. **Inefficient data access (N+1 / unindexed).** Queries inside loops,
+   per-render repeated calls, missing indexes on filtered/joined columns.
+   Correct but falls over under load — a real availability risk.
+
+## Also scan for
+- **Injection:** SQL, command, XSS, template, path traversal.
+- **Auth/session:** weak token handling, CSRF, session fixation, predictable ids.
+- **Trust boundaries:** spoofable headers (e.g. `X-Forwarded-For`) trusted
+  without a vetted proxy; unvalidated untrusted input (uploads, inbound mail,
+  webhooks); services bound to `0.0.0.0` that should be loopback-only.
+- **Config:** debug mode on in prod, default creds, missing security headers,
+  permissive CORS.
+- **Dependencies:** known CVEs; unmaintained or single-maintainer deps in
+  security-critical paths.
 
 ## Output
-Severity-ranked findings with:
-- Location (file:line)
-- Risk explanation
-- Remediation steps
+Severity-ranked findings (Critical → High → Medium → Low), each with:
+- **Location** (`file:line`)
+- **Risk** — what an attacker actually gains
+- **Remediation** — concrete, minimal fix
+
+End with: which of the six classes were checked and found **clean**, and any
+marked **N/A** for this target — so the scan's coverage is auditable, not just
+its hits.

package/packages/droid/commands/ship.md

@@ -2,17 +2,39 @@
 name: ship
 description: Check pre-deployment
 usage: /ship
-allowed-tools: Bash(npm *), Bash(git *)
+allowed-tools: Read, Grep, Glob, Bash(git *), Bash(npm *), Bash(pnpm *), Bash(yarn *), Bash(pytest *), Bash(python *), Bash(go *), Bash(cargo *), Bash(make *)
 ---
-Pre-deploy checklist:
+Pre-deploy / pre-merge gate. **Detect the stack first** (look for
+`package.json`, `pyproject.toml`/`setup.cfg`, `go.mod`, `Cargo.toml`,
+`Makefile`) and run only the checks that actually exist — never assume a
+script (`lint`, `build`, `migrate`) is present. Report each item as
+**pass / fail / N/A**.
 
-- [ ] Tests pass (`npm test`)
-- [ ] Lint clean (`npm run lint`)
-- [ ] Build succeeds (`npm run build`)
-- [ ] No console.log/debugger statements
-- [ ] Env vars documented
-- [ ] No hardcoded secrets
-- [ ] Error handling complete
-- [ ] Migrations ready
+## Checklist
+- [ ] **Tests pass** — run the project's real test command (`npm test`,
+      `pytest`, `go test ./...`, `cargo test`, `make test`).
+- [ ] **Lint / format clean** — only if a linter or formatter is configured.
+- [ ] **Build succeeds** — only if the project has a build step.
+- [ ] **No debug leftovers** — stray `console.log` / `print` / `debugger` /
+      `dbg!` / commented-out blocks / blocker `TODO`s in the changed files.
+- [ ] **No hardcoded secrets** — scan the diff. Secrets load from env / a
+      secret store; `.env` is gitignored and only a value-less `.env.example`
+      is tracked.
+- [ ] **Error handling complete** — every new IO / network / DB call has a
+      failure path; nothing fails silently; no internal detail leaks to clients.
+- [ ] **Authorization** — new endpoints/actions check **ownership + role**,
+      not just authentication (no IDOR via id-swapping).
+- [ ] **Rate limiting** — new externally reachable routes, including
+      authenticated writes, are bounded.
+- [ ] **Data access scoped & scales** — new queries are constrained to the
+      requesting principal (no cross-tenant leak) and avoid obvious N+1 /
+      unindexed scans on hot paths.
+- [ ] **Migrations ready** — only if the project has a schema / migrations.
+- [ ] **Docs & config in sync** — `.env.example`, README, and any
+      threat-model / PRD updated for new config or new attack surface.
+- [ ] **Clean tree, correct branch, in sync with `origin`.**
 
-Run checks and report: Ready 🚀 or Blocked 🛑 with issues.
+For any security-sensitive change in the diff, run **`/security`** on the
+changed files before shipping.
+
+Report: **Ready 🚀** or **Blocked 🛑** with the specific failing items.

package/packages/opencode/command/security.md

@@ -3,19 +3,57 @@ name: security
 description: Scan security [target]
 usage: /security
 argument-hint: [file, directory, or leave empty for full scan]
-allowed-tools: Read, Grep, Glob
+allowed-tools: Read, Grep, Glob, Bash(git log *), Bash(git grep *), Bash(rg *)
 ---
-Audit $ARGUMENTS for security vulnerabilities.
+Audit $ARGUMENTS for security vulnerabilities. Adapt scope to what the target
+actually is — a library, CLI, web app, and service won't all have every
+category. Skip what genuinely doesn't apply; never invent findings to fill a
+section.
 
-## Check For
-- Injection: SQL, command, XSS, template
-- Auth: Weak passwords, session issues, CSRF
-- Data: Exposure, logging secrets, insecure storage
-- Config: Debug mode, default creds, missing headers
-- Dependencies: Known CVEs
+## The recurring six (check every project, where applicable)
+These show up in nearly every quickly-built app regardless of stack:
+
+1. **Secrets in the repo.** Tokens / API keys / `.env` files committed to
+   tracked files or anywhere in git history. Verify `.env` is gitignored and
+   only a value-less `.env.example` is tracked; scan history (`git log -p`,
+   `git grep`) for leaked keys. Secrets must load from env / a secret store at
+   runtime — never hardcoded, never logged.
+2. **Data-access authorization (tenant isolation).** Every record read or
+   written must be scoped to the requesting principal — via DB-level rules
+   (RLS / row policies) and/or application-layer ownership checks. Flag any
+   query that trusts a client-supplied id without an ownership or role gate,
+   and any table/collection with a policy that's too broad or missing.
+3. **Rate limiting.** Every externally reachable endpoint and abuse-prone
+   inbound path is bounded — including **authenticated mutation/write routes**,
+   not just the obvious public GETs. Note any unbounded route.
+4. **Error handling past the happy path.** Third-party / IO / DB failures are
+   caught; nothing fails silently; no internal detail (stack traces, queries,
+   secrets) leaks to the client. Background/async work has its own catch.
+5. **Authorization beyond authentication (IDOR / privilege).** "Logged in" is
+   not "allowed to do this". Confirm ownership AND role/permission checks on
+   every state-changing or privileged action. Mentally swap an id in a request
+   — does it return 403, or does it leak/modify another user's data?
+6. **Inefficient data access (N+1 / unindexed).** Queries inside loops,
+   per-render repeated calls, missing indexes on filtered/joined columns.
+   Correct but falls over under load — a real availability risk.
+
+## Also scan for
+- **Injection:** SQL, command, XSS, template, path traversal.
+- **Auth/session:** weak token handling, CSRF, session fixation, predictable ids.
+- **Trust boundaries:** spoofable headers (e.g. `X-Forwarded-For`) trusted
+  without a vetted proxy; unvalidated untrusted input (uploads, inbound mail,
+  webhooks); services bound to `0.0.0.0` that should be loopback-only.
+- **Config:** debug mode on in prod, default creds, missing security headers,
+  permissive CORS.
+- **Dependencies:** known CVEs; unmaintained or single-maintainer deps in
+  security-critical paths.
 
 ## Output
-Severity-ranked findings with:
-- Location (file:line)
-- Risk explanation
-- Remediation steps
+Severity-ranked findings (Critical → High → Medium → Low), each with:
+- **Location** (`file:line`)
+- **Risk** — what an attacker actually gains
+- **Remediation** — concrete, minimal fix
+
+End with: which of the six classes were checked and found **clean**, and any
+marked **N/A** for this target — so the scan's coverage is auditable, not just
+its hits.

package/packages/opencode/command/ship.md

@@ -2,17 +2,39 @@
 name: ship
 description: Check pre-deployment
 usage: /ship
-allowed-tools: Bash(npm *), Bash(git *)
+allowed-tools: Read, Grep, Glob, Bash(git *), Bash(npm *), Bash(pnpm *), Bash(yarn *), Bash(pytest *), Bash(python *), Bash(go *), Bash(cargo *), Bash(make *)
 ---
-Pre-deploy checklist:
+Pre-deploy / pre-merge gate. **Detect the stack first** (look for
+`package.json`, `pyproject.toml`/`setup.cfg`, `go.mod`, `Cargo.toml`,
+`Makefile`) and run only the checks that actually exist — never assume a
+script (`lint`, `build`, `migrate`) is present. Report each item as
+**pass / fail / N/A**.
 
-- [ ] Tests pass (`npm test`)
-- [ ] Lint clean (`npm run lint`)
-- [ ] Build succeeds (`npm run build`)
-- [ ] No console.log/debugger statements
-- [ ] Env vars documented
-- [ ] No hardcoded secrets
-- [ ] Error handling complete
-- [ ] Migrations ready
+## Checklist
+- [ ] **Tests pass** — run the project's real test command (`npm test`,
+      `pytest`, `go test ./...`, `cargo test`, `make test`).
+- [ ] **Lint / format clean** — only if a linter or formatter is configured.
+- [ ] **Build succeeds** — only if the project has a build step.
+- [ ] **No debug leftovers** — stray `console.log` / `print` / `debugger` /
+      `dbg!` / commented-out blocks / blocker `TODO`s in the changed files.
+- [ ] **No hardcoded secrets** — scan the diff. Secrets load from env / a
+      secret store; `.env` is gitignored and only a value-less `.env.example`
+      is tracked.
+- [ ] **Error handling complete** — every new IO / network / DB call has a
+      failure path; nothing fails silently; no internal detail leaks to clients.
+- [ ] **Authorization** — new endpoints/actions check **ownership + role**,
+      not just authentication (no IDOR via id-swapping).
+- [ ] **Rate limiting** — new externally reachable routes, including
+      authenticated writes, are bounded.
+- [ ] **Data access scoped & scales** — new queries are constrained to the
+      requesting principal (no cross-tenant leak) and avoid obvious N+1 /
+      unindexed scans on hot paths.
+- [ ] **Migrations ready** — only if the project has a schema / migrations.
+- [ ] **Docs & config in sync** — `.env.example`, README, and any
+      threat-model / PRD updated for new config or new attack surface.
+- [ ] **Clean tree, correct branch, in sync with `origin`.**
 
-Run checks and report: Ready 🚀 or Blocked 🛑 with issues.
+For any security-sensitive change in the diff, run **`/security`** on the
+changed files before shipping.
+
+Report: **Ready 🚀** or **Blocked 🛑** with the specific failing items.