reviewer-harness 1.5.0 → 1.6.0

package/package.json

@@ -3,7 +3,7 @@
   "bin": {
     "reviewer-harness": "./bin/cli.js"
   },
-  "description": "Your own AI harness — one master config that syncs guardrail rules, skills, and a local memory to Claude, OpenCode, Gemini, Cline, Freebuff, Copilot CLI, and Antigravity. No API key, no dependencies.",
+  "description": "Your own AI harness \u2014 one master config that syncs guardrail rules, skills, and a local memory to Claude, OpenCode, Gemini, Cline, Freebuff, Copilot CLI, and Antigravity. No API key, no dependencies.",
   "engines": {
     "node": ">=18"
   },
@@ -26,7 +26,7 @@
     "url": "https://github.com/xcell321/reviewer-harness.git"
   },
   "type": "module",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "files": [
     "bin",
     "lib",
@@ -34,4 +34,4 @@
     "agents",
     "commands"
   ]
-}
+}

package/skills/api-security.md

@@ -0,0 +1,37 @@
+---
+name: api-security
+description: 12 API security rules — apply to every backend endpoint you build or review. No anonymous backdoors, no leaked secrets.
+---
+
+## Skill: api-security
+
+When to use: building or reviewing any API — REST, GraphQL, or internal endpoints.
+
+Apply these 12 rules to every endpoint. If a rule doesn't apply, say why.
+
+### Authentication & Access
+1. **Authenticate every call.** No anonymous backdoors. Every endpoint requires a valid credential — no "internal" or "debug" routes left open.
+2. **Check object access.** Verify the caller owns the resource: *your* ID, not anyone's ID. Never trust an ID from the request without checking ownership.
+3. **Use least-privilege keys.** Read-only keys where possible. Separate keys per environment. Never reuse an admin key for a client.
+
+### Input & Transport
+4. **Validate input.** Reject what you didn't expect. Whitelist shapes with a schema (e.g. Zod); never trust raw request bodies, query params, or headers.
+5. **HTTPS only.** No plain-text tokens, ever. Redirect HTTP to HTTPS. Set Secure cookies.
+6. **No secrets in URLs.** URLs end up in logs, browser history, and referrer headers. Put tokens in headers, never in query strings or paths.
+
+### Tokens & Sessions
+7. **Short-lived tokens.** Leaks expire fast. Access tokens in minutes, refresh tokens in days — never permanent. Rotate on sensitive actions.
+8. **Rate limit.** Slow down brute force. Throttle auth endpoints aggressively (e.g. 5 attempts/minute); throttle the rest by reasonable use.
+
+### Observability & Hygiene
+9. **Log auth failures.** Spot attacks early. Log failed logins, invalid tokens, and permission denials with IP and timestamp — but never log the secret itself.
+10. **Version your API.** Retire old weak endpoints. Keep `/v1`, `/v2` explicit; deprecate with a sunset date, don't silently change behavior.
+11. **Limit response data.** Send only what's needed. Don't return full user objects, internal IDs, or stack traces to clients. Filter fields per role.
+12. **Inventory endpoints.** You can't guard what you forgot. Keep a list of every route; audit it when adding features. Remove dead endpoints.
+
+### Quick check before shipping
+- [ ] Every route has auth (or a documented reason it doesn't)
+- [ ] IDs in requests are ownership-checked
+- [ ] Inputs are schema-validated
+- [ ] No secrets in URLs or logs
+- [ ] Auth endpoints are rate-limited

package/skills/ux-edge-states.md

@@ -0,0 +1,37 @@
+---
+name: ux-edge-states
+description: 10 UX states beyond the happy path — design every screen for empty, loading, error, offline, and success. The real test is what the UI does when nothing goes right.
+---
+
+## Skill: ux-edge-states
+
+When to use: building or reviewing any screen, page, or component.
+
+Your product works when everything goes right. The real test is what it does when nothing does. Run every screen through these 10 states before calling it done.
+
+### States to design
+1. **Empty state.** What does the screen say before there is any data? Never show a blank page. Explain what's missing and give a clear next action ("No sessions yet — create one").
+2. **Loading state.** Make the wait feel short. Show a skeleton or spinner immediately; never freeze the UI with no feedback. For long waits, show progress.
+3. **Error state.** Say what went wrong *and how to fix it*. "Something went wrong" is not enough. Include the cause and the recovery step ("Connection failed — check the backend is running, then Retry").
+4. **No internet.** Never leave the user staring at a blank screen. Detect offline, show a clear banner, and queue actions for retry when back online.
+5. **Slow network.** Show progress, not a frozen spinner. Use timeouts with friendly messages; allow cancel. Distinguish "loading" from "stuck".
+6. **No search results.** Suggest something instead of a dead end. Show "No results for X" plus alternatives: clear filters, related items, or a create action.
+7. **Permission denied.** Explain why and give a way back. Don't just hide the button — tell the user what permission is missing and how to get it (or who to ask).
+8. **Session expired.** Save their work before logging out. Warn before expiry when possible; preserve form input and drafts across re-auth.
+9. **Form validation.** Flag the mistake the moment it happens, not after submit. Inline errors next to the field; explain the rule ("Password needs 8+ characters").
+10. **Success state.** Confirm it, celebrate it, then show what is next. A toast or checkmark plus the logical next action ("Session created — add your first terminal").
+
+### Quick check before shipping
+- [ ] Empty: screen explains what's missing + next action
+- [ ] Loading: immediate feedback, no frozen UI
+- [ ] Error: cause + recovery step, not just "failed"
+- [ ] Offline/slow: detected and communicated
+- [ ] Validation: inline, immediate, explanatory
+- [ ] Success: confirmed + next step shown
+
+### Anti-patterns
+- Blank screens with no explanation.
+- Generic "Something went wrong" with no recovery path.
+- Spinners that never resolve and can't be cancelled.
+- Losing user input on error, expiry, or navigation.
+- Dead-end "no results" with no suggestions.