rust-intel-cc 0.4.5

package/commands/rust-intel-cc/audit.md

@@ -0,0 +1,112 @@
+---
+description: Scan Rust code against the categories from rust-intel and return a triaged report with concrete fixes.
+argument-hint: "[path]"
+---
+
+# /rust-cc-audit
+
+Audits Rust code against the full taxonomy in the `rust-intel` skill. Removes the developer's need to know every category — finds what a senior reviewer with that document in their head would catch.
+
+## Arguments
+
+- `$ARGUMENTS` — path to a file, directory, or crate. Defaults to the current working directory.
+
+## Process
+
+1. **Load the `rust-intel` skill.** This is the only source of rules. If the skill is unavailable, emit `⚠️ BLOCKED: skill rust-intel is not registered` and stop.
+
+2. **Pin the world.** Read `Cargo.toml` (and `CLAUDE.md`, if present). Record the exact versions of `tokio`, `axum`, `sqlx`, `reqwest`, `serde`, `hyper`, `clap`, and any other key dependency. Without this, §A1 (API hallucinations) cannot be checked — block instead of guessing.
+
+3. **Determine scope.**
+   - If `$ARGUMENTS` is empty: walk `src/**/*.rs` relative to cwd.
+   - If a file: just that file.
+   - If a directory: every `*.rs` recursively, excluding `target/`.
+   - Skip generated code (`OUT_DIR`, `build.rs` output).
+
+   **Fan-out preferred for broad scope.** For a whole-crate or directory scope, prefer the fan-out workflow from the skill's "Running a full pass" section — the shipped `audit-project.workflow.js` (one agent per module, async split into two). The serial walk below is the fallback for a single file or when the Workflow tool is unavailable.
+
+4. **Walk every category in the skill.** Iterate from §A1 through the final Tier F category (§F4) as enumerated in the `rust-intel` skill. For each, apply that category's BANNED/REQUIRED rules verbatim from the skill — do not re-state them here. The skill is the single source of rule wording; this command is the workflow harness. Note that Tier E is a different axis — systemic cost (performance), not correctness — and is entirely 🟡/🟢, never 🔴. Tier F is reviewed with a different stance (see the skill's "Tier F — how to review for meaning"): first obtain the named spec/reference and the project's own guarantee-bearing docs (README, SECURITY.md, design docs), extract the mandated behaviors/guarantees into a checklist, then check the code against that list — enumerate, don't sample. If a claimed reference is unavailable, report "conformance to <X> not verified — reference not available" as a finding.
+
+5. **For every finding, produce:**
+   - **Category:** `§XN — name`
+   - **File:line:column** (or line range for multiline patterns)
+   - **Citation** of the relevant fragment (3–10 lines of context)
+   - **Why it's dangerous** — one sentence referencing the spec's wording
+   - **Concrete fix** — a patch or code that applies to this file (not generic advice like "use a bounded channel")
+   - **Severity:** `critical` (silent data loss / UB / leak / deadlock), `high` (probable production bug), `medium` (antipattern with no immediate risk), `info` (style).
+
+6. **Report grouping:**
+   - By severity (critical → info).
+   - Inside a severity, by tier (A → B → C → D → E → F).
+   - End with a Post-flight summary in the spec's canonical form: surface **only** the 🔴-tier occurrences — see the `rust-intel` skill's *Enforcement tiers* for the canonical list (it is the single source; do not duplicate it here). Do not enumerate 🟢-tier items (`unwrap`/`expect`, `clone_on_copy`, narrowing `as` casts, etc.) — those are left to clippy. Non-🔴 antipatterns surfaced as individual findings above stay there; they are not re-aggregated into the summary. Tier E (systemic cost / perf) is entirely 🟡/🟢, so it never surfaces in the Post-flight summary either — perf findings appear as ordinary findings above, like any other non-🔴 antipattern.
+
+## Report format
+
+```
+# rust-cc-audit report
+
+**Scope:** <path>
+**Pinned versions:** tokio=X.Y, sqlx=A.B, ...
+**Found:** N critical, M high, K medium, L info
+
+---
+
+## CRITICAL
+
+### [§B2] src/handler.rs:47–52 — Mutex held across .await
+```rust
+let guard = state.lock().unwrap();
+let value = guard.get(&key).cloned();
+some_async_op(value).await  // ← guard still alive
+```
+**Why dangerous:** `std::sync::Mutex` blocks the tokio worker across `.await` — deadlocks under load.
+**Fix:**
+```rust
+let value = {
+    let guard = state.lock().unwrap();
+    guard.get(&key).cloned()
+};  // guard dropped before .await
+some_async_op(value).await
+```
+
+### [§B8] src/notifier.rs:88 — Forgotten .await
+...
+
+---
+
+## HIGH
+...
+
+---
+
+## Post-flight summary
+
+Surface **only** the 🔴-tier occurrences — see the `rust-intel` skill's *Enforcement tiers* for the canonical list (it is the single source). 🟢-tier items (`unwrap`/`expect`, `clone_on_copy`, narrowing `as` casts) are left to clippy and are not listed here. The lines below are an illustrative shape, not the authoritative inventory.
+
+- `unsafe` / `transmute` / `mem::uninitialized`/`zeroed` (§B5): none
+- Crypto calls — library / primitive / params (§B12): none
+- New `Cargo.toml` dependencies — name + version + justification (§A1): none
+- Manual `unsafe impl Send`/`Sync` (§B18): none
+- `unbounded_channel` / unbounded `FuturesUnordered` (§B14): 1 (src/events.rs:14 — unjustified)
+- atomic `Relaxed`-publish to another thread (§B13): none
+- `tokio::spawn` whose `JoinHandle` is dropped (§B21): none
+- `impl Drop` doing async work (§B22): none
+- `==`/`!=` on secret material (§B24): none
+- `extern "C"` / `Box::from_raw` / `from_raw_parts` (§B25): none
+- `Pin::new_unchecked` (§B15b): none
+- Blanket impl in a public API (§C1): none
+- Spec / documented-guarantee divergence on a wire format, security guarantee, or persisted data (§F1/§F2): none
+- Leaked / unclosed boundary resource an untrusted peer can hold open (§F3): none
+```
+
+## Behavioral principles
+
+- **Don't invent findings.** If a category isn't activated, don't mention it. A short report beats a synthetic one.
+- **Don't "fix" in the repo.** Report only. Applying fixes is a separate step the user authorizes.
+- **Block on uncertainty.** If a crate version is unknown and §A1 needs it, emit a blocking message — don't guess.
+- **Don't restate the spec.** Reference the paragraph (`§B2`) instead of paraphrasing its text.
+
+## Limits
+
+- This is static analysis via reading. It doesn't replace `cargo clippy`, `miri`, `tokio-console`, `loom` — the spec's Post-flight checklist still recommends them explicitly.
+- Categories that need runtime observation (steady-state memory growth for §B10) can only be flagged as "candidate" — not confirmed without profiling.

package/commands/rust-intel-cc/fix.md

@@ -0,0 +1,137 @@
+---
+description: Maps an error (rustc / clippy / panic / runtime anomaly) onto a rust-intel category and proposes a root-cause fix.
+argument-hint: "<error message or behavior description>"
+---
+
+# /rust-cc-fix
+
+Removes the developer's need to navigate rustc docs and StackOverflow. Takes a symptom — returns the cause, the fix, **and** a preventive rule so it doesn't recur.
+
+## Arguments
+
+- `$ARGUMENTS` — a `rustc` message, `cargo clippy` output, panic backtrace, or runtime-behavior description in natural language. May be multiline.
+
+## Process
+
+1. **Load the `rust-intel` skill.** If unavailable, emit `⚠️ BLOCKED: skill rust-intel is not registered` and stop.
+
+2. **Classify the input:**
+   - Compiler error (has `error[EXXXX]` or `error:` marker).
+   - Clippy warning (has `warning: ... #[warn(clippy::...)]`).
+   - Panic / runtime stack trace (has `thread 'main' panicked` or a backtrace).
+   - Natural-language anomaly (deadlock, OOM, slow, intermittent flake).
+
+3. **Request context when needed:**
+   - For a compiler error — need the relevant source lines (or the file path). If neither is provided, ask. **Don't guess.**
+   - For runtime symptoms — need `Cargo.toml` for versions and a repro scenario, if the category depends on either (§A1, §B4).
+   - If context is insufficient, emit a blocking message in the spec's canonical form.
+
+4. **Map to a category.** Use the routing table below — it is **only a router** (symptom → category number). The actual rule wording, BANNED/REQUIRED bullets, and remediation guidance live in the skill, never duplicated here. Whenever a new category lands in the `rust-intel` skill, extend this routing table accordingly. Table is non-exhaustive — when no row matches, read the spec's taxonomy directly.
+
+   | Symptom | Category |
+   |---|---|
+   | E0433, E0432, E0425, E0412, E0405 | §A1 (project organization, API hallucination) |
+   | E0277, E0308, E0599, E0407 | out-of-scope (compile-only — rustc's message is sufficient). But scan the reflexive "fix" for §A2 (reflexive `Arc<Mutex<T>>`), §A3 (`pub` to silence E0603), §C5 (`.clone()` to silence borrows) residue. |
+   | E0277 with `Send` / `Sync` in the bound | §B2 / §B15 / §B18 — the missing-`Send` is usually a symptom of a guard held across `.await`, a Pin/RPITIT mismatch, or a manual `unsafe impl Send` that was wrong. |
+   | E0596, E0594, E0502, E0499 | §C5 candidate (but check the ownership design first — don't slap `.clone()`) |
+   | E0106, E0495, E0521 | §B1 (lifetime laundering / leaking) |
+   | `clippy::await_holding_lock` | §B2 (but clippy catches ~30% — check hidden cases too) |
+   | `clippy::clone_on_copy`, `clippy::redundant_clone` | §C5 |
+   | `clippy::unwrap_used`, `clippy::expect_used` | §C2 |
+   | A path under an attacker-mutable directory is `canonicalize`d + `starts_with(base)`-checked, then `open`ed / read — escape reported despite the check | §C2 (TOCTOU — the static check is not race-free; CWE-367; use `openat`+`O_NOFOLLOW` or the `cap-std` crate when the tree is attacker-mutable) |
+   | `clippy::missing_safety_doc`, `clippy::undocumented_unsafe_blocks` | §B5 |
+   | panic "Cannot start a runtime from within a runtime" | §B15 (block_on inside async) |
+   | panic "cannot recursively acquire mutex" | §B9 (lock ordering / re-entry) |
+   | panic "PoisonError" / `poisoned lock` | §B2 (poisoning cascade) |
+   | Task hangs, `Poll::Pending` forever | §B15 (Waker not registered) |
+   | Deadlock without panic, two threads waiting on each other | §B9 |
+   | A `std::thread::scope` block hangs / never returns; or a child-thread panic re-panics the parent at the closing brace, skipping cleanup | §B9 (scope auto-joins on the brace — close the channel / drop the sender / signal cancellation *before* the scope ends; inspect each `ScopedJoinHandle::join()` when cleanup must run regardless) |
+   | Deadlock / all async workers wedge after touching a concurrent map (`DashMap`/`scc`); `clippy::await_holding_lock` stays silent | §B2 (a `Ref`/`RefMut` shard guard held across `.await` — store `Arc<OnceCell>`, clone out, drop the guard before awaiting) |
+   | One core spins; a flush/drain/leader loop never recovers and never exits, waiters keep getting `Err` | §B3a (coordinator livelock — release leadership and `return` on a persistent error; bound/back off any retry) |
+   | Steady-state RAM growth, OOM after days | §B10 (cycles) or §B14 (unbounded queue) |
+   | Latency spike under load, executor starvation | §B11 (blocking executor) |
+   | "Under load, `expensive_fetch` runs N times instead of 1" | §B13 (TOCTOU) |
+   | "Compiles and works on x86/dev, but garbage/race on ARM/AArch64; data published via an atomic is visible before the payload write" | §B13 (`Relaxed`-publish — use `Release`/`Acquire`, or `AcqRel`/`SeqCst` for RMW; model-check with `loom`) |
+   | "The message/request/write didn't happen but no error either" | §B8 (forgotten `.await`) |
+   | Encrypt/decrypt works, but security review finds a vulnerability | §B12 |
+   | `HashMap::get` returns `None` but the value was inserted | §B16 (Eq/Hash contract mismatch) |
+   | A worker pins at 100% CPU on a regex match / request times out on a specific input; the engine is `fancy-regex` / `onig` / `pcre2` | §B16 (ReDoS — catastrophic backtracking on untrusted input; keep untrusted input on the linear `regex` crate, else size-cap + hard match timeout) |
+   | panic `already borrowed: BorrowMutError` | §B17 (RefCell reentrant borrow) |
+   | `unsafe impl Send` / `unsafe impl Sync` without SAFETY justification | §B18 |
+   | `untagged` enum deserializes to wrong variant | §B20 (variant shape overlap) |
+   | Task started but no way to cancel or observe completion | §B21 (dropped JoinHandle) |
+   | Owner's `Drop` never runs / a periodic task outlives its owner / `_exits_on_drop` test hangs | §B21 (timer task holds a strong `Arc` to its owner — hold `Weak`, exit on `upgrade()==None`) |
+   | "Resource didn't close" / connection pool exhausted | §B22 (async Drop is not real) |
+   | `tokio::select!` arm side effect lost on cancellation | §B23 |
+   | "Timing-based authentication vulnerability" / CVE-class | §B24 (constant-time comparison) |
+   | "Panic crossed extern \"C\" boundary" / "process aborted in FFI" | §B25 |
+   | `attempt to ... with overflow` panic (debug) / wrong result only in release | §B26 (integer overflow: debug-panic vs release-wrap) |
+   | Numeric value wrong after a cast / `as` (`len() as u32`, `u64 as u32`) | §B26 (lossy conversion) |
+   | `attempt to divide by zero` / `attempt to calculate the remainder with a divisor of zero` | §B26 (div/rem by zero) |
+   | Duration looks wrong / negative / jumps; `.elapsed().unwrap()` panic | §B27 (wall-clock vs monotonic time) |
+   | panic `byte index N is not a char boundary` | §B28 (UTF-8 string slicing) |
+   | "string truncated mid-character" / non-ASCII corrupted | §B28 (char boundaries) |
+   | "Channel kind wrong for runtime" / async-blocks-on-sync-channel | §C8 |
+   | Tracing span missing in spawned task logs | §C9 |
+   | Workspace member's feature unexpectedly enabled in release | §C10 |
+   | `Deref` chain produces unexpected type / inheritance-style API breaks | §C11 |
+   | Test passes locally, flakes on CI / `thread::sleep` in test | §D1 |
+   | Test in `tests/` cannot compile after refactor | §D2 |
+   | New test is green even with the fix reverted / on pre-fix code; snapshot blessed from a brand-new implementation | §D1a (oracle validity — the oracle is the code itself; add a negative control) |
+   | A feature's tests are green but using it end-to-end fails or corrupts data; tests only check a config flag / header / status string — never exercise the behavior | §D1a (façade fitted to the test — Goodhart on the suite; add one end-to-end test that *uses* the feature, not just one that asserts it was announced) |
+   | Works in tests, breaks in prod: wrong arithmetic only in release, timeout only at real data sizes, race only under real concurrency | §D3 (test/prod divergence) — release-wrap → §B26, scale → §E3/§B7, interleaving → §B13/§B9 |
+   | CI reads green but a test actually hangs; `SLOW`/`TIMEOUT` lines never surfaced; test command piped through `grep`/`head` | §D4 (filtered live pipe without `set -o pipefail` masks the hang — gate on the runner or tee-to-file-then-grep; root-cause the hang) |
+   | Windows: `LNK1104: cannot open file '…exe'` on a test/bench binary after a flaky run | §D5 (a zombie test process holds its own `.exe` — reap stray `<crate>-<hex>.exe` at run start; the real fix is the hang, §D4) |
+   | Own tests and round-trip green, but interop with the real peer / reference implementation / published vectors fails | §F1 (spec conformance — both halves share the same misreading; verify against the external oracle) |
+   | Behavior contradicts what README/SECURITY.md/docs promise (token logged, untrusted input trusted, write not durable) | §F2 (documented guarantees — the doc, not the call graph, defines the boundary) |
+   | Connection/FD/gauge leaks on error paths; a peer that connects and stalls pins a task forever; EOF busy-loop or peer never sees close | §F3 (boundary/error-path lifecycle; §B21/§B4 twins; no-timeout read on untrusted peer) |
+   | `parse(display(x))` / `decode(encode(x))` corrupts data on special characters or boundary sizes | §F4 (round-trip law never tested over the domain — add the property test) |
+   | Feature never activates, code is dead | §C7 (feature typo) |
+   | Slow / high latency under load / high CPU / throughput collapses at scale | §E (systemic cost) — pick the law by shape: serial work → §E1, allocation → §E2, complexity/O(n²) → §E3, lock contention → §E4, recompute/Regex-in-loop → §E5; all under §E6 (measure first) |
+   | Two sequential `.await`s / not parallel / CPU-bound stalls the runtime | §E1 (`join!`/`buffer_unordered`/`JoinSet`; `spawn_blocking`/`rayon` for CPU-bound) |
+   | Too many allocations / high RSS / GC-like churn | §E2 (drop needless `clone`/`collect`/`format`; `with_capacity`, `Cow`/`&str`, reuse buffers) |
+   | Works fast on small input, quadratic at scale | §E3 (accidental O(n²); wrong container) |
+   | Lock contention / scales poorly across cores / `Mutex` hot | §E4 (atomics / `ArcSwap` / sharding) |
+   | "Need a faster HashMap" | §E4 (hasher choice) + §B16 — pick by trust boundary: fast hasher for trusted input, DoS-resistant for untrusted |
+   | Recompiles `Regex` / reparses every call / unbuffered I/O | §E5 (`LazyLock`; buffer I/O; reuse; lazy logging) |
+
+   If the symptom maps to **multiple** categories, list them all and explain which is primary.
+
+5. **Compose the answer:**
+   - **Category(ies):** `§XN` referencing the paragraph.
+   - **Real cause:** one or two sentences. Not a paraphrase of the symptom — why it arises in light of the spec's rule.
+   - **Why the "obvious" fix is bad** (when one exists — especially §C5 reflexive `.clone()`).
+   - **Right fix:** code or patch for the user's concrete example. If code wasn't shown — general form plus an explicit request to share the actual fragment.
+   - **Preventive rule** from the spec in one line: what to add to the style/checklist so it doesn't recur.
+   - **What to run after the fix:** the matching clippy lint / miri / tokio-console — from the Post-flight checklist.
+
+## Answer format
+
+```
+## §XN — <category name>
+
+**Cause.** <…>
+
+**The "obvious" fix that's also bad.** <when applicable — e.g. for a borrow error: "just add .clone()", per §C5>
+
+**Right fix.**
+```rust
+<patch>
+```
+
+**Preventive rule.** <one line from the spec>
+
+**Run after.** `cargo clippy -- -W clippy.await_holding_lock` (for §B2), `miri` (for §B5), `tokio-console` (for §B11), etc.
+```
+
+## Behavioral principles
+
+- **Root cause, not symptom.** "Just add `.clone()` to make it compile" is a forbidden answer; see §C5. First ask whether ownership can be restructured.
+- **Don't guess versions.** If the fix depends on a version (`axum::Server::bind` disappeared in 0.7), request `Cargo.toml` — don't invent.
+- **Acknowledge uncertainty.** The spec warns explicitly: ~50% of LLM cancel-safety assessments in empirical testing were confidently wrong (§B3). If the symptom touches cancel-safety, enumerate every `.await` point and prove — don't assert.
+- **Don't restate the solution in disguise.** If you've already named the cause as §B2, don't recite its rules in full — reference.
+
+## Limits
+
+- Doesn't replace static analysis. If the user has lots of code and the location is unclear, redirect to `/rust-cc-audit`.
+- Doesn't execute code. All fixes are textual suggestions; the user applies them.

package/commands/rust-intel-cc/plan.md

@@ -0,0 +1,74 @@
+---
+description: Before writing Rust — run the task through rust-intel's trigger table and Pre-flight checklist. Returns a plan, not code.
+argument-hint: "<task description>"
+---
+
+# /rust-cc-plan
+
+Catches mistakes at the design stage, while rolling them back is still cheap. This is **not** a code generator — it's a structured pre-flight before you start.
+
+## Arguments
+
+- `$ARGUMENTS` — task description in natural language. More detail → sharper plan.
+
+## Process
+
+1. **Load the `rust-intel` skill.** If unavailable, emit `⚠️ BLOCKED: skill rust-intel is not registered` and stop.
+
+2. **Pin the world.** Read `Cargo.toml` and `CLAUDE.md` (if present). Record versions. If they're missing or insufficient for the task, ask — don't invent.
+
+3. **Run the trigger table.** Match phrases from `$ARGUMENTS` against the trigger table in the `rust-intel` skill (the "Self-monitoring" section near the top of the spec). Record **every** activated category — the table is the source of truth for the phrase→category mapping; this command does not duplicate it. If ≥2 categories fire, flag the task as high-risk and enumerate exactly which ones the plan defends against.
+
+4. **Pre-flight checklist.** Walk the 7-question Pre-flight checklist defined at the end of the `rust-intel` skill (section "Pre-flight checklist"). For each question, ask the user only if the answer isn't already implied by context or by step 2. Don't ask all seven mechanically — that becomes noise. The skill is the canonical source of question wording; this command does not duplicate it.
+
+5. **Compose the plan.** Format:
+
+```
+# Plan: <short task name>
+
+## Activated categories
+- §B2 (Mutex across .await) — shared state between tasks
+- §B3 (cancel safety) — timeout was mentioned
+- §C2 (error handling) — public library function
+**Risk level:** high (3 categories)
+
+## Context
+- Stack: tokio 1.X, sqlx 0.Y (from Cargo.toml)
+- Crate type: library / binary
+- Idioms from CLAUDE.md: <if any>
+
+## Open questions (will block code-writing)
+1. Cancel-safety boundary: if the timeout fires after `db.commit()`, what behavior?
+   — retry / rollback / propagate?
+2. Backpressure policy for the event queue: block producer / drop oldest / drop newest?
+3. Trait `Storage` — sealed, or open to external impls?
+
+## Solution structure
+1. <step — module/function, and what matters about it for the activated categories>
+2. <step>
+3. ...
+
+## Risk points (flag upfront in the code)
+- `handle_request` will use `tokio::select!` — needs an explicit `cancel-safe: yes/NO` annotation (§B3).
+- `Arc<Mutex<State>>` in `AppState` — guard must NOT cross `.await` (§B2); critical section ≤ 10 lines.
+- `process_batch` — bounded channel `mpsc::channel(N=?)` with an explicit policy (§B14).
+
+## After implementation (Post-flight)
+- `cargo clippy -- -W clippy::await_holding_lock -W clippy::unwrap_used ...`
+- If any `unsafe` is added — `cargo +nightly miri test`.
+- Surface in the summary: `unsafe`, `unwrap`, `Arc<Mutex<_>>`, `unbounded_channel`, new dependencies (§A1 defense).
+```
+
+6. **If any blockers are unresolved — stop, don't proceed with the plan.** Emit a blocking message in the spec's canonical form listing what's needed from the user.
+
+## Behavioral principles
+
+- **Don't write code.** Not even fragments, not even "for illustration". This command is the design phase.
+- **Don't skip triggers.** If a phrase in the task activates a category, it belongs in the list — even if it seems "not relevant here". The spec is built around the fact that LLMs systematically misjudge category relevance.
+- **Trait hierarchies — text before approval** (operating mode rule 3). If the task needs a new public trait, describe the signatures in the plan and mark "requires confirmation before impl".
+- **Crypto — special mode** (§B12). If activated, the plan must contain a "Threat model: <…> — requires confirmation" section; code doesn't start without it.
+
+## Limits
+
+- The plan defends against categories that **exist in the spec**. New bug classes (see draft categories in `docs/roadmap.md`) aren't covered until they migrate into the main ruleset.
+- This isn't a full architectural review. It's a pre-flight against the risk matrix, not a design doc.

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "rust-intel-cc",
+  "version": "0.4.5",
+  "description": "Defense against LLM Rust failure modes for Claude Code: 58 categories of bugs that survive rustc, clippy, and cargo test. npx installer for the rust-intel skill + /rust-cc-* commands.",
+  "bin": {
+    "rust-intel-cc": "bin/install.js"
+  },
+  "files": [
+    "bin/",
+    "skill/",
+    "commands/rust-intel-cc/",
+    "CHANGELOG.md",
+    "LICENSE-MIT",
+    "LICENSE-APACHE"
+  ],
+  "engines": {
+    "node": ">=16"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PHPCraftdream/rust-intel.git"
+  },
+  "homepage": "https://github.com/PHPCraftdream/rust-intel#readme",
+  "bugs": "https://github.com/PHPCraftdream/rust-intel/issues",
+  "keywords": [
+    "rust",
+    "claude-code",
+    "claude",
+    "code-review",
+    "audit",
+    "llm",
+    "correctness",
+    "security"
+  ],
+  "author": "Marat K <phpcraftdream@gmail.com>",
+  "license": "(MIT OR Apache-2.0)"
+}