start-vibing 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. package/package.json +1 -1
  2. package/template/.claude/CLAUDE.md +129 -168
  3. package/template/.claude/agents/analyzer.md +0 -14
  4. package/template/.claude/agents/commit-manager.md +0 -19
  5. package/template/.claude/agents/documenter.md +0 -10
  6. package/template/.claude/agents/domain-updater.md +194 -200
  7. package/template/.claude/agents/final-validator.md +0 -18
  8. package/template/.claude/agents/orchestrator.md +36 -34
  9. package/template/.claude/agents/quality-checker.md +0 -24
  10. package/template/.claude/agents/research.md +299 -262
  11. package/template/.claude/agents/security-auditor.md +1 -14
  12. package/template/.claude/agents/tester.md +0 -8
  13. package/template/.claude/agents/ui-ux-reviewer.md +80 -18
  14. package/template/.claude/commands/feature.md +48 -102
  15. package/template/.claude/config/README.md +30 -30
  16. package/template/.claude/config/project-config.json +53 -53
  17. package/template/.claude/config/quality-gates.json +46 -46
  18. package/template/.claude/config/security-rules.json +45 -45
  19. package/template/.claude/config/testing-config.json +168 -168
  20. package/template/.claude/hooks/SETUP.md +52 -181
  21. package/template/.claude/hooks/user-prompt-submit.py +184 -46
  22. package/template/.claude/settings.json +0 -39
  23. package/template/.claude/skills/codebase-knowledge/SKILL.md +145 -145
  24. package/template/.claude/skills/codebase-knowledge/domains/claude-system.md +260 -321
  25. package/template/.claude/skills/docs-tracker/SKILL.md +239 -239
  26. package/template/.claude/skills/final-check/SKILL.md +284 -284
  27. package/template/.claude/skills/quality-gate/SKILL.md +278 -278
  28. package/template/.claude/skills/research-cache/SKILL.md +207 -207
  29. package/template/.claude/skills/security-scan/SKILL.md +206 -206
  30. package/template/.claude/skills/test-coverage/SKILL.md +441 -441
  31. package/template/.claude/skills/ui-ux-audit/SKILL.md +254 -254
  32. package/template/.claude/config/domain-mapping.json +0 -26
  33. package/template/.claude/hooks/post-tool-use.py +0 -155
  34. package/template/.claude/hooks/pre-tool-use.py +0 -159
  35. package/template/.claude/hooks/stop-validation.py +0 -155
  36. package/template/.claude/hooks/validate-commit.py +0 -200
  37. package/template/.claude/hooks/workflow-manager.py +0 -350
  38. package/template/.claude/workflow-state.schema.json +0 -200
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: ui-ux-reviewer
3
- description: "AUTOMATICALLY invoke when implementing UI/visual features. Triggers: files in 'components/', 'app/', '.tsx' with JSX, user says 'UI', 'component', 'page', 'design', 'layout'. Researches competitors, validates WCAG 2.1 accessibility, tests all viewports. MUST run BEFORE implementation of UI code."
3
+ description: "AUTOMATICALLY invoke when implementing UI/visual features. Triggers: files in 'components/', 'app/', '.tsx' with JSX, user says 'UI', 'component', 'page', 'design', 'layout'. ENFORCES separate UIs for mobile/tablet/desktop (NOT just responsive). Researches competitors, validates WCAG 2.1 accessibility."
4
4
  model: sonnet
5
5
  tools: Read, Grep, Glob, WebSearch, WebFetch
6
6
  skills: ui-ux-audit
@@ -10,29 +10,52 @@ skills: ui-ux-audit
10
10
 
11
11
  You review UI/UX for all visual features, research competitors, and validate accessibility.
12
12
 
13
- ## RULE: USE UI-UX-AUDIT SKILL
13
+ ## CRITICAL: SEPARATE UIs (NOT RESPONSIVE)
14
14
 
15
- > **MANDATORY:** Read:
16
- > - `.claude/skills/ui-ux-audit/SKILL.md` - Full checklist and templates
15
+ > **MANDATORY:** Web apps MUST have **SEPARATE UIs** for each platform.
16
+ > Do NOT just make "responsive" designs - create different layouts entirely.
17
17
 
18
- ## WORKFLOW STATE TRACKING
18
+ ### Platform Requirements
19
19
 
20
- Run this command automatically after UI/UX review:
20
+ | Platform | Width | Layout |
21
+ | -------- | ------- | ------------------------------------------------ |
22
+ | Mobile | 375px | Bottom nav, full-screen modals, pull-to-refresh |
23
+ | Tablet | 768px | Condensed dropdowns, collapsible sidebar |
24
+ | Desktop | 1280px+ | Left sidebar, top navbar with search, high density |
21
25
 
22
- ```bash
23
- python .claude/hooks/workflow-manager.py agent-executed --agent ui-ux-reviewer --result approved --notes "Researched 5 competitors, validated accessibility and responsiveness"
24
- ```
26
+ ### Mobile UI (375px)
27
+ - Bottom navigation bar (NOT hamburger menu)
28
+ - Full-screen modal for search (with close button)
29
+ - Pull-to-refresh functionality
30
+ - Touch targets minimum 44x44px
31
+ - NO horizontal scroll ever
32
+
33
+ ### Tablet UI (768px)
34
+ - Condensed data in dropdowns
35
+ - Hybrid collapsible sidebar
36
+ - Adapted touch/click interactions
37
+
38
+ ### Desktop UI (1280px+)
39
+ - Left sidebar: notifications, profile, navigation
40
+ - Top navbar: centered search bar (Levenshtein fuzzy search)
41
+ - Use MagicUI or shadcn components
42
+ - Higher information density
43
+
44
+ ## RULE: USE UI-UX-AUDIT SKILL
45
+
46
+ > **MANDATORY:** Read:
47
+ > - `.claude/skills/ui-ux-audit/SKILL.md` - Full checklist and templates
25
48
 
26
49
  ## Workflow
27
50
 
28
51
  ```
29
- 1. IDENTIFY → What type of UI? Mobile-first or desktop-first?
52
+ 1. IDENTIFY → What platform? Create SEPARATE layouts for each
30
53
 
31
- 2. RESEARCH → 3-5 competitors, screenshots
54
+ 2. RESEARCH → 3-5 competitors for EACH platform (mobile/desktop/tablet)
32
55
 
33
- 3. DEFINE → Market pattern, our approach
56
+ 3. DEFINE → Market pattern, our approach PER PLATFORM
34
57
 
35
- 4. VALIDATE → Accessibility and responsiveness
58
+ 4. VALIDATE → Accessibility and separate layouts
36
59
  ```
37
60
 
38
61
  ## Competitor Research
@@ -171,10 +194,49 @@ Skeleton checklist:
171
194
  **STATUS:** [APPROVED/NEEDS WORK]
172
195
  ```
173
196
 
197
+ ## Input Validation (ALL INPUTS)
198
+
199
+ Every input field MUST have real-time visual validation:
200
+
201
+ ```tsx
202
+ // Border colors
203
+ valid: "border-green-500"
204
+ invalid: "border-red-500"
205
+ neutral: "border-gray-300"
206
+ ```
207
+
208
+ ### Requirements
209
+ - Error checklist below input (items disappear when fixed)
210
+ - Autofill detection (onInput + onAnimationStart)
211
+ - Prevent wrong data types (email in nickname field)
212
+ - Validate on blur AND on input
213
+
214
+ ```tsx
215
+ <div className="mt-1 text-sm text-red-500">
216
+ {errors.map(error => (
217
+ <div key={error}>• {error}</div>
218
+ ))}
219
+ </div>
220
+ ```
221
+
222
+ ## UI Polish Requirements
223
+
224
+ | Requirement | Implementation |
225
+ | -------------------------- | ------------------------------------------- |
226
+ | Page transitions | Framer Motion subtle animations |
227
+ | No page headers with title | Remove redundant utility headers |
228
+ | No page scroll with layout | Main container `overflow-hidden` |
229
+ | Hidden scrollbars | Custom CSS, but scroll still works |
230
+ | Scroll indicators | Arrow icons when more content exists |
231
+ | Featured carousel | Carousel section for featured content |
232
+ | Database seeding | Seed visual data + test users on init |
233
+
174
234
  ## Critical Rules
175
235
 
176
- 1. **ALWAYS research competitors** - Before implementing
177
- 2. **ALWAYS validate accessibility** - WCAG 2.1 Level AA
178
- 3. **ALWAYS test viewports** - All 4 required
179
- 4. **NEVER horizontal overflow** - Check all viewports
180
- 5. **ALWAYS create skeleton** - With the component
236
+ 1. **ALWAYS create SEPARATE UIs** - Mobile/Tablet/Desktop (NOT responsive)
237
+ 2. **ALWAYS research competitors** - Before implementing (per platform)
238
+ 3. **ALWAYS validate accessibility** - WCAG 2.1 Level AA
239
+ 4. **ALWAYS validate ALL inputs** - Real-time visual feedback
240
+ 5. **NEVER horizontal overflow** - Check all viewports
241
+ 6. **ALWAYS create skeleton** - With the component
242
+ 7. **ALWAYS use Framer Motion** - Subtle transitions
@@ -1,102 +1,48 @@
1
- # /feature - Iniciar Nova Feature
2
-
3
- ---
4
-
5
- command: feature
6
- description: Inicia o fluxo completo para uma nova feature
7
- usage: /feature [descricao da feature]
8
-
9
- ---
10
-
11
- ## PASSO 1: INICIAR WORKFLOW (OBRIGATORIO)
12
-
13
- **EXECUTE IMEDIATAMENTE antes de qualquer outra acao:**
14
-
15
- ```bash
16
- python "$CLAUDE_PROJECT_DIR/.claude/hooks/workflow-manager.py" start-task --type feature --description "$ARGUMENTS"
17
- ```
18
-
19
- Se o comando acima falhar, informe o usuario e NAO prossiga.
20
-
21
- ---
22
-
23
- ## PASSO 2: EXECUTAR ANALYZER
24
-
25
- Leia o arquivo `.claude/agents/analyzer.md` e execute as instrucoes.
26
-
27
- Ao final, execute:
28
-
29
- ```bash
30
- python "$CLAUDE_PROJECT_DIR/.claude/hooks/workflow-manager.py" agent-executed --agent analyzer --result approved
31
- python "$CLAUDE_PROJECT_DIR/.claude/hooks/workflow-manager.py" approve-files --files "[arquivos identificados]"
32
- ```
33
-
34
- **IMPORTANTE:** Sem aprovar arquivos, os hooks bloqueiarao qualquer edicao!
35
-
36
- ---
37
-
38
- ## PASSO 3: FLUXO DE AGENTES
39
-
40
- Execute na ordem (leia cada arquivo .md antes):
41
-
42
- | Ordem | Agente | Arquivo | Quando |
43
- | ----- | ----------------- | ------------------------------------ | --------- |
44
- | 1 | analyzer | `.claude/agents/analyzer.md` | Sempre |
45
- | 2 | ui-ux-reviewer | `.claude/agents/ui-ux-reviewer.md` | Se tem UI |
46
- | 3 | documenter | `.claude/agents/documenter.md` | Sempre |
47
- | 4 | **[IMPLEMENTAR]** | - | - |
48
- | 5 | tester | `.claude/agents/tester.md` | Sempre |
49
- | 6 | security-auditor | `.claude/agents/security-auditor.md` | Sempre |
50
- | 7 | quality-checker | `.claude/agents/quality-checker.md` | Sempre |
51
- | 8 | final-validator | `.claude/agents/final-validator.md` | Sempre |
52
-
53
- Apos cada agente, registre:
54
-
55
- ```bash
56
- python "$CLAUDE_PROJECT_DIR/.claude/hooks/workflow-manager.py" agent-executed --agent [nome] --result approved
57
- ```
58
-
59
- ---
60
-
61
- ## PASSO 4: QUALITY GATES
62
-
63
- ```bash
64
- bun run typecheck && bun run lint && bun run test && bun run test:e2e && bun run build
65
- ```
66
-
67
- Registre cada resultado:
68
-
69
- ```bash
70
- python "$CLAUDE_PROJECT_DIR/.claude/hooks/workflow-manager.py" quality-gate --gate typecheck --passed true
71
- python "$CLAUDE_PROJECT_DIR/.claude/hooks/workflow-manager.py" quality-gate --gate lint --passed true
72
- python "$CLAUDE_PROJECT_DIR/.claude/hooks/workflow-manager.py" quality-gate --gate build --passed true
73
- ```
74
-
75
- ---
76
-
77
- ## PASSO 5: VALIDACAO FINAL
78
-
79
- ```bash
80
- python "$CLAUDE_PROJECT_DIR/.claude/hooks/workflow-manager.py" final-validation --result approved --ready-to-commit true
81
- ```
82
-
83
- ---
84
-
85
- ## PASSO 6: COMMIT (se solicitado)
86
-
87
- Apos commit bem-sucedido:
88
-
89
- ```bash
90
- python "$CLAUDE_PROJECT_DIR/.claude/hooks/workflow-manager.py" complete-task --commit-hash [HASH]
91
- ```
92
-
93
- ---
94
-
95
- ## CRITERIOS DE SUCESSO
96
-
97
- - [ ] Workflow iniciado via workflow-manager
98
- - [ ] Analyzer executado e arquivos aprovados
99
- - [ ] Agentes executados na ordem
100
- - [ ] Testes criados (unit + E2E se UI)
101
- - [ ] Quality gates passando
102
- - [ ] Final validation aprovada
1
+ # /feature - Iniciar Nova Feature
2
+
3
+ ---
4
+
5
+ command: feature
6
+ description: Inicia o fluxo completo para uma nova feature
7
+ usage: /feature [descricao da feature]
8
+
9
+ ---
10
+
11
+ ## Fluxo de Desenvolvimento
12
+
13
+ Execute na ordem (use Task tool para invocar cada agente):
14
+
15
+ | Ordem | Agente | Arquivo | Quando |
16
+ | ----- | ----------------- | ------------------------------------ | --------- |
17
+ | 1 | analyzer | `.claude/agents/analyzer.md` | Sempre |
18
+ | 2 | ui-ux-reviewer | `.claude/agents/ui-ux-reviewer.md` | Se tem UI |
19
+ | 3 | documenter | `.claude/agents/documenter.md` | Sempre |
20
+ | 4 | **[IMPLEMENTAR]** | - | - |
21
+ | 5 | tester | `.claude/agents/tester.md` | Sempre |
22
+ | 6 | security-auditor | `.claude/agents/security-auditor.md` | Sempre |
23
+ | 7 | quality-checker | `.claude/agents/quality-checker.md` | Sempre |
24
+ | 8 | final-validator | `.claude/agents/final-validator.md` | Sempre |
25
+ | 9 | commit-manager | `.claude/agents/commit-manager.md` | Sempre |
26
+
27
+ ---
28
+
29
+ ## Quality Gates
30
+
31
+ ```bash
32
+ bun run typecheck && bun run lint && bun run test && bun run test:e2e && bun run build
33
+ ```
34
+
35
+ ---
36
+
37
+ ## Critérios de Sucesso
38
+
39
+ - [ ] Analyzer executado antes da implementação
40
+ - [ ] Agentes executados na ordem
41
+ - [ ] Testes criados (unit + E2E se UI)
42
+ - [ ] Todos quality gates passaram
43
+ - [ ] Documentação atualizada
44
+ - [ ] Security audit aprovado
45
+ - [ ] Commit convencional criado
46
+
47
+ - [ ] Quality gates passando
48
+ - [ ] Final validation aprovada
@@ -1,30 +1,30 @@
1
- # Project Configuration
2
-
3
- This directory contains project-specific configuration files that agents read to adapt their behavior to your project.
4
-
5
- ## Files
6
-
7
- | File | Purpose |
8
- |------|---------|
9
- | `project-config.json` | Main project configuration (stack, structure, commands) |
10
- | `domain-mapping.json` | Maps file patterns to knowledge domains |
11
- | `quality-gates.json` | Quality check commands |
12
- | `testing-config.json` | Testing framework and conventions |
13
- | `security-rules.json` | Security audit rules |
14
-
15
- ## How Agents Use These
16
-
17
- 1. **analyzer** - Reads `project-config.json` for structure, `domain-mapping.json` for domains
18
- 2. **tester** - Reads `testing-config.json` for frameworks and conventions
19
- 3. **security-auditor** - Reads `security-rules.json` for security patterns
20
- 4. **quality-checker** - Reads `quality-gates.json` for commands
21
- 5. **domain-updater** - Reads `domain-mapping.json` for file-to-domain mapping
22
-
23
- ## Customizing for Your Project
24
-
25
- 1. Update `project-config.json` with your stack and commands
26
- 2. Update `domain-mapping.json` with your project structure
27
- 3. Update `testing-config.json` with your test conventions
28
- 4. Update `security-rules.json` with your auth framework
29
-
30
- The agents will automatically adapt to your configuration.
1
+ # Project Configuration
2
+
3
+ This directory contains project-specific configuration files that agents read to adapt their behavior to your project.
4
+
5
+ ## Files
6
+
7
+ | File | Purpose |
8
+ |------|---------|
9
+ | `project-config.json` | Main project configuration (stack, structure, commands) |
10
+ | `domain-mapping.json` | Maps file patterns to knowledge domains |
11
+ | `quality-gates.json` | Quality check commands |
12
+ | `testing-config.json` | Testing framework and conventions |
13
+ | `security-rules.json` | Security audit rules |
14
+
15
+ ## How Agents Use These
16
+
17
+ 1. **analyzer** - Reads `project-config.json` for structure, `domain-mapping.json` for domains
18
+ 2. **tester** - Reads `testing-config.json` for frameworks and conventions
19
+ 3. **security-auditor** - Reads `security-rules.json` for security patterns
20
+ 4. **quality-checker** - Reads `quality-gates.json` for commands
21
+ 5. **domain-updater** - Reads `domain-mapping.json` for file-to-domain mapping
22
+
23
+ ## Customizing for Your Project
24
+
25
+ 1. Update `project-config.json` with your stack and commands
26
+ 2. Update `domain-mapping.json` with your project structure
27
+ 3. Update `testing-config.json` with your test conventions
28
+ 4. Update `security-rules.json` with your auth framework
29
+
30
+ The agents will automatically adapt to your configuration.
@@ -1,53 +1,53 @@
1
- {
2
- "$schema": "https://json-schema.org/draft/2020-12/schema",
3
- "$comment": "Project-specific configuration. Agents read this to adapt to your project.",
4
-
5
- "stack": {
6
- "runtime": "bun",
7
- "language": "typescript",
8
- "strictMode": true,
9
- "database": "mongodb",
10
- "orm": "mongoose",
11
- "validation": "zod",
12
- "container": "docker"
13
- },
14
-
15
- "structure": {
16
- "apps": "apps/",
17
- "shared": "common/",
18
- "types": "types/",
19
- "tests": "tests/",
20
- "docs": "docs/"
21
- },
22
-
23
- "pathAliases": {
24
- "$types/*": "./types/*",
25
- "@common/*": "./common/*",
26
- "@common": "./common/index.ts",
27
- "@db/*": "./common/db/*",
28
- "@db": "./common/db/index.ts",
29
- "@apps/*": "./apps/*"
30
- },
31
-
32
- "commands": {
33
- "typecheck": "bun run typecheck",
34
- "lint": "bun run lint",
35
- "test": "bun run test",
36
- "testE2e": "bun run test:e2e",
37
- "build": "bun run build",
38
- "dev": "bun run dev",
39
- "dockerBuild": "docker compose build",
40
- "dockerUp": "docker compose up"
41
- },
42
-
43
- "conventions": {
44
- "branchPrefix": {
45
- "feature": "feature/",
46
- "bugfix": "fix/",
47
- "refactor": "refactor/"
48
- },
49
- "commitFormat": "conventional",
50
- "typesLocation": "types/",
51
- "noTypesInSrc": true
52
- }
53
- }
1
+ {
2
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
3
+ "$comment": "Project-specific configuration. Agents read this to adapt to your project.",
4
+
5
+ "stack": {
6
+ "runtime": "bun",
7
+ "language": "typescript",
8
+ "strictMode": true,
9
+ "database": "mongodb",
10
+ "orm": "mongoose",
11
+ "validation": "zod",
12
+ "container": "docker"
13
+ },
14
+
15
+ "structure": {
16
+ "apps": "apps/",
17
+ "shared": "common/",
18
+ "types": "types/",
19
+ "tests": "tests/",
20
+ "docs": "docs/"
21
+ },
22
+
23
+ "pathAliases": {
24
+ "$types/*": "./types/*",
25
+ "@common/*": "./common/*",
26
+ "@common": "./common/index.ts",
27
+ "@db/*": "./common/db/*",
28
+ "@db": "./common/db/index.ts",
29
+ "@apps/*": "./apps/*"
30
+ },
31
+
32
+ "commands": {
33
+ "typecheck": "bun run typecheck",
34
+ "lint": "bun run lint",
35
+ "test": "bun run test",
36
+ "testE2e": "bun run test:e2e",
37
+ "build": "bun run build",
38
+ "dev": "bun run dev",
39
+ "dockerBuild": "docker compose build",
40
+ "dockerUp": "docker compose up"
41
+ },
42
+
43
+ "conventions": {
44
+ "branchPrefix": {
45
+ "feature": "feature/",
46
+ "bugfix": "fix/",
47
+ "refactor": "refactor/"
48
+ },
49
+ "commitFormat": "conventional",
50
+ "typesLocation": "types/",
51
+ "noTypesInSrc": true
52
+ }
53
+ }
@@ -1,46 +1,46 @@
1
- {
2
- "$comment": "Quality gate commands. Agents use these to run checks.",
3
-
4
- "gates": {
5
- "typecheck": {
6
- "command": "bun run typecheck",
7
- "description": "TypeScript type checking",
8
- "required": true,
9
- "order": 1
10
- },
11
- "lint": {
12
- "command": "bun run lint",
13
- "description": "ESLint code linting",
14
- "required": true,
15
- "order": 2
16
- },
17
- "unitTests": {
18
- "command": "bun run test",
19
- "description": "Unit tests with Vitest",
20
- "required": true,
21
- "order": 3
22
- },
23
- "e2eTests": {
24
- "command": "bun run test:e2e",
25
- "description": "E2E tests with Playwright",
26
- "required": false,
27
- "order": 4
28
- },
29
- "build": {
30
- "command": "bun run build",
31
- "description": "Production build",
32
- "required": true,
33
- "order": 5
34
- },
35
- "dockerBuild": {
36
- "command": "docker compose build",
37
- "description": "Docker image build",
38
- "required": false,
39
- "order": 6
40
- }
41
- },
42
-
43
- "runAll": "bun run typecheck && bun run lint && bun run test && bun run build",
44
-
45
- "skipGatesForTypes": ["config", "docs"]
46
- }
1
+ {
2
+ "$comment": "Quality gate commands. Agents use these to run checks.",
3
+
4
+ "gates": {
5
+ "typecheck": {
6
+ "command": "bun run typecheck",
7
+ "description": "TypeScript type checking",
8
+ "required": true,
9
+ "order": 1
10
+ },
11
+ "lint": {
12
+ "command": "bun run lint",
13
+ "description": "ESLint code linting",
14
+ "required": true,
15
+ "order": 2
16
+ },
17
+ "unitTests": {
18
+ "command": "bun run test",
19
+ "description": "Unit tests with Vitest",
20
+ "required": true,
21
+ "order": 3
22
+ },
23
+ "e2eTests": {
24
+ "command": "bun run test:e2e",
25
+ "description": "E2E tests with Playwright",
26
+ "required": false,
27
+ "order": 4
28
+ },
29
+ "build": {
30
+ "command": "bun run build",
31
+ "description": "Production build",
32
+ "required": true,
33
+ "order": 5
34
+ },
35
+ "dockerBuild": {
36
+ "command": "docker compose build",
37
+ "description": "Docker image build",
38
+ "required": false,
39
+ "order": 6
40
+ }
41
+ },
42
+
43
+ "runAll": "bun run typecheck && bun run lint && bun run test && bun run build",
44
+
45
+ "skipGatesForTypes": ["config", "docs"]
46
+ }
@@ -1,45 +1,45 @@
1
- {
2
- "$comment": "Security rules. Used by security-auditor agent.",
3
-
4
- "authentication": {
5
- "framework": "session-based",
6
- "userIdSource": "ctx.user._id",
7
- "protectedProcedure": "protectedProcedure",
8
- "sessionStore": "mongodb"
9
- },
10
-
11
- "validation": {
12
- "library": "zod",
13
- "requireOnAllRoutes": true
14
- },
15
-
16
- "sensitivePatterns": {
17
- "forbidden": [
18
- "input.userId",
19
- "input.user_id",
20
- "req.body.userId",
21
- "passwordHash",
22
- "password:"
23
- ],
24
- "files": ["auth/", "api/", "server/", "routers/"]
25
- },
26
-
27
- "cryptography": {
28
- "passwordHashing": "bcrypt",
29
- "minSaltRounds": 10,
30
- "tokenGeneration": "crypto.randomBytes"
31
- },
32
-
33
- "cookies": {
34
- "httpOnly": true,
35
- "secure": true,
36
- "sameSite": "strict"
37
- },
38
-
39
- "owaspChecks": {
40
- "a01_brokenAccessControl": true,
41
- "a02_cryptographicFailures": true,
42
- "a03_injection": true,
43
- "a07_authenticationFailures": true
44
- }
45
- }
1
+ {
2
+ "$comment": "Security rules. Used by security-auditor agent.",
3
+
4
+ "authentication": {
5
+ "framework": "session-based",
6
+ "userIdSource": "ctx.user._id",
7
+ "protectedProcedure": "protectedProcedure",
8
+ "sessionStore": "mongodb"
9
+ },
10
+
11
+ "validation": {
12
+ "library": "zod",
13
+ "requireOnAllRoutes": true
14
+ },
15
+
16
+ "sensitivePatterns": {
17
+ "forbidden": [
18
+ "input.userId",
19
+ "input.user_id",
20
+ "req.body.userId",
21
+ "passwordHash",
22
+ "password:"
23
+ ],
24
+ "files": ["auth/", "api/", "server/", "routers/"]
25
+ },
26
+
27
+ "cryptography": {
28
+ "passwordHashing": "bcrypt",
29
+ "minSaltRounds": 10,
30
+ "tokenGeneration": "crypto.randomBytes"
31
+ },
32
+
33
+ "cookies": {
34
+ "httpOnly": true,
35
+ "secure": true,
36
+ "sameSite": "strict"
37
+ },
38
+
39
+ "owaspChecks": {
40
+ "a01_brokenAccessControl": true,
41
+ "a02_cryptographicFailures": true,
42
+ "a03_injection": true,
43
+ "a07_authenticationFailures": true
44
+ }
45
+ }