Skip to content

Commit ca6b35a

Browse files
anoncamoz-agent
anoncam
and
oz-agent
committed
Add .claude tooling and configuration files
Co-Authored-By: Oz <oz-agent@warp.dev>
1 parent aa71ec3 commit ca6b35a

6 files changed

Lines changed: 242 additions & 0 deletions

File tree

‎.claude/agents/security-reviewer.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Security Reviewer
2+
3+
You are a security-focused code reviewer specializing in cryptographic implementations and secure data handling.
4+
5+
## Scope
6+
7+
Focus on these security-critical areas of the dedpaste codebase:
8+
9+
### Cryptography (cli/)
10+
- `pgpUtils.ts` — PGP key generation, encryption, decryption, signing
11+
- `encryptionUtils.ts` — Encryption/decryption workflows
12+
- `encryptionHelpers.ts` — Encryption helper functions
13+
- `keyManager.ts` — Key storage and retrieval
14+
- `unifiedKeyManager.ts` — Unified key management layer
15+
- `keybaseUtils.ts` — Keybase integration for key discovery
16+
17+
### Data Handling (src/)
18+
- `index.ts` — Worker request handling, paste storage/retrieval, auth
19+
20+
## Review Checklist
21+
22+
### Cryptographic Issues
23+
- [ ] Weak or deprecated algorithms (check openpgp configuration)
24+
- [ ] Hardcoded keys, IVs, or salts
25+
- [ ] Insufficient key lengths
26+
- [ ] Improper random number generation
27+
- [ ] Missing or incorrect signature verification
28+
- [ ] Key material in logs or error messages
29+
30+
### Input Validation
31+
- [ ] Unsanitized user input in paste content or metadata
32+
- [ ] Path traversal in paste ID handling
33+
- [ ] Missing size limits on uploads
34+
- [ ] Header injection via user-controlled values
35+
36+
### Information Leakage
37+
- [ ] Sensitive data in error messages or stack traces
38+
- [ ] Timing differences in authentication checks
39+
- [ ] Key fingerprints or metadata exposed unintentionally
40+
- [ ] Debug logging that leaks secrets
41+
42+
### Authentication & Authorization
43+
- [ ] One-time paste deletion is properly enforced
44+
- [ ] Burn-after-reading can't be bypassed
45+
- [ ] Password-protected pastes use constant-time comparison
46+
- [ ] R2/KV access patterns don't allow enumeration
47+
48+
### Dependency Security
49+
- [ ] Check `npm audit` for known vulnerabilities
50+
- [ ] Verify openpgp version is current and not affected by CVEs
51+
- [ ] Review third-party key discovery (Keybase) trust model
52+
53+
## Output
54+
55+
Provide findings in this format:
56+
57+
### [SEVERITY] — Finding Title
58+
- **File**: path/to/file.ts:line
59+
- **Issue**: Description of the vulnerability
60+
- **Impact**: What an attacker could achieve
61+
- **Recommendation**: How to fix it
62+
- **Reference**: CWE or relevant security standard
63+
64+
Severity levels: CRITICAL, HIGH, MEDIUM, LOW, INFO

‎.claude/settings.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"hooks": {
3+
"PostToolUse": [
4+
{
5+
"matcher": "Edit|Write",
6+
"command": "npx prettier --write \"$CLAUDE_FILE_PATH\" 2>/dev/null || true",
7+
"description": "Auto-format edited files with Prettier"
8+
}
9+
],
10+
"PreToolUse": [
11+
{
12+
"matcher": "Edit|Write",
13+
"command": "if echo \"$CLAUDE_FILE_PATH\" | grep -qE '(\\.env|\\.dev\\.vars|wrangler\\.toml)$'; then echo 'BLOCK: This file contains secrets or deployment config. Edit manually.' && exit 1; fi",
14+
"description": "Block edits to .env, .dev.vars, and wrangler.toml"
15+
},
16+
{
17+
"matcher": "Edit|Write",
18+
"command": "if echo \"$CLAUDE_FILE_PATH\" | grep -qE '(package-lock\\.json|yarn\\.lock|pnpm-lock\\.yaml)$'; then echo 'BLOCK: Lock files should not be edited directly. Use npm install.' && exit 1; fi",
19+
"description": "Block direct edits to lock files"
20+
}
21+
]
22+
},
23+
"permissions": {
24+
"allow": [
25+
"Bash(cat:*)",
26+
"Bash(chmod:*)",
27+
"Bash(grep:*)",
28+
"Bash(node:*)",
29+
"Bash(npm install:*)",
30+
"Bash(npm link)",
31+
"Bash(npm run build:*)",
32+
"Bash(npm run dev:*)",
33+
"Bash(npm run format:*)",
34+
"Bash(npm run lint:*)",
35+
"Bash(npm test:*)",
36+
"Bash(npm audit:*)",
37+
"Bash(npx tsc:*)",
38+
"Bash(npx prettier:*)",
39+
"Bash(npx eslint:*)",
40+
"Bash(git add:*)",
41+
"Bash(git checkout:*)",
42+
"Bash(git commit:*)",
43+
"Bash(git diff:*)",
44+
"Bash(git fetch:*)",
45+
"Bash(git log:*)",
46+
"Bash(git merge:*)",
47+
"Bash(git pull:*)",
48+
"Bash(git push:*)",
49+
"Bash(git remote:*)",
50+
"Bash(git stash:*)",
51+
"Bash(git status:*)",
52+
"Bash(git tag:*)",
53+
"Bash(gh issue:*)",
54+
"Bash(gh pr:*)",
55+
"Bash(gh run:*)",
56+
"Bash(wrangler:*)",
57+
"Bash(dedpaste:*)",
58+
"WebSearch"
59+
],
60+
"deny": []
61+
}
62+
}

‎.claude/skills/deploy-check/SKILL.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
name: deploy-check
3+
description: Build, type-check, test, and deploy to Cloudflare Workers with verification
4+
disable-model-invocation: true
5+
---
6+
7+
# Deploy Check
8+
9+
Run the full pre-deploy validation pipeline and deploy to Cloudflare Workers.
10+
Stop immediately if any step fails and report the error.
11+
12+
## Steps
13+
14+
1. **Type check** — Run `npx tsc --noEmit` to catch type errors without emitting files
15+
2. **Build** — Run `npm run build` to compile TypeScript for both worker and CLI
16+
3. **Lint** — Run `npm run lint` to check for code quality issues
17+
4. **Test** — Run `npm test` to run the test suite
18+
5. **Deploy** — Run `npm run deploy` to deploy to Cloudflare Workers
19+
6. **Verify** — After deployment, run `curl -s -o /dev/null -w "%{http_code}" https://dedpaste.com` to confirm the worker is responding (expect 200 or 404 for root)
20+
21+
## Failure Handling
22+
23+
- If type check fails: Report the type errors and suggest fixes
24+
- If build fails: Report compilation errors
25+
- If lint fails: Run `npm run format` first, then re-lint. If lint still fails, report remaining issues
26+
- If tests fail: Report which tests failed and why
27+
- If deploy fails: Check wrangler output for auth or config issues
28+
- If verification fails: Check Cloudflare dashboard status
29+
30+
## Output
31+
32+
Provide a summary table:
33+
34+
| Step | Status | Duration |
35+
|------|--------|----------|
36+
| Type check | ✅/❌ | Xs |
37+
| Build | ✅/❌ | Xs |
38+
| Lint | ✅/❌ | Xs |
39+
| Test | ✅/❌ | Xs |
40+
| Deploy | ✅/❌ | Xs |
41+
| Verify | ✅/❌ | Xs |

‎.claude/skills/release-notes/SKILL.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
name: release-notes
3+
description: Generate release notes from conventional commits since the last git tag
4+
disable-model-invocation: true
5+
---
6+
7+
# Release Notes Generator
8+
9+
Generate a formatted changelog from conventional commits since the last release tag.
10+
11+
## Steps
12+
13+
1. **Find the latest tag** — Run `git describe --tags --abbrev=0` to get the most recent tag
14+
2. **Collect commits** — Run `git log <tag>..HEAD --oneline --no-merges` to get all commits since that tag
15+
3. **Parse conventional commits** — Group commits by type prefix:
16+
- `feat:` → **Features**
17+
- `fix:` → **Bug Fixes**
18+
- `perf:` → **Performance**
19+
- `docs:` → **Documentation**
20+
- `refactor:` → **Refactoring**
21+
- `test:` → **Tests**
22+
- `chore:` / `ci:` / `build:` → **Maintenance**
23+
- `BREAKING CHANGE:` or `!:` → **Breaking Changes** (highlighted at top)
24+
4. **Determine next version** — Based on commit types:
25+
- Any breaking change → major bump
26+
- Any `feat:` → minor bump
27+
- Only `fix:` / other → patch bump
28+
5. **Format output** — Generate markdown release notes
29+
30+
## Output Format
31+
32+
```markdown
33+
# v{version} — {date}
34+
35+
## Breaking Changes
36+
- {description} ({short-hash})
37+
38+
## Features
39+
- {scope}: {description} ({short-hash})
40+
41+
## Bug Fixes
42+
- {description} ({short-hash})
43+
44+
## Maintenance
45+
- {description} ({short-hash})
46+
47+
**Full Changelog**: {compare-url}
48+
```
49+
50+
## Notes
51+
52+
- If there are no commits since the last tag, report that there's nothing to release
53+
- If there are no tags at all, use the initial commit as the base
54+
- Include the GitHub compare URL: `https://github.com/anoncam/dedpaste/compare/{old-tag}...{new-tag}`
55+
- Strip the conventional commit prefix from descriptions for cleaner output
56+
- Include the scope in parentheses if present (e.g., `feat(cli): add encryption`)

‎.mcp.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"mcpServers": {
3+
"context7": {
4+
"command": "npx",
5+
"args": ["-y", "@upstash/context7-mcp@latest"],
6+
"description": "Live documentation lookup for openpgp, commander, inquirer, Cloudflare Workers APIs"
7+
}
8+
}
9+
}

‎.prettierrc‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"semi": true,
3+
"singleQuote": true,
4+
"trailingComma": "es5",
5+
"tabWidth": 2,
6+
"useTabs": false,
7+
"printWidth": 100,
8+
"bracketSpacing": true,
9+
"arrowParens": "always"
10+
}

0 commit comments

Comments
 (0)