القائمة
Run the dependency security audit and maintain .github/notes/dependencies.md. Use when the canary pre-push audit hook fails, or when `bun audit` flags a high advisory.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Add a new shared workspace package under packages/*. Use when creating a new @packages/<name>, whether a bundled library other workspaces import or a build-only script package that runs during a build.
Orient in this repo: which file to edit for a change, how a change ripples across the stack, and how to search the code. Use at the start of a task in an unfamiliar area, or before a cross-cutting change.
Prefer Bun-native APIs, else Node built-ins with the node: prefix. Use when importing a Node built-in (fs, path, child_process, crypto, os, util), reading or writing files, spawning a process, or choosing between a Bun and a Node API.
Icebox a raised-but-undecided concern instead of forcing a plan-or-dismiss call: record it with no verdict so the context survives. Use when a review, PR, audit, or eval surfaces something real-maybe that should not be scheduled or closed yet, or when the user says to icebox or park an item.
Add a typed Hono API endpoint or WebSocket route: router, OpenAPI docs, validation envelope, and RPC client wiring. Use when adding or modifying routes in api/hono.
Start, restart, and verify the ZeroStarter dev stack. `bun run dev` serves portless named `.localhost` URLs (branch-prefixed in a worktree); resolve them with `bunx portless get`. Use when asked to run the app, when the API returns NOT_FOUND for routes that exist in source, or before browser testing.
| name | audit |
| description | Run the dependency security audit and maintain .github/notes/dependencies.md. Use when the canary pre-push audit hook fails, or when `bun audit` flags a high advisory. |
bun audit --audit-level high runs in the pre-push hook on canary only (lefthook.yml). .github/notes/dependencies.md is the canonical record of every active override; it stays even when there are none.
bun audit --audit-level high
Done when the output is clean or lists the high advisories to resolve.
Drop to the next rung only when the one above can't lift the tree:
Update the vulnerable dep (best): bump its catalog: entry in the root package.json.
Update the parent that pins the vulnerable transitive dep.
Override (last resort): add to overrides in the root package.json:
"overrides": { "<vulnerable-package>": "<patched-version>" }
Then bun i and confirm nothing broke: bun run check-types && bun run build. Done when bun run check-types && bun run build pass and bun audit --audit-level high reports no high advisories.
Match the file's existing shape: one ### <package> → <version> block per active override under ## Active overrides, each carrying Advisory (link, severity, affected range), Why an override (why an update or parent bump can't lift the tree), Risk, and Exit criteria (when to remove it). Delete a block when its override is dropped. Done when every entry in root overrides has a matching block and no block outlives its override.
package.json/bun.lock/.github/notes/dependencies.md go through a normal PR.