patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill contains documented code patterns for this project — recurring structures, shared abstractions, and architectural approaches that keep the codebase consistent.
Each pattern file has a rationale explaining why the pattern exists, concrete code examples with file references, and guidance on when to use it (and when not to).
When writing new code or reviewing changes, check if an established pattern applies. If it does, follow it. If you have a good reason to deviate, note why.
The dense index at .claude/rules/patterns.md loads automatically and provides one-line summaries with pointers to full pattern files. Read the individual pattern file when you need full details.
Result<T,E> discriminated union with ok()/err() constructors for railway-oriented error handling across all core functionsSkilltapError base class with typed subclasses (UserError, GitError, ScanError, NetworkError) and optional hint fieldsafeParse + z.prettifyError at every data boundary; .prefault({}) for nested defaults; parseWithResult() helperloadState/saveStateloadJsonState<T> and saveJsonState generic helpers; all state modules delegate to these, no ad-hoc JSON I/OSourceAdapter strategy pattern: plain object literals with canHandle() + resolve(), iterated by a priority-ordered resolverAgentAdapter interface with detect()/invoke(), factory functions for CLI/custom/Ollama adapters, three-priority resolution via resolveAgent()resolved.adapter from resolveSource() gates source-type-specific logic (npm vs git vs local) throughout install, update, and trust flowssetupOutput(args) → Output handle; 3 modes (tty/plain/json); all command output goes through out.* methods; replaces old agent-mode-branching splitout?: Output for progresscomposePolicy(config, flags) → EffectivePolicy; composePolicyForSource adds trust overlay; loadPolicyOrExit() is CLI-layer entry pointscopeBase(scope, projectRoot?) pure helper — single-source scope-to-base-dir; use derived helpers (skillInstallDir, etc.) for full pathsapplySkillStateChange({scope, projectRoot, mutate, manifestSync?}) atomic load→mutate→save for skills[]; fires manifest sync hooks on diffwrapGit<T>() wrapper + Bun's $ template tag with .quiet(); extractStderr() for consistent error extractionscanStatic(); StaticWarning extends PatternMatch with a file fieldinstallSkill() returns InstallResult { records, warnings, semanticWarnings, updates, pluginRecord? }; unified onWarnings(warnings, kind, name) callbackcreateX() returns { path, cleanup }; copies static fixtures, initializes git repo, commits; always dot:true in Bun.Glob.scanexpect(result.ok).toBe(true) + discriminated union guard; VALID_* constants with spread for schema test variantscreateTestEnv() from @skilltap/test-utils returns { homeDir, configDir, cleanup() }; replaces per-test manual env save/restorerunSkilltap(args, homeDir, configDir) + cliCmd() from @skilltap/test-utils; routes to compiled binary when SKILLTAP_TEST_BIN set_dep = realImpl optional params; tests inject mocks as 2nd/3rd args; private type Fn = typeof realFn aliases enforce signature compatibilityT | null not Result; caller cascades through priority tiers (provenance → publisher → curated → unverified); outer try/catch guarantees a valid result alwayssymlink.ts; config enum arrays in schemas/config.tspolicy.agentMode and runAgentMode()/runInteractiveMode() no longer exist. See output-interface.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.