claude-jackedBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: dcr
description: "Risk-tiered multi-lens review for this repo - the SMALL/MEDIUM/LARGE tier sets reviewer count and agent budget (4/8/16), findings are validated before fixing, and the run stops after two waves by default. (repo)"
---
# Generated by /jacked-setup — 2026-09-01 | Template v2 | Engine: jacked v0.96.0
# Commit this file. Its LARGE-tier, Codex, and conditional sections read ~/.claude/skills/dcr/references/ from the jacked install. To update: uv tool install --upgrade claude-jacked && jacked install && /jacked-setup dcr

## Repo Config

- **Project**: claude-jacked
- **Type**: CLI tool + local FastAPI service / dashboard (Python)
- **Stack**: Python (FastAPI, uvicorn, hatchling, pystray/rumps); SQLite via `jacked/web/database.py`; file-based Memory Vault under `jacked/memory/` (cross-process file locks, atomic rollups, Claude-hook capture/recall); integrates the Anthropic API and OAuth/credential flows

## Default Lens Selection
Always on: Guardrails, Security, Access Control, Data Integrity & Schema Safety, Observability & Debuggability, Logic & Edge Cases, Testing, Maintainability, Simplicity & Reuse
Usually off: UX & Flow (turn ON when the change touches the `jacked/data/web/` dashboard), Performance (turn ON for the sweep / usage-monitor / bulk-refresh paths)
(Still allow runtime override — if changes clearly involve an "off" lens, include it.)

## Planning Phase Lenses
When reviewing a plan or design doc (PLANNING phase, no code changes yet):
Use: Guardrails, Logic & Edge Cases, Maintainability, Simplicity & Reuse
Skip: Security, Access Control, Performance, UX & Flow, Testing, Observability & Debuggability, Data Integrity & Schema Safety (can't assess without code)
Reviewers focus on: missing edge cases in the design, over-engineering, architectural soundness, plan completeness. Repo emphasis: any auth/account/hook design must be checked for multi-account credential isolation and for hook-content trust boundaries (transcript/session text is untrusted input).

## PROJECT_CONTEXT Paths
Read these for reviewer context (validate with `ls` first, skip missing):
- `CLAUDE.md`, `JACKED_GUARDRAILS.md`, `lessons.md`
- `design/guardrails_and_lint_gate.md`
- `design/memory-vault-design.html`
- `docs/architecture/oauth-and-credential-flows.md`, `docs/architecture/auto-swap-system.md`

## Domain Wild Cards
In addition to the standard pool, include:
- Do changes to the hook scripts under `jacked/data/hooks/` (memory_capture, memory_recall, session_account_tracker, qa_suggest, chain_of_command_context) keep the recall trust boundary — no untrusted transcript/session content re-injected as instructions, and no hook failure that blocks or corrupts the user's Claude session?
- Does it keep multi-account credentials isolated — no token, session, or usage data from one Claude/Codex account leaking into another (or into the wrong dashboard card)?
- Does it honor the repo's uv-only rule (no bare `pip`/`python`; use `uv run` / `uv pip`) and the code-size guardrail?
- Does it degrade gracefully headless — when the tray/menubar or a display is unavailable, does the service still run?

## Domain Pre-Mortem Scenarios
In addition to the standard pool, include:
- A credential or usage token from one account leaks into another account's session, or the dashboard renders the wrong account's data.
- Two concurrent Claude sessions write the Memory Vault at once and a settings merge wipes user settings or corrupts the vault (the recent DCR-wave bug class: settings-wipe, lock contract, rollup atomicity).
- The background service fails to bind `:8321` after an upgrade/restart (launchd KeepAlive race) and the dashboard silently goes dark.
- A skill/command/hook install writes into the wrong `~/.claude` or `~/.agents` location and clobbers or duplicates a user's existing config.

## Sensitive Areas
Touching any of these forces the LARGE risk tier (full reviewer fan-out):
- OAuth/credential flows and account switching — tokens, keychain access, credential detection, anything under `jacked/web/` touching auth or account identity
- `jacked/data/hooks/` — hook scripts inject content into user Claude sessions (trust boundary: transcript/session text is untrusted input)
- Memory Vault write paths (`jacked/memory/`) — cross-process file locks, atomic rollups, user data loss risk
- SQLite schema changes in `jacked/web/database.py` or any migration logic

## Config Staleness Check
Before using the config above, run a lightweight drift check (advisory only — never block on it):
1. `git rev-parse HEAD` and compare to **Generated at commit** below.
2. `ls package.json pyproject.toml go.mod Cargo.toml setup.py Gemfile pom.xml build.gradle composer.json mix.exs 2>/dev/null` and compare the manifest set to **Detected stack** below.
3. If EITHER differs, count the intervening commits (`git rev-list --count <generated-commit>..HEAD 2>/dev/null`) and surface one line, then continue:
   > ⚠️ This `/dcr` config was generated N commits ago and the stack/paths may have drifted — re-run `/jacked-setup dcr` to refresh.
   If the generated commit is unreachable (history rewritten) or the manifest set changed, surface the nudge regardless of commit count. Never stop or skip the run on a staleness mismatch.

<!-- Staleness fingerprint — the engine compares these against the live repo on each run -->
- **Generated at commit**: 938c956d03edb6720fc4e5adbad117b3cdca9bce
- **Detected stack**: pyproject.toml

<!-- ENGINE — DO NOT EDIT BELOW THIS LINE -->

## BUDGET FIRST

The RISK TIER sets how wide the review goes and the agent budget caps it. Nothing later in this file widens either.

### RISK TIER

Classify the change under review into ONE tier. Sensitivity beats size: a 20-line auth change is LARGE. When genuinely torn between tiers, take the higher one.

- **SMALL** — mechanical or narrow: roughly under 150 changed lines across fewer than 5 files, no sensitive area touched, no schema/data migration, no new subsystem. Typical:

BLOCKgrade F · trust 39/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (7 observation(s))

Network

declared (9 observation(s))

Shell

declared (3 observation(s))

Dependencies

pinned

Secrets in source

found

Findings (25)

data = yaml.load(block, Loader=_bounded_loader())  # noqa: S506 - SafeLoader subclass

- OAuth/credential flows and account switching — tokens, keychain access, credential detection, anything under `jacked/web/` touching auth or account identity

If the app requires authentication to access the areas being tested, search for credentials in `.env` files before asking the user.

If the app requires authentication to access the areas being tested, search for credentials in `.env` files before asking the user.

The audit reads content from the audited repo into Claude's context: `cat .npmrc`, `cat .yarnrc.yml`, `head -5 requirements.txt`, scanner JSON output, finding descriptions, etc. A malicious repo could

- **Never tell the user to pre-authorize destructive git for this command.** Do not advise adding a broad `Bash(git:*)`/`Bash(git branch:*)` always-allow rule, and do not advise clicking "always allow

- If the repo passes the floor check but has minimal context, write a config with defaults. If it fails the floor check (zero manifests, zero source files, zero commits), do NOT generate — tell the us

- A file that is **large but low-churn** is **NOT a priority** — if the code never changes, it isn't costing us money. Note it if you like, but don't tell the user to refactor it.

<p>SessionStart hook injects a group-scoped brief, hard-budgeted ≤ 1,500 tokens: <code>hot.md</code> + index excerpt + top-linked decisions + last episodic entry for the cwd's repo, ending with an exp

<tr><td><b>M4</b> recall</td><td>jacked/memory/recall.py; data/hooks/memory_recall.py (synchronous, stdout). Assembly order with hard 1500-token budget (len//4 estimate): imperative line reserved firs

modules_to_reset.append(importlib.import_module(mod_path))

module = importlib.import_module(f"jacked.data.hooks.{name}")

"curl": "potential data exfiltration",

"wget": "potential data exfiltration",

TOKEN = "sk-ant-oat01-secret-access-token"

"refreshToken": "sk-ant-ort01-secret-refresh-token",

TOKEN = "sk-ant-oat01-secret-access-token"

If the user says it is the wrong session, re-run step 5 with the alternate's id from the candidate list.

.gitleaks.toml

.pre-commit-config.yaml

module = importlib.import_module(local_imports[name])

mod = importlib.import_module(mod_name)

mod = importlib.import_module(mod_name)

f"eval(require('fs').readFileSync({json.dumps(str(ACCOUNTS_JS))},'utf8'));\n"

program = f"eval(require('fs').readFileSync({json.dumps(str(PROVIDER_JS))},'utf8'));\n"

Gates applied: instruction_override, no_behavioural_pass.