Bun loose

N14 · Passwords are never hashed with Bun.hash or a fast digest (SHA, MD5, CryptoHasher, createHash)

R10 · Browser bundles never inline the whole environment (bun build --env=inline, env: "inline")

R07 · SQL text is never built by interpolating or concatenating values (bind them)

R08 · Strings never become shell syntax: no sh -c with interpolation, no raw Bun Shell input, no exec of built strings

T10 · Parsed JSON and request payloads are validated, not cast to a type

R09 · Certificate verification stays on in production code (no rejectUnauthorized: false, no NODE_TLS_REJECT_UNAUTHORIZED=0)

R09 · Commands, env files and CI never set NODE_TLS_REJECT_UNAUTHORIZED=0

C05/G07 · CI keeps its check steps: no removed test/check/lint step, no continue-on-error or || true on one

C05 · package.json check scripts keep running real checks (no echo/exit 0/|| true, no pass-with-no-tests added)

C05 · Commands and the scripts they run never hide a failing check (|| true, ; exit 0, --pass-with-no-tests)

G07 · The user approves every change Claude makes to the G03 exceptions file (file tools ask)

G07 · Shell commands never write the G03 exceptions file (undone and refused)

Q01 · A commit never records focused tests; CI and package scripts never run bun test --only

Q09 · Declared coverage thresholds are never lowered or removed (bunfig.toml [test], package.json jest)

T04 · tsconfig keeps its strictness floor; a new tsconfig enables strict, noUncheckedIndexedAccess, noFallthroughCasesInSwitch, noImplicitOverride

T08 · New explicit any, as-unknown-as bridges and non-null assertions become unknown plus narrowing (warns)

T09 · No blanket diagnostic suppression; a targeted @ts-expect-error or disable states its reason

R03 · Catch handlers do not silently swallow errors or fake success

R04 · Subprocess results are observed: no discarded Bun.spawn/spawnSync or .nothrow() shell result

R01 · A promise created by a statement has a rejection owner (await, return or handler; language server types)

R02 · No async callback in forEach: completion and failures must propagate

R05 · Request handlers avoid synchronous filesystem, process and hashing work (warns)

R06 · Outbound fetch calls carry a deadline (an abort signal) (warns)

S01 · Shipped code does not reach into another workspace package through a relative path (use its declared entrypoint)

S02 · A new runtime import does not close a two-module cycle (the imported module imports this one) (warns)

S03 · Reusable modules do not start servers, spawn processes or write files at import time (warns)

S04 · New module-private functions and constants are used somewhere in the module (warns)

G01/D01 · Tells Claude, at session start, which Bun version capability claims are judged against

C01 · bun build of code that uses Bun APIs targets Bun (--target=bun); the default target is the browser

C04 · A package that promises Node (engines.node) does not export TypeScript sources Node cannot load

D01 · CI and images run an exact Bun version, the one the project pins (setup-bun, oven/bun images)

D02 · Prefer Bun for installs and scripts; npm, pnpm or yarn may stay when the chosen workflow is consistent (warns)

D03 · Dependencies change only through the package manager the project declares (packageManager field, lockfile)

D03 · No second lockfile next to another package manager's lockfile

D04 · CI and image builds install from the lockfile and fail on drift (bun install --frozen-lockfile, bun ci)

D04 · A turn that changes package.json dependencies also updates the lockfile next to it (once per stop)

D05 · Shipped entrypoints and CI never rely on Bun's runtime auto-install (-i, --install=fallback|force, install.auto)

D05 · Code never imports a package with a version in the specifier (Bun auto-install syntax)

D06 · Code imports only packages its own package.json declares (hoisting and neighbouring manifests do not count)

D07 · Dependency lifecycle scripts are trusted one by one, never all at once

D07 · Packages added to trustedDependencies by hand are named with the reason they need install scripts (warns)

D08 · Production code does not import packages declared only in devDependencies (warns: bundled output may inline them)

D08 · Test, lint and type tooling goes to devDependencies: a package.json listing it in dependencies is refused (shell writes undone)

D08 · Test, lint and type tooling is installed as a development dependency (bun add -d), never as a production one

D09 · Local packages are referenced through workspaces (workspace:*), not file:/link: copies or registry ranges (warns)

D10 · One-off tools run pinned or from the lockfile; project tools are not installed globally (warns)

D11 · A new dependency does not duplicate a responsibility an existing one already covers (warns, for review)

N01 · Prefer Bun for unit and integration tests; Vitest, Jest or Mocha may stay when compatible with the project's runtime (warns)

N02 · Prefer Bun for running TypeScript and JSX; tsx, ts-node or Babel loaders may stay when compatible with the project's runtime (warns)

N03 · Prefer Bun for bundling; esbuild, Rollup, Webpack, Vite, Parcel or tsup may stay when compatible with the project's runtime (warns)

N04 · Prefer Bun for loading .env files; dotenv loaders may stay when compatible with the project's runtime (warns)

N05 · Prefer Bun for restarting or reloading on change; nodemon or ts-node-dev may stay when compatible with the project's runtime (warns)

N06 · Prefer Bun for HTTP requests; node-fetch, axios or got may stay when compatible with the project's runtime (warns)

N07 · Prefer Bun for HTTP servers and routing; Express, Koa, Fastify or another Node server framework may stay when compatible with the project's runtime (warns)

N08 · Prefer Bun for WebSocket servers and clients; ws or another WebSocket package may stay when compatible with the project's runtime (warns)

N09 · Prefer Bun for whole-file reads and writes; fs-extra, rimraf, mkdirp or JSON file wrappers may stay when compatible with the project's runtime (warns)

N10 · Prefer Bun for running processes and shell commands; execa, cross-spawn, shelljs, zx or cross-env may stay when compatible with the project's runtime (warns)

N11 · Prefer Bun for file globbing and pattern matching; glob, fast-glob, globby or minimatch may stay when compatible with the project's runtime (warns)

N12 · Prefer Bun for PostgreSQL, MySQL and SQLite access; pg, postgres, mysql2 or SQLite drivers may stay when compatible with the project's runtime (warns)

N13 · Prefer Bun for Redis access; redis or ioredis may stay when compatible with the project's runtime (warns)

N14 · Prefer Bun for password hashing; bcrypt or argon2 packages may stay when compatible with the project's runtime (warns)

N15 · Prefer Bun for S3 object storage; the AWS S3 SDK or MinIO client may stay when compatible with the project's runtime (warns)

N16 · Prefer crypto.randomUUID() and Bun.randomUUIDv7() to the uuid package for v4/v7 ids; uuid may stay (warns)

T01 · Prefer bun check for type checking; a pinned TypeScript checker may stay (warns)

T05 · A tsconfig for Bun code resolves modules like Bun (bundler or nodenext), not node10/classic

T06 · TypeScript using Bun APIs has Bun's type declarations (@types/bun) in its package

Q01 · Claude does not finish a turn with focused tests (.only, fit, fdescribe) in the test files it changed (once per stop)

Q02 · A newly skipped or todo test says why on the line before it (warns)

Q03 · A turn that changes production code also changes or adds a test, or says why none is needed (warns, once per stop)

Q04 · Assertions compare behavior, not a value with itself or a constant with itself (warns, for review)

Q06 · Asynchronous assertions (.resolves, .rejects) are awaited or returned

Q07 · Tests restore what they change: spies, fake time, environment variables; module mocks are isolated (warns)

Q08 · Tests wait on readiness and use ephemeral ports, not fixed sleeps or fixed ports (warns)

Q10 · Updated snapshots are reviewed against intended behavior (bun test -u, hand-edited .snap files) (warns)

Records which checks (typecheck, test, lint) a shell call runs, scripts and task runners (turbo) included, when they cover the changed packages (C02 ledger)

C02/C05 · A final message claiming passing tests, types or lint needs a successful run after Claude's last edit

Records, per session, Claude's code edits (file tools and shell writes) and the checks that succeeded after them (C02)

C02 · A turn that changed code ends only after the required checks succeeded on the final files (once per stop)

Records that a shell call runs a package-manager operation, so the manifest and lockfile writes it causes are not hand edits (D02, D06)

S07 · Newly shipped behavior has no placeholder returns or not-implemented stubs (warns)

T07 · A turn adds no TypeScript errors to the changed files or their importers (language server, once per stop)

Records the work tree when a prompt starts: the baseline of the end-of-turn rules (D04, T07, Q03, C02)