---
name: sdlc-security-init
description: Materialize stack-specific security patterns into the current project. Safe to re-run — preserves user-defined rules outside the managed block.
---

# $sdlc-security-init

One-time (re-runnable) command that writes stack-specific security rules into
`.codex/security-patterns.yaml` and `.codex/security-guidance.md` in the current project.

The pipeline's own security phase consumes these files. It also reads bundled provider
fragments directly, so a normal run is stack-aware without initialization; this command
materializes the resolved rules inside a project for inspection and project-local extension.

Run this command when changing stacks or after upgrading the marketplace. Re-running it
regenerates only the managed block.

## Prerequisites

- No additional plugin install is required; the consumer is this repository's own security phase.
- The current directory must be a project root (contains `.codex/` or the command creates it).

## Arguments

- `--dry-run`: print what would be written without modifying any files.

## Algorithm

### 1. Detect active stack plugins

Run `python3 {SDLC_HOME}/scripts/detect-stack.py --repo .` and use its
`providers` dependency closure. This guarantees security rules follow the same
aspect winners and foundation dependencies as the pipeline. Always include:

- `sdlc` core (base patterns apply to every project)
- every foundation returned by the provider closure

### 2. Collect security-patterns fragments

For each active plugin (sdlc core first, then js-foundation, then stack plugins in priority order):

- Read `{SDLC_HOME}/security-patterns/{plugin_name}.yaml` if it exists.
- Parse the `patterns:` array.
- Tag each rule with `_source: {plugin_name}` for traceability (written as a comment in the output).
- De-duplicate by `rule_name` (first occurrence wins — higher-priority plugin wins).

### 3. Merge into `.codex/security-patterns.yaml`

The target file uses a **managed block** delimited by:

```yaml
# >>> sdlc-marketplace managed (do not edit inside this block) >>>
# <<< sdlc-marketplace managed <<<
```

**If the file does not exist:** create it with only the managed block containing all collected rules.

**If the file exists and contains the managed block:** replace only the content between the markers. Preserve everything outside the markers (user's custom rules above or below).

**If the file exists WITHOUT the managed block markers:** do NOT modify the file. Print a warning:

```
⚠️ .codex/security-patterns.yaml exists without sdlc-marketplace markers.
   Manual file detected — skipping to avoid clobbering your rules.
   To enable managed rules: add the managed block markers manually or delete the file and re-run.
```

Output format inside the managed block:

```yaml
# >>> sdlc-marketplace managed (do not edit inside this block) >>>
# Generated by $sdlc-security-init. Re-run to regenerate. Sources: sdlc, js-foundation, nextjs-plugin.
patterns:
  # --- sdlc (core) ---
  - rule_name: hardcoded_api_key_stripe
    ...
  # --- js-foundation ---
  - rule_name: js_dynamic_code_execution
    ...
  # --- nextjs-plugin ---
  - rule_name: nextjs_dangerous_html
    ...
# <<< sdlc-marketplace managed <<<
```

### 4. Materialize `.codex/security-guidance.md`

Derive stack-specific security guidance from the `security phase` `phase_prompts_injection` section of each active stack's `stack.md`. This gives the model-backed review layer context it would otherwise lack.

Same managed-block pattern:

```markdown
<!-- >>> sdlc-marketplace managed (do not edit inside this block) >>> -->
<!-- <<< sdlc-marketplace managed <<< -->
```

If the file exists without markers: skip + warn (same as above).

Content inside the block:

```markdown
<!-- >>> sdlc-marketplace managed (do not edit inside this block) >>> -->
<!-- Generated by $sdlc-security-init. Sources: nextjs-plugin. -->

## Stack-specific security guidance

### Next.js
{content of the security phase_prompts_injection from nextjs-plugin/stack.md}

### Node.js
{content of the security phase_prompts_injection from nodejs-plugin/stack.md, if active}
<!-- <<< sdlc-marketplace managed <<< -->
```

If a stack's `stack.md` has no `security` injection block, skip that stack silently.

### 5. Confirm pipeline consumption

Use `Glob {SDLC_HOME}/security-patterns/*.yaml`. If no fragments exist, append:

```text
⚠️ No bundled security fragments were found. The generated project files remain
   inspectable, but the installation should be repaired with $sdlc-doctor.
```

### 6. Print summary

```
✅ $sdlc-security-init complete

Files written:
  .codex/security-patterns.yaml   — N rules (sources: vanilla, nextjs)
  .codex/security-guidance.md — N stacks

Rules by source:
  sdlc (core):         6 rules
  js-foundation:       4 rules
  nextjs-plugin:       4 rules
  Total:               14 rules

Pipeline consumer: ✅ bundled security phase

Re-run $sdlc-security-init after:
  - Adding or changing a stack provider
  - Upgrading the marketplace
  - Changing the project's detected stack
```

## --dry-run mode

In dry-run mode, print the full content that WOULD be written to each file (or the diff vs. existing content) without modifying anything. Clearly mark output as `[DRY RUN]`.

## Instructions

- Use the detector result plus `Read`; do not implement a second detector.
- Merge rules programmatically — do not invent rules that are not in the fragment files.
- The managed block markers are the idempotency contract. Never remove content outside them.
- Print the summary last. Be terse — counts and sources, no narrative.
- If `.codex/` directory does not exist in the project root, create it before writing.