@defai.digital/automatosx 5.6.35 → 5.7.2

package/examples/agents/.automatosx/abilities/refactoring.md

@@ -0,0 +1,223 @@
+# Refactoring Ability
+
+Expert knowledge of code smells, refactoring techniques, and strategies for improving code quality without changing behavior.
+
+## Overview
+
+Refactoring is the process of restructuring existing code without changing its external behavior. The goal is to improve code quality, readability, and maintainability.
+
+## Code Smells
+
+Code smells are indicators that something might be wrong with your code structure.
+
+### Bloaters
+
+**Long Method**
+- **Smell**: Method with too many lines
+- **Impact**: Hard to understand, test, and maintain
+- **Refactoring**: Extract Method, Replace Temp with Query, Decompose Conditional
+
+```typescript
+// ❌ BAD: Long method
+function processOrder(order: Order) {
+  // Validate order
+  if (!order.id) throw new Error('Invalid order');
+  if (order.items.length === 0) throw new Error('Empty order');
+  for (const item of order.items) {
+    if (item.quantity <= 0) throw new Error('Invalid quantity');
+    if (!item.price) throw new Error('Missing price');
+  }
+
+  // Calculate total
+  let subtotal = 0;
+  for (const item of order.items) {
+    subtotal += item.price * item.quantity;
+  }
+  const tax = subtotal * 0.1;
+  const shipping = subtotal > 100 ? 0 : 10;
+  const total = subtotal + tax + shipping;
+
+  // Apply discounts
+  let discount = 0;
+  if (order.customer.isPremium) {
+    discount = total * 0.15;
+  } else if (total > 200) {
+    discount = total * 0.1;
+  } else if (total > 100) {
+    discount = total * 0.05;
+  }
+
+  // Save order
+  // ... 50 more lines
+}
+
+// ✅ GOOD: Extracted methods
+function processOrder(order: Order) {
+  validateOrder(order);
+  const total = calculateTotal(order);
+  const discounted = applyDiscounts(total, order.customer);
+  return saveOrder(order, discounted);
+}
+
+function validateOrder(order: Order) {
+  if (!order.id) throw new Error('Invalid order');
+  if (order.items.length === 0) throw new Error('Empty order');
+  order.items.forEach(validateOrderItem);
+}
+
+function calculateTotal(order: Order): number {
+  const subtotal = calculateSubtotal(order.items);
+  const tax = calculateTax(subtotal);
+  const shipping = calculateShipping(subtotal);
+  return subtotal + tax + shipping;
+}
+
+function applyDiscounts(total: number, customer: Customer): number {
+  const discountRate = getDiscountRate(total, customer);
+  return total * (1 - discountRate);
+}
+```
+
+**Large Class**
+- **Smell**: Class with too many fields, methods, or responsibilities
+- **Impact**: Violates Single Responsibility Principle
+- **Refactoring**: Extract Class, Extract Subclass
+
+**Long Parameter List**
+- **Smell**: Function with many parameters
+- **Impact**: Hard to use, understand, and change
+- **Refactoring**: Introduce Parameter Object, Preserve Whole Object
+
+**Primitive Obsession**
+- **Smell**: Using primitives instead of small objects
+- **Impact**: Loss of type safety and domain meaning
+- **Refactoring**: Replace Data Value with Object, Introduce Value Object
+
+### Object-Orientation Abusers
+
+**Switch Statements**
+- **Smell**: Type-based conditionals instead of polymorphism
+- **Impact**: Violates Open/Closed Principle, hard to extend
+- **Refactoring**: Replace Conditional with Polymorphism
+
+**Refused Bequest**
+- **Smell**: Subclass doesn't use inherited methods
+- **Impact**: Violates Liskov Substitution Principle
+- **Refactoring**: Replace Inheritance with Delegation, Push Down Method
+
+### Change Preventers
+
+**Divergent Change**
+- **Smell**: One class changed for many different reasons
+- **Impact**: Violates Single Responsibility Principle
+- **Refactoring**: Extract Class
+
+**Shotgun Surgery**
+- **Smell**: Every change requires many small changes in many classes
+- **Impact**: Hard to make changes, easy to miss updates
+- **Refactoring**: Move Method, Move Field, Inline Class
+
+### Dispensables
+
+**Duplicate Code**
+- **Smell**: Same code structure in multiple places
+- **Impact**: Maintenance nightmare, bugs replicate
+- **Refactoring**: Extract Method, Extract Class, Pull Up Method
+
+**Dead Code**
+- **Smell**: Unused variables, parameters, methods, classes
+- **Impact**: Confusion, maintenance burden
+- **Refactoring**: Delete it
+
+**Speculative Generality**
+- **Smell**: "We might need this someday" code
+- **Impact**: Unnecessary complexity
+- **Refactoring**: Collapse Hierarchy, Inline Class, Remove Parameter
+
+## Refactoring Techniques
+
+### Extract Method
+
+**When**: Code fragment can be grouped together
+**Benefit**: Improves clarity, reusability
+
+### Inline Method
+
+**When**: Method body is as clear as the name
+**Benefit**: Reduces unnecessary indirection
+
+### Extract Variable
+
+**When**: Complex expression that's hard to understand
+**Benefit**: Makes expression clearer
+
+### Rename Variable/Method/Class
+
+**When**: Name doesn't reveal intent
+**Benefit**: Improves readability
+
+### Move Method/Field
+
+**When**: Method/field used more by another class
+**Benefit**: Reduces coupling, improves cohesion
+
+### Extract Class
+
+**When**: Class has responsibilities for multiple concerns
+**Benefit**: Follows Single Responsibility Principle
+
+### Replace Conditional with Polymorphism
+
+**When**: Type-based conditionals
+**Benefit**: Follows Open/Closed Principle
+
+## Refactoring Strategies
+
+### 1. The Refactoring Workflow
+
+**Red-Green-Refactor (TDD)**:
+1. **Red**: Write failing test
+2. **Green**: Make test pass (quick and dirty)
+3. **Refactor**: Improve code while keeping tests green
+
+**Safe Refactoring**:
+1. Ensure tests exist and pass
+2. Make small, incremental changes
+3. Run tests after each change
+4. Commit frequently
+5. Use automated refactoring tools when possible
+
+### 2. When to Refactor
+
+**Rule of Three**:
+- First time: Just do it
+- Second time: Wince but do it anyway
+- Third time: Refactor
+
+**Opportunistic Refactoring**:
+- While adding features
+- While fixing bugs
+- During code review
+- When understanding code
+
+### 3. When NOT to Refactor
+
+- Code is about to be deleted
+- Rewriting is easier than refactoring
+- Close to a deadline (defer to later)
+- Code works and doesn't need changes
+
+## Best Practices
+
+1. **Test Coverage First**: Ensure tests exist before refactoring
+2. **Small Steps**: Make one change at a time
+3. **Commit Often**: Save working states frequently
+4. **Use Tools**: Leverage IDE and automated refactoring
+5. **Review Changes**: Have someone review your refactoring
+6. **Document Why**: Explain major refactorings in commit messages
+
+## Further Reading
+
+- "Refactoring" by Martin Fowler
+- "Working Effectively with Legacy Code" by Michael Feathers
+- "Your Code as a Crime Scene" by Adam Tornhill

package/examples/agents/.automatosx/abilities/release-strategy.md

@@ -0,0 +1,58 @@
+# Release Strategy
+
+Plan and execute safe, controlled software releases. Use deployment patterns that minimize risk and enable quick rollback.
+
+## Deployment Patterns
+
+### 1. Blue-Green Deployment
+```bash
+# ✅ Switch traffic instantly
+kubectl apply -f deployment-green.yaml
+curl http://green.example.com/health
+kubectl patch service app -p '{"spec":{"selector":{"version":"green"}}}'
+# Rollback if needed: switch back to blue
+```
+
+### 2. Canary Deployment
+```yaml
+# ✅ Good: Gradual rollout (10% canary, 90% stable)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app-stable
+spec:
+  replicas: 9
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app-canary
+spec:
+  replicas: 1
+```
+
+### 3. Feature Flags
+```javascript
+// ✅ Good: Gradual feature rollout
+if (featureFlags.isEnabled('new-checkout', user.id)) {
+  return <NewCheckout />;
+}
+```
+
+## Don'ts ❌
+
+```bash
+# ❌ Bad: Big bang release on Friday
+./deploy-all-changes.sh
+# Go home, hope for best
+
+# ❌ Bad: No rollback plan
+```
+
+## Best Practices
+- Release during low-traffic periods
+- Have documented rollback procedure
+- Use feature flags for risky changes
+- Monitor key metrics during/after release
+- Automate deployment process
+- Document release notes

package/examples/agents/.automatosx/abilities/risk-assessment.md

@@ -0,0 +1,19 @@
+Goal
+- Identify and prioritize risks; propose mitigations and owners.
+
+How to do it
+- List risks by category (technical, operational, legal, market).
+- Rate likelihood and impact (Low/Med/High or 1–5).
+- Propose mitigations, triggers, and owners.
+
+Do
+- Use a table: Risk | Likelihood | Impact | Mitigation | Owner | Trigger.
+- Include residual risk after mitigation.
+
+Don’t
+- Don’t list generic risks without project context.
+- Don’t skip ownership/trigger criteria.
+
+Output
+- A prioritized risk register plus a short mitigation plan.
+

package/examples/agents/.automatosx/abilities/secrets-policy.md

@@ -0,0 +1,61 @@
+# Secrets Management Policy
+
+Securely store, rotate, and access secrets (API keys, passwords, certificates). Never commit secrets to version control.
+
+## Do's ✅
+
+```bash
+# ✅ Good: Environment variables
+export DATABASE_URL="postgresql://user:password@localhost/db"
+export API_KEY="sk_live_abc123"
+
+# Access in code
+const dbUrl = process.env.DATABASE_URL;
+```
+
+```javascript
+// ✅ Good: AWS Secrets Manager
+const AWS = require('aws-sdk');
+const client = new AWS.SecretsManager({ region: 'us-east-1' });
+
+async function getSecret(name) {
+  const data = await client.getSecretValue({ SecretId: name }).promise();
+  return JSON.parse(data.SecretString);
+}
+```
+
+```
+# ✅ Good: .gitignore secrets
+.env
+.env.local
+secrets/
+*.pem
+*.key
+```
+
+## Don'ts ❌
+
+```javascript
+// ❌ Bad: Hardcoded secrets
+const API_KEY = "sk_live_abc123xyz";
+const DB_PASSWORD = "SuperSecret123!";
+
+// ❌ Bad: Logging secrets
+logger.info('DB connection', { password: dbPassword });
+
+// ❌ Bad: Secrets in URLs
+fetch(`https://api.com/data?api_key=${apiKey}`);
+// ✅ Good: In headers
+fetch('https://api.com/data', {
+  headers: { 'Authorization': `Bearer ${apiKey}` }
+});
+```
+
+## Best Practices
+- Never commit secrets to git
+- Use secret management tools (Vault, AWS Secrets Manager)
+- Rotate secrets regularly (90 days)
+- Different secrets for dev/staging/prod
+- Audit secret access
+- Encrypt at rest and in transit
+- Use pre-commit hooks (detect-secrets)

package/examples/agents/.automatosx/abilities/secure-coding-review.md

@@ -0,0 +1,51 @@
+# Secure Coding Review
+
+Review code for security vulnerabilities using OWASP Top 10 and secure coding standards. Identify and fix flaws before production.
+
+## OWASP Top 10 Examples
+
+### A01: Broken Access Control
+```javascript
+// ❌ Bad: No authorization
+app.get('/api/users/:id/orders', async (req, res) => {
+  const orders = await db.getOrders(req.params.id);
+  res.json(orders);  // Any user can view any orders!
+});
+
+// ✅ Good: Verify ownership
+app.get('/api/users/:id/orders', auth, async (req, res) => {
+  if (req.user.id !== parseInt(req.params.id)) {
+    return res.status(403).json({ error: 'Forbidden' });
+  }
+  const orders = await db.getOrders(req.params.id);
+  res.json(orders);
+});
+```
+
+### A02: Cryptographic Failures
+```javascript
+// ❌ Bad: Weak hashing
+const hash = crypto.createHash('md5').update(password).digest('hex');
+
+// ✅ Good: Strong hashing
+const hash = await bcrypt.hash(password, 12);
+```
+
+### A03: Injection
+```javascript
+// ❌ Bad: SQL Injection
+const query = `SELECT * FROM users WHERE email = '${email}'`;
+
+// ✅ Good: Parameterized query
+const query = 'SELECT * FROM users WHERE email = ?';
+const results = await db.query(query, [email]);
+```
+
+## Review Checklist
+- ✅ MFA for sensitive actions
+- ✅ Authorization checks on all endpoints
+- ✅ Input validation and sanitization
+- ✅ Parameterized queries
+- ✅ Secrets not hardcoded
+- ✅ TLS 1.2+ required
+- ✅ No sensitive data in logs

package/examples/agents/.automatosx/abilities/security-audit.md

@@ -0,0 +1,65 @@
+# Security Audit Ability
+
+Identify and mitigate security vulnerabilities in code.
+
+## OWASP Top 10 Focus
+
+1. **Injection Attacks**
+   - SQL injection
+   - Command injection
+   - XSS (Cross-Site Scripting)
+   - Prevention: Input validation, parameterized queries
+
+2. **Broken Authentication**
+   - Weak passwords
+   - Session management issues
+   - Missing MFA
+   - Prevention: Strong auth mechanisms, secure sessions
+
+3. **Sensitive Data Exposure**
+   - Unencrypted data
+   - Hardcoded secrets
+   - Logging sensitive info
+   - Prevention: Encryption, secret management
+
+4. **Access Control**
+   - Missing authorization checks
+   - Privilege escalation
+   - IDOR (Insecure Direct Object References)
+   - Prevention: Proper authorization, RBAC
+
+5. **Security Misconfiguration**
+   - Default credentials
+   - Unnecessary services enabled
+   - Debug mode in production
+   - Prevention: Secure defaults, hardening
+
+## Security Checklist
+
+Input Validation:
+
+- [ ] Validate all user inputs
+- [ ] Whitelist > blacklist
+- [ ] Sanitize outputs
+- [ ] Check file upload types and sizes
+
+Authentication & Authorization:
+
+- [ ] Strong password requirements
+- [ ] Secure session management
+- [ ] Proper authorization checks
+- [ ] Rate limiting on auth endpoints
+
+Data Protection:
+
+- [ ] Encrypt sensitive data at rest
+- [ ] Use HTTPS for data in transit
+- [ ] No secrets in code/logs
+- [ ] Secure key management
+
+Code Security:
+
+- [ ] No eval() or dangerous functions
+- [ ] Parameterized queries (no string concat)
+- [ ] Secure random number generation
+- [ ] Dependency vulnerability scanning