@heyai-rules/pilo-masterkit 2.1.0 → 3.1.0

package/.agent/rules/cpp/security.md

@@ -1,51 +1,51 @@
----
-paths:
-  - "**/*.cpp"
-  - "**/*.hpp"
-  - "**/*.cc"
-  - "**/*.hh"
-  - "**/*.cxx"
-  - "**/*.h"
-  - "**/CMakeLists.txt"
----
-# C++ Security
-
-> This file extends [common/security.md](../common/security.md) with C++ specific content.
-
-## Memory Safety
-
-- Never use raw `new`/`delete` — use smart pointers
-- Never use C-style arrays — use `std::array` or `std::vector`
-- Never use `malloc`/`free` — use C++ allocation
-- Avoid `reinterpret_cast` unless absolutely necessary
-
-## Buffer Overflows
-
-- Use `std::string` over `char*`
-- Use `.at()` for bounds-checked access when safety matters
-- Never use `strcpy`, `strcat`, `sprintf` — use `std::string` or `fmt::format`
-
-## Undefined Behavior
-
-- Always initialize variables
-- Avoid signed integer overflow
-- Never dereference null or dangling pointers
-- Use sanitizers in CI:
-  ```bash
-  cmake -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined" ..
-  ```
-
-## Static Analysis
-
-- Use **clang-tidy** for automated checks:
-  ```bash
-  clang-tidy --checks='*' src/*.cpp
-  ```
-- Use **cppcheck** for additional analysis:
-  ```bash
-  cppcheck --enable=all src/
-  ```
-
-## Reference
-
-See skill: `cpp-coding-standards` for detailed security guidelines.
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.hpp"
+  - "**/*.cc"
+  - "**/*.hh"
+  - "**/*.cxx"
+  - "**/*.h"
+  - "**/CMakeLists.txt"
+---
+# C++ Security
+
+> This file extends [common/security.md](../common/security.md) with C++ specific content.
+
+## Memory Safety
+
+- Never use raw `new`/`delete` — use smart pointers
+- Never use C-style arrays — use `std::array` or `std::vector`
+- Never use `malloc`/`free` — use C++ allocation
+- Avoid `reinterpret_cast` unless absolutely necessary
+
+## Buffer Overflows
+
+- Use `std::string` over `char*`
+- Use `.at()` for bounds-checked access when safety matters
+- Never use `strcpy`, `strcat`, `sprintf` — use `std::string` or `fmt::format`
+
+## Undefined Behavior
+
+- Always initialize variables
+- Avoid signed integer overflow
+- Never dereference null or dangling pointers
+- Use sanitizers in CI:
+  ```bash
+  cmake -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined" ..
+  ```
+
+## Static Analysis
+
+- Use **clang-tidy** for automated checks:
+  ```bash
+  clang-tidy --checks='*' src/*.cpp
+  ```
+- Use **cppcheck** for additional analysis:
+  ```bash
+  cppcheck --enable=all src/
+  ```
+
+## Reference
+
+See skill: `cpp-coding-standards` for detailed security guidelines.

package/.agent/rules/cpp/testing.md

@@ -1,44 +1,44 @@
----
-paths:
-  - "**/*.cpp"
-  - "**/*.hpp"
-  - "**/*.cc"
-  - "**/*.hh"
-  - "**/*.cxx"
-  - "**/*.h"
-  - "**/CMakeLists.txt"
----
-# C++ Testing
-
-> This file extends [common/testing.md](../common/testing.md) with C++ specific content.
-
-## Framework
-
-Use **GoogleTest** (gtest/gmock) with **CMake/CTest**.
-
-## Running Tests
-
-```bash
-cmake --build build && ctest --test-dir build --output-on-failure
-```
-
-## Coverage
-
-```bash
-cmake -DCMAKE_CXX_FLAGS="--coverage" -DCMAKE_EXE_LINKER_FLAGS="--coverage" ..
-cmake --build .
-ctest --output-on-failure
-lcov --capture --directory . --output-file coverage.info
-```
-
-## Sanitizers
-
-Always run tests with sanitizers in CI:
-
-```bash
-cmake -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined" ..
-```
-
-## Reference
-
-See skill: `cpp-testing` for detailed C++ testing patterns, TDD workflow, and GoogleTest/GMock usage.
+---
+paths:
+  - "**/*.cpp"
+  - "**/*.hpp"
+  - "**/*.cc"
+  - "**/*.hh"
+  - "**/*.cxx"
+  - "**/*.h"
+  - "**/CMakeLists.txt"
+---
+# C++ Testing
+
+> This file extends [common/testing.md](../common/testing.md) with C++ specific content.
+
+## Framework
+
+Use **GoogleTest** (gtest/gmock) with **CMake/CTest**.
+
+## Running Tests
+
+```bash
+cmake --build build && ctest --test-dir build --output-on-failure
+```
+
+## Coverage
+
+```bash
+cmake -DCMAKE_CXX_FLAGS="--coverage" -DCMAKE_EXE_LINKER_FLAGS="--coverage" ..
+cmake --build .
+ctest --output-on-failure
+lcov --capture --directory . --output-file coverage.info
+```
+
+## Sanitizers
+
+Always run tests with sanitizers in CI:
+
+```bash
+cmake -DCMAKE_CXX_FLAGS="-fsanitize=address,undefined" ..
+```
+
+## Reference
+
+See skill: `cpp-testing` for detailed C++ testing patterns, TDD workflow, and GoogleTest/GMock usage.

package/.agent/rules/csharp/coding-style.md

@@ -1,72 +1,72 @@
----
-paths:
-  - "**/*.cs"
-  - "**/*.csx"
----
-# C# Coding Style
-
-> This file extends [common/coding-style.md](../common/coding-style.md) with C#-specific content.
-
-## Standards
-
-- Follow current .NET conventions and enable nullable reference types
-- Prefer explicit access modifiers on public and internal APIs
-- Keep files aligned with the primary type they define
-
-## Types and Models
-
-- Prefer `record` or `record struct` for immutable value-like models
-- Use `class` for entities or types with identity and lifecycle
-- Use `interface` for service boundaries and abstractions
-- Avoid `dynamic` in application code; prefer generics or explicit models
-
-```csharp
-public sealed record UserDto(Guid Id, string Email);
-
-public interface IUserRepository
-{
-    Task<UserDto?> FindByIdAsync(Guid id, CancellationToken cancellationToken);
-}
-```
-
-## Immutability
-
-- Prefer `init` setters, constructor parameters, and immutable collections for shared state
-- Do not mutate input models in-place when producing updated state
-
-```csharp
-public sealed record UserProfile(string Name, string Email);
-
-public static UserProfile Rename(UserProfile profile, string name) =>
-    profile with { Name = name };
-```
-
-## Async and Error Handling
-
-- Prefer `async`/`await` over blocking calls like `.Result` or `.Wait()`
-- Pass `CancellationToken` through public async APIs
-- Throw specific exceptions and log with structured properties
-
-```csharp
-public async Task<Order> LoadOrderAsync(
-    Guid orderId,
-    CancellationToken cancellationToken)
-{
-    try
-    {
-        return await repository.FindAsync(orderId, cancellationToken)
-            ?? throw new InvalidOperationException($"Order {orderId} was not found.");
-    }
-    catch (Exception ex)
-    {
-        logger.LogError(ex, "Failed to load order {OrderId}", orderId);
-        throw;
-    }
-}
-```
-
-## Formatting
-
-- Use `dotnet format` for formatting and analyzer fixes
-- Keep `using` directives organized and remove unused imports
-- Prefer expression-bodied members only when they stay readable
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+---
+# C# Coding Style
+
+> This file extends [common/coding-style.md](../common/coding-style.md) with C#-specific content.
+
+## Standards
+
+- Follow current .NET conventions and enable nullable reference types
+- Prefer explicit access modifiers on public and internal APIs
+- Keep files aligned with the primary type they define
+
+## Types and Models
+
+- Prefer `record` or `record struct` for immutable value-like models
+- Use `class` for entities or types with identity and lifecycle
+- Use `interface` for service boundaries and abstractions
+- Avoid `dynamic` in application code; prefer generics or explicit models
+
+```csharp
+public sealed record UserDto(Guid Id, string Email);
+
+public interface IUserRepository
+{
+    Task<UserDto?> FindByIdAsync(Guid id, CancellationToken cancellationToken);
+}
+```
+
+## Immutability
+
+- Prefer `init` setters, constructor parameters, and immutable collections for shared state
+- Do not mutate input models in-place when producing updated state
+
+```csharp
+public sealed record UserProfile(string Name, string Email);
+
+public static UserProfile Rename(UserProfile profile, string name) =>
+    profile with { Name = name };
+```
+
+## Async and Error Handling
+
+- Prefer `async`/`await` over blocking calls like `.Result` or `.Wait()`
+- Pass `CancellationToken` through public async APIs
+- Throw specific exceptions and log with structured properties
+
+```csharp
+public async Task<Order> LoadOrderAsync(
+    Guid orderId,
+    CancellationToken cancellationToken)
+{
+    try
+    {
+        return await repository.FindAsync(orderId, cancellationToken)
+            ?? throw new InvalidOperationException($"Order {orderId} was not found.");
+    }
+    catch (Exception ex)
+    {
+        logger.LogError(ex, "Failed to load order {OrderId}", orderId);
+        throw;
+    }
+}
+```
+
+## Formatting
+
+- Use `dotnet format` for formatting and analyzer fixes
+- Keep `using` directives organized and remove unused imports
+- Prefer expression-bodied members only when they stay readable

package/.agent/rules/csharp/hooks.md

@@ -1,25 +1,25 @@
----
-paths:
-  - "**/*.cs"
-  - "**/*.csx"
-  - "**/*.csproj"
-  - "**/*.sln"
-  - "**/Directory.Build.props"
-  - "**/Directory.Build.targets"
----
-# C# Hooks
-
-> This file extends [common/hooks.md](../common/hooks.md) with C#-specific content.
-
-## PostToolUse Hooks
-
-Configure in `~/.claude/settings.json`:
-
-- **dotnet format**: Auto-format edited C# files and apply analyzer fixes
-- **dotnet build**: Verify the solution or project still compiles after edits
-- **dotnet test --no-build**: Re-run the nearest relevant test project after behavior changes
-
-## Stop Hooks
-
-- Run a final `dotnet build` before ending a session with broad C# changes
-- Warn on modified `appsettings*.json` files so secrets do not get committed
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+  - "**/*.csproj"
+  - "**/*.sln"
+  - "**/Directory.Build.props"
+  - "**/Directory.Build.targets"
+---
+# C# Hooks
+
+> This file extends [common/hooks.md](../common/hooks.md) with C#-specific content.
+
+## PostToolUse Hooks
+
+Configure in `~/.claude/settings.json`:
+
+- **dotnet format**: Auto-format edited C# files and apply analyzer fixes
+- **dotnet build**: Verify the solution or project still compiles after edits
+- **dotnet test --no-build**: Re-run the nearest relevant test project after behavior changes
+
+## Stop Hooks
+
+- Run a final `dotnet build` before ending a session with broad C# changes
+- Warn on modified `appsettings*.json` files so secrets do not get committed

package/.agent/rules/csharp/patterns.md

@@ -1,50 +1,50 @@
----
-paths:
-  - "**/*.cs"
-  - "**/*.csx"
----
-# C# Patterns
-
-> This file extends [common/patterns.md](../common/patterns.md) with C#-specific content.
-
-## API Response Pattern
-
-```csharp
-public sealed record ApiResponse<T>(
-    bool Success,
-    T? Data = default,
-    string? Error = null,
-    object? Meta = null);
-```
-
-## Repository Pattern
-
-```csharp
-public interface IRepository<T>
-{
-    Task<IReadOnlyList<T>> FindAllAsync(CancellationToken cancellationToken);
-    Task<T?> FindByIdAsync(Guid id, CancellationToken cancellationToken);
-    Task<T> CreateAsync(T entity, CancellationToken cancellationToken);
-    Task<T> UpdateAsync(T entity, CancellationToken cancellationToken);
-    Task DeleteAsync(Guid id, CancellationToken cancellationToken);
-}
-```
-
-## Options Pattern
-
-Use strongly typed options for config instead of reading raw strings throughout the codebase.
-
-```csharp
-public sealed class PaymentsOptions
-{
-    public const string SectionName = "Payments";
-    public required string BaseUrl { get; init; }
-    public required string ApiKeySecretName { get; init; }
-}
-```
-
-## Dependency Injection
-
-- Depend on interfaces at service boundaries
-- Keep constructors focused; if a service needs too many dependencies, split responsibilities
-- Register lifetimes intentionally: singleton for stateless/shared services, scoped for request data, transient for lightweight pure workers
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+---
+# C# Patterns
+
+> This file extends [common/patterns.md](../common/patterns.md) with C#-specific content.
+
+## API Response Pattern
+
+```csharp
+public sealed record ApiResponse<T>(
+    bool Success,
+    T? Data = default,
+    string? Error = null,
+    object? Meta = null);
+```
+
+## Repository Pattern
+
+```csharp
+public interface IRepository<T>
+{
+    Task<IReadOnlyList<T>> FindAllAsync(CancellationToken cancellationToken);
+    Task<T?> FindByIdAsync(Guid id, CancellationToken cancellationToken);
+    Task<T> CreateAsync(T entity, CancellationToken cancellationToken);
+    Task<T> UpdateAsync(T entity, CancellationToken cancellationToken);
+    Task DeleteAsync(Guid id, CancellationToken cancellationToken);
+}
+```
+
+## Options Pattern
+
+Use strongly typed options for config instead of reading raw strings throughout the codebase.
+
+```csharp
+public sealed class PaymentsOptions
+{
+    public const string SectionName = "Payments";
+    public required string BaseUrl { get; init; }
+    public required string ApiKeySecretName { get; init; }
+}
+```
+
+## Dependency Injection
+
+- Depend on interfaces at service boundaries
+- Keep constructors focused; if a service needs too many dependencies, split responsibilities
+- Register lifetimes intentionally: singleton for stateless/shared services, scoped for request data, transient for lightweight pure workers

package/.agent/rules/csharp/security.md

@@ -1,58 +1,58 @@
----
-paths:
-  - "**/*.cs"
-  - "**/*.csx"
-  - "**/*.csproj"
-  - "**/appsettings*.json"
----
-# C# Security
-
-> This file extends [common/security.md](../common/security.md) with C#-specific content.
-
-## Secret Management
-
-- Never hardcode API keys, tokens, or connection strings in source code
-- Use environment variables, user secrets for local development, and a secret manager in production
-- Keep `appsettings.*.json` free of real credentials
-
-```csharp
-// BAD
-const string ApiKey = "sk-live-123";
-
-// GOOD
-var apiKey = builder.Configuration["OpenAI:ApiKey"]
-    ?? throw new InvalidOperationException("OpenAI:ApiKey is not configured.");
-```
-
-## SQL Injection Prevention
-
-- Always use parameterized queries with ADO.NET, Dapper, or EF Core
-- Never concatenate user input into SQL strings
-- Validate sort fields and filter operators before using dynamic query composition
-
-```csharp
-const string sql = "SELECT * FROM Orders WHERE CustomerId = @customerId";
-await connection.QueryAsync<Order>(sql, new { customerId });
-```
-
-## Input Validation
-
-- Validate DTOs at the application boundary
-- Use data annotations, FluentValidation, or explicit guard clauses
-- Reject invalid model state before running business logic
-
-## Authentication and Authorization
-
-- Prefer framework auth handlers instead of custom token parsing
-- Enforce authorization policies at endpoint or handler boundaries
-- Never log raw tokens, passwords, or PII
-
-## Error Handling
-
-- Return safe client-facing messages
-- Log detailed exceptions with structured context server-side
-- Do not expose stack traces, SQL text, or filesystem paths in API responses
-
-## References
-
-See skill: `security-review` for broader application security review checklists.
+---
+paths:
+  - "**/*.cs"
+  - "**/*.csx"
+  - "**/*.csproj"
+  - "**/appsettings*.json"
+---
+# C# Security
+
+> This file extends [common/security.md](../common/security.md) with C#-specific content.
+
+## Secret Management
+
+- Never hardcode API keys, tokens, or connection strings in source code
+- Use environment variables, user secrets for local development, and a secret manager in production
+- Keep `appsettings.*.json` free of real credentials
+
+```csharp
+// BAD
+const string ApiKey = "sk-live-123";
+
+// GOOD
+var apiKey = builder.Configuration["OpenAI:ApiKey"]
+    ?? throw new InvalidOperationException("OpenAI:ApiKey is not configured.");
+```
+
+## SQL Injection Prevention
+
+- Always use parameterized queries with ADO.NET, Dapper, or EF Core
+- Never concatenate user input into SQL strings
+- Validate sort fields and filter operators before using dynamic query composition
+
+```csharp
+const string sql = "SELECT * FROM Orders WHERE CustomerId = @customerId";
+await connection.QueryAsync<Order>(sql, new { customerId });
+```
+
+## Input Validation
+
+- Validate DTOs at the application boundary
+- Use data annotations, FluentValidation, or explicit guard clauses
+- Reject invalid model state before running business logic
+
+## Authentication and Authorization
+
+- Prefer framework auth handlers instead of custom token parsing
+- Enforce authorization policies at endpoint or handler boundaries
+- Never log raw tokens, passwords, or PII
+
+## Error Handling
+
+- Return safe client-facing messages
+- Log detailed exceptions with structured context server-side
+- Do not expose stack traces, SQL text, or filesystem paths in API responses
+
+## References
+
+See skill: `security-review` for broader application security review checklists.