@hienlh/ppm 0.9.81 → 0.9.82

package/.opencode/skills/ck-security/references/stride-owasp-checklist.md

@@ -1,128 +0,0 @@
-# STRIDE + OWASP Security Checklist
-
-Reference checklist for `ck:security` audits. Use during Step 2 (STRIDE Analysis) and Step 3 (OWASP Top 10 Check).
-
----
-
-## STRIDE Checklist
-
-### Spoofing (Authentication)
-- [ ] All endpoints require authentication (unless intentionally public)
-- [ ] Passwords hashed with bcrypt/argon2 — not MD5 or SHA1
-- [ ] JWT tokens have expiration (`exp`) and are validated server-side
-- [ ] Session management uses `Secure`, `HttpOnly`, `SameSite` cookie flags
-- [ ] Multi-factor auth available for sensitive operations
-- [ ] OAuth/OIDC flows use `state` parameter to prevent CSRF
-- [ ] Default credentials removed from all services and dependencies
-
-### Tampering (Integrity)
-- [ ] Input validation on all user-supplied data (type, length, format)
-- [ ] Parameterized queries used — no string concatenation for SQL/NoSQL
-- [ ] CSRF tokens present on all state-changing forms
-- [ ] Request signing for API-to-API calls (HMAC or mTLS)
-- [ ] File uploads validated for type (magic bytes), size, and content
-- [ ] Deserialization of untrusted data avoided or sandboxed
-- [ ] HTTP methods restricted per endpoint (no GET for mutations)
-
-### Repudiation (Logging)
-- [ ] Authentication events logged: login, logout, failures
-- [ ] Authorization failures logged with user/resource context
-- [ ] Data modification events logged with actor and timestamp
-- [ ] Logs do not contain sensitive data (passwords, tokens, PII)
-- [ ] Log integrity protected — append-only storage or centralized sink
-- [ ] Logs retained per compliance requirements (90 days minimum)
-
-### Information Disclosure
-- [ ] Error messages do not leak stack traces in production
-- [ ] API responses exclude internal IDs, system paths, or version strings
-- [ ] Sensitive data encrypted at rest (AES-256 or equivalent)
-- [ ] All transport uses TLS 1.2+ — no HTTP for sensitive endpoints
-- [ ] No hardcoded secrets in source code (see Secret Patterns below)
-- [ ] `.env` files and credential files listed in `.gitignore`
-- [ ] API responses filtered to minimum necessary fields (no over-fetching)
-
-### Denial of Service
-- [ ] Rate limiting on authentication and sensitive endpoints
-- [ ] Request body size limits configured at server/gateway level
-- [ ] Pagination enforced on all list endpoints (no unbounded queries)
-- [ ] Timeouts set on all external API and database calls
-- [ ] Connection pools sized and cleaned up properly
-- [ ] Regex patterns reviewed for catastrophic backtracking (ReDoS)
-- [ ] Background jobs have concurrency limits and dead-letter queues
-
-### Elevation of Privilege
-- [ ] Role-based access control (RBAC) enforced server-side, not client-side
-- [ ] Horizontal privilege checks: user A cannot access user B's resources (IDOR)
-- [ ] Admin endpoints have separate, stricter auth middleware
-- [ ] Privilege escalation paths require re-authentication
-- [ ] Service accounts use principle of least privilege
-- [ ] Third-party integrations scoped to minimum required permissions
-
----
-
-## OWASP Top 10 Quick Reference
-
-| # | Category | What to Check |
-|---|----------|---------------|
-| A01 | Broken Access Control | Missing auth checks, IDOR vulnerabilities, CORS misconfiguration, path traversal |
-| A02 | Cryptographic Failures | Weak hashing (MD5/SHA1), plaintext storage, missing TLS, weak cipher suites |
-| A03 | Injection | SQL, NoSQL, OS command, LDAP, template injection via unsanitized input |
-| A04 | Insecure Design | Missing threat model, business logic flaws, no abuse-case testing |
-| A05 | Security Misconfiguration | Default credentials, verbose error pages, unnecessary features/ports enabled |
-| A06 | Vulnerable Components | Outdated dependencies, known CVEs, unpatched libraries |
-| A07 | Auth Failures | Brute force possible, credential stuffing, session fixation, weak tokens |
-| A08 | Data Integrity Failures | Unsigned updates, unverified deserialization, CI/CD pipeline compromise |
-| A09 | Logging Failures | Missing security event logs, no alerting, insufficient monitoring coverage |
-| A10 | SSRF | Unvalidated user-supplied URLs, internal service access via fetch/curl |
-
----
-
-## Secret Patterns to Detect
-
-Scan source files for the following regex patterns. Any match is a Critical finding.
-
-```regex
-# Generic API keys
-(?i)(api[_-]?key|apikey)\s*[:=]\s*['"][A-Za-z0-9\-_]{20,}['"]
-
-# AWS access key IDs
-AKIA[0-9A-Z]{16}
-
-# AWS secret access keys
-(?i)aws[_-]?secret[_-]?access[_-]?key\s*[:=]\s*['"][A-Za-z0-9/+]{40}['"]
-
-# JSON Web Tokens
-eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+
-
-# Generic passwords in config/code
-(?i)(password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]
-
-# Private keys (PEM format)
------BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
-
-# GitHub personal access tokens
-ghp_[A-Za-z0-9]{36}
-
-# Stripe secret keys
-sk_(live|test)_[A-Za-z0-9]{24,}
-
-# Generic bearer tokens
-(?i)bearer\s+[A-Za-z0-9\-._~+/]{20,}
-```
-
-> False positive reduction: skip matches inside `*.test.*`, `*.spec.*`, `*.example`, and `*.md` files when the value is clearly a placeholder (e.g., `YOUR_KEY_HERE`, `<your-token>`).
-
----
-
-## Dependency Audit Commands
-
-Run the appropriate command for the detected stack and include output in the findings report:
-
-| Stack | Command |
-|-------|---------|
-| Node.js | `npm audit --json` |
-| Python | `pip-audit --format json` |
-| Go | `govulncheck ./...` |
-| Ruby | `bundle audit check --update` |
-| Java/Maven | `mvn dependency-check:check` |
-| Rust | `cargo audit` |

package/.opencode/skills/ckm-storage/SKILL.md

@@ -1,23 +0,0 @@
----
-name: ckm:storage
-description: S3 storage operations - upload, sync, list, get URLs
-argument-hint: "[list|sync|upload|url] [args]"
-metadata:
-  author: claudekit
-  version: "1.0.0"
----
-
-## Subcommands
-
-| Subcommand | Description | Reference |
-|------------|-------------|-----------|
-| `list` | list | `references/list.md` |
-| `sync` | sync | `references/sync.md` |
-| `upload` | upload | `references/upload.md` |
-| `url` | url | `references/url.md` |
-
-## Routing
-
-1. Parse subcommand from `$ARGUMENTS` (first word)
-2. Load corresponding `references/{subcommand}.md`
-3. Execute with remaining arguments

package/.opencode/skills/ckm-storage/references/list.md

@@ -1,87 +0,0 @@
-# Command: /storage:list
-
-List objects in S3-compatible storage.
-
-## Usage
-
-```bash
-/storage:list [prefix]
-```
-
-## Arguments
-
-- `prefix` (optional): Filter by prefix/folder
-
-## Examples
-
-```bash
-# List all objects
-/storage:list
-
-# List objects in designs folder
-/storage:list designs/
-
-# List objects matching prefix
-/storage:list campaign-2024/
-```
-
-## Output Format
-
-```
-designs/hero.png          125 KB   2024-12-26
-designs/logo.svg           12 KB   2024-12-25
-videos/demo.mp4          45.2 MB   2024-12-24
----
-3 objects, 45.3 MB total
-```
-
-## Prompt
-
-```
-List objects in S3-compatible storage.
-
-**Arguments:** $ARGUMENTS
-
-**Steps:**
-1. Parse optional prefix argument
-2. Load s3-client from `.opencode/skills/storage/scripts/s3-client.cjs`
-3. Check `isConfigured()` - if false, output config instructions and exit
-4. Call `list(prefix)`
-5. Format output:
-   - Table: key, size (human readable), last modified
-   - Summary: count, total size
-
-**Script Usage:**
-```javascript
-const s3 = require('./.opencode/skills/storage/scripts/s3-client.cjs');
-
-if (!s3.isConfigured()) {
-  console.log('S3 not configured. Set S3_ENDPOINT, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_BUCKET in .env');
-  return;
-}
-
-const result = await s3.list(prefix);
-
-if (!result.success) {
-  console.log(`Error: ${result.error}`);
-  return;
-}
-
-function formatSize(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-  return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
-}
-
-let totalSize = 0;
-result.objects.forEach(obj => {
-  totalSize += obj.size;
-  const date = new Date(obj.lastModified).toISOString().split('T')[0];
-  console.log(`${obj.key.padEnd(40)} ${formatSize(obj.size).padStart(10)} ${date}`);
-});
-
-console.log('---');
-console.log(`${result.objects.length} objects, ${formatSize(totalSize)} total`);
-```
-```
-

package/.opencode/skills/ckm-storage/references/sync.md

@@ -1,89 +0,0 @@
-# Command: /storage:sync
-
-Sync a local folder to S3-compatible storage.
-
-## Usage
-
-```bash
-/storage:sync <folder> [remote-prefix]
-```
-
-## Arguments
-
-- `folder` (required): Local folder path relative to project root
-- `remote-prefix` (optional): Remote prefix/folder name (default: folder name)
-
-## Examples
-
-```bash
-# Sync entire assets/designs folder
-/storage:sync assets/designs
-
-# Sync to specific remote prefix
-/storage:sync assets/banners campaign-2024/banners
-
-# Dry run to preview what would be uploaded
-/storage:sync assets/videos --dry-run
-```
-
-## Options
-
-- `--dry-run`: Preview files without uploading
-- `--extensions=.png,.jpg`: Filter by file extensions
-
-## Behavior
-
-1. Check if S3 is configured
-2. Recursively scan local folder
-3. Upload each file, preserving folder structure
-4. Report: uploaded count, failed count, total size
-
-## Prompt
-
-```
-Sync local folder to S3-compatible storage.
-
-**Arguments:** $ARGUMENTS
-
-**Steps:**
-1. Parse arguments:
-   - First arg = local folder
-   - Second arg (optional) = remote prefix
-   - Parse flags: --dry-run, --extensions=x,y
-2. Load s3-client from `.opencode/skills/storage/scripts/s3-client.cjs`
-3. Check `isConfigured()` - if false, output config instructions and exit
-4. Verify local folder exists
-5. Call `sync(localFolder, remotePrefix, options)`
-6. Output results:
-   - Dry run: list files that would be uploaded
-   - Actual: "Synced: {uploaded} files, {failed} failed"
-   - List uploaded URLs
-
-**Script Usage:**
-```javascript
-const s3 = require('./.opencode/skills/storage/scripts/s3-client.cjs');
-
-if (!s3.isConfigured()) {
-  console.log('S3 not configured. Set S3_ENDPOINT, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_BUCKET in .env');
-  return;
-}
-
-const options = {
-  dryRun: args.includes('--dry-run'),
-  extensions: parseExtensions(args)
-};
-
-const result = await s3.sync(localFolder, remotePrefix, options);
-
-if (options.dryRun) {
-  console.log('Dry run - files that would be uploaded:');
-  result.files.forEach(f => console.log(`  ${f.remote}`));
-} else {
-  console.log(`Synced: ${result.uploaded} files, ${result.failed} failed`);
-  result.files.filter(f => f.success).forEach(f => {
-    console.log(`  ${f.path} -> ${f.url}`);
-  });
-}
-```
-```
-

package/.opencode/skills/ckm-storage/references/upload.md

@@ -1,77 +0,0 @@
-# Command: /storage:upload
-
-Upload a single asset to S3-compatible storage.
-
-## Usage
-
-```bash
-/storage:upload <path>
-```
-
-## Arguments
-
-- `path` (required): Local file path relative to project root
-
-## Examples
-
-```bash
-# Upload single image
-/storage:upload assets/designs/hero-banner.png
-
-# Upload to specific remote path
-/storage:upload assets/videos/demo.mp4 videos/demo.mp4
-```
-
-## Behavior
-
-1. Check if S3 is configured (env vars present)
-2. If not configured: output message, no error
-3. If configured: upload file, return public URL
-
-## Required Environment Variables
-
-```bash
-S3_ENDPOINT=https://xxx.r2.cloudflarestorage.com
-S3_ACCESS_KEY_ID=xxxxx
-S3_SECRET_ACCESS_KEY=xxxxx
-S3_BUCKET=my-assets
-S3_PUBLIC_URL=https://cdn.example.com  # optional
-```
-
-## Prompt
-
-```
-Upload the specified file to S3-compatible storage.
-
-**Arguments:** $ARGUMENTS
-
-**Steps:**
-1. Parse the path argument (first arg = local path, optional second arg = remote path)
-2. Load s3-client from `.opencode/skills/storage/scripts/s3-client.cjs`
-3. Check `isConfigured()` - if false, output "S3 not configured. Set S3_ENDPOINT, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_BUCKET in .env" and exit
-4. Verify local file exists
-5. If no remote path provided, use local path relative to project root
-6. Call `upload(localPath, remotePath)`
-7. Output result:
-   - Success: "Uploaded: {remotePath}\nURL: {url}"
-   - Failure: "Upload failed: {error}"
-
-**Script Usage:**
-```javascript
-const s3 = require('./.opencode/skills/storage/scripts/s3-client.cjs');
-
-if (!s3.isConfigured()) {
-  console.log('S3 not configured. Set S3_ENDPOINT, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_BUCKET in .env');
-  return;
-}
-
-const result = await s3.upload(localPath, remotePath);
-if (result.success) {
-  console.log(`Uploaded: ${remotePath}`);
-  console.log(`URL: ${result.url}`);
-} else {
-  console.log(`Upload failed: ${result.error}`);
-}
-```
-```
-

package/.opencode/skills/ckm-storage/references/url.md

@@ -1,63 +0,0 @@
-# Command: /storage:url
-
-Get public URL for an S3 object.
-
-## Usage
-
-```bash
-/storage:url <path>
-```
-
-## Arguments
-
-- `path` (required): Remote object key/path
-
-## Examples
-
-```bash
-# Get URL for specific object
-/storage:url designs/hero-banner.png
-
-# Output: https://cdn.example.com/designs/hero-banner.png
-```
-
-## Behavior
-
-- Uses `S3_PUBLIC_URL` if configured (custom domain)
-- Otherwise constructs URL from endpoint and bucket
-
-## Prompt
-
-```
-Get public URL for an S3 object.
-
-**Arguments:** $ARGUMENTS
-
-**Steps:**
-1. Parse path argument
-2. Load s3-client from `.opencode/skills/storage/scripts/s3-client.cjs`
-3. Check `isConfigured()` - if false, output config instructions and exit
-4. Optionally verify object exists with `exists(path)`
-5. Call `getPublicUrl(path)`
-6. Output URL
-
-**Script Usage:**
-```javascript
-const s3 = require('./.opencode/skills/storage/scripts/s3-client.cjs');
-
-if (!s3.isConfigured()) {
-  console.log('S3 not configured. Set S3_ENDPOINT, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_BUCKET in .env');
-  return;
-}
-
-// Optional: verify exists
-const check = await s3.exists(remotePath);
-if (!check.exists && !check.error) {
-  console.log(`Warning: Object may not exist: ${remotePath}`);
-}
-
-const url = s3.getPublicUrl(remotePath);
-console.log(url);
-```
-```
-

package/.opencode/skills/claude-code/SKILL.md

@@ -1,64 +0,0 @@
----
-name: ckm:claude-code
-description: Activate when users ask about Claude Code installation, slash commands (/plan, /fix, /content, /docs, /design, /git), creating/managing Agent Skills, configuring MCP servers, setting up hooks/plugins, IDE integration (VS Code, JetBrains), CI/CD workflows, enterprise deployment (SSO, RBAC, sandboxing), troubleshooting authentication/performance issues, or advanced features (extended thinking, caching, checkpointing).
-argument-hint: "[question or topic]"
-metadata:
-  author: claudekit
-  version: "1.0.0"
----
-
-# Claude Code
-
-Anthropic's agentic coding tool combining autonomous planning, execution, and validation with extensibility through skills, plugins, MCP servers, and hooks.
-
-## Core Concepts
-
-**Subagents**: Specialized agents (planner, content-reviewer, campaign-debugger, docs-manager, ui-ux-designer, researcher, copywriter)
-
-**Agent Skills**: Modular capabilities with SKILL.md + bundled resources (scripts, references, assets) loaded progressively
-
-**Slash Commands**: User-defined operations in `.opencode/commands/` expanding to prompts
-
-**Hooks**: Event-driven shell commands (SessionStart, PreToolUse, PostToolUse, Stop, SubagentStop)
-
-**MCP Servers**: Model Context Protocol integrations for external tools (GitHub, Jira, databases)
-
-**Plugins**: Packaged collections distributed via marketplace
-
-## Reference Guide
-
-Load references as needed for specific topics:
-
-| Topic | Reference File | Contents |
-|-------|----------------|----------|
-| Installation & setup | `references/getting-started.md` | Prerequisites, installation methods, authentication |
-| Slash commands | `references/slash-commands.md` | Full catalog: /cook, /plan, /fix, /test, /docs, /git, /design |
-| Workflow examples | `references/common-workflows.md` | Feature implementation, bug fixing, testing, git ops |
-| Creating skills | `references/agent-skills.md` | Skill structure, metadata, bundled resources |
-| MCP servers | `references/mcp-integration.md` | Configuration, common servers, authentication |
-| Hooks system | `references/hooks-comprehensive.md` | Event types, command/prompt hooks, tool matchers |
-| Plugins | `references/hooks-and-plugins.md` | Plugin structure, marketplace, installation |
-| Configuration | `references/configuration.md` | Settings hierarchy, model config, output styles |
-| Enterprise | `references/enterprise-features.md` | SSO, RBAC, sandboxing, audit logging, deployment |
-| IDE integration | `references/ide-integration.md` | VS Code extension, JetBrains plugin |
-| CI/CD | `references/cicd-integration.md` | GitHub Actions, GitLab workflows |
-| Advanced features | `references/advanced-features.md` | Extended thinking, caching, checkpointing |
-| Troubleshooting | `references/troubleshooting.md` | Auth failures, MCP issues, performance, debug mode |
-| API reference | `references/api-reference.md` | Admin, Messages, Files, Models, Skills APIs |
-| Best practices | `references/best-practices.md` | Project organization, security, performance, cost |
-
-## Instructions
-
-When answering questions:
-
-1. Identify topic from user query
-2. Load relevant reference files (use table above)
-3. Provide specific guidance with examples
-4. For complex queries, load multiple references
-
-**Documentation sources:**
-- Context7 llms.txt: `https://context7.com/websites/claude_en_claude-code/llms.txt?tokens=10000`
-- Topic search: `https://context7.com/websites/claude_en_claude-code/llms.txt?topic=<topic>&tokens=5000`
-- Official docs: https://docs.claude.com/en/docs/claude-code/
-- GitHub: https://github.com/anthropics/claude-code
-- Support: support.claude.com