npm - @hienlh/ppm - Versions diffs - 0.9.81 → 0.9.83 - Mend

@hienlh/ppm 0.9.81 → 0.9.83

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1754) hide show

package/.opencode/skills/scout/references/external-scouting.md DELETED Viewed

@@ -1,140 +0,0 @@
-# External Scouting with Gemini/OpenCode
-Use external agentic tools for faster searches with large context windows (1M+ tokens).
-## Tool Selection
-```
-SCALE <= 3  → gemini CLI
-SCALE 4-5   → opencode CLI
-SCALE >= 6  → Use internal scouting instead
-```
-## Configuration
-Read from `.opencode/.ck.json`:
-```json
-{
-  "gemini": {
-    "model": "gemini-3-flash-preview"
-  }
-}
-```
-Default model: `gemini-3-flash-preview`
-## Gemini CLI (SCALE <= 3)
-### Command
-```bash
-gemini -y -m <model> "[prompt]"
-```
-### Example
-```bash
-gemini -y -m gemini-3-flash-preview "Search src/ for authentication files. List paths with brief descriptions."
-```
-## OpenCode CLI (SCALE 4-5)
-### Command
-```bash
-opencode run "[prompt]" --model opencode/grok-code
-```
-### Example
-```bash
-opencode run "Find all payment-related files in lib/ and api/" --model opencode/grok-code
-```
-## Installation Check
-Before using, verify tools installed:
-```bash
-which gemini
-which opencode
-```
-If not installed, ask user:
-1. **Yes** - Provide installation instructions (may need manual auth steps)
-2. **No** - Fall back to Explore subagents (`internal-scouting.md`)
-## Spawning Parallel Bash Agents
-Use `Task` tool with `subagent_type: "Bash"` to spawn parallel agents:
-```
-Task 1: subagent_type="Bash", prompt="Run: gemini -y -m gemini-3-flash-preview '[prompt1]'"
-Task 2: subagent_type="Bash", prompt="Run: gemini -y -m gemini-3-flash-preview '[prompt2]'"
-Task 3: subagent_type="Bash", prompt="Run: gemini -y -m gemini-3-flash-preview '[prompt3]'"
-```
-Spawn all in single message for parallel execution.
-## Prompt Guidelines
-- Be specific about directories to search
-- Request file paths with descriptions
-- Set clear scope boundaries
-- Ask for patterns/relationships if relevant
-## Example Workflow
-User: "Find database migration files"
-Spawn 3 parallel Bash agents via Task tool:
-```
-Task 1 (Bash): "Run: gemini -y -m gemini-3-flash-preview 'Search db/, migrations/ for migration files'"
-Task 2 (Bash): "Run: gemini -y -m gemini-3-flash-preview 'Search lib/, src/ for database schema files'"
-Task 3 (Bash): "Run: gemini -y -m gemini-3-flash-preview 'Search config/ for database configuration'"
-```
-## Reading File Content
-When needing to read file content, use chunking to stay within context limits (<150K tokens safe zone).
-### Step 1: Get Line Counts
-```bash
-wc -l path/to/file1.ts path/to/file2.ts path/to/file3.ts
-```
-### Step 2: Calculate Chunks
-- **Target:** ~500 lines per chunk (safe for most files)
-- **Max files per agent:** 3-5 small files OR 1 large file chunked
-**Chunking formula:**
-```
-chunks = ceil(total_lines / 500)
-lines_per_chunk = ceil(total_lines / chunks)
-```
-### Step 3: Spawn Parallel Bash Agents
-**Small files (<500 lines each):**
-```
-Task 1: subagent_type="Bash", prompt="cat file1.ts file2.ts"
-Task 2: subagent_type="Bash", prompt="cat file3.ts file4.ts"
-```
-**Large file (>500 lines) - use sed for ranges:**
-```
-Task 1: subagent_type="Bash", prompt="sed -n '1,500p' large-file.ts"
-Task 2: subagent_type="Bash", prompt="sed -n '501,1000p' large-file.ts"
-Task 3: subagent_type="Bash", prompt="sed -n '1001,1500p' large-file.ts"
-```
-### Chunking Decision Tree
-```
-File < 500 lines     → Read entire file
-File 500-1500 lines  → Split into 2-3 chunks
-File > 1500 lines    → Split into ceil(lines/500) chunks
-```
-Spawn all in single message for parallel execution.
-## Timeout and Error Handling
-- Set 3-minute timeout per bash call
-- Skip timed-out agents
-- Don't restart failed agents
-- On persistent failures, fall back to internal scouting

package/.opencode/skills/scout/references/internal-scouting.md DELETED Viewed

@@ -1,119 +0,0 @@
-# Internal Scouting with Explore Subagents
-Use Explore subagents when SCALE >= 6 or external tools unavailable.
-## How It Works
-Spawn multiple `Explore` subagents via `Task` tool to search codebase in parallel.
-## Task Tool Configuration
-```
-subagent_type: "Explore"
-```
-## Prompt Template
-```
-Quickly scout {DIRECTORY} for files related to: {USER_PROMPT}
-Instructions:
-- Search for relevant files matching the task
-- Use Glob/Grep for file discovery
-- List files with brief descriptions
-- Timeout: 3 minutes max
-- Skip if timeout reached
-Report format:
-## Found Files
-- `path/file.ext` - description
-## Patterns
-- Key patterns observed
-```
-## Spawning Strategy
-### Directory Division
-Split codebase logically:
-- `src/` - Source code
-- `lib/` - Libraries
-- `tests/` - Test files
-- `config/` - Configuration
-- `api/` - API routes
-### Parallel Execution
-- Spawn all agents in single `Task` tool call
-- Each agent gets distinct directory scope
-- No overlap between agents
-## Example
-User prompt: "Find authentication-related files"
-```
-Agent 1: Scout src/auth/, src/middleware/ for auth files
-Agent 2: Scout src/api/, src/routes/ for auth endpoints
-Agent 3: Scout tests/ for auth tests
-Agent 4: Scout lib/, utils/ for auth utilities
-Agent 5: Scout config/ for auth configuration
-Agent 6: Scout types/, interfaces/ for auth types
-```
-## Timeout Handling
-- Set 3-minute timeout per agent
-- Skip non-responding agents
-- Don't restart timed-out agents
-- Aggregate available results
-## Reading File Content
-When needing to read file content, use chunking to stay within context limits (<150K tokens safe zone).
-### Step 1: Get Line Counts
-```bash
-wc -l path/to/file1.ts path/to/file2.ts path/to/file3.ts
-```
-### Step 2: Calculate Chunks
-- **Target:** ~500 lines per chunk (safe for most files)
-- **Max files per agent:** 3-5 small files OR 1 large file chunked
-**Chunking formula:**
-```
-chunks = ceil(total_lines / 500)
-lines_per_chunk = ceil(total_lines / chunks)
-```
-### Step 3: Spawn Parallel Bash Agents
-**Small files (<500 lines each):**
-```
-Task 1: subagent_type="Bash", prompt="cat file1.ts file2.ts"
-Task 2: subagent_type="Bash", prompt="cat file3.ts file4.ts"
-```
-**Large file (>500 lines) - use sed for ranges:**
-```
-Task 1: subagent_type="Bash", prompt="sed -n '1,500p' large-file.ts"
-Task 2: subagent_type="Bash", prompt="sed -n '501,1000p' large-file.ts"
-Task 3: subagent_type="Bash", prompt="sed -n '1001,1500p' large-file.ts"
-```
-### Chunking Decision Tree
-```
-File < 500 lines     → Read entire file
-File 500-1500 lines  → Split into 2-3 chunks
-File > 1500 lines    → Split into ceil(lines/500) chunks
-```
-Spawn all in single message for parallel execution.
-## Result Aggregation
-Combine results from all agents:
-1. Deduplicate file paths
-2. Merge descriptions
-3. Note any gaps/timeouts
-4. List unresolved questions

package/.opencode/skills/scout/references/task-management-scouting.md DELETED Viewed

@@ -1,125 +0,0 @@
-# Scout Task Management Patterns
-Track parallel scout agent execution via Claude Native Tasks (TaskCreate, TaskUpdate, TaskList).
-## When to Create Tasks
-| Agents | Create Tasks? | Rationale |
-|--------|--------------|-----------|
-| ≤ 2    | No           | Overhead exceeds benefit, finishes quickly |
-| ≥ 3    | Yes          | Meaningful coordination, progress monitoring |
-## Task Registration Flow
-```
-TaskList()                          // Check for existing scout tasks
-  → Found tasks?  → Skip creation, reuse existing
-  → Empty?        → TaskCreate per agent (see schema below)
-```
-## Metadata Schema
-```
-TaskCreate(
-  subject: "Scout {directory} for {target}",
-  activeForm: "Scouting {directory}",
-  description: "Search {directories} for {patterns}",
-  metadata: {
-    agentType: "Explore",        // "Explore" (internal) or "Bash" (external)
-    scope: "src/auth/,src/middleware/",
-    scale: 6,
-    agentIndex: 1,               // 1-indexed position
-    totalAgents: 6,
-    toolMode: "internal",        // "internal" or "external"
-    priority: "P2",              // Always P2 for scout coordination
-    effort: "3m"                 // Fixed timeout per agent
-  }
-)
-```
-### Required Fields
-- `agentType` — Subagent type: `"Explore"` for internal, `"Bash"` for external
-- `scope` — Comma-separated directory boundaries for this agent
-- `scale` — Total SCALE value determined in Step 1
-- `agentIndex` / `totalAgents` — Position tracking (e.g., 3 of 6)
-- `toolMode` — `"internal"` or `"external"`
-- `priority` — Always `"P2"` (scout = coordination, not primary work)
-- `effort` — Always `"3m"` (fixed timeout)
-### Optional Fields
-- `searchPatterns` — Key patterns searched (aids debugging)
-- `externalTool` — If external: `"gemini"` or `"opencode"`
-## Task Lifecycle
-```
-Step 3: TaskCreate per agent     → status: pending
-Step 4: Before spawning agent    → TaskUpdate → status: in_progress
-Step 5: Agent returns report     → TaskUpdate → status: completed
-Step 5: Agent times out (3m)     → Keep in_progress, add error metadata
-```
-### Timeout Handling
-```
-TaskUpdate(taskId, {
-  metadata: { ...existing, error: "timeout" }
-})
-// Task stays in_progress — distinguishes timeout from incomplete
-// Log in final report's "Unresolved Questions" section
-```
-## Examples
-### Internal Scouting (SCALE=6)
-```
-// Step 3: Register 6 tasks
-TaskCreate(subject: "Scout src/auth/ for auth files",
-  activeForm: "Scouting src/auth/",
-  metadata: { agentType: "Explore", scope: "src/auth/", scale: 6,
-              agentIndex: 1, totalAgents: 6, toolMode: "internal",
-              priority: "P2", effort: "3m" })  // → taskId1
-// Repeat for agents 2-6 with different scopes
-// Step 4: Spawn agents
-TaskUpdate(taskId1, { status: "in_progress" })
-// ... spawn all Explore subagents in single Task tool call
-// Step 5: Collect
-TaskUpdate(taskId1, { status: "completed" })  // report received
-TaskUpdate(taskId3, { metadata: { error: "timeout" } })  // timed out
-```
-### External Scouting (SCALE=3, gemini)
-```
-TaskCreate(subject: "Scout db/ for migrations via gemini",
-  activeForm: "Scouting db/ via gemini",
-  metadata: { agentType: "Bash", scope: "db/,migrations/", scale: 3,
-              agentIndex: 1, totalAgents: 3, toolMode: "external",
-              externalTool: "gemini", priority: "P2", effort: "3m" })
-```
-## Integration with Cook/Planning
-Scout tasks are **independent** from cook/planning phase tasks — NOT parent-child.
-**Rationale:** Different lifecycle. Scout completes before cook continues. Mixing creates confusion in TaskList.
-**Sequence when cook spawns scout:**
-1. Cook Step 2 → spawns planner → planner spawns scout
-2. Scout registers its own tasks (Step 3), executes (Step 4-5)
-3. Scout returns aggregated report → planner continues
-4. Cook Step 3 hydrates phase tasks (separate from scout tasks)
-## Quality Check Output
-After registration: `✓ Registered [N] scout tasks ([internal|external] mode, SCALE={scale})`
-## Error Handling
-If `TaskCreate` fails: log warning, continue without task tracking. Scout remains fully functional — tasks add observability, not functionality.

package/.opencode/skills/security-scan/SKILL.md DELETED Viewed

@@ -1,141 +0,0 @@
----
-name: ck:security-scan
-description: "Scan codebase for security vulnerabilities, hardcoded secrets, dependency issues, and OWASP patterns. Use when asked to 'security scan', 'check for secrets', 'audit security', or before major releases."
-argument-hint: "[scope] [--secrets-only] [--deps-only] [--full]"
-metadata:
-  author: claudekit
-  version: "1.0.0"
----
-# Security Scan
-Lightweight security scanner using Claude's reasoning + shell tools. No external dependencies required.
-## Usage
-```
-/ck:security-scan              # Full scan of current project
-/ck:security-scan --secrets-only   # Only secret/credential detection
-/ck:security-scan --deps-only      # Only dependency audit
-/ck:security-scan src/api/         # Scan specific directory
-```
-## Scan Categories
-| Category | Method | Speed | Reference |
-|----------|--------|-------|-----------|
-| Secrets | Grep regex patterns | Fast | `references/secret-patterns.md` |
-| Dependencies | `npm audit` / `pip audit` | Medium | Built-in |
-| Code patterns | Grep + Claude analysis | Medium | `references/vulnerability-patterns.md` |
-## Workflow
-### 1. Detect Project Type
-```
-- Check for package.json → Node.js
-- Check for requirements.txt / pyproject.toml → Python
-- Check for go.mod → Go
-- Check for Cargo.toml → Rust
-```
-### 2. Secret Scanning (Always runs first)
-Load `references/secret-patterns.md` for regex patterns.
-Use Grep tool to search for each pattern category:
-- API keys and tokens (AWS, GitHub, Stripe, etc.)
-- Private keys and certificates
-- Database connection strings with credentials
-- Hardcoded passwords in code
-**Exclude**: `.env.example`, test fixtures, documentation, `node_modules/`, `dist/`
-For each match:
-- Verify it's a real secret (not a placeholder like `YOUR_API_KEY`)
-- Rate severity: CRITICAL (exposed prod key), HIGH (real credential), MEDIUM (possible credential)
-### 3. Dependency Audit (If applicable)
-Run the appropriate command:
-```bash
-# Node.js
-npm audit --json 2>/dev/null || echo '{"error":"npm audit failed"}'
-# Python (if pip-audit available)
-pip audit --format json 2>/dev/null || echo '{"error":"pip audit unavailable"}'
-```
-Parse output, categorize by severity (critical/high/moderate/low).
-### 4. Code Pattern Analysis
-Load `references/vulnerability-patterns.md` for patterns.
-Use Grep tool to search for dangerous patterns:
-- SQL injection (string concatenation in queries)
-- XSS (innerHTML, dangerouslySetInnerHTML without sanitization)
-- Command injection (exec/spawn with unsanitized input)
-- Path traversal (user input in file paths)
-- Insecure randomness (Math.random for security)
-- eval() / Function() with dynamic input
-For each match:
-- Read surrounding code context (5-10 lines)
-- Use Claude reasoning to determine if it's a real vulnerability or false positive
-- Rate severity and suggest fix
-### 5. .env Exposure Check
-```bash
-# Check if .env files are tracked by git
-git ls-files --error-unmatch .env .env.local .env.production 2>/dev/null
-# Check .gitignore for .env patterns
-grep -n "\.env" .gitignore 2>/dev/null
-```
-### 6. Generate Report
-Output a markdown report directly in chat:
-```markdown
-# Security Scan Report
-**Project:** {name}
-**Scanned:** {date}
-**Files checked:** {count}
-## Summary
-| Category | Critical | High | Medium | Low |
-|----------|----------|------|--------|-----|
-| Secrets  | X | X | X | - |
-| Deps     | X | X | X | X |
-| Code     | X | X | X | - |
-## Findings
-### CRITICAL
-1. **[SECRET]** Hardcoded AWS key in `src/config.js:42`
-   - Pattern: `AKIA[0-9A-Z]{16}`
-   - Fix: Move to environment variable
-### HIGH
-...
-## Recommendations
-1. ...
-```
-If `--auto` mode active in cook workflow: save report to `{CK_REPORTS_PATH}` or `plans/reports/security-scan-{date}.md`.
-## Scope Declaration
-This skill handles: Secret detection, dependency auditing, common vulnerability patterns.
-This skill does NOT handle: Penetration testing, runtime security analysis, infrastructure security, compliance audits.
-## Security Policy
-- NEVER output actual secret values in reports — redact to first 4 + last 2 chars
-- NEVER execute secrets or credentials found during scanning
-- NEVER modify code automatically — only report findings with fix suggestions
-- If a real credential is found, recommend immediate rotation

package/.opencode/skills/security-scan/references/secret-patterns.md DELETED Viewed

@@ -1,77 +0,0 @@
-# Secret Detection Patterns
-Grep patterns for detecting hardcoded secrets. Use with Grep tool, exclude test/example files.
-## High Confidence (Structured format, low false positive)
-### AWS
-```
-AKIA[0-9A-Z]{16}
-```
-### GitHub (Classic + Fine-grained)
-```
-gh[pousr]_[A-Za-z0-9_]{36,255}
-github_pat_[A-Za-z0-9_]{22,}
-```
-### Stripe
-```
-sk_live_[0-9a-zA-Z]{24,}
-rk_live_[0-9a-zA-Z]{24,}
-```
-### Slack
-```
-xox[baprs]-[0-9a-zA-Z-]{10,}
-```
-### Google Cloud
-```
-AIza[0-9A-Za-z_-]{35}
-```
-### Anthropic
-```
-sk-ant-[A-Za-z0-9_-]{40,}
-```
-### Private Keys
-```
------BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
-```
-### JWT / Bearer Tokens (in code, not headers)
-```
-eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}
-```
-## Medium Confidence (Need context verification)
-### Generic API Keys
-```
-(?i)(api[_-]?key|apikey|api[_-]?secret)\s*[:=]\s*['"][A-Za-z0-9/+=]{16,}['"]
-```
-### Database URLs
-```
-(?i)(postgres|mysql|mongodb|redis)://[^:]+:[^@]+@
-```
-### Passwords in Code
-```
-(?i)(password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]
-```
-### Generic Secrets
-```
-(?i)(secret|token|credential)\s*[:=]\s*['"][A-Za-z0-9/+=]{16,}['"]
-```
-## Exclusion Patterns
-Skip matches in these contexts:
-- Files: `*.example`, `*.test.*`, `*.spec.*`, `*.md`, `*.txt`
-- Directories: `node_modules/`, `dist/`, `vendor/`, `__pycache__/`
-- Content: Lines containing `TODO`, `FIXME`, `YOUR_`, `REPLACE_`, `xxx`, `placeholder`
-- Content: Variable declarations without actual values (`= process.env.`, `= os.getenv(`)

package/.opencode/skills/security-scan/references/vulnerability-patterns.md DELETED Viewed

@@ -1,105 +0,0 @@
-# Vulnerability Code Patterns
-Grep patterns for detecting common vulnerability patterns. Use with Grep tool.
-## SQL Injection
-### String concatenation in queries
-```
-(?i)(query|sql|execute)\s*\(.*\+.*\)
-(?i)(SELECT|INSERT|UPDATE|DELETE|DROP).*['"].*\+
-```
-### Template literals in queries (JS/TS)
-```
-(?i)(query|sql|execute)\s*\(`.*\$\{
-```
-## XSS (Cross-Site Scripting)
-### Dangerous DOM manipulation
-```
-\.innerHTML\s*=
-dangerouslySetInnerHTML
-document\.write\(
-```
-### Unescaped output (template engines)
-```
-\{\{\{        # Handlebars unescaped (triple braces)
-<%-\s*       # EJS unescaped (vs <%= escaped)
-\|safe\b     # Jinja2/Django unescaped
-v-html=      # Vue unescaped
-```
-## Command Injection
-### Unsanitized exec/spawn
-```
-(?i)(exec|execSync|spawn|spawnSync)\s*\(.*\+
-(?i)(exec|execSync|spawn|spawnSync)\s*\(`.*\$\{
-(?i)child_process.*\(.*\$\{
-os\.system\(.*\+
-subprocess\.(call|run|Popen)\(.*\+
-```
-## Path Traversal
-### User input in file paths
-```
-(?i)(readFile|writeFile|createReadStream|open)\s*\(.*req\.(params|query|body)
-(?i)(readFile|writeFile)\s*\(.*\+.*\)
-```
-## Insecure Randomness
-### Math.random for security
-```
-Math\.random\(\).*(?i)(token|key|secret|password|session|nonce|salt)
-```
-## Dangerous Functions
-### eval and equivalents
-```
-\beval\s*\(
-new\s+Function\s*\(
-setTimeout\s*\(\s*['"]
-setInterval\s*\(\s*['"]
-```
-### Deserialization
-```
-(?i)(pickle\.loads|yaml\.load\(|unserialize\()
-JSON\.parse\(.*req\.(params|query|body)
-```
-## Authentication / Authorization
-### Hardcoded credentials
-```
-(?i)(admin|root|password)\s*[:=]\s*['"][^'"]{4,}['"]
-```
-### Disabled security
-```
-(?i)(verify|ssl|tls|certificate)\s*[:=]\s*(false|False|0)
-(?i)rejectUnauthorized\s*:\s*false
-NODE_TLS_REJECT_UNAUTHORIZED.*0
-```
-## Information Disclosure
-### Debug/verbose in production
-```
-(?i)console\.(log|debug|trace)\s*\(.*(?:password|secret|token|key|credential)
-(?i)(DEBUG|VERBOSE)\s*[:=]\s*(true|True|1)
-```
-## False Positive Indicators
-Skip matches containing:
-- `test`, `spec`, `mock`, `fixture`, `example`, `sample`, `demo`
-- `TODO`, `FIXME`, `HACK`
-- Variable declarations reading from env: `process.env.`, `os.getenv(`
-- Comments (lines starting with `//`, `#`, `/*`)