@kubbisec/ai-linux-arm64 0.1.3 → 0.1.5

package/bundled/skills/sec-using-skills/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: sec-using-skills
+description: "Route KubbiSec chat to sec-* workflow skills vs domain skills (naus-pipelines, remediation, scanner-*, aspm-platform). Invoke before choosing a skill path."
+metadata:
+  kubbisec:
+    category: workflow
+    surfaces: [chat]
+---
+
+# sec-using-skills — Skill routing (KubbiSec)
+
+Use this skill when the user intent is unclear, when multiple skills could apply, or at the start of a non-trivial session.
+
+**Announce:** `Using sec-using-skills to pick the right workflow.`
+
+## The rule
+
+If a **sec-*** workflow skill might apply, invoke it **before** domain skills or code changes. User explicit `@skill <name>` overrides routing.
+
+## Skill categories
+
+| Category | Examples | Purpose |
+|----------|----------|---------|
+| **workflow** | `sec-clarify`, `sec-brainstorm`, `sec-plan`, `sec-review`, `sec-verify`, `sec-debug` | Specify, plan, review, verify |
+| **domain** | `naus-pipelines`, `remediation`, `aspm-platform`, `github-local` | ASPM, CI, CVE fixes, GitHub |
+| **scanner** | `scanner-semgrep`, `scanner-trivy`, … | Run one scanner per turn |
+
+## Routing matrix
+
+| User intent | Primary skill | Optional secondary | Never combine |
+|-------------|---------------|-------------------|---------------|
+| Vague scope, missing org/project/CVE context | `sec-clarify` | — | `sec-plan` before clarify done |
+| New feature / refactor / policy (chat) | `sec-brainstorm` → `sec-plan` | `naus-pipelines` if CI-only | `remediation` |
+| Implement approved `.kbs/specs/*.md` | `sec-plan` | domain skill for file area | `sec-brainstorm` mid-implementation |
+| Review diff before merge / after fix | `sec-review` | `sec-verify` | `sec-brainstorm` |
+| Claim "done", "tests pass", open PR | `sec-verify` | — | skip verify |
+| Failed remediation / flaky test / regression | `sec-debug` | `remediation` (CVE-scoped) | `sec-plan` |
+| NAUS pipeline YAML | `naus-pipelines` | `sec-review` if auth/secrets touched | — |
+| CVE minimal patch | `remediation` | `sec-verify` on exit | `sec-brainstorm` |
+| ASPM API / findings | `aspm-platform` | — | — |
+| Local GitHub clone/status | `github-local` | — | — |
+| Run Semgrep/Trivy/etc. | one `scanner-*` | — | multiple scanners same turn |
+
+## Invocation surfaces
+
+| Surface | sec-* | Domain |
+|---------|-------|--------|
+| `kbs chat` | Yes (`/skill:sec-*`, `@skill sec-*`) | Yes |
+| `kbs chat --mode plan` | **Required:** clarify → brainstorm → plan | Read-only discovery only |
+| `kbs chat --mode review` | **Prefer** `sec-review` | Read + diff tools |
+| `kbs fix` / remediation harness | `sec-review` + `sec-verify` only | `remediation` implicit |
+| `kbs watch` | `sec-debug` on failure | scanner-* per policy |
+
+## Typical greenfield flow
+
+1. `sec-clarify` — lock org/project/acceptance criteria → `.kbs/context/session-questionnaire.json`
+2. `sec-brainstorm` — threat model + design → `.kbs/specs/YYYY-MM-DD-<slug>.md` (HARD-GATE until `approved`)
+3. `sec-plan` — bite-sized tasks → `.kbs/plans/YYYY-MM-DD-<slug>.md`
+4. Implement with domain skills as needed
+5. `sec-review` on diff, then `sec-verify` with command evidence before PR
+
+## Env / flags
+
+```bash
+KUBBISEC_CHAT_MODE=default|plan|review
+KUBBISEC_FORCE_SKILL=sec-brainstorm   # escape hatch; log warning
+KUBBISEC_SKIP_CLARIFY=1               # skip questionnaire; still log skip
+```
+
+## Anti-patterns
+
+- Loading `sec-brainstorm` + `remediation` in the same turn
+- Running `sec-plan` before spec is `approved`
+- Claiming merge-ready without `sec-review` + `sec-verify`
+- Multiple `scanner-*` skills in one turn
+
+---
+
+*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/sec-verify/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: sec-verify
+description: "Run verification commands and attach evidence before claiming tests pass, build OK, or PR ready."
+metadata:
+  kubbisec:
+    category: workflow
+    surfaces: [chat, fix, watch]
+    blocks: [false-completion-claims]
+---
+
+# sec-verify — Evidence before completion (KubbiSec)
+
+**Announce:** `Using sec-verify for <claim>.`
+
+## Iron Law
+
+**No completion claims without fresh command output in this session.**
+
+## Gate function
+
+Before claiming any status (pass, fixed, ready, done):
+
+1. **IDENTIFY** — What command proves this claim?
+2. **RUN** — Execute the FULL command in this session (fresh)
+3. **READ** — Full stdout/stderr, exit code, failure count
+4. **VERIFY** — Does output support the claim?
+5. **REPORT** — State claim ONLY with quoted evidence snippet
+
+## Claim → evidence map (monorepo defaults)
+
+| Claim | Required command | Not sufficient |
+|-------|------------------|----------------|
+| Unit tests pass | `pnpm --filter <pkg> test <file> -v` | Prior run, "should pass" |
+| API tests pass | `pnpm --filter api test -v` | Lint only |
+| Lint clean | `pnpm exec eslint <paths>` | Partial file |
+| Typecheck | `pnpm exec tsc -p <tsconfig> --noEmit` | IDE green |
+| Build | `pnpm --filter <pkg> build` | Types only |
+| CVE fixed | Re-run scanner + target test | Code changed only |
+| sec-review clear | sec-review output attached | Self-review |
+| No secrets | `gitleaks detect --no-git` or scanner skill | grep once |
+
+## Forbidden phrases (without step 5 evidence)
+
+- "should work", "probably", "seems fine", "looks good"
+- "Great!", "Done!", "Perfect!" before evidence
+- "Tests pass" without exit code 0 in same turn
+
+## Process — after plan task
+
+1. Read plan step **Verify:** command
+2. Run via `bash`; capture full output
+3. Post: `Claim: tests pass. Evidence: exit 0, N passed` + excerpt (max 2k chars)
+4. Check plan checkbox only after evidence posted
+5. Scrub `*TOKEN*`, `*SECRET*` from excerpts
+
+## Process — before PR (fix flow)
+
+1. Remediation diff + sec-review done
+2. Run package tests + optional semgrep/trivy per policy
+3. Append `verifyEvidence[]` to progress log
+4. PR creation allowed
+
+## Failures and waivers
+
+- Command fails → report actual failures; no "mostly pass"
+- Command not found → suggest `pnpm install`; fail verify
+- Timeout (>10m) → report timeout; no pass claim
+- Flaky test → report flake; suggest `sec-debug`
+- User requests skip → refuse false claim; allow `verifyWaived: true` only with user-typed waiver in chat
+
+## Copy (PT)
+
+`Sem saída de comando nesta sessão, não afirmamos sucesso.`
+
+---
+
+*Adapted from Superpowers (obra/superpowers) — MIT License.*

package/bundled/skills/skill-mention.d.ts

@@ -0,0 +1,3 @@
+/** @deprecated Import from chat-mentions.js — re-export shim for backward compatibility. */
+export { SKILL_MENTION_TOKEN, extractAtPrefix, extractSkillMentionPrefix, parseSkillMentionPrefix, filterSkillSuggestions, transformAtSkillMentions, applySkillMentionCompletion, } from "./chat-mentions.js";
+//# sourceMappingURL=skill-mention.d.ts.map

package/bundled/skills/skill-mention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-mention.d.ts","sourceRoot":"","sources":["../../src/skills/skill-mention.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC"}

package/bundled/skills/skill-mention.js

@@ -0,0 +1,3 @@
+/** @deprecated Import from chat-mentions.js — re-export shim for backward compatibility. */
+export { SKILL_MENTION_TOKEN, extractAtPrefix, extractSkillMentionPrefix, parseSkillMentionPrefix, filterSkillSuggestions, transformAtSkillMentions, applySkillMentionCompletion, } from "./chat-mentions.js";
+//# sourceMappingURL=skill-mention.js.map

package/bundled/skills/skill-mention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-mention.js","sourceRoot":"","sources":["../../src/skills/skill-mention.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC"}

package/bundled/skills/skill-mention.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, it } from "vitest";
+import {
+  extractAtPrefix,
+  extractSkillMentionPrefix,
+  filterSkillSuggestions,
+  parseSkillMentionPrefix,
+  transformAtSkillMentions,
+} from "./skill-mention.js";
+
+describe("skill-mention", () => {
+  it("detects @skill mention prefix", () => {
+    expect(parseSkillMentionPrefix("@skill")).toEqual({ query: "" });
+    expect(parseSkillMentionPrefix("@skill naus")).toEqual({ query: "naus" });
+    expect(parseSkillMentionPrefix("@skillful")).toBeNull();
+    expect(parseSkillMentionPrefix("@skill/foo")).toBeNull();
+  });
+
+  it("extracts @skill mention including partial name after space", () => {
+    expect(extractSkillMentionPrefix("use @skill naus")).toBe("@skill naus");
+    expect(extractSkillMentionPrefix("@skill")).toBe("@skill");
+    expect(extractSkillMentionPrefix("foo@skill")).toBeNull();
+  });
+
+  it("extractAtPrefix only matches when @ starts the last token", () => {
+    expect(extractAtPrefix("@skill")).toBe("@skill");
+    expect(extractAtPrefix("use @skill na")).toBeNull();
+  });
+
+  it("lists all skills when query is empty", () => {
+    const items = filterSkillSuggestions(
+      [
+        { name: "alpha", description: "A" },
+        { name: "beta", description: "B" },
+      ],
+      "",
+    );
+    expect(items).toHaveLength(2);
+  });
+
+  it("transforms @skill name to /skill:name for Pi expansion", () => {
+    expect(transformAtSkillMentions("@skill naus-pipelines validate")).toBe(
+      "/skill:naus-pipelines validate",
+    );
+    expect(transformAtSkillMentions("@skill")).toBe("@skill");
+  });
+});

package/bundled/skills/skill-mention.ts

@@ -0,0 +1,10 @@
+/** @deprecated Import from chat-mentions.js — re-export shim for backward compatibility. */
+export {
+  SKILL_MENTION_TOKEN,
+  extractAtPrefix,
+  extractSkillMentionPrefix,
+  parseSkillMentionPrefix,
+  filterSkillSuggestions,
+  transformAtSkillMentions,
+  applySkillMentionCompletion,
+} from "./chat-mentions.js";

package/bundled/theme/kubbisec.json

@@ -0,0 +1,93 @@
+{
+	"$schema": "https://raw.githubusercontent.com/earendil-works/pi/main/packages/coding-agent/src/modes/interactive/theme/theme-schema.json",
+	"name": "kubbisec",
+	"description": "KubbiSec — black canvas, brand cyan accent (#28DCF9)",
+	"vars": {
+		"cyan": "#28DCF9",
+		"cyanDim": "#1a8fa3",
+		"cyanMuted": "#0d3d47",
+		"text": "#E8E8E8",
+		"gray": "#8A8A8A",
+		"dimGray": "#5C5C5C",
+		"darkGray": "#2A2A2A",
+		"accent": "#28DCF9",
+		"selectedBg": "#0a1f24",
+		"userMsgBg": "#0c1418",
+		"toolPendingBg": "#0a1012",
+		"toolSuccessBg": "#0a1612",
+		"toolErrorBg": "#1a0e0e",
+		"customMsgBg": "#101820",
+		"green": "#34D399",
+		"red": "#F87171",
+		"yellow": "#FBBF24",
+		"blue": "#5f87ff",
+		"purple": "#A78BFA",
+		"purpleDim": "#7C5CBF",
+		"purpleMuted": "#3D2E5C"
+	},
+	"colors": {
+		"accent": "cyan",
+		"border": "cyanMuted",
+		"borderAccent": "cyan",
+		"borderMuted": "darkGray",
+		"success": "green",
+		"error": "red",
+		"warning": "yellow",
+		"muted": "gray",
+		"dim": "dimGray",
+		"text": "text",
+		"thinkingText": "gray",
+
+		"selectedBg": "selectedBg",
+		"userMessageBg": "userMsgBg",
+		"userMessageText": "text",
+		"customMessageBg": "customMsgBg",
+		"customMessageText": "text",
+		"customMessageLabel": "cyan",
+		"toolPendingBg": "toolPendingBg",
+		"toolSuccessBg": "toolSuccessBg",
+		"toolErrorBg": "toolErrorBg",
+		"toolTitle": "cyan",
+		"toolOutput": "gray",
+
+		"mdHeading": "cyan",
+		"mdLink": "cyan",
+		"mdLinkUrl": "cyanDim",
+		"mdCode": "cyan",
+		"mdCodeBlock": "green",
+		"mdCodeBlockBorder": "cyanMuted",
+		"mdQuote": "gray",
+		"mdQuoteBorder": "cyanMuted",
+		"mdHr": "darkGray",
+		"mdListBullet": "cyan",
+
+		"toolDiffAdded": "green",
+		"toolDiffRemoved": "red",
+		"toolDiffContext": "gray",
+
+		"syntaxComment": "#5C6B72",
+		"syntaxKeyword": "#28DCF9",
+		"syntaxFunction": "#7EE8FF",
+		"syntaxVariable": "#B8F0FC",
+		"syntaxString": "#34D399",
+		"syntaxNumber": "#FBBF24",
+		"syntaxType": "#5f87ff",
+		"syntaxOperator": "#E8E8E8",
+		"syntaxPunctuation": "#8A8A8A",
+
+		"thinkingOff": "darkGray",
+		"thinkingMinimal": "dimGray",
+		"thinkingLow": "cyanDim",
+		"thinkingMedium": "cyan",
+		"thinkingHigh": "#7EE8FF",
+		"thinkingXhigh": "#B8F0FC",
+
+		"bashMode": "cyan",
+		"planAccent": "purple"
+	},
+	"export": {
+		"pageBg": "#000000",
+		"cardBg": "#0c1014",
+		"infoBg": "#0a1f24"
+	}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubbisec/ai-linux-arm64",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "KubbiSec CLI — Linux arm64 binary",
   "license": "UNLICENSED",
   "os": [
@@ -10,7 +10,8 @@
     "arm64"
   ],
   "files": [
-    "bin/kubbisec"
+    "bin/kubbisec",
+    "bundled/**"
   ],
   "preferUnplugged": true,
   "engines": {