@kubbisec/ai-linux-x64 0.1.25 → 0.1.28

package/bundled/skills/chat-mentions.js

@@ -0,0 +1,108 @@
+import { fuzzyFilter } from "@earendil-works/pi-tui";
+export const SKILL_MENTION_TOKEN = "@skill";
+export const PLAN_MENTION_ALIASES = ["@plan", "@planejar"];
+const PLAN_MENTION_TOKENS_LONGEST_FIRST = [...PLAN_MENTION_ALIASES].sort((a, b) => b.length - a.length);
+const PATH_DELIMITERS = new Set([" ", "\t", '"', "'", "="]);
+function findLastDelimiter(text) {
+    for (let i = text.length - 1; i >= 0; i -= 1) {
+        if (PATH_DELIMITERS.has(text[i] ?? "")) {
+            return i;
+        }
+    }
+    return -1;
+}
+/** Same token rules as Pi CombinedAutocompleteProvider.extractAtPrefix. */
+export function extractAtPrefix(textBeforeCursor) {
+    const lastDelimiterIndex = findLastDelimiter(textBeforeCursor);
+    const tokenStart = lastDelimiterIndex === -1 ? 0 : lastDelimiterIndex + 1;
+    if (textBeforeCursor[tokenStart] === "@") {
+        return textBeforeCursor.slice(tokenStart);
+    }
+    return null;
+}
+/** KubbiSec: `@skill` may include a space and partial name (not only the last @ token). */
+export function extractSkillMentionPrefix(textBeforeCursor) {
+    const idx = textBeforeCursor.lastIndexOf(SKILL_MENTION_TOKEN);
+    if (idx === -1)
+        return null;
+    if (idx > 0 && !PATH_DELIMITERS.has(textBeforeCursor[idx - 1] ?? "")) {
+        return null;
+    }
+    const slice = textBeforeCursor.slice(idx);
+    if (!parseSkillMentionPrefix(slice))
+        return null;
+    return slice;
+}
+export function parseSkillMentionPrefix(atPrefix) {
+    if (!atPrefix?.startsWith(SKILL_MENTION_TOKEN))
+        return null;
+    const tail = atPrefix.slice(SKILL_MENTION_TOKEN.length);
+    if (tail.length > 0 && !tail.startsWith(" "))
+        return null;
+    return { query: tail.startsWith(" ") ? tail.trimStart() : "" };
+}
+export function parsePlanMentionPrefix(atPrefix) {
+    if (!atPrefix)
+        return null;
+    for (const token of PLAN_MENTION_TOKENS_LONGEST_FIRST) {
+        if (!atPrefix.startsWith(token))
+            continue;
+        const tail = atPrefix.slice(token.length);
+        if (tail.length > 0 && !tail.startsWith(" "))
+            continue;
+        return { query: tail.startsWith(" ") ? tail.trimStart() : "" };
+    }
+    return null;
+}
+export function filterSkillSuggestions(skills, query) {
+    const items = skills.map((skill) => ({
+        value: skill.name,
+        label: skill.name,
+        description: skill.description,
+    }));
+    if (!query)
+        return items;
+    return fuzzyFilter(items, query, (item) => `${item.label} ${item.description ?? ""}`).map((item) => ({
+        value: item.value,
+        label: item.label,
+        description: item.description,
+    }));
+}
+/** Pi expands `/skill:name` — map `@skill name` before submit. */
+export function transformAtSkillMentions(text) {
+    return text.replace(/@skill\s+([^\s@/]+)/g, "/skill:$1");
+}
+/** Legacy: map `@plan` / `@planejar` to `/mode:plan` (prefer session state + visible @plan). */
+export function transformAtPlanMentions(text) {
+    const tokenPattern = PLAN_MENTION_TOKENS_LONGEST_FIRST.map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+    const pattern = new RegExp(`(^|[\\s"'=])(${tokenPattern})(\\s[\\s\\S]*)?`, "g");
+    return text.replace(pattern, (_match, delim, _token, tail) => {
+        const query = tail ? tail.trimStart() : "";
+        return `${delim}/mode:plan${query ? ` ${query}` : ""}`;
+    });
+}
+/** Apply @skill → /skill:name only. @plan stays visible; plan mode is set via session state. */
+export function transformChatMentions(text) {
+    return transformAtSkillMentions(text);
+}
+export function messageActivatesPlanMode(text) {
+    const trimmed = text.trim();
+    return (trimmed.startsWith("/mode:plan") || /^@plan\b/i.test(trimmed) || /^@planejar\b/i.test(trimmed));
+}
+export function applySkillMentionCompletion(lines, cursorLine, cursorCol, item, prefix) {
+    const currentLine = lines[cursorLine] ?? "";
+    const beforePrefix = currentLine.slice(0, cursorCol - prefix.length);
+    const afterCursor = currentLine.slice(cursorCol);
+    const atIndex = beforePrefix.lastIndexOf(SKILL_MENTION_TOKEN);
+    const head = atIndex >= 0 ? beforePrefix.slice(0, atIndex) : beforePrefix;
+    const insertion = `${SKILL_MENTION_TOKEN} ${item.value} `;
+    const newLine = `${head}${insertion}${afterCursor}`;
+    const newLines = [...lines];
+    newLines[cursorLine] = newLine;
+    return {
+        lines: newLines,
+        cursorLine,
+        cursorCol: head.length + insertion.length,
+    };
+}
+//# sourceMappingURL=chat-mentions.js.map

package/bundled/skills/chat-mentions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-mentions.js","sourceRoot":"","sources":["../../src/skills/chat-mentions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,WAAW,CAAU,CAAC;AAEpE,MAAM,iCAAiC,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAC,IAAI,CACtE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAC9B,CAAC;AAEF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE5D,SAAS,iBAAiB,CAAC,IAAY;IACrC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,gBAAwB;IACtD,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,CAAC;IAC1E,IAAI,gBAAgB,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACzC,OAAO,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,yBAAyB,CAAC,gBAAwB;IAChE,MAAM,GAAG,GAAG,gBAAgB,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC9D,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAuB;IAC7D,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAuB;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,iCAAiC,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACvD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAA4B,EAC5B,KAAa;IAEb,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,KAAK,EAAE,KAAK,CAAC,IAAI;QACjB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CACvF,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACT,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,YAAY,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/D,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CACzC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,gBAAgB,YAAY,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAChF,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,MAAc,EAAE,IAAa,EAAE,EAAE;QACpF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,GAAG,KAAK,aAAa,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,CACL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAe,EACf,UAAkB,EAClB,SAAiB,EACjB,IAAsB,EACtB,MAAc;IAEd,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1E,MAAM,SAAS,GAAG,GAAG,mBAAmB,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;IAC1D,MAAM,OAAO,GAAG,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC;IAC/B,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,UAAU;QACV,SAAS,EAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;KAC1C,CAAC;AACJ,CAAC"}

package/bundled/skills/chat-mentions.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import {
+  messageActivatesPlanMode,
+  PLAN_MENTION_ALIASES,
+  parsePlanMentionPrefix,
+  transformAtPlanMentions,
+  transformChatMentions,
+} from "./chat-mentions.js";
+
+describe("chat-mentions", () => {
+  it("exports plan mention aliases", () => {
+    expect(PLAN_MENTION_ALIASES).toEqual(["@plan", "@planejar"]);
+  });
+
+  it("parses @plan and @planejar prefixes", () => {
+    expect(parsePlanMentionPrefix("@plan")).toEqual({ query: "" });
+    expect(parsePlanMentionPrefix("@plan fix HIGH")).toEqual({ query: "fix HIGH" });
+    expect(parsePlanMentionPrefix("@planejar scope")).toEqual({ query: "scope" });
+    expect(parsePlanMentionPrefix("@planful")).toBeNull();
+  });
+
+  it("transformAtPlanMentions still maps legacy @plan to /mode:plan", () => {
+    expect(transformAtPlanMentions("@plan fix HIGH SCA")).toBe("/mode:plan fix HIGH SCA");
+    expect(transformAtPlanMentions("@planejar foo")).toBe("/mode:plan foo");
+    expect(transformAtPlanMentions("x@plan fix")).toBe("x@plan fix");
+  });
+
+  it("transformChatMentions keeps @plan visible (plan mode via session state)", () => {
+    expect(transformChatMentions("@plan fix HIGH SCA")).toBe("@plan fix HIGH SCA");
+    expect(transformChatMentions("@planejar x")).toBe("@planejar x");
+    expect(transformChatMentions("@skill naus @plan fix")).toBe("/skill:naus @plan fix");
+  });
+
+  it("messageActivatesPlanMode detects plan prefixes", () => {
+    expect(messageActivatesPlanMode("@plan scope")).toBe(true);
+    expect(messageActivatesPlanMode("/mode:plan scope")).toBe(true);
+    expect(messageActivatesPlanMode("hello")).toBe(false);
+  });
+});

package/bundled/skills/chat-mentions.ts

@@ -0,0 +1,133 @@
+import type { AutocompleteItem } from "@earendil-works/pi-tui";
+import { fuzzyFilter } from "@earendil-works/pi-tui";
+import type { KubbisecSkillEntry } from "./list-bundled-skills.js";
+
+export const SKILL_MENTION_TOKEN = "@skill";
+
+export const PLAN_MENTION_ALIASES = ["@plan", "@planejar"] as const;
+
+const PLAN_MENTION_TOKENS_LONGEST_FIRST = [...PLAN_MENTION_ALIASES].sort(
+  (a, b) => b.length - a.length,
+);
+
+const PATH_DELIMITERS = new Set([" ", "\t", '"', "'", "="]);
+
+function findLastDelimiter(text: string): number {
+  for (let i = text.length - 1; i >= 0; i -= 1) {
+    if (PATH_DELIMITERS.has(text[i] ?? "")) {
+      return i;
+    }
+  }
+  return -1;
+}
+
+/** Same token rules as Pi CombinedAutocompleteProvider.extractAtPrefix. */
+export function extractAtPrefix(textBeforeCursor: string): string | null {
+  const lastDelimiterIndex = findLastDelimiter(textBeforeCursor);
+  const tokenStart = lastDelimiterIndex === -1 ? 0 : lastDelimiterIndex + 1;
+  if (textBeforeCursor[tokenStart] === "@") {
+    return textBeforeCursor.slice(tokenStart);
+  }
+  return null;
+}
+
+/** KubbiSec: `@skill` may include a space and partial name (not only the last @ token). */
+export function extractSkillMentionPrefix(textBeforeCursor: string): string | null {
+  const idx = textBeforeCursor.lastIndexOf(SKILL_MENTION_TOKEN);
+  if (idx === -1) return null;
+  if (idx > 0 && !PATH_DELIMITERS.has(textBeforeCursor[idx - 1] ?? "")) {
+    return null;
+  }
+  const slice = textBeforeCursor.slice(idx);
+  if (!parseSkillMentionPrefix(slice)) return null;
+  return slice;
+}
+
+export function parseSkillMentionPrefix(atPrefix: string | null): { query: string } | null {
+  if (!atPrefix?.startsWith(SKILL_MENTION_TOKEN)) return null;
+  const tail = atPrefix.slice(SKILL_MENTION_TOKEN.length);
+  if (tail.length > 0 && !tail.startsWith(" ")) return null;
+  return { query: tail.startsWith(" ") ? tail.trimStart() : "" };
+}
+
+export function parsePlanMentionPrefix(atPrefix: string | null): { query: string } | null {
+  if (!atPrefix) return null;
+  for (const token of PLAN_MENTION_TOKENS_LONGEST_FIRST) {
+    if (!atPrefix.startsWith(token)) continue;
+    const tail = atPrefix.slice(token.length);
+    if (tail.length > 0 && !tail.startsWith(" ")) continue;
+    return { query: tail.startsWith(" ") ? tail.trimStart() : "" };
+  }
+  return null;
+}
+
+export function filterSkillSuggestions(
+  skills: KubbisecSkillEntry[],
+  query: string,
+): AutocompleteItem[] {
+  const items = skills.map((skill) => ({
+    value: skill.name,
+    label: skill.name,
+    description: skill.description,
+  }));
+  if (!query) return items;
+  return fuzzyFilter(items, query, (item) => `${item.label} ${item.description ?? ""}`).map(
+    (item) => ({
+      value: item.value,
+      label: item.label,
+      description: item.description,
+    }),
+  );
+}
+
+/** Pi expands `/skill:name` — map `@skill name` before submit. */
+export function transformAtSkillMentions(text: string): string {
+  return text.replace(/@skill\s+([^\s@/]+)/g, "/skill:$1");
+}
+
+/** Legacy: map `@plan` / `@planejar` to `/mode:plan` (prefer session state + visible @plan). */
+export function transformAtPlanMentions(text: string): string {
+  const tokenPattern = PLAN_MENTION_TOKENS_LONGEST_FIRST.map((t) =>
+    t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"),
+  ).join("|");
+  const pattern = new RegExp(`(^|[\\s"'=])(${tokenPattern})(\\s[\\s\\S]*)?`, "g");
+  return text.replace(pattern, (_match, delim: string, _token: string, tail?: string) => {
+    const query = tail ? tail.trimStart() : "";
+    return `${delim}/mode:plan${query ? ` ${query}` : ""}`;
+  });
+}
+
+/** Apply @skill → /skill:name only. @plan stays visible; plan mode is set via session state. */
+export function transformChatMentions(text: string): string {
+  return transformAtSkillMentions(text);
+}
+
+export function messageActivatesPlanMode(text: string): boolean {
+  const trimmed = text.trim();
+  return (
+    trimmed.startsWith("/mode:plan") || /^@plan\b/i.test(trimmed) || /^@planejar\b/i.test(trimmed)
+  );
+}
+
+export function applySkillMentionCompletion(
+  lines: string[],
+  cursorLine: number,
+  cursorCol: number,
+  item: AutocompleteItem,
+  prefix: string,
+): { lines: string[]; cursorLine: number; cursorCol: number } {
+  const currentLine = lines[cursorLine] ?? "";
+  const beforePrefix = currentLine.slice(0, cursorCol - prefix.length);
+  const afterCursor = currentLine.slice(cursorCol);
+  const atIndex = beforePrefix.lastIndexOf(SKILL_MENTION_TOKEN);
+  const head = atIndex >= 0 ? beforePrefix.slice(0, atIndex) : beforePrefix;
+  const insertion = `${SKILL_MENTION_TOKEN} ${item.value} `;
+  const newLine = `${head}${insertion}${afterCursor}`;
+  const newLines = [...lines];
+  newLines[cursorLine] = newLine;
+  return {
+    lines: newLines,
+    cursorLine,
+    cursorCol: head.length + insertion.length,
+  };
+}

package/bundled/skills/github-local/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: github-local
+description: Local gh/git, naus, and aspm on the machine running kbs chat with host-first auth support.
+---
+
+GitHub local tools are available in chat without `--extended-context`.
+
+## Tools
+
+- **GitHub:** `github_local_status`, `github_local_repo_summary`, `github_local_clone`, `github_local_fetch`, `github_local_commit`, `github_local_push`, `github_local_pr_create`
+- Uses host `gh`/`git` auth first; local push/PR/clone retry once with the platform/env token when native auth is rejected.
+- Always available in chat (no `--extended-context` required).
+- **NAUS:** `naus_local_status`, `naus_local_validate`, `naus_local_plan`, `naus_local_run`
+- **ASPM:** `aspm_local_status`, `aspm_local_doctor`, `aspm_local_scan`, `aspm_local_upload`
+
+Cloud equivalents remain on the API (e.g. `trigger_run`, `naus_validate_yaml`, platform upload via CI).

package/bundled/skills/kubbisec-resource-router/SKILL.md

@@ -0,0 +1,3 @@
+# kubbisec-resource-router
+
+This skill routes incoming tasks to appropriate resources and modes.

package/bundled/skills/list-bundled-skills.d.ts

@@ -0,0 +1,7 @@
+export type KubbisecSkillEntry = {
+    name: string;
+    description: string;
+};
+/** Skills shipped under dist/skills (same dirs passed as Pi --skill). */
+export declare function listBundledKubbisecSkills(): KubbisecSkillEntry[];
+//# sourceMappingURL=list-bundled-skills.d.ts.map

package/bundled/skills/list-bundled-skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-bundled-skills.d.ts","sourceRoot":"","sources":["../../src/skills/list-bundled-skills.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAoBF,yEAAyE;AACzE,wBAAgB,yBAAyB,IAAI,kBAAkB,EAAE,CAiBhE"}

package/bundled/skills/list-bundled-skills.js

@@ -0,0 +1,44 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { resolveBundledDistRoot, resolveSnapshotBundledDistDir, } from "../resolve-bundled-dist-root.js";
+function parseSkillFrontmatter(raw) {
+    const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    if (!match)
+        return {};
+    const block = match[1];
+    const name = block.match(/^name:\s*(.+)$/m)?.[1]?.trim();
+    const description = block.match(/^description:\s*(.+)$/m)?.[1]?.trim();
+    return { name, description };
+}
+function resolveSkillsDir() {
+    const distDir = path.join(resolveBundledDistRoot(), "skills");
+    if (fs.existsSync(distDir))
+        return distDir;
+    const entryDir = path.dirname(resolveSnapshotBundledDistDir());
+    const srcDir = path.join(entryDir, "src/skills");
+    if (fs.existsSync(srcDir))
+        return srcDir;
+    return null;
+}
+/** Skills shipped under dist/skills (same dirs passed as Pi --skill). */
+export function listBundledKubbisecSkills() {
+    const skillsDir = resolveSkillsDir();
+    if (!skillsDir)
+        return [];
+    const entries = [];
+    for (const dir of fs.readdirSync(skillsDir, { withFileTypes: true })) {
+        if (!dir.isDirectory())
+            continue;
+        const skillMd = path.join(skillsDir, dir.name, "SKILL.md");
+        if (!fs.existsSync(skillMd))
+            continue;
+        const raw = fs.readFileSync(skillMd, "utf8");
+        const meta = parseSkillFrontmatter(raw);
+        entries.push({
+            name: meta.name?.trim() || dir.name,
+            description: meta.description?.trim() || dir.name,
+        });
+    }
+    return entries.sort((a, b) => a.name.localeCompare(b.name));
+}
+//# sourceMappingURL=list-bundled-skills.js.map

package/bundled/skills/list-bundled-skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-bundled-skills.js","sourceRoot":"","sources":["../../src/skills/list-bundled-skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,6BAA6B,GAC9B,MAAM,iCAAiC,CAAC;AAOzC,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,yBAAyB;IACvC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAE1B,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;YAAE,SAAS;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,IAAI;SAClD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/bundled/skills/list-bundled-skills.ts

@@ -0,0 +1,49 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import {
+  resolveBundledDistRoot,
+  resolveSnapshotBundledDistDir,
+} from "../resolve-bundled-dist-root.js";
+
+export type KubbisecSkillEntry = {
+  name: string;
+  description: string;
+};
+
+function parseSkillFrontmatter(raw: string): { name?: string; description?: string } {
+  const match = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!match) return {};
+  const block = match[1];
+  const name = block.match(/^name:\s*(.+)$/m)?.[1]?.trim();
+  const description = block.match(/^description:\s*(.+)$/m)?.[1]?.trim();
+  return { name, description };
+}
+
+function resolveSkillsDir(): string | null {
+  const distDir = path.join(resolveBundledDistRoot(), "skills");
+  if (fs.existsSync(distDir)) return distDir;
+  const entryDir = path.dirname(resolveSnapshotBundledDistDir());
+  const srcDir = path.join(entryDir, "src/skills");
+  if (fs.existsSync(srcDir)) return srcDir;
+  return null;
+}
+
+/** Skills shipped under dist/skills (same dirs passed as Pi --skill). */
+export function listBundledKubbisecSkills(): KubbisecSkillEntry[] {
+  const skillsDir = resolveSkillsDir();
+  if (!skillsDir) return [];
+
+  const entries: KubbisecSkillEntry[] = [];
+  for (const dir of fs.readdirSync(skillsDir, { withFileTypes: true })) {
+    if (!dir.isDirectory()) continue;
+    const skillMd = path.join(skillsDir, dir.name, "SKILL.md");
+    if (!fs.existsSync(skillMd)) continue;
+    const raw = fs.readFileSync(skillMd, "utf8");
+    const meta = parseSkillFrontmatter(raw);
+    entries.push({
+      name: meta.name?.trim() || dir.name,
+      description: meta.description?.trim() || dir.name,
+    });
+  }
+  return entries.sort((a, b) => a.name.localeCompare(b.name));
+}

package/bundled/skills/naus-pipelines/SKILL.md

@@ -0,0 +1,127 @@
+---
+name: naus-pipelines
+description: NAUS CI/CD — YAML, validação @kubbisec/naus-validation, runners e jobs ASPM no KubbiSec.
+---
+
+## Estrutura YAML (obrigatório — não é GitHub Actions)
+
+| Correto (NAUS) | Errado (não usar) |
+|----------------|-------------------|
+| `run:` (top-level) | `jobs:` |
+| `script:` (array de strings) | `commands:`, `steps:` |
+| `depends_on:` | `needs:` |
+| `variables:` | `env:` no root |
+| `kind: aspm` + `tool: trivy` | `scanner: trivy` + script manual `trivy fs` |
+| `$VAR` / Env Pack | `${{ secrets.* }}`, `${{ vars.* }}` |
+
+Top-level: `name`, `description`, `local`, `stages`, `variables`, `volumes`, `repository`, `only`, `run` (obrigatório).
+
+**HARD-GATE:** antes de mostrar YAML final → `naus_pipeline_docs` + `naus_validate_yaml` (ou `naus_local_validate` no workspace).
+
+## NAUS CLI (`npm install -g @kubbisec/naus`)
+
+Ficheiro por omissão: `.naus.yml`. **Docs:** `naus_pipeline_docs` secção `naus-commands`.
+
+| Comando | Descrição |
+|---------|-----------|
+| `naus register [token] [--renew]` | Registar runner (bootstrap mTLS) |
+| `naus start` | Iniciar runner e aceitar jobs |
+| `naus migrate` | Migrar runner token legado → certificado |
+| `naus validate <file>` / `naus check <file>` | Validar YAML |
+| `naus plan <file> [--format mermaid]` | Ondas de dependências |
+| `naus run <file>` | Executar pipeline localmente |
+| `naus daemon list` / `naus daemon stop` | Sessões background |
+| `naus runner start` | Modo legado (token, sem mTLS) |
+| `naus tools install` | Ferramentas auxiliares |
+
+**Variáveis:** `NAUS_BOOTSTRAP_TOKEN`, `NAUS_RENEW_RUNNER=1` (equivale `--renew`).
+
+**Chat:** não invocar `register`, `start`, `daemon` — processos persistentes; documentar apenas.
+
+## Exemplo canónico (container + ASPM matrix + gate)
+
+```yaml
+name: exemplo-simples
+stages: [build, security]
+
+run:
+  - build:
+      stage: build
+      image: node:20-alpine
+      script:
+        - npm ci
+        - npm run build --if-present
+
+  - kubbisec_scan:
+      stage: security
+      kind: kubbisec_scan
+      profile: full
+      depends_on: [build]
+
+  - kubbisec_gate:
+      kind: aspm_gate
+      depends_on: [kubbisec_scan]
+      rules:
+        vulnerabilities:
+          max_by_severity:
+            CRITICAL: 0
+```
+
+Jobs `kind: aspm` e `kind: kubbisec_scan` **não** precisam de `script:` — o NAUS expande para a CLI correspondente.
+
+### Hybrid Scan (`kind: kubbisec_scan`)
+Executa uma varredura híbrida (scanners tradicionais + passes semânticos de IA) e faz o upload automático para o ASPM. É o sucessor moderno do `kind: aspm_matrix` para segurança geral do repositório.
+
+## Kinds de job
+
+| Kind | Campos principais |
+|------|-------------------|
+| `container` (default) | `image:`, `script:`, `depends_on:` |
+| `kubbisec_scan` | `profile:` full \| quick \| ai-only \| scanners-only |
+| `aspm` | `tool:`, `mode:` scan \| upload \| scan-and-upload |
+| `aspm_matrix` | `parallel: [{ tool: ... }]`, `matrix_strategy:` chain \| fanout |
+| `aspm_gate` | `rules:` (vulnerabilities, coverage, risk_score) |
+| `aspm_preset` | `preset: kubbisec/default-security` |
+| `docker` | `registry:`, `tags:`; opcional `aspm.tool` + `aspm.gate` |
+
+## Fluxo na plataforma (cloud)
+
+1. `naus_pipeline_docs` — secções web (`naus-commands`, `naus-pipeline-overview`, `naus-aspm-integration`, …).
+2. `naus_schema_overview` — cheat sheet de campos.
+3. `naus_validate_yaml` — **sempre** validar antes de persistir.
+4. `set_editor_yaml` (preview) → `set_pipeline_yaml` (bound) → `trigger_run` → `get_run_logs_excerpt`.
+
+## Secrets e variáveis
+
+| Contexto | Onde definir valores sensíveis |
+|----------|-------------------------------|
+| **`naus run` / `naus plan` local** | Por omissão: **`.secrets`** e **`.env`** no cwd. Ou caminhos explícitos: `naus run .naus.yml --env-file .env --secret-file .secrets` (qualquer nome, ex. `.secret`). Flags repetíveis. |
+| **Runner na cloud (KubbiSec)** | **Env Packs** no painel (CI/CD → Env Packs) associados ao pipeline — não usar `.secrets` no runner remoto. |
+
+No YAML, referencie apenas `$VAR` — nunca o valor em claro. Chaves em `.secrets` são ofuscadas nos logs locais. **Não commitar** `.secrets`.
+
+**Anti-padrões (secrets):**
+- Local `naus run` → criar `.secrets` no repo; **não** inventar `kubsec_set_secret`, `naus set_env_pack` ou `attach_env_pack` para execução local.
+- Cloud → Env Packs na UI; `.secrets` só existe na máquina onde corres `naus run`.
+
+## Fluxo local (`kbs chat -w <repo>`)
+
+Ferramentas `naus_local_*` disponíveis sem `--extended-context`. Se `naus` não estiver no PATH, o chat instala `@kubbisec/naus` globalmente (allowlist) antes de executar.
+
+| Tool | Comando |
+|------|---------|
+| `naus_local_status` | `naus` no PATH |
+| `naus_local_validate` | `naus validate <path>` |
+| `naus_local_plan` | `naus plan <path>` (lê `.env` / `.secrets` como `naus run`) |
+| `naus_local_run` | `naus run <path>` (até 15 min; lê `.secrets` por omissão) |
+
+## Runner enrollment (documentar, não executar no chat)
+
+1. Obter bootstrap token `bt_...` na UI (Runners).
+2. `naus register <token>` → grava `~/.kubbisec/naus/config.json` + certificados mTLS.
+3. `naus start` — runner aceita jobs da cloud.
+4. Re-registo do mesmo runner: token de re-registo na UI ou `naus migrate` (token legado `nau_...`).
+
+## Scanners locais (fora do pipeline)
+
+Para `aspm scan` / `aspm upload` no host → skill `aspm-platform` e `aspm_local_*`.

package/bundled/skills/remediation/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: remediation
+description: Apply minimal security fixes from KubbiSec findings; clone via API credentials (EnvPack GITHUB_TOKEN + org GitHub); auto mode opens PR with gh+git non-interactive.
+---
+
+Fix the finding using the cloned repository workspace.
+
+1. Resolve repo: `kubsec_github_repository` (token from EnvPack `GITHUB_TOKEN` / `GH_TOKEN` overrides org app token when set).
+2. Apply minimal code changes from real evidence only — no invented CVEs or paths.
+3. Auto-PR (`kbs fix --mode auto`): commit, `git push`, `gh pr create` with `GIT_TERMINAL_PROMPT=0` and `GH_PROMPT_DISABLED=1`.
+
+For local git/gh in chat, use `github_local_*` tools (always available; host-first auth). See @skill github-local.

package/bundled/skills/scanner-gitleaks/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: scanner-gitleaks
+description: Gitleaks — deteção de secrets em repositórios Git.
+---
+
+Chame `security_scanner_playbook(scanner="gitleaks", platform?, topic?)`.
+
+Relatório: `gitleaks-report.json`. Upload: `-s gitleaks`.
+
+NAUS: `kind: aspm` com `tool: gitleaks` ou entrada em `aspm_matrix.parallel`.

package/bundled/skills/scanner-nmap/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: scanner-nmap
+description: Nmap — scan de rede e portas (XML para ASPM).
+---
+
+Chame `security_scanner_playbook(scanner="nmap", platform?, topic?)`.
+
+Relatório: `nmap-report.xml` (`-oX`). Upload: `-s nmap`.
+
+NAUS: `kind: aspm` com `tool: nmap` e `target` da rede/host.

package/bundled/skills/scanner-osv/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: scanner-osv
+description: OSV-Scanner — advisories em dependências e lockfiles.
+---
+
+Chame `security_scanner_playbook(scanner="osv", platform?, topic?)`.
+
+Relatório: `osv-report.json`. Upload: `-s osv`.
+
+NAUS: `kind: aspm` com `tool: osv`.

package/bundled/skills/scanner-semgrep/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: scanner-semgrep
+description: Semgrep — SAST com regras e políticas customizadas.
+---
+
+Chame `security_scanner_playbook(scanner="semgrep", platform?, topic?)`.
+
+Relatório: `semgrep-report.json`. Upload: `-s semgrep`.
+
+NAUS: `kind: aspm` com `tool: semgrep`; imagem padrão `semgrep/semgrep:latest`.

package/bundled/skills/scanner-skipfish/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: scanner-skipfish
+description: Skipfish — DAST web (crawling/fuzzing).
+---
+
+Chame `security_scanner_playbook(scanner="skipfish", platform?, topic?)`.
+
+Relatório: `skipfish-report.json`. Upload: `-s skipfish`.
+
+NAUS: `kind: aspm` com `tool: skipfish` e URL em `target`.

package/bundled/skills/scanner-sonar/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: scanner-sonar
+description: SonarQube — SAST via export JSON da API Sonar.
+---
+
+Chame `security_scanner_playbook(scanner="sonar", platform?, topic?)`.
+
+Relatório: `sonar-report.json` (export API). Upload: `-s sonar`.
+
+NAUS: `kind: aspm` com `tool: sonar`, frequentemente `mode: upload` após export.

package/bundled/skills/scanner-syft/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: scanner-syft
+description: Syft — geração de SBOM (CycloneDX/SPDX) para ASPM.
+---
+
+Chame `security_scanner_playbook(scanner="syft", platform?, topic?)`.
+
+Relatório: `sbom.json` (cyclonedx-json). Upload: `-s syft`.
+
+NAUS: `kind: aspm` com `tool: syft`; matrix com `format: cyclonedx-json`.

package/bundled/skills/scanner-trivy/SKILL.md

@@ -0,0 +1,10 @@
+---
+name: scanner-trivy
+description: Trivy — SCA, imagens Docker, IaC; upload ASPM e job NAUS.
+---
+
+Chame `security_scanner_playbook(scanner="trivy", platform="linux"|"macos"|"windows", topic="install"|"scan"|"upload"|"naus"|"formats"|"all")`.
+
+Relatório típico: `trivy-report.json`. Upload: `aspm upload trivy-report.json -s trivy`.
+
+NAUS: `kind: aspm` com `tool: trivy`; preset `kind: docker` com `aspm.tool: trivy` e gate.