@nockdev/awf 6.2.0 → 6.2.2

package/.agent/skills/tooling/ide-extension/data/lsp-patterns.yaml

@@ -0,0 +1,126 @@
+# Language Server Protocol Patterns — HSA Tier 3 Data
+version: "1.0.0"
+
+patterns:
+  - id: LSP-001
+    name: Server Initialization
+    category: setup
+    description: LSP server setup with capabilities negotiation.
+    text: |
+      Server declares capabilities during initialize handshake.
+      Common capabilities: completion, hover, definition, references,
+      diagnostics, code actions, rename, formatting.
+    example: |
+      const connection = createConnection(ProtocoLConnection);
+      const documents = new TextDocuments(TextDocument);
+      connection.onInitialize((params) => ({
+        capabilities: {
+          textDocumentSync: TextDocumentSyncKind.Incremental,
+          completionProvider: { resolveProvider: true, triggerCharacters: ["."] },
+          hoverProvider: true,
+          definitionProvider: true,
+          referencesProvider: true,
+          codeActionProvider: true
+        }
+      }));
+      documents.listen(connection);
+      connection.listen();
+
+  - id: LSP-002
+    name: Diagnostics Push
+    category: analysis
+    description: Push diagnostics (errors/warnings) to client.
+    text: |
+      Send diagnostics on document change.
+      Include severity, range, message, source.
+    example: |
+      documents.onDidChangeContent((change) => {
+        const diagnostics: Diagnostic[] = [];
+        const text = change.document.getText();
+        // Analyze text, push diagnostics
+        const match = /TODO/.exec(text);
+        if (match) {
+          diagnostics.push({
+            severity: DiagnosticSeverity.Information,
+            range: { start: { line: 0, character: match.index },
+                     end: { line: 0, character: match.index + 4 } },
+            message: "TODO found",
+            source: "my-lsp"
+          });
+        }
+        connection.sendDiagnostics({ uri: change.document.uri, diagnostics });
+      });
+
+  - id: LSP-003
+    name: Code Actions
+    category: refactoring
+    description: Quick fixes and refactoring actions.
+    text: |
+      Return CodeAction[] for given diagnostic context.
+      Types: QuickFix, Refactor, Source, Extract.
+    example: |
+      connection.onCodeAction((params) => {
+        const actions: CodeAction[] = [];
+        for (const diag of params.context.diagnostics) {
+          if (diag.code === "unused-import") {
+            actions.push({
+              title: "Remove unused import",
+              kind: CodeActionKind.QuickFix,
+              edit: { changes: { [params.textDocument.uri]: [TextEdit.del(diag.range)] } },
+              diagnostics: [diag]
+            });
+          }
+        }
+        return actions;
+      });
+
+  - id: LSP-004
+    name: Go-to-Definition
+    category: navigation
+    description: Jump to symbol definition.
+    example: |
+      connection.onDefinition((params) => {
+        const doc = documents.get(params.textDocument.uri);
+        const word = getWordAtPosition(doc, params.position);
+        const location = findDefinition(word);
+        return location ? Location.create(location.uri, location.range) : null;
+      });
+
+  - id: LSP-005
+    name: Hover Information
+    category: analysis
+    description: Show documentation on hover.
+    example: |
+      connection.onHover((params) => {
+        const doc = documents.get(params.textDocument.uri);
+        const word = getWordAtPosition(doc, params.position);
+        const info = getDocumentation(word);
+        return info ? { contents: { kind: "markdown", value: info } } : null;
+      });
+
+  - id: LSP-006
+    name: Transport Configuration
+    category: setup
+    description: |
+      LSP transport options: stdio (most common), IPC, TCP, pipe.
+    text: |
+      stdio: Default, works with all editors
+      IPC: VS Code–specific, faster
+      TCP: Remote debugging, network servers
+
+      Client launch config (VS Code):
+      "languageServer": {
+        "command": "node",
+        "args": ["./server/out/main.js", "--stdio"],
+        "transport": "stdio"
+      }
+
+  - id: LSP-007
+    name: Incremental Sync
+    category: performance
+    description: |
+      Use incremental text sync for large files.
+    text: |
+      TextDocumentSyncKind.Incremental sends only changed ranges.
+      TextDocumentSyncKind.Full sends entire document (simpler but slower).
+      Best practice: Use Incremental for production LSP servers.

package/.agent/skills/tooling/ide-extension/data/vscode-patterns.yaml

@@ -0,0 +1,172 @@
+# VS Code Extension Patterns — HSA Tier 3 Data
+# IDE Extension Development Skill
+version: "1.0.0"
+
+patterns:
+  # ==========================================================================
+  # Extension Host Architecture
+  # ==========================================================================
+  - id: VSCODE-001
+    name: Extension Activation
+    category: lifecycle
+    description: |
+      Extensions run in isolated Extension Host process.
+      Use activation events to lazy-load.
+    text: |
+      Activation Events (package.json):
+      - onLanguage:typescript — When TS file opened
+      - onCommand:ext.cmd — When command invoked
+      - workspaceContains:**/*.rs — When workspace has Rust files  
+      - onStartupFinished — After VS Code fully loaded (use sparingly)
+      - * — Always active (avoid: blocks startup)
+    example: |
+      // package.json
+      "activationEvents": ["onLanguage:python", "onCommand:ext.analyze"]
+
+      // extension.ts
+      export function activate(context: ExtensionContext) {
+        const cmd = commands.registerCommand("ext.analyze", async () => {
+          const editor = window.activeTextEditor;
+          if (!editor) return;
+          // ... analyze document
+        });
+        context.subscriptions.push(cmd);
+      }
+
+  - id: VSCODE-002
+    name: Contribution Points
+    category: api
+    description: |
+      Declarative UI contributions in package.json.
+    text: |
+      Key contribution points:
+      - commands: Register command palette entries
+      - menus: Context menus, editor title, explorer context
+      - views: Custom tree views in sidebar
+      - viewsContainers: Custom activity bar icons
+      - configuration: Settings page entries
+      - keybindings: Keyboard shortcuts
+      - languages: Language declarations
+      - grammars: TextMate grammar for syntax highlighting
+      - themes: Color themes
+      - snippets: Code snippets
+
+  - id: VSCODE-003
+    name: Webview Panel
+    category: ui
+    description: |
+      Custom HTML/CSS/JS UI in editor panels.
+    text: |
+      Best practices:
+      - Use message passing (postMessage/onDidReceiveMessage)
+      - Persist state with getState/setState
+      - Use webviewOptions.retainContextWhenHidden sparingly
+      - Apply CSP: default-src 'none'
+      - Use webview.asWebviewUri for local resources
+    example: |
+      const panel = window.createWebviewPanel(
+        "myView", "My Panel", ViewColumn.One,
+        { enableScripts: true, retainContextWhenHidden: false }
+      );
+      panel.webview.html = getHtml(panel.webview);
+      panel.webview.onDidReceiveMessage((msg) => {
+        if (msg.command === "getData") {
+          panel.webview.postMessage({ data: result });
+        }
+      });
+
+  - id: VSCODE-004
+    name: TreeView Provider
+    category: ui
+    description: |
+      Custom tree views in sidebar/explorer.
+    text: |
+      Implement TreeDataProvider<T> interface:
+      - getChildren(element?): Return child nodes
+      - getTreeItem(element): Return TreeItem with label, icon, command
+      - onDidChangeTreeData: Event to refresh tree
+    example: |
+      class MyTreeProvider implements TreeDataProvider<MyItem> {
+        private _onDidChange = new EventEmitter<MyItem | undefined>();
+        readonly onDidChangeTreeData = this._onDidChange.event;
+        
+        getChildren(el?: MyItem): MyItem[] {
+          return el ? el.children : this.rootItems;
+        }
+        getTreeItem(el: MyItem): TreeItem {
+          return { label: el.name, collapsibleState: el.children.length ? 1 : 0 };
+        }
+        refresh() { this._onDidChange.fire(undefined); }
+      }
+
+  - id: VSCODE-005
+    name: Extension Testing
+    category: testing
+    description: |
+      Test extensions in Extension Development Host.
+    text: |
+      Setup:
+      1. Use @vscode/test-electron for integration tests
+      2. Run tests in isolated VS Code instance
+      3. Use mocha as test runner
+      4. Mock vscode API for unit tests
+    example: |
+      // src/test/suite/extension.test.ts
+      suite("Extension Test Suite", () => {
+        test("Command should activate", async () => {
+          await vscode.commands.executeCommand("ext.doSomething");
+          assert.ok(true);
+        });
+      });
+
+  - id: VSCODE-006
+    name: Diagnostic Provider
+    category: api
+    description: |
+      Report errors/warnings in Problems panel.
+    text: |
+      Use DiagnosticCollection to manage diagnostics.
+      Update on document change events.
+    example: |
+      const diagnostics = languages.createDiagnosticCollection("myLinter");
+      workspace.onDidChangeTextDocument((e) => {
+        const diags: Diagnostic[] = [];
+        // analyze document, push Diagnostic objects
+        diagnostics.set(e.document.uri, diags);
+      });
+
+  - id: VSCODE-007
+    name: CompletionItem Provider
+    category: api
+    description: |
+      Provide autocomplete suggestions.
+    text: |
+      Register CompletionItemProvider with trigger characters.
+      Return CompletionItem[] with label, kind, detail, insertText.
+    example: |
+      languages.registerCompletionItemProvider("typescript", {
+        provideCompletionItems(doc, pos) {
+          const items: CompletionItem[] = [
+            { label: "myFunction", kind: CompletionItemKind.Function,
+              insertText: new SnippetString("myFunction(${1:arg})"),
+              detail: "Custom function" }
+          ];
+          return items;
+        }
+      }, ".");
+
+  - id: VSCODE-008
+    name: Publishing Extension
+    category: distribution
+    description: |
+      Package and publish to VS Code Marketplace.
+    text: |
+      Steps:
+      1. npm install -g @vscode/vsce
+      2. vsce package → creates .vsix
+      3. vsce publish → publishes to marketplace
+      Requirements:
+      - publisher in package.json
+      - Azure DevOps PAT token
+      - README.md with screenshots
+      - CHANGELOG.md

package/.agent/skills/tooling/mcp/META.yaml

@@ -0,0 +1,80 @@
+name: mcp
+version: "1.0.0"
+display: Model Context Protocol
+category: tooling
+tier: 1
+priority: 1
+
+desc: "MCP server & client development. JSON-RPC 2.0, transport (stdio/Streamable HTTP), tool/resource/prompt primitives, OAuth 2.1, and production patterns."
+
+  ### Data Files (3 domains, ~24 patterns)
+  - transport-patterns.yaml: stdio vs Streamable HTTP, config (8)
+  - tool-design.yaml: stateless tools, pagination, error handling (8)
+  - security.yaml: OAuth 2.1 flows, input validation, rate limiting (8)
+
+triggers:
+  file_patterns:
+    # Config
+    - "mcp.json"
+    - "mcp-config.json"
+    - ".mcp.json"
+    - "claude_desktop_config.json"
+    # Server structure
+    - "**/mcp-server/**"
+    - "**/mcp/**/*.ts"
+    - "**/tools/*.ts"
+    - "**/resources/*.ts"
+    - "**/prompts/*.ts"
+  keywords:
+    # Core
+    - MCP
+    - Model Context Protocol
+    - mcp server
+    - mcp client
+    - mcp tool
+    - mcp resource
+    - mcp prompt
+    # Protocol
+    - JSON-RPC
+    - JSON-RPC 2.0
+    - jsonrpc
+    # Transport
+    - stdio transport
+    - streamable http
+    - sse transport
+    # SDK
+    - "@modelcontextprotocol/sdk"
+    - "mcp sdk"
+    - "from mcp import"
+    # Primitives
+    - tool definition
+    - resource template
+    - prompt template
+    # Auth
+    - OAuth 2.1
+    - mcp auth
+
+caps:
+  - JSON-RPC 2.0 protocol (request/response/notification)
+  - Host ↔ Client ↔ Server architecture
+  - Transport: stdio (local/dev) vs Streamable HTTP (remote/prod)
+  - Tool primitives: stateless, idempotent, JSON Schema validation
+  - Resource primitives: URI templates, dynamic content
+  - Prompt primitives: reusable prompt templates
+  - OAuth 2.1 authentication (mandatory for HTTP transport)
+  - Bounded context per server (single responsibility)
+  - Pagination tokens for large result sets
+  - Error classification (recoverable vs fatal, -32xxx codes)
+  - Input validation & sanitization
+  - Containerized deployment patterns
+  - SDK patterns: TypeScript (@modelcontextprotocol/sdk), Python (mcp)
+
+related_skills:
+  - ai-agents
+  - api-protocols
+  - security
+
+hsa_adapter:
+  enabled: true
+  data_dir: "skills/tooling/mcp/data"
+  preload_data: true

package/.agent/skills/tooling/mcp/SKILL.md

@@ -0,0 +1,114 @@
+# MCP — Model Context Protocol Server Development
+
+> Skill cho phát triển MCP servers & clients  
+> JSON-RPC 2.0 • Tool/Resource/Prompt primitives • OAuth 2.1
+
+---
+
+## Khi Nào Dùng
+
+- Xây dựng MCP server kết nối AI agents với tools/data
+- Phát triển custom tools, resources, prompts cho Claude/Gemini/ChatGPT
+- Thiết kế transport layer (stdio local, Streamable HTTP production)
+- Implement OAuth 2.1 cho MCP servers remote
+
+## Architecture
+
+```
+┌─────────────────────────────────────────┐
+│           HOST APPLICATION              │
+│  (Claude Desktop, VS Code, IDE...)      │
+│                                         │
+│  ┌──────────┐  ┌──────────┐             │
+│  │ Client A │  │ Client B │  ← 1:1 map  │
+│  └────┬─────┘  └────┬─────┘             │
+└───────│──────────────│──────────────────┘
+        │              │
+  ┌─────▼─────┐  ┌─────▼─────┐
+  │ Server A  │  │ Server B  │  ← Bounded context
+  │ (Files)   │  │ (GitHub)  │  ← Single responsibility
+  └───────────┘  └───────────┘
+```
+
+## Core Patterns
+
+### Transport Selection
+
+| Transport           | Use Case                           | Auth               |
+| ------------------- | ---------------------------------- | ------------------ |
+| **stdio**           | Local dev, CLI tools, same-machine | Not required       |
+| **Streamable HTTP** | Remote, production, multi-user     | OAuth 2.1 required |
+
+### Tool Design (CRITICAL)
+
+```typescript
+// ✅ GOOD: Stateless, idempotent, bounded
+server.tool(
+  "search_files",
+  {
+    query: z.string(),
+    maxResults: z.number().default(10),
+  },
+  async ({ query, maxResults }) => {
+    const results = await search(query, maxResults);
+    return { content: [{ type: "text", text: JSON.stringify(results) }] };
+  },
+);
+
+// ❌ BAD: Stateful, unbounded results
+server.tool("get_all_data", {}, async () => {
+  return { content: [{ type: "text", text: entireDatabase }] }; // OOM!
+});
+```
+
+### Tool Rules
+
+1. **Stateless** — No side effects between calls
+2. **Idempotent** — Same input → same output
+3. **Bounded** — Use `maxResults` + pagination tokens
+4. **Validated** — JSON Schema cho tất cả inputs
+5. **Documented** — Clear description cho AI model
+
+### Resource Design
+
+```typescript
+// Static resource
+server.resource("config", "config://app", async () => ({
+  contents: [{ uri: "config://app", text: configData }],
+}));
+
+// Dynamic resource template
+server.resourceTemplate("user/{id}", async (uri) => ({
+  contents: [{ uri, text: await getUser(uri.params.id) }],
+}));
+```
+
+## Security Checklist
+
+- ✅ OAuth 2.1 cho HTTP transport
+- ✅ Input validation (JSON Schema)
+- ✅ Response size limits
+- ✅ Rate limiting per client
+- ✅ No secrets in tool outputs
+- ✅ Sanitize file paths (prevent traversal)
+
+## Common Traps
+
+| Trap                 | Giải pháp                                    |
+| -------------------- | -------------------------------------------- |
+| Response quá lớn     | Pagination tokens, `maxResults`              |
+| Timeout              | Set timeout per tool, return partial results |
+| Error classification | Use JSON-RPC error codes (-32600 to -32603)  |
+| Concurrent requests  | Stateless design, no shared mutable state    |
+| Transport mismatch   | stdio=dev only, HTTP=prod with OAuth         |
+
+## SDK Quick Reference
+
+| Language   | Package                     | Docs                    |
+| ---------- | --------------------------- | ----------------------- |
+| TypeScript | `@modelcontextprotocol/sdk` | modelcontextprotocol.io |
+| Python     | `mcp`                       | modelcontextprotocol.io |
+
+---
+
+_DOMYH Awesome Code • MCP Skill v1.0.0_

package/.agent/skills/tooling/mcp/data/security.yaml

@@ -0,0 +1,116 @@
+# MCP Security Patterns - HSA MCP Skill
+# Updated: 2026-02-12
+
+metadata:
+  skill: mcp
+  domain: security
+  version: "1.0.0"
+  updated: "2026-02-12"
+  patterns_count: 8
+
+patterns:
+  - id: sec001
+    name: oauth21
+    category: security
+    description: OAuth 2.1 authentication for HTTP transport
+    text: oauth 2.1 authentication http transport authorization bearer token
+    example: |
+      // Server: validate OAuth token
+      app.use("/mcp", async (req, res, next) => {
+        const token = req.headers.authorization?.split("Bearer ")[1];
+        if (!token || !await validateToken(token)) {
+          return res.status(401).json({ error: "Unauthorized" });
+        }
+        next();
+      });
+    severity: CRITICAL
+    rule: "OAuth 2.1 is MANDATORY for HTTP transport"
+
+  - id: sec002
+    name: input_sanitization
+    category: security
+    description: Sanitize all user inputs to prevent injection
+    text: input sanitization injection prevention path traversal command injection
+    example: |
+      // Prevent path traversal
+      const safePath = path.resolve(baseDir, userPath);
+      if (!safePath.startsWith(baseDir)) throw new Error("Path traversal!");
+      // Prevent command injection
+      const safeArg = shellEscape(userInput);
+    severity: CRITICAL
+
+  - id: sec003
+    name: rate_limiting
+    category: security
+    description: Rate limiting per client to prevent abuse
+    text: rate limit throttle abuse prevention per client request limit
+    example: |
+      const limiter = new RateLimiter({ windowMs: 60000, max: 100 });
+      app.use("/mcp", limiter.middleware());
+    severity: HIGH
+
+  - id: sec004
+    name: response_size_limit
+    category: security
+    description: Limit response sizes to prevent OOM
+    text: response size limit out of memory prevent large payload
+    example: |
+      const MAX_RESPONSE_SIZE = 1024 * 1024; // 1MB
+      if (result.length > MAX_RESPONSE_SIZE) {
+        return { content: [{ type: "text",
+          text: `Result too large (${result.length} bytes). Use pagination.` }],
+          isError: true };
+      }
+    severity: HIGH
+
+  - id: sec005
+    name: secrets_protection
+    category: security
+    description: Never expose secrets in tool outputs
+    text: secrets protection api keys passwords environment variables
+    rule: "NEVER include API keys, passwords, or tokens in tool responses"
+    example: |
+      // ✅ Redact secrets
+      const safeConfig = { ...config, apiKey: "***REDACTED***" };
+      // ❌ NEVER do this
+      return { content: [{ type: "text", text: process.env.API_KEY }] };
+    severity: CRITICAL
+
+  - id: sec006
+    name: scope_limitation
+    category: security
+    description: Limit server capabilities to minimal required scope
+    text: scope limitation minimal permissions principle of least privilege
+    rule: "Each server should only access what it needs"
+    example: |
+      // ✅ Read-only database server
+      server.tool("query", schema, async (input) => {
+        return db.query(input.sql); // SELECT only, no mutations
+      });
+
+  - id: sec007
+    name: timeout_handling
+    category: security
+    description: Set timeouts for all tool operations
+    text: timeout handling abort signal cancel long running operation
+    example: |
+      server.tool("fetch_data", schema, async (input) => {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 30000);
+        try {
+          return await fetchData(input, { signal: controller.signal });
+        } finally { clearTimeout(timeout); }
+      });
+    severity: HIGH
+
+  - id: sec008
+    name: logging_audit
+    category: security
+    description: Audit logging for all tool invocations
+    text: logging audit trail tool invocation tracking
+    example: |
+      server.tool("write_file", schema, async (input) => {
+        logger.info({ tool: "write_file", input: sanitize(input), timestamp: Date.now() });
+        return await writeFile(input);
+      });
+    severity: MEDIUM