@nockdev/awf 6.2.0

package/.agent/rules/data/quality-standards.json

@@ -0,0 +1,59 @@
+{
+  "version": "4.5",
+  "last_updated": "2026-02-01",
+  
+  "iso_25010": {
+    "name": "ISO 25010 Software Quality",
+    "characteristics": [
+      { "id": 1, "name": "Functional Suitability", "description": "Code does the right thing", "vi": "Chức năng" },
+      { "id": 2, "name": "Performance Efficiency", "description": "Speed, resource usage", "vi": "Hiệu năng" },
+      { "id": 3, "name": "Compatibility", "description": "Works with other systems", "vi": "Tương thích" },
+      { "id": 4, "name": "Usability", "description": "Easy to use", "vi": "Khả dụng" },
+      { "id": 5, "name": "Reliability", "description": "Stable, fault-tolerant", "vi": "Tin cậy" },
+      { "id": 6, "name": "Security", "description": "Protects data", "vi": "Bảo mật" },
+      { "id": 7, "name": "Maintainability", "description": "Easy to fix, extend", "vi": "Bảo trì" },
+      { "id": 8, "name": "Portability", "description": "Runs in multiple environments", "vi": "Di động" }
+    ]
+  },
+  
+  "cwe_top_25_2024": {
+    "name": "CWE Top 25 Most Dangerous Vulnerabilities (2024)",
+    "vulnerabilities": [
+      { "rank": 1, "id": "CWE-79", "name": "XSS", "description": "Cross-site scripting", "vi": "Chèn script độc hại" },
+      { "rank": 2, "id": "CWE-787", "name": "Out-of-bounds Write", "description": "Memory corruption" },
+      { "rank": 3, "id": "CWE-89", "name": "SQL Injection", "description": "SQL code injection", "vi": "Chèn SQL" },
+      { "rank": 4, "id": "CWE-352", "name": "CSRF", "description": "Cross-site request forgery", "vi": "Giả mạo request" },
+      { "rank": 5, "id": "CWE-22", "name": "Path Traversal", "description": "Unauthorized file access", "vi": "Truy cập file trái phép" },
+      { "rank": 6, "id": "CWE-287", "name": "Improper Auth", "description": "Authentication bypass", "vi": "Xác thực không đúng" },
+      { "rank": 7, "id": "CWE-78", "name": "OS Command Injection", "description": "System command injection" },
+      { "rank": 8, "id": "CWE-862", "name": "Missing Authorization", "description": "Access control bypass" },
+      { "rank": 9, "id": "CWE-400", "name": "Resource Consumption", "description": "DoS via resource exhaustion" },
+      { "rank": 10, "id": "CWE-200", "name": "Info Exposure", "description": "Sensitive data leak" }
+    ]
+  },
+  
+  "owasp_top_10_2021": {
+    "name": "OWASP Top 10 Web Security (2021)",
+    "categories": [
+      { "id": "A01", "name": "Broken Access Control", "description": "Authorization failures" },
+      { "id": "A02", "name": "Cryptographic Failures", "description": "Encryption issues" },
+      { "id": "A03", "name": "Injection", "description": "Code/SQL injection" },
+      { "id": "A04", "name": "Insecure Design", "description": "Design flaws" },
+      { "id": "A05", "name": "Security Misconfiguration", "description": "Bad settings" },
+      { "id": "A06", "name": "Vulnerable Components", "description": "Outdated dependencies" },
+      { "id": "A07", "name": "Auth Failures", "description": "Authentication issues" },
+      { "id": "A08", "name": "Data Integrity Failures", "description": "Tampering risks" },
+      { "id": "A09", "name": "Logging Failures", "description": "Poor audit trails" },
+      { "id": "A10", "name": "SSRF", "description": "Server-Side Request Forgery" }
+    ]
+  },
+  
+  "severity_levels": {
+    "levels": [
+      { "level": "P0", "icon": "🔴", "name": "Critical", "sla": "24h", "vi": "Nghiêm trọng" },
+      { "level": "P1", "icon": "🟠", "name": "High", "sla": "3 days", "vi": "Cao" },
+      { "level": "P2", "icon": "🟡", "name": "Medium", "sla": "1 week", "vi": "Trung bình" },
+      { "level": "P3", "icon": "🟢", "name": "Low", "sla": "2 weeks", "vi": "Thấp" }
+    ]
+  }
+}

package/.agent/rules/duplication-prevention.md

@@ -0,0 +1,138 @@
+---
+name: duplication-prevention
+priority: 2
+always_apply: true
+category: quality
+version: "4.5"
+---
+
+# 🔄 Duplication Prevention v6.2.0
+
+> 🌍 **Language / Ngôn ngữ**: English (default) | [Tiếng Việt](#tiếng-việt)
+> 📝 **Note**: Consolidates `code-deduplication.md` + `logic-duplication-check.md`
+
+## Enforcement Level: WARN
+
+## Description
+
+Two complementary rules:
+
+1. **Code Dedup** — Before adding new functions, search existing code
+2. **Logic Check** — Before reporting "missing", verify logic exists elsewhere
+
+---
+
+## 🔍 Before Adding New Functions
+
+### Step 1: Search Existing Code
+
+```yaml
+search_patterns:
+  1. grep_search: function name, keywords
+  2. find_by_name: "utils", "helpers", "shared", "lib"
+  3. view_file_outline: existing utility files
+```
+
+### Step 2: Check Standard Locations
+
+| Language   | Check Directories                              |
+| ---------- | ---------------------------------------------- |
+| TypeScript | `src/lib/`, `src/utils/`, `lib/`               |
+| Go         | `pkg/`, `internal/utils/`, `internal/helpers/` |
+| Python     | `src/utils/`, `utils/`, `common/`              |
+| Java       | `src/main/java/**/utils/`, `**/common/`        |
+| C#         | `Common/`, `Utilities/`, `Helpers/`            |
+
+### Step 3: Decision Matrix
+
+| Found       | Action                             |
+| ----------- | ---------------------------------- |
+| Exact match | ✅ Use existing, don't create new  |
+| Similar     | ⚠️ Consider extending existing     |
+| None        | ✅ Create new in appropriate utils |
+
+---
+
+## 🔍 Before Reporting "Missing"
+
+### Check for Refactored Logic
+
+```yaml
+fallback_checks: 1. Check _deprecated/ folder for migration notes
+  2. Check manifest.yaml for updated references
+  3. Check related directories (rules/ vs core/)
+  4. Search for similar functionality elsewhere
+```
+
+### Example
+
+```
+❌ Wrong: "RULES.md is MISSING in core/"
+Reality: RULES.md was split into 15 files in rules/
+
+✅ Correct: Check rules/README.md → find evidence.md, safety.md
+Report: "RULES.md was refactored into rules/"
+```
+
+---
+
+## 📋 Enforcement
+
+### On Function Creation:
+
+```
+⚠️ Similar function found: formatDate
+📍 Location: src/utils/format.ts:42
+💡 Consider using existing: formatDate()
+```
+
+### On Missing Report:
+
+```
+🔍 Checking fallbacks...
+├── _deprecated/: Not found
+├── manifest.yaml: Found → rules_dir updated
+└── Result: Refactored to rules/
+```
+
+---
+
+## 📋 Checklist
+
+### Before Adding Utils:
+
+- [ ] Searched existing codebase?
+- [ ] Checked utils/lib/helpers directories?
+- [ ] Confirmed no similar function exists?
+
+### Before Reporting Missing:
+
+- [ ] Checked \_deprecated/ folder?
+- [ ] Checked manifest for new paths?
+- [ ] Searched related directories?
+
+---
+
+# Tiếng Việt
+
+> 🇻🇳 Phiên bản Tiếng Việt
+
+## Mô Tả
+
+Ngăn chặn code trùng lặp và báo cáo sai về file thiếu.
+
+## Trước Khi Thêm Function
+
+1. Tìm kiếm code tương tự
+2. Kiểm tra thư mục utils/shared
+3. Chỉ tạo mới nếu thực sự không có
+
+## Trước Khi Báo "Thiếu"
+
+1. Kiểm tra \_deprecated/
+2. Kiểm tra manifest.yaml
+3. Tìm trong các thư mục liên quan
+
+---
+
+_DOMYH Awesome Code • Consolidated Duplication Prevention_

package/.agent/rules/incremental-changes.md

@@ -0,0 +1,146 @@
+# Incremental Changes Rule
+
+## Enforcement Level: WARN
+
+## Rule Description
+
+Agent PHẢI thực hiện thay đổi code theo **incremental approach** - từng bước nhỏ, test thường xuyên, commit atomic.
+
+---
+
+## Core Principles
+
+### 1. Small Batches
+
+```
+❌ BAD: Change 10 files at once
+✅ GOOD: Change 1-3 related files, verify, then continue
+```
+
+### 2. Test After Each Step
+
+```
+❌ BAD: Write all code, then test at the end
+✅ GOOD: Write feature → Test → Verify → Next feature
+```
+
+### 3. Atomic Changes
+
+```
+❌ BAD: Mix unrelated changes in one commit
+✅ GOOD: One logical change per commit
+```
+
+---
+
+## Incremental Flow
+
+```mermaid
+graph TB
+    A[Plan Changes] --> B[Implement Step 1]
+    B --> C{Test/Verify?}
+    C -->|Pass| D[Commit Step 1]
+    C -->|Fail| E[Fix & Retry]
+    E --> C
+    D --> F{More Steps?}
+    F -->|Yes| G[Implement Step 2]
+    G --> C
+    F -->|No| H[Done]
+```
+
+---
+
+## Implementation Guidelines
+
+### Maximum Changes Per Batch
+
+| Change Type   | Max Files        | Max Lines |
+| ------------- | ---------------- | --------- |
+| Bug fix       | 2-3 files        | 50 lines  |
+| Small feature | 3-5 files        | 150 lines |
+| Refactor      | 5-10 files       | 300 lines |
+| Large feature | Break into steps | N/A       |
+
+### Verification After Each Step
+
+```
+After modifying code:
+1. Run: Lint check
+2. Run: Type check (if applicable)
+3. Run: Related unit tests
+4. Verify: Build succeeds
+```
+
+### Rollback Strategy
+
+If step fails:
+
+1. Identify failing change
+2. Revert to last working state
+3. Re-implement with fix
+4. Continue incrementally
+
+---
+
+## Trigger Patterns
+
+Agent SHOULD apply this rule when:
+
+- Implementing multi-file changes
+- Adding new features
+- Performing refactoring
+- Fixing complex bugs
+
+---
+
+## Example Workflow
+
+```
+User: "Add user CRUD operations"
+
+Agent Plan:
+├── Step 1: Create User model + migration
+├── Step 2: Create User repository
+├── Step 3: Create User service
+├── Step 4: Create User controller
+└── Step 5: Add routes + tests
+
+Execution:
+Step 1: Create User model
+├── Write: src/models/user.ts
+├── Write: migrations/001_user.sql
+├── Verify: Schema valid ✅
+└── Commit: "feat(user): add User model"
+
+Step 2: Create User repository
+├── Write: src/repositories/user.ts
+├── Verify: Types match ✅
+└── Commit: "feat(user): add User repository"
+
+... continue incrementally
+```
+
+---
+
+## Benefits
+
+| Benefit           | Description                          |
+| ----------------- | ------------------------------------ |
+| Easier debugging  | Small changes = easy to isolate bugs |
+| Lower risk        | Rollback only affects small change   |
+| Better reviews    | Atomic commits are easier to review  |
+| Progress tracking | Can measure completion by steps      |
+
+---
+
+## Checklist
+
+- [ ] Changes broken into small steps?
+- [ ] Each step verified before next?
+- [ ] Commits are atomic?
+- [ ] Tests run after each step?
+- [ ] Can rollback if needed?
+
+---
+
+_DOMYH Awesome Code — Incremental Changes Rule_

package/.agent/rules/modules/context-management.yaml

@@ -0,0 +1,158 @@
+# Context Management Rule v6.0
+# Modular rule for context and token efficiency
+
+---
+name: context-management
+version: "6.1.2"
+rule_id: "MOD-CTX-001"
+
+# =============================================================================
+# RULE METADATA
+# =============================================================================
+
+description: |
+  Rules for efficient context window management and token optimization.
+  Based on best practices for LLM conversation management.
+
+category: "efficiency"
+
+# =============================================================================
+# CONTEXT APPLICATION
+# =============================================================================
+
+context:
+  always_apply: true
+  personas: ["*"]
+  workflows: ["*"]
+
+# =============================================================================
+# CORE PRINCIPLES
+# =============================================================================
+
+principles:
+  progressive_disclosure:
+    description: "Load information only when needed"
+    implementation:
+      - "Start with high-level overview"
+      - "Drill down on request or necessity"
+      - "Don't load full files unless required"
+    examples:
+      good: "Use view_file_outline first, then view specific functions"
+      bad: "Load entire 500-line file to find one function"
+
+  token_budget_awareness:
+    description: "Be conscious of token usage"
+    implementation:
+      - "Estimate token cost before large operations"
+      - "Summarize verbose outputs"
+      - "Reference instead of repeat"
+    limits:
+      working_memory: 2000
+      session_context: 5000
+      max_single_file: 10000
+
+  smart_caching:
+    description: "Remember what you've already seen"
+    implementation:
+      - "Don't re-read files already in context"
+      - "Track which files have been viewed"
+      - "Update mental model incrementally"
+
+# =============================================================================
+# SPECIFIC RULES
+# =============================================================================
+
+rules:
+  file_viewing:
+    rule: "Use view_file_outline before view_file for large files"
+    rationale: "Outline provides structure with minimal tokens"
+    threshold: "Files > 200 lines"
+    
+  search_strategy:
+    rule: "Use grep_search for finding, view_file for understanding"
+    rationale: "grep returns targeted results, view_file is for context"
+    
+  conversation_context:
+    rule: "Reference previous answers instead of repeating"
+    pattern: "As mentioned above..." or "Continuing from earlier..."
+    
+  output_efficiency:
+    rule: "Summarize similar items, detail unique ones"
+    example: "Found 15 similar errors in X pattern, showing 3 representative..."
+    
+  file_modification:
+    rule: "Use targeted edits, not full file rewrites"
+    pattern: "replace_file_content for modifications"
+    exception: "New files use write_to_file"
+
+# =============================================================================
+# TRIGGERS & ACTIONS
+# =============================================================================
+
+triggers:
+  large_file_detected:
+    condition: "File > 500 lines"
+    action: "Use outline first"
+    
+  repeated_content:
+    condition: "Same content appears twice"
+    action: "Reference with pointer"
+    
+  context_overflow:
+    condition: "Context approaching limit"
+    action: "Summarize and archive older context"
+
+# =============================================================================
+# INTEGRATION
+# =============================================================================
+
+integration:
+  memory_system:
+    - "Use working memory for immediate context"
+    - "Move completed context to session memory"
+    - "Summarize session to state on save"
+    
+  reflection:
+    enabled: true
+    check_after: "Every 5 tool calls"
+    question: "Am I using context efficiently?"
+
+  # HSA v1.0.0 Integration
+  hsa:
+    enabled: true
+    description: "Hierarchical Semantic Architecture for intelligent context"
+    
+    mcp_tools:
+      hsa_get_context:
+        description: "Get optimized context for complex analysis"
+        when: "Before analyzing multiple related files"
+        
+      hsa_detect_stack:
+        description: "Detect project tech stack"
+        when: "At session start"
+        
+      hsa_check_changes:
+        description: "Check file changes since last context"
+        when: "After user edits files"
+        
+      hsa_prefetch:
+        description: "Prefetch predicted next files"
+        when: "Navigation between components"
+        
+      hsa_status:
+        description: "Check HSA engine status"
+        when: "Debug or troubleshooting"
+    
+    auto_workflow:
+      session_start: "hsa_detect_stack"
+      before_analysis: "hsa_get_context"
+      after_file_edit: "hsa_check_changes"
+      
+    fallback:
+      when_unavailable: "Use file-based context (view_file, grep_search)"
+      graceful: true
+
+---
+
+_DOMYH Awesome Code • Context Management Rule • HSA v1.0.0 Integration_
+

package/.agent/rules/modules/edit-verification.yaml

@@ -0,0 +1,197 @@
+# Edit Verification Rule v6.0
+# Modular rule for code edit verification
+
+---
+name: edit-verification
+version: "6.1.2"
+rule_id: "MOD-EDV-001"
+
+# =============================================================================
+# RULE METADATA
+# =============================================================================
+
+description: |
+  Mandatory verification after code edits to prevent silent failures.
+  Based on documented agent edit failures (CVE Research 2025).
+
+category: "verification"
+
+# =============================================================================
+# CONTEXT APPLICATION
+# =============================================================================
+
+context:
+  always_apply: true
+  personas: ["developer", "debugger", "devops"]
+  workflows: ["/code", "/debug", "/refactor"]
+
+# =============================================================================
+# CORE PRINCIPLES
+# =============================================================================
+
+principles:
+  verify_after_edit:
+    description: "Always verify changes after editing"
+    implementation:
+      - "Display diff evidence"
+      - "Show lines changed"
+      - "Run syntax check"
+
+  scope_containment:
+    description: "Only edit what's requested"
+    implementation:
+      - "Don't refactor unrelated code"
+      - "Don't auto-format entire file"
+      - "Don't change coding style"
+
+  deletion_prevention:
+    description: "Prevent accidental code deletion"
+    implementation:
+      - "Verify file integrity after edits"
+      - "Watch for 100+ line deletions"
+      - "Use git diff to confirm changes"
+
+# =============================================================================
+# VERIFICATION GATES
+# =============================================================================
+
+gates:
+  gate_1_confirmation:
+    name: "Edit Confirmation"
+    action: |
+      Display after any edit:
+      - File path
+      - Lines added/removed
+      - Status (applied/failed)
+      - Verification command
+    template: |
+      📝 EDIT APPLIED
+
+      File: {file_path}
+      Lines Changed: +{added}, -{removed}
+      Status: ✅ Applied
+
+      Verify: git diff HEAD -- {file_path}
+
+  gate_2_syntax:
+    name: "Syntax Check"
+    commands:
+      typescript: "npx tsc --noEmit"
+      go: "go build ./..."
+      python: "python -m py_compile {file}"
+      rust: "cargo check"
+      java: "javac {file}"
+    on_failure: "Stop and report syntax error"
+
+  gate_3_tests:
+    name: "Test Run (if applicable)"
+    condition: "If related tests exist"
+    commands:
+      typescript: 'npm test -- --testPathPattern="{pattern}"'
+      go: "go test ./{package}/..."
+      python: "pytest {test_file}"
+    on_failure: "Report test failure with details"
+
+# =============================================================================
+# SCOPE RULES
+# =============================================================================
+
+scope:
+  allowed:
+    - "Files mentioned in request"
+    - "Directly related files (imports, types)"
+    - "Test files for edited code"
+
+  forbidden:
+    - "Unrelated code refactoring"
+    - "Auto-formatting entire files"
+    - "Changing coding style conventions"
+    - "Editing files outside project"
+
+  violation_template: |
+    ⚠️ SCOPE EXPANSION DETECTED
+
+    Request: {original_request}
+    I also want to:
+    - {additional_change_1}
+    - {additional_change_2}
+
+    This expands the scope. Continue? (y/n):
+
+# =============================================================================
+# PROTECTED PATTERNS
+# =============================================================================
+
+protected:
+  files:
+    - ".env*" # Environment secrets
+    - "*.key" # Keys
+    - "*.pem" # Certificates
+    - "id_rsa*" # SSH keys
+    - "credentials.*" # Auth files
+    - "secrets.*" # Secret files
+
+  sections:
+    marker: "@protected - do not modify"
+    end_marker: "@end-protected"
+    action: "Skip editing protected sections"
+
+# =============================================================================
+# PATCH STRATEGY
+# =============================================================================
+
+patch:
+  rules:
+    - "Apply small hunks, not entire files"
+    - "Commit frequently"
+    - "Pull/rebase before patching"
+    - "If patch fails, regenerate don't force"
+
+  on_failure: |
+    ❌ PATCH FAILED
+
+    File has changed since context was loaded.
+    Conflict in: {file} (line {start}-{end})
+
+    Options:
+    1️⃣ Pull latest and regenerate patch
+    2️⃣ Show manual merge steps
+    3️⃣ Abort and review changes
+
+# =============================================================================
+# CHECKLIST
+# =============================================================================
+
+checklist:
+  - "Displayed diff evidence?"
+  - "Lines added/removed correct?"
+  - "Syntax check passed?"
+  - "No unintended deletions?"
+  - "Within requested scope?"
+  - "Tests still pass?"
+
+# =============================================================================
+# INTEGRATION
+# =============================================================================
+
+integration:
+  tier: 2 # Execution tier
+  related_modules:
+    - stop-conditions
+    - evidence
+
+  hsa_tools:
+    hsa_detect_stack:
+      purpose: "Auto-detect correct build/lint/test commands for verification gates"
+      usage: "hsa_detect_stack → determines syntax_check, build_check, test_check commands"
+    hsa_get_context:
+      purpose: "Pre-edit context to assess impact before modifying code"
+      usage: "hsa_get_context files=[target] → understand dependencies and callers"
+
+  reflection:
+    enabled: true
+    check_after: "edit"
+    question: "Did I verify this edit properly?"
+
+---
+_DOMYH Awesome Code • Edit Verification Rule_