agent-devkit 0.1.6 → 0.3.0

package/runtime/agents/software-specification-analyst/capabilities/create-technical-spec/capability.yaml

@@ -19,3 +19,15 @@ integration:
   repository: null
   methods: []
 write_policy: read_only
+
+routing:
+  anchors:
+    - arquitetura
+    - especificacao tecnica
+    - spec tecnica
+    - technical spec
+  intents:
+    - spec.technical
+  examples:
+    - gere uma especificacao tecnica para essa demanda
+  priority: 80

package/runtime/agents/software-specification-analyst/capabilities/refine-analysis-with-feedback/capability.yaml

@@ -23,4 +23,4 @@ outputs:
 integration:
   repository: null
   methods: []
-write_policy: ask_before_creating_output_directory
+write_policy: output_only

package/runtime/agents/software-specification-analyst/capabilities/write-user-stories/capability.yaml

@@ -19,3 +19,15 @@ integration:
   repository: null
   methods: []
 write_policy: read_only
+
+routing:
+  anchors:
+    - criterios de aceite
+    - historia
+    - user stories
+    - user story
+  intents:
+    - spec.user-stories
+  examples:
+    - escreva historias de usuario
+  priority: 80

package/runtime/agents/sqlserver-change-operator/agent.yaml

@@ -61,6 +61,17 @@ agent_surface:
     - knowledge/policies.yaml
 
 write_policy:
-  read_operations: auto
+  read_operations: read_only
   write_operations: confirm
   destructive_operations: blocked_by_default
+
+routing:
+  anchors:
+    - banco
+    - migracao
+    - migration
+    - sql
+    - sqlserver
+  intents:
+    - database.sqlserver.change
+  priority: 35

package/runtime/agents/sqlserver-data-analyzer/agent.yaml

@@ -85,5 +85,16 @@ agent_surface:
     - knowledge/policies.yaml
 
 write_policy:
-  read_operations: auto
-  write_operations: unsupported
+  read_operations: read_only
+  write_operations: blocked_by_default
+
+routing:
+  anchors:
+    - banco
+    - database
+    - sql
+    - sqlserver
+    - tabela
+  intents:
+    - database.sqlserver.analysis
+  priority: 45

package/runtime/agents/supabase-project-analyst/AGENTS.md

@@ -0,0 +1,29 @@
+# Supabase Project Analyst
+
+Instrucoes locais para trabalhar no agente `supabase-project-analyst`.
+
+## Responsabilidade
+
+Este agente analisa projetos Supabase em modo read-only, com foco em Postgres,
+RLS, Auth, Storage, Edge Functions, migrations, performance e seguranca. A
+primeira fase analisa arquivos locais e readiness de CLI/MCP sem aplicar SQL.
+
+## Fora De Escopo
+
+- Aplicar migrations.
+- Executar SQL real.
+- Criar projeto Supabase.
+- Alterar RLS, Auth, Storage ou configuracao remota.
+- Armazenar credenciais OAuth/token.
+- Substituir `postgres-data-analyzer` para analise SQL generica.
+
+## Guardrails
+
+- Nunca imprimir `service_role`, access token, DB URL ou JWT secret.
+- Nunca usar `raw_user_meta_data`/`user_metadata` como autorizacao segura.
+- Alertar para tabelas expostas sem RLS.
+- Alertar para `auth.role()`, `TO authenticated` sem ownership e UPDATE sem
+  `WITH CHECK`.
+- Alertar para `SECURITY DEFINER` em schema exposto e views sem
+  `security_invoker`.
+- Gerar SQL apenas como sugestao, nunca aplicar.

package/runtime/agents/supabase-project-analyst/README.md

@@ -0,0 +1,23 @@
+# Supabase Project Analyst
+
+Agente especialista em diagnostico read-only de projetos Supabase locais:
+configuracao, migrations, RLS, Auth, Storage, Edge Functions e plano de
+correcao sem executar alteracoes.
+
+## Capabilities
+
+- `inspect-supabase-project`: coleta contexto local e readiness de CLI/MCP.
+- `audit-rls-policies`: audita RLS e policies em SQL local.
+- `audit-auth-security`: audita Auth, claims e exposicao de secrets.
+- `audit-storage-policies`: audita buckets/policies de Storage em SQL local.
+- `review-migrations`: revisa migrations e DDL perigoso.
+- `generate-supabase-report`: consolida findings em relatorio output-only.
+- `plan-supabase-fix`: gera plano e SQL sugerido sem aplicar.
+
+## Uso
+
+```bash
+./agent --json run supabase-project-analyst inspect-supabase-project --project-path .
+```
+
+Este agente nao executa SQL e nao aplica migrations.

package/runtime/agents/supabase-project-analyst/agent.yaml

@@ -0,0 +1,53 @@
+id: supabase-project-analyst
+kind: specialist-agent
+name: Supabase Project Analyst
+version: 0.1.0
+status: draft
+owner: agent-devkit
+purpose: >
+  Diagnosticar projetos Supabase em modo read-only, analisando configuracao
+  local, migrations, RLS, Auth, Storage, Edge Functions, riscos e planos de
+  correcao sem aplicar mudancas.
+default_context:
+  - knowledge/system.md
+  - knowledge/context.md
+  - knowledge/policies.yaml
+env:
+  required: []
+  optional:
+    - SUPABASE_PROJECT_REF
+    - SUPABASE_ACCESS_TOKEN
+    - SUPABASE_DB_URL
+    - SUPABASE_SERVICE_ROLE_KEY
+capabilities:
+  - inspect-supabase-project
+  - audit-rls-policies
+  - audit-auth-security
+  - audit-storage-policies
+  - review-migrations
+  - generate-supabase-report
+  - plan-supabase-fix
+agent_surface:
+  repositories:
+    - infra/integrations/supabase-project/supabase_project_repository.py
+  policies:
+    - knowledge/policies.yaml
+write_policy:
+  inspection: read_only
+  audits: read_only
+  report: output_only
+  fix_plan: dry_run
+  sql_execution: blocked_by_default
+  remote_changes: blocked_by_default
+routing:
+  anchors:
+    - supabase
+    - rls
+    - storage policies
+    - edge functions
+    - supabase auth
+  intents:
+    - supabase.project.audit
+    - supabase.rls.audit
+    - supabase.security.review
+  priority: 50

package/runtime/agents/supabase-project-analyst/capabilities/audit-auth-security/capability.yaml

@@ -0,0 +1,18 @@
+id: supabase-project-analyst.audit-auth-security
+kind: capability
+name: Audit Auth Security
+version: 0.1.0
+status: draft
+purpose: Auditar Auth, claims, metadados e exposicao de secrets em projeto Supabase local.
+entrypoint:
+  runner: runner.py
+  workflow: workflow.md
+  output_template: ../../templates/supabase-audit.md
+inputs:
+  required: []
+  optional:
+    - project-path
+outputs:
+  artifacts:
+    - supabase-auth-audit.json
+write_policy: read_only

package/runtime/agents/supabase-project-analyst/capabilities/audit-auth-security/decision-rules.md

@@ -0,0 +1,5 @@
+# Decision Rules
+
+- Nunca expor valores de secrets.
+- `raw_user_meta_data`/`user_metadata` nao devem ser usados para autorizacao.
+- Service role em codigo local deve ser high/critical.

package/runtime/agents/supabase-project-analyst/capabilities/audit-auth-security/runner.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Runner for supabase-project-analyst/audit-auth-security."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+
+REPOSITORY_DIR = Path(__file__).resolve().parents[2] / "infra" / "integrations" / "supabase-project"
+sys.path.insert(0, str(REPOSITORY_DIR))
+
+from supabase_project_repository import SupabaseProjectError, SupabaseProjectRepository  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Audit Supabase Auth security")
+    parser.add_argument("--project-path", default=".")
+    args = parser.parse_args()
+    try:
+        result = SupabaseProjectRepository().audit_auth_security(project_path=Path(args.project_path))
+    except SupabaseProjectError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/agents/supabase-project-analyst/capabilities/audit-auth-security/workflow.md

@@ -0,0 +1,6 @@
+# Workflow
+
+1. Ler migrations, seed e Edge Functions.
+2. Detectar `raw_user_meta_data`, `user_metadata`, service role e chaves.
+3. Detectar uso inseguro de JWT/claims em autorizacao.
+4. Retornar findings read-only.

package/runtime/agents/supabase-project-analyst/capabilities/audit-rls-policies/capability.yaml

@@ -0,0 +1,18 @@
+id: supabase-project-analyst.audit-rls-policies
+kind: capability
+name: Audit RLS Policies
+version: 0.1.0
+status: draft
+purpose: Auditar RLS e policies Supabase em SQL local.
+entrypoint:
+  runner: runner.py
+  workflow: workflow.md
+  output_template: ../../templates/supabase-audit.md
+inputs:
+  required: []
+  optional:
+    - project-path
+outputs:
+  artifacts:
+    - supabase-rls-audit.json
+write_policy: read_only

package/runtime/agents/supabase-project-analyst/capabilities/audit-rls-policies/decision-rules.md

@@ -0,0 +1,6 @@
+# Decision Rules
+
+- `auth.role()` deve ser reportado.
+- `TO authenticated` sem `auth.uid()`/ownership deve ser reportado.
+- UPDATE sem `WITH CHECK` deve ser reportado.
+- Nao aplicar policy.

package/runtime/agents/supabase-project-analyst/capabilities/audit-rls-policies/runner.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Runner for supabase-project-analyst/audit-rls-policies."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+
+REPOSITORY_DIR = Path(__file__).resolve().parents[2] / "infra" / "integrations" / "supabase-project"
+sys.path.insert(0, str(REPOSITORY_DIR))
+
+from supabase_project_repository import SupabaseProjectError, SupabaseProjectRepository  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Audit Supabase RLS policies")
+    parser.add_argument("--project-path", default=".")
+    args = parser.parse_args()
+    try:
+        result = SupabaseProjectRepository().audit_rls_policies(project_path=Path(args.project_path))
+    except SupabaseProjectError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/agents/supabase-project-analyst/capabilities/audit-rls-policies/workflow.md

@@ -0,0 +1,7 @@
+# Workflow
+
+1. Ler migrations e seed local.
+2. Detectar tabelas em schema exposto sem RLS.
+3. Detectar policies permissivas, `auth.role()`, `TO authenticated` sem
+   ownership e UPDATE sem `WITH CHECK`.
+4. Retornar findings read-only.

package/runtime/agents/supabase-project-analyst/capabilities/audit-storage-policies/capability.yaml

@@ -0,0 +1,18 @@
+id: supabase-project-analyst.audit-storage-policies
+kind: capability
+name: Audit Storage Policies
+version: 0.1.0
+status: draft
+purpose: Auditar buckets e policies de Supabase Storage em SQL local.
+entrypoint:
+  runner: runner.py
+  workflow: workflow.md
+  output_template: ../../templates/supabase-audit.md
+inputs:
+  required: []
+  optional:
+    - project-path
+outputs:
+  artifacts:
+    - supabase-storage-audit.json
+write_policy: read_only

package/runtime/agents/supabase-project-analyst/capabilities/audit-storage-policies/decision-rules.md

@@ -0,0 +1,5 @@
+# Decision Rules
+
+- Storage public amplo deve ser finding.
+- Upsert exige INSERT, SELECT e UPDATE.
+- Nao alterar buckets ou policies.

package/runtime/agents/supabase-project-analyst/capabilities/audit-storage-policies/runner.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Runner for supabase-project-analyst/audit-storage-policies."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+
+REPOSITORY_DIR = Path(__file__).resolve().parents[2] / "infra" / "integrations" / "supabase-project"
+sys.path.insert(0, str(REPOSITORY_DIR))
+
+from supabase_project_repository import SupabaseProjectError, SupabaseProjectRepository  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Audit Supabase Storage policies")
+    parser.add_argument("--project-path", default=".")
+    args = parser.parse_args()
+    try:
+        result = SupabaseProjectRepository().audit_storage_policies(project_path=Path(args.project_path))
+    except SupabaseProjectError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/agents/supabase-project-analyst/capabilities/audit-storage-policies/workflow.md

@@ -0,0 +1,6 @@
+# Workflow
+
+1. Ler SQL local.
+2. Detectar policies sobre `storage.objects`.
+3. Detectar acesso publico amplo e upsert sem SELECT/UPDATE/INSERT suficientes.
+4. Retornar findings read-only.

package/runtime/agents/supabase-project-analyst/capabilities/generate-supabase-report/capability.yaml

@@ -0,0 +1,18 @@
+id: supabase-project-analyst.generate-supabase-report
+kind: capability
+name: Generate Supabase Report
+version: 0.1.0
+status: draft
+purpose: Consolidar auditorias Supabase em relatorio output-only.
+entrypoint:
+  runner: runner.py
+  workflow: workflow.md
+  output_template: ../../templates/supabase-report.md
+inputs:
+  required: []
+  optional:
+    - project-path
+outputs:
+  artifacts:
+    - supabase-report.json
+write_policy: output_only

package/runtime/agents/supabase-project-analyst/capabilities/generate-supabase-report/decision-rules.md

@@ -0,0 +1,6 @@
+# Decision Rules
+
+- Nao escrever arquivo local.
+- Nao aplicar SQL.
+- Redigir secrets em evidencias.
+- Separar recomendacao de SQL sugerido.

package/runtime/agents/supabase-project-analyst/capabilities/generate-supabase-report/runner.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Runner for supabase-project-analyst/generate-supabase-report."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+
+REPOSITORY_DIR = Path(__file__).resolve().parents[2] / "infra" / "integrations" / "supabase-project"
+sys.path.insert(0, str(REPOSITORY_DIR))
+
+from supabase_project_repository import SupabaseProjectError, SupabaseProjectRepository  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Generate a Supabase audit report")
+    parser.add_argument("--project-path", default=".")
+    args = parser.parse_args()
+    try:
+        result = SupabaseProjectRepository().generate_supabase_report(project_path=Path(args.project_path))
+    except SupabaseProjectError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/agents/supabase-project-analyst/capabilities/generate-supabase-report/workflow.md

@@ -0,0 +1,6 @@
+# Workflow
+
+1. Executar auditorias locais em memoria.
+2. Consolidar findings por severidade e categoria.
+3. Separar fatos, riscos e recomendacoes.
+4. Retornar relatorio output-only.

package/runtime/agents/supabase-project-analyst/capabilities/inspect-supabase-project/capability.yaml

@@ -0,0 +1,19 @@
+id: supabase-project-analyst.inspect-supabase-project
+kind: capability
+name: Inspect Supabase Project
+version: 0.1.0
+status: draft
+purpose: Coletar contexto local e readiness de um projeto Supabase sem expor segredos.
+entrypoint:
+  runner: runner.py
+  workflow: workflow.md
+  output_template: ../../templates/supabase-inspection.md
+inputs:
+  required: []
+  optional:
+    - project-path
+    - include-cli-status
+outputs:
+  artifacts:
+    - supabase-inspection.json
+write_policy: read_only

package/runtime/agents/supabase-project-analyst/capabilities/inspect-supabase-project/decision-rules.md

@@ -0,0 +1,6 @@
+# Decision Rules
+
+- Nao executar SQL.
+- Nao chamar comandos que mutam projeto.
+- Reportar MCP/CLI como readiness, nao como requisito.
+- Nao imprimir valores de tokens, DB URLs ou service role keys.

package/runtime/agents/supabase-project-analyst/capabilities/inspect-supabase-project/runner.py

@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+"""Runner for supabase-project-analyst/inspect-supabase-project."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+
+REPOSITORY_DIR = Path(__file__).resolve().parents[2] / "infra" / "integrations" / "supabase-project"
+sys.path.insert(0, str(REPOSITORY_DIR))
+
+from supabase_project_repository import SupabaseProjectError, SupabaseProjectRepository  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Inspect a local Supabase project")
+    parser.add_argument("--project-path", default=".")
+    parser.add_argument("--include-cli-status", action="store_true")
+    args = parser.parse_args()
+    try:
+        result = SupabaseProjectRepository().inspect_supabase_project(
+            project_path=Path(args.project_path),
+            include_cli_status=args.include_cli_status,
+        )
+    except SupabaseProjectError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/agents/supabase-project-analyst/capabilities/inspect-supabase-project/workflow.md

@@ -0,0 +1,7 @@
+# Workflow
+
+1. Resolver `project-path` ou usar diretorio atual.
+2. Ler `supabase/config.toml`, migrations, seed e Edge Functions se existirem.
+3. Opcionalmente executar apenas `supabase --version`, `supabase --help` e
+   `supabase db --help` com timeout.
+4. Redigir qualquer segredo antes de retornar.

package/runtime/agents/supabase-project-analyst/capabilities/plan-supabase-fix/capability.yaml

@@ -0,0 +1,18 @@
+id: supabase-project-analyst.plan-supabase-fix
+kind: capability
+name: Plan Supabase Fix
+version: 0.1.0
+status: draft
+purpose: Gerar plano de correcao e SQL sugerido sem aplicar mudancas.
+entrypoint:
+  runner: runner.py
+  workflow: workflow.md
+  output_template: ../../templates/supabase-fix-plan.md
+inputs:
+  required: []
+  optional:
+    - project-path
+outputs:
+  artifacts:
+    - supabase-fix-plan.json
+write_policy: dry_run

package/runtime/agents/supabase-project-analyst/capabilities/plan-supabase-fix/decision-rules.md

@@ -0,0 +1,6 @@
+# Decision Rules
+
+- Nunca executar SQL.
+- Nunca criar migration automaticamente.
+- SQL sugerido precisa ser revisavel e separado por finding.
+- Mudancas reais exigem capability futura com `confirm`.

package/runtime/agents/supabase-project-analyst/capabilities/plan-supabase-fix/runner.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Runner for supabase-project-analyst/plan-supabase-fix."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+
+REPOSITORY_DIR = Path(__file__).resolve().parents[2] / "infra" / "integrations" / "supabase-project"
+sys.path.insert(0, str(REPOSITORY_DIR))
+
+from supabase_project_repository import SupabaseProjectError, SupabaseProjectRepository  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Plan Supabase fixes without applying SQL")
+    parser.add_argument("--project-path", default=".")
+    args = parser.parse_args()
+    try:
+        result = SupabaseProjectRepository().plan_supabase_fix(project_path=Path(args.project_path))
+    except SupabaseProjectError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/agents/supabase-project-analyst/capabilities/plan-supabase-fix/workflow.md

@@ -0,0 +1,6 @@
+# Workflow
+
+1. Executar auditorias locais em memoria.
+2. Gerar plano de correcao por finding.
+3. Incluir SQL sugerido apenas quando seguro.
+4. Marcar `apply_real: false`.

package/runtime/agents/supabase-project-analyst/capabilities/review-migrations/capability.yaml

@@ -0,0 +1,18 @@
+id: supabase-project-analyst.review-migrations
+kind: capability
+name: Review Migrations
+version: 0.1.0
+status: draft
+purpose: Revisar migrations Supabase locais sem aplicar SQL.
+entrypoint:
+  runner: runner.py
+  workflow: workflow.md
+  output_template: ../../templates/supabase-audit.md
+inputs:
+  required: []
+  optional:
+    - project-path
+outputs:
+  artifacts:
+    - supabase-migration-review.json
+write_policy: read_only

package/runtime/agents/supabase-project-analyst/capabilities/review-migrations/decision-rules.md

@@ -0,0 +1,6 @@
+# Decision Rules
+
+- DDL destrutivo deve ser high.
+- `SECURITY DEFINER` em schema exposto deve ser high/critical.
+- Views sem `security_invoker` devem ser reportadas.
+- Nao aplicar migration.

package/runtime/agents/supabase-project-analyst/capabilities/review-migrations/runner.py

@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+"""Runner for supabase-project-analyst/review-migrations."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+import sys
+
+
+REPOSITORY_DIR = Path(__file__).resolve().parents[2] / "infra" / "integrations" / "supabase-project"
+sys.path.insert(0, str(REPOSITORY_DIR))
+
+from supabase_project_repository import SupabaseProjectError, SupabaseProjectRepository  # noqa: E402
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Review Supabase migrations")
+    parser.add_argument("--project-path", default=".")
+    args = parser.parse_args()
+    try:
+        result = SupabaseProjectRepository().review_migrations(project_path=Path(args.project_path))
+    except SupabaseProjectError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())