agent-nuvira 1.79.2 → 1.82.0

package/.agents/skills/a11y-audit/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: a11y-audit
+description: Audit web applications for accessibility (WCAG 2.1 AA compliance): check color contrast, keyboard navigation, screen-reader compatibility, ARIA attributes, and semantic HTML. Use when the goal asks to audit, fix, or improve accessibility.
+version: 1.0.0
+---
+
+# a11y-audit
+
+Audit web applications for accessibility (WCAG 2.1 AA compliance): check color contrast, keyboard navigation, screen-reader compatibility, ARIA attributes, and semantic HTML. Use when the goal asks to audit, fix, or improve accessibility.
+
+## Goal pattern
+
+accessibility a11y wcag audit screen reader keyboard nav aria contrast wcag
+
+## Parameters
+
+- scope (choice [default: full]): Audit scope
+
+## Steps
+
+1. [analyst] Scan the codebase for accessibility issues: run automated tools (axe-core, pa11y, lighthouse) or inspect JSX for missing alt text, labels, ARIA roles, and semantic landmarks.
+
+2. [analyst] Categorize issues by severity: critical (blocks users), serious (hard to use), moderate (annoying), minor (cosmetic). Map to WCAG success criteria. (after: step-1)
+
+3. [analyst] Fix critical and serious issues: add missing alt text, labels, ARIA attributes, keyboard handlers, focus management, and color contrast adjustments. (after: step-2)
+
+4. [analyst] Test fixes: verify keyboard-only navigation, screen-reader output, and color contrast ratios. Re-run automated scanner. (after: step-3)
+
+5. [analyst] Write an accessibility report: WCAG 2.1 AA conformance status, remaining issues by severity, and an accessibility statement for the project. (after: step-4)

package/.agents/skills/api-call/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: api-call
+description: Make API calls with authentication, retry logic, and response parsing
+runtime: node
+required_environment_variables:
+  - API_BASE_URL
+tags:
+  - api
+  - http
+  - integration
+parameters:
+  - name: endpoint
+    description: API endpoint path (e.g., /users, /posts)
+    required: true
+    type: string
+  - name: method
+    description: HTTP method (GET, POST, PUT, DELETE)
+    required: false
+    type: string
+    default: GET
+  - name: data
+    description: JSON data for POST/PUT requests
+    required: false
+    type: string
+  - name: headers
+    description: Additional HTTP headers as JSON
+    required: false
+    type: string
+---
+
+# API Call Skill
+
+Make API calls with authentication, retry logic, and response parsing. This skill demonstrates the execution engine's ability to run Node.js scripts.
+
+## How It Works
+
+1. Receives endpoint, method, and optional data/headers
+2. Makes HTTP request to API_BASE_URL + endpoint
+3. Handles authentication via API_KEY environment variable
+4. Implements retry logic with exponential backoff
+5. Returns structured response
+
+## Usage
+
+When the user needs to make an API call, execute this skill with the endpoint and method.
+
+## Security
+
+- API keys are injected via environment variables
+- Base URL is configured via API_BASE_URL
+- Retry logic prevents excessive requests

package/.agents/skills/api-call/call.js

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+/**
+ * API Call Skill — Demonstrates Node.js skill execution.
+ * 
+ * This script is executed by the skill-executor.ts module when the agent
+ * calls: skill tool → execute: { skill: "api-call", args: { endpoint: "/users" } }
+ * 
+ * The executor:
+ * 1. Detects runtime: node (from shebang or frontmatter)
+ * 2. Parses required_environment_variables: [API_BASE_URL, API_KEY]
+ * 3. Injects API_BASE_URL and API_KEY from process.env (if registered)
+ * 4. Spawns: node /tmp/skill-exec/abc123/call.js
+ * 5. Captures stdout/stderr/exit code
+ */
+
+const https = require('https');
+const http = require('http');
+const url = require('url');
+
+// Parse command-line arguments
+function parseArgs(args) {
+  const parsed = {
+    endpoint: null,
+    method: 'GET',
+    data: null,
+    headers: {}
+  };
+
+  for (let i = 0; i < args.length; i++) {
+    switch (args[i]) {
+      case '--endpoint':
+      case '-e':
+        parsed.endpoint = args[++i];
+        break;
+      case '--method':
+      case '-m':
+        parsed.method = args[++i].toUpperCase();
+        break;
+      case '--data':
+      case '-d':
+        parsed.data = args[++i];
+        break;
+      case '--headers':
+      case '-H':
+        try {
+          parsed.headers = JSON.parse(args[++i]);
+        } catch (e) {
+          console.error(`Error: Invalid JSON for headers: ${args[i]}`, process.stderr);
+          process.exit(1);
+        }
+        break;
+    }
+  }
+
+  return parsed;
+}
+
+// Make HTTP request with retry logic
+async function makeRequest(options, retries = 3, delay = 1000) {
+  for (let attempt = 1; attempt <= retries; attempt++) {
+    try {
+      const response = await executeRequest(options);
+      return response;
+    } catch (error) {
+      if (attempt === retries) {
+        throw error;
+      }
+      
+      console.error(`Attempt ${attempt} failed: ${error.message}. Retrying in ${delay}ms...`);
+      await new Promise(resolve => setTimeout(resolve, delay));
+      delay *= 2; // Exponential backoff
+    }
+  }
+}
+
+function executeRequest(options) {
+  return new Promise((resolve, reject) => {
+    const parsedUrl = new url.URL(options.url);
+    const isHttps = parsedUrl.protocol === 'https:';
+    const client = isHttps ? https : http;
+
+    const reqOptions = {
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port || (isHttps ? 443 : 80),
+      path: parsedUrl.pathname + parsedUrl.search,
+      method: options.method,
+      headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+      }
+    };
+
+    const req = client.request(reqOptions, (res) => {
+      let data = '';
+      
+      res.on('data', (chunk) => {
+        data += chunk;
+      });
+      
+      res.on('end', () => {
+        try {
+          const jsonData = JSON.parse(data);
+          resolve({
+            status: res.statusCode,
+            headers: res.headers,
+            data: jsonData
+          });
+        } catch {
+          resolve({
+            status: res.statusCode,
+            headers: res.headers,
+            data: data
+          });
+        }
+      });
+    });
+
+    req.on('error', reject);
+    req.setTimeout(10000, () => {
+      req.destroy();
+      reject(new Error('Request timeout'));
+    });
+
+    if (options.body) {
+      req.write(options.body);
+    }
+
+    req.end();
+  });
+}
+
+// Main execution
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  
+  if (!args.endpoint) {
+    console.error('Error: --endpoint is required');
+    console.error('Usage: node call.js --endpoint /users --method GET');
+    process.exit(1);
+  }
+
+  const baseUrl = process.env.API_BASE_URL;
+  if (!baseUrl) {
+    console.error('Error: API_BASE_URL environment variable is not set');
+    console.error('Set it with: export API_BASE_URL=https://api.example.com');
+    process.exit(1);
+  }
+
+  const apiKey = process.env.API_KEY;
+  if (apiKey) {
+    args.headers['Authorization'] = `Bearer ${apiKey}`;
+  }
+
+  const fullUrl = baseUrl + args.endpoint;
+  console.log(`Making ${args.method} request to: ${fullUrl}`);
+  
+  if (args.data) {
+    console.log(`Request body: ${args.data}`);
+  }
+
+  try {
+    const response = await makeRequest({
+      url: fullUrl,
+      method: args.method,
+      body: args.data,
+      headers: args.headers
+    });
+
+    console.log(`\n✅ Request successful!`);
+    console.log(`📊 Status: ${response.status}`);
+    console.log(`\nResponse:`);
+    console.log(JSON.stringify(response.data, null, 2));
+    
+    // Return structured result
+    const result = {
+      success: true,
+      status: response.status,
+      data: response.data
+    };
+    console.log(`\n${JSON.stringify(result, null, 2)}`);
+  } catch (error) {
+    console.error(`\n❌ Request failed: ${error.message}`);
+    process.exit(1);
+  }
+}
+
+main();

package/.agents/skills/api-call/call.mjs

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+/**
+ * API Call Skill — Demonstrates Node.js skill execution.
+ * 
+ * This script is executed by the skill-executor.ts module when the agent
+ * calls: skill tool → execute: { skill: "api-call", args: { endpoint: "/users" } }
+ * 
+ * The executor:
+ * 1. Detects runtime: node (from shebang or frontmatter)
+ * 2. Parses required_environment_variables: [API_BASE_URL, API_KEY]
+ * 3. Injects API_BASE_URL and API_KEY from process.env (if registered)
+ * 4. Spawns: node /tmp/skill-exec/abc123/call.mjs
+ * 5. Captures stdout/stderr/exit code
+ */
+
+import https from 'https';
+import http from 'http';
+import { URL } from 'url';
+
+// Parse command-line arguments
+function parseArgs(args) {
+  const parsed = {
+    endpoint: null,
+    method: 'GET',
+    data: null,
+    headers: {}
+  };
+
+  for (let i = 0; i < args.length; i++) {
+    switch (args[i]) {
+      case '--endpoint':
+      case '-e':
+        parsed.endpoint = args[++i];
+        break;
+      case '--method':
+      case '-m':
+        parsed.method = args[++i].toUpperCase();
+        break;
+      case '--data':
+      case '-d':
+        parsed.data = args[++i];
+        break;
+      case '--headers':
+      case '-H':
+        try {
+          parsed.headers = JSON.parse(args[++i]);
+        } catch (e) {
+          console.error(`Error: Invalid JSON for headers: ${args[i]}`);
+          process.exit(1);
+        }
+        break;
+    }
+  }
+
+  return parsed;
+}
+
+// Make HTTP request with retry logic
+async function makeRequest(options, retries = 3, delay = 1000) {
+  for (let attempt = 1; attempt <= retries; attempt++) {
+    try {
+      const response = await executeRequest(options);
+      return response;
+    } catch (error) {
+      if (attempt === retries) {
+        throw error;
+      }
+      
+      console.error(`Attempt ${attempt} failed: ${error.message}. Retrying in ${delay}ms...`);
+      await new Promise(resolve => setTimeout(resolve, delay));
+      delay *= 2; // Exponential backoff
+    }
+  }
+}
+
+function executeRequest(options) {
+  return new Promise((resolve, reject) => {
+    const parsedUrl = new URL(options.url);
+    const isHttps = parsedUrl.protocol === 'https:';
+    const client = isHttps ? https : http;
+
+    const reqOptions = {
+      hostname: parsedUrl.hostname,
+      port: parsedUrl.port || (isHttps ? 443 : 80),
+      path: parsedUrl.pathname + parsedUrl.search,
+      method: options.method,
+      headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+      }
+    };
+
+    const req = client.request(reqOptions, (res) => {
+      let data = '';
+      
+      res.on('data', (chunk) => {
+        data += chunk;
+      });
+      
+      res.on('end', () => {
+        try {
+          const jsonData = JSON.parse(data);
+          resolve({
+            status: res.statusCode,
+            headers: res.headers,
+            data: jsonData
+          });
+        } catch {
+          resolve({
+            status: res.statusCode,
+            headers: res.headers,
+            data: data
+          });
+        }
+      });
+    });
+
+    req.on('error', reject);
+    req.setTimeout(10000, () => {
+      req.destroy();
+      reject(new Error('Request timeout'));
+    });
+
+    if (options.body) {
+      req.write(options.body);
+    }
+
+    req.end();
+  });
+}
+
+// Main execution
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  
+  if (!args.endpoint) {
+    console.error('Error: --endpoint is required');
+    console.error('Usage: node call.mjs --endpoint /users --method GET');
+    process.exit(1);
+  }
+
+  const baseUrl = process.env.API_BASE_URL;
+  if (!baseUrl) {
+    console.error('Error: API_BASE_URL environment variable is not set');
+    console.error('Set it with: export API_BASE_URL=https://api.example.com');
+    process.exit(1);
+  }
+
+  const apiKey = process.env.API_KEY;
+  if (apiKey) {
+    args.headers['Authorization'] = `Bearer ${apiKey}`;
+  }
+
+  const fullUrl = baseUrl + args.endpoint;
+  console.log(`Making ${args.method} request to: ${fullUrl}`);
+  
+  if (args.data) {
+    console.log(`Request body: ${args.data}`);
+  }
+
+  try {
+    const response = await makeRequest({
+      url: fullUrl,
+      method: args.method,
+      body: args.data,
+      headers: args.headers
+    });
+
+    console.log(`\n✅ Request successful!`);
+    console.log(`📊 Status: ${response.status}`);
+    console.log(`\nResponse:`);
+    console.log(JSON.stringify(response.data, null, 2));
+    
+    // Return structured result
+    const result = {
+      success: true,
+      status: response.status,
+      data: response.data
+    };
+    console.log(`\n${JSON.stringify(result, null, 2)}`);
+  } catch (error) {
+    console.error(`\n❌ Request failed: ${error.message}`);
+    process.exit(1);
+  }
+}
+
+main();

package/.agents/skills/api-design/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: api-design
+description: Design and implement a REST API: gather requirements, design endpoints with proper HTTP methods/status codes, produce an OpenAPI spec, implement routes, and write integration tests. Use when the goal asks to create an API, design endpoints, build a REST service, or scaffold an HTTP backend.
+version: 1.0.0
+---
+
+# api-design
+
+Design and implement a REST API: gather requirements, design endpoints with proper HTTP methods/status codes, produce an OpenAPI spec, implement routes, and write integration tests. Use when the goal asks to create an API, design endpoints, build a REST service, or scaffold an HTTP backend.
+
+## Goal pattern
+
+API design REST endpoint route HTTP backend server create implement OpenAPI swagger
+
+## Parameters
+
+- framework (choice [default: auto]): HTTP framework (auto-detected from package.json if not specified)
+- authType (choice [default: api-key]): Authentication method (default: API key)
+
+## Steps
+
+1. [context-gatherer] Gather requirements with evidence:
+- Read the project manifest (package.json / pyproject.toml) for the framework (Express, Fastify, Hono, Flask, FastAPI)
+- Read existing route files if any — note the patterns (file structure, middleware, error handling)
+- Identify the resources (nouns that become endpoints) and operations (CRUD + custom actions)
+- Note auth requirements (API keys, JWT, session), rate limiting needs, and pagination strategy
+Produce: a resource list, an operation-per-resource matrix, and the framework conventions to follow.
+
+2. [planner] Design the endpoint contract:
+- For each resource: list endpoints with HTTP method, path, request/response schema, status codes
+- Follow REST conventions: nouns for resources, proper HTTP verbs (GET=read, POST=create, PUT/PATCH=update, DELETE=remove)
+- Define error response shape (consistent across all endpoints)
+- Plan pagination (cursor-based or offset), filtering, and sorting
+- Decide auth middleware placement and error handler strategy
+Produce an endpoint matrix table. (after: step-0)
+
+3. [writer] Write the OpenAPI 3.0 spec (openapi.yaml or openapi.json):
+- paths: every endpoint with method, parameters, request body schema, response schemas (200/201/400/401/404/500)
+- components/schemas: reusable types for request/response bodies
+- security: define the auth scheme (Bearer token, API key, etc.)
+- Validate the spec: Run `npx swagger-cli validate openapi.yaml` (install if needed)
+The spec is the contract — implementation must match it exactly. (after: step-1)
+
+4. [runner] Implement the routes following the framework conventions and the OpenAPI spec:
+- Create route files (e.g. src/routes/users.ts, src/routes/orders.ts)
+- Apply middleware: auth, validation (request body against schema), error handling
+- Use the status codes from the spec (201 for create, 204 for delete, 400 for validation errors)
+- Wire routes into the app entry point
+Each route handler should validate input, call the service layer, and return the spec-defined response shape. (after: step-2)
+
+5. [tester] Write and run integration tests that verify the contract:
+- For each endpoint: test the happy path, error paths (400, 401, 404), and edge cases
+- Verify response shapes match the OpenAPI spec (status code + body structure)
+- Test auth: unauthenticated requests get 401, unauthorized access gets 403
+- Run the tests: Run `npm test` or equivalent
+The tests are the proof that implementation matches the spec. (after: step-3)

package/.agents/skills/api-testing/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: api-testing
+description: Test REST and GraphQL APIs: write automated tests for endpoints, validate status codes, response schemas, auth flows, and edge cases. Use when the goal asks to test, validate, or verify an API.
+version: 1.0.0
+---
+
+# api-testing
+
+Test REST and GraphQL APIs: write automated tests for endpoints, validate status codes, response schemas, auth flows, and edge cases. Use when the goal asks to test, validate, or verify an API.
+
+## Goal pattern
+
+test api endpoint rest graphql http request validate response status auth
+
+## Parameters
+
+- framework (choice [default: auto]): Test framework
+
+## Steps
+
+1. [analyst] Discover endpoints: parse OpenAPI/Swagger specs, route files, or scan source code for route definitions. List all endpoints with methods, paths, and expected parameters.
+
+2. [analyst] Group tests by endpoint: happy path, error cases (400, 401, 403, 404, 500), boundary values, and auth scenarios (unauthenticated, expired token, insufficient scope). (after: step-1)
+
+3. [analyst] Write test files using the project test framework (vitest, jest, pytest, go test). Include setup for test DB, mocks for external services, and fixtures for request bodies. (after: step-2)
+
+4. [analyst] Run tests and fix failures iteratively. Cover edge cases: empty bodies, invalid JSON, missing required fields, SQL-injection payloads in params. (after: step-3)
+
+5. [analyst] Generate coverage report: total endpoints tested, pass/fail counts, response-time assertions, and schema validation results. (after: step-4)

package/.agents/skills/api-versioning/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: api-versioning
+description: Implement API versioning: URL path, header, or content-type versioning with deprecation notices and migration guides. Use when the goal asks to version an API, handle breaking changes, or add deprecation notices.
+version: 1.0.0
+---
+
+# api-versioning
+
+Implement API versioning: URL path, header, or content-type versioning with deprecation notices and migration guides. Use when the goal asks to version an API, handle breaking changes, or add deprecation notices.
+
+## Goal pattern
+
+api version versioning deprecation breaking change migration url header
+
+## Parameters
+
+- strategy (choice [default: auto]): Versioning strategy
+
+## Steps
+
+1. [analyst] Choose versioning strategy: URL path (/v1/), header (API-Version), or content-type negotiation. Define version lifecycle.
+
+2. [analyst] Restructure routes: move existing endpoints under a version prefix. Set up version-aware middleware. (after: step-0)
+
+3. [analyst] Add deprecation support: implement Sunset header, deprecation warnings in responses, and version negotiation. (after: step-1)
+
+4. [analyst] Write migration guides: document breaking changes between versions, provide code examples for upgrades. (after: step-2)
+
+5. [analyst] Test version coexistence: verify v1 and v2 endpoints work simultaneously, check deprecation headers appear. (after: step-3)

package/.agents/skills/auth-setup/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: auth-setup
+description: Implement authentication and authorization: OAuth2 (Google, GitHub), magic links, JWT sessions, role-based access control. Use when the goal asks to add login, signup, auth, SSO, or RBAC to an app.
+version: 1.0.0
+---
+
+# auth-setup
+
+Implement authentication and authorization: OAuth2 (Google, GitHub), magic links, JWT sessions, role-based access control. Use when the goal asks to add login, signup, auth, SSO, or RBAC to an app.
+
+## Goal pattern
+
+auth login signup oauth sso jwt session rbac role access control authentication authorization magic link google github
+
+## Parameters
+
+- strategy (choice [default: auto]): Auth strategy
+
+## Steps
+
+1. [analyst] Choose auth strategy: OAuth2 providers, magic links, social login, or self-hosted. Install the auth library (NextAuth, Lucia, Passport, etc.).
+
+2. [analyst] Configure providers: register OAuth apps with Google/GitHub/etc., set callback URLs, configure scopes, and store credentials securely. (after: step-1)
+
+3. [analyst] Implement user flows: signup, login, logout, password reset, email verification. Handle session creation and JWT token refresh. (after: step-2)
+
+4. [analyst] Add RBAC: define roles (admin, editor, viewer), protect routes with middleware, and handle permission checks in the UI. (after: step-3)
+
+5. [analyst] Test and harden: verify CSRF protection, rate-limit login attempts, test role escalation scenarios, and audit token expiration. (after: step-4)

package/.agents/skills/backup-recovery/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: backup-recovery
+description: Design and implement backup and disaster recovery: automated database backups, point-in-time recovery, S3 snapshots, and runbook documentation. Use when the goal asks to set up backups, recovery, or disaster resilience.
+version: 1.0.0
+---
+
+# backup-recovery
+
+Design and implement backup and disaster recovery: automated database backups, point-in-time recovery, S3 snapshots, and runbook documentation. Use when the goal asks to set up backups, recovery, or disaster resilience.
+
+## Goal pattern
+
+backup recovery disaster recovery database backup restore snapshots runbook resilience
+
+## Parameters
+
+- scope (choice [default: full-stack]): Backup scope
+
+## Steps
+
+1. [analyst] Audit current state: identify all data stores (DB, file storage, cache), their backup capabilities, and current RPO/RTO targets.
+
+2. [analyst] Design backup strategy: define frequency (continuous, hourly, daily), retention policy, storage location (S3, GCS, separate region), and encryption. (after: step-1)
+
+3. [analyst] Implement automated backups: write cron jobs or scheduled tasks for database dumps, file snapshots, and configuration backups. Verify checksums. (after: step-2)
+
+4. [analyst] Test recovery: perform a full restore to an isolated environment, verify data integrity, measure recovery time. (after: step-3)
+
+5. [analyst] Write a disaster recovery runbook: step-by-step recovery procedures, contact list, escalation path, and post-mortem template. (after: step-4)

package/.agents/skills/backup-strategy/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: backup-strategy
+description: Design and implement backup strategies. Use when the goal asks to set up backups, disaster recovery, or data protection.
+version: 1.0.0
+---
+
+# backup-strategy
+
+Design and implement backup strategies. Use when the goal asks to set up backups, disaster recovery, or data protection.
+
+## Goal pattern
+
+backup disaster recovery retention snapshot restore data protection
+
+## Parameters
+
+- strategy (choice [default: incremental]): Backup strategy
+
+## Steps
+
+1. [analyst] Define RPO (Recovery Point Objective) and RTO (Recovery Time Objective). Identify critical data.
+
+2. [analyst] Implement backup strategy: full, incremental, differential. Choose storage (S3, GCS, tape). (after: step-0)
+
+3. [analyst] Add encryption, compression, and versioning. Implement retention policies. (after: step-1)
+
+4. [analyst] Test restore procedures regularly. Document runbooks and verify backups. (after: step-2)

package/.agents/skills/blob-storage/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: blob-storage
+description: Set up blob/file storage: S3, Cloudflare R2, or Azure Blob for uploads, assets, and backups. Use when the goal asks to add file uploads, cloud storage, or asset hosting.
+version: 1.0.0
+---
+
+# blob-storage
+
+Set up blob/file storage: S3, Cloudflare R2, or Azure Blob for uploads, assets, and backups. Use when the goal asks to add file uploads, cloud storage, or asset hosting.
+
+## Goal pattern
+
+blob storage s3 cloudflare r2 azure upload file asset hosting bucket
+
+## Parameters
+
+- provider (choice [default: auto]): Storage provider
+
+## Steps
+
+1. [analyst] Choose the storage provider: S3, R2, Azure Blob, or MinIO. Set up the bucket/container with appropriate permissions.
+
+2. [analyst] Implement upload: create presigned URLs for client-side upload, or server-side upload with streaming. (after: step-0)
+
+3. [analyst] Add access control: implement signed URLs for read, bucket policies for public assets, and ACL for private files. (after: step-1)
+
+4. [analyst] Handle processing: add image resizing on upload, virus scanning, and metadata extraction. (after: step-2)
+
+5. [analyst] Test and optimize: verify uploads work, test file serving, add CDN caching, and monitor storage costs. (after: step-3)