anchi-kit 1.2.0 → 1.2.2

package/.cursor/compliance/gdpr-checklist.yaml

@@ -0,0 +1,73 @@
+# ============================================
+# GDPR Checklist & Procedures
+# ============================================
+# AI guidance for handling personal data
+
+# ============================================
+# 1. Data Collection
+# ============================================
+data_collection:
+  rules:
+    - rule: "Minimize data collection"
+      check: "Is this data absolutely necessary for the feature?"
+      action: "Warn if collecting unrestricted PII"
+
+    - rule: "Explicit Consent"
+      check: "Is there a consent form/checkbox for this data?"
+      action: "Check for UI elements receiving this data"
+
+  pii_categories:
+    - name: "Direct Identifiers"
+      fields: [email, phone, ssn, passport, device_id]
+      risk: "HIGH"
+      requirement: "Encryption + Strict Access"
+
+    - name: "Indirect Identifiers"
+      fields: [dob, gender, zip_code, ip_address]
+      risk: "MEDIUM"
+      requirement: "Anonymization where possible"
+
+# ============================================
+# 2. Right to be Forgotten (Deletion)
+# ============================================
+deletion_procedures:
+  requirements:
+    - "Must delete from Primary Database"
+    - "Must delete from Backups (or invalidate)"
+    - "Must delete from Logs (or redact)"
+    - "Must notify 3rd party processors (Stripe, Analytics)"
+
+  ai_check:
+    - command: "delete_user"
+    - verify: "Cascading deletes implemented?"
+    - verify: "Soft delete vs Hard delete policy?"
+
+# ============================================
+# 3. Data Portability (Export)
+# ============================================
+export_procedures:
+  requirements:
+    - "Format must be machine-readable (JSON/CSV)"
+    - "Must include all user-provided data"
+    - "Must NOT include internal system metadata (hashes, internal scores)"
+
+# ============================================
+# 4. Data Processing Agreement (DPA)
+# ============================================
+third_party_checks:
+  checklist:
+    - "Is DPA signed with vendor?"
+    - "Is vendor GDPR compliant?"
+    - "Is data crossing EU borders?"
+
+# ============================================
+# AI Enforcement
+# ============================================
+ai_enforcement:
+  on_schema_change:
+    - "Check if new PII fields added"
+    - "Suggest encryption for PII"
+
+  on_api_create:
+    - "Check if PII returned in response"
+    - "Suggest strict CORS & Auth"

package/.cursor/data-classification.yaml

@@ -0,0 +1,138 @@
+# ============================================
+# Data Classification - Internal Security
+# ============================================
+# Định nghĩa mức độ nhạy cảm của dữ liệu
+# AI sẽ tự động nhận diện và áp dụng quy tắc phù hợp
+
+classification_levels:
+  # 🔴 CONFIDENTIAL - Tuyệt mật
+  confidential:
+    description: "Dữ liệu tuyệt mật, không được chia sẻ ra ngoài"
+    patterns:
+      - "**/secrets/**"
+      - "**/credentials/**"
+      - "**/.env"
+      - "**/.env.*"
+      - "!**/.env.example"
+      - "**/private-keys/**"
+      - "**/certificates/**"
+      - "**/prisma/migrations/**"
+      - "**/database/seeds/**"
+    
+    rules:
+      no_export: true           # Không export nội dung đầy đủ
+      no_paste_external: true   # Không paste ra AI bên ngoài
+      no_screenshot: true       # Cảnh báo khi xuất hiện trong terminal
+      redact_in_logs: true      # Tự động mask trong logs
+      require_approval: true    # Yêu cầu xác nhận trước khi thao tác
+
+  # 🟠 INTERNAL - Nội bộ
+  internal:
+    description: "Dữ liệu nội bộ, chỉ chia sẻ trong team"
+    patterns:
+      - "src/domain/**"
+      - "src/core/**"
+      - "src/services/**"
+      - "**/internal/**"
+      - "**/private/**"
+      - "docs/internal/**"
+      - "docs/architecture/**"
+      - "**/api/internal/**"
+    
+    rules:
+      warn_before_share: true   # Cảnh báo trước khi share
+      summarize_only: true      # Chỉ tóm tắt, không quote đầy đủ
+      no_full_export: true      # Không export toàn bộ file
+
+  # 🟡 RESTRICTED - Hạn chế
+  restricted:
+    description: "Dữ liệu hạn chế, cần cẩn thận khi chia sẻ"
+    patterns:
+      - "src/**"
+      - "lib/**"
+      - "packages/**"
+      - "apps/**"
+      - "config/**"
+    
+    rules:
+      check_before_export: true # Kiểm tra trước khi export
+
+  # 🟢 PUBLIC - Công khai
+  public:
+    description: "Dữ liệu có thể chia sẻ công khai"
+    patterns:
+      - "README.md"
+      - "CHANGELOG.md"
+      - "LICENSE"
+      - "docs/public/**"
+      - "examples/**"
+      - ".github/workflows/**"
+    
+    rules:
+      allow_share: true
+
+# ============================================
+# Sensitive Content Patterns
+# ============================================
+# AI tự động redact các patterns này
+
+sensitive_patterns:
+  # API Keys & Tokens
+  api_keys:
+    - "sk-[a-zA-Z0-9]{20,}"           # OpenAI
+    - "AIza[a-zA-Z0-9_-]{35}"          # Google
+    - "ghp_[a-zA-Z0-9]{36}"            # GitHub PAT
+    - "sk-ant-[a-zA-Z0-9_-]+"          # Anthropic
+    - "xox[baprs]-[a-zA-Z0-9-]+"       # Slack
+    - "AKIA[A-Z0-9]{16}"               # AWS
+  
+  # URLs & Endpoints
+  internal_urls:
+    - "*://localhost:*"
+    - "*://127.0.0.1:*"
+    - "*://*.internal.*"
+    - "*://*.local:*"
+    - "*://staging.*"
+    - "*://dev.*"
+  
+  # Credentials
+  credentials:
+    - "password\\s*[=:]\\s*['\"][^'\"]+['\"]"
+    - "secret\\s*[=:]\\s*['\"][^'\"]+['\"]"
+    - "api[_-]?key\\s*[=:]\\s*['\"][^'\"]+['\"]"
+
+# ============================================
+# Redaction Rules
+# ============================================
+# Khi xuất logs/docs/demo, tự động thay thế
+
+redaction:
+  enabled: true
+  replacement: "[REDACTED]"
+  
+  auto_redact:
+    - api_keys
+    - internal_urls
+    - credentials
+    - email_addresses
+    - ip_addresses
+    - jwt_tokens
+
+# ============================================
+# Warning Triggers
+# ============================================
+# Khi nào AI cần cảnh báo người dùng
+
+warnings:
+  # Trigger khi tạo file trong các thư mục này
+  on_file_create:
+    - "/docs/**"
+    - "/demo/**"
+    - "/examples/**"
+    - "/public/**"
+    message: "⚠️ Đang tạo file có thể public. Kiểm tra không chứa thông tin nhạy cảm."
+  
+  # Trigger khi export/copy code
+  on_code_export:
+    from_classified: ["confidential", "internal"]
+    message: "⚠️ Code này thuộc phân loại nội bộ. Xác nhận trước khi chia sẻ."

package/.cursor/deploy-guard.yaml

@@ -0,0 +1,135 @@
+# ============================================
+# Deploy Guard - Silent Protection
+# ============================================
+# AI tự động kiểm tra và cảnh báo khi deploy
+
+# ============================================
+# Allowed Deploy Targets
+# ============================================
+allowed_platforms:
+  # Chỉ cho phép deploy qua org/team accounts
+  vercel:
+    type: "org_only"
+    # org_name sẽ được config khi setup
+
+  aws:
+    type: "org_only"
+    # account_id sẽ được config khi setup
+
+  railway:
+    type: "team_only"
+
+  render:
+    type: "team_only"
+
+  fly_io:
+    type: "org_only"
+
+# ============================================
+# Blocked Actions
+# ============================================
+blocked:
+  # Ngăn chặn deploy qua account cá nhân
+  personal_accounts: true
+
+  # Ngăn chặn tunnel localhost ra internet
+  localhost_tunnels:
+    - ngrok
+    - localtunnel
+    - cloudflare_tunnel
+    - expose
+
+  # Ngăn chặn public share localhost
+  public_share:
+    - "*share*my*localhost*"
+    - "*expose*local*"
+
+# ============================================
+# Environment Guards
+# ============================================
+env_guards:
+  # Cảnh báo khi dùng staging config cho production
+  staging_production_mismatch:
+    enabled: true
+    check:
+      - "NODE_ENV mismatch"
+      - "DATABASE_URL contains staging/dev"
+      - "API endpoints contain staging"
+
+  # Kiểm tra .env không bị build vào frontend
+  env_in_frontend:
+    enabled: true
+    patterns:
+      - "NEXT_PUBLIC_* should not contain secrets"
+      - "VITE_* should not contain secrets"
+      - "REACT_APP_* should not contain secrets"
+
+  # Cảnh báo hardcoded secrets trong build
+  hardcoded_secrets:
+    enabled: true
+    scan_before_deploy: true
+
+# ============================================
+# Deploy Checklist (AI tự động verify)
+# ============================================
+pre_deploy_checks:
+  - name: "No secrets in code"
+    command: "scan_secrets"
+    block_on_fail: true
+
+  - name: "Environment variables set"
+    check: "required_env_vars"
+    block_on_fail: true
+
+  - name: "Not using localhost URLs"
+    pattern: "localhost|127.0.0.1"
+    exclude: "*.test.*|*.spec.*"
+    block_on_fail: false
+    warn: true
+
+  - name: "Database not pointing to local"
+    check: "DATABASE_URL != localhost"
+    block_on_fail: true
+
+# ============================================
+# Logging Redaction
+# ============================================
+log_redaction:
+  enabled: true
+
+  # Tự động redact trong console.log, logger.*
+  auto_redact_patterns:
+    - token
+    - secret
+    - password
+    - api_key
+    - authorization
+    - bearer
+
+  # Redact URLs nội bộ
+  redact_internal_urls: true
+
+  # Redact stack traces nhạy cảm
+  redact_stacktraces:
+    hide_paths: true
+    hide_line_numbers: false
+
+# ============================================
+# Demo/Docs Guard
+# ============================================
+demo_guard:
+  enabled: true
+
+  # Khi tạo docs/demo, kiểm tra không chứa
+  forbidden_content:
+    - real_api_keys
+    - real_database_urls
+    - internal_endpoints
+    - customer_data
+    - schema_with_real_data
+
+  # Suggest mock data thay thế
+  suggest_mocks: true
+
+  # Auto-redact khi phát hiện
+  auto_redact: true

package/.cursor/skills/advanced-coding/skill.md

@@ -0,0 +1,34 @@
+---
+name: advanced-coding
+description: Activate when users ask about agentic coding workflows, slash commands (/cook, /plan, /fix, /test, /docs, /design, /git), creating/managing Agent Skills, or advanced features.
+---
+
+# Advanced Coding Assistant
+
+Anchi's advanced agentic coding tool combining autonomous planning, execution, and validation with extensibility through skills, plugins, and hooks.
+
+## Core Concepts
+
+**Subagents**: Specialized agents (planner, code-reviewer, tester, debugger, docs-manager, ui-ux-designer, database-admin)
+
+**Agent Skills**: Modular capabilities with SKILL.md + bundled resources (scripts, references, assets) loaded progressively
+
+**Slash Commands**: User-defined operations in `.cursor/commands/` expanding to prompts
+
+**Hooks**: Event-driven shell commands (SessionStart, PreToolUse, PostToolUse, Stop, SubagentStop)
+
+## Reference Guide
+
+Load references as needed for specific topics:
+
+| Topic | Reference File | Contents |
+|-------|----------------|----------|
+| Installation & setup | `references/getting-started.md` | Prerequisites, installation methods, authentication |
+
+## Instructions
+
+When answering questions:
+
+1. Identify topic from user query
+2. Load relevant reference files (use table above)
+3. Provide specific guidance with examples

package/.cursor/skills/template-skill/SKILL.md

@@ -0,0 +1,6 @@
+---
+name: template-skill
+description: Replace with description of the skill and when Claude should use it.
+---
+
+# Insert instructions below