codehava-agent-kit 1.0.1 → 2.0.0

package/templates/.agent/skills/codebase-cleanup-tech-debt/SKILL.md

@@ -0,0 +1,389 @@
+---
+name: codebase-cleanup-tech-debt
+description: "You are a technical debt expert specializing in identifying, quantifying, and prioritizing technical debt in software projects. Analyze the codebase to uncover debt, assess its impact, and create acti"
+risk: unknown
+source: community
+date_added: "2026-02-27"
+---
+
+# Technical Debt Analysis and Remediation
+
+You are a technical debt expert specializing in identifying, quantifying, and prioritizing technical debt in software projects. Analyze the codebase to uncover debt, assess its impact, and create actionable remediation plans.
+
+## Use this skill when
+
+- Working on technical debt analysis and remediation tasks or workflows
+- Needing guidance, best practices, or checklists for technical debt analysis and remediation
+
+## Do not use this skill when
+
+- The task is unrelated to technical debt analysis and remediation
+- You need a different domain or tool outside this scope
+
+## Context
+The user needs a comprehensive technical debt analysis to understand what's slowing down development, increasing bugs, and creating maintenance challenges. Focus on practical, measurable improvements with clear ROI.
+
+## Requirements
+$ARGUMENTS
+
+## Instructions
+
+### 1. Technical Debt Inventory
+
+Conduct a thorough scan for all types of technical debt:
+
+**Code Debt**
+- **Duplicated Code**
+  - Exact duplicates (copy-paste)
+  - Similar logic patterns
+  - Repeated business rules
+  - Quantify: Lines duplicated, locations
+  
+- **Complex Code**
+  - High cyclomatic complexity (>10)
+  - Deeply nested conditionals (>3 levels)
+  - Long methods (>50 lines)
+  - God classes (>500 lines, >20 methods)
+  - Quantify: Complexity scores, hotspots
+
+- **Poor Structure**
+  - Circular dependencies
+  - Inappropriate intimacy between classes
+  - Feature envy (methods using other class data)
+  - Shotgun surgery patterns
+  - Quantify: Coupling metrics, change frequency
+
+**Architecture Debt**
+- **Design Flaws**
+  - Missing abstractions
+  - Leaky abstractions
+  - Violated architectural boundaries
+  - Monolithic components
+  - Quantify: Component size, dependency violations
+
+- **Technology Debt**
+  - Outdated frameworks/libraries
+  - Deprecated API usage
+  - Legacy patterns (e.g., callbacks vs promises)
+  - Unsupported dependencies
+  - Quantify: Version lag, security vulnerabilities
+
+**Testing Debt**
+- **Coverage Gaps**
+  - Untested code paths
+  - Missing edge cases
+  - No integration tests
+  - Lack of performance tests
+  - Quantify: Coverage %, critical paths untested
+
+- **Test Quality**
+  - Brittle tests (environment-dependent)
+  - Slow test suites
+  - Flaky tests
+  - No test documentation
+  - Quantify: Test runtime, failure rate
+
+**Documentation Debt**
+- **Missing Documentation**
+  - No API documentation
+  - Undocumented complex logic
+  - Missing architecture diagrams
+  - No onboarding guides
+  - Quantify: Undocumented public APIs
+
+**Infrastructure Debt**
+- **Deployment Issues**
+  - Manual deployment steps
+  - No rollback procedures
+  - Missing monitoring
+  - No performance baselines
+  - Quantify: Deployment time, failure rate
+
+### 2. Impact Assessment
+
+Calculate the real cost of each debt item:
+
+**Development Velocity Impact**
+```
+Debt Item: Duplicate user validation logic
+Locations: 5 files
+Time Impact: 
+- 2 hours per bug fix (must fix in 5 places)
+- 4 hours per feature change
+- Monthly impact: ~20 hours
+Annual Cost: 240 hours × $150/hour = $36,000
+```
+
+**Quality Impact**
+```
+Debt Item: No integration tests for payment flow
+Bug Rate: 3 production bugs/month
+Average Bug Cost:
+- Investigation: 4 hours
+- Fix: 2 hours  
+- Testing: 2 hours
+- Deployment: 1 hour
+Monthly Cost: 3 bugs × 9 hours × $150 = $4,050
+Annual Cost: $48,600
+```
+
+**Risk Assessment**
+- **Critical**: Security vulnerabilities, data loss risk
+- **High**: Performance degradation, frequent outages
+- **Medium**: Developer frustration, slow feature delivery
+- **Low**: Code style issues, minor inefficiencies
+
+### 3. Debt Metrics Dashboard
+
+Create measurable KPIs:
+
+**Code Quality Metrics**
+```yaml
+Metrics:
+  cyclomatic_complexity:
+    current: 15.2
+    target: 10.0
+    files_above_threshold: 45
+    
+  code_duplication:
+    percentage: 23%
+    target: 5%
+    duplication_hotspots:
+      - src/validation: 850 lines
+      - src/api/handlers: 620 lines
+      
+  test_coverage:
+    unit: 45%
+    integration: 12%
+    e2e: 5%
+    target: 80% / 60% / 30%
+    
+  dependency_health:
+    outdated_major: 12
+    outdated_minor: 34
+    security_vulnerabilities: 7
+    deprecated_apis: 15
+```
+
+**Trend Analysis**
+```python
+debt_trends = {
+    "2024_Q1": {"score": 750, "items": 125},
+    "2024_Q2": {"score": 820, "items": 142},
+    "2024_Q3": {"score": 890, "items": 156},
+    "growth_rate": "18% quarterly",
+    "projection": "1200 by 2025_Q1 without intervention"
+}
+```
+
+### 4. Prioritized Remediation Plan
+
+Create an actionable roadmap based on ROI:
+
+**Quick Wins (High Value, Low Effort)**
+Week 1-2:
+```
+1. Extract duplicate validation logic to shared module
+   Effort: 8 hours
+   Savings: 20 hours/month
+   ROI: 250% in first month
+
+2. Add error monitoring to payment service
+   Effort: 4 hours
+   Savings: 15 hours/month debugging
+   ROI: 375% in first month
+
+3. Automate deployment script
+   Effort: 12 hours
+   Savings: 2 hours/deployment × 20 deploys/month
+   ROI: 333% in first month
+```
+
+**Medium-Term Improvements (Month 1-3)**
+```
+1. Refactor OrderService (God class)
+   - Split into 4 focused services
+   - Add comprehensive tests
+   - Create clear interfaces
+   Effort: 60 hours
+   Savings: 30 hours/month maintenance
+   ROI: Positive after 2 months
+
+2. Upgrade React 16 → 18
+   - Update component patterns
+   - Migrate to hooks
+   - Fix breaking changes
+   Effort: 80 hours  
+   Benefits: Performance +30%, Better DX
+   ROI: Positive after 3 months
+```
+
+**Long-Term Initiatives (Quarter 2-4)**
+```
+1. Implement Domain-Driven Design
+   - Define bounded contexts
+   - Create domain models
+   - Establish clear boundaries
+   Effort: 200 hours
+   Benefits: 50% reduction in coupling
+   ROI: Positive after 6 months
+
+2. Comprehensive Test Suite
+   - Unit: 80% coverage
+   - Integration: 60% coverage
+   - E2E: Critical paths
+   Effort: 300 hours
+   Benefits: 70% reduction in bugs
+   ROI: Positive after 4 months
+```
+
+### 5. Implementation Strategy
+
+**Incremental Refactoring**
+```python
+# Phase 1: Add facade over legacy code
+class PaymentFacade:
+    def __init__(self):
+        self.legacy_processor = LegacyPaymentProcessor()
+    
+    def process_payment(self, order):
+        # New clean interface
+        return self.legacy_processor.doPayment(order.to_legacy())
+
+# Phase 2: Implement new service alongside
+class PaymentService:
+    def process_payment(self, order):
+        # Clean implementation
+        pass
+
+# Phase 3: Gradual migration
+class PaymentFacade:
+    def __init__(self):
+        self.new_service = PaymentService()
+        self.legacy = LegacyPaymentProcessor()
+        
+    def process_payment(self, order):
+        if feature_flag("use_new_payment"):
+            return self.new_service.process_payment(order)
+        return self.legacy.doPayment(order.to_legacy())
+```
+
+**Team Allocation**
+```yaml
+Debt_Reduction_Team:
+  dedicated_time: "20% sprint capacity"
+  
+  roles:
+    - tech_lead: "Architecture decisions"
+    - senior_dev: "Complex refactoring"  
+    - dev: "Testing and documentation"
+    
+  sprint_goals:
+    - sprint_1: "Quick wins completed"
+    - sprint_2: "God class refactoring started"
+    - sprint_3: "Test coverage >60%"
+```
+
+### 6. Prevention Strategy
+
+Implement gates to prevent new debt:
+
+**Automated Quality Gates**
+```yaml
+pre_commit_hooks:
+  - complexity_check: "max 10"
+  - duplication_check: "max 5%"
+  - test_coverage: "min 80% for new code"
+  
+ci_pipeline:
+  - dependency_audit: "no high vulnerabilities"
+  - performance_test: "no regression >10%"
+  - architecture_check: "no new violations"
+  
+code_review:
+  - requires_two_approvals: true
+  - must_include_tests: true
+  - documentation_required: true
+```
+
+**Debt Budget**
+```python
+debt_budget = {
+    "allowed_monthly_increase": "2%",
+    "mandatory_reduction": "5% per quarter",
+    "tracking": {
+        "complexity": "sonarqube",
+        "dependencies": "dependabot",
+        "coverage": "codecov"
+    }
+}
+```
+
+### 7. Communication Plan
+
+**Stakeholder Reports**
+```markdown
+## Executive Summary
+- Current debt score: 890 (High)
+- Monthly velocity loss: 35%
+- Bug rate increase: 45%
+- Recommended investment: 500 hours
+- Expected ROI: 280% over 12 months
+
+## Key Risks
+1. Payment system: 3 critical vulnerabilities
+2. Data layer: No backup strategy
+3. API: Rate limiting not implemented
+
+## Proposed Actions
+1. Immediate: Security patches (this week)
+2. Short-term: Core refactoring (1 month)
+3. Long-term: Architecture modernization (6 months)
+```
+
+**Developer Documentation**
+```markdown
+## Refactoring Guide
+1. Always maintain backward compatibility
+2. Write tests before refactoring
+3. Use feature flags for gradual rollout
+4. Document architectural decisions
+5. Measure impact with metrics
+
+## Code Standards
+- Complexity limit: 10
+- Method length: 20 lines
+- Class length: 200 lines
+- Test coverage: 80%
+- Documentation: All public APIs
+```
+
+### 8. Success Metrics
+
+Track progress with clear KPIs:
+
+**Monthly Metrics**
+- Debt score reduction: Target -5%
+- New bug rate: Target -20%
+- Deployment frequency: Target +50%
+- Lead time: Target -30%
+- Test coverage: Target +10%
+
+**Quarterly Reviews**
+- Architecture health score
+- Developer satisfaction survey
+- Performance benchmarks
+- Security audit results
+- Cost savings achieved
+
+## Output Format
+
+1. **Debt Inventory**: Comprehensive list categorized by type with metrics
+2. **Impact Analysis**: Cost calculations and risk assessments
+3. **Prioritized Roadmap**: Quarter-by-quarter plan with clear deliverables
+4. **Quick Wins**: Immediate actions for this sprint
+5. **Implementation Guide**: Step-by-step refactoring strategies
+6. **Prevention Plan**: Processes to avoid accumulating new debt
+7. **ROI Projections**: Expected returns on debt reduction investment
+
+Focus on delivering measurable improvements that directly impact development velocity, system reliability, and team morale.

package/templates/.agent/skills/computer-use-agents/SKILL.md

@@ -0,0 +1,320 @@
+---
+name: computer-use-agents
+description: "The fundamental architecture of computer use agents: observe screen, reason about next action, execute action, repeat. This loop integrates vision models with action execution through an iterative pipeline."
+risk: unknown
+source: "vibeship-spawner-skills (Apache 2.0)"
+date_added: "2026-02-27"
+---
+
+# Computer Use Agents
+
+## Patterns
+
+### Perception-Reasoning-Action Loop
+
+The fundamental architecture of computer use agents: observe screen,
+reason about next action, execute action, repeat. This loop integrates
+vision models with action execution through an iterative pipeline.
+
+Key components:
+1. PERCEPTION: Screenshot captures current screen state
+2. REASONING: Vision-language model analyzes and plans
+3. ACTION: Execute mouse/keyboard operations
+4. FEEDBACK: Observe result, continue or correct
+
+Critical insight: Vision agents are completely still during "thinking"
+phase (1-5 seconds), creating a detectable pause pattern.
+
+
+**When to use**: ['Building any computer use agent from scratch', 'Integrating vision models with desktop control', 'Understanding agent behavior patterns']
+
+```python
+from anthropic import Anthropic
+from PIL import Image
+import base64
+import pyautogui
+import time
+
+class ComputerUseAgent:
+    """
+    Perception-Reasoning-Action loop implementation.
+    Based on Anthropic Computer Use patterns.
+    """
+
+    def __init__(self, client: Anthropic, model: str = "claude-sonnet-4-20250514"):
+        self.client = client
+        self.model = model
+        self.max_steps = 50  # Prevent runaway loops
+        self.action_delay = 0.5  # Seconds between actions
+
+    def capture_screenshot(self) -> str:
+        """Capture screen and return base64 encoded image."""
+        screenshot = pyautogui.screenshot()
+        # Resize for token efficiency (1280x800 is good balance)
+        screenshot = screenshot.resize((1280, 800), Image.LANCZOS)
+
+        import io
+        buffer = io.BytesIO()
+        screenshot.save(buffer, format="PNG")
+        return base64.b64encode(buffer.getvalue()).decode()
+
+    def execute_action(self, action: dict) -> dict:
+        """Execute mouse/keyboard action on the computer."""
+        action_type = action.get("type")
+
+        if action_type == "click":
+            x, y = action["x"], action["y"]
+            button = action.get("button", "left")
+            pyautogui.click(x, y, button=button)
+            return {"success": True, "action": f"clicked at ({x}, {y})"}
+
+        elif action_type == "type":
+            text = action["text"]
+            pyautogui.typewrite(text, interval=0.02)
+            return {"success": True, "action": f"typed {len(text)} chars"}
+
+        elif action_type == "key":
+            key = action["key"]
+            pyautogui.press(key)
+            return {"success": True, "action": f"pressed {key}"}
+
+        elif action_type == "scroll":
+            direction = action.get("direction", "down")
+            amount = action.get("amount", 3)
+            scroll = -amount if direction == "down" else amount
+            pyautogui.scroll(scroll)
+            return {"success": True, "action": f"scrolled {dir
+```
+
+### Sandboxed Environment Pattern
+
+Computer use agents MUST run in isolated, sandboxed environments.
+Never give agents direct access to your main system - the security
+risks are too high. Use Docker containers with virtual desktops.
+
+Key isolation requirements:
+1. NETWORK: Restrict to necessary endpoints only
+2. FILESYSTEM: Read-only or scoped to temp directories
+3. CREDENTIALS: No access to host credentials
+4. SYSCALLS: Filter dangerous system calls
+5. RESOURCES: Limit CPU, memory, time
+
+The goal is "blast radius minimization" - if the agent goes wrong,
+damage is contained to the sandbox.
+
+
+**When to use**: ['Deploying any computer use agent', 'Testing agent behavior safely', 'Running untrusted automation tasks']
+
+```python
+# Dockerfile for sandboxed computer use environment
+# Based on Anthropic's reference implementation pattern
+
+FROM ubuntu:22.04
+
+# Install desktop environment
+RUN apt-get update && apt-get install -y \
+    xvfb \
+    x11vnc \
+    fluxbox \
+    xterm \
+    firefox \
+    python3 \
+    python3-pip \
+    supervisor
+
+# Security: Create non-root user
+RUN useradd -m -s /bin/bash agent && \
+    mkdir -p /home/agent/.vnc
+
+# Install Python dependencies
+COPY requirements.txt /tmp/
+RUN pip3 install -r /tmp/requirements.txt
+
+# Security: Drop capabilities
+RUN apt-get install -y --no-install-recommends libcap2-bin && \
+    setcap -r /usr/bin/python3 || true
+
+# Copy agent code
+COPY --chown=agent:agent . /app
+WORKDIR /app
+
+# Supervisor config for virtual display + VNC
+COPY supervisord.conf /etc/supervisor/conf.d/
+
+# Expose VNC port only (not desktop directly)
+EXPOSE 5900
+
+# Run as non-root
+USER agent
+
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]
+
+---
+
+# docker-compose.yml with security constraints
+version: '3.8'
+
+services:
+  computer-use-agent:
+    build: .
+    ports:
+      - "5900:5900"  # VNC for observation
+      - "8080:8080"  # API for control
+
+    # Security constraints
+    security_opt:
+      - no-new-privileges:true
+      - seccomp:seccomp-profile.json
+
+    # Resource limits
+    deploy:
+      resources:
+        limits:
+          cpus: '2'
+          memory: 4G
+        reservations:
+          cpus: '0.5'
+          memory: 1G
+
+    # Network isolation
+    networks:
+      - agent-network
+
+    # No access to host filesystem
+    volumes:
+      - agent-tmp:/tmp
+
+    # Read-only root filesystem
+    read_only: true
+    tmpfs:
+      - /run
+      - /var/run
+
+    # Environment
+    environment:
+      - DISPLAY=:99
+      - NO_PROXY=localhost
+
+networks:
+  agent-network:
+    driver: bridge
+    internal: true  # No internet by default
+
+volumes:
+  agent-tmp:
+
+---
+
+# Python wrapper with additional runtime sandboxing
+import subprocess
+import os
+from dataclasses im
+```
+
+### Anthropic Computer Use Implementation
+
+Official implementation pattern using Claude's computer use capability.
+Claude 3.5 Sonnet was the first frontier model to offer computer use.
+Claude Opus 4.5 is now the "best model in the world for computer use."
+
+Key capabilities:
+- screenshot: Capture current screen state
+- mouse: Click, move, drag operations
+- keyboard: Type text, press keys
+- bash: Run shell commands
+- text_editor: View and edit files
+
+Tool versions:
+- computer_20251124 (Opus 4.5): Adds zoom action for detailed inspection
+- computer_20250124 (All other models): Standard capabilities
+
+Critical limitation: "Some UI elements (like dropdowns and scrollbars)
+might be tricky for Claude to manipulate" - Anthropic docs
+
+
+**When to use**: ['Building production computer use agents', 'Need highest quality vision understanding', 'Full desktop control (not just browser)']
+
+```python
+from anthropic import Anthropic
+from anthropic.types.beta import (
+    BetaToolComputerUse20241022,
+    BetaToolBash20241022,
+    BetaToolTextEditor20241022,
+)
+import subprocess
+import base64
+from PIL import Image
+import io
+
+class AnthropicComputerUse:
+    """
+    Official Anthropic Computer Use implementation.
+
+    Requires:
+    - Docker container with virtual display
+    - VNC for viewing agent actions
+    - Proper tool implementations
+    """
+
+    def __init__(self):
+        self.client = Anthropic()
+        self.model = "claude-sonnet-4-20250514"  # Best for computer use
+        self.screen_size = (1280, 800)
+
+    def get_tools(self) -> list:
+        """Define computer use tools."""
+        return [
+            BetaToolComputerUse20241022(
+                type="computer_20241022",
+                name="computer",
+                display_width_px=self.screen_size[0],
+                display_height_px=self.screen_size[1],
+            ),
+            BetaToolBash20241022(
+                type="bash_20241022",
+                name="bash",
+            ),
+            BetaToolTextEditor20241022(
+                type="text_editor_20241022",
+                name="str_replace_editor",
+            ),
+        ]
+
+    def execute_tool(self, name: str, input: dict) -> dict:
+        """Execute a tool and return result."""
+
+        if name == "computer":
+            return self._handle_computer_action(input)
+        elif name == "bash":
+            return self._handle_bash(input)
+        elif name == "str_replace_editor":
+            return self._handle_editor(input)
+        else:
+            return {"error": f"Unknown tool: {name}"}
+
+    def _handle_computer_action(self, input: dict) -> dict:
+        """Handle computer control actions."""
+        action = input.get("action")
+
+        if action == "screenshot":
+            # Capture via xdotool/scrot
+            subprocess.run(["scrot", "/tmp/screenshot.png"])
+
+            with open("/tmp/screenshot.png", "rb") as f:
+            
+```
+
+## ⚠️ Sharp Edges
+
+| Issue | Severity | Solution |
+|-------|----------|----------|
+| Issue | critical | ## Defense in depth - no single solution works |
+| Issue | medium | ## Add human-like variance to actions |
+| Issue | high | ## Use keyboard alternatives when possible |
+| Issue | medium | ## Accept the tradeoff |
+| Issue | high | ## Implement context management |
+| Issue | high | ## Monitor and limit costs |
+| Issue | critical | ## ALWAYS use sandboxing |
+
+## When to Use
+This skill is applicable to execute the workflow or actions described in the overview.