cokit-cli 1.0.9 → 1.2.0

package/skills/web-testing/references/pre-release-checklist.md

@@ -0,0 +1,75 @@
+# Pre-Release Testing Checklist
+
+## Cross-Browser & Responsive
+
+- [ ] Chrome, Firefox, Safari, Edge latest
+- [ ] Mobile: iPhone real device (Safari iOS)
+- [ ] Mobile: Android real device (Chrome)
+- [ ] Breakpoints: 375px, 768px, 1024px, 1920px
+- [ ] Portrait & landscape orientations
+
+## Functional Testing
+
+- [ ] Primary user journeys complete
+- [ ] CRUD operations work
+- [ ] Login/logout/password reset
+- [ ] Form validation enforced
+- [ ] Search/filter/sort/pagination
+
+## Interactive Elements
+
+- [ ] Buttons, links respond correctly
+- [ ] Modals open/close properly
+- [ ] Dropdowns, tooltips work
+- [ ] Touch gestures work on mobile
+- [ ] Drag & drop (if applicable)
+
+## Keyboard & Accessibility
+
+- [ ] Tab navigation through all elements
+- [ ] Enter/Space activates buttons
+- [ ] Escape closes modals
+- [ ] Visible focus indicators
+- [ ] Screen reader announces content
+
+## Performance (Core Web Vitals)
+
+- [ ] LCP < 2.5 seconds
+- [ ] CLS < 0.1
+- [ ] INP < 200ms
+- [ ] Images optimized & lazy loaded
+
+## Visual & Layout
+
+- [ ] No horizontal scroll on mobile
+- [ ] Content reflows at breakpoints
+- [ ] Sufficient color contrast
+- [ ] Animations smooth
+
+## Error Handling
+
+- [ ] Network errors show retry option
+- [ ] 401/403/404/500 handled properly
+- [ ] Form errors highlight fields
+
+## Security
+
+- [ ] HTTPS enforced
+- [ ] Security headers present
+- [ ] CSRF tokens in forms
+
+## Test Quality
+
+- [ ] All tests pass (no flaky tests)
+- [ ] Coverage: Unit 70%, Integration 20%, E2E 10%
+- [ ] Accessibility audit passed
+
+## Quick Commands
+
+```bash
+npm run test                                    # All tests
+npx playwright test --project=chromium,firefox  # Cross-browser
+npx @axe-core/cli https://staging.example.com   # Accessibility
+npx lighthouse https://staging.example.com       # Performance
+curl -I https://staging.example.com | grep -i security  # Headers
+```

package/skills/web-testing/references/security-checklists.md

@@ -0,0 +1,81 @@
+# Security Checklists
+
+## Authentication Security
+
+- [ ] Strong auth mechanism (OAuth 2.0, JWT, OIDC)
+- [ ] No basic auth or custom schemes
+- [ ] Password policy enforced (12+ chars, complexity)
+- [ ] MFA/2FA for sensitive operations
+- [ ] Account lockout after failed attempts (5-10)
+- [ ] Secure password reset (token expiration)
+- [ ] Default credentials removed/disabled
+- [ ] API keys not in code/version control
+- [ ] Session tokens cryptographically generated
+- [ ] Logout invalidates session/token
+
+## API Security
+
+- [ ] HTTPS/TLS enforced for all endpoints
+- [ ] API versioning strategy in place
+- [ ] Rate limiting implemented
+- [ ] Auth required (API key or OAuth token)
+- [ ] Input validation on all parameters
+- [ ] Output encoding/sanitization
+- [ ] CORS headers properly configured
+- [ ] Pagination limits prevent enumeration
+- [ ] Proper HTTP status codes (401 vs 403)
+- [ ] Error messages don't expose internals
+
+## Session Management
+
+- [ ] Session IDs cryptographically random
+- [ ] Cookies: HttpOnly, Secure, SameSite flags
+- [ ] Session timeout (idle + absolute)
+- [ ] Session invalidation on logout
+- [ ] Session fixation protection (regenerate on login)
+- [ ] CSRF tokens for state-changing ops
+- [ ] Session data server-side (not in cookies)
+
+## Input Validation
+
+- [ ] Whitelist validation (allow only expected)
+- [ ] Type validation (string, number, date)
+- [ ] Length validation (min/max)
+- [ ] Format validation (regex for email, URL)
+- [ ] SQL parameters use prepared statements
+- [ ] NoSQL queries use safe APIs
+- [ ] Command execution avoided/validated
+- [ ] XML external entities disabled (XXE)
+- [ ] JSON parsing safe (no eval)
+- [ ] ReDoS-safe regex patterns
+
+## Security Headers
+
+```
+Content-Security-Policy: default-src 'self'; script-src 'self'
+X-Content-Type-Options: nosniff
+X-Frame-Options: DENY
+X-XSS-Protection: 1; mode=block
+Strict-Transport-Security: max-age=31536000; includeSubDomains
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: camera=(), microphone=(), geolocation=()
+```
+
+- [ ] CSP configured (restrict resource loading)
+- [ ] X-Content-Type-Options: nosniff
+- [ ] X-Frame-Options (DENY or SAMEORIGIN)
+- [ ] HSTS enabled with appropriate max-age
+- [ ] Referrer-Policy configured
+- [ ] Permissions-Policy set
+- [ ] Server/X-Powered-By headers removed
+- [ ] CORS: No wildcard on credentialed endpoints
+
+## Verify Headers
+
+```bash
+# Check security headers
+curl -I https://example.com
+
+# Use securityheaders.com
+# Use observatory.mozilla.org
+```

package/skills/web-testing/references/security-testing-overview.md

@@ -0,0 +1,92 @@
+# Security Testing Overview
+
+## OWASP Top 10 (2024)
+
+| Rank | Vulnerability | Testing Method |
+|------|--------------|----------------|
+| A01 | Broken Access Control | Test unauthorized actions across roles |
+| A02 | Cryptographic Failures | Check HTTPS, encryption algorithms |
+| A03 | Injection (SQL/NoSQL/Cmd) | Test with payloads (see vulnerability-payloads.md) |
+| A04 | Insecure Design | Threat modeling, abuse case testing |
+| A05 | Security Misconfiguration | Default creds, open ports, headers |
+| A06 | Vulnerable Components | npm audit, Snyk scanning |
+| A07 | Auth Failures | Brute force, session hijacking |
+| A08 | Integrity Failures | Deserialization, CI/CD security |
+| A09 | Logging Failures | Verify security event logging |
+| A10 | SSRF | Test internal URL access |
+
+## Security Testing Types
+
+### SAST (Static Analysis)
+- **When**: Early development, pre-commit
+- **Tools**: SonarQube, CodeQL, Semgrep
+- **Focus**: Code flaws without execution
+- **Limitation**: High false positives
+
+### DAST (Dynamic Analysis)
+- **When**: QA/staging, running application
+- **Tools**: OWASP ZAP, Burp Suite, Nuclei
+- **Focus**: Runtime vulnerabilities
+- **Limitation**: Requires running app
+
+### SCA (Dependency Scanning)
+- **Tools**: npm audit, Snyk, Dependabot
+- **Focus**: Known CVEs in dependencies
+- **Automation**: CI/CD integration
+
+### Secret Detection
+- **Tools**: detect-secrets, GitGuardian
+- **Focus**: API keys, passwords in code
+- **Implementation**: Pre-commit hooks
+
+## Quick Security Scan
+
+```bash
+# Dependency vulnerabilities
+npm audit
+npx snyk test
+
+# OWASP ZAP baseline scan
+docker run -t ghcr.io/zaproxy/zaproxy:stable \
+  zap-baseline.py -t https://example.com
+
+# Nuclei template scan
+nuclei -u https://example.com -t cves/
+
+# Check security headers
+curl -I https://example.com | grep -i "security\|content-security\|x-"
+```
+
+## Penetration Testing Phases
+
+1. **Reconnaissance**: DNS, WHOIS, tech fingerprinting
+2. **Scanning**: Port scan, service enumeration
+3. **Vulnerability Assessment**: Automated + manual testing
+4. **Exploitation**: Verify findings, demonstrate impact
+5. **Reporting**: CVSS scores, remediation guidance
+
+## Tools Comparison
+
+| Tool | Type | Cost | Best For |
+|------|------|------|----------|
+| OWASP ZAP | DAST | Free | CI/CD, learning |
+| Burp Suite | DAST | Paid | Enterprise, detailed |
+| Nuclei | DAST | Free | Custom checks |
+| npm audit | SCA | Free | Node.js deps |
+| Snyk | SCA | Free/Paid | Multi-language |
+
+## CI/CD Integration
+
+```yaml
+# Security scanning in pipeline
+- name: Dependency Scan
+  run: npm audit --audit-level=high
+
+- name: SAST Scan
+  uses: github/codeql-action/analyze@v3
+
+- name: DAST Scan
+  run: |
+    docker run -v $(pwd):/zap/wrk:rw ghcr.io/zaproxy/zaproxy:stable \
+      zap-api-scan.py -t http://localhost:3000/openapi.json -f openapi
+```

package/skills/web-testing/references/shadow-dom-testing.md

@@ -0,0 +1,70 @@
+# Shadow DOM & Web Components Testing
+
+## Challenges
+
+- CSS encapsulation breaks selectors
+- Elements hidden from DOM queries
+- XPath doesn't penetrate shadow boundaries
+
+## Tool Support
+
+| Tool | Support | Method |
+|------|---------|--------|
+| Playwright | Native | `>>` piercing selector |
+| Cypress | Good | `.shadow()` command |
+| Selenium | Limited | JS execution |
+| Axe | v5.7+ | API support |
+
+## Playwright Shadow Piercing
+
+```javascript
+const input = page.locator('my-component >> .internal-input');
+const button = page.locator('comp-a >> comp-b >> button');
+const el = page.locator('custom-element >> button:has-text("Click me")');
+```
+
+## Cypress Shadow DOM
+
+```javascript
+cy.get('my-component').shadow().find('.internal-button').click();
+
+// Enable globally: { includeShadowDom: true }
+```
+
+## Selenium Workaround
+
+```javascript
+const shadowHost = driver.findElement(By.css('my-component'));
+const shadowRoot = driver.executeScript('return arguments[0].shadowRoot', shadowHost);
+const button = shadowRoot.findElement(By.css('button'));
+```
+
+## Page Object Pattern
+
+```typescript
+export class MyComponentPO {
+  constructor(private page: Page) {}
+
+  async fillEmail(email: string) {
+    await this.page.locator('my-form >> input[type="email"]').fill(email);
+  }
+
+  async submit() {
+    await this.page.locator('my-form >> button[type="submit"]').click();
+  }
+}
+```
+
+## Best Practices
+
+1. Request `open` shadow roots when possible
+2. Encapsulate shadow traversal in page objects
+3. Avoid deep nesting (increases complexity)
+
+## Debugging
+
+```javascript
+const contents = await page.evaluate(() => {
+  return document.querySelector('my-component').shadowRoot.innerHTML;
+});
+```

package/skills/web-testing/references/test-data-management.md

@@ -0,0 +1,131 @@
+# Test Data Management
+
+## Faker.js (Dynamic Data Generation)
+
+```typescript
+import { faker } from '@faker-js/faker';
+
+// Reproducible data (seeding)
+faker.seed(123);
+
+const user = {
+  id: faker.string.uuid(),
+  name: faker.person.fullName(),
+  email: faker.internet.email(),
+  avatar: faker.image.avatar(),
+  createdAt: faker.date.past(),
+};
+```
+
+## Factory Pattern (Fishery)
+
+```typescript
+import { Factory } from 'fishery';
+import { faker } from '@faker-js/faker';
+
+// Define factory
+const userFactory = Factory.define<User>(() => ({
+  id: faker.string.uuid(),
+  name: faker.person.fullName(),
+  email: faker.internet.email(),
+  role: 'user',
+}));
+
+// Usage
+const user = userFactory.build();
+const admin = userFactory.build({ role: 'admin' });
+const users = userFactory.buildList(5);
+```
+
+## Factory with Associations
+
+```typescript
+const postFactory = Factory.define<Post>(({ associations }) => ({
+  id: faker.string.uuid(),
+  title: faker.lorem.sentence(),
+  author: associations.author || userFactory.build(),
+}));
+
+const post = postFactory.build({
+  author: userFactory.build({ role: 'admin' }),
+});
+```
+
+## Fixtures (Static Baseline Data)
+
+```typescript
+// fixtures/users.ts
+export const testUsers = {
+  admin: {
+    id: 'admin-001',
+    email: 'admin@test.com',
+    role: 'admin',
+  },
+  member: {
+    id: 'member-001',
+    email: 'member@test.com',
+    role: 'member',
+  },
+};
+
+// In tests
+import { testUsers } from './fixtures/users';
+```
+
+## Combined Pattern (Fixtures + Factories)
+
+```typescript
+// Baseline fixtures for known states
+const baseUser = testUsers.admin;
+
+// Factory for dynamic variations
+const dynamicUser = userFactory.build({
+  ...baseUser,
+  email: faker.internet.email(), // Override specific fields
+});
+```
+
+## Database Seeding
+
+```typescript
+// seed.ts
+async function seedTestData(db: Database, workerIndex: number) {
+  // Worker-isolated data
+  const prefix = `w${workerIndex}`;
+
+  await db.users.insertMany([
+    { id: `${prefix}-user-1`, email: `user1-${prefix}@test.com` },
+    { id: `${prefix}-user-2`, email: `user2-${prefix}@test.com` },
+  ]);
+}
+
+async function clearTestData(db: Database, workerIndex: number) {
+  const prefix = `w${workerIndex}`;
+  await db.users.deleteMany({ id: { $regex: `^${prefix}` } });
+}
+```
+
+## Best Practices
+
+- **Reproducibility:** Seed Faker for consistent test data
+- **Isolation:** Prefix data with worker index for parallelism
+- **Cleanup:** Always clean up in afterEach/afterAll
+- **Minimal data:** Only create what's needed for test
+- **Type safety:** Type your factories
+
+## Anti-Patterns
+
+```typescript
+// BAD: Hardcoded values
+const user = { email: 'test@test.com' }; // Collisions!
+
+// GOOD: Dynamic generation
+const user = { email: faker.internet.email() };
+
+// BAD: Shared mutable state
+let globalUser;
+beforeAll(() => { globalUser = createUser(); });
+
+// GOOD: Fresh data per test
+beforeEach(() => { user = userFactory.build(); });
+```

package/skills/web-testing/references/test-flakiness-mitigation.md

@@ -0,0 +1,86 @@
+# Test Flakiness Mitigation
+
+## Root Causes
+
+- Timing mismatches (hard waits)
+- Non-isolated tests (shared state)
+- Network instability
+- Animation timing
+
+## Explicit Waits (Not Hard Waits)
+
+```javascript
+// BAD: Hard wait
+await new Promise(r => setTimeout(r, 500));
+
+// GOOD: Wait for condition
+await page.waitForSelector('.success', { timeout: 10000 });
+await expect(page.locator('.count')).toContainText('5');
+
+// BEST: Playwright auto-wait
+await page.getByRole('button', { name: /submit/i }).click();
+```
+
+## Wait Timeout Guidelines
+
+| Scenario | Timeout |
+|----------|---------|
+| Page load | 10-15s |
+| Element visibility | 5-10s |
+| API responses | 30-60s |
+
+## Retry Strategies
+
+```javascript
+// Playwright built-in
+test.describe.configure({ retries: 3 });
+
+// Per-test
+test('flaky test', async ({ page }) => { /* */ }, { retries: 3 });
+
+// Exponential backoff
+async function retryWithBackoff(fn, maxRetries = 3) {
+  for (let i = 0; i < maxRetries; i++) {
+    try { return await fn(); }
+    catch (e) {
+      if (i === maxRetries - 1) throw e;
+      await new Promise(r => setTimeout(r, Math.pow(2, i) * 1000));
+    }
+  }
+}
+```
+
+## Test Isolation
+
+```javascript
+// BAD: Dependent tests
+let userId;
+test('create', async () => { userId = await createUser(); });
+test('load', async () => { await loadUser(userId); }); // Depends on previous!
+
+// GOOD: Independent
+test('create and load', async ({ page }) => {
+  const userId = await createUser(page);
+  await loadUser(page, userId);
+});
+```
+
+## Disable Animations
+
+```css
+* { animation-duration: 0s !important; transition-duration: 0s !important; }
+```
+
+## Network Stability
+
+```javascript
+await page.route('**/external-api/**', route =>
+  route.fulfill({ status: 200, body: '{}' })
+);
+```
+
+## Flakiness Detection
+
+```bash
+npx playwright test --repeat-each=5
+```

package/skills/web-testing/references/testing-pyramid-strategy.md

@@ -0,0 +1,76 @@
+# Testing Strategy Models
+
+## Model Comparison
+
+| Model | Structure | Best For |
+|-------|-----------|----------|
+| Pyramid | Unit 70% > Integration 20% > E2E 10% | Monoliths, logic-heavy |
+| Trophy (Dodds) | Static > Integration (largest) > Unit > E2E | Modern SPAs |
+| Honeycomb (Spotify) | Contract-centric cells | Microservices |
+| Diamond | Balanced unit/integration | Domain services |
+
+## Testing Trophy (Recommended for SPAs)
+
+```
+         E2E (minimal)
+        /------------\
+       / Integration  \   <-- Largest portion
+      /----------------\
+     /   Unit Tests     \
+    /--------------------\
+   /   Static Analysis    \  <-- Foundation
+  /________________________\
+```
+
+**Philosophy:** "The more your tests resemble how software is used, the more confidence they give you." - Kent C. Dodds
+
+**Key Principles:**
+- Test behavior, not implementation
+- Minimize mocking
+- Prioritize integration tests
+- Use accessible queries (getByRole first)
+
+## Testing Honeycomb (Microservices)
+
+Contract testing at center, interconnected cells for:
+- Unit tests (implementation details)
+- Integration tests (service boundaries)
+- Contract tests (API agreements)
+- E2E tests (critical paths only)
+
+## Ratios by Context
+
+| Context | Unit | Integration | E2E |
+|---------|------|-------------|-----|
+| Classic Pyramid | 70% | 20% | 10% |
+| Testing Trophy | 30% | 50% | 10% |
+| API-heavy | 75% | 15% | 10% |
+| Microservices | 40% | 40% | 20% |
+
+## Priority Matrix
+
+| Priority | Category | Examples |
+|----------|----------|----------|
+| P0 | Core flows | Signup, login, checkout, payment |
+| P1 | Major features | Search, CRUD, navigation |
+| P2 | Secondary | Filters, sorting, pagination |
+| P3 | Edge cases | Empty states, max limits |
+
+## Coverage Targets
+
+| Area | Target |
+|------|--------|
+| Critical paths | 100% |
+| Core features | 80-90% |
+| Overall | 75-85% |
+
+**Note:** Coverage as diagnostic, not target. Focus on what's uncovered.
+
+## CI/CD Order
+
+```yaml
+- run: npm run lint          # Gate 0: Static analysis
+- run: npm run test:unit     # Gate 1: Fast fail
+- run: npm run test:integration # Gate 2
+- run: npm run test:e2e      # Gate 3: Pre-merge
+```