cokit-cli 1.2.7 → 1.4.0

package/skills/ck-security/references/stride-owasp-checklist.md

@@ -0,0 +1,128 @@
+# STRIDE + OWASP Security Checklist
+
+Reference checklist for `security` audits. Use during Step 2 (STRIDE Analysis) and Step 3 (OWASP Top 10 Check).
+
+---
+
+## STRIDE Checklist
+
+### Spoofing (Authentication)
+- [ ] All endpoints require authentication (unless intentionally public)
+- [ ] Passwords hashed with bcrypt/argon2 — not MD5 or SHA1
+- [ ] JWT tokens have expiration (`exp`) and are validated server-side
+- [ ] Session management uses `Secure`, `HttpOnly`, `SameSite` cookie flags
+- [ ] Multi-factor auth available for sensitive operations
+- [ ] OAuth/OIDC flows use `state` parameter to prevent CSRF
+- [ ] Default credentials removed from all services and dependencies
+
+### Tampering (Integrity)
+- [ ] Input validation on all user-supplied data (type, length, format)
+- [ ] Parameterized queries used — no string concatenation for SQL/NoSQL
+- [ ] CSRF tokens present on all state-changing forms
+- [ ] Request signing for API-to-API calls (HMAC or mTLS)
+- [ ] File uploads validated for type (magic bytes), size, and content
+- [ ] Deserialization of untrusted data avoided or sandboxed
+- [ ] HTTP methods restricted per endpoint (no GET for mutations)
+
+### Repudiation (Logging)
+- [ ] Authentication events logged: login, logout, failures
+- [ ] Authorization failures logged with user/resource context
+- [ ] Data modification events logged with actor and timestamp
+- [ ] Logs do not contain sensitive data (passwords, tokens, PII)
+- [ ] Log integrity protected — append-only storage or centralized sink
+- [ ] Logs retained per compliance requirements (90 days minimum)
+
+### Information Disclosure
+- [ ] Error messages do not leak stack traces in production
+- [ ] API responses exclude internal IDs, system paths, or version strings
+- [ ] Sensitive data encrypted at rest (AES-256 or equivalent)
+- [ ] All transport uses TLS 1.2+ — no HTTP for sensitive endpoints
+- [ ] No hardcoded secrets in source code (see Secret Patterns below)
+- [ ] `.env` files and credential files listed in `.gitignore`
+- [ ] API responses filtered to minimum necessary fields (no over-fetching)
+
+### Denial of Service
+- [ ] Rate limiting on authentication and sensitive endpoints
+- [ ] Request body size limits configured at server/gateway level
+- [ ] Pagination enforced on all list endpoints (no unbounded queries)
+- [ ] Timeouts set on all external API and database calls
+- [ ] Connection pools sized and cleaned up properly
+- [ ] Regex patterns reviewed for catastrophic backtracking (ReDoS)
+- [ ] Background jobs have concurrency limits and dead-letter queues
+
+### Elevation of Privilege
+- [ ] Role-based access control (RBAC) enforced server-side, not client-side
+- [ ] Horizontal privilege checks: user A cannot access user B's resources (IDOR)
+- [ ] Admin endpoints have separate, stricter auth middleware
+- [ ] Privilege escalation paths require re-authentication
+- [ ] Service accounts use principle of least privilege
+- [ ] Third-party integrations scoped to minimum required permissions
+
+---
+
+## OWASP Top 10 Quick Reference
+
+| # | Category | What to Check |
+|---|----------|---------------|
+| A01 | Broken Access Control | Missing auth checks, IDOR vulnerabilities, CORS misconfiguration, path traversal |
+| A02 | Cryptographic Failures | Weak hashing (MD5/SHA1), plaintext storage, missing TLS, weak cipher suites |
+| A03 | Injection | SQL, NoSQL, OS command, LDAP, template injection via unsanitized input |
+| A04 | Insecure Design | Missing threat model, business logic flaws, no abuse-case testing |
+| A05 | Security Misconfiguration | Default credentials, verbose error pages, unnecessary features/ports enabled |
+| A06 | Vulnerable Components | Outdated dependencies, known CVEs, unpatched libraries |
+| A07 | Auth Failures | Brute force possible, credential stuffing, session fixation, weak tokens |
+| A08 | Data Integrity Failures | Unsigned updates, unverified deserialization, CI/CD pipeline compromise |
+| A09 | Logging Failures | Missing security event logs, no alerting, insufficient monitoring coverage |
+| A10 | SSRF | Unvalidated user-supplied URLs, internal service access via fetch/curl |
+
+---
+
+## Secret Patterns to Detect
+
+Scan source files for the following regex patterns. Any match is a Critical finding.
+
+```regex
+# Generic API keys
+(?i)(api[_-]?key|apikey)\s*[:=]\s*['"][A-Za-z0-9\-_]{20,}['"]
+
+# AWS access key IDs
+AKIA[0-9A-Z]{16}
+
+# AWS secret access keys
+(?i)aws[_-]?secret[_-]?access[_-]?key\s*[:=]\s*['"][A-Za-z0-9/+]{40}['"]
+
+# JSON Web Tokens
+eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+
+
+# Generic passwords in config/code
+(?i)(password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]
+
+# Private keys (PEM format)
+-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
+
+# GitHub personal access tokens
+ghp_[A-Za-z0-9]{36}
+
+# Stripe secret keys
+sk_(live|test)_[A-Za-z0-9]{24,}
+
+# Generic bearer tokens
+(?i)bearer\s+[A-Za-z0-9\-._~+/]{20,}
+```
+
+> False positive reduction: skip matches inside `*.test.*`, `*.spec.*`, `*.example`, and `*.md` files when the value is clearly a placeholder (e.g., `YOUR_KEY_HERE`, `<your-token>`).
+
+---
+
+## Dependency Audit Commands
+
+Run the appropriate command for the detected stack and include output in the findings report:
+
+| Stack | Command |
+|-------|---------|
+| Node.js | `npm audit --json` |
+| Python | `pip-audit --format json` |
+| Go | `govulncheck ./...` |
+| Ruby | `bundle audit check --update` |
+| Java/Maven | `mvn dependency-check:check` |
+| Rust | `cargo audit` |

package/skills/ck-sequential-thinking/README.md

@@ -0,0 +1,183 @@
+# Sequential Thinking Agent Skill
+
+Structured, reflective problem-solving methodology converted from the sequential-thinking MCP server into a native Agent Skill.
+
+## Overview
+
+This skill teaches the AI to apply systematic sequential thinking methodology for complex problem-solving, without relying on external MCP tools. It enables:
+- Breaking down complex problems into manageable thought sequences
+- Dynamic adjustment of thought count as understanding evolves
+- Revision of previous thoughts when new insights emerge
+- Branching into alternative reasoning paths
+- Hypothesis generation and verification
+
+## Skill Structure
+
+```
+sequential-thinking/
+├── SKILL.md (105 lines)
+│   Core methodology, when to apply, scripts usage
+│
+├── package.json
+│   Test dependencies (jest)
+│
+├── .env.example
+│   Configuration options
+│
+├── scripts/
+│   ├── process-thought.js (executable)
+│   │   Validate and track thoughts deterministically
+│   │
+│   └── format-thought.js (executable)
+│       Format thoughts for display (box/simple/markdown)
+│
+├── tests/
+│   ├── process-thought.test.js
+│   │   Validation, tracking, history tests
+│   │
+│   └── format-thought.test.js
+│       Formatting tests (all formats)
+│
+└── references/
+    ├── core-patterns.md (95 lines)
+    │   Essential revision & branching patterns
+    │
+    ├── examples-api.md (88 lines)
+    │   API design example walkthrough
+    │
+    ├── examples-debug.md (90 lines)
+    │   Performance debugging example
+    │
+    ├── examples-architecture.md (94 lines)
+    │   Architecture decision example
+    │
+    ├── advanced-techniques.md (76 lines)
+    │   Spiral refinement, hypothesis testing, convergence
+    │
+    └── advanced-strategies.md (79 lines)
+        Uncertainty management, revision cascades, meta-thinking
+```
+
+**Documentation**: 627 lines across 7 files (all under 100 lines)
+**Scripts**: 2 executable Node.js scripts with tests
+
+## Key Features
+
+### Progressive Disclosure Design
+Each file focuses on specific aspects, loaded only when needed:
+- **SKILL.md**: Quick reference with core methodology
+- **core-patterns.md**: Common patterns for everyday use
+- **examples-*.md**: Real-world walkthroughs for learning
+- **advanced-*.md**: Sophisticated techniques for complex scenarios
+
+### Token Efficiency
+- Concise explanations sacrifice grammar for brevity
+- Examples demonstrate patterns without verbose explanation
+- Cross-references between files avoid duplication
+
+### Methodology Conversion
+Extracted from MCP server's approach and converted to instructions:
+- MCP tool provided **interface** for sequential thinking
+- Agent skill provides **methodology** to think sequentially
+- No dependency on external tools—pure instructional approach
+
+## Usage Modes
+
+**Explicit Mode**: Use visible thought markers
+```
+Thought 1/5: [Analysis]
+Thought 2/5: [Further analysis]
+```
+
+**Implicit Mode**: Apply methodology internally without cluttering output
+
+## When AI Should Use This Skill
+
+Automatically activated for:
+- Complex problem decomposition
+- Adaptive planning with potential revisions
+- Debugging and root cause analysis
+- Architecture and design decisions
+- Problems with unclear or emerging scope
+- Multi-step solutions requiring context
+
+## Scripts Usage
+
+### Process Thought (Validation & Tracking)
+
+```bash
+# Process a thought
+node scripts/process-thought.js --thought "Initial analysis" --number 1 --total 5 --next true
+
+# Process with revision
+node scripts/process-thought.js --thought "Corrected analysis" --number 2 --total 5 --next true --revision 1
+
+# Process with branching
+node scripts/process-thought.js --thought "Branch A" --number 2 --total 5 --next true --branch 1 --branchId "branch-a"
+
+# View history
+node scripts/process-thought.js --history
+
+# Reset history
+node scripts/process-thought.js --reset
+```
+
+### Format Thought (Display)
+
+```bash
+# Box format (default)
+node scripts/format-thought.js --thought "Analysis" --number 1 --total 5
+
+# Simple text format
+node scripts/format-thought.js --thought "Analysis" --number 1 --total 5 --format simple
+
+# Markdown format
+node scripts/format-thought.js --thought "Analysis" --number 1 --total 5 --format markdown
+
+# With revision
+node scripts/format-thought.js --thought "Revised" --number 2 --total 5 --revision 1
+
+# With branch
+node scripts/format-thought.js --thought "Branch" --number 2 --total 5 --branch 1 --branchId "a"
+```
+
+### Running Tests
+
+```bash
+# Install dependencies (first time only)
+npm install
+
+# Run all tests
+npm test
+
+# Run tests in watch mode
+npm run test:watch
+
+# Run with coverage
+npm run test:coverage
+```
+
+## When to Use Scripts
+
+**Use scripts when**:
+- Need deterministic validation of thought structure
+- Want persistent thought history tracking
+- Require formatted output for documentation
+- Building tools that integrate with sequential thinking
+
+**Don't use scripts when**:
+- Applying methodology directly in responses
+- Want lightweight, inline thinking
+- No need for validation or tracking
+
+Scripts are **optional tooling** - the methodology can be applied without them.
+
+## Source
+
+Converted from: https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking
+
+Original MCP server by Anthropic (MIT License).
+Skill conversion:
+- Extracts methodology as instructions
+- Adds executable scripts for deterministic validation
+- Makes tool-independent while preserving functionality

package/skills/ck-sequential-thinking/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: ck-sequential-thinking
+description: Apply step-by-step analysis for complex problems with revision capability. Use for multi-step reasoning, hypothesis verification, adaptive planning, problem decomposition, course correction.
+license: MIT
+argument-hint: "[problem to analyze step-by-step]"
+---
+
+# Sequential Thinking
+
+Structured problem-solving via manageable, reflective thought sequences with dynamic adjustment.
+
+## When to Apply
+
+- Complex problem decomposition
+- Adaptive planning with revision capability
+- Analysis needing course correction
+- Problems with unclear/emerging scope
+- Multi-step solutions requiring context maintenance
+- Hypothesis-driven investigation/debugging
+
+## Core Process
+
+### 1. Start with Loose Estimate
+```
+Thought 1/5: [Initial analysis]
+```
+Adjust dynamically as understanding evolves.
+
+### 2. Structure Each Thought
+- Build on previous context explicitly
+- Address one aspect per thought
+- State assumptions, uncertainties, realizations
+- Signal what next thought should address
+
+### 3. Apply Dynamic Adjustment
+- **Expand**: More complexity discovered → increase total
+- **Contract**: Simpler than expected → decrease total
+- **Revise**: New insight invalidates previous → mark revision
+- **Branch**: Multiple approaches → explore alternatives
+
+### 4. Use Revision When Needed
+```
+Thought 5/8 [REVISION of Thought 2]: [Corrected understanding]
+- Original: [What was stated]
+- Why revised: [New insight]
+- Impact: [What changes]
+```
+
+### 5. Branch for Alternatives
+```
+Thought 4/7 [BRANCH A from Thought 2]: [Approach A]
+Thought 4/7 [BRANCH B from Thought 2]: [Approach B]
+```
+Compare explicitly, converge with decision rationale.
+
+### 6. Generate & Verify Hypotheses
+```
+Thought 6/9 [HYPOTHESIS]: [Proposed solution]
+Thought 7/9 [VERIFICATION]: [Test results]
+```
+Iterate until hypothesis verified.
+
+### 7. Complete Only When Ready
+Mark final: `Thought N/N [FINAL]`
+
+Complete when:
+- Solution verified
+- All critical aspects addressed
+- Confidence achieved
+- No outstanding uncertainties
+
+## Application Modes
+
+**Explicit**: Use visible thought markers when complexity warrants visible reasoning or user requests breakdown.
+
+**Implicit**: Apply methodology internally for routine problem-solving where thinking aids accuracy without cluttering response.
+
+## Scripts (Optional)
+
+Optional scripts for deterministic validation/tracking:
+- `scripts/process-thought.js` - Validate & track thoughts with history
+- `scripts/format-thought.js` - Format for display (box/markdown/simple)
+
+See README.md for usage examples. Use when validation/persistence needed; otherwise apply methodology directly.
+
+## References
+
+Load when deeper understanding needed:
+- `references/core-patterns.md` - Revision & branching patterns
+- `references/examples-api.md` - API design example
+- `references/examples-debug.md` - Debugging example
+- `references/examples-architecture.md` - Architecture decision example
+- `references/advanced-techniques.md` - Spiral refinement, hypothesis testing, convergence
+- `references/advanced-strategies.md` - Uncertainty, revision cascades, meta-thinking

package/skills/ck-sequential-thinking/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "sequential-thinking-skill",
+  "version": "1.0.0",
+  "description": "Sequential thinking methodology with thought processing scripts",
+  "main": "scripts/process-thought.js",
+  "scripts": {
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:coverage": "jest --coverage"
+  },
+  "keywords": [
+    "sequential-thinking",
+    "problem-solving",
+    "agent-skill"
+  ],
+  "author": "CoKit",
+  "license": "MIT",
+  "devDependencies": {
+    "jest": "^29.7.0"
+  },
+  "jest": {
+    "testEnvironment": "node",
+    "testMatch": [
+      "**/tests/**/*.test.js"
+    ],
+    "coveragePathIgnorePatterns": [
+      "/node_modules/",
+      "/tests/"
+    ]
+  }
+}

package/skills/ck-ship/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: ck-ship
+description: "Ship pipeline: merge main, test, review, commit, push, PR. Single command from feature branch to PR URL. Use for shipping official releases to main/master or beta releases to dev/beta branches."
+argument-hint: "[official|beta] [--skip-tests] [--skip-review] [--skip-journal] [--skip-docs] [--dry-run]"
+license: MIT
+---
+
+# Ship: Unified Ship Pipeline
+
+Single command to ship a feature branch. Fully automated — only stops for test failures, critical review issues, or major version bumps.
+
+**Inspired by:** gstack `/ship` by Garry Tan. Adapted for framework-agnostic, multi-language support.
+
+## Arguments
+
+| Flag | Effect |
+|------|--------|
+| `official` | Ship to default branch (main/master). Full pipeline with docs + journal |
+| `beta` | Ship to dev/beta branch. Lighter pipeline, skip docs update |
+| (none) | Auto-detect: if base branch is main/master → official, else → beta |
+| `--skip-tests` | Skip test step (use when tests already passed) |
+| `--skip-review` | Skip pre-landing review step |
+| `--skip-journal` | Skip journal writing step |
+| `--skip-docs` | Skip docs update step |
+| `--dry-run` | Show what would happen without executing |
+
+## Ship Mode Detection
+
+```
+If argument = "official" → target = main/master (auto-detect default branch)
+If argument = "beta"     → target = dev/beta (auto-detect dev branch)
+If no argument           → infer from current branch naming:
+  - feature/* hotfix/* bugfix/* → official (target main)
+  - dev/* beta/* experiment/*  → beta (target dev/beta)
+  - unclear                    → asking the user
+```
+
+## When to Stop (blocking)
+
+- On target branch already → abort
+- Merge conflicts that can't be auto-resolved → stop, show conflicts
+- Test failures → stop, show failures
+- Critical review issues → asking the user per issue
+- Major/minor version bump needed → asking the user
+
+## When NOT to Stop
+
+- Uncommitted changes → always include them
+- Patch version bump → auto-decide
+- Changelog content → auto-generate
+- Commit message → auto-compose
+- No version file → skip version step silently
+- No changelog → skip changelog step silently
+
+## Pipeline
+
+```
+Step 1:  Pre-flight      → Branch check, mode detection, status, diff analysis
+Step 2:  Link Issues      → Find/create related GitHub issues
+Step 3:  Merge target     → Fetch + merge origin/<target-branch>
+Step 4:  Run tests        → Auto-detect test runner, run, check results
+Step 5:  Review           → Two-pass checklist review (critical + informational)
+Step 6:  Version bump     → Auto-detect version file, bump patch/minor
+Step 7:  Changelog        → Auto-generate from commits + diff
+Step 8:  Journal          → Write technical journal via /ck-journal
+Step 9:  Docs update      → Update project docs via /ck-docs update (official only)
+Step 10: Commit           → Conventional commit with version/changelog
+Step 11: Push             → git push -u origin <branch>
+Step 12: Create PR        → gh pr create with structured body + linked issues
+```
+
+**Detailed steps:** Load `references/ship-workflow.md`
+**Auto-detection:** Load `references/auto-detect.md`
+**PR template:** Load `references/pr-template.md`
+
+## Token Efficiency Rules
+
+- Steps 4 (tests) and 5 (review): delegate to `ck-tester` and `ck-code-reviewer` subagents — don't inline
+- Steps 8 (journal) and 9 (docs): run in **background** — don't block pipeline
+- Step 2 (issues): use single `gh` command batch — avoid multiple API calls
+- Skip steps early via flags to save tokens on unnecessary work
+- Beta mode auto-skips: docs update (Step 9)
+- Capture step outputs inline — don't re-read files already in context
+
+## Quick Start
+
+User says `/ck-ship` → run full pipeline → output PR URL.
+User says `/ck-ship beta` → ship to dev branch with lighter pipeline.
+User says `/ck-ship official` → ship to main with full docs + journal.
+
+## Output Format
+
+```
+✓ Pre-flight: branch feature/foo, 5 commits, +200/-50 lines (mode: official)
+✓ Issues: linked #42, created #43
+✓ Merged: origin/main (up to date)
+✓ Tests: 42 passed, 0 failed
+✓ Review: 0 critical, 2 informational
+✓ Version: 1.2.3 → 1.2.4
+✓ Changelog: updated
+✓ Journal: written (background)
+✓ Docs: updated (background)
+✓ Committed: feat(auth): add OAuth2 login flow
+✓ Pushed: origin/feature/foo
+✓ PR: https://github.com/org/repo/pull/123 (linked: #42, #43)
+```
+
+## Important Rules
+
+- **Never skip tests** (unless `--skip-tests`). If tests fail, stop.
+- **Never force push.** Regular `git push` only.
+- **Never ask for confirmation** except for critical review issues and major/minor version bumps.
+- **Auto-detect everything.** Test runner, version file, changelog format, target branch — detect from project files.
+- **Framework-agnostic.** Works for Node, Python, Rust, Go, Ruby, Java, or any project with a test command.
+- **Subagent delegation.** Use `ck-tester` for tests, `ck-code-reviewer` for review, `journal-writer` for journal, `ck-docs-manager` for docs. Don't inline.
+- **Background tasks.** Journal and docs run in background to not block the pipeline.

package/skills/ck-ship/references/auto-detect.md

@@ -0,0 +1,103 @@
+# Auto-Detection Logic
+
+Detect test runner, version file, and changelog format from project files.
+
+## Test Runner Detection
+
+Check in order (first match wins):
+
+| Check | Test Command |
+|-------|-------------|
+| `package.json` → `scripts.test` exists | `npm test` |
+| `Makefile` → has `test:` target | `make test` |
+| `pytest.ini` OR `pyproject.toml` has `[tool.pytest]` | `pytest` |
+| `Cargo.toml` exists | `cargo test` |
+| `go.mod` exists | `go test ./...` |
+| `Gemfile` + `Rakefile` with test task | `bundle exec rake test` |
+| `build.gradle` or `build.gradle.kts` | `./gradlew test` |
+| `pom.xml` | `mvn test` |
+| `mix.exs` | `mix test` |
+| `deno.json` | `deno test` |
+
+**Detection script:**
+```bash
+if [ -f package.json ] && grep -q '"test"' package.json 2>/dev/null; then
+  echo "npm test"
+elif [ -f Makefile ] && grep -q '^test:' Makefile 2>/dev/null; then
+  echo "make test"
+elif [ -f pytest.ini ] || ([ -f pyproject.toml ] && grep -q '\[tool.pytest' pyproject.toml 2>/dev/null); then
+  echo "pytest"
+elif [ -f Cargo.toml ]; then
+  echo "cargo test"
+elif [ -f go.mod ]; then
+  echo "go test ./..."
+else
+  echo "NONE"
+fi
+```
+
+**If NONE:** Use asking the user — "No test runner detected. Options: A) Skip tests, B) Provide test command"
+
+## Version File Detection
+
+Check in order:
+
+| Check | Read Pattern |
+|-------|-------------|
+| `VERSION` file | Read as semver string |
+| `package.json` → `version` field | `jq -r .version package.json` |
+| `pyproject.toml` → `version` | grep `version = "..."` |
+| `Cargo.toml` → `version` | grep `version = "..."` |
+| `mix.exs` → `@version` | grep `@version "..."` |
+
+**If none found:** Skip version bump silently. Not all projects use versioning.
+
+**Bump logic:**
+```
+Lines changed < 50  → patch (X.Y.Z → X.Y.Z+1)
+Lines changed >= 50 → patch (safe default)
+User explicitly says "breaking" or "major feature" → asking the user for minor/major
+```
+
+## Changelog Detection
+
+| Check | Format |
+|-------|--------|
+| `CHANGELOG.md` | Keep-a-changelog format |
+| `CHANGES.md` | Same |
+| `HISTORY.md` | Same |
+
+**If none found:** Skip changelog silently.
+
+**Entry format:**
+```markdown
+## [X.Y.Z] - YYYY-MM-DD
+
+### Added
+- New features from commits with `feat:` prefix
+
+### Changed
+- Changes from commits with `refactor:`, `perf:` prefix
+
+### Fixed
+- Bug fixes from commits with `fix:` prefix
+
+### Removed
+- Removals mentioned in commit messages
+```
+
+**Infer categories from:**
+1. Conventional commit prefixes in `git log main..HEAD --oneline`
+2. File types changed (test files → test improvements, docs → documentation)
+3. Diff content (new functions = Added, modified functions = Changed)
+
+## Main Branch Detection
+
+```bash
+git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@'
+```
+
+Fallback: check if `main` or `master` exists:
+```bash
+git rev-parse --verify origin/main 2>/dev/null && echo "main" || echo "master"
+```