cokit-cli 1.3.0 → 1.4.0

package/skills/ck-repomix/SKILL.md

@@ -0,0 +1,248 @@
+---
+name: ck-repomix
+description: Pack repositories into AI-friendly files with Repomix (XML, Markdown, plain text). Use for codebase snapshots, LLM context preparation, security audits, third-party library analysis.
+argument-hint: "[path] [--style xml|markdown|plain|json]"
+---
+
+# Repomix Skill
+
+Repomix packs entire repositories into single, AI-friendly files. Perfect for feeding codebases to LLMs like Copilot, ChatGPT, and Gemini.
+
+## When to Use
+
+Use when:
+- Packaging codebases for AI analysis
+- Creating repository snapshots for LLM context
+- Analyzing third-party libraries
+- Preparing for security audits
+- Generating documentation context
+- Investigating bugs across large codebases
+- Creating AI-friendly code representations
+
+## Quick Start
+
+### Check Installation
+```bash
+repomix --version
+```
+
+### Install
+```bash
+# npm
+npm install -g repomix
+
+# Homebrew (macOS/Linux)
+brew install repomix
+```
+
+### Basic Usage
+```bash
+# Package current directory (generates repomix-output.xml)
+repomix
+
+# Specify output format
+repomix --style markdown
+repomix --style json
+
+# Package remote repository
+npx repomix --remote owner/repo
+
+# Custom output with filters
+repomix --include "src/**/*.ts" --remove-comments -o output.md
+```
+
+## Core Capabilities
+
+### Repository Packaging
+- AI-optimized formatting with clear separators
+- Multiple output formats: XML, Markdown, JSON, Plain text
+- Git-aware processing (respects .gitignore)
+- Token counting for LLM context management
+- Security checks for sensitive information
+
+### Remote Repository Support
+Process remote repositories without cloning:
+```bash
+# Shorthand
+npx repomix --remote yamadashy/repomix
+
+# Full URL
+npx repomix --remote https://github.com/owner/repo
+
+# Specific commit
+npx repomix --remote https://github.com/owner/repo/commit/hash
+```
+
+### Comment Removal
+Strip comments from supported languages (HTML, CSS, JavaScript, TypeScript, Vue, Svelte, Python, PHP, Ruby, C, C#, Java, Go, Rust, Swift, Kotlin, Dart, Shell, YAML):
+```bash
+repomix --remove-comments
+```
+
+## Common Use Cases
+
+### Code Review Preparation
+```bash
+# Package feature branch for AI review
+repomix --include "src/**/*.ts" --remove-comments -o review.md --style markdown
+```
+
+### Security Audit
+```bash
+# Package third-party library
+npx repomix --remote vendor/library --style xml -o audit.xml
+```
+
+### Documentation Generation
+```bash
+# Package with docs and code
+repomix --include "src/**,docs/**,*.md" --style markdown -o context.md
+```
+
+### Bug Investigation
+```bash
+# Package specific modules
+repomix --include "src/auth/**,src/api/**" -o debug-context.xml
+```
+
+### Implementation Planning
+```bash
+# Full codebase context
+repomix --remove-comments --copy
+```
+
+## Command Line Reference
+
+### File Selection
+```bash
+# Include specific patterns
+repomix --include "src/**/*.ts,*.md"
+
+# Ignore additional patterns
+repomix -i "tests/**,*.test.js"
+
+# Disable .gitignore rules
+repomix --no-gitignore
+```
+
+### Output Options
+```bash
+# Output format
+repomix --style markdown  # or xml, json, plain
+
+# Output file path
+repomix -o output.md
+
+# Remove comments
+repomix --remove-comments
+
+# Copy to clipboard
+repomix --copy
+```
+
+### Configuration
+```bash
+# Use custom config file
+repomix -c custom-config.json
+
+# Initialize new config
+repomix --init  # creates repomix.config.json
+```
+
+## Token Management
+
+Repomix automatically counts tokens for individual files, total repository, and per-format output.
+
+Typical LLM context limits:
+- Copilot: ~200K tokens
+- GPT-4: ~128K tokens
+- GPT-3.5: ~16K tokens
+
+### Token Count Optimization
+Understanding your codebase's token distribution is crucial for optimizing AI interactions. Use the --token-count-tree option to visualize token usage across your project:
+
+```bash
+repomix --token-count-tree
+```
+This displays a hierarchical view of your codebase with token counts:
+
+```
+🔢 Token Count Tree:
+────────────────────
+└── src/ (70,925 tokens)
+    ├── cli/ (12,714 tokens)
+    │   ├── actions/ (7,546 tokens)
+    │   └── reporters/ (990 tokens)
+    └── core/ (41,600 tokens)
+        ├── file/ (10,098 tokens)
+        └── output/ (5,808 tokens)
+```
+You can also set a minimum token threshold to focus on larger files:
+
+```bash
+repomix --token-count-tree 1000  # Only show files/directories with 1000+ tokens
+```
+
+This helps you:
+
+- Identify token-heavy files that might exceed AI context limits
+- Optimize file selection using --include and --ignore patterns
+- Plan compression strategies by targeting the largest contributors
+- Balance content vs. context when preparing code for AI analysis
+
+## Security Considerations
+
+Repomix uses Secretlint to detect sensitive data (API keys, passwords, credentials, private keys, AWS secrets).
+
+Best practices:
+1. Always review output before sharing
+2. Use `.repomixignore` for sensitive files
+3. Enable security checks for unknown codebases
+4. Avoid packaging `.env` files
+5. Check for hardcoded credentials
+
+Disable security checks if needed:
+```bash
+repomix --no-security-check
+```
+
+## Implementation Workflow
+
+When user requests repository packaging:
+
+1. **Assess Requirements**
+   - Identify target repository (local/remote)
+   - Determine output format needed
+   - Check for sensitive data concerns
+
+2. **Configure Filters**
+   - Set include patterns for relevant files
+   - Add ignore patterns for unnecessary files
+   - Enable/disable comment removal
+
+3. **Execute Packaging**
+   - Run repomix with appropriate options
+   - Monitor token counts
+   - Verify security checks
+
+4. **Validate Output**
+   - Review generated file
+   - Confirm no sensitive data
+   - Check token limits for target LLM
+
+5. **Deliver Context**
+   - Provide packaged file to user
+   - Include token count summary
+   - Note any warnings or issues
+
+## Reference Documentation
+
+For detailed information, see:
+- [Configuration Reference](./references/configuration.md) - Config files, include/exclude patterns, output formats, advanced options
+- [Usage Patterns](./references/usage-patterns.md) - AI analysis workflows, security audit preparation, documentation generation, library evaluation
+
+## Additional Resources
+
+- GitHub: https://github.com/yamadashy/repomix
+- Documentation: https://repomix.com/guide/
+- MCP Server: Available for AI assistant integration

package/skills/ck-research/SKILL.md

@@ -0,0 +1,172 @@
+---
+name: ck-research
+description: "Research technical solutions, analyze architectures, gather requirements thoroughly. Use for technology evaluation, best practices research, solution design, scalability/security/maintainability analysis."
+license: MIT
+argument-hint: "[topic]"
+---
+
+# Research
+
+## Research Methodology
+
+Always honoring **YAGNI**, **KISS**, and **DRY** principles.
+**Be honest, be brutal, straight to the point, and be concise.**
+
+### Phase 1: Scope Definition
+
+First, you will clearly define the research scope by:
+- Identifying key terms and concepts to investigate
+- Determining the recency requirements (how current must information be)
+- Establishing evaluation criteria for sources
+- Setting boundaries for the research depth
+
+### Phase 2: Systematic Information Gathering
+
+You will employ a multi-source research strategy:
+
+1. **Search Strategy**:
+   - **Gemini Toggle**: Check `.ck.json` (or `.ck.json`) for `skills.research.useGemini` (default: `true`). If `false`, skip Gemini and use WebSearch.
+   - **Gemini Model**: Read from `.ck.json`: `gemini.model` (default: `gemini-3-flash-preview`)
+   - If `useGemini` is enabled and `gemini` bash command is available, execute `gemini -y -m <gemini.model> "...your search prompt..."` bash command (timeout: 10 minutes) and save the output using `Report:` path from `## Naming` section (including all citations).
+   - If `useGemini` is disabled or `gemini` bash command is not available, use `WebSearch` tool.
+   - Run multiple `gemini` bash commands or `WebSearch` tools in parallel to search for relevant information.
+   - Craft precise search queries with relevant keywords
+   - Include terms like "best practices", "2024", "latest", "security", "performance"
+   - Search for official documentation, GitHub repositories, and authoritative blogs
+   - Prioritize results from recognized authorities (official docs, major tech companies, respected developers)
+   - **IMPORTANT:** You are allowed to perform at most **5 researches (max 5 tool calls)**, user might request less than this amount, **strictly respect it**, think carefully based on the task before performing each related research topic.
+
+2. **Deep Content Analysis**:
+   - When you found a potential Github repository URL, use `docs-seeker` skill to find read it.
+   - Focus on official documentation, API references, and technical specifications
+   - Analyze README files from popular GitHub repositories
+   - Review changelog and release notes for version-specific information
+
+3. **Video Content Research**:
+   - Prioritize content from official channels, recognized experts, and major conferences
+   - Focus on practical demonstrations and real-world implementations
+
+4. **Cross-Reference Validation**:
+   - Verify information across multiple independent sources
+   - Check publication dates to ensure currency
+   - Identify consensus vs. controversial approaches
+   - Note any conflicting information or debates in the community
+
+### Phase 3: Analysis and Synthesis
+
+You will analyze gathered information by:
+- Identifying common patterns and best practices
+- Evaluating pros and cons of different approaches
+- Assessing maturity and stability of technologies
+- Recognizing security implications and performance considerations
+- Determining compatibility and integration requirements
+
+### Phase 4: Report Generation
+
+**Notes:**
+- Research reports are saved using `Report:` path from `## Naming` section.
+- If `## Naming` section is not available, ask main agent to provide the output path.
+
+You will create a comprehensive markdown report with the following structure:
+
+```markdown
+# Research Report: [Topic]
+
+## Executive Summary
+[2-3 paragraph overview of key findings and recommendations]
+
+## Research Methodology
+- Sources consulted: [number]
+- Date range of materials: [earliest to most recent]
+- Key search terms used: [list]
+
+## Key Findings
+
+### 1. Technology Overview
+[Comprehensive description of the technology/topic]
+
+### 2. Current State & Trends
+[Latest developments, version information, adoption trends]
+
+### 3. Best Practices
+[Detailed list of recommended practices with explanations]
+
+### 4. Security Considerations
+[Security implications, vulnerabilities, and mitigation strategies]
+
+### 5. Performance Insights
+[Performance characteristics, optimization techniques, benchmarks]
+
+## Comparative Analysis
+[If applicable, comparison of different solutions/approaches]
+
+## Implementation Recommendations
+
+### Quick Start Guide
+[Step-by-step getting started instructions]
+
+### Code Examples
+[Relevant code snippets with explanations]
+
+### Common Pitfalls
+[Mistakes to avoid and their solutions]
+
+## Resources & References
+
+### Official Documentation
+- [Linked list of official docs]
+
+### Recommended Tutorials
+- [Curated list with descriptions]
+
+### Community Resources
+- [Forums, Discord servers, Stack Overflow tags]
+
+### Further Reading
+- [Advanced topics and deep dives]
+
+## Appendices
+
+### A. Glossary
+[Technical terms and definitions]
+
+### B. Version Compatibility Matrix
+[If applicable]
+
+### C. Raw Research Notes
+[Optional: detailed notes from research process]
+```
+
+## Quality Standards
+
+You will ensure all research meets these criteria:
+- **Accuracy**: Information is verified across multiple sources
+- **Currency**: Prioritize information from the last 12 months unless historical context is needed
+- **Completeness**: Cover all aspects requested by the user
+- **Actionability**: Provide practical, implementable recommendations
+- **Clarity**: Use clear language, define technical terms, provide examples
+- **Attribution**: Always cite sources and provide links for verification
+
+## Special Considerations
+
+- When researching security topics, always check for recent CVEs and security advisories
+- For performance-related research, look for benchmarks and real-world case studies
+- When investigating new technologies, assess community adoption and support levels
+- For API documentation, verify endpoint availability and authentication requirements
+- Always note deprecation warnings and migration paths for older technologies
+
+## Output Requirements
+**IMPORTANT:** Invoke "/ck-project-organization" skill to organize the outputs.
+
+Your final report must:
+1. Be saved using the `Report:` path from `## Naming` section with a descriptive filename
+2. Include a timestamp of when the research was conducted
+3. Provide clear section navigation with a table of contents for longer reports
+4. Use code blocks with appropriate syntax highlighting
+5. Include diagrams or architecture descriptions where helpful (in mermaid or ASCII art)
+6. Conclude with specific, actionable next steps
+
+**IMPORTANT:** Sacrifice grammar for the sake of concision when writing reports.
+**IMPORTANT:** In reports, list any unresolved questions at the end, if any.
+
+**Remember:** You are not just collecting information, but providing strategic technical intelligence that enables informed decision-making. Your research should anticipate follow-up questions and provide comprehensive coverage of the topic while remaining focused and practical.

package/skills/ck-scout/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: ck-scout
+description: "Fast codebase scouting using parallel agents. Use for file discovery, task context gathering, quick searches across directories. Supports internal (Explore) and external (Gemini/OpenCode) agents."
+argument-hint: "[search-target] [ext]"
+---
+
+# Scout
+
+Fast, token-efficient codebase scouting using parallel agents to find files needed for tasks.
+
+## Arguments
+- Default: Scout using built-in Explore subagents in parallel (`./references/internal-scouting.md`)
+- `ext`: Scout using external Gemini/OpenCode CLI tools in parallel (`./references/external-scouting.md`)
+
+## When to Use
+
+- Beginning work on feature spanning multiple directories
+- User mentions needing to "find", "locate", or "search for" files
+- Starting debugging session requiring file relationships understanding
+- User asks about project structure or where functionality lives
+- Before changes that might affect multiple codebase parts
+
+## Quick Start
+
+1. Analyze user prompt to identify search targets
+2. Use a wide range of Grep and Glob patterns to find relevant files and estimate scale of the codebase
+3. Spawn parallel agents with divided directories
+4. Collect results into concise report
+
+## Configuration
+
+Read from `.ck.json`:
+- `gemini.model` - Gemini model (default: `gemini-3-flash-preview`)
+
+## Workflow
+
+### 1. Analyze Task
+- Parse user prompt for search targets
+- Identify key directories, patterns, file types, lines of code
+- Determine optimal SCALE value of subagents to spawn
+
+### 2. Divide and Conquer
+- Split codebase into logical segments per agent
+- Assign each agent specific directories or patterns
+- Ensure no overlap, maximize coverage
+
+### 3. Register Scout Tasks
+- **Skip if:** Agent count ≤ 2 (overhead exceeds benefit)
+- **Skip if:** Task tools unavailable (VSCode extension) — use `TodoWrite` instead
+- `TaskList` first — check for existing scout tasks in session
+- If not found, `TaskCreate` per agent with scope metadata
+- See `references/task-management-scouting.md` for patterns and examples
+
+### 4. Spawn Parallel Agents
+Load appropriate reference based on decision tree:
+- **Internal (Default):** `references/internal-scouting.md` (Explore subagents)
+- **External:** `references/external-scouting.md` (Gemini/OpenCode)
+
+**Notes:**
+- `TaskUpdate` each task to `in_progress` before spawning its agent (skip if Task tools unavailable)
+- Prompt detailed instructions for each subagent with exact directories or files it should read
+- Remember that each subagent has less than 200K tokens of context window
+- Amount of subagents to-be-spawned depends on the current system resources available and amount of files to be scanned
+- Each subagent must return a detailed summary report to a main agent
+
+### 5. Collect Results
+**IMPORTANT:** Invoke "/ck-project-organization" skill to organize the outputs.
+
+- Timeout: 3 minutes per agent (skip non-responders)
+- `TaskUpdate` completed tasks; log timed-out agents in report (skip if Task tools unavailable)
+- Aggregate findings into single report
+- List unresolved questions at end
+
+## Report Format
+
+```markdown
+# Scout Report
+
+## Relevant Files
+- `path/to/file.ts` - Brief description
+- ...
+
+## Unresolved Questions
+- Any gaps in findings
+```
+
+## References
+
+- `references/internal-scouting.md` - Using Explore subagents
+- `references/external-scouting.md` - Using Gemini/OpenCode CLI
+- `references/task-management-scouting.md` - Task patterns for scout coordination

package/skills/ck-security/SKILL.md

@@ -0,0 +1,139 @@
+---
+name: ck-security
+description: "STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using ck:autoresearch pattern."
+argument-hint: "<scope glob or 'full'> [--fix] [--iterations N]"
+---
+
+# ck:security — Security Audit
+
+Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With `--fix`, applies fixes iteratively using the ck:autoresearch guard pattern.
+
+## When to Use
+
+- Before a release or major deployment
+- After adding auth, payment, or data-handling features
+- Periodic security review (monthly/quarterly)
+- Compliance check (SOC 2, GDPR, PCI-DSS prep)
+
+## When NOT to Use
+
+- Purely cosmetic changes (CSS, copy edits)
+- No user-facing code or data handling involved
+
+---
+
+## Modes
+
+| Mode | Invocation | Behavior |
+|------|-----------|----------|
+| Audit only | `/ck-security <scope>` | Scan → categorize → report |
+| Audit + Fix | `/ck-security <scope> --fix` | Scan → categorize → fix iteratively |
+| Bounded fix | `/ck-security <scope> --fix --iterations N` | Limit fix iterations to N |
+
+---
+
+## Audit Methodology
+
+### 1. Scope Resolution
+Expand the provided glob or `full` keyword into a file list. Read all in-scope files before analysis.
+
+### 2. STRIDE Analysis
+Evaluate each threat category systematically:
+- **S**poofing — identity/authentication weaknesses
+- **T**ampering — input validation, integrity controls
+- **R**epudiation — audit logging gaps
+- **I**nformation Disclosure — data leakage, secret exposure
+- **D**enial of Service — rate limits, resource exhaustion
+- **E**levation of Privilege — broken access control, RBAC gaps
+
+### 3. OWASP Top 10 Check
+Map findings to OWASP categories (A01–A10). See `references/stride-owasp-checklist.md` for per-category checks.
+
+### 4. Dependency Audit
+Run the appropriate package audit tool for the detected stack:
+- Node.js: `npm audit`
+- Python: `pip-audit`
+- Go: `govulncheck`
+- Ruby: `bundle audit`
+
+### 5. Secret Detection
+Scan for hardcoded API keys, passwords, tokens, and private keys using regex patterns. See `references/stride-owasp-checklist.md` → Secret Patterns.
+
+### 6. Finding Categorization
+Assign each finding a severity level (see Severity Definitions below).
+
+---
+
+## Output Format
+
+```
+## Security Audit Report
+
+### Summary
+- Files scanned: N
+- Findings: X critical, Y high, Z medium, W low, V info
+
+### Findings
+
+| # | Severity | Category | File:Line | Description | Fix Recommendation |
+|---|----------|----------|-----------|-------------|-------------------|
+| 1 | Critical  | Injection | api/users.ts:45 | SQL string concatenation | Use parameterized queries |
+| 2 | High      | Auth      | auth/login.ts:12 | No rate limiting | Add express-rate-limit |
+```
+
+---
+
+## Fix Mode (--fix)
+
+When `--fix` is provided, apply fixes iteratively after the audit:
+
+1. Sort all findings by severity (Critical → High → Medium → Low)
+2. For each finding:
+   a. Apply one targeted fix
+   b. Run guard (tests or lint) to verify no regression
+   c. Commit: `security(fix-N): <short description>`
+   d. Advance to next finding
+3. Stop early if guard fails — report the failure instead of proceeding
+4. Uses `autoresearch` guard pattern for regression prevention
+
+> Tip: Use `--iterations N` to cap total fix iterations when scope is large.
+
+---
+
+## Severity Definitions
+
+| Severity | Description | Fix Priority |
+|----------|-------------|-------------|
+| Critical | Exploitable now, data breach or RCE risk | Immediate — block release |
+| High | Exploitable with moderate effort, significant impact | This sprint |
+| Medium | Limited exploitability or impact | Next sprint |
+| Low | Theoretical risk, defense-in-depth improvement | Backlog |
+| Info | Best practice suggestion, no direct risk | Optional |
+
+---
+
+## Integration with Other Skills
+
+- Run after `predict` when the security persona flags concerns
+- Feed Critical/High findings into `ck:autoresearch --fix` for automated remediation
+- Use `scenario` with `--focus authorization` for deeper auth flow testing
+- Pair with `plan` to schedule Medium/Low findings as sprint tasks
+
+---
+
+## Example Invocations
+
+```bash
+# Audit API layer only
+/ck-security src/api/**/*.ts
+
+# Audit entire src/ and auto-fix, max 15 iterations
+/ck-security src/ --fix --iterations 15
+
+# Full codebase audit (no fix)
+/ck-security full
+```
+
+---
+
+See `references/stride-owasp-checklist.md` for the detailed per-category checklist and secret detection regex patterns.