cokit-cli 1.3.0 → 1.4.0

package/templates/repo/.github/skills/repomix/SKILL.md

@@ -1,248 +0,0 @@
----
-name: repomix
-description: Pack repositories into AI-friendly files with Repomix (XML, Markdown, plain text). Use for codebase snapshots, LLM context preparation, security audits, third-party library analysis.
-argument-hint: "[path] [--style xml|markdown|plain|json]"
----
-
-# Repomix Skill
-
-Repomix packs entire repositories into single, AI-friendly files. Perfect for feeding codebases to LLMs like Copilot, ChatGPT, and Gemini.
-
-## When to Use
-
-Use when:
-- Packaging codebases for AI analysis
-- Creating repository snapshots for LLM context
-- Analyzing third-party libraries
-- Preparing for security audits
-- Generating documentation context
-- Investigating bugs across large codebases
-- Creating AI-friendly code representations
-
-## Quick Start
-
-### Check Installation
-```bash
-repomix --version
-```
-
-### Install
-```bash
-# npm
-npm install -g repomix
-
-# Homebrew (macOS/Linux)
-brew install repomix
-```
-
-### Basic Usage
-```bash
-# Package current directory (generates repomix-output.xml)
-repomix
-
-# Specify output format
-repomix --style markdown
-repomix --style json
-
-# Package remote repository
-npx repomix --remote owner/repo
-
-# Custom output with filters
-repomix --include "src/**/*.ts" --remove-comments -o output.md
-```
-
-## Core Capabilities
-
-### Repository Packaging
-- AI-optimized formatting with clear separators
-- Multiple output formats: XML, Markdown, JSON, Plain text
-- Git-aware processing (respects .gitignore)
-- Token counting for LLM context management
-- Security checks for sensitive information
-
-### Remote Repository Support
-Process remote repositories without cloning:
-```bash
-# Shorthand
-npx repomix --remote yamadashy/repomix
-
-# Full URL
-npx repomix --remote https://github.com/owner/repo
-
-# Specific commit
-npx repomix --remote https://github.com/owner/repo/commit/hash
-```
-
-### Comment Removal
-Strip comments from supported languages (HTML, CSS, JavaScript, TypeScript, Vue, Svelte, Python, PHP, Ruby, C, C#, Java, Go, Rust, Swift, Kotlin, Dart, Shell, YAML):
-```bash
-repomix --remove-comments
-```
-
-## Common Use Cases
-
-### Code Review Preparation
-```bash
-# Package feature branch for AI review
-repomix --include "src/**/*.ts" --remove-comments -o review.md --style markdown
-```
-
-### Security Audit
-```bash
-# Package third-party library
-npx repomix --remote vendor/library --style xml -o audit.xml
-```
-
-### Documentation Generation
-```bash
-# Package with docs and code
-repomix --include "src/**,docs/**,*.md" --style markdown -o context.md
-```
-
-### Bug Investigation
-```bash
-# Package specific modules
-repomix --include "src/auth/**,src/api/**" -o debug-context.xml
-```
-
-### Implementation Planning
-```bash
-# Full codebase context
-repomix --remove-comments --copy
-```
-
-## Command Line Reference
-
-### File Selection
-```bash
-# Include specific patterns
-repomix --include "src/**/*.ts,*.md"
-
-# Ignore additional patterns
-repomix -i "tests/**,*.test.js"
-
-# Disable .gitignore rules
-repomix --no-gitignore
-```
-
-### Output Options
-```bash
-# Output format
-repomix --style markdown  # or xml, json, plain
-
-# Output file path
-repomix -o output.md
-
-# Remove comments
-repomix --remove-comments
-
-# Copy to clipboard
-repomix --copy
-```
-
-### Configuration
-```bash
-# Use custom config file
-repomix -c custom-config.json
-
-# Initialize new config
-repomix --init  # creates repomix.config.json
-```
-
-## Token Management
-
-Repomix automatically counts tokens for individual files, total repository, and per-format output.
-
-Typical LLM context limits:
-- Copilot: ~200K tokens
-- GPT-4: ~128K tokens
-- GPT-3.5: ~16K tokens
-
-### Token Count Optimization
-Understanding your codebase's token distribution is crucial for optimizing AI interactions. Use the --token-count-tree option to visualize token usage across your project:
-
-```bash
-repomix --token-count-tree
-```
-This displays a hierarchical view of your codebase with token counts:
-
-```
-🔢 Token Count Tree:
-────────────────────
-└── src/ (70,925 tokens)
-    ├── cli/ (12,714 tokens)
-    │   ├── actions/ (7,546 tokens)
-    │   └── reporters/ (990 tokens)
-    └── core/ (41,600 tokens)
-        ├── file/ (10,098 tokens)
-        └── output/ (5,808 tokens)
-```
-You can also set a minimum token threshold to focus on larger files:
-
-```bash
-repomix --token-count-tree 1000  # Only show files/directories with 1000+ tokens
-```
-
-This helps you:
-
-- Identify token-heavy files that might exceed AI context limits
-- Optimize file selection using --include and --ignore patterns
-- Plan compression strategies by targeting the largest contributors
-- Balance content vs. context when preparing code for AI analysis
-
-## Security Considerations
-
-Repomix uses Secretlint to detect sensitive data (API keys, passwords, credentials, private keys, AWS secrets).
-
-Best practices:
-1. Always review output before sharing
-2. Use `.repomixignore` for sensitive files
-3. Enable security checks for unknown codebases
-4. Avoid packaging `.env` files
-5. Check for hardcoded credentials
-
-Disable security checks if needed:
-```bash
-repomix --no-security-check
-```
-
-## Implementation Workflow
-
-When user requests repository packaging:
-
-1. **Assess Requirements**
-   - Identify target repository (local/remote)
-   - Determine output format needed
-   - Check for sensitive data concerns
-
-2. **Configure Filters**
-   - Set include patterns for relevant files
-   - Add ignore patterns for unnecessary files
-   - Enable/disable comment removal
-
-3. **Execute Packaging**
-   - Run repomix with appropriate options
-   - Monitor token counts
-   - Verify security checks
-
-4. **Validate Output**
-   - Review generated file
-   - Confirm no sensitive data
-   - Check token limits for target LLM
-
-5. **Deliver Context**
-   - Provide packaged file to user
-   - Include token count summary
-   - Note any warnings or issues
-
-## Reference Documentation
-
-For detailed information, see:
-- [Configuration Reference](./references/configuration.md) - Config files, include/exclude patterns, output formats, advanced options
-- [Usage Patterns](./references/usage-patterns.md) - AI analysis workflows, security audit preparation, documentation generation, library evaluation
-
-## Additional Resources
-
-- GitHub: https://github.com/yamadashy/repomix
-- Documentation: https://repomix.com/guide/
-- MCP Server: Available for AI assistant integration

package/templates/repo/.github/skills/research/SKILL.md

@@ -1,172 +0,0 @@
----
-name: research
-description: "Research technical solutions, analyze architectures, gather requirements thoroughly. Use for technology evaluation, best practices research, solution design, scalability/security/maintainability analysis."
-license: MIT
-argument-hint: "[topic]"
----
-
-# Research
-
-## Research Methodology
-
-Always honoring **YAGNI**, **KISS**, and **DRY** principles.
-**Be honest, be brutal, straight to the point, and be concise.**
-
-### Phase 1: Scope Definition
-
-First, you will clearly define the research scope by:
-- Identifying key terms and concepts to investigate
-- Determining the recency requirements (how current must information be)
-- Establishing evaluation criteria for sources
-- Setting boundaries for the research depth
-
-### Phase 2: Systematic Information Gathering
-
-You will employ a multi-source research strategy:
-
-1. **Search Strategy**:
-   - **Gemini Toggle**: Check `.ck.json` (or `.ck.json`) for `skills.research.useGemini` (default: `true`). If `false`, skip Gemini and use WebSearch.
-   - **Gemini Model**: Read from `.ck.json`: `gemini.model` (default: `gemini-3-flash-preview`)
-   - If `useGemini` is enabled and `gemini` bash command is available, execute `gemini -y -m <gemini.model> "...your search prompt..."` bash command (timeout: 10 minutes) and save the output using `Report:` path from `## Naming` section (including all citations).
-   - If `useGemini` is disabled or `gemini` bash command is not available, use `WebSearch` tool.
-   - Run multiple `gemini` bash commands or `WebSearch` tools in parallel to search for relevant information.
-   - Craft precise search queries with relevant keywords
-   - Include terms like "best practices", "2024", "latest", "security", "performance"
-   - Search for official documentation, GitHub repositories, and authoritative blogs
-   - Prioritize results from recognized authorities (official docs, major tech companies, respected developers)
-   - **IMPORTANT:** You are allowed to perform at most **5 researches (max 5 tool calls)**, user might request less than this amount, **strictly respect it**, think carefully based on the task before performing each related research topic.
-
-2. **Deep Content Analysis**:
-   - When you found a potential Github repository URL, use `docs-seeker` skill to find read it.
-   - Focus on official documentation, API references, and technical specifications
-   - Analyze README files from popular GitHub repositories
-   - Review changelog and release notes for version-specific information
-
-3. **Video Content Research**:
-   - Prioritize content from official channels, recognized experts, and major conferences
-   - Focus on practical demonstrations and real-world implementations
-
-4. **Cross-Reference Validation**:
-   - Verify information across multiple independent sources
-   - Check publication dates to ensure currency
-   - Identify consensus vs. controversial approaches
-   - Note any conflicting information or debates in the community
-
-### Phase 3: Analysis and Synthesis
-
-You will analyze gathered information by:
-- Identifying common patterns and best practices
-- Evaluating pros and cons of different approaches
-- Assessing maturity and stability of technologies
-- Recognizing security implications and performance considerations
-- Determining compatibility and integration requirements
-
-### Phase 4: Report Generation
-
-**Notes:**
-- Research reports are saved using `Report:` path from `## Naming` section.
-- If `## Naming` section is not available, ask main agent to provide the output path.
-
-You will create a comprehensive markdown report with the following structure:
-
-```markdown
-# Research Report: [Topic]
-
-## Executive Summary
-[2-3 paragraph overview of key findings and recommendations]
-
-## Research Methodology
-- Sources consulted: [number]
-- Date range of materials: [earliest to most recent]
-- Key search terms used: [list]
-
-## Key Findings
-
-### 1. Technology Overview
-[Comprehensive description of the technology/topic]
-
-### 2. Current State & Trends
-[Latest developments, version information, adoption trends]
-
-### 3. Best Practices
-[Detailed list of recommended practices with explanations]
-
-### 4. Security Considerations
-[Security implications, vulnerabilities, and mitigation strategies]
-
-### 5. Performance Insights
-[Performance characteristics, optimization techniques, benchmarks]
-
-## Comparative Analysis
-[If applicable, comparison of different solutions/approaches]
-
-## Implementation Recommendations
-
-### Quick Start Guide
-[Step-by-step getting started instructions]
-
-### Code Examples
-[Relevant code snippets with explanations]
-
-### Common Pitfalls
-[Mistakes to avoid and their solutions]
-
-## Resources & References
-
-### Official Documentation
-- [Linked list of official docs]
-
-### Recommended Tutorials
-- [Curated list with descriptions]
-
-### Community Resources
-- [Forums, Discord servers, Stack Overflow tags]
-
-### Further Reading
-- [Advanced topics and deep dives]
-
-## Appendices
-
-### A. Glossary
-[Technical terms and definitions]
-
-### B. Version Compatibility Matrix
-[If applicable]
-
-### C. Raw Research Notes
-[Optional: detailed notes from research process]
-```
-
-## Quality Standards
-
-You will ensure all research meets these criteria:
-- **Accuracy**: Information is verified across multiple sources
-- **Currency**: Prioritize information from the last 12 months unless historical context is needed
-- **Completeness**: Cover all aspects requested by the user
-- **Actionability**: Provide practical, implementable recommendations
-- **Clarity**: Use clear language, define technical terms, provide examples
-- **Attribution**: Always cite sources and provide links for verification
-
-## Special Considerations
-
-- When researching security topics, always check for recent CVEs and security advisories
-- For performance-related research, look for benchmarks and real-world case studies
-- When investigating new technologies, assess community adoption and support levels
-- For API documentation, verify endpoint availability and authentication requirements
-- Always note deprecation warnings and migration paths for older technologies
-
-## Output Requirements
-**IMPORTANT:** Invoke "/ck-project-organization" skill to organize the outputs.
-
-Your final report must:
-1. Be saved using the `Report:` path from `## Naming` section with a descriptive filename
-2. Include a timestamp of when the research was conducted
-3. Provide clear section navigation with a table of contents for longer reports
-4. Use code blocks with appropriate syntax highlighting
-5. Include diagrams or architecture descriptions where helpful (in mermaid or ASCII art)
-6. Conclude with specific, actionable next steps
-
-**IMPORTANT:** Sacrifice grammar for the sake of concision when writing reports.
-**IMPORTANT:** In reports, list any unresolved questions at the end, if any.
-
-**Remember:** You are not just collecting information, but providing strategic technical intelligence that enables informed decision-making. Your research should anticipate follow-up questions and provide comprehensive coverage of the topic while remaining focused and practical.

package/templates/repo/.github/skills/scout/SKILL.md

@@ -1,91 +0,0 @@
----
-name: scout
-description: "Fast codebase scouting using parallel agents. Use for file discovery, task context gathering, quick searches across directories. Supports internal (Explore) and external (Gemini/OpenCode) agents."
-argument-hint: "[search-target] [ext]"
----
-
-# Scout
-
-Fast, token-efficient codebase scouting using parallel agents to find files needed for tasks.
-
-## Arguments
-- Default: Scout using built-in Explore subagents in parallel (`./references/internal-scouting.md`)
-- `ext`: Scout using external Gemini/OpenCode CLI tools in parallel (`./references/external-scouting.md`)
-
-## When to Use
-
-- Beginning work on feature spanning multiple directories
-- User mentions needing to "find", "locate", or "search for" files
-- Starting debugging session requiring file relationships understanding
-- User asks about project structure or where functionality lives
-- Before changes that might affect multiple codebase parts
-
-## Quick Start
-
-1. Analyze user prompt to identify search targets
-2. Use a wide range of Grep and Glob patterns to find relevant files and estimate scale of the codebase
-3. Spawn parallel agents with divided directories
-4. Collect results into concise report
-
-## Configuration
-
-Read from `.ck.json`:
-- `gemini.model` - Gemini model (default: `gemini-3-flash-preview`)
-
-## Workflow
-
-### 1. Analyze Task
-- Parse user prompt for search targets
-- Identify key directories, patterns, file types, lines of code
-- Determine optimal SCALE value of subagents to spawn
-
-### 2. Divide and Conquer
-- Split codebase into logical segments per agent
-- Assign each agent specific directories or patterns
-- Ensure no overlap, maximize coverage
-
-### 3. Register Scout Tasks
-- **Skip if:** Agent count ≤ 2 (overhead exceeds benefit)
-- **Skip if:** Task tools unavailable (VSCode extension) — use `TodoWrite` instead
-- `TaskList` first — check for existing scout tasks in session
-- If not found, `TaskCreate` per agent with scope metadata
-- See `references/task-management-scouting.md` for patterns and examples
-
-### 4. Spawn Parallel Agents
-Load appropriate reference based on decision tree:
-- **Internal (Default):** `references/internal-scouting.md` (Explore subagents)
-- **External:** `references/external-scouting.md` (Gemini/OpenCode)
-
-**Notes:**
-- `TaskUpdate` each task to `in_progress` before spawning its agent (skip if Task tools unavailable)
-- Prompt detailed instructions for each subagent with exact directories or files it should read
-- Remember that each subagent has less than 200K tokens of context window
-- Amount of subagents to-be-spawned depends on the current system resources available and amount of files to be scanned
-- Each subagent must return a detailed summary report to a main agent
-
-### 5. Collect Results
-**IMPORTANT:** Invoke "/ck-project-organization" skill to organize the outputs.
-
-- Timeout: 3 minutes per agent (skip non-responders)
-- `TaskUpdate` completed tasks; log timed-out agents in report (skip if Task tools unavailable)
-- Aggregate findings into single report
-- List unresolved questions at end
-
-## Report Format
-
-```markdown
-# Scout Report
-
-## Relevant Files
-- `path/to/file.ts` - Brief description
-- ...
-
-## Unresolved Questions
-- Any gaps in findings
-```
-
-## References
-
-- `references/internal-scouting.md` - Using Explore subagents
-- `references/external-scouting.md` - Using Gemini/OpenCode CLI
-- `references/task-management-scouting.md` - Task patterns for scout coordination

package/templates/repo/.github/skills/security/SKILL.md

@@ -1,139 +0,0 @@
----
-name: security
-description: "STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using ck:autoresearch pattern."
-argument-hint: "<scope glob or 'full'> [--fix] [--iterations N]"
----
-
-# ck:security — Security Audit
-
-Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With `--fix`, applies fixes iteratively using the ck:autoresearch guard pattern.
-
-## When to Use
-
-- Before a release or major deployment
-- After adding auth, payment, or data-handling features
-- Periodic security review (monthly/quarterly)
-- Compliance check (SOC 2, GDPR, PCI-DSS prep)
-
-## When NOT to Use
-
-- Purely cosmetic changes (CSS, copy edits)
-- No user-facing code or data handling involved
-
----
-
-## Modes
-
-| Mode | Invocation | Behavior |
-|------|-----------|----------|
-| Audit only | `/ck-security <scope>` | Scan → categorize → report |
-| Audit + Fix | `/ck-security <scope> --fix` | Scan → categorize → fix iteratively |
-| Bounded fix | `/ck-security <scope> --fix --iterations N` | Limit fix iterations to N |
-
----
-
-## Audit Methodology
-
-### 1. Scope Resolution
-Expand the provided glob or `full` keyword into a file list. Read all in-scope files before analysis.
-
-### 2. STRIDE Analysis
-Evaluate each threat category systematically:
-- **S**poofing — identity/authentication weaknesses
-- **T**ampering — input validation, integrity controls
-- **R**epudiation — audit logging gaps
-- **I**nformation Disclosure — data leakage, secret exposure
-- **D**enial of Service — rate limits, resource exhaustion
-- **E**levation of Privilege — broken access control, RBAC gaps
-
-### 3. OWASP Top 10 Check
-Map findings to OWASP categories (A01–A10). See `references/stride-owasp-checklist.md` for per-category checks.
-
-### 4. Dependency Audit
-Run the appropriate package audit tool for the detected stack:
-- Node.js: `npm audit`
-- Python: `pip-audit`
-- Go: `govulncheck`
-- Ruby: `bundle audit`
-
-### 5. Secret Detection
-Scan for hardcoded API keys, passwords, tokens, and private keys using regex patterns. See `references/stride-owasp-checklist.md` → Secret Patterns.
-
-### 6. Finding Categorization
-Assign each finding a severity level (see Severity Definitions below).
-
----
-
-## Output Format
-
-```
-## Security Audit Report
-
-### Summary
-- Files scanned: N
-- Findings: X critical, Y high, Z medium, W low, V info
-
-### Findings
-
-| # | Severity | Category | File:Line | Description | Fix Recommendation |
-|---|----------|----------|-----------|-------------|-------------------|
-| 1 | Critical  | Injection | api/users.ts:45 | SQL string concatenation | Use parameterized queries |
-| 2 | High      | Auth      | auth/login.ts:12 | No rate limiting | Add express-rate-limit |
-```
-
----
-
-## Fix Mode (--fix)
-
-When `--fix` is provided, apply fixes iteratively after the audit:
-
-1. Sort all findings by severity (Critical → High → Medium → Low)
-2. For each finding:
-   a. Apply one targeted fix
-   b. Run guard (tests or lint) to verify no regression
-   c. Commit: `security(fix-N): <short description>`
-   d. Advance to next finding
-3. Stop early if guard fails — report the failure instead of proceeding
-4. Uses `autoresearch` guard pattern for regression prevention
-
-> Tip: Use `--iterations N` to cap total fix iterations when scope is large.
-
----
-
-## Severity Definitions
-
-| Severity | Description | Fix Priority |
-|----------|-------------|-------------|
-| Critical | Exploitable now, data breach or RCE risk | Immediate — block release |
-| High | Exploitable with moderate effort, significant impact | This sprint |
-| Medium | Limited exploitability or impact | Next sprint |
-| Low | Theoretical risk, defense-in-depth improvement | Backlog |
-| Info | Best practice suggestion, no direct risk | Optional |
-
----
-
-## Integration with Other Skills
-
-- Run after `predict` when the security persona flags concerns
-- Feed Critical/High findings into `ck:autoresearch --fix` for automated remediation
-- Use `scenario` with `--focus authorization` for deeper auth flow testing
-- Pair with `plan` to schedule Medium/Low findings as sprint tasks
-
----
-
-## Example Invocations
-
-```bash
-# Audit API layer only
-/ck-security src/api/**/*.ts
-
-# Audit entire src/ and auto-fix, max 15 iterations
-/ck-security src/ --fix --iterations 15
-
-# Full codebase audit (no fix)
-/ck-security full
-```
-
----
-
-See `references/stride-owasp-checklist.md` for the detailed per-category checklist and secret detection regex patterns.