create-vasvibe 2.4.0 → 2.5.0

package/template/schemas/security-standards.template.md

@@ -1,58 +1,58 @@
-# SECURITY STANDARDS — [Project Name]
-
-**Owner Agent:** Security Expert (Mode Standards)
-**Date:** [YYYY-MM-DD HH:MM]
-**Phase:** Planning
-**Status:** `Draft` / `Approved`
-
-> Acuan standar keamanan proyek yang ditetapkan di awal. Semua engineer WAJIB mengikuti. Diverifikasi ulang oleh Security di fase Hardening. Perubahan lewat `_shared/change-management.md`.
-
----
-
-## 1. Authentication & Authorization
-
-- **Auth mechanism:** [JWT / session / OAuth2 — pilih dan jelaskan]
-- **Password policy:** [hashing algo (bcrypt/argon2), min length, complexity]
-- **Token expiry:** [access token TTL, refresh token strategy]
-- **Authorization model:** [RBAC / ABAC — daftar role dan permission]
-
-## 2. Data Protection
-
-- **Encryption in transit:** TLS 1.2+ wajib
-- **Encryption at rest:** [field/tabel yang dienkripsi]
-- **PII handling:** [masking, minimization]
-- **Secrets management:** semua via env var, JANGAN hardcode; daftarkan di `.env.example`
-
-## 3. Input Validation & Output Encoding
-
-- Validasi semua input di server-side
-- Parameterized queries (anti SQL injection)
-- Output encoding (anti XSS)
-
-## 4. Security Headers & Config
-
-- CSP, HSTS, X-Frame-Options, X-Content-Type-Options
-- CORS policy: [origin yang diizinkan]
-- Rate limiting: [batas per endpoint sensitif]
-
-## 5. Compliance Requirements
-
-- [GDPR / UU PDP / PCI-DSS — jika relevan]
-
-## 6. Threat Model Summary
-
-[Threat utama yang diantisipasi sejak desain — referensi ke STRIDE jika sudah ada threat model.]
-
-## 7. Security Acceptance Criteria
-
-Checklist yang harus lulus sebelum release (diverifikasi Security di Hardening):
-- [ ] Tidak ada hardcoded secret
-- [ ] Semua endpoint ter-proteksi authz
-- [ ] Dependency bebas CVE critical/high
-- [ ] OWASP Top 10 ter-review
-
-## Revision History
-
-| Timestamp | Agen | Perubahan |
-|-----------|------|-----------|
-| [YYYY-MM-DD HH:MM] | Security | Initial security standards |
+# SECURITY STANDARDS — [Project Name]
+
+**Owner Agent:** Security Expert (Mode Standards)
+**Date:** [YYYY-MM-DD HH:MM]
+**Phase:** Planning
+**Status:** `Draft` / `Approved`
+
+> Acuan standar keamanan proyek yang ditetapkan di awal. Semua engineer WAJIB mengikuti. Diverifikasi ulang oleh Security di fase Hardening. Perubahan lewat `_shared/change-management.md`.
+
+---
+
+## 1. Authentication & Authorization
+
+- **Auth mechanism:** [JWT / session / OAuth2 — pilih dan jelaskan]
+- **Password policy:** [hashing algo (bcrypt/argon2), min length, complexity]
+- **Token expiry:** [access token TTL, refresh token strategy]
+- **Authorization model:** [RBAC / ABAC — daftar role dan permission]
+
+## 2. Data Protection
+
+- **Encryption in transit:** TLS 1.2+ wajib
+- **Encryption at rest:** [field/tabel yang dienkripsi]
+- **PII handling:** [masking, minimization]
+- **Secrets management:** semua via env var, JANGAN hardcode; daftarkan di `.env.example`
+
+## 3. Input Validation & Output Encoding
+
+- Validasi semua input di server-side
+- Parameterized queries (anti SQL injection)
+- Output encoding (anti XSS)
+
+## 4. Security Headers & Config
+
+- CSP, HSTS, X-Frame-Options, X-Content-Type-Options
+- CORS policy: [origin yang diizinkan]
+- Rate limiting: [batas per endpoint sensitif]
+
+## 5. Compliance Requirements
+
+- [GDPR / UU PDP / PCI-DSS — jika relevan]
+
+## 6. Threat Model Summary
+
+[Threat utama yang diantisipasi sejak desain — referensi ke STRIDE jika sudah ada threat model.]
+
+## 7. Security Acceptance Criteria
+
+Checklist yang harus lulus sebelum release (diverifikasi Security di Hardening):
+- [ ] Tidak ada hardcoded secret
+- [ ] Semua endpoint ter-proteksi authz
+- [ ] Dependency bebas CVE critical/high
+- [ ] OWASP Top 10 ter-review
+
+## Revision History
+
+| Timestamp | Agen | Perubahan |
+|-----------|------|-----------|
+| [YYYY-MM-DD HH:MM] | Security | Initial security standards |

package/template/schemas/security_report.template.md

@@ -1,89 +1,89 @@
-# SECURITY REPORT - [TASK-ID / SCOPE]
-
-**Date:** [YYYY-MM-DD HH:MM]
-**Agent:** Security Expert Agent
-**Scope:** [Deskripsi scope yang diaudit — misal: "Fitur Login & Auth", "Seluruh codebase", "v1.2.0 release"]
-**Mode:** [A: Threat Model / B: Vulnerability Scan / C: Security Fix / D: Pre-release Audit]
-
----
-
-## Executive Summary
-
-[Ringkasan singkat — apa yang diaudit, berapa temuan, dan rekomendasi utama.]
-
-**Overall Risk Level:** `CRITICAL` / `HIGH` / `MEDIUM` / `LOW` / `CLEAR`
-
----
-
-## Findings
-
-### CRITICAL
-| # | Vulnerability | Location | Description | Recommendation |
-|---|---------------|----------|-------------|----------------|
-| 1 | | | | |
-
-### HIGH
-| # | Vulnerability | Location | Description | Recommendation |
-|---|---------------|----------|-------------|----------------|
-| 1 | | | | |
-
-### MEDIUM
-| # | Vulnerability | Location | Description | Recommendation |
-|---|---------------|----------|-------------|----------------|
-| 1 | | | | |
-
-### LOW / INFO
-| # | Vulnerability | Location | Description | Recommendation |
-|---|---------------|----------|-------------|----------------|
-| 1 | | | | |
-
----
-
-## OWASP Top 10 Checklist
-
-- [ ] A01: Broken Access Control
-- [ ] A02: Cryptographic Failures
-- [ ] A03: Injection (SQL, XSS, Command)
-- [ ] A04: Insecure Design
-- [ ] A05: Security Misconfiguration
-- [ ] A06: Vulnerable & Outdated Components
-- [ ] A07: Authentication & Session Failures
-- [ ] A08: Software & Data Integrity Failures
-- [ ] A09: Security Logging & Monitoring Failures
-- [ ] A10: Server-Side Request Forgery (SSRF)
-
----
-
-## Dependency Scan Results
-
-```
-[Output dari npm audit / pip audit / bundle audit]
-```
-
-**Vulnerable packages found:** [X critical, Y high, Z moderate]
-
----
-
-## Secrets Scan Results
-
-- [ ] No hardcoded credentials found
-- [ ] No API keys in source code
-- [ ] `.env.example` does not contain real values
-- [ ] `.gitignore` covers all `.env` variants
-
----
-
-## Fixes Applied
-
-| # | Vulnerability | Fix Description | Files Changed | Timestamp |
-|---|---------------|-----------------|---------------|-----------|
-| 1 | | | | |
-
----
-
-## Sign-off
-
-- **Status:** `Pending Fix` / `All Clear` / `Conditional Approval`
-- **Remaining Issues:** [Daftar temuan yang belum di-fix dan alasannya — misal: "MEDIUM-1: accepted risk, ditangani di sprint berikutnya"]
-- **Next Action:** [Fix CRITICAL-1 sebelum deploy / Ready for release / dll]
-- **Reviewed By:** [Security Agent + Human approval jika sudah di-review]
+# SECURITY REPORT - [TASK-ID / SCOPE]
+
+**Date:** [YYYY-MM-DD HH:MM]
+**Agent:** Security Expert Agent
+**Scope:** [Deskripsi scope yang diaudit — misal: "Fitur Login & Auth", "Seluruh codebase", "v1.2.0 release"]
+**Mode:** [A: Threat Model / B: Vulnerability Scan / C: Security Fix / D: Pre-release Audit]
+
+---
+
+## Executive Summary
+
+[Ringkasan singkat — apa yang diaudit, berapa temuan, dan rekomendasi utama.]
+
+**Overall Risk Level:** `CRITICAL` / `HIGH` / `MEDIUM` / `LOW` / `CLEAR`
+
+---
+
+## Findings
+
+### CRITICAL
+| # | Vulnerability | Location | Description | Recommendation |
+|---|---------------|----------|-------------|----------------|
+| 1 | | | | |
+
+### HIGH
+| # | Vulnerability | Location | Description | Recommendation |
+|---|---------------|----------|-------------|----------------|
+| 1 | | | | |
+
+### MEDIUM
+| # | Vulnerability | Location | Description | Recommendation |
+|---|---------------|----------|-------------|----------------|
+| 1 | | | | |
+
+### LOW / INFO
+| # | Vulnerability | Location | Description | Recommendation |
+|---|---------------|----------|-------------|----------------|
+| 1 | | | | |
+
+---
+
+## OWASP Top 10 Checklist
+
+- [ ] A01: Broken Access Control
+- [ ] A02: Cryptographic Failures
+- [ ] A03: Injection (SQL, XSS, Command)
+- [ ] A04: Insecure Design
+- [ ] A05: Security Misconfiguration
+- [ ] A06: Vulnerable & Outdated Components
+- [ ] A07: Authentication & Session Failures
+- [ ] A08: Software & Data Integrity Failures
+- [ ] A09: Security Logging & Monitoring Failures
+- [ ] A10: Server-Side Request Forgery (SSRF)
+
+---
+
+## Dependency Scan Results
+
+```
+[Output dari npm audit / pip audit / bundle audit]
+```
+
+**Vulnerable packages found:** [X critical, Y high, Z moderate]
+
+---
+
+## Secrets Scan Results
+
+- [ ] No hardcoded credentials found
+- [ ] No API keys in source code
+- [ ] `.env.example` does not contain real values
+- [ ] `.gitignore` covers all `.env` variants
+
+---
+
+## Fixes Applied
+
+| # | Vulnerability | Fix Description | Files Changed | Timestamp |
+|---|---------------|-----------------|---------------|-----------|
+| 1 | | | | |
+
+---
+
+## Sign-off
+
+- **Status:** `Pending Fix` / `All Clear` / `Conditional Approval`
+- **Remaining Issues:** [Daftar temuan yang belum di-fix dan alasannya — misal: "MEDIUM-1: accepted risk, ditangani di sprint berikutnya"]
+- **Next Action:** [Fix CRITICAL-1 sebelum deploy / Ready for release / dll]
+- **Reviewed By:** [Security Agent + Human approval jika sudah di-review]

package/template/schemas/specification.template.md

@@ -1,71 +1,57 @@
-# SPEC-XXX: [Feature Name]
-
-## Metadata
-- **Author:** Analyst Agent
-- **Created:** [YYYY-MM-DD]
-- **Status:** draft | review | approved
-- **Depends on:** SPEC-YYY
-
-## User Story
-Sebagai [role konkret], saya ingin [action], sehingga [benefit].
-
-## Non-Goals / Out of Scope
-Daftar eksplisit apa yang TIDAK dikerjakan fitur ini (pagar ruang lingkup untuk developer).
-- ...
-
-## Technical Flow
-1. [Langkah 1 — satu aktor + satu aksi, contoh: User submit form login]
-2. [Langkah 2 — contoh: Backend validasi credentials]
-3. [Langkah 3 — contoh: Return JWT token]
-
-## Acceptance Criteria
-Format Given/When/Then, tiap kriteria binary (lulus/gagal). Wajib mencakup happy path & failure path.
-- [ ] **Given** ... **When** ... **Then** ...
-- [ ] **Given** ... **When** ... **Then** ...
-
-## API Contract
-### [METHOD] /api/v1/endpoint
-- **Auth:** [public | Bearer JWT | ...]
-- **Success status:** [200 | 201 | ...]
-
-**Request** — setiap field: `nama` (casing sesuai konvensi project) · tipe · required? · constraint
-| Field | Type | Required | Constraint |
-|-------|------|----------|------------|
-| ... | ... | ... | ... |
-
-```json
-{ "contoh": "nilai nyata, bukan kosong" }
-```
-**Response (Success):**
-```json
-{ "contoh": "nilai nyata" }
-```
-**Response (Error)** — enumerasi setiap kondisi (HTTP status + kode error):
-| HTTP | Error Code | Kapan terjadi |
-|------|-----------|---------------|
-| 400 | VALIDATION_ERROR | ... |
-| 401 | ... | ... |
-
-## Database Changes
-Tabel/kolom/index baru — nama, tipe, nullability, default (harus cocok dengan `state/knowledge_base/data-model/`) — atau tulis "None".
-
-## UI/UX
-Rujuk komponen dari `state/knowledge_base/design-system/` dengan nama persis; sertakan state kosong/loading/error — atau tulis "None".
-
-## Edge Cases & Validation
-Aturan validasi per field (batas, format, required/optional) + pesan/kode error persis.
-- [ ] ...
-
----
-
-## Human Approval
-
-**Human Approval Status:** pending | approved | revision_requested
-
-**Human Feedback:**
-> (Kosongkan jika belum ada feedback. Analyst Agent akan mengisi berdasarkan masukan reviewer.)
-
-## Revision History
-| Date | Author | Changes |
-|------|--------|---------|
-| [YYYY-MM-DD] | Analyst Agent | Initial draft |
+# SPEC-XXX: [Feature Name]
+
+## Metadata
+- **Author:** Analyst Agent
+- **Created:** [YYYY-MM-DD]
+- **Status:** draft | review | approved
+- **Depends on:** SPEC-YYY
+
+## User Story
+Sebagai [role], saya ingin [action], sehingga [benefit].
+
+## Technical Flow
+1. [Langkah 1 — contoh: User submit form login]
+2. [Langkah 2 — contoh: Backend validasi credentials]
+3. [Langkah 3 — contoh: Return JWT token]
+
+## Acceptance Criteria
+- [ ] ...
+- [ ] ...
+
+## API Contract
+### [METHOD] /api/endpoint
+**Request:**
+```json
+{}
+```
+**Response (200):**
+```json
+{}
+```
+**Response (Error):**
+```json
+{}
+```
+
+## Database Changes
+(Tabel baru, kolom baru, atau index yang dibutuhkan — atau tulis "None")
+
+## UI/UX
+(Screenshot mockup, deskripsi komponen, atau link ke desain — atau tulis "None")
+
+## Edge Cases & Validation
+- [ ] ...
+
+---
+
+## Human Approval
+
+**Human Approval Status:** pending | approved | revision_requested
+
+**Human Feedback:**
+> (Kosongkan jika belum ada feedback. Analyst Agent akan mengisi berdasarkan masukan reviewer.)
+
+## Revision History
+| Date | Author | Changes |
+|------|--------|---------|
+| [YYYY-MM-DD] | Analyst Agent | Initial draft |

package/template/schemas/style_guide.template.md

@@ -1,29 +1,29 @@
-# Project Style Guide & Architecture Constraints
-
-## 1. Naming Conventions
-- **Files/Folders:** `kebab-case` (misal: `user-profile.tsx`, `auth-service.ts`)
-- **Variables/Functions:** `camelCase` (misal: `getUserProfile()`)
-- **Classes/Interfaces:** `PascalCase` (misal: `class UserProfile`, `interface AuthConfig`)
-- **Constants/Enums:** `UPPER_SNAKE_CASE` (misal: `MAX_RETRY_COUNT = 3`)
-
-## 2. Directory Structure (`codes/`)
-- `src/components/` → UI Components (Dumb/Presentational)
-- `src/pages/` atau `app/` → Route-level components
-- `src/services/` → API calls, logic database, atau external services
-- `src/utils/` → Helper functions murni
-- `src/types/` → Type definitions (TypeScript)
-
-## 3. Security Guidelines
-- **TIDAK BOLEH** hardcode API Keys, secrets, tokens, atau password ke dalam source code.
-- Selalu gunakan `process.env.VARIABLE_NAME` (Node/Next) atau setara, dan catat keys yang dibutuhkan di `.env.example`.
-- Selalu validasi input user baik di client maupun di server (defense in depth).
-
-## 4. Code Quality & Formatting
-- **Linter:** Wajib lulus ESLint / Prettier.
-- **Max File Length:** Usahakan di bawah 300 baris. Jika lebih, pecah menjadi modul kecil.
-- **DRY (Don't Repeat Yourself):** Jika ada logika yang digunakan 3 kali atau lebih, ekstraksi menjadi function/util/hook.
-
-## 5. Error Handling
-- Hindari `console.log` di production code. Gunakan logger library.
-- Jangan gunakan `try-catch` kosong. Selalu handle atau re-throw error.
-- Tampilkan error message yang ramah ke user (UI), tapi log error aslinya (Technical).
+# Project Style Guide & Architecture Constraints
+
+## 1. Naming Conventions
+- **Files/Folders:** `kebab-case` (misal: `user-profile.tsx`, `auth-service.ts`)
+- **Variables/Functions:** `camelCase` (misal: `getUserProfile()`)
+- **Classes/Interfaces:** `PascalCase` (misal: `class UserProfile`, `interface AuthConfig`)
+- **Constants/Enums:** `UPPER_SNAKE_CASE` (misal: `MAX_RETRY_COUNT = 3`)
+
+## 2. Directory Structure (`codes/`)
+- `src/components/` → UI Components (Dumb/Presentational)
+- `src/pages/` atau `app/` → Route-level components
+- `src/services/` → API calls, logic database, atau external services
+- `src/utils/` → Helper functions murni
+- `src/types/` → Type definitions (TypeScript)
+
+## 3. Security Guidelines
+- **TIDAK BOLEH** hardcode API Keys, secrets, tokens, atau password ke dalam source code.
+- Selalu gunakan `process.env.VARIABLE_NAME` (Node/Next) atau setara, dan catat keys yang dibutuhkan di `.env.example`.
+- Selalu validasi input user baik di client maupun di server (defense in depth).
+
+## 4. Code Quality & Formatting
+- **Linter:** Wajib lulus ESLint / Prettier.
+- **Max File Length:** Usahakan di bawah 300 baris. Jika lebih, pecah menjadi modul kecil.
+- **DRY (Don't Repeat Yourself):** Jika ada logika yang digunakan 3 kali atau lebih, ekstraksi menjadi function/util/hook.
+
+## 5. Error Handling
+- Hindari `console.log` di production code. Gunakan logger library.
+- Jangan gunakan `try-catch` kosong. Selalu handle atau re-throw error.
+- Tampilkan error message yang ramah ke user (UI), tapi log error aslinya (Technical).

package/template/schemas/task_list.template.md

@@ -1,28 +1,28 @@
-# Task List — [Project Name]
-
-## Summary
-| Metric | Count |
-|--------|-------|
-| Total Tasks | 0 |
-| Completed | 0 |
-| In Progress | 0 |
-| Blocked | 0 |
-
-## Status Legend
-| Status | Meaning |
-|--------|---------|
-| `not_started` | Belum dikerjakan |
-| `development` | Sedang dikembangkan oleh Developer |
-| `ready_to_test` | Development selesai, siap test |
-| `testing` | Sedang ditest oleh Tester |
-| `fixing` | Ada bug, sedang diperbaiki Fixer |
-| `done` | Passed testing |
-| `human_validated` | Divalidasi oleh human |
-
-## Tasks
-
-- Task XXX: [Task Name]
-  - Spesifikasi: [spec] ../specifications/XXX_spec_*.md
-  - Current Status: not_started
-  - Status Logs: 
-     - Task Created: [YYYY-MM-DD HH:MM] (PM Agent)
+# Task List — [Project Name]
+
+## Summary
+| Metric | Count |
+|--------|-------|
+| Total Tasks | 0 |
+| Completed | 0 |
+| In Progress | 0 |
+| Blocked | 0 |
+
+## Status Legend
+| Status | Meaning |
+|--------|---------|
+| `not_started` | Belum dikerjakan |
+| `development` | Sedang dikembangkan oleh Developer |
+| `ready_to_test` | Development selesai, siap test |
+| `testing` | Sedang ditest oleh Tester |
+| `fixing` | Ada bug, sedang diperbaiki Fixer |
+| `done` | Passed testing |
+| `human_validated` | Divalidasi oleh human |
+
+## Tasks
+
+- Task XXX: [Task Name]
+  - Spesifikasi: [spec] ../specifications/XXX_spec_*.md
+  - Current Status: not_started
+  - Status Logs: 
+     - Task Created: [YYYY-MM-DD HH:MM] (PM Agent)

package/template/schemas/workspace-manifest.template.json

@@ -1,24 +1,24 @@
-{
-  "_comment": "DESIRED-STATE manifest written by the Toolsmith agent to state/workspace-manifest.json. Platform-agnostic: lists WHAT skills + MCP the project wants. Re-applying to a new tool (tool-switch) reads this same file and realizes it in the new tool's config format. This is the source of truth; per-tool config files are derived artifacts.",
-  "version": 1,
-  "project": "<project name>",
-  "decidedFrom": ["project_overview.md tech stack", "requirements.md", "find-skills"],
-  "skills": [
-    { "id": "find-skills", "reason": "discover further skills on demand" },
-    { "id": "ui-ux-pro-max", "reason": "UI-heavy frontend (example)" }
-  ],
-  "mcp": [
-    { "id": "filesystem", "reason": "ground agent in workspace" },
-    { "id": "git", "reason": "code-aware context" }
-  ],
-  "appliedTo": {
-    "_comment": "ISO timestamp of last successful apply per platform, or null if never applied. Toolsmith updates this after each apply.",
-    "claude-code": null,
-    "opencode": null,
-    "antigravity": null,
-    "github-copilot": null
-  },
-  "revisionHistory": [
-    { "timestamp": "<YYYY-MM-DD HH:MM>", "agent": "toolsmith", "change": "initial provisioning" }
-  ]
-}
+{
+  "_comment": "DESIRED-STATE manifest written by the Toolsmith agent to state/workspace-manifest.json. Platform-agnostic: lists WHAT skills + MCP the project wants. Re-applying to a new tool (tool-switch) reads this same file and realizes it in the new tool's config format. This is the source of truth; per-tool config files are derived artifacts.",
+  "version": 1,
+  "project": "<project name>",
+  "decidedFrom": ["project_overview.md tech stack", "requirements.md", "find-skills"],
+  "skills": [
+    { "id": "find-skills", "reason": "discover further skills on demand" },
+    { "id": "ui-ux-pro-max", "reason": "UI-heavy frontend (example)" }
+  ],
+  "mcp": [
+    { "id": "filesystem", "reason": "ground agent in workspace" },
+    { "id": "git", "reason": "code-aware context" }
+  ],
+  "appliedTo": {
+    "_comment": "ISO timestamp of last successful apply per platform, or null if never applied. Toolsmith updates this after each apply.",
+    "claude-code": null,
+    "opencode": null,
+    "antigravity": null,
+    "github-copilot": null
+  },
+  "revisionHistory": [
+    { "timestamp": "<YYYY-MM-DD HH:MM>", "agent": "toolsmith", "change": "initial provisioning" }
+  ]
+}