devflow-kit 0.9.0 → 1.0.0

package/shared/skills/git-safety/references/detection.md

@@ -0,0 +1,290 @@
+# Git Safety - Sensitive File Detection
+
+Patterns and functions for detecting sensitive files before commit.
+
+---
+
+## Sensitive File Patterns
+
+### Credentials and Secrets
+
+```bash
+SENSITIVE_PATTERNS=(
+  ".env"
+  ".env.local"
+  ".env.*.local"
+  "*.key"
+  "*.pem"
+  "*.p12"
+  "*.pfx"
+  "*secret*"
+  "*password*"
+  "*credential*"
+  "id_rsa"
+  "id_dsa"
+  "id_ed25519"
+  "id_ecdsa"
+  ".aws/credentials"
+  ".npmrc"
+  ".pypirc"
+  ".netrc"
+  ".pgpass"
+  "*.keystore"
+  "*.jks"
+)
+```
+
+### Temporary and Generated Files
+
+```bash
+TEMP_PATTERNS=(
+  "*.tmp"
+  "*.temp"
+  "*.log"
+  "*.swp"
+  "*.swo"
+  "*~"
+  ".DS_Store"
+  "Thumbs.db"
+  "*.bak"
+  "*.orig"
+  "*.rej"
+  "*.pid"
+  "*.seed"
+  "*.cache"
+)
+```
+
+### Build and Dependency Artifacts
+
+```bash
+ARTIFACT_PATTERNS=(
+  "node_modules/"
+  "vendor/"
+  "dist/"
+  "build/"
+  "target/"
+  "__pycache__/"
+  "*.pyc"
+  "*.pyo"
+  ".next/"
+  ".nuxt/"
+  ".output/"
+  "coverage/"
+)
+```
+
+---
+
+## Content Scanning Functions
+
+### Full Secret Detection
+
+```bash
+# Check file content for secrets
+check_for_secrets() {
+    local file="$1"
+
+    # API keys (various formats)
+    if grep -qE 'api[_-]?key["\s]*[:=]["\s]*['\''"][a-zA-Z0-9_-]{20,}['\''"]' "$file" 2>/dev/null; then
+        echo "WARNING: $file may contain API key"
+        return 1
+    fi
+
+    # Passwords in config
+    if grep -qE 'password["\s]*[:=]["\s]*['\''"][^'\''\"]{8,}['\''"]' "$file" 2>/dev/null; then
+        echo "WARNING: $file may contain password"
+        return 1
+    fi
+
+    # Private keys
+    if grep -q 'BEGIN.*PRIVATE KEY' "$file" 2>/dev/null; then
+        echo "BLOCK: $file contains private key"
+        return 1
+    fi
+
+    # AWS credentials
+    if grep -qE 'AKIA[0-9A-Z]{16}' "$file" 2>/dev/null; then
+        echo "BLOCK: $file may contain AWS access key"
+        return 1
+    fi
+
+    # AWS secret key pattern
+    if grep -qE '[a-zA-Z0-9/+=]{40}' "$file" 2>/dev/null && grep -qi 'aws\|secret' "$file" 2>/dev/null; then
+        echo "WARNING: $file may contain AWS secret key"
+        return 1
+    fi
+
+    # GitHub tokens
+    if grep -qE 'gh[pousr]_[A-Za-z0-9_]{36,}' "$file" 2>/dev/null; then
+        echo "BLOCK: $file may contain GitHub token"
+        return 1
+    fi
+
+    # Generic tokens
+    if grep -qE 'token["\s]*[:=]["\s]*['\''"][a-zA-Z0-9_-]{32,}['\''"]' "$file" 2>/dev/null; then
+        echo "WARNING: $file may contain token"
+        return 1
+    fi
+
+    # Slack webhook URLs
+    if grep -qE 'hooks\.slack\.com/services/[A-Z0-9]+/[A-Z0-9]+/[a-zA-Z0-9]+' "$file" 2>/dev/null; then
+        echo "BLOCK: $file contains Slack webhook URL"
+        return 1
+    fi
+
+    # Database connection strings with credentials
+    if grep -qE '(mysql|postgres|mongodb)://[^:]+:[^@]+@' "$file" 2>/dev/null; then
+        echo "WARNING: $file may contain database credentials"
+        return 1
+    fi
+
+    return 0
+}
+```
+
+### Batch File Checking
+
+```bash
+# Check all staged files for secrets
+check_staged_files() {
+    local has_secrets=0
+
+    while IFS= read -r file; do
+        if [[ -f "$file" ]]; then
+            if ! check_for_secrets "$file"; then
+                has_secrets=1
+            fi
+        fi
+    done < <(git diff --cached --name-only)
+
+    return $has_secrets
+}
+```
+
+### Pre-commit Integration
+
+```bash
+# Run before committing
+pre_commit_check() {
+    echo "Checking for sensitive files..."
+
+    # Check filenames
+    local staged_files
+    staged_files=$(git diff --cached --name-only)
+
+    for pattern in "${SENSITIVE_PATTERNS[@]}"; do
+        if echo "$staged_files" | grep -q "$pattern"; then
+            echo "BLOCK: Staged file matches sensitive pattern: $pattern"
+            return 1
+        fi
+    done
+
+    # Check file contents
+    if ! check_staged_files; then
+        echo "BLOCK: Secrets detected in staged files"
+        return 1
+    fi
+
+    echo "OK: No sensitive files detected"
+    return 0
+}
+```
+
+---
+
+## Pattern Matching by File Type
+
+### Environment Files
+
+```bash
+is_env_file() {
+    local file="$1"
+    case "$file" in
+        .env|.env.*|*.env) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+```
+
+### Key Files
+
+```bash
+is_key_file() {
+    local file="$1"
+    case "$file" in
+        *.key|*.pem|*.p12|*.pfx|*.jks|*.keystore) return 0 ;;
+        id_rsa*|id_dsa*|id_ed25519*|id_ecdsa*) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+```
+
+### Config Files with Potential Secrets
+
+```bash
+should_scan_for_secrets() {
+    local file="$1"
+    case "$file" in
+        *.json|*.yaml|*.yml|*.toml|*.ini|*.conf|*.config) return 0 ;;
+        *.js|*.ts|*.py|*.rb|*.go|*.java) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+```
+
+---
+
+## Gitignore Recommendations
+
+Based on detected sensitive patterns, recommend `.gitignore` entries:
+
+```bash
+# Environment files
+.env
+.env.*
+!.env.example
+
+# Keys and certificates
+*.key
+*.pem
+*.p12
+*.pfx
+*.jks
+*.keystore
+
+# SSH keys
+id_rsa*
+id_dsa*
+id_ed25519*
+id_ecdsa*
+
+# Cloud credentials
+.aws/credentials
+.gcloud/
+.azure/
+
+# Package manager configs with tokens
+.npmrc
+.pypirc
+.netrc
+
+# Database files
+*.sql
+*.dump
+*.sqlite
+*.db
+
+# Logs
+*.log
+logs/
+
+# IDE and OS
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+.DS_Store
+Thumbs.db
+```

package/shared/skills/git-safety/references/patterns.md

@@ -0,0 +1,289 @@
+# Git Safety Patterns
+
+Correct patterns for safe git operations.
+
+---
+
+## Core Patterns
+
+### Sequential Operations
+
+```bash
+# Always chain git commands with &&
+git add file.ts && git commit -m "message" && git push
+
+# Never run in parallel - use sequential execution
+```
+
+### Lock Handling
+
+```bash
+# Check for and wait on locks
+wait_for_lock_release() {
+  while [ -f .git/index.lock ]; do
+    sleep 0.1
+  done
+}
+```
+
+### Safe Amend
+
+```bash
+# Only amend if not pushed
+if ! git log origin/$(git branch --show-current)..HEAD | grep -q .; then
+  git commit --amend  # Safe - not pushed
+fi
+```
+
+---
+
+## Lock File Handling - Full Implementation
+
+```bash
+# Function to wait for lock file release
+wait_for_lock_release() {
+    local max_wait=10
+    local waited=0
+    while [ -f .git/index.lock ]; do
+        if [ $waited -ge $max_wait ]; then
+            echo "ERROR: .git/index.lock still exists after ${max_wait}s"
+            echo "Another git process may be running, or a process crashed."
+            echo "Check: ps aux | grep git"
+            return 1
+        fi
+        echo "Waiting for git lock to be released... (${waited}s)"
+        sleep 1
+        waited=$((waited + 1))
+    done
+    return 0
+}
+
+# Always call before git operations
+wait_for_lock_release || exit 1
+```
+
+---
+
+## Complete Commit Flow
+
+```bash
+# 1. Wait for lock
+wait_for_lock_release || exit 1
+
+# 2. Check what's changing
+git status --porcelain
+
+# 3. Review changes
+git diff HEAD --stat
+
+# 4. Stage specific files (not blind 'git add .')
+git add src/specific-file.ts
+
+# 5. Create commit with proper message
+git commit -m "$(cat <<'EOF'
+type(scope): summary
+
+Description
+
+EOF
+)"
+
+# 6. Verify
+git log -1 --stat
+git status
+```
+
+---
+
+## Safe Push Workflow
+
+```bash
+# Check remote status first
+git fetch origin
+git status
+
+# If behind, pull first
+if git status | grep -q "behind"; then
+    git pull --rebase origin $(git branch --show-current)
+fi
+
+# Push
+git push -u origin $(git branch --show-current)
+```
+
+---
+
+## Protected Branch Check
+
+```bash
+PROTECTED_BRANCHES="main master develop"
+
+check_protected_branch() {
+    local branch="$1"
+    for protected in $PROTECTED_BRANCHES; do
+        if [ "$branch" = "$protected" ]; then
+            echo "ERROR: Cannot force push to $branch"
+            return 1
+        fi
+    done
+    return 0
+}
+```
+
+---
+
+## Pre-commit Hook Handling
+
+### If Hook Modifies Files
+
+```bash
+# Run commit
+git commit -m "message"
+
+# If hook modified files, amend to include them
+git add .
+git commit --amend --no-edit
+```
+
+### If Hook Rejects Commit
+
+```bash
+# DO NOT amend - fix the issue and create new commit
+
+# Fix the issue
+eslint --fix src/
+
+# Stage and commit fresh
+git add .
+git commit -m "fix: resolve linting issues"
+```
+
+---
+
+## Amend Verification
+
+```bash
+# Check if commit is pushed
+if git status | grep -q "Your branch is ahead"; then
+    echo "Safe to amend - not pushed"
+else
+    echo "DANGER: May be pushed - do NOT amend"
+fi
+
+# Verify commit author
+git log -1 --format='%an %ae'
+```
+
+---
+
+## Recovery Workflows
+
+### Undo Last Commit (not pushed)
+
+```bash
+# Keep changes staged
+git reset --soft HEAD~1
+
+# Keep changes unstaged
+git reset HEAD~1
+
+# Discard changes (DANGEROUS)
+git reset --hard HEAD~1
+```
+
+### Recover Deleted Branch
+
+```bash
+# Find the commit
+git reflog
+
+# Recreate branch
+git checkout -b recovered-branch <commit-sha>
+```
+
+### Fix Wrong Branch
+
+```bash
+# If committed to wrong branch
+git reset --soft HEAD~1
+git stash
+git checkout correct-branch
+git stash pop
+git commit -m "message"
+```
+
+### Stash Handling
+
+```bash
+# Save work temporarily
+git stash push -m "description of changes"
+
+# List stashes
+git stash list
+
+# Apply most recent stash (keep in stash list)
+git stash apply
+
+# Apply and remove from list
+git stash pop
+
+# Apply specific stash
+git stash apply stash@{2}
+
+# Drop specific stash
+git stash drop stash@{0}
+
+# Clear all stashes (DANGEROUS)
+git stash clear
+```
+
+### Interactive Stash Recovery
+
+```bash
+# Show stash contents
+git stash show -p stash@{0}
+
+# Create branch from stash
+git stash branch new-branch stash@{0}
+```
+
+---
+
+## Branch Naming Examples
+
+```bash
+# Feature branches
+git checkout -b feat/short-description
+
+# Bug fixes
+git checkout -b fix/issue-123-description
+
+# Releases
+git checkout -b release/v1.2.0
+
+# Hotfixes
+git checkout -b hotfix/critical-fix
+```
+
+---
+
+## Sequential Operation Patterns
+
+```bash
+# WRONG - parallel execution
+git add . &
+git status &
+wait
+
+# CORRECT - sequential with && chains
+wait_for_lock_release && \
+git add . && \
+git status && \
+echo "Done"
+```
+
+---
+
+## Quick Reference
+
+See [detection.md](detection.md) for sensitive file patterns.

package/shared/skills/git-safety/references/violations.md

@@ -0,0 +1,18 @@
+# Git Safety Violations
+
+Common git safety violations:
+
+## Violations
+
+| Violation | Risk | Fix |
+|-----------|------|-----|
+| Parallel git commands | Index corruption | Run git commands sequentially |
+| Force push to main | Lost commits | Never force push protected branches |
+| Committing secrets | Security breach | Use [detection.md](detection.md) patterns |
+| Amending after push | History rewrite | Create new commit instead |
+| Skipping hooks | Quality bypass | Never use `--no-verify` |
+| Ignoring lock files | Corruption | Wait for lock release |
+
+## Quick Reference
+
+See [commands.md](commands.md) for safe command patterns and [detection.md](detection.md) for sensitive file detection.