devflow-kit 1.8.2 → 2.0.0

package/plugins/devflow-resolve/skills/security-patterns/references/violations.md

@@ -1,237 +0,0 @@
-# Security Violation Examples
-
-Extended violation patterns for security reviews. Reference from main SKILL.md.
-
-## Injection Vulnerabilities
-
-### SQL Injection
-```typescript
-// VULNERABLE: String interpolation in query
-const user = await db.query(`SELECT * FROM users WHERE id = '${userId}'`);
-const result = await db.query(`SELECT * FROM products WHERE name LIKE '%${search}%'`);
-```
-
-### NoSQL Injection
-```typescript
-// VULNERABLE: Direct object from request
-const user = await db.users.findOne({ username: req.body.username });
-// Attacker sends: { username: { $gt: "" } }
-
-// VULNERABLE: $where operator accepts arbitrary JS
-db.users.find({ $where: `this.name === '${userInput}'` });
-
-// VULNERABLE: regex injection
-db.users.find({ name: { $regex: userInput } });
-// Attacker sends: ".*" (matches everything)
-```
-
-### Command Injection
-```typescript
-// VULNERABLE: User input in shell command
-exec(`ls ${userInput}`);
-exec(`convert ${filename} output.png`);
-exec(`ping -c 4 ${hostname}`);
-
-// Dangerous characters: ; | & $ ` ( ) < > \ ' "
-// Example attack: userInput = "file.txt; rm -rf /"
-```
-
-### Path Traversal
-```typescript
-// VULNERABLE: Direct path concatenation
-const file = req.params.filename;
-fs.readFile(`./uploads/${file}`);  // Attacker: ../../../etc/passwd
-
-// VULNERABLE: Encoded traversal
-// Attacker sends: %2e%2e%2f%2e%2e%2fetc/passwd (URL encoded ../..)
-const decoded = decodeURIComponent(req.params.filename);
-fs.readFile(`./uploads/${decoded}`);
-
-// VULNERABLE: Double encoding
-// Attacker sends: %252e%252e%252f (double-encoded ../)
-```
-
-### LDAP Injection
-```typescript
-// VULNERABLE: Unescaped LDAP filter
-const filter = `(uid=${username})`;
-ldap.search(baseDN, filter);
-// Attacker: username = "admin)(&(password=*)"
-```
-
-### Template Injection (SSTI)
-```typescript
-// VULNERABLE: User input in template
-const template = `Hello ${req.body.name}!`;
-ejs.render(template);
-// Attacker: name = "<%= process.env.SECRET %>"
-```
-
-### Header Injection
-```typescript
-// VULNERABLE: CRLF injection
-res.setHeader('Location', `/user/${userInput}`);
-// Attacker: userInput = "test\r\nSet-Cookie: admin=true"
-```
-
----
-
-## Authentication Vulnerabilities
-
-### Weak Password Policies
-```typescript
-// VULNERABLE: Weak password requirements
-if (password.length >= 6) { /* accept */ }
-```
-
-### Session Management Issues
-```typescript
-// VULNERABLE: Session ID in URL
-app.get('/dashboard?session=abc123');
-
-// VULNERABLE: Predictable session IDs
-const sessionId = `user_${userId}`;
-
-// VULNERABLE: No session timeout or rotation
-```
-
-### JWT Misuse
-```typescript
-// VULNERABLE: Weak secret
-jwt.sign(payload, 'secret123');
-
-// VULNERABLE: No expiration
-jwt.sign(payload, secret);
-
-// VULNERABLE: Algorithm confusion (accepts 'none')
-jwt.verify(token, secret);  // Without algorithm specification
-```
-
-### Missing Authorization
-```typescript
-// VULNERABLE: No auth checks
-app.delete('/api/users/:id', async (req, res) => {
-  await deleteUser(req.params.id);  // No auth check!
-});
-```
-
----
-
-## Cryptography Vulnerabilities
-
-### Hardcoded Secrets
-```typescript
-// VULNERABLE: Secrets in code
-const API_KEY = 'sk-abc123xyz789';
-const dbPassword = 'admin123';
-const jwtSecret = 'mysecret';
-
-// VULNERABLE: Secrets in config files
-const config = {
-  database: {
-    password: 'prod_password_123'
-  },
-  api: {
-    key: 'sk-live-abcdef123456'
-  }
-};
-```
-
-### Weak Cryptography
-```typescript
-// VULNERABLE: Broken hash algorithms
-crypto.createHash('md5').update(password);  // MD5 is broken
-crypto.createHash('sha1').update(password);  // SHA1 weak for passwords
-
-// VULNERABLE: Using password directly as key
-const key = password;
-crypto.createCipheriv('aes-256-gcm', key, iv);
-```
-
-### Insecure Random
-```typescript
-// VULNERABLE: Predictable random
-const token = Math.random().toString(36);  // Predictable!
-const id = Date.now().toString();
-const code = Math.floor(Math.random() * 1000000);
-```
-
-### Weak Encryption
-```typescript
-// VULNERABLE: ECB mode (patterns visible)
-crypto.createCipheriv('aes-256-ecb', key, null);
-
-// VULNERABLE: No authentication (CBC without HMAC)
-crypto.createCipheriv('aes-256-cbc', key, iv);
-```
-
-### Timing Attacks
-```typescript
-// VULNERABLE: Early exit reveals length info
-function verifyToken(provided: string, stored: string): boolean {
-  return provided === stored; // Early exit reveals info
-}
-```
-
----
-
-## Detection Grep Commands
-
-### Injection Detection
-```bash
-# SQL Injection
-grep -rn "query.*\${" --include="*.ts" --include="*.js"
-grep -rn "query.*+ " --include="*.ts" --include="*.js"
-grep -rn "execute.*\`" --include="*.ts" --include="*.js"
-
-# NoSQL Injection
-grep -rn "findOne.*req\.\|find.*req\." --include="*.ts" --include="*.js"
-grep -rn "\$where" --include="*.ts" --include="*.js"
-
-# Command Injection
-grep -rn "exec\s*\(" --include="*.ts" --include="*.js"
-grep -rn "spawn.*\`\|execSync.*\`" --include="*.ts" --include="*.js"
-
-# Path Traversal
-grep -rn "readFile.*req\.\|readFileSync.*req\." --include="*.ts" --include="*.js"
-grep -rn "path\.join.*req\." --include="*.ts" --include="*.js"
-```
-
-### Auth Detection
-```bash
-# Missing auth middleware
-grep -rn "app\.\(get\|post\|put\|delete\).*async" --include="*.ts" --include="*.js" | \
-  grep -v "requireAuth\|isAuthenticated\|authorize"
-
-# Weak JWT configuration
-grep -rn "jwt\.sign\|jwt\.verify" --include="*.ts" --include="*.js" -A 5 | \
-  grep -v "algorithm\|expiresIn"
-
-# Session issues
-grep -rn "session\|cookie" --include="*.ts" --include="*.js" | \
-  grep -v "httpOnly\|secure\|sameSite"
-
-# Password handling
-grep -rn "password.*length" --include="*.ts" --include="*.js"
-```
-
-### Crypto Detection
-```bash
-# Hardcoded secrets
-grep -rn "password.*=.*['\"]" --include="*.ts" --include="*.js"
-grep -rn "api.key.*=.*['\"]" --include="*.ts" --include="*.js"
-grep -rn "secret.*=.*['\"]" --include="*.ts" --include="*.js"
-grep -rn "sk-\|pk-\|api_" --include="*.ts" --include="*.js"
-
-# Weak crypto
-grep -rn "createHash.*md5\|sha1" --include="*.ts" --include="*.js"
-grep -rn "DES\|RC4\|Blowfish" --include="*.ts" --include="*.js"
-grep -rn "aes-.*-ecb\|aes-.*-cbc" --include="*.ts" --include="*.js"
-
-# Insecure random
-grep -rn "Math.random" --include="*.ts" --include="*.js"
-grep -rn "Date.now.*id\|Date.now.*token" --include="*.ts" --include="*.js"
-
-# String comparison for secrets
-grep -rn "token.*===\|secret.*===\|key.*===" --include="*.ts" --include="*.js"
-```

package/plugins/devflow-rust/.claude-plugin/plugin.json

@@ -1,21 +0,0 @@
-{
-  "name": "devflow-rust",
-  "description": "Rust language patterns - ownership, borrowing, error handling, type-driven design",
-  "author": {
-    "name": "Dean0x"
-  },
-  "version": "1.8.2",
-  "homepage": "https://github.com/dean0x/devflow",
-  "repository": "https://github.com/dean0x/devflow",
-  "license": "MIT",
-  "keywords": [
-    "rust",
-    "ownership",
-    "borrowing",
-    "type-safety"
-  ],
-  "agents": [],
-  "skills": [
-    "rust"
-  ]
-}

package/plugins/devflow-rust/skills/rust/SKILL.md

@@ -1,193 +0,0 @@
----
-name: rust
-description: This skill should be used when the user works with Rust files (.rs), asks about "ownership", "borrowing", "lifetimes", "Result/Option", "traits", or discusses memory safety and type-driven design. Provides patterns for ownership, error handling, type system usage, and safe concurrency.
-user-invocable: false
-allowed-tools: Read, Grep, Glob
-activation:
-  file-patterns:
-    - "**/*.rs"
-  exclude:
-    - "**/target/**"
----
-
-# Rust Patterns
-
-Reference for Rust-specific patterns, ownership model, and type-driven design.
-
-## Iron Law
-
-> **MAKE ILLEGAL STATES UNREPRESENTABLE**
->
-> Encode invariants in the type system. If a function can fail, return `Result`. If a value
-> might be absent, return `Option`. If a state transition is invalid, make it uncompilable.
-> Runtime checks are a fallback, not a strategy.
-
-## When This Skill Activates
-
-- Working with Rust codebases
-- Designing type-safe APIs
-- Managing ownership and borrowing
-- Implementing error handling
-- Writing concurrent code
-
----
-
-## Ownership & Borrowing
-
-### Prefer Borrowing Over Cloning
-
-```rust
-// BAD: fn process(data: String) — takes ownership unnecessarily
-// GOOD: fn process(data: &str) — borrows, caller keeps ownership
-
-fn process(data: &str) -> usize {
-    data.len()
-}
-```
-
-### Lifetime Annotations When Needed
-
-```rust
-// Return reference tied to input lifetime
-fn first_word(s: &str) -> &str {
-    s.split_whitespace().next().unwrap_or("")
-}
-
-// Explicit when compiler can't infer
-struct Excerpt<'a> {
-    text: &'a str,
-}
-```
-
----
-
-## Error Handling
-
-### Use Result and the ? Operator
-
-```rust
-use std::fs;
-use std::io;
-
-fn read_config(path: &str) -> Result<Config, AppError> {
-    let content = fs::read_to_string(path)
-        .map_err(|e| AppError::Io { path: path.into(), source: e })?;
-    let config: Config = toml::from_str(&content)
-        .map_err(|e| AppError::Parse { source: e })?;
-    Ok(config)
-}
-```
-
-### Custom Error Types with thiserror
-
-```rust
-use thiserror::Error;
-
-#[derive(Error, Debug)]
-pub enum AppError {
-    #[error("IO error reading {path}")]
-    Io { path: String, #[source] source: io::Error },
-    #[error("parse error")]
-    Parse { #[from] source: toml::de::Error },
-    #[error("{entity} with id {id} not found")]
-    NotFound { entity: String, id: String },
-}
-```
-
----
-
-## Type System
-
-### Newtype Pattern
-
-```rust
-// Prevent mixing up IDs
-struct UserId(String);
-struct OrderId(String);
-
-fn get_order(user_id: &UserId, order_id: &OrderId) -> Result<Order, AppError> {
-    // Can't accidentally swap parameters
-    todo!()
-}
-```
-
-### Enums for State Machines
-
-```rust
-enum Connection {
-    Disconnected,
-    Connecting { attempt: u32 },
-    Connected { session: Session },
-}
-
-// Each state carries only its relevant data
-// Invalid transitions are uncompilable
-```
-
----
-
-## Patterns
-
-### Builder Pattern
-
-```rust
-pub struct ServerBuilder {
-    port: u16,
-    host: String,
-}
-
-impl ServerBuilder {
-    pub fn new() -> Self { Self { port: 8080, host: "localhost".into() } }
-    pub fn port(mut self, port: u16) -> Self { self.port = port; self }
-    pub fn host(mut self, host: impl Into<String>) -> Self { self.host = host.into(); self }
-    pub fn build(self) -> Server { Server { port: self.port, host: self.host } }
-}
-```
-
-### Iterator Chains Over Loops
-
-```rust
-// BAD: manual loop with push
-// GOOD:
-let active_names: Vec<&str> = users.iter()
-    .filter(|u| u.is_active)
-    .map(|u| u.name.as_str())
-    .collect();
-```
-
----
-
-## Anti-Patterns
-
-| Pattern | Bad | Good |
-|---------|-----|------|
-| Unwrap in library | `.unwrap()` | `?` operator or `.ok_or()` |
-| Clone to satisfy borrow checker | `.clone()` everywhere | Restructure ownership |
-| String for everything | `HashMap<String, String>` | Typed structs and enums |
-| Ignoring Result | `let _ = write(...)` | Handle or propagate error |
-| Mutex<Vec> for message passing | Shared mutable state | Channels (`mpsc`) |
-
----
-
-## Extended References
-
-For additional patterns and examples:
-- `references/violations.md` - Common Rust violations
-- `references/patterns.md` - Extended Rust patterns
-- `references/detection.md` - Detection patterns for Rust issues
-- `references/ownership.md` - Advanced ownership and lifetime patterns
-
----
-
-## Checklist
-
-- [ ] No `.unwrap()` in library/application code (ok in tests)
-- [ ] Custom error types with `thiserror`
-- [ ] `?` operator for error propagation
-- [ ] Borrow instead of clone where possible
-- [ ] Newtype pattern for type-safe IDs
-- [ ] Enums for state machines
-- [ ] Iterator chains over manual loops
-- [ ] `#[must_use]` on Result-returning functions
-- [ ] No `unsafe` without safety comment
-- [ ] Clippy clean (`cargo clippy -- -D warnings`)

package/plugins/devflow-rust/skills/rust/references/ownership.md

@@ -1,242 +0,0 @@
-# Rust Ownership Deep Dive
-
-Advanced ownership patterns, lifetime elision, interior mutability, and pinning.
-
-## Lifetime Elision Rules
-
-The compiler applies three rules to infer lifetimes. When they don't resolve, annotate manually.
-
-### Rule 1: Each Reference Parameter Gets Its Own Lifetime
-
-```rust
-// Compiler sees: fn first(s: &str) -> &str
-// Compiler infers: fn first<'a>(s: &'a str) -> &'a str
-fn first(s: &str) -> &str {
-    &s[..1]
-}
-```
-
-### Rule 2: Single Input Lifetime Applies to All Outputs
-
-```rust
-// One input reference — output borrows from it
-fn trim(s: &str) -> &str {
-    s.trim()
-}
-```
-
-### Rule 3: &self Lifetime Applies to All Outputs in Methods
-
-```rust
-impl Config {
-    // &self lifetime flows to return
-    fn database_url(&self) -> &str {
-        &self.db_url
-    }
-}
-```
-
-### When Elision Fails
-
-```rust
-// Two input lifetimes — compiler can't decide which output borrows from
-// Must annotate: output borrows from `a`, not `b`
-fn longest<'a>(a: &'a str, b: &str) -> &'a str {
-    if a.len() >= b.len() { a } else { a }
-}
-```
-
----
-
-## Interior Mutability
-
-Mutate data behind a shared reference when ownership rules are too strict.
-
-### Cell — Copy Types Only
-
-```rust
-use std::cell::Cell;
-
-struct Counter {
-    count: Cell<u32>, // Mutate through &self
-}
-
-impl Counter {
-    fn increment(&self) {
-        self.count.set(self.count.get() + 1);
-    }
-}
-```
-
-### RefCell — Runtime Borrow Checking
-
-```rust
-use std::cell::RefCell;
-
-struct Cache {
-    data: RefCell<HashMap<String, String>>,
-}
-
-impl Cache {
-    fn get_or_insert(&self, key: &str, value: &str) -> String {
-        let mut data = self.data.borrow_mut(); // Panics if already borrowed
-        data.entry(key.to_string())
-            .or_insert_with(|| value.to_string())
-            .clone()
-    }
-}
-```
-
-### Mutex — Thread-Safe Interior Mutability
-
-```rust
-use std::sync::Mutex;
-
-struct SharedState {
-    data: Mutex<Vec<String>>,
-}
-
-impl SharedState {
-    fn push(&self, item: String) -> Result<(), AppError> {
-        let mut data = self.data.lock()
-            .map_err(|_| AppError::LockPoisoned)?;
-        data.push(item);
-        Ok(())
-    }
-}
-```
-
-### Decision Guide
-
-| Type | Thread-Safe | Cost | Use Case |
-|------|-------------|------|----------|
-| `Cell<T>` | No | Zero | Copy types, single-threaded |
-| `RefCell<T>` | No | Runtime borrow check | Non-Copy, single-threaded |
-| `Mutex<T>` | Yes | Lock overhead | Multi-threaded mutation |
-| `RwLock<T>` | Yes | Lock overhead | Multi-threaded, read-heavy |
-| `Atomic*` | Yes | Hardware atomic | Counters, flags |
-
----
-
-## Cow — Clone on Write
-
-Defer cloning until mutation is actually needed.
-
-```rust
-use std::borrow::Cow;
-
-// Returns borrowed if no processing needed, owned if modified
-fn normalize_path(path: &str) -> Cow<'_, str> {
-    if path.contains("//") {
-        Cow::Owned(path.replace("//", "/"))
-    } else {
-        Cow::Borrowed(path)
-    }
-}
-
-// Function accepts both owned and borrowed transparently
-fn process(input: Cow<'_, str>) {
-    println!("{}", input); // No allocation if already borrowed
-}
-```
-
-### Cow in APIs
-
-```rust
-// Accept Cow for flexible ownership — caller decides allocation
-pub fn log_message(msg: Cow<'_, str>) {
-    eprintln!("[LOG] {}", msg);
-}
-
-// Caller with borrowed data — zero-copy
-log_message(Cow::Borrowed("static message"));
-
-// Caller with owned data — no extra clone
-log_message(Cow::Owned(format!("dynamic: {}", value)));
-```
-
----
-
-## Pin for Async and Self-Referential Types
-
-### Why Pin Exists
-
-Self-referential structs break if moved in memory. `Pin` guarantees the value won't move.
-
-```rust
-use std::pin::Pin;
-use std::future::Future;
-
-// Async functions return self-referential futures
-// Pin ensures the future stays in place while polled
-fn fetch_data(url: &str) -> Pin<Box<dyn Future<Output = Result<Data, Error>> + '_>> {
-    Box::pin(async move {
-        let response = reqwest::get(url).await?;
-        let data = response.json::<Data>().await?;
-        Ok(data)
-    })
-}
-```
-
-### Pin in Practice
-
-```rust
-use tokio::pin;
-
-async fn process_stream(stream: impl Stream<Item = Data>) {
-    // pin! macro pins the stream to the stack
-    pin!(stream);
-
-    while let Some(item) = stream.next().await {
-        handle(item).await;
-    }
-}
-```
-
-### When You Need Pin
-
-| Scenario | Need Pin? |
-|----------|-----------|
-| Returning `async` blocks as trait objects | Yes |
-| Implementing `Future` manually | Yes |
-| Using `tokio::select!` on futures | Yes (automatically handled) |
-| Normal async/await | No (compiler handles it) |
-| Storing futures in collections | Yes (`Pin<Box<dyn Future>>`) |
-
----
-
-## Ownership Transfer Patterns
-
-### Take Pattern — Move Out of Option
-
-```rust
-struct Connection {
-    session: Option<Session>,
-}
-
-impl Connection {
-    fn close(&mut self) -> Option<Session> {
-        self.session.take() // Moves out, leaves None
-    }
-}
-```
-
-### Swap Pattern — Replace In Place
-
-```rust
-use std::mem;
-
-fn rotate_buffer(current: &mut Vec<u8>, new_data: Vec<u8>) -> Vec<u8> {
-    mem::replace(current, new_data) // Returns old, installs new
-}
-```
-
-### Entry Pattern — Conditional Insertion
-
-```rust
-use std::collections::HashMap;
-
-fn get_or_create(map: &mut HashMap<String, Vec<Item>>, key: &str) -> &mut Vec<Item> {
-    map.entry(key.to_string()).or_insert_with(Vec::new)
-}
-```