devflow-kit 1.8.3 → 2.0.0

package/plugins/devflow-debug/skills/git-safety/references/detection.md

@@ -1,290 +0,0 @@
-# Git Safety - Sensitive File Detection
-
-Patterns and functions for detecting sensitive files before commit.
-
----
-
-## Sensitive File Patterns
-
-### Credentials and Secrets
-
-```bash
-SENSITIVE_PATTERNS=(
-  ".env"
-  ".env.local"
-  ".env.*.local"
-  "*.key"
-  "*.pem"
-  "*.p12"
-  "*.pfx"
-  "*secret*"
-  "*password*"
-  "*credential*"
-  "id_rsa"
-  "id_dsa"
-  "id_ed25519"
-  "id_ecdsa"
-  ".aws/credentials"
-  ".npmrc"
-  ".pypirc"
-  ".netrc"
-  ".pgpass"
-  "*.keystore"
-  "*.jks"
-)
-```
-
-### Temporary and Generated Files
-
-```bash
-TEMP_PATTERNS=(
-  "*.tmp"
-  "*.temp"
-  "*.log"
-  "*.swp"
-  "*.swo"
-  "*~"
-  ".DS_Store"
-  "Thumbs.db"
-  "*.bak"
-  "*.orig"
-  "*.rej"
-  "*.pid"
-  "*.seed"
-  "*.cache"
-)
-```
-
-### Build and Dependency Artifacts
-
-```bash
-ARTIFACT_PATTERNS=(
-  "node_modules/"
-  "vendor/"
-  "dist/"
-  "build/"
-  "target/"
-  "__pycache__/"
-  "*.pyc"
-  "*.pyo"
-  ".next/"
-  ".nuxt/"
-  ".output/"
-  "coverage/"
-)
-```
-
----
-
-## Content Scanning Functions
-
-### Full Secret Detection
-
-```bash
-# Check file content for secrets
-check_for_secrets() {
-    local file="$1"
-
-    # API keys (various formats)
-    if grep -qE 'api[_-]?key["\s]*[:=]["\s]*['\''"][a-zA-Z0-9_-]{20,}['\''"]' "$file" 2>/dev/null; then
-        echo "WARNING: $file may contain API key"
-        return 1
-    fi
-
-    # Passwords in config
-    if grep -qE 'password["\s]*[:=]["\s]*['\''"][^'\''\"]{8,}['\''"]' "$file" 2>/dev/null; then
-        echo "WARNING: $file may contain password"
-        return 1
-    fi
-
-    # Private keys
-    if grep -q 'BEGIN.*PRIVATE KEY' "$file" 2>/dev/null; then
-        echo "BLOCK: $file contains private key"
-        return 1
-    fi
-
-    # AWS credentials
-    if grep -qE 'AKIA[0-9A-Z]{16}' "$file" 2>/dev/null; then
-        echo "BLOCK: $file may contain AWS access key"
-        return 1
-    fi
-
-    # AWS secret key pattern
-    if grep -qE '[a-zA-Z0-9/+=]{40}' "$file" 2>/dev/null && grep -qi 'aws\|secret' "$file" 2>/dev/null; then
-        echo "WARNING: $file may contain AWS secret key"
-        return 1
-    fi
-
-    # GitHub tokens
-    if grep -qE 'gh[pousr]_[A-Za-z0-9_]{36,}' "$file" 2>/dev/null; then
-        echo "BLOCK: $file may contain GitHub token"
-        return 1
-    fi
-
-    # Generic tokens
-    if grep -qE 'token["\s]*[:=]["\s]*['\''"][a-zA-Z0-9_-]{32,}['\''"]' "$file" 2>/dev/null; then
-        echo "WARNING: $file may contain token"
-        return 1
-    fi
-
-    # Slack webhook URLs
-    if grep -qE 'hooks\.slack\.com/services/[A-Z0-9]+/[A-Z0-9]+/[a-zA-Z0-9]+' "$file" 2>/dev/null; then
-        echo "BLOCK: $file contains Slack webhook URL"
-        return 1
-    fi
-
-    # Database connection strings with credentials
-    if grep -qE '(mysql|postgres|mongodb)://[^:]+:[^@]+@' "$file" 2>/dev/null; then
-        echo "WARNING: $file may contain database credentials"
-        return 1
-    fi
-
-    return 0
-}
-```
-
-### Batch File Checking
-
-```bash
-# Check all staged files for secrets
-check_staged_files() {
-    local has_secrets=0
-
-    while IFS= read -r file; do
-        if [[ -f "$file" ]]; then
-            if ! check_for_secrets "$file"; then
-                has_secrets=1
-            fi
-        fi
-    done < <(git diff --cached --name-only)
-
-    return $has_secrets
-}
-```
-
-### Pre-commit Integration
-
-```bash
-# Run before committing
-pre_commit_check() {
-    echo "Checking for sensitive files..."
-
-    # Check filenames
-    local staged_files
-    staged_files=$(git diff --cached --name-only)
-
-    for pattern in "${SENSITIVE_PATTERNS[@]}"; do
-        if echo "$staged_files" | grep -q "$pattern"; then
-            echo "BLOCK: Staged file matches sensitive pattern: $pattern"
-            return 1
-        fi
-    done
-
-    # Check file contents
-    if ! check_staged_files; then
-        echo "BLOCK: Secrets detected in staged files"
-        return 1
-    fi
-
-    echo "OK: No sensitive files detected"
-    return 0
-}
-```
-
----
-
-## Pattern Matching by File Type
-
-### Environment Files
-
-```bash
-is_env_file() {
-    local file="$1"
-    case "$file" in
-        .env|.env.*|*.env) return 0 ;;
-        *) return 1 ;;
-    esac
-}
-```
-
-### Key Files
-
-```bash
-is_key_file() {
-    local file="$1"
-    case "$file" in
-        *.key|*.pem|*.p12|*.pfx|*.jks|*.keystore) return 0 ;;
-        id_rsa*|id_dsa*|id_ed25519*|id_ecdsa*) return 0 ;;
-        *) return 1 ;;
-    esac
-}
-```
-
-### Config Files with Potential Secrets
-
-```bash
-should_scan_for_secrets() {
-    local file="$1"
-    case "$file" in
-        *.json|*.yaml|*.yml|*.toml|*.ini|*.conf|*.config) return 0 ;;
-        *.js|*.ts|*.py|*.rb|*.go|*.java) return 0 ;;
-        *) return 1 ;;
-    esac
-}
-```
-
----
-
-## Gitignore Recommendations
-
-Based on detected sensitive patterns, recommend `.gitignore` entries:
-
-```bash
-# Environment files
-.env
-.env.*
-!.env.example
-
-# Keys and certificates
-*.key
-*.pem
-*.p12
-*.pfx
-*.jks
-*.keystore
-
-# SSH keys
-id_rsa*
-id_dsa*
-id_ed25519*
-id_ecdsa*
-
-# Cloud credentials
-.aws/credentials
-.gcloud/
-.azure/
-
-# Package manager configs with tokens
-.npmrc
-.pypirc
-.netrc
-
-# Database files
-*.sql
-*.dump
-*.sqlite
-*.db
-
-# Logs
-*.log
-logs/
-
-# IDE and OS
-.idea/
-.vscode/
-*.swp
-*.swo
-*~
-.DS_Store
-Thumbs.db
-```

package/plugins/devflow-debug/skills/git-safety/references/patterns.md

@@ -1,289 +0,0 @@
-# Git Safety Patterns
-
-Correct patterns for safe git operations.
-
----
-
-## Core Patterns
-
-### Sequential Operations
-
-```bash
-# Always chain git commands with &&
-git add file.ts && git commit -m "message" && git push
-
-# Never run in parallel - use sequential execution
-```
-
-### Lock Handling
-
-```bash
-# Check for and wait on locks
-wait_for_lock_release() {
-  while [ -f .git/index.lock ]; do
-    sleep 0.1
-  done
-}
-```
-
-### Safe Amend
-
-```bash
-# Only amend if not pushed
-if ! git log origin/$(git branch --show-current)..HEAD | grep -q .; then
-  git commit --amend  # Safe - not pushed
-fi
-```
-
----
-
-## Lock File Handling - Full Implementation
-
-```bash
-# Function to wait for lock file release
-wait_for_lock_release() {
-    local max_wait=10
-    local waited=0
-    while [ -f .git/index.lock ]; do
-        if [ $waited -ge $max_wait ]; then
-            echo "ERROR: .git/index.lock still exists after ${max_wait}s"
-            echo "Another git process may be running, or a process crashed."
-            echo "Check: ps aux | grep git"
-            return 1
-        fi
-        echo "Waiting for git lock to be released... (${waited}s)"
-        sleep 1
-        waited=$((waited + 1))
-    done
-    return 0
-}
-
-# Always call before git operations
-wait_for_lock_release || exit 1
-```
-
----
-
-## Complete Commit Flow
-
-```bash
-# 1. Wait for lock
-wait_for_lock_release || exit 1
-
-# 2. Check what's changing
-git status --porcelain
-
-# 3. Review changes
-git diff HEAD --stat
-
-# 4. Stage specific files (not blind 'git add .')
-git add src/specific-file.ts
-
-# 5. Create commit with proper message
-git commit -m "$(cat <<'EOF'
-type(scope): summary
-
-Description
-
-EOF
-)"
-
-# 6. Verify
-git log -1 --stat
-git status
-```
-
----
-
-## Safe Push Workflow
-
-```bash
-# Check remote status first
-git fetch origin
-git status
-
-# If behind, pull first
-if git status | grep -q "behind"; then
-    git pull --rebase origin $(git branch --show-current)
-fi
-
-# Push
-git push -u origin $(git branch --show-current)
-```
-
----
-
-## Protected Branch Check
-
-```bash
-PROTECTED_BRANCHES="main master develop"
-
-check_protected_branch() {
-    local branch="$1"
-    for protected in $PROTECTED_BRANCHES; do
-        if [ "$branch" = "$protected" ]; then
-            echo "ERROR: Cannot force push to $branch"
-            return 1
-        fi
-    done
-    return 0
-}
-```
-
----
-
-## Pre-commit Hook Handling
-
-### If Hook Modifies Files
-
-```bash
-# Run commit
-git commit -m "message"
-
-# If hook modified files, amend to include them
-git add .
-git commit --amend --no-edit
-```
-
-### If Hook Rejects Commit
-
-```bash
-# DO NOT amend - fix the issue and create new commit
-
-# Fix the issue
-eslint --fix src/
-
-# Stage and commit fresh
-git add .
-git commit -m "fix: resolve linting issues"
-```
-
----
-
-## Amend Verification
-
-```bash
-# Check if commit is pushed
-if git status | grep -q "Your branch is ahead"; then
-    echo "Safe to amend - not pushed"
-else
-    echo "DANGER: May be pushed - do NOT amend"
-fi
-
-# Verify commit author
-git log -1 --format='%an %ae'
-```
-
----
-
-## Recovery Workflows
-
-### Undo Last Commit (not pushed)
-
-```bash
-# Keep changes staged
-git reset --soft HEAD~1
-
-# Keep changes unstaged
-git reset HEAD~1
-
-# Discard changes (DANGEROUS)
-git reset --hard HEAD~1
-```
-
-### Recover Deleted Branch
-
-```bash
-# Find the commit
-git reflog
-
-# Recreate branch
-git checkout -b recovered-branch <commit-sha>
-```
-
-### Fix Wrong Branch
-
-```bash
-# If committed to wrong branch
-git reset --soft HEAD~1
-git stash
-git checkout correct-branch
-git stash pop
-git commit -m "message"
-```
-
-### Stash Handling
-
-```bash
-# Save work temporarily
-git stash push -m "description of changes"
-
-# List stashes
-git stash list
-
-# Apply most recent stash (keep in stash list)
-git stash apply
-
-# Apply and remove from list
-git stash pop
-
-# Apply specific stash
-git stash apply stash@{2}
-
-# Drop specific stash
-git stash drop stash@{0}
-
-# Clear all stashes (DANGEROUS)
-git stash clear
-```
-
-### Interactive Stash Recovery
-
-```bash
-# Show stash contents
-git stash show -p stash@{0}
-
-# Create branch from stash
-git stash branch new-branch stash@{0}
-```
-
----
-
-## Branch Naming Examples
-
-```bash
-# Feature branches
-git checkout -b feat/short-description
-
-# Bug fixes
-git checkout -b fix/issue-123-description
-
-# Releases
-git checkout -b release/v1.2.0
-
-# Hotfixes
-git checkout -b hotfix/critical-fix
-```
-
----
-
-## Sequential Operation Patterns
-
-```bash
-# WRONG - parallel execution
-git add . &
-git status &
-wait
-
-# CORRECT - sequential with && chains
-wait_for_lock_release && \
-git add . && \
-git status && \
-echo "Done"
-```
-
----
-
-## Quick Reference
-
-See [detection.md](detection.md) for sensitive file patterns.

package/plugins/devflow-debug/skills/git-safety/references/violations.md

@@ -1,18 +0,0 @@
-# Git Safety Violations
-
-Common git safety violations:
-
-## Violations
-
-| Violation | Risk | Fix |
-|-----------|------|-----|
-| Parallel git commands | Index corruption | Run git commands sequentially |
-| Force push to main | Lost commits | Never force push protected branches |
-| Committing secrets | Security breach | Use [detection.md](detection.md) patterns |
-| Amending after push | History rewrite | Create new commit instead |
-| Skipping hooks | Quality bypass | Never use `--no-verify` |
-| Ignoring lock files | Corruption | Wait for lock release |
-
-## Quick Reference
-
-See [commands.md](commands.md) for safe command patterns and [detection.md](detection.md) for sensitive file detection.

package/plugins/devflow-debug/skills/knowledge-persistence/SKILL.md

@@ -1,128 +0,0 @@
----
-name: knowledge-persistence
-description: >-
-  This skill should be used when recording architectural decisions or pitfalls
-  to project knowledge files, or when loading prior decisions and known pitfalls
-  for context during investigation, specification, or review.
-user-invocable: false
-allowed-tools: Read, Write, Bash
----
-
-# Knowledge Persistence
-
-Record architectural decisions and pitfalls to `.memory/knowledge/` files. This is the single source of truth for the extraction procedure — commands reference this skill instead of inlining the steps.
-
-## Iron Law
-
-> **SINGLE SOURCE OF TRUTH**
->
-> All knowledge extraction follows this procedure exactly. Commands never inline
-> their own extraction steps — they read this skill and follow it.
-
----
-
-## File Locations
-
-```
-.memory/knowledge/
-├── decisions.md    # ADR entries (append-only)
-└── pitfalls.md     # PF entries (area-specific gotchas)
-```
-
-## File Formats
-
-### decisions.md (ADR entries)
-
-**Template header** (create if file missing):
-```
-<!-- TL;DR: 0 decisions. Key: -->
-# Architectural Decisions
-
-Append-only. Status changes allowed; deletions prohibited.
-```
-
-**Entry format**:
-```markdown
-## ADR-{NNN}: {Title}
-
-- **Date**: {YYYY-MM-DD}
-- **Status**: Accepted
-- **Context**: {Why this decision was needed}
-- **Decision**: {What was decided}
-- **Consequences**: {Tradeoffs and implications}
-- **Source**: {command and identifier, e.g. `/implement TASK-123`}
-```
-
-### pitfalls.md (PF entries)
-
-**Template header** (create if file missing):
-```
-<!-- TL;DR: 0 pitfalls. Key: -->
-# Known Pitfalls
-
-Area-specific gotchas, fragile areas, and past bugs.
-```
-
-**Entry format**:
-```markdown
-## PF-{NNN}: {Short description}
-
-- **Area**: {file paths or module names}
-- **Issue**: {What goes wrong}
-- **Impact**: {Consequences if hit}
-- **Resolution**: {How to fix or avoid}
-- **Source**: {command and identifier, e.g. `/code-review branch-name`}
-```
-
----
-
-## Extraction Procedure
-
-Follow these steps when recording decisions or pitfalls:
-
-1. **Read** the target file (`.memory/knowledge/decisions.md` or `.memory/knowledge/pitfalls.md`). If it doesn't exist, create it with the template header above.
-2. **Check capacity** — count `## ADR-` or `## PF-` headings. If >=50, log "Knowledge base at capacity — skipping new entry" and stop.
-3. **Find next ID** — find highest NNN via regex (`/^## ADR-(\d+)/` or `/^## PF-(\d+)/`), default to 0. Increment by 1.
-4. **Deduplicate** (pitfalls only) — skip if an entry with the same Area + Issue already exists.
-5. **Append** the new entry using the format above.
-6. **Update TL;DR** — rewrite the `<!-- TL;DR: ... -->` comment on line 1 to reflect the new count and key topics.
-
-## Lock Protocol
-
-When writing, use a mkdir-based lock:
-- Lock path: `.memory/.knowledge.lock`
-- Timeout: 30 seconds (fail if lock not acquired)
-- Stale recovery: if lock directory is >60 seconds old, remove it and retry
-- Release lock after write completes (remove lock directory)
-
-## Loading Knowledge for Context
-
-When a command needs prior knowledge as input (not recording):
-
-1. Read `.memory/knowledge/decisions.md` if it exists
-2. Read `.memory/knowledge/pitfalls.md` if it exists
-3. Pass content as context to downstream agents — prior decisions constrain scope, known pitfalls inform investigation
-
-If neither file exists, skip silently. No error, no empty-file creation.
-
-## Operation Budget
-
-Recording: do inline (no agent spawn), 2-3 Read/Write operations total.
-Loading: 1-2 Read operations, pass as context string.
-
----
-
-## Extended References
-
-For entry examples and status lifecycle details:
-- `references/examples.md` - Full decision and pitfall entry examples
-
----
-
-## Success Criteria
-
-- [ ] Entry appended with correct sequential ID
-- [ ] No duplicate pitfalls (same Area + Issue)
-- [ ] TL;DR comment updated with current count
-- [ ] Lock acquired before write, released after
-- [ ] Capacity limit (50) respected