devflow-kit 1.8.3 → 2.0.1

package/plugins/devflow-code-review/skills/security-patterns/references/violations.md

@@ -1,237 +0,0 @@
-# Security Violation Examples
-
-Extended violation patterns for security reviews. Reference from main SKILL.md.
-
-## Injection Vulnerabilities
-
-### SQL Injection
-```typescript
-// VULNERABLE: String interpolation in query
-const user = await db.query(`SELECT * FROM users WHERE id = '${userId}'`);
-const result = await db.query(`SELECT * FROM products WHERE name LIKE '%${search}%'`);
-```
-
-### NoSQL Injection
-```typescript
-// VULNERABLE: Direct object from request
-const user = await db.users.findOne({ username: req.body.username });
-// Attacker sends: { username: { $gt: "" } }
-
-// VULNERABLE: $where operator accepts arbitrary JS
-db.users.find({ $where: `this.name === '${userInput}'` });
-
-// VULNERABLE: regex injection
-db.users.find({ name: { $regex: userInput } });
-// Attacker sends: ".*" (matches everything)
-```
-
-### Command Injection
-```typescript
-// VULNERABLE: User input in shell command
-exec(`ls ${userInput}`);
-exec(`convert ${filename} output.png`);
-exec(`ping -c 4 ${hostname}`);
-
-// Dangerous characters: ; | & $ ` ( ) < > \ ' "
-// Example attack: userInput = "file.txt; rm -rf /"
-```
-
-### Path Traversal
-```typescript
-// VULNERABLE: Direct path concatenation
-const file = req.params.filename;
-fs.readFile(`./uploads/${file}`);  // Attacker: ../../../etc/passwd
-
-// VULNERABLE: Encoded traversal
-// Attacker sends: %2e%2e%2f%2e%2e%2fetc/passwd (URL encoded ../..)
-const decoded = decodeURIComponent(req.params.filename);
-fs.readFile(`./uploads/${decoded}`);
-
-// VULNERABLE: Double encoding
-// Attacker sends: %252e%252e%252f (double-encoded ../)
-```
-
-### LDAP Injection
-```typescript
-// VULNERABLE: Unescaped LDAP filter
-const filter = `(uid=${username})`;
-ldap.search(baseDN, filter);
-// Attacker: username = "admin)(&(password=*)"
-```
-
-### Template Injection (SSTI)
-```typescript
-// VULNERABLE: User input in template
-const template = `Hello ${req.body.name}!`;
-ejs.render(template);
-// Attacker: name = "<%= process.env.SECRET %>"
-```
-
-### Header Injection
-```typescript
-// VULNERABLE: CRLF injection
-res.setHeader('Location', `/user/${userInput}`);
-// Attacker: userInput = "test\r\nSet-Cookie: admin=true"
-```
-
----
-
-## Authentication Vulnerabilities
-
-### Weak Password Policies
-```typescript
-// VULNERABLE: Weak password requirements
-if (password.length >= 6) { /* accept */ }
-```
-
-### Session Management Issues
-```typescript
-// VULNERABLE: Session ID in URL
-app.get('/dashboard?session=abc123');
-
-// VULNERABLE: Predictable session IDs
-const sessionId = `user_${userId}`;
-
-// VULNERABLE: No session timeout or rotation
-```
-
-### JWT Misuse
-```typescript
-// VULNERABLE: Weak secret
-jwt.sign(payload, 'secret123');
-
-// VULNERABLE: No expiration
-jwt.sign(payload, secret);
-
-// VULNERABLE: Algorithm confusion (accepts 'none')
-jwt.verify(token, secret);  // Without algorithm specification
-```
-
-### Missing Authorization
-```typescript
-// VULNERABLE: No auth checks
-app.delete('/api/users/:id', async (req, res) => {
-  await deleteUser(req.params.id);  // No auth check!
-});
-```
-
----
-
-## Cryptography Vulnerabilities
-
-### Hardcoded Secrets
-```typescript
-// VULNERABLE: Secrets in code
-const API_KEY = 'sk-abc123xyz789';
-const dbPassword = 'admin123';
-const jwtSecret = 'mysecret';
-
-// VULNERABLE: Secrets in config files
-const config = {
-  database: {
-    password: 'prod_password_123'
-  },
-  api: {
-    key: 'sk-live-abcdef123456'
-  }
-};
-```
-
-### Weak Cryptography
-```typescript
-// VULNERABLE: Broken hash algorithms
-crypto.createHash('md5').update(password);  // MD5 is broken
-crypto.createHash('sha1').update(password);  // SHA1 weak for passwords
-
-// VULNERABLE: Using password directly as key
-const key = password;
-crypto.createCipheriv('aes-256-gcm', key, iv);
-```
-
-### Insecure Random
-```typescript
-// VULNERABLE: Predictable random
-const token = Math.random().toString(36);  // Predictable!
-const id = Date.now().toString();
-const code = Math.floor(Math.random() * 1000000);
-```
-
-### Weak Encryption
-```typescript
-// VULNERABLE: ECB mode (patterns visible)
-crypto.createCipheriv('aes-256-ecb', key, null);
-
-// VULNERABLE: No authentication (CBC without HMAC)
-crypto.createCipheriv('aes-256-cbc', key, iv);
-```
-
-### Timing Attacks
-```typescript
-// VULNERABLE: Early exit reveals length info
-function verifyToken(provided: string, stored: string): boolean {
-  return provided === stored; // Early exit reveals info
-}
-```
-
----
-
-## Detection Grep Commands
-
-### Injection Detection
-```bash
-# SQL Injection
-grep -rn "query.*\${" --include="*.ts" --include="*.js"
-grep -rn "query.*+ " --include="*.ts" --include="*.js"
-grep -rn "execute.*\`" --include="*.ts" --include="*.js"
-
-# NoSQL Injection
-grep -rn "findOne.*req\.\|find.*req\." --include="*.ts" --include="*.js"
-grep -rn "\$where" --include="*.ts" --include="*.js"
-
-# Command Injection
-grep -rn "exec\s*\(" --include="*.ts" --include="*.js"
-grep -rn "spawn.*\`\|execSync.*\`" --include="*.ts" --include="*.js"
-
-# Path Traversal
-grep -rn "readFile.*req\.\|readFileSync.*req\." --include="*.ts" --include="*.js"
-grep -rn "path\.join.*req\." --include="*.ts" --include="*.js"
-```
-
-### Auth Detection
-```bash
-# Missing auth middleware
-grep -rn "app\.\(get\|post\|put\|delete\).*async" --include="*.ts" --include="*.js" | \
-  grep -v "requireAuth\|isAuthenticated\|authorize"
-
-# Weak JWT configuration
-grep -rn "jwt\.sign\|jwt\.verify" --include="*.ts" --include="*.js" -A 5 | \
-  grep -v "algorithm\|expiresIn"
-
-# Session issues
-grep -rn "session\|cookie" --include="*.ts" --include="*.js" | \
-  grep -v "httpOnly\|secure\|sameSite"
-
-# Password handling
-grep -rn "password.*length" --include="*.ts" --include="*.js"
-```
-
-### Crypto Detection
-```bash
-# Hardcoded secrets
-grep -rn "password.*=.*['\"]" --include="*.ts" --include="*.js"
-grep -rn "api.key.*=.*['\"]" --include="*.ts" --include="*.js"
-grep -rn "secret.*=.*['\"]" --include="*.ts" --include="*.js"
-grep -rn "sk-\|pk-\|api_" --include="*.ts" --include="*.js"
-
-# Weak crypto
-grep -rn "createHash.*md5\|sha1" --include="*.ts" --include="*.js"
-grep -rn "DES\|RC4\|Blowfish" --include="*.ts" --include="*.js"
-grep -rn "aes-.*-ecb\|aes-.*-cbc" --include="*.ts" --include="*.js"
-
-# Insecure random
-grep -rn "Math.random" --include="*.ts" --include="*.js"
-grep -rn "Date.now.*id\|Date.now.*token" --include="*.ts" --include="*.js"
-
-# String comparison for secrets
-grep -rn "token.*===\|secret.*===\|key.*===" --include="*.ts" --include="*.js"
-```

package/plugins/devflow-code-review/skills/test-patterns/SKILL.md

@@ -1,183 +0,0 @@
----
-name: test-patterns
-description: This skill should be used when the user asks to "write tests", "fix failing tests", "improve test coverage", "add integration tests", "debug a flaky test", or reviews test quality. Provides behavior-focused testing patterns, coverage analysis, and detection of brittle test anti-patterns like implementation coupling and non-deterministic assertions.
-user-invocable: false
-allowed-tools: Read, Grep, Glob, AskUserQuestion
-activation:
-  file-patterns:
-    - "**/*.test.*"
-    - "**/*.spec.*"
-    - "**/test/**"
-    - "**/tests/**"
-    - "**/__tests__/**"
-  exclude:
-    - "node_modules/**"
----
-
-# Test Patterns
-
-## Iron Law
-
-> **TESTS VALIDATE BEHAVIOR, NOT IMPLEMENTATION**
->
-> A test should fail when behavior breaks, not when implementation changes. If refactoring
-> breaks tests without changing behavior, the tests are wrong. Mock boundaries, not internals.
-> Test the contract, not the code. If tests are hard to write, the design is wrong — fix the
-> architecture, not the tests.
-
----
-
-## Test Design Red Flags
-
-### 1. Complex Setup
-
-**RED FLAG**: Test setup >10 lines means the design is wrong.
-
-```typescript
-// VIOLATION: Too many dependencies
-beforeEach(async () => {
-  mockDb = new MockDatabase();
-  await mockDb.connect();
-  mockCache = new MockCache();
-  // ... 10+ more lines
-  service = new UserService(mockDb, mockCache, mockLogger, mockConfig);
-});
-
-// CORRECT: Simple setup
-it('should return Ok with valid data', () => {
-  const result = createUser({ name: 'test', email: 'test@example.com' });
-  expect(result.ok).toBe(true);
-});
-```
-
-**Detection**: `beforeEach` >10 lines, multiple mocks, async setup, database seeding
-
-### 2. Repetitive Boilerplate
-
-**RED FLAG**: Same pattern repeated >3 times means the API is wrong.
-
-```typescript
-// VIOLATION: Try/catch everywhere
-try { await api.createUser(data); fail(); } catch (e) { expect(e.status).toBe(400); }
-
-// CORRECT: Result types eliminate repetition
-const result = createUser(invalidData);
-expect(result.ok).toBe(false);
-expect(result.error.type).toBe('ValidationError');
-```
-
-### 3. Difficult Mocking
-
-**RED FLAG**: Mock setup >20 lines means dependencies are wrong.
-
-```typescript
-// VIOLATION: Nested mock structures
-mockDb = { transaction: jest.fn(), orders: { create: jest.fn(), update: jest.fn() } };
-
-// CORRECT: Pure functions need no mocking
-const result = processOrder(order);
-expect(result.ok).toBe(true);
-```
-
-### 4. Implementation Testing
-
-**RED FLAG**: Testing internals means tests are fragile.
-
-```typescript
-// VIOLATION: Spying on private methods
-const spy = jest.spyOn(cart as any, 'updateTotal');
-expect(spy).toHaveBeenCalled();
-
-// CORRECT: Test observable behavior
-expect(cart.getTotal()).toBe(10);
-```
-
----
-
-## Coverage & Review
-
-### Coverage Issues
-
-- **Untested new code**: New functions/branches without corresponding tests
-- **Missing edge cases**: Only happy path tested, no error paths
-- **Missing error paths**: `throw`/`reject` in source without matching test assertions
-
-### Test Quality Issues
-
-- **Brittle tests**: Testing HOW (mock call verification) not WHAT (outcome)
-- **Unclear test names**: `it('test1')` instead of `it('validates email format on creation')`
-- **Missing AAA structure**: Mixed arrange/act/assert without clear separation
-
-### Mocking Issues
-
-- **Over-mocking**: Everything mocked, nothing actually tested
-- **Mocking third-party internals**: Mock at your own interface boundary instead
-
----
-
-## Severity Guidelines
-
-| Severity | Criteria |
-|----------|----------|
-| **CRITICAL** | Tests pass but don't verify behavior; critical paths untested; tests mock everything |
-| **HIGH** | Missing error path coverage; flaky tests; extremely slow (>10s); >10 line setup |
-| **MEDIUM** | Some edge cases missing; weak assertions; unclear structure |
-| **LOW** | Organization could improve; naming could be clearer |
-
----
-
-## Test Suite Safety
-
-```typescript
-// vitest.config.ts / jest.config.js
-{ fileParallelism: false, maxWorkers: 1, testTimeout: 10000 }
-```
-
-```bash
-NODE_OPTIONS="--max-old-space-size=512" npm test
-```
-
----
-
-## Extended References
-
-For comprehensive examples and detection patterns:
-
-| Reference | Contents |
-|-----------|----------|
-| `references/violations.md` | Full violation examples for all categories |
-| `references/patterns.md` | Correct test patterns and organization |
-| `references/detection.md` | Bash commands for automated detection |
-| `references/report-template.md` | Full report format for documenting issues |
-
----
-
-## Quality Gates
-
-Tests pass design review when:
-- [ ] Setup code <10 lines per test file
-- [ ] No repetitive try/catch or error handling patterns
-- [ ] Mocking requires <5 lines of setup
-- [ ] No spying on private methods or internal state
-- [ ] Tests verify behavior, not implementation details
-- [ ] Pure business logic testable without mocks
-- [ ] New code has corresponding tests
-- [ ] All branches covered (happy path + errors + edge cases)
-- [ ] Test names describe expected behavior
-- [ ] Tests follow Arrange-Act-Assert structure
-- [ ] No real delays (use mocked timers)
-- [ ] No flaky patterns (race conditions, timing dependencies)
-
----
-
-## Review Checklist
-
-- [ ] New code has corresponding tests
-- [ ] All branches covered (happy path + errors + edge cases)
-- [ ] Tests verify behavior, not implementation
-- [ ] Test names describe expected behavior
-- [ ] Tests follow Arrange-Act-Assert structure
-- [ ] No real delays (use mocked timers)
-- [ ] Assertions are specific and meaningful
-- [ ] Mocking limited to boundaries (not internals)
-- [ ] No flaky patterns (race conditions, timing dependencies)

package/plugins/devflow-code-review/skills/test-patterns/references/patterns.md

@@ -1,220 +0,0 @@
-# Test Patterns - Correct Examples
-
-Reference for proper test patterns and approaches.
-
----
-
-## Simple Setup Patterns
-
-### Pure Function Testing
-
-```typescript
-// CORRECT: Simple setup indicates good design
-describe('createUser', () => {
-  it('should return Ok with valid data', () => {
-    const result = createUser({ name: 'test', email: 'test@example.com' });
-    expect(result.ok).toBe(true);
-    expect(result.value.name).toBe('test');
-  });
-
-  it('should return Err with invalid email', () => {
-    const result = createUser({ name: 'test', email: 'invalid' });
-    expect(result.ok).toBe(false);
-    expect(result.error.type).toBe('ValidationError');
-  });
-});
-```
-
----
-
-## Minimal Mocking Patterns
-
-### Single Dependency Injection
-
-```typescript
-// CORRECT: Single mock for focused test
-describe('OrderCalculator', () => {
-  it('should calculate total with tax', () => {
-    const taxService = { getRate: () => 0.1 }; // Simple mock
-    const calculator = new OrderCalculator(taxService);
-    const result = calculator.calculateTotal([
-      { price: 100, quantity: 2 },
-      { price: 50, quantity: 1 },
-    ]);
-    expect(result).toBe(275);
-  });
-});
-```
-
----
-
-## Behavior-Focused Testing
-
-```typescript
-// CORRECT: Testing behavior, not implementation
-describe('ShoppingCart', () => {
-  it('should calculate correct total after adding items', () => {
-    const cart = new ShoppingCart();
-    cart.addItem({ id: '1', price: 10 });
-    cart.addItem({ id: '2', price: 20 });
-    expect(cart.getTotal()).toBe(30);
-  });
-
-  it('should be empty after clearing', () => {
-    const cart = new ShoppingCart();
-    cart.addItem({ id: '1', price: 10 });
-    cart.clear();
-    expect(cart.getItems()).toEqual([]);
-    expect(cart.getTotal()).toBe(0);
-  });
-});
-```
-
----
-
-## Coverage Patterns
-
-### Branch Coverage
-
-```typescript
-describe('calculateDiscount', () => {
-  it('returns 10% for regular customers', () => {
-    expect(calculateDiscount(100, 'regular')).toBe(10);
-  });
-  it('returns 20% for premium customers', () => {
-    expect(calculateDiscount(100, 'premium')).toBe(20);
-  });
-  it('returns 30% for VIP customers', () => {
-    expect(calculateDiscount(100, 'vip')).toBe(30);
-  });
-});
-```
-
-### Error Path Coverage
-
-```typescript
-describe('fetchUser', () => {
-  it('returns user data on success', async () => { /* ... */ });
-  it('throws ApiError on 404', async () => {
-    api.get.mockResolvedValue({ ok: false, status: 404 });
-    await expect(fetchUser('123')).rejects.toThrow(ApiError);
-  });
-  it('handles network errors', async () => {
-    api.get.mockRejectedValue(new Error('Network error'));
-    await expect(fetchUser('123')).rejects.toThrow('Network error');
-  });
-});
-```
-
----
-
-## Separation of Concerns Testing
-
-```typescript
-// CORRECT: Business logic tested without I/O
-describe('OrderPricing (pure logic)', () => {
-  it('should calculate subtotal', () => {
-    const items = [{ price: 100, quantity: 2 }, { price: 50, quantity: 1 }];
-    expect(calculateSubtotal(items)).toBe(250);
-  });
-  it('should apply percentage discount', () => {
-    expect(applyDiscount(100, { type: 'percent', value: 20 })).toBe(80);
-  });
-});
-
-// Integration test for I/O wrapper
-describe('OrderService (integration)', () => {
-  it('should persist order and return result', async () => {
-    const mockRepo = { save: jest.fn().mockResolvedValue({ id: '1' }) };
-    const service = new OrderService(mockRepo);
-    const result = await service.createOrder({ items: [{ price: 100, quantity: 1 }] });
-    expect(result.ok).toBe(true);
-  });
-});
-```
-
----
-
-## Parameterized Testing
-
-```typescript
-describe('validateEmail', () => {
-  const validEmails = ['test@example.com', 'user.name@domain.org', 'user+tag@example.co.uk'];
-  const invalidEmails = ['', 'invalid', '@nodomain.com', 'spaces in@email.com'];
-
-  test.each(validEmails)('should accept valid email: %s', (email) => {
-    expect(validateEmail(email).ok).toBe(true);
-  });
-
-  test.each(invalidEmails)('should reject invalid email: %s', (email) => {
-    expect(validateEmail(email).ok).toBe(false);
-  });
-});
-```
-
----
-
-## Boundary Mocking
-
-```typescript
-// CORRECT: Wrap third-party libraries in your own interface
-interface HttpClient {
-  get<T>(url: string): Promise<T>;
-}
-
-class MockHttpClient implements HttpClient {
-  private responses: Map<string, any> = new Map();
-  mockResponse(url: string, data: any) { this.responses.set(url, data); }
-  async get<T>(url: string): Promise<T> { return this.responses.get(url); }
-}
-
-// Tests use MockHttpClient, production uses AxiosHttpClient
-```
-
----
-
-## Test Organization
-
-```typescript
-describe('UserService', () => {
-  let service: UserService;
-  let repo: InMemoryUserRepo;
-
-  beforeEach(() => {
-    repo = new InMemoryUserRepo();
-    service = new UserService(repo);
-  });
-
-  describe('create', () => {
-    it('creates user with valid data', async () => { /* ... */ });
-    it('rejects invalid email', async () => { /* ... */ });
-  });
-
-  describe('update', () => {
-    it('updates existing user', async () => { /* ... */ });
-    it('returns error for non-existent user', async () => { /* ... */ });
-  });
-});
-```
-
----
-
-## Test Data Factories
-
-```typescript
-// CORRECT: Factories for test data, not test setup
-const createTestUser = (overrides = {}): User => ({
-  id: 'test-id',
-  name: 'Test User',
-  email: 'test@example.com',
-  role: 'user',
-  ...overrides,
-});
-
-describe('UserPermissions', () => {
-  it('should allow admin to delete users', () => {
-    const admin = createTestUser({ role: 'admin' });
-    expect(canDeleteUser(admin)).toBe(true);
-  });
-});
-```