dsh-ecc-skills 0.4.0

package/skills/nestjs-patterns/SKILL.md

@@ -0,0 +1,231 @@
+---
+name: nestjs-patterns
+description: NestJS architecture patterns for modules, controllers, providers, DTO validation, guards, interceptors, config, and production-grade TypeScript backends. Use when building or reviewing a NestJS backend — modules, providers, DTO validation, guards, or interceptors.
+metadata:
+  origin: ECC
+---
+
+# NestJS Development Patterns
+
+Production-grade NestJS patterns for modular TypeScript backends.
+
+## When to Activate
+
+- Building NestJS APIs or services
+- Structuring modules, controllers, and providers
+- Adding DTO validation, guards, interceptors, or exception filters
+- Configuring environment-aware settings and database integrations
+- Testing NestJS units or HTTP endpoints
+
+## Project Structure
+
+```text
+src/
+├── app.module.ts
+├── main.ts
+├── common/
+│   ├── filters/
+│   ├── guards/
+│   ├── interceptors/
+│   └── pipes/
+├── config/
+│   ├── configuration.ts
+│   └── validation.ts
+├── modules/
+│   ├── auth/
+│   │   ├── auth.controller.ts
+│   │   ├── auth.module.ts
+│   │   ├── auth.service.ts
+│   │   ├── dto/
+│   │   ├── guards/
+│   │   └── strategies/
+│   └── users/
+│       ├── dto/
+│       ├── entities/
+│       ├── users.controller.ts
+│       ├── users.module.ts
+│       └── users.service.ts
+└── prisma/ or database/
+```
+
+- Keep domain code inside feature modules.
+- Put cross-cutting filters, decorators, guards, and interceptors in `common/`.
+- Keep DTOs close to the module that owns them.
+
+## Bootstrap and Global Validation
+
+```ts
+async function bootstrap() {
+  const app = await NestFactory.create(AppModule, { bufferLogs: true });
+
+  app.useGlobalPipes(
+    new ValidationPipe({
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      transform: true,
+      transformOptions: { enableImplicitConversion: true },
+    }),
+  );
+
+  app.useGlobalInterceptors(new ClassSerializerInterceptor(app.get(Reflector)));
+  app.useGlobalFilters(new HttpExceptionFilter());
+
+  await app.listen(process.env.PORT ?? 3000);
+}
+bootstrap();
+```
+
+- Always enable `whitelist` and `forbidNonWhitelisted` on public APIs.
+- Prefer one global validation pipe instead of repeating validation config per route.
+
+## Modules, Controllers, and Providers
+
+```ts
+@Module({
+  controllers: [UsersController],
+  providers: [UsersService],
+  exports: [UsersService],
+})
+export class UsersModule {}
+
+@Controller('users')
+export class UsersController {
+  constructor(private readonly usersService: UsersService) {}
+
+  @Get(':id')
+  getById(@Param('id', ParseUUIDPipe) id: string) {
+    return this.usersService.getById(id);
+  }
+
+  @Post()
+  create(@Body() dto: CreateUserDto) {
+    return this.usersService.create(dto);
+  }
+}
+
+@Injectable()
+export class UsersService {
+  constructor(private readonly usersRepo: UsersRepository) {}
+
+  async create(dto: CreateUserDto) {
+    return this.usersRepo.create(dto);
+  }
+}
+```
+
+- Controllers should stay thin: parse HTTP input, call a provider, return response DTOs.
+- Put business logic in injectable services, not controllers.
+- Export only the providers other modules genuinely need.
+
+## DTOs and Validation
+
+```ts
+export class CreateUserDto {
+  @IsEmail()
+  email!: string;
+
+  @IsString()
+  @Length(2, 80)
+  name!: string;
+
+  @IsOptional()
+  @IsEnum(UserRole)
+  role?: UserRole;
+}
+```
+
+- Validate every request DTO with `class-validator`.
+- Use dedicated response DTOs or serializers instead of returning ORM entities directly.
+- Avoid leaking internal fields such as password hashes, tokens, or audit columns.
+
+## Auth, Guards, and Request Context
+
+```ts
+@UseGuards(JwtAuthGuard, RolesGuard)
+@Roles('admin')
+@Get('admin/report')
+getAdminReport(@Req() req: AuthenticatedRequest) {
+  return this.reportService.getForUser(req.user.id);
+}
+```
+
+- Keep auth strategies and guards module-local unless they are truly shared.
+- Encode coarse access rules in guards, then do resource-specific authorization in services.
+- Prefer explicit request types for authenticated request objects.
+
+## Exception Filters and Error Shape
+
+```ts
+@Catch()
+export class HttpExceptionFilter implements ExceptionFilter {
+  catch(exception: unknown, host: ArgumentsHost) {
+    const response = host.switchToHttp().getResponse<Response>();
+    const request = host.switchToHttp().getRequest<Request>();
+
+    if (exception instanceof HttpException) {
+      return response.status(exception.getStatus()).json({
+        path: request.url,
+        error: exception.getResponse(),
+      });
+    }
+
+    return response.status(500).json({
+      path: request.url,
+      error: 'Internal server error',
+    });
+  }
+}
+```
+
+- Keep one consistent error envelope across the API.
+- Throw framework exceptions for expected client errors; log and wrap unexpected failures centrally.
+
+## Config and Environment Validation
+
+```ts
+ConfigModule.forRoot({
+  isGlobal: true,
+  load: [configuration],
+  validate: validateEnv,
+});
+```
+
+- Validate env at boot, not lazily at first request.
+- Keep config access behind typed helpers or config services.
+- Split dev/staging/prod concerns in config factories instead of branching throughout feature code.
+
+## Persistence and Transactions
+
+- Keep repository / ORM code behind providers that speak domain language.
+- For Prisma or TypeORM, isolate transactional workflows in services that own the unit of work.
+- Do not let controllers coordinate multi-step writes directly.
+
+## Testing
+
+```ts
+describe('UsersController', () => {
+  let app: INestApplication;
+
+  beforeAll(async () => {
+    const moduleRef = await Test.createTestingModule({
+      imports: [UsersModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
+    await app.init();
+  });
+});
+```
+
+- Unit test providers in isolation with mocked dependencies.
+- Add request-level tests for guards, validation pipes, and exception filters.
+- Reuse the same global pipes/filters in tests that you use in production.
+
+## Production Defaults
+
+- Enable structured logging and request correlation ids.
+- Terminate on invalid env/config instead of booting partially.
+- Prefer async provider initialization for DB/cache clients with explicit health checks.
+- Keep background jobs and event consumers in their own modules, not inside HTTP controllers.
+- Make rate limiting, auth, and audit logging explicit for public endpoints.

package/skills/netmiko-ssh-automation/SKILL.md

@@ -0,0 +1,174 @@
+---
+name: netmiko-ssh-automation
+description: Safe Python Netmiko patterns for read-only collection, bounded batch SSH, TextFSM parsing, guarded config changes, timeouts, and network automation error handling. Use when automating network device access with Python Netmiko, whether collecting state or pushing guarded config changes.
+metadata:
+  origin: community
+---
+
+# Netmiko SSH Automation
+
+Use this skill when writing or reviewing Python automation that connects to
+network devices with Netmiko. Keep the default path read-only; config changes
+need a separate change window, peer review, and rollback plan.
+
+## When to Use
+
+- Collecting `show` command output across routers, switches, or firewalls.
+- Building a small audit script for interface, routing, or config evidence.
+- Adding timeouts and exception handling to network SSH scripts.
+- Parsing command output with TextFSM when a template exists.
+- Reviewing automation before it touches production devices.
+
+## Safety Defaults
+
+- Start with read-only `send_command()` collection.
+- Keep inventory small and explicit; do not sweep whole address ranges.
+- Use environment variables, a vault, or `getpass`; never hardcode credentials.
+- Set connection and read timeouts.
+- Limit concurrency so older devices are not overloaded.
+- Require an explicit operator flag before `send_config_set()`.
+- Do not call `save_config()` until the change has been verified and approved.
+
+## Read-Only Connection Pattern
+
+```python
+import os
+from getpass import getpass
+from netmiko import ConnectHandler
+from netmiko.exceptions import (
+    NetmikoAuthenticationException,
+    NetmikoTimeoutException,
+    ReadTimeout,
+)
+
+device = {
+    "device_type": "cisco_ios",
+    "host": "192.0.2.10",
+    "username": os.environ.get("NETMIKO_USERNAME") or input("Username: "),
+    "password": os.environ.get("NETMIKO_PASSWORD") or getpass("Password: "),
+    "secret": os.environ.get("NETMIKO_ENABLE_SECRET"),
+    "conn_timeout": 10,
+    "auth_timeout": 20,
+    "banner_timeout": 15,
+    "read_timeout_override": 30,
+}
+
+try:
+    with ConnectHandler(**device) as conn:
+        if device.get("secret") and not conn.check_enable_mode():
+            conn.enable()
+        output = conn.send_command("show ip interface brief", read_timeout=30)
+        print(output)
+except NetmikoAuthenticationException:
+    print("Authentication failed")
+except NetmikoTimeoutException:
+    print("SSH connection timed out")
+except ReadTimeout:
+    print("Command read timed out")
+```
+
+Use placeholder addresses from documentation ranges in examples. Keep real
+inventory in an ignored local file or a secrets-managed system.
+
+## Batch Collection
+
+```python
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from typing import Any
+
+def collect_show(device: dict[str, Any], command: str) -> dict[str, Any]:
+    host = device["host"]
+    try:
+        with ConnectHandler(**device) as conn:
+            output = conn.send_command(command, read_timeout=45)
+        return {"host": host, "ok": True, "output": output}
+    except (NetmikoAuthenticationException, NetmikoTimeoutException, ReadTimeout) as exc:
+        return {"host": host, "ok": False, "error": type(exc).__name__}
+
+results = []
+with ThreadPoolExecutor(max_workers=8) as pool:
+    futures = [pool.submit(collect_show, device, "show version") for device in devices]
+    for future in as_completed(futures):
+        results.append(future.result())
+```
+
+Keep `max_workers` low unless the device estate and AAA systems are known to
+handle higher connection volume.
+
+## Structured Parsing
+
+Netmiko can ask TextFSM, TTP, or Genie to parse supported command output. Treat
+parser output as an optimization, not the only evidence path.
+
+```python
+with ConnectHandler(**device) as conn:
+    parsed = conn.send_command(
+        "show ip interface brief",
+        use_textfsm=True,
+        raise_parsing_error=False,
+        read_timeout=30,
+    )
+
+if isinstance(parsed, str):
+    print("No parser template matched; store raw output for review")
+else:
+    for row in parsed:
+        print(row)
+```
+
+If parsing drives a blocking decision, keep the raw command output alongside
+the parsed result so an operator can inspect mismatches.
+
+## Guarded Config Pattern
+
+```python
+import os
+
+commands = [
+    "interface GigabitEthernet0/1",
+    "description CHANGE-1234 UPLINK-TO-CORE",
+]
+
+apply_changes = os.environ.get("APPLY_NETWORK_CHANGES") == "1"
+
+if not apply_changes:
+    print("Dry run only. Candidate commands:")
+    print("\n".join(commands))
+else:
+    with ConnectHandler(**device) as conn:
+        conn.enable()
+        before = conn.send_command("show running-config interface GigabitEthernet0/1")
+        output = conn.send_config_set(commands)
+        after = conn.send_command("show running-config interface GigabitEthernet0/1")
+        print(before)
+        print(output)
+        print(after)
+        print("Verify behavior before saving startup config.")
+```
+
+Saving the config is a separate approval step. In production, include a rollback
+snippet and capture before/after evidence in the change record.
+
+## Review Checklist
+
+- Does the script identify an explicit inventory source?
+- Are credentials absent from source, logs, and exception messages?
+- Are `conn_timeout`, `auth_timeout`, and command `read_timeout` set?
+- Are failures reported per device without stopping the whole batch?
+- Does the script avoid broad scans and unbounded concurrency?
+- Are config changes behind a dry-run or explicit operator flag?
+- Is `save_config()` separate from the initial push and tied to verification?
+
+## Anti-Patterns
+
+- Hardcoding passwords, enable secrets, or private keys in source.
+- Sending config commands as the default code path.
+- Running automation against a CIDR range instead of a reviewed inventory.
+- Logging full running configs to shared systems without sanitization.
+- Treating parser success as proof that the device state is correct.
+
+## See Also
+
+- Skill: `cisco-ios-patterns`
+- Skill: `network-config-validation`
+- Skill: `network-interface-health`

package/skills/network-bgp-diagnostics/SKILL.md

@@ -0,0 +1,168 @@
+---
+name: network-bgp-diagnostics
+description: Diagnostics-only BGP troubleshooting patterns for neighbor state, route exchange, prefix policy, AS path inspection, and safe evidence collection. Use when a BGP neighbor is down, routes are missing, or prefix policy and AS path need inspection.
+metadata:
+  origin: community
+---
+
+# Network BGP Diagnostics
+
+Use this skill when a BGP session is down, flapping, established with missing
+routes, or advertising unexpected prefixes. The default workflow is read-only
+evidence collection; policy and reset actions belong in a reviewed change
+window.
+
+## When to Use
+
+- BGP neighbors are stuck in Idle, Connect, Active, OpenSent, or OpenConfirm.
+- A session is Established but expected prefixes are missing.
+- A route-map, prefix-list, max-prefix limit, or AS path policy may be filtering
+  routes.
+- You need before/after evidence for a BGP change.
+- You are reviewing automation that parses BGP summary output.
+
+## Read-Only Triage Flow
+
+1. Identify the exact neighbor, address family, VRF, and local/remote ASNs.
+2. Capture summary state and last reset reason.
+3. Prove reachability to the peer source address.
+4. Check route policy references before assuming transport failure.
+5. Compare advertised, received, and installed routes where the platform
+   supports those commands.
+
+```text
+show bgp summary
+show bgp neighbors <peer>
+show ip route <peer>
+show tcp brief | include <peer>|:179
+show logging | include BGP|<peer>
+show running-config | section router bgp
+show ip prefix-list
+show route-map
+```
+
+Use platform-specific address-family commands when the device uses VRFs, IPv6,
+VPNv4, or EVPN. Do not assume global IPv4 unicast.
+
+## State Interpretation
+
+| State | First checks |
+| --- | --- |
+| Established with prefix count | Route exchange is up; inspect policy and table selection |
+| Established with zero prefixes | Check inbound policy, max-prefix, advertised routes, and AFI/SAFI |
+| Active | TCP session is not completing; check routing, source, ACLs, and peer reachability |
+| Connect | TCP connection is in progress; check path and remote listener |
+| OpenSent/OpenConfirm | TCP works; check ASN, authentication, timers, capabilities, and logs |
+| Idle | Neighbor may be disabled, missing config, blocked by policy, or backoff timer |
+
+## Transport Checks
+
+```text
+ping <peer> source <local-source>
+traceroute <peer> source <local-source>
+show ip route <peer>
+show bgp neighbors <peer> | include BGP state|Last reset|Local host|Foreign host
+```
+
+If the peer is sourced from a loopback, confirm both directions route to the
+loopback addresses and that the neighbor config uses the expected update source.
+
+Avoid disabling ACLs or firewall policy as a diagnostic shortcut. Read hit
+counters, logs, and path state first.
+
+## Route Policy Checks
+
+```text
+show bgp neighbors <peer> advertised-routes
+show bgp neighbors <peer> routes
+show ip prefix-list <name>
+show route-map <name>
+show bgp <prefix>
+```
+
+Some platforms require additional configuration before `received-routes` is
+available. Do not add that configuration during incident triage unless the
+operator approves the change.
+
+## AS Path And Prefix Review
+
+```text
+show bgp regexp _65001_
+show bgp regexp ^65001$
+show bgp <prefix>
+show bgp neighbors <peer> advertised-routes | include Network|Path|<prefix>
+```
+
+Use AS-path regex carefully. `_65001_` matches AS 65001 as a token. Plain
+`65001` can match longer ASNs or unrelated text.
+
+## Parser Pattern
+
+```python
+import re
+from typing import Any
+
+BGP_SUMMARY_RE = re.compile(
+    r"^(?P<neighbor>\d{1,3}(?:\.\d{1,3}){3})\s+"
+    r"(?P<version>\d+)\s+"
+    r"(?P<remote_as>\d+)\s+"
+    r"(?P<msg_rcvd>\d+)\s+"
+    r"(?P<msg_sent>\d+)\s+"
+    r"(?P<table_version>\d+)\s+"
+    r"(?P<input_queue>\d+)\s+"
+    r"(?P<output_queue>\d+)\s+"
+    r"(?P<uptime>\S+)\s+"
+    r"(?P<state_or_prefixes>\S+)$",
+    re.M,
+)
+
+def parse_bgp_summary(raw: str) -> list[dict[str, Any]]:
+    rows = []
+    for match in BGP_SUMMARY_RE.finditer(raw):
+        state_or_prefixes = match.group("state_or_prefixes")
+        if state_or_prefixes.isdigit():
+            state = "Established"
+            prefixes_received = int(state_or_prefixes)
+        else:
+            state = state_or_prefixes
+            prefixes_received = None
+        rows.append({
+            "neighbor": match.group("neighbor"),
+            "remote_as": int(match.group("remote_as")),
+            "state": state,
+            "prefixes_received": prefixes_received,
+            "uptime": match.group("uptime"),
+        })
+    return rows
+```
+
+Prefer structured parser output when available, but store raw output with the
+incident record because BGP summary formats vary by platform and address family.
+
+## Change-Window Only
+
+These actions can affect routing and should not be suggested as automatic
+diagnostics:
+
+- Clearing a BGP session.
+- Changing neighbor authentication, timers, update source, route-maps, or
+  prefix-lists.
+- Enabling additional received-route storage.
+- Relaxing firewall, ACL, or control-plane policy.
+
+If a reset is approved, prefer the least disruptive soft or route-refresh option
+supported by the platform and document exactly why it is safe.
+
+## Anti-Patterns
+
+- Assuming `Active` always means the remote side is down.
+- Ignoring VRF, address family, or update-source differences.
+- Using broad AS-path regex without token boundaries.
+- Hard-resetting a peer before reading last reset reason and logs.
+- Treating missing `received-routes` output as proof that no routes arrived.
+
+## See Also
+
+- Skill: `cisco-ios-patterns`
+- Skill: `network-config-validation`
+- Skill: `network-interface-health`