everything-gemini 0.0.0-stage → 1.0.0

package/skills/root-cause-debugger/scripts/git-bisect-helper.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Fast git bisect helper script
+
+TEST_CMD="${1:-npm test}"
+
+echo "Running bisect test: $TEST_CMD"
+if eval "$TEST_CMD" >/dev/null 2>&1; then
+  echo "Commit is GOOD (tests passed)"
+  exit 0
+else
+  echo "Commit is BAD (tests failed)"
+  exit 1
+fi

package/skills/security-audit/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: security-audit
+description: >-
+  Performs security audits, OWASP top 10 vulnerability checks, dependency vulnerability scans, and secret leakage detection. Use when reviewing code for security vulnerabilities.
+---
+
+# Security Audit
+
+This skill guides the agent through proactive security evaluations, secret detection, and dependency hygiene.
+
+## Audit Checklist
+
+### 1. Secret Scanning
+Ensure no sensitive keys, tokens, private keys, or credentials are hardcoded:
+- Check for `.env`, `*.pem`, `id_rsa`, AWS keys (`AKIA...`), GitHub tokens (`ghp_...`).
+- Execute `scripts/scan-secrets.sh` to search for known credential regex patterns.
+
+### 2. Dependency Vulnerability Assessment
+Run ecosystem-specific vulnerability scanners:
+- **Node**: `npm audit` or `pnpm audit`
+- **Python**: `pip-audit`
+- **Go**: `govulncheck ./...`
+- **Rust**: `cargo audit`
+
+### 3. Code-Level Vulnerability Inspection
+- **Injection Flaws**: Check all database queries for parameterized values. Ensure no raw string interpolation in SQL or NoSQL queries.
+- **Cross-Site Scripting (XSS)**: Ensure user input rendered in HTML is sanitized or escaped. In React, inspect any usage of `dangerouslySetInnerHTML`.
+- **Insecure Deserialization**: Avoid `eval()`, `pickle.loads()`, or unrestricted YAML parsing (`yaml.unsafe_load`).
+- **Path Traversal**: Ensure file system operations resolve paths against a safe root directory.

package/skills/security-audit/scripts/scan-secrets.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Fast secret scanner for committed files
+
+echo "Scanning tracked files for potential exposed secrets..."
+
+PATTERNS=(
+  "AKIA[0-9A-Z]{16}"
+  "ghp_[a-zA-Z0-9]{36}"
+  "github_pat_[a-zA-Z0-9_]{82}"
+  "-----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----"
+  "AIza[0-9A-Za-z\\-_]{35}"
+)
+
+FOUND=0
+for pattern in "${PATTERNS[@]}"; do
+  MATCHES=$(git grep -EI "$pattern" 2>/dev/null || true)
+  if [ -n "$MATCHES" ]; then
+    echo "⚠️ Potential secret match for pattern: $pattern"
+    echo "$MATCHES"
+    FOUND=$((FOUND + 1))
+  fi
+done
+
+if [ "$FOUND" -eq 0 ]; then
+  echo "✔ No high-entropy secrets detected."
+fi

package/skills/subagent-handoff/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: subagent-handoff
+description: >-
+  Guides the primary agent in delegating complex, multi-step subtasks to scoped subagents (Planner, Reviewer, Build-Repair, QA, Security) with minimal token contamination and deterministic handoffs.
+---
+
+# Subagent Handoff Protocol
+
+This skill governs how the primary agent orchestrates and delegates work to scoped subagents.
+
+## Core Directives
+
+1. **When to Delegate vs. Execute Directly**:
+   - **Delegate**: Visual browser testing (`browser_subagent`), deep dependency planning (`agents/planner.md`), adversarial code review (`agents/code-reviewer.md`), and build-break triage (`agents/build-repair.md`).
+   - **Execute Directly**: Simple file edits, direct user questions, single test runs, and minor refactorings.
+
+2. **The Clean Handoff Principle**:
+   - Never dump the entire conversation history into the subagent prompt.
+   - Provide a self-contained, bounded task prompt containing:
+     1. Specific objective.
+     2. Exact file paths to inspect.
+     3. Clear constraints and tools allowed.
+     4. Explicit stop condition and expected return report schema.
+
+3. **Synthesis & Integration**:
+   - When the subagent completes its task and returns its report, the primary agent evaluates the report, links findings to source files, and seamlessly continues the top-level plan.
+
+For delegation prompt templates and examples, see [references/handoff-patterns.md](./references/handoff-patterns.md).

package/skills/subagent-handoff/references/handoff-patterns.md

@@ -0,0 +1,30 @@
+# Subagent Handoff Patterns & Prompt Templates
+
+## Pattern 1: Code Review Delegation Template
+```text
+Task Name: Security & Quality Code Review
+Task:
+You are acting as the 'code-reviewer' subagent.
+Inspect the recent changes in git branch 'feature/payment-v2' (or git diff HEAD~1).
+Focus on:
+1. Null/undefined safety and edge cases in checkout logic.
+2. Parameterized queries in src/services/payment.ts.
+3. Verification that tests pass via 'npm test'.
+Stop condition: All diff files reviewed and tests executed.
+Return a markdown report with Verdict, Critical Blockers, and Suggestions.
+```
+
+## Pattern 2: Build-Repair Delegation Template
+```text
+Task Name: TypeScript Compiler & Test Fix
+Task:
+You are acting as the 'build-repair' subagent.
+Command 'npm run build' is failing with:
+"TS2322: Type 'string' is not assignable to type 'number' in src/api/user.ts:54"
+1. Read src/api/user.ts around line 54.
+2. Trace the type definition in src/types/user.ts.
+3. Apply a surgical fix using replace_file_content.
+4. Verify by running 'npm run build'.
+Stop condition: 'npm run build' exits with code 0.
+Return a report summarizing the root cause and applied fix.
+```

package/skills/tdd-workflow/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: tdd-workflow
+description: >-
+  Enforces strict Test-Driven Development (Red-Green-Refactor). Use this skill when the user asks to implement a new feature, fix a bug, or refactor logic using TDD.
+---
+
+# Test-Driven Development (TDD) Workflow
+
+This skill guides the agent through an uncompromising Red-Green-Refactor cycle.
+
+## Procedure
+
+### Step 1: Discover Existing Test Runner
+Detect the test framework in use:
+- **Node/TS**: Check `package.json` for `jest`, `vitest`, `mocha`, or `npm test`.
+- **Python**: Check for `pytest` or `unittest`.
+- **Go**: Look for `*_test.go` and run `go test ./...`.
+
+Run the existing suite to ensure the baseline is green before touching anything:
+```bash
+# Example
+npm test
+```
+
+### Step 2: Phase RED (Write Failing Test)
+1. Write a minimal test file or test case specifying the expected outcome or reproducing the exact bug reported.
+2. Run the specific test and verify that it **fails**.
+3. Confirm failure reason: It must fail on the assertion, NOT because of an import error or syntax error.
+
+### Step 3: Phase GREEN (Write Minimal Implementation)
+1. Write the absolute minimum production code to satisfy the test assertion.
+2. Do not prematurely optimize or handle un-tested edge cases yet.
+3. Re-run the test to confirm it now passes (turns green).
+
+### Step 4: Phase REFACTOR (Clean Code with Confidence)
+1. Eliminate duplication, extract functions, refine variable names, and improve readability.
+2. Re-run tests immediately after each edit.
+3. Repeat for next edge case.
+
+For detailed test patterns and mocking strategies, see [references/tdd-patterns.md](./references/tdd-patterns.md).

package/skills/tdd-workflow/references/tdd-patterns.md

@@ -0,0 +1,23 @@
+# TDD Patterns & Mocking Reference
+
+## 1. Arrange-Act-Assert (AAA)
+Always structure tests cleanly into three discrete blocks:
+```typescript
+it('should calculate discount correctly', () => {
+  // Arrange
+  const cart = new Cart();
+  cart.addItem({ price: 100 });
+
+  // Act
+  const total = cart.getDiscountedTotal(0.2);
+
+  // Assert
+  expect(total).toBe(80);
+});
+```
+
+## 2. Mocking Boundaries
+- Only mock at system boundaries (e.g. 3rd-party HTTP APIs, payment gateways, hardware).
+- Avoid mocking internal domain services or utilities; test them through public contracts.
+- In Python, use `unittest.mock.patch` with context managers.
+- In Node/TypeScript, use `vi.spyOn` or `jest.spyOn`.

package/templates/minimal/GEMINI.md

@@ -0,0 +1,5 @@
+# Minimal Antigravity Guidelines
+
+1. **Verify**: Always check code with tests or linters after making changes.
+2. **Minimal Diffs**: Keep modifications targeted and preserve existing styles and comments.
+3. **Zero Secrets**: Never print, log, or commit secret keys or sensitive tokens.

package/templates/minimal/hooks.json

@@ -0,0 +1,16 @@
+{
+  "safety-gate": {
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./hooks/safety-shield/scripts/safety-gate.sh",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}