everything-gemini 0.0.0-stage → 1.0.1

package/skills/kubernetes-operator/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: kubernetes-operator
+description: >-
+  Use this skill when authoring Kubernetes manifests, configuring Helm charts, setting up Horizontal Pod Autoscalers (HPA), or troubleshooting container cluster deployments.
+---
+
+# Kubernetes Cluster & Workload Operations
+
+## Overview
+This skill guides the agent in writing declarative, production-ready Kubernetes manifests, configuring health probes, resource constraints, ingress controllers, and rolling update strategies.
+
+## Procedural Workflow
+
+### 1. Hardened Deployment Manifest Pattern
+Always configure resource limits, security contexts, and liveness/readiness probes:
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api-service
+  labels:
+    app.kubernetes.io/name: api-service
+spec:
+  replicas: 3
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app: api-service
+  template:
+    metadata:
+      labels:
+        app: api-service
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+      containers:
+        - name: app
+          image: myregistry.azurecr.io/api-service:v1.0.0
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+          resources:
+            requests:
+              cpu: "100m"
+              memory: "128Mi"
+            limits:
+              cpu: "500m"
+              memory: "512Mi"
+          ports:
+            - containerPort: 8080
+          readinessProbe:
+            httpGet:
+              path: /health/ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health/live
+              port: 8080
+            initialDelaySeconds: 15
+            periodSeconds: 20
+```
+
+### 2. Auto-scaling & Ingress
+- **HorizontalPodAutoscaler (HPA)**: Target CPU (e.g. 70%) and Memory utilization before traffic spikes.
+- **Ingress with TLS**: Annotate with cert-manager (`cert-manager.io/cluster-issuer: letsencrypt-prod`) for automated SSL lifecycle.
+
+### 3. Triage & Debugging Commands
+- Inspect crash loops: `kubectl logs -l app=api-service --tail=100 -p` (previous container logs).
+- Inspect pod events: `kubectl describe pod <pod-name>`.
+
+## Verification Checklist
+- [ ] Non-root security context configured (`runAsNonRoot: true`)
+- [ ] Both readiness and liveness probes defined
+- [ ] Memory limits defined to prevent cluster OOM killer cascades
+- [ ] Rolling update configured with zero downtime (`maxUnavailable: 0`)

package/skills/performance-profiler/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: performance-profiler
+description: >-
+  Profiles application latency, CPU usage, memory leaks, and database bottlenecks. Use when diagnosing slow response times, high resource consumption, or memory leaks.
+---
+
+# Performance Profiler
+
+This skill guides the agent through systematic latency and resource bottleneck profiling.
+
+## Profiling Workflow
+
+### 1. Identify the Bottleneck Metric
+Determine the performance symptom:
+- **High CPU**: Algorithmic complexity ($O(n^2)$), tight loops, excessive JSON serialization.
+- **High Memory / Leak**: Retained closures, unclosed database streams, unbounded in-memory caches.
+- **High Latency (I/O)**: N+1 database queries, unindexed SQL lookups, synchronous blocking disk I/O.
+
+### 2. Node.js & V8 Profiling
+Run Node with the V8 sampling profiler:
+```bash
+node --prof app.js
+node --prof-process isolate-*.log > processed.txt
+```
+
+### 3. Database Query Analysis
+- **PostgreSQL**: Run `EXPLAIN (ANALYZE, BUFFERS) <query>` to inspect sequential scans, join types, and execution time.
+- **Indexes**: Verify that high-cardinality `WHERE` and `JOIN` columns have appropriate B-Tree or Hash indexes.
+
+### 4. Memory Heap Dumps
+Capture heap snapshots or track memory diffs between iterations to isolate leaks:
+```javascript
+const mem = process.memoryUsage();
+console.log(`Heap Used: ${Math.round(mem.heapUsed / 1024 / 1024)} MB`);
+```

package/skills/performance-profiler/scripts/profile-node.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Quick Node.js CPU profiling helper
+
+TARGET="${1:-index.js}"
+DURATION="${2:-10}"
+
+echo "Starting CPU profiling for $TARGET ($DURATION seconds)..."
+NODE_V8_COVERAGE=coverage node --cpu-prof "$TARGET" &
+PID=$!
+
+sleep "$DURATION"
+kill -SIGINT "$PID" 2>/dev/null || true
+echo "CPU profile generated. Look for CPU.*.cpuprofile in the directory."

package/skills/repo-onboarding/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: repo-onboarding
+description: >-
+  Rapidly inspects an unfamiliar codebase, maps directory structures, identifies key patterns, and generates a structured Knowledge Item (KI) for permanent repository memory.
+---
+
+# Repository Onboarding & Knowledge Item (KI) Indexing
+
+When an agent enters a new codebase, this skill provides a structured exploration sequence to index architecture, conventions, and operational runbooks without wasting excessive context.
+
+## Onboarding Procedure
+
+### 1. Root & Ecosystem Inspection
+1. Read project manifest: `package.json`, `pyproject.toml`, `go.mod`, `Cargo.toml`.
+2. Check `.gitignore` to identify ignored artifacts, environment configs, and build outputs.
+3. Check `README.md` and docs for local setup and testing scripts.
+
+### 2. Architectural Survey
+1. Run `list_dir` on root and top-level directories to understand organizational patterns (e.g. Clean Architecture, Monorepo, MVC).
+2. Identify entry points (e.g., `src/index.ts`, `app/main.py`, `cmd/server/main.go`).
+3. Locate core data models and database schemas (e.g., Prisma schemas, SQLAlchemy models, migrations).
+
+### 3. Build & Test Verification
+Run the project's build and test commands to verify environment health:
+```bash
+# E.g.
+npm run build && npm test
+```
+
+### 4. Create Repository Knowledge Item (KI)
+Persist findings into the localized Knowledge Items store so subsequent sessions have instant architectural recall:
+- Create `metadata.json` outlining core patterns, key paths, and test instructions.
+- Create an architecture summary artifact in `<appDataDir>/knowledge`.
+
+For the schema and structure of Knowledge Items, see [references/knowledge-item-schema.md](./references/knowledge-item-schema.md).

package/skills/repo-onboarding/references/knowledge-item-schema.md

@@ -0,0 +1,30 @@
+# Knowledge Items (KI) Schema & Reference
+
+Knowledge Items are Antigravity's persistent, curated memory units stored in `<appDataDir>/knowledge`.
+
+## Structure
+```text
+<appDataDir>/knowledge/<ki-id>/
+├── metadata.json
+└── artifacts/
+    ├── architecture.md
+    └── common-patterns.md
+```
+
+## `metadata.json` Format
+```json
+{
+  "title": "Repository Architecture & Patterns",
+  "summary": "Fullstack Next.js app using PostgreSQL, Prisma, and Tailwind CSS. Tests run via Vitest.",
+  "createdAt": "2026-10-15T10:00:00Z",
+  "updatedAt": "2026-10-15T10:00:00Z",
+  "references": [
+    "package.json",
+    "prisma/schema.prisma",
+    "vitest.config.ts"
+  ]
+}
+```
+
+## When to Consult Knowledge Items
+Always check Knowledge Items before performing deep-dive architectural investigations to avoid duplicating work and violating established team conventions.

package/skills/root-cause-debugger/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: root-cause-debugger
+description: >-
+  Systematically diagnoses complex regressions, silent data corruptions, race conditions, and elusive bugs using binary search (git bisect), log analysis, and reproduction harnesses.
+---
+
+# Root Cause Debugger
+
+This skill provides an evidence-based debugging procedure to eliminate guessing and find root causes rapidly.
+
+## 5-Step Debugging Protocol
+
+### 1. Build a Minimal Reproducer (MRE)
+- Never start guessing fixes without an automated test or minimal script that reliably triggers the failure.
+- Strip away unrelated modules until only the failing component remains.
+
+### 2. Formulate & Test Hypotheses
+- List the top 2-3 plausible hypotheses for why the failure occurs.
+- Add targeted debug statements or breakpoints to confirm or falsify each hypothesis sequentially.
+
+### 3. Binary Search History with `git bisect`
+If the bug is a regression that didn't exist in an earlier commit:
+```bash
+git bisect start
+git bisect bad HEAD
+git bisect good <known-good-commit>
+git bisect run ./test-runner.sh
+```
+This isolates the exact offending commit in $O(\log n)$ steps.
+
+### 4. Implement Minimal Surgical Fix
+- Resolve the root cause directly at its source. Avoid superficial patches that merely silence error messages.
+
+### 5. Add Regression Shield Test
+- Commit an automated test that explicitly verifies the regression never recurs.

package/skills/root-cause-debugger/scripts/git-bisect-helper.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Fast git bisect helper script
+
+TEST_CMD="${1:-npm test}"
+
+echo "Running bisect test: $TEST_CMD"
+if eval "$TEST_CMD" >/dev/null 2>&1; then
+  echo "Commit is GOOD (tests passed)"
+  exit 0
+else
+  echo "Commit is BAD (tests failed)"
+  exit 1
+fi

package/skills/security-audit/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: security-audit
+description: >-
+  Performs security audits, OWASP top 10 vulnerability checks, dependency vulnerability scans, and secret leakage detection. Use when reviewing code for security vulnerabilities.
+---
+
+# Security Audit
+
+This skill guides the agent through proactive security evaluations, secret detection, and dependency hygiene.
+
+## Audit Checklist
+
+### 1. Secret Scanning
+Ensure no sensitive keys, tokens, private keys, or credentials are hardcoded:
+- Check for `.env`, `*.pem`, `id_rsa`, AWS keys (`AKIA...`), GitHub tokens (`ghp_...`).
+- Execute `scripts/scan-secrets.sh` to search for known credential regex patterns.
+
+### 2. Dependency Vulnerability Assessment
+Run ecosystem-specific vulnerability scanners:
+- **Node**: `npm audit` or `pnpm audit`
+- **Python**: `pip-audit`
+- **Go**: `govulncheck ./...`
+- **Rust**: `cargo audit`
+
+### 3. Code-Level Vulnerability Inspection
+- **Injection Flaws**: Check all database queries for parameterized values. Ensure no raw string interpolation in SQL or NoSQL queries.
+- **Cross-Site Scripting (XSS)**: Ensure user input rendered in HTML is sanitized or escaped. In React, inspect any usage of `dangerouslySetInnerHTML`.
+- **Insecure Deserialization**: Avoid `eval()`, `pickle.loads()`, or unrestricted YAML parsing (`yaml.unsafe_load`).
+- **Path Traversal**: Ensure file system operations resolve paths against a safe root directory.

package/skills/security-audit/scripts/scan-secrets.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Fast secret scanner for committed files
+
+echo "Scanning tracked files for potential exposed secrets..."
+
+PATTERNS=(
+  "AKIA[0-9A-Z]{16}"
+  "ghp_[a-zA-Z0-9]{36}"
+  "github_pat_[a-zA-Z0-9_]{82}"
+  "-----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----"
+  "AIza[0-9A-Za-z\\-_]{35}"
+)
+
+FOUND=0
+for pattern in "${PATTERNS[@]}"; do
+  MATCHES=$(git grep -EI "$pattern" 2>/dev/null || true)
+  if [ -n "$MATCHES" ]; then
+    echo "⚠️ Potential secret match for pattern: $pattern"
+    echo "$MATCHES"
+    FOUND=$((FOUND + 1))
+  fi
+done
+
+if [ "$FOUND" -eq 0 ]; then
+  echo "✔ No high-entropy secrets detected."
+fi

package/skills/stripe-integration/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: stripe-integration
+description: >-
+  Use this skill when implementing Stripe checkout sessions, managing subscription billing lifecycles, verifying webhook signatures, or configuring customer billing portals.
+---
+
+# Stripe Payments & Subscription Architecture
+
+## Overview
+This skill guides the implementation of PCI-compliant payment flows, webhook signature verification, idempotent charge processing, and customer portal session generation using the official Stripe SDK.
+
+## Procedural Workflow
+
+### 1. Robust Webhook Signature Verification
+Never process webhooks without verifying the cryptographic signature against your endpoint secret:
+```typescript
+import Stripe from "stripe";
+
+const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
+  apiVersion: "2024-06-20",
+});
+
+export async function handleStripeWebhook(rawBody: string | Buffer, signature: string) {
+  let event: Stripe.Event;
+  try {
+    event = stripe.webhooks.constructEvent(
+      rawBody,
+      signature,
+      process.env.STRIPE_WEBHOOK_SECRET!
+    );
+  } catch (err: any) {
+    throw new Error(`Webhook signature verification failed: ${err.message}`);
+  }
+
+  // Handle idempotent events using database transaction
+  switch (event.type) {
+    case "checkout.session.completed":
+      await handleCheckoutCompleted(event.data.object as Stripe.Checkout.Session);
+      break;
+    case "customer.subscription.updated":
+    case "customer.subscription.deleted":
+      await syncSubscriptionStatus(event.data.object as Stripe.Subscription);
+      break;
+  }
+}
+```
+
+### 2. Idempotency & Concurrency Safety
+- Always store `event.id` in an `idempotency_keys` table or set a unique constraint. If Stripe retries a webhook, discard duplicates immediately.
+- Use `client_reference_id` or `metadata` to link Stripe customers with your internal user IDs.
+
+### 3. Customer Billing Portal
+Generate pre-authenticated portal sessions so users can update payment methods and invoices self-service without custom frontend form logic:
+```typescript
+const portalSession = await stripe.billingPortal.sessions.create({
+  customer: stripeCustomerId,
+  return_url: `${process.env.NEXT_PUBLIC_APP_URL}/dashboard/billing`,
+});
+```
+
+## Verification Checklist
+- [ ] Raw body buffer preserved for webhook cryptographic verification
+- [ ] Idempotency key checked before applying database mutations
+- [ ] Webhook handler returns HTTP 200 promptly before long-running async tasks
+- [ ] Stripe secret keys read strictly from environment variables

package/skills/subagent-handoff/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: subagent-handoff
+description: >-
+  Guides the primary agent in delegating complex, multi-step subtasks to scoped subagents (Planner, Reviewer, Build-Repair, QA, Security) with minimal token contamination and deterministic handoffs.
+---
+
+# Subagent Handoff Protocol
+
+This skill governs how the primary agent orchestrates and delegates work to scoped subagents.
+
+## Core Directives
+
+1. **When to Delegate vs. Execute Directly**:
+   - **Delegate**: Visual browser testing (`browser_subagent`), deep dependency planning (`agents/planner.md`), adversarial code review (`agents/code-reviewer.md`), and build-break triage (`agents/build-repair.md`).
+   - **Execute Directly**: Simple file edits, direct user questions, single test runs, and minor refactorings.
+
+2. **The Clean Handoff Principle**:
+   - Never dump the entire conversation history into the subagent prompt.
+   - Provide a self-contained, bounded task prompt containing:
+     1. Specific objective.
+     2. Exact file paths to inspect.
+     3. Clear constraints and tools allowed.
+     4. Explicit stop condition and expected return report schema.
+
+3. **Synthesis & Integration**:
+   - When the subagent completes its task and returns its report, the primary agent evaluates the report, links findings to source files, and seamlessly continues the top-level plan.
+
+For delegation prompt templates and examples, see [references/handoff-patterns.md](./references/handoff-patterns.md).

package/skills/subagent-handoff/references/handoff-patterns.md

@@ -0,0 +1,30 @@
+# Subagent Handoff Patterns & Prompt Templates
+
+## Pattern 1: Code Review Delegation Template
+```text
+Task Name: Security & Quality Code Review
+Task:
+You are acting as the 'code-reviewer' subagent.
+Inspect the recent changes in git branch 'feature/payment-v2' (or git diff HEAD~1).
+Focus on:
+1. Null/undefined safety and edge cases in checkout logic.
+2. Parameterized queries in src/services/payment.ts.
+3. Verification that tests pass via 'npm test'.
+Stop condition: All diff files reviewed and tests executed.
+Return a markdown report with Verdict, Critical Blockers, and Suggestions.
+```
+
+## Pattern 2: Build-Repair Delegation Template
+```text
+Task Name: TypeScript Compiler & Test Fix
+Task:
+You are acting as the 'build-repair' subagent.
+Command 'npm run build' is failing with:
+"TS2322: Type 'string' is not assignable to type 'number' in src/api/user.ts:54"
+1. Read src/api/user.ts around line 54.
+2. Trace the type definition in src/types/user.ts.
+3. Apply a surgical fix using replace_file_content.
+4. Verify by running 'npm run build'.
+Stop condition: 'npm run build' exits with code 0.
+Return a report summarizing the root cause and applied fix.
+```

package/skills/supabase-architect/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: supabase-architect
+description: >-
+  Use this skill when designing Supabase database schemas, writing Row Level Security (RLS) policies, setting up pgvector AI embeddings, or configuring Supabase Edge Functions.
+---
+
+# Supabase Architecture & Security Playbook
+
+## Overview
+Supabase provides a powerful managed backend powered by PostgreSQL. This skill guides the agent in crafting bulletproof Row Level Security (RLS) policies, configuring pgvector for semantic search and AI embeddings, and deploying performant Supabase Edge Functions.
+
+## Procedural Workflow
+
+### 1. Row Level Security (RLS) Defense-in-Depth
+Never leave a table with RLS disabled in production:
+```sql
+-- 1. Always enable RLS on newly created tables
+ALTER TABLE documents ENABLE ROW LEVEL SECURITY;
+
+-- 2. Enforce strict tenant isolation or user ownership
+CREATE POLICY "Users can only read their own documents"
+ON documents
+FOR SELECT
+USING (auth.uid() = user_id);
+
+CREATE POLICY "Users can only insert their own documents"
+ON documents
+FOR INSERT
+WITH CHECK (auth.uid() = user_id);
+```
+
+### 2. Semantic Search & Vector Embeddings (`pgvector`)
+When storing AI embeddings in PostgreSQL:
+1. Enable extension: `CREATE EXTENSION IF NOT EXISTS vector;`
+2. Create vector column matching model dimensions (e.g., 768 or 1536):
+   ```sql
+   ALTER TABLE documents ADD COLUMN embedding vector(768);
+   ```
+3. Create an HNSW index for fast similarity lookups:
+   ```sql
+   CREATE INDEX ON documents USING hnsw (embedding vector_cosine_ops);
+   ```
+4. Define match RPC functions with inner product or cosine distance queries.
+
+### 3. Realtime Channels & Subscriptions
+- Filter broadcasts server-side using Postgres row-level filters (`eq`, `in`) to prevent client-side data leaks.
+- Ensure sensitive columns are omitted or masked in realtime publication sets.
+
+## Verification Checklist
+- [ ] RLS explicitly enabled on every table
+- [ ] RLS policies tested against unauthenticated and cross-tenant tokens
+- [ ] Vector index created with appropriate similarity operator (`vector_cosine_ops`)
+- [ ] Edge functions handle CORS headers and verify JWT signatures

package/skills/tdd-workflow/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: tdd-workflow
+description: >-
+  Enforces strict Test-Driven Development (Red-Green-Refactor). Use this skill when the user asks to implement a new feature, fix a bug, or refactor logic using TDD.
+---
+
+# Test-Driven Development (TDD) Workflow
+
+This skill guides the agent through an uncompromising Red-Green-Refactor cycle.
+
+## Procedure
+
+### Step 1: Discover Existing Test Runner
+Detect the test framework in use:
+- **Node/TS**: Check `package.json` for `jest`, `vitest`, `mocha`, or `npm test`.
+- **Python**: Check for `pytest` or `unittest`.
+- **Go**: Look for `*_test.go` and run `go test ./...`.
+
+Run the existing suite to ensure the baseline is green before touching anything:
+```bash
+# Example
+npm test
+```
+
+### Step 2: Phase RED (Write Failing Test)
+1. Write a minimal test file or test case specifying the expected outcome or reproducing the exact bug reported.
+2. Run the specific test and verify that it **fails**.
+3. Confirm failure reason: It must fail on the assertion, NOT because of an import error or syntax error.
+
+### Step 3: Phase GREEN (Write Minimal Implementation)
+1. Write the absolute minimum production code to satisfy the test assertion.
+2. Do not prematurely optimize or handle un-tested edge cases yet.
+3. Re-run the test to confirm it now passes (turns green).
+
+### Step 4: Phase REFACTOR (Clean Code with Confidence)
+1. Eliminate duplication, extract functions, refine variable names, and improve readability.
+2. Re-run tests immediately after each edit.
+3. Repeat for next edge case.
+
+For detailed test patterns and mocking strategies, see [references/tdd-patterns.md](./references/tdd-patterns.md).

package/skills/tdd-workflow/references/tdd-patterns.md

@@ -0,0 +1,23 @@
+# TDD Patterns & Mocking Reference
+
+## 1. Arrange-Act-Assert (AAA)
+Always structure tests cleanly into three discrete blocks:
+```typescript
+it('should calculate discount correctly', () => {
+  // Arrange
+  const cart = new Cart();
+  cart.addItem({ price: 100 });
+
+  // Act
+  const total = cart.getDiscountedTotal(0.2);
+
+  // Assert
+  expect(total).toBe(80);
+});
+```
+
+## 2. Mocking Boundaries
+- Only mock at system boundaries (e.g. 3rd-party HTTP APIs, payment gateways, hardware).
+- Avoid mocking internal domain services or utilities; test them through public contracts.
+- In Python, use `unittest.mock.patch` with context managers.
+- In Node/TypeScript, use `vi.spyOn` or `jest.spyOn`.

package/templates/minimal/GEMINI.md

@@ -0,0 +1,5 @@
+# Minimal Antigravity Guidelines
+
+1. **Verify**: Always check code with tests or linters after making changes.
+2. **Minimal Diffs**: Keep modifications targeted and preserve existing styles and comments.
+3. **Zero Secrets**: Never print, log, or commit secret keys or sensitive tokens.

package/templates/minimal/hooks.json

@@ -0,0 +1,16 @@
+{
+  "safety-gate": {
+    "PreToolUse": [
+      {
+        "matcher": "run_command",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ./hooks/safety-shield/scripts/safety-gate.sh",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}