everything-gemini 1.8.0 → 1.9.0

package/skills/vault-secrets-management/SKILL.md

@@ -0,0 +1,129 @@
+---
+name: vault-secrets-management
+description: >-
+  Architects and automates HashiCorp Vault secrets management, AppRole machine authentication, dynamic ephemeral database credentials, and PKI mTLS certificate rotation.
+---
+
+# HashiCorp Vault Secrets Management & Ephemeral Credentials
+
+This skill guides the design, automation, and operational patterns for HashiCorp Vault enterprise secrets orchestration, dynamic credential generation, and PKI certificate authority workflows.
+
+---
+
+## ⚡ Secret Engine Capabilities Matrix
+
+| Secret Engine | Purpose | Lifecycle Behavior |
+| :--- | :--- | :--- |
+| **`kv-v2`** | Static credentials & API keys | Versioned key-value store with soft delete and rollback. |
+| **`database`** | Ephemeral DB access (Postgres, MySQL) | Generates short-lived user credentials and revokes upon lease expiry. |
+| **`pki`** | Internal mTLS & TLS certificates | Acts as CA/sub-CA; dynamically issues certificates in milliseconds. |
+| **`transit`** | Cryptography as a service | Encrypts/decrypts data without exposing raw encryption keys. |
+
+---
+
+## 🔐 AppRole Machine Authentication Workflow
+
+Applications authenticate using decoupled `role_id` and short-lived `secret_id`:
+
+```bash
+# 1. Enable AppRole auth method
+vault auth enable approle
+
+# 2. Configure service role with strict CIDR and token policies
+vault write auth/approle/role/api-service \
+    secret_id_ttl=60m \
+    token_ttl=30m \
+    token_max_ttl=4h \
+    secret_id_num_uses=10 \
+    token_policies="api-service-policy" \
+    bind_secret_id=true
+
+# 3. Retrieve Role ID (stored in deployment manifest)
+vault read auth/approle/role/api-service/role-id
+
+# 4. Generate Secret ID (delivered securely via CI/CD or orchestrator)
+vault write -f auth/approle/role/api-service/secret-id
+```
+
+Node.js / Python authentication client:
+
+```typescript
+import axios from 'axios';
+
+export async function loginWithAppRole(vaultAddr: string, roleId: string, secretId: string) {
+  const response = await axios.post(`${vaultAddr}/v1/auth/approle/login`, {
+    role_id: roleId,
+    secret_id: secretId,
+  });
+  
+  const clientToken = response.data.auth.client_token;
+  const leaseDuration = response.data.auth.lease_duration;
+  return { clientToken, leaseDuration };
+}
+```
+
+---
+
+## ⏳ Dynamic Ephemeral Database Credentials
+
+Configure Vault to create temporary, unique PostgreSQL roles for each application instance:
+
+```bash
+# 1. Mount database engine
+vault secrets enable database
+
+# 2. Configure connection to PostgreSQL
+vault write database/config/production-postgres \
+    plugin_name=postgresql-database-plugin \
+    allowed_roles="readwrite-service" \
+    connection_url="postgresql://{{username}}:{{password}}@postgres:5432/production?sslmode=verify-full" \
+    username="vaultadmin" \
+    password="supersecretadminpassword"
+
+# 3. Define role template with automated role creation SQL
+vault write database/roles/readwrite-service \
+    db_name=production-postgres \
+    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
+        GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
+    default_ttl="1h" \
+    max_ttl="24h"
+```
+
+Application requests credentials on demand:
+
+```bash
+vault read database/creds/readwrite-service
+# Returns: username: v-approle-readwrite-abc123, password: xyz..., lease_id: database/creds/readwrite-service/xyz...
+```
+
+---
+
+## 📜 PKI Dynamic mTLS Certificate Issuance
+
+Automate TLS certificate issuance without manual CSR handling:
+
+```bash
+# Mount PKI engine and configure Root/Intermediate CA
+vault secrets enable pki
+vault secrets tune -max-lease-ttl=87600h pki
+
+# Configure role for cluster services
+vault write pki/roles/internal-mesh \
+    allowed_domains="internal.cluster.local" \
+    allow_subdomains=true \
+    max_ttl="72h"
+
+# Generate certificate on demand
+vault write pki/issue/internal-mesh \
+    common_name="billing-service.internal.cluster.local" \
+    ttl="24h"
+```
+
+---
+
+## 📋 Architectural Rules & Best Practices
+
+1. **Never Hardcode Secrets**: Eliminate long-lived static DB passwords; adopt dynamic ephemeral database roles with short TTLs (< 2 hours).
+2. **Strict Secret ID Binding**: Bind AppRole `secret_id` to expected subnet CIDRs (`secret_id_bound_cidrs`) to stop credential theft across VPCs.
+3. **Lease Renewal & Heartbeats**: Background workers must periodically renew active leases (`vault write sys/leases/renew lease_id=...`) before expiry.
+4. **Audit Logging**: Enable Vault audit devices (`vault audit enable file file_path=/var/log/vault/audit.log`) with hashed payload sanitization.

package/templates/full-power/mcp_config.json

@@ -53,6 +53,10 @@
         "SLACK_BOT_TOKEN": "${SLACK_BOT_TOKEN}",
         "SLACK_TEAM_ID": "${SLACK_TEAM_ID}"
       }
+    },
+    "puppeteer": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-puppeteer"]
     }
   }
 }

package/tests/cli.test.js

@@ -90,9 +90,9 @@ it('should benchmark ecosystem components and output valid JSON with --json', ()
   const res = runCli('benchmark --json');
   assert.strictEqual(res.status, 0);
   const data = JSON.parse(res.stdout);
-  assert.strictEqual(data.totalComponents, 70);
-  assert.strictEqual(data.progressiveSkillsCount, 52);
-  assert.strictEqual(data.scopedAgentsCount, 11);
+  assert.strictEqual(data.totalComponents, 75);
+  assert.strictEqual(data.progressiveSkillsCount, 56);
+  assert.strictEqual(data.scopedAgentsCount, 12);
   assert.strictEqual(data.lifecycleHooksCount, 7);
   assert(data.totalRunbookTokens > 15000, 'Expected >15,000 runbook tokens');
   assert(data.estimatedTokensSavedPerTurn > 8000, 'Expected significant token savings');
@@ -316,7 +316,7 @@ try {
     const dryRes = runCli(`bundle --output "${bundleTarget}" --dry-run`);
     assert.strictEqual(dryRes.status, 0);
     assert.match(dryRes.stdout, /DRY RUN MODE ACTIVATED/);
-    assert.match(dryRes.stdout, /Skills to bundle: 52/);
+    assert.match(dryRes.stdout, /Skills to bundle: 56/);
     assert.strictEqual(fs.existsSync(bundleTarget), false, 'Dry run should not create destination directory');
 
     // JSON Dry-run mode
@@ -324,7 +324,7 @@ try {
     assert.strictEqual(jsonRes.status, 0);
     const dryData = JSON.parse(jsonRes.stdout);
     assert.strictEqual(dryData.dryRun, true);
-    assert.strictEqual(dryData.manifest.components.totalCount, 70);
+    assert.strictEqual(dryData.manifest.components.totalCount, 75);
 
     // Live mode
     const liveRes = runCli(`bundle --output "${bundleTarget}"`);
@@ -332,8 +332,49 @@ try {
     assert.match(liveRes.stdout, /Offline Distribution Bundle Created/);
     assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'bundle-manifest.json')), true);
     assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'offline-install.sh')), true);
-    assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'skills', 'vllm-inference')), true);
-    assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'agents', 'incident-responder.md')), true);
+    assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'skills', 'milvus-vector-clustering')), true);
+    assert.strictEqual(fs.existsSync(path.join(bundleTarget, 'agents', 'platform-engineer.md')), true);
+  });
+
+  // Scaffold Command
+  it('should scaffold skill, agent, and hook in dry-run and live modes', () => {
+    const scaffoldWorkspace = path.join(tempWorkspace, 'scaffold-ws');
+
+    // Skill Dry-run
+    const drySkill = runCli(`scaffold skill demo-test-skill --workspace "${scaffoldWorkspace}" --dry-run --json`);
+    assert.strictEqual(drySkill.status, 0);
+    const drySkillData = JSON.parse(drySkill.stdout);
+    assert.strictEqual(drySkillData.isDryRun, true);
+    assert.strictEqual(drySkillData.type, 'skill');
+
+    // Live Agent Scaffold
+    const liveAgent = runCli(`scaffold agent demo-qa-agent --workspace "${scaffoldWorkspace}"`);
+    assert.strictEqual(liveAgent.status, 0);
+    assert.match(liveAgent.stdout, /Created subagent profile/);
+    assert.strictEqual(fs.existsSync(path.join(scaffoldWorkspace, 'agents', 'demo-qa-agent.md')), true);
+
+    // Live Hook Scaffold
+    const liveHook = runCli(`scaffold hook demo-safety --workspace "${scaffoldWorkspace}"`);
+    assert.strictEqual(liveHook.status, 0);
+    assert.match(liveHook.stdout, /Created lifecycle hook/);
+    assert.strictEqual(fs.existsSync(path.join(scaffoldWorkspace, 'hooks', 'demo-safety', 'hooks.json')), true);
+    assert.strictEqual(fs.existsSync(path.join(scaffoldWorkspace, 'hooks', 'demo-safety', 'scripts', 'demo-safety-gate.sh')), true);
+  });
+
+  // Sync Command
+  it('should synchronize workspace with sync command in dry-run and live modes', () => {
+    // Dry-run
+    const drySync = runCli(`sync --workspace "${tempWorkspace}" --dry-run`);
+    assert.strictEqual(drySync.status, 0);
+    assert.match(drySync.stdout, /DRY RUN MODE ACTIVATED/);
+    assert.match(drySync.stdout, /Synchronizing Workspace with Catalog/);
+
+    // JSON Dry-run
+    const jsonSync = runCli(`sync --workspace "${tempWorkspace}" --dry-run --json`);
+    assert.strictEqual(jsonSync.status, 0);
+    const syncData = JSON.parse(jsonSync.stdout);
+    assert.strictEqual(syncData.isDryRun, true);
+    assert.strictEqual(syncData.success, true);
   });
 
   // Info for incident-responder and v1.8.0 skills
@@ -359,14 +400,37 @@ try {
     assert.match(resLite.stdout, /LiteLLM/);
   });
 
+  // Info for platform-engineer and v1.9.0 skills
+  it('should display info for platform-engineer subagent and v1.9.0 skills', () => {
+    const resPlat = runCli('info platform-engineer');
+    assert.strictEqual(resPlat.status, 0);
+    assert.match(resPlat.stdout, /Platform Engineer/);
+
+    const resMilvus = runCli('info milvus-vector-clustering');
+    assert.strictEqual(resMilvus.status, 0);
+    assert.match(resMilvus.stdout, /Milvus/);
+
+    const resR2 = runCli('info cloudflare-r2-object-storage');
+    assert.strictEqual(resR2.status, 0);
+    assert.match(resR2.stdout, /Cloudflare R2/);
+
+    const resVault = runCli('info vault-secrets-management');
+    assert.strictEqual(resVault.status, 0);
+    assert.match(resVault.stdout, /Vault/);
+
+    const resRate = runCli('info distributed-rate-limiting');
+    assert.strictEqual(resRate.status, 0);
+    assert.match(resRate.stdout, /Distributed Rate Limiting/);
+  });
+
   // Benchmark Components Verification
-  it('should report 70 components, 52 skills, and 11 subagents in benchmark --json', () => {
+  it('should report 75 components, 56 skills, and 12 subagents in benchmark --json', () => {
     const res = runCli('benchmark --json');
     assert.strictEqual(res.status, 0);
     const data = JSON.parse(res.stdout);
-    assert.strictEqual(data.totalComponents, 70, 'Total components should be 70');
-    assert.strictEqual(data.progressiveSkillsCount, 52, 'Progressive skills should be 52');
-    assert.strictEqual(data.scopedAgentsCount, 11, 'Scoped agents should be 11');
+    assert.strictEqual(data.totalComponents, 75, 'Total components should be 75');
+    assert.strictEqual(data.progressiveSkillsCount, 56, 'Progressive skills should be 56');
+    assert.strictEqual(data.scopedAgentsCount, 12, 'Scoped agents should be 12');
     assert.strictEqual(data.lifecycleHooksCount, 7, 'Lifecycle hooks should be 7');
   });