kiro-kit 0.1.0

package/dist/presets/backend/specs/_templates/backend/design.md

@@ -0,0 +1,87 @@
+# Design: [Feature Name]
+
+## Architecture
+
+### System Context
+
+Describe how this feature fits into the overall system architecture.
+
+### Component Design
+
+```
+[Controller/Handler Layer]
+  -> [Service/Business Logic Layer]
+    -> [Repository/Data Access Layer]
+      -> [Database]
+```
+
+### Data Flow
+
+Describe request lifecycle:
+- Request validation and parsing
+- Authentication and authorization
+- Business logic execution
+- Data persistence
+- Response formatting
+
+## API Design
+
+### Endpoints
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | /api/v1/[resource] | List resources |
+| POST | /api/v1/[resource] | Create resource |
+| GET | /api/v1/[resource]/:id | Get resource |
+| PUT | /api/v1/[resource]/:id | Update resource |
+| DELETE | /api/v1/[resource]/:id | Delete resource |
+
+### Request/Response Schemas
+
+```typescript
+interface CreateResourceRequest {
+  // Define request body
+}
+
+interface ResourceResponse {
+  // Define response shape
+}
+```
+
+## Database Design
+
+### Schema
+
+```sql
+CREATE TABLE [resource] (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  -- columns
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+```
+
+### Indexes
+
+- Primary query patterns and their index coverage
+- Expected data volume and growth rate
+
+## Error Handling Strategy
+
+- Validation errors: 400 with field-level details
+- Auth errors: 401/403 with minimal information
+- Business logic errors: 409/422 with error codes
+- Internal errors: 500 with correlation ID only
+
+## Testing Strategy
+
+- Unit tests: service layer logic, validation rules
+- Integration tests: database operations, API endpoints
+- Load tests: concurrent request handling, connection pooling
+
+## Security Considerations
+
+- Input validation approach
+- Authentication mechanism
+- Authorization model
+- Data encryption requirements

package/dist/presets/backend/specs/_templates/backend/requirements.md

@@ -0,0 +1,55 @@
+# Requirements: [Feature Name]
+
+## Overview
+
+Brief description of the feature and its purpose within the backend system.
+
+## User Stories
+
+- As a [client/service/admin], I want to [action] so that [benefit]
+
+## Functional Requirements
+
+### API Endpoints
+- [ ] Endpoint accepts valid request payloads and returns correct responses
+- [ ] Input validation rejects malformed requests with descriptive errors
+- [ ] Authentication and authorization enforced on protected endpoints
+- [ ] Pagination implemented for list endpoints
+
+### Data Layer
+- [ ] Database schema supports the required data model
+- [ ] Migrations are reversible and tested
+- [ ] Indexes cover primary query patterns
+- [ ] Data integrity constraints enforced at database level
+
+### Business Logic
+- [ ] [Describe core business rules]
+- [ ] [Describe state transitions]
+- [ ] [Describe integration requirements]
+
+### Error Handling
+- [ ] All errors return structured JSON responses with error codes
+- [ ] Validation errors include field-level details
+- [ ] Internal errors do not expose implementation details
+- [ ] Errors are logged with correlation IDs
+
+## Non-Functional Requirements
+
+- [ ] Response time under 200ms for simple CRUD operations
+- [ ] Handles 100 concurrent requests without degradation
+- [ ] Database queries execute under 50ms (p95)
+- [ ] Zero data loss on failure (transactional integrity)
+
+## Security Requirements
+
+- [ ] Input validated and sanitized against injection attacks
+- [ ] Authentication required for non-public endpoints
+- [ ] Authorization checked at resource level
+- [ ] Sensitive data encrypted at rest and in transit
+- [ ] Rate limiting applied to public endpoints
+
+## Acceptance Criteria
+
+1. [Specific, testable criterion]
+2. [Specific, testable criterion]
+3. [Specific, testable criterion]

package/dist/presets/backend/specs/_templates/backend/tasks.md

@@ -0,0 +1,46 @@
+# Tasks: [Feature Name]
+
+## Phase 1: Data Layer
+
+- [ ] 1.1 Design database schema and create migration
+- [ ] 1.2 Implement repository/data access layer
+- [ ] 1.3 Add database indexes for query patterns
+- [ ] 1.4 Write repository unit tests
+
+## Phase 2: Business Logic
+
+- [ ] 2.1 Implement service layer with core business rules
+- [ ] 2.2 Add input validation schemas
+- [ ] 2.3 Implement error handling with typed errors
+- [ ] 2.4 Write service layer unit tests
+
+## Phase 3: API Endpoints
+
+- [ ] 3.1 Implement route handlers (CRUD operations)
+- [ ] 3.2 Add authentication middleware to protected routes
+- [ ] 3.3 Add authorization checks (resource ownership)
+- [ ] 3.4 Implement pagination for list endpoints
+- [ ] 3.5 Write API integration tests
+
+## Phase 4: Security and Validation
+
+- [ ] 4.1 Add rate limiting to public endpoints
+- [ ] 4.2 Implement input sanitization
+- [ ] 4.3 Add security headers
+- [ ] 4.4 Run security audit on new endpoints
+- [ ] 4.5 Verify no sensitive data in logs or responses
+
+## Phase 5: Documentation and Deployment
+
+- [ ] 5.1 Update OpenAPI/Swagger documentation
+- [ ] 5.2 Add API usage examples
+- [ ] 5.3 Update system architecture docs
+- [ ] 5.4 Configure monitoring and alerting
+- [ ] 5.5 Create deployment runbook
+
+## Phase 6: Performance
+
+- [ ] 6.1 Run load tests against new endpoints
+- [ ] 6.2 Optimize slow queries (EXPLAIN ANALYZE)
+- [ ] 6.3 Add caching where appropriate
+- [ ] 6.4 Verify connection pooling configuration

package/dist/presets/backend/statusline.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+// Statusline: outputs git branch + project name + time on one line.
+
+const { execSync } = require('child_process');
+const path = require('path');
+
+let branch = '';
+try {
+  branch = execSync('git rev-parse --abbrev-ref HEAD', { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+} catch (e) {
+  // Not a git repo
+}
+
+const projectName = path.basename(process.cwd());
+const time = new Date().toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
+
+const parts = [];
+if (branch) parts.push(branch);
+parts.push(projectName);
+parts.push(time);
+
+process.stdout.write(parts.join(' | ') + '\n');

package/dist/presets/backend/statusline.ps1

@@ -0,0 +1,16 @@
+# Statusline: outputs git branch + project name + time on one line.
+# Gracefully omits git branch if not a git repository.
+
+$Branch = ''
+try {
+    $Branch = (git rev-parse --abbrev-ref HEAD 2>$null)
+} catch {}
+
+$Project = Split-Path -Leaf (Get-Location)
+$Time = Get-Date -Format 'HH:mm'
+
+if ($Branch) {
+    Write-Output "$Branch | $Project | $Time"
+} else {
+    Write-Output "$Project | $Time"
+}

package/dist/presets/backend/statusline.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Statusline: outputs git branch + project name + time on one line.
+# Gracefully omits git branch if not a git repository.
+
+BRANCH=""
+if git rev-parse --abbrev-ref HEAD >/dev/null 2>&1; then
+  BRANCH=$(git rev-parse --abbrev-ref HEAD)
+fi
+
+PROJECT=$(basename "$PWD")
+TIME=$(date +"%H:%M")
+
+if [ -n "$BRANCH" ]; then
+  echo "$BRANCH | $PROJECT | $TIME"
+else
+  echo "$PROJECT | $TIME"
+fi

package/dist/presets/backend/steering/api-design-conventions.md

@@ -0,0 +1,105 @@
+---
+inclusion: always
+description: API design conventions for RESTful services, error handling, versioning, and request/response patterns.
+---
+
+# API Design Conventions
+
+## URL Structure
+
+- Use plural nouns for resource collections: `/users`, `/orders`, `/products`
+- Use path parameters for resource identifiers: `/users/:id`
+- Use query parameters for filtering, sorting, pagination: `/users?role=admin&sort=name&page=2`
+- Nest sub-resources one level deep maximum: `/users/:id/orders`
+- Use kebab-case for multi-word paths: `/order-items`
+- Version APIs in the URL path: `/api/v1/users`
+
+## HTTP Methods
+
+- GET: retrieve resources (idempotent, cacheable)
+- POST: create new resources
+- PUT: full replacement of a resource
+- PATCH: partial update of a resource
+- DELETE: remove a resource (idempotent)
+
+## Response Format
+
+All responses use a consistent envelope:
+
+```json
+{
+  "data": {},
+  "meta": { "page": 1, "total": 100 },
+  "errors": []
+}
+```
+
+## Error Responses
+
+Use standard HTTP status codes with structured error bodies:
+
+```json
+{
+  "errors": [
+    {
+      "code": "VALIDATION_ERROR",
+      "message": "Email is required",
+      "field": "email"
+    }
+  ]
+}
+```
+
+Status code mapping:
+- 400: validation errors, malformed request
+- 401: missing or invalid authentication
+- 403: authenticated but not authorized
+- 404: resource not found
+- 409: conflict (duplicate, state mismatch)
+- 422: unprocessable entity (business logic rejection)
+- 429: rate limit exceeded
+- 500: unexpected server error
+
+## Pagination
+
+Use cursor-based pagination for large datasets, offset-based for simple cases:
+
+```
+GET /api/v1/users?limit=20&cursor=abc123
+```
+
+Response includes pagination metadata:
+```json
+{
+  "data": [],
+  "meta": {
+    "hasNext": true,
+    "nextCursor": "def456",
+    "total": 1500
+  }
+}
+```
+
+## Naming Conventions
+
+- Request/response bodies: camelCase for JSON fields
+- Database columns: snake_case
+- URL paths: kebab-case
+- Query parameters: camelCase
+- Headers: Title-Case (X-Request-Id)
+
+## Authentication
+
+- Use Bearer tokens in Authorization header
+- Short-lived access tokens (15-60 minutes)
+- Refresh tokens for session renewal
+- API keys for service-to-service communication
+- Never pass credentials in URL query parameters
+
+## Validation
+
+- Validate all input at the controller/handler layer
+- Use schema validation libraries (Zod, Joi, Pydantic)
+- Return all validation errors at once (not one at a time)
+- Sanitize input to prevent injection attacks
+- Set reasonable limits on string lengths and array sizes

package/dist/presets/backend/steering/security-best-practices.md

@@ -0,0 +1,85 @@
+---
+inclusion: always
+description: Security best practices for backend development covering authentication, input validation, data protection, and common vulnerability prevention.
+---
+
+# Security Best Practices
+
+## Input Validation
+
+- Validate all input on the server side regardless of client validation
+- Use allowlists over denylists for input validation
+- Parameterize all database queries (never concatenate user input into SQL)
+- Validate content types and reject unexpected formats
+- Set maximum request body size limits
+- Sanitize file uploads (validate type, size, scan for malware)
+
+## Authentication
+
+- Hash passwords with bcrypt (cost factor 12+) or argon2id
+- Implement account lockout after repeated failed attempts
+- Use constant-time comparison for token/password verification
+- Invalidate sessions on password change
+- Implement proper logout (invalidate tokens server-side)
+- Use secure session configuration (httpOnly, secure, sameSite)
+
+## Authorization
+
+- Implement role-based access control (RBAC) at minimum
+- Check authorization on every request (not just UI hiding)
+- Use principle of least privilege for service accounts
+- Validate resource ownership before allowing access
+- Log authorization failures for monitoring
+
+## Data Protection
+
+- Encrypt sensitive data at rest (AES-256)
+- Use TLS 1.2+ for all data in transit
+- Never log sensitive data (passwords, tokens, PII)
+- Mask sensitive fields in API responses
+- Implement data retention policies
+- Use environment variables for secrets (never hardcode)
+
+## Common Vulnerabilities (OWASP Top 10)
+
+- SQL Injection: use parameterized queries exclusively
+- XSS: encode output, use Content-Security-Policy headers
+- CSRF: use anti-CSRF tokens for state-changing operations
+- SSRF: validate and restrict outbound URLs
+- Mass Assignment: use explicit allowlists for request body fields
+- Broken Access Control: verify permissions on every endpoint
+
+## HTTP Security Headers
+
+Set these headers on all responses:
+- `Strict-Transport-Security: max-age=31536000; includeSubDomains`
+- `X-Content-Type-Options: nosniff`
+- `X-Frame-Options: DENY`
+- `Content-Security-Policy: default-src 'self'`
+- `X-XSS-Protection: 0` (rely on CSP instead)
+- `Referrer-Policy: strict-origin-when-cross-origin`
+
+## Rate Limiting
+
+- Implement rate limiting on all public endpoints
+- Use sliding window or token bucket algorithms
+- Return 429 with Retry-After header when limit exceeded
+- Apply stricter limits to authentication endpoints
+- Consider per-user and per-IP limits separately
+
+## Logging and Monitoring
+
+- Log all authentication events (success and failure)
+- Log authorization failures
+- Never log sensitive data in plain text
+- Implement alerting for suspicious patterns
+- Retain logs for compliance requirements
+- Use structured logging (JSON format) for analysis
+
+## Dependency Security
+
+- Audit dependencies regularly (npm audit, pip-audit, govulncheck)
+- Pin dependency versions in production
+- Use lockfiles (package-lock.json, poetry.lock, go.sum)
+- Monitor for CVEs in dependencies
+- Remove unused dependencies promptly

package/dist/presets/backend/workflows/development-rules.md

@@ -0,0 +1,33 @@
+# Development Rules
+
+Follow these principles in all implementation work: YAGNI (You Aren't Gonna Need It), KISS (Keep It Simple, Stupid), DRY (Don't Repeat Yourself).
+
+## File Naming
+
+- Use kebab-case for all file names
+- Names should describe purpose clearly without needing to read content
+- Long descriptive names are preferred over short ambiguous ones
+
+## File Size Management
+
+- Keep individual code files under 200 lines
+- Split large files into smaller, focused modules
+- Use composition over inheritance for complex components
+- Extract utility functions into separate modules
+- Create dedicated service classes for business logic
+
+## Code Quality
+
+- Write clean, readable, maintainable code
+- Follow established architectural patterns in the project
+- Handle edge cases and error scenarios with try-catch
+- Use secure coding patterns by default
+- Do not create new "enhanced" files; update existing files directly
+
+## Pre-commit Rules
+
+- Run linting before commit
+- Run tests before push
+- Keep commits focused on actual code changes
+- Never commit confidential information (dotenv, API keys, credentials)
+- Use conventional commit format

package/dist/presets/backend/workflows/documentation-management.md

@@ -0,0 +1,29 @@
+# Documentation Management
+
+## Documents to Maintain
+
+- Project Roadmap: living document tracking phases, milestones, progress
+- Project Changelog: record of all significant changes, features, fixes
+- System Architecture: component diagrams, data flow, integration points
+- Code Standards: conventions, patterns, naming rules
+
+## When to Update
+
+Update documentation automatically when:
+
+- A development phase status changes (In Progress to Complete)
+- Major features are implemented or released
+- Significant bugs are resolved or security patches applied
+- Project timeline or scope adjustments are made
+- External dependencies or breaking changes occur
+
+## Update Protocol
+
+1. Before: read current document status
+2. During: maintain version consistency and proper formatting
+3. After: verify links, dates, and cross-references are accurate
+4. Quality: ensure updates align with actual implementation progress
+
+## Changelog Format
+
+Use Keep a Changelog format with sections: Added, Changed, Deprecated, Removed, Fixed, Security. Tag entries with semantic versioning.

package/dist/presets/backend/workflows/orchestration-protocol.md

@@ -0,0 +1,25 @@
+# Orchestration Protocol
+
+## Sequential Chaining
+
+Chain tasks when they have dependencies or require outputs from previous steps:
+
+- Planning then Implementation then Testing then Review: feature development
+- Research then Design then Code then Documentation: new system components
+- Each step completes fully before the next begins
+- Pass context and outputs between steps in the chain
+
+## Parallel Execution
+
+Execute multiple tasks simultaneously when they are independent:
+
+- Code + Tests + Docs: when implementing separate non-conflicting components
+- Multiple feature branches: different work on isolated features
+- Cross-platform builds: platform-specific implementations
+
+## Coordination Rules
+
+- Ensure no file conflicts or shared resource contention in parallel work
+- Plan integration points before parallel execution begins
+- Use merge strategy to combine parallel outputs
+- Validate combined results after parallel work completes

package/dist/presets/backend/workflows/primary-workflow.md

@@ -0,0 +1,33 @@
+# Primary Workflow
+
+Follow this cycle for all implementation work: Plan, Implement, Test, Review.
+
+## 1. Planning
+
+- Analyze requirements and break into concrete tasks
+- Research relevant technical topics before implementation
+- Create implementation plan with TODO items
+
+## 2. Implementation
+
+- Write clean, readable, maintainable code
+- Follow established architectural patterns
+- Implement features according to specifications
+- Handle edge cases and error scenarios
+- After modifying code, run compile/build to check for errors
+
+## 3. Testing
+
+- Write comprehensive unit tests for new functionality
+- Ensure high code coverage on critical paths
+- Test error scenarios and edge cases
+- Validate performance requirements
+- Do not use mocks or fake data just to pass tests
+
+## 4. Review
+
+- Review code for standards compliance
+- Check for security concerns
+- Verify documentation is updated
+- Ensure backward compatibility
+- Confirm no regressions introduced

package/dist/presets/data-ai/.env.example

@@ -0,0 +1,35 @@
+# Data-AI Preset Environment Variables
+# Copy this file to .env and fill in your values
+
+# Workspace
+WORKSPACE_ROOT=.
+
+# Python Environment
+PYTHON_PATH=python3
+VENV_PATH=.venv
+
+# ML Experiment Tracking
+MLFLOW_TRACKING_URI=<your-mlflow-uri>
+WANDB_API_KEY=<your-wandb-key>
+WANDB_PROJECT=<your-project-name>
+
+# Google AI
+GOOGLE_API_KEY=<your-google-api-key>
+GOOGLE_CLOUD_PROJECT=<your-gcp-project>
+
+# Data Storage
+DATA_DIR=./data
+MODELS_DIR=./models
+ARTIFACTS_DIR=./artifacts
+
+# Jupyter
+JUPYTER_PORT=8888
+JUPYTER_TOKEN=<your-jupyter-token>
+
+# DVC Remote
+DVC_REMOTE=<your-dvc-remote-url>
+
+# Notifications (optional)
+DISCORD_WEBHOOK_URL=<your-discord-webhook>
+TELEGRAM_BOT_TOKEN=<your-telegram-token>
+TELEGRAM_CHAT_ID=<your-chat-id>

package/dist/presets/data-ai/.mcp.json.example

@@ -0,0 +1,31 @@
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-filesystem", "${WORKSPACE_ROOT}"]
+    },
+    "git": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-git", "--repository", "${WORKSPACE_ROOT}"]
+    },
+    "docs-seeker": {
+      "command": "npx",
+      "args": ["-y", "@mcp/docs-seeker"],
+      "env": {
+        "DOCS_PATH": "${WORKSPACE_ROOT}/docs"
+      }
+    },
+    "jupyter": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-jupyter"],
+      "env": {
+        "JUPYTER_URL": "http://localhost:${JUPYTER_PORT}",
+        "JUPYTER_TOKEN": "${JUPYTER_TOKEN}"
+      }
+    },
+    "fetch": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-fetch"]
+    }
+  }
+}

package/dist/presets/data-ai/README.md

@@ -0,0 +1,58 @@
+# Data-AI Preset
+
+Python/ML and AI agent toolkit for data science, machine learning, and AI development workflows.
+
+## Overview
+
+This preset provides a comprehensive environment for data scientists, ML engineers, and AI developers working with Python-based ML/AI stacks including PyTorch, TensorFlow, scikit-learn, pandas, and Google ADK.
+
+## Included Artifacts
+
+- 20 agents (16 baseline + 4 data-ai specific)
+- 21 skills (including document-skills sub-skill container)
+- 29 commands (25 baseline + 4 data-ai specific)
+- 6 hooks (cross-platform)
+- 4 workflows
+- Statusline triple (js/sh/ps1)
+- MCP server configurations
+- Spec and docs templates
+
+## Data-AI Specific Agents
+
+- `data-scientist` - Statistical analysis, EDA, feature engineering
+- `ml-engineer` - Model training, optimization, deployment
+- `data-pipeline-architect` - ETL/ELT pipelines, data orchestration
+- `model-evaluator` - Model validation, metrics, bias detection
+
+## Data-AI Specific Skills
+
+- `google-adk-python` - Google AI Development Kit for Python agents
+- `ai-multimodal` - Multimodal AI processing (vision, audio, text)
+- `document-skills` - Sub-skill container (docx, pdf, pptx, xlsx)
+- `research` - Technical research and analysis
+- `repomix` - Repository packaging for AI context
+- `sequential-thinking` - Structured problem decomposition
+
+## Usage
+
+```bash
+npx kiro-kit init --preset data-ai
+```
+
+## MCP Servers
+
+- filesystem - Local file access
+- git - Repository operations
+- docs-seeker - Documentation search
+- jupyter - Notebook server integration
+- fetch - HTTP fetching
+
+## Recommended Stack
+
+- Python 3.10+
+- PyTorch / TensorFlow / JAX
+- pandas / polars / numpy
+- scikit-learn / XGBoost
+- MLflow / Weights & Biases
+- DVC for data versioning
+- Google ADK for AI agents