kiro-kit 0.1.0

package/dist/presets/backend/commands/release.md

@@ -0,0 +1,17 @@
+---
+description: Prepare and execute a release with version bump and changelog
+inclusion: manual
+argument-hint: "[version-type]"
+---
+
+## Arguments
+VERSION_TYPE: $1 (default: patch, options: major, minor, patch)
+
+## Workflow
+1. Verify working tree is clean
+2. Run full test suite
+3. Bump version in package.json
+4. Update CHANGELOG.md with new entries
+5. Create git commit and tag
+6. Push to remote with tags
+7. Report release summary

package/dist/presets/backend/commands/review/code.md

@@ -0,0 +1,16 @@
+---
+description: Perform a code review on recent changes
+inclusion: manual
+argument-hint: "[scope]"
+---
+
+## Arguments
+SCOPE: $1 (default: staged changes, options: staged, branch, file path)
+
+## Workflow
+1. Identify files to review based on scope
+2. Check code quality, readability, and standards compliance
+3. Identify security vulnerabilities
+4. Assess performance implications
+5. Verify error handling and edge cases
+6. Produce review report with categorized findings

package/dist/presets/backend/commands/review/security.md

@@ -0,0 +1,17 @@
+---
+description: Perform a security-focused review of the codebase
+inclusion: manual
+argument-hint: "[scope]"
+---
+
+## Arguments
+SCOPE: $1 (default: all, options: auth, api, database, dependencies)
+
+## Workflow
+1. Run dependency audit (npm audit / pip-audit)
+2. Check for OWASP Top 10 vulnerabilities
+3. Review authentication and authorization logic
+4. Verify input validation and output encoding
+5. Check for secrets in code or config files
+6. Assess security headers and transport configuration
+7. Produce security report with severity ratings

package/dist/presets/backend/commands/scout/ext.md

@@ -0,0 +1,17 @@
+---
+description: Scout codebase using external agentic tools for faster parallel search
+inclusion: manual
+argument-hint: "[search-query] [scale]"
+---
+
+## Arguments
+QUERY: $1 (required)
+SCALE: $2 (default: 3)
+
+## Workflow
+1. Analyze search query and determine agent count
+2. Divide codebase into logical sections
+3. Launch parallel searches via external tools (Gemini, OpenCode)
+4. Collect results within 3-minute timeout per agent
+5. Deduplicate and organize findings
+6. Report results with coverage gaps

package/dist/presets/backend/commands/scout.md

@@ -0,0 +1,16 @@
+---
+description: Scout the codebase for files relevant to a task
+inclusion: manual
+argument-hint: "[search-query] [scale]"
+---
+
+## Arguments
+QUERY: $1 (required)
+SCALE: $2 (default: 3)
+
+## Workflow
+1. Analyze the search query and identify key directories
+2. Divide codebase into logical sections for parallel searching
+3. Search each section for files matching the query
+4. Deduplicate and organize results by category
+5. Present file list with any coverage gaps noted

package/dist/presets/backend/commands/skill/add.md

@@ -0,0 +1,16 @@
+---
+description: Add new reference files or scripts to a skill
+inclusion: manual
+argument-hint: "[skill-name] [reference-or-script-prompt]"
+---
+
+## Arguments
+SKILL: $1 (required, skill name)
+PROMPT: $2 (required, what to add)
+
+## Workflow
+1. Locate skill directory at `.kiro/skills/$1`
+2. Analyze existing skill content
+3. Create new reference files or scripts based on prompt
+4. Update SKILL.md if activation triggers change
+5. Verify skill structure is valid

package/dist/presets/backend/commands/skill/create.md

@@ -0,0 +1,17 @@
+---
+description: Create a new skill from scratch
+inclusion: manual
+argument-hint: "[skill-name] [description]"
+---
+
+## Arguments
+NAME: $1 (required, kebab-case skill name)
+DESCRIPTION: $2 (required, what the skill does)
+
+## Workflow
+1. Create skill directory at `.kiro/skills/$1/`
+2. Generate SKILL.md with front-matter and content
+3. Create references/ directory if detailed docs needed
+4. Create scripts/ directory if automation needed
+5. Verify skill structure matches specification
+6. Test activation with representative scenario

package/dist/presets/backend/commands/skill/optimize.md

@@ -0,0 +1,16 @@
+---
+description: Optimize an existing skill for token efficiency and effectiveness
+inclusion: manual
+argument-hint: "[skill-name]"
+---
+
+## Arguments
+SKILL: $1 (required, skill name)
+
+## Workflow
+1. Read current skill content and structure
+2. Analyze token usage and identify redundancy
+3. Propose optimizations (consolidate, restructure, trim)
+4. Present plan for user approval
+5. Implement approved changes
+6. Verify skill still activates correctly

package/dist/presets/backend/commands/test.md

@@ -0,0 +1,15 @@
+---
+description: Run the test suite with coverage reporting
+inclusion: manual
+argument-hint: "[pattern]"
+---
+
+## Arguments
+PATTERN: $1 (default: all tests)
+
+## Workflow
+1. Run test suite with coverage: `npm test -- --coverage`
+2. If pattern provided, filter tests: `npm test -- $1`
+3. Report test results summary (passed, failed, skipped)
+4. Report coverage metrics (lines, branches, functions)
+5. Highlight any failing tests with error details

package/dist/presets/backend/docs/code-standards.md

@@ -0,0 +1,84 @@
+# Code Standards
+
+## Language and Runtime
+
+- Node.js 18+ with TypeScript strict mode
+- Python 3.10+ with type hints
+- Go 1.21+ with standard project layout
+
+## Architecture
+
+- Layered architecture: Controller -> Service -> Repository
+- Dependency injection for testability
+- Single responsibility per module
+- Maximum 200 lines per file
+
+## File Organization
+
+```
+src/
+  config/              Configuration and environment
+  controllers/         Route handlers (thin, delegation only)
+  services/            Business logic
+  repositories/        Data access layer
+  middleware/          Request processing pipeline
+  models/              Data models and schemas
+  validators/          Input validation schemas
+  errors/              Custom error classes
+  utils/               Shared utilities
+  types/               TypeScript type definitions
+tests/
+  unit/                Unit tests (no I/O)
+  integration/         Database and API tests
+  fixtures/            Test data and helpers
+```
+
+## Naming
+
+- Files: kebab-case (`user-service.ts`, `auth-middleware.ts`)
+- Classes: PascalCase (`UserService`, `AuthMiddleware`)
+- Functions: camelCase (`createUser`, `validateToken`)
+- Constants: UPPER_SNAKE_CASE (`MAX_RETRIES`, `DB_POOL_SIZE`)
+- Database tables: snake_case plural (`user_accounts`)
+- Database columns: snake_case (`created_at`, `email_verified`)
+- API paths: kebab-case plural (`/api/v1/user-accounts`)
+- Environment variables: UPPER_SNAKE_CASE (`DATABASE_URL`)
+
+## Error Handling
+
+- Use typed error classes with error codes
+- Never swallow errors silently
+- Log errors with context (correlation ID, user ID, operation)
+- Return structured error responses to clients
+- Use try-catch at service boundaries
+
+## Database
+
+- Use parameterized queries exclusively (no string concatenation)
+- Implement connection pooling
+- Add indexes based on query patterns
+- Use transactions for multi-statement operations
+- Include created_at/updated_at on all tables
+
+## Testing
+
+- Colocate test files or use parallel test directory
+- Unit tests for business logic (no database, no network)
+- Integration tests for API endpoints and database operations
+- Use factories for test data (not raw fixtures)
+- Test error paths, not just happy paths
+
+## Security
+
+- Validate all input at the boundary
+- Hash passwords with bcrypt or argon2id
+- Use parameterized queries (prevent SQL injection)
+- Set security headers on all responses
+- Never log sensitive data (passwords, tokens, PII)
+
+## Git Conventions
+
+- Conventional commits: `type(scope): description`
+- Branch naming: `feature/description`, `fix/description`
+- PR titles under 72 characters
+- Squash merge to main

package/dist/presets/backend/docs/project-roadmap.md

@@ -0,0 +1,60 @@
+# Project Roadmap
+
+## Current Version: 0.1.0
+
+## Phase 1: Foundation (In Progress)
+
+- [ ] Project scaffolding and configuration
+- [ ] Database schema design and initial migrations
+- [ ] Authentication system (JWT + refresh tokens)
+- [ ] Core API endpoints (CRUD operations)
+- [ ] Error handling and logging infrastructure
+- [ ] Unit and integration test setup
+
+## Phase 2: Core Features
+
+- [ ] Business logic implementation
+- [ ] Input validation and sanitization
+- [ ] Rate limiting and abuse prevention
+- [ ] Background job processing
+- [ ] Email/notification service integration
+- [ ] API documentation (OpenAPI/Swagger)
+
+## Phase 3: Security and Performance
+
+- [ ] Security audit and hardening
+- [ ] Performance profiling and optimization
+- [ ] Database query optimization
+- [ ] Caching strategy implementation
+- [ ] Load testing and capacity planning
+- [ ] Monitoring and alerting setup
+
+## Phase 4: Deployment and Operations
+
+- [ ] Docker containerization
+- [ ] CI/CD pipeline configuration
+- [ ] Staging environment setup
+- [ ] Production deployment
+- [ ] Runbook documentation
+- [ ] Disaster recovery procedures
+
+## Phase 5: Scale and Iterate
+
+- [ ] Horizontal scaling implementation
+- [ ] Advanced features based on user feedback
+- [ ] API versioning strategy
+- [ ] Performance monitoring and optimization
+- [ ] Documentation updates
+
+## Success Metrics
+
+- API response time: p95 under 200ms
+- Uptime: 99.9% availability
+- Test coverage: 80%+ on critical paths
+- Zero critical security vulnerabilities
+- Deployment frequency: multiple times per week
+
+## Changelog
+
+### [Unreleased]
+- Initial project setup

package/dist/presets/backend/docs/system-architecture.md

@@ -0,0 +1,81 @@
+# System Architecture
+
+## Overview
+
+Document the high-level system architecture, components, and their interactions.
+
+## System Context
+
+```mermaid
+flowchart LR
+    Client[Client Apps] --> API[API Gateway]
+    API --> Auth[Auth Service]
+    API --> Core[Core Service]
+    Core --> DB[(Database)]
+    Core --> Cache[(Cache)]
+    Core --> Queue[Message Queue]
+    Queue --> Worker[Background Workers]
+```
+
+## Components
+
+### API Layer
+- Framework: [Express/Fastify/NestJS/FastAPI/Gin]
+- Responsibilities: request routing, validation, response formatting
+- Middleware: auth, rate limiting, logging, CORS
+
+### Service Layer
+- Business logic and domain rules
+- Transaction management
+- External service integration
+- Event publishing
+
+### Data Layer
+- Primary database: [PostgreSQL/MongoDB]
+- Cache: [Redis]
+- Search: [Elasticsearch] (if applicable)
+- File storage: [S3/GCS] (if applicable)
+
+### Infrastructure
+- Container runtime: Docker
+- Orchestration: [Docker Compose/Kubernetes]
+- CI/CD: GitHub Actions
+- Monitoring: [Prometheus/Datadog/CloudWatch]
+
+## Data Flow
+
+### Request Lifecycle
+1. Client sends HTTP request
+2. Load balancer routes to available instance
+3. Middleware pipeline: CORS -> Rate Limit -> Auth -> Validation
+4. Controller delegates to service layer
+5. Service executes business logic
+6. Repository handles data persistence
+7. Response formatted and returned
+
+### Background Processing
+1. Service publishes event to message queue
+2. Worker consumes event
+3. Worker executes long-running task
+4. Result stored or notification sent
+
+## Deployment
+
+### Environments
+- Development: local Docker Compose
+- Staging: [cloud provider] with production-like config
+- Production: [cloud provider] with HA configuration
+
+### Scaling Strategy
+- Horizontal scaling for stateless API instances
+- Read replicas for database read scaling
+- Cache layer for frequently accessed data
+- Queue-based processing for async workloads
+
+## Security Architecture
+
+- TLS termination at load balancer
+- JWT-based authentication
+- Role-based access control (RBAC)
+- Network segmentation (public/private subnets)
+- Secrets managed via environment variables or secret manager

package/dist/presets/backend/hooks/.env.example

@@ -0,0 +1,9 @@
+# Hook environment variables
+# Copy this file to .env and fill in your values.
+
+# Discord webhook URL for notifications
+DISCORD_WEBHOOK_URL=<your-discord-webhook-url>
+
+# Telegram bot token and chat ID for notifications
+TELEGRAM_BOT_TOKEN=<your-telegram-bot-token>
+TELEGRAM_CHAT_ID=<your-telegram-chat-id>

package/dist/presets/backend/hooks/README.md

@@ -0,0 +1,28 @@
+# Hooks
+
+Cross-platform hook scripts for Kiro IDE automation.
+
+## Available Hooks
+
+| Hook | Trigger | Description |
+|------|---------|-------------|
+| scout-block | PreToolUse | Blocks dangerous commands (rm -rf, drop database, etc.) |
+| modularization-hook | PostToolUse | Warns when files exceed 200 lines |
+| discord-notify | agentStop | Sends notification via Discord webhook |
+| telegram-notify | agentStop | Sends notification via Telegram bot |
+| pre-commit-lint | PreToolUse | Runs linter before commit |
+| git-status-tracker | PostToolUse | Logs git working tree status summary |
+
+## Platform Support
+
+Each hook has a primary `.js` (Node.js) version and platform-specific fallbacks:
+- `.js` - Cross-platform (requires Node.js)
+- `.sh` - Unix/macOS/Linux (bash)
+- `.ps1` - Windows (PowerShell)
+
+## Environment Variables
+
+Copy `hooks/.env.example` to `hooks/.env` and configure:
+- `DISCORD_WEBHOOK_URL` - Required for discord-notify
+- `TELEGRAM_BOT_TOKEN` - Required for telegram-notify
+- `TELEGRAM_CHAT_ID` - Required for telegram-notify

package/dist/presets/backend/hooks/discord-notify.js

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+// Sends a notification to Discord via webhook.
+// Requires DISCORD_WEBHOOK_URL in hooks/.env or environment.
+
+const https = require('https');
+
+const WEBHOOK_URL = process.env.DISCORD_WEBHOOK_URL || '';
+const message = process.argv.slice(2).join(' ') || 'Agent task completed.';
+
+if (!WEBHOOK_URL) {
+  process.stderr.write('[discord-notify] DISCORD_WEBHOOK_URL not set. Skipping.\n');
+  process.exit(0);
+}
+
+const url = new URL(WEBHOOK_URL);
+const payload = JSON.stringify({ content: message });
+
+const options = {
+  hostname: url.hostname,
+  path: url.pathname,
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+};
+
+const req = https.request(options, (res) => {
+  process.exit(res.statusCode >= 200 && res.statusCode < 300 ? 0 : 1);
+});
+
+req.on('error', () => process.exit(1));
+req.write(payload);
+req.end();

package/dist/presets/backend/hooks/discord-notify.ps1

@@ -0,0 +1,19 @@
+# Sends a notification to Discord via webhook.
+# Requires DISCORD_WEBHOOK_URL in environment.
+
+$Message = if ($args.Count -gt 0) { $args -join ' ' } else { 'Agent task completed.' }
+
+$WebhookUrl = $env:DISCORD_WEBHOOK_URL
+
+if (-not $WebhookUrl) {
+    Write-Error "[discord-notify] DISCORD_WEBHOOK_URL not set. Skipping."
+    exit 0
+}
+
+$Body = @{ content = $Message } | ConvertTo-Json
+try {
+    Invoke-RestMethod -Uri $WebhookUrl -Method Post -Body $Body -ContentType 'application/json'
+    exit 0
+} catch {
+    exit 1
+}

package/dist/presets/backend/hooks/discord-notify.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Sends a notification to Discord via webhook.
+# Requires DISCORD_WEBHOOK_URL in environment.
+
+MESSAGE="${*:-Agent task completed.}"
+
+if [ -z "$DISCORD_WEBHOOK_URL" ]; then
+  echo "[discord-notify] DISCORD_WEBHOOK_URL not set. Skipping." >&2
+  exit 0
+fi
+
+curl -s -o /dev/null -w "%{http_code}" \
+  -H "Content-Type: application/json" \
+  -d "{\"content\": \"$MESSAGE\"}" \
+  "$DISCORD_WEBHOOK_URL" | grep -q "^2" && exit 0 || exit 1

package/dist/presets/backend/hooks/git-status-tracker.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+// Tracks git status changes and logs summary.
+// Useful as a PostToolUse or agentStop hook.
+
+const { execSync } = require('child_process');
+
+try {
+  const status = execSync('git status --porcelain', { encoding: 'utf8' }).trim();
+  if (!status) {
+    process.stdout.write('[git-status] Working tree clean.\n');
+    process.exit(0);
+  }
+
+  const lines = status.split('\n');
+  const added = lines.filter((l) => l.startsWith('A') || l.startsWith('?')).length;
+  const modified = lines.filter((l) => l.startsWith('M') || l.startsWith(' M')).length;
+  const deleted = lines.filter((l) => l.startsWith('D') || l.startsWith(' D')).length;
+
+  process.stdout.write(
+    `[git-status] ${lines.length} changes: +${added} ~${modified} -${deleted}\n`
+  );
+} catch (err) {
+  process.stderr.write('[git-status] Not a git repository or git unavailable.\n');
+}
+
+process.exit(0);

package/dist/presets/backend/hooks/modularization-hook.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+// PostToolUse hook: warns when a file exceeds 200 lines.
+// Encourages splitting large files into smaller modules.
+
+const fs = require('fs');
+const path = require('path');
+
+const MAX_LINES = 200;
+const CODE_EXTENSIONS = ['.js', '.ts', '.jsx', '.tsx', '.py', '.go', '.rs', '.java'];
+
+const filePath = process.argv[2] || '';
+
+if (!filePath || !fs.existsSync(filePath)) {
+  process.exit(0);
+}
+
+const ext = path.extname(filePath).toLowerCase();
+if (!CODE_EXTENSIONS.includes(ext)) {
+  process.exit(0);
+}
+
+try {
+  const content = fs.readFileSync(filePath, 'utf8');
+  const lineCount = content.split('\n').length;
+
+  if (lineCount > MAX_LINES) {
+    process.stderr.write(
+      `[modularization] Warning: ${filePath} has ${lineCount} lines (max ${MAX_LINES}). Consider splitting.\n`
+    );
+    process.exit(1);
+  }
+} catch (err) {
+  // Silently ignore read errors
+}
+
+process.exit(0);

package/dist/presets/backend/hooks/pre-commit-lint.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// Pre-commit hook: runs linter on staged files.
+// Exits non-zero if lint fails, preventing commit.
+
+const { execSync } = require('child_process');
+
+try {
+  execSync('npm run lint --silent', { stdio: 'pipe' });
+  process.exit(0);
+} catch (err) {
+  process.stderr.write('[pre-commit-lint] Lint failed. Fix errors before committing.\n');
+  if (err.stdout) process.stderr.write(err.stdout.toString());
+  if (err.stderr) process.stderr.write(err.stderr.toString());
+  process.exit(1);
+}

package/dist/presets/backend/hooks/scout-block.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+// Security guard: blocks dangerous commands before execution.
+// Registered as PreToolUse hook.
+
+const BLOCKED_PATTERNS = [
+  /rm\s+(-rf|-fr)\s+[\/~]/i,
+  /rm\s+(-rf|-fr)\s+\./i,
+  /drop\s+(database|table|schema)/i,
+  /truncate\s+table/i,
+  /delete\s+from\s+\w+\s*;?\s*$/i,
+  /format\s+[a-z]:/i,
+  /mkfs\./i,
+  /dd\s+if=.*of=\/dev/i,
+  /chmod\s+-R\s+777\s+\//i,
+  />\s*\/dev\/sd[a-z]/i,
+  /:(){ :\|:& };:/,
+  /shutdown/i,
+  /reboot/i,
+  /init\s+0/i,
+];
+
+const input = process.argv.slice(2).join(' ') || '';
+const blocked = BLOCKED_PATTERNS.some((p) => p.test(input));
+
+if (blocked) {
+  process.stderr.write(`[scout-block] Blocked dangerous command: ${input}\n`);
+  process.exit(2);
+}
+
+process.exit(0);

package/dist/presets/backend/hooks/scout-block.ps1

@@ -0,0 +1,26 @@
+# Security guard: blocks dangerous commands before execution.
+# Registered as PreToolUse hook.
+
+$Input = $args -join ' '
+
+$BlockedPatterns = @(
+    'rm\s+(-rf|-fr)\s+[\/~]'
+    'drop\s+(database|table|schema)'
+    'truncate\s+table'
+    'format\s+[a-z]:'
+    'mkfs\.'
+    'dd\s+if=.*of=\/dev'
+    'chmod\s+-R\s+777\s+\/'
+    'shutdown'
+    'reboot'
+    'init\s+0'
+)
+
+foreach ($pattern in $BlockedPatterns) {
+    if ($Input -match $pattern) {
+        Write-Error "[scout-block] Blocked dangerous command: $Input"
+        exit 2
+    }
+}
+
+exit 0

package/dist/presets/backend/hooks/scout-block.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Security guard: blocks dangerous commands before execution.
+# Registered as PreToolUse hook.
+
+INPUT="$*"
+
+BLOCKED_PATTERNS=(
+  "rm -rf /"
+  "rm -fr /"
+  "rm -rf ~"
+  "rm -rf ."
+  "drop database"
+  "drop table"
+  "truncate table"
+  "mkfs."
+  "dd if="
+  "chmod -R 777 /"
+  "shutdown"
+  "reboot"
+  "init 0"
+  "format c:"
+)
+
+for pattern in "${BLOCKED_PATTERNS[@]}"; do
+  if echo "$INPUT" | grep -qi "$pattern"; then
+    echo "[scout-block] Blocked dangerous command: $INPUT" >&2
+    exit 2
+  fi
+done
+
+exit 0