kiro-kit 0.2.2 → 0.3.0

package/dist/presets/backend/hooks/api-schema-validate.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+/**
+ * Validates that route handler files export proper HTTP method handlers
+ * and use input validation (checks for zod/joi imports in route files).
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROUTE_DIRS = ['src/app/api', 'src/routes', 'routes', 'api'];
+const ROUTE_FILES = ['route.ts', 'route.js', 'index.ts', 'index.js'];
+const VALIDATION_PATTERNS = [/from\s+['"]zod['"]/, /from\s+['"]joi['"]/, /require\(['"]zod['"]\)/, /require\(['"]joi['"]\)/];
+const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
+
+const cwd = process.cwd();
+const issues = [];
+
+function findRouteFiles(dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        results.push(...findRouteFiles(full));
+      } else if (ROUTE_FILES.includes(entry.name)) {
+        results.push(full);
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+let routeFiles = [];
+for (const dir of ROUTE_DIRS) {
+  routeFiles.push(...findRouteFiles(path.resolve(cwd, dir)));
+}
+
+if (routeFiles.length === 0) {
+  process.exit(0);
+}
+
+for (const file of routeFiles) {
+  const content = fs.readFileSync(file, 'utf8');
+  const rel = path.relative(cwd, file);
+
+  // Check for exported HTTP method handlers
+  const hasMethod = HTTP_METHODS.some((m) =>
+    new RegExp(`export\\s+(async\\s+)?function\\s+${m}\\b`).test(content)
+  );
+  if (!hasMethod) {
+    issues.push(`${rel}: No exported HTTP method handler found (GET, POST, etc.)`);
+    continue;
+  }
+
+  // Check for input validation on POST/PUT/PATCH handlers
+  const hasMutation = ['POST', 'PUT', 'PATCH'].some((m) =>
+    new RegExp(`export\\s+(async\\s+)?function\\s+${m}\\b`).test(content)
+  );
+  if (hasMutation) {
+    const hasValidation = VALIDATION_PATTERNS.some((p) => p.test(content));
+    if (!hasValidation) {
+      issues.push(`${rel}: Mutation handler without input validation (zod/joi not imported)`);
+    }
+  }
+}
+
+if (issues.length > 0) {
+  process.stdout.write('[api-schema-validate] Issues found:\n');
+  issues.forEach((i) => process.stdout.write(`  - ${i}\n`));
+  process.exit(1);
+}
+
+process.exit(0);

package/dist/presets/backend/hooks/endpoint-test-coverage.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * Checks that API route files in src/app/api/ or routes/ have corresponding test files.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROUTE_DIRS = ['src/app/api', 'src/routes', 'routes'];
+const TEST_DIRS = ['__tests__', 'tests', 'test'];
+const ROUTE_FILES = ['route.ts', 'route.js', 'index.ts', 'index.js'];
+
+const cwd = process.cwd();
+
+function findRoutes(dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        results.push(...findRoutes(full));
+      } else if (ROUTE_FILES.includes(entry.name)) {
+        results.push({ file: full, dir: path.dirname(full) });
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+let routes = [];
+for (const dir of ROUTE_DIRS) {
+  routes.push(...findRoutes(path.resolve(cwd, dir)));
+}
+
+if (routes.length === 0) {
+  process.exit(0);
+}
+
+const missing = [];
+
+for (const route of routes) {
+  const routeDir = route.dir;
+  const routeRel = path.relative(cwd, routeDir);
+  const routeName = path.basename(routeDir);
+
+  // Look for test files in various locations
+  const testPatterns = [
+    path.join(routeDir, `route.test.ts`),
+    path.join(routeDir, `route.test.js`),
+    path.join(routeDir, `${routeName}.test.ts`),
+    path.join(routeDir, `${routeName}.test.js`),
+  ];
+
+  // Also check parent __tests__ directories
+  for (const testDir of TEST_DIRS) {
+    testPatterns.push(path.join(routeDir, '..', testDir, `${routeName}.test.ts`));
+    testPatterns.push(path.join(routeDir, '..', testDir, `${routeName}.test.js`));
+  }
+
+  const hasTest = testPatterns.some((t) => fs.existsSync(t));
+  if (!hasTest) {
+    missing.push(routeRel);
+  }
+}
+
+if (missing.length > 0) {
+  process.stdout.write(`[endpoint-test-coverage] ${missing.length} API route(s) without tests:\n`);
+  missing.slice(0, 10).forEach((m) => process.stdout.write(`  - ${m}\n`));
+  if (missing.length > 10) {
+    process.stdout.write(`  ... and ${missing.length - 10} more\n`);
+  }
+  process.exit(1);
+}
+
+process.exit(0);

package/dist/presets/backend/hooks/migration-safety-check.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+/**
+ * Scans migration files for dangerous operations (DROP TABLE, DROP COLUMN, TRUNCATE)
+ * and warns before execution.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const MIGRATION_DIRS = ['prisma/migrations', 'drizzle', 'migrations', 'db/migrations', 'src/db/migrations'];
+const DANGEROUS_PATTERNS = [
+  { pattern: /DROP\s+TABLE/gi, label: 'DROP TABLE' },
+  { pattern: /DROP\s+COLUMN/gi, label: 'DROP COLUMN' },
+  { pattern: /ALTER\s+TABLE\s+\S+\s+DROP/gi, label: 'ALTER TABLE DROP' },
+  { pattern: /TRUNCATE/gi, label: 'TRUNCATE' },
+  { pattern: /DELETE\s+FROM\s+\S+\s*;/gi, label: 'DELETE without WHERE' },
+];
+const SQL_EXTENSIONS = ['.sql', '.ts', '.js'];
+
+const cwd = process.cwd();
+const warnings = [];
+
+function findMigrationFiles(dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        results.push(...findMigrationFiles(full));
+      } else if (SQL_EXTENSIONS.includes(path.extname(entry.name).toLowerCase())) {
+        results.push(full);
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+let migrationFiles = [];
+for (const dir of MIGRATION_DIRS) {
+  migrationFiles.push(...findMigrationFiles(path.resolve(cwd, dir)));
+}
+
+if (migrationFiles.length === 0) {
+  process.exit(0);
+}
+
+for (const file of migrationFiles) {
+  const content = fs.readFileSync(file, 'utf8');
+  const rel = path.relative(cwd, file);
+
+  for (const { pattern, label } of DANGEROUS_PATTERNS) {
+    const matches = content.match(pattern);
+    if (matches) {
+      warnings.push(`${rel}: Contains ${label} (${matches.length} occurrence(s))`);
+    }
+  }
+}
+
+if (warnings.length > 0) {
+  process.stdout.write('[migration-safety-check] Dangerous operations detected:\n');
+  warnings.forEach((w) => process.stdout.write(`  - ${w}\n`));
+  process.stdout.write('  Review these changes carefully before applying.\n');
+  process.exit(1);
+}
+
+process.exit(0);

package/dist/presets/backend/manifest.json

@@ -523,6 +523,29 @@
       "type": "hook",
       "executable": true
     },
+    {
+      "source": "hooks/api-schema-validate.js",
+      "target": ".kiro/hooks/api-schema-validate.js",
+      "type": "hook",
+      "executable": true
+    },
+    {
+      "source": "hooks/migration-safety-check.js",
+      "target": ".kiro/hooks/migration-safety-check.js",
+      "type": "hook",
+      "executable": true
+    },
+    {
+      "source": "hooks/endpoint-test-coverage.js",
+      "target": ".kiro/hooks/endpoint-test-coverage.js",
+      "type": "hook",
+      "executable": true
+    },
+    {
+      "source": "powers.json",
+      "target": ".kiro/powers.json",
+      "type": "powers"
+    },
     {
       "source": "metadata.json",
       "target": ".kiro/metadata.json",
@@ -864,73 +887,63 @@
       "type": "other"
     },
     {
-      "source": "skills/claude-code/references/advanced-features.md",
-      "target": ".kiro/skills/claude-code/references/advanced-features.md",
-      "type": "doc"
-    },
-    {
-      "source": "skills/claude-code/references/agent-skills.md",
-      "target": ".kiro/skills/claude-code/references/agent-skills.md",
-      "type": "doc"
-    },
-    {
-      "source": "skills/claude-code/references/api-reference.md",
-      "target": ".kiro/skills/claude-code/references/api-reference.md",
-      "type": "doc"
+      "source": "skills/kiro/skill.md",
+      "target": ".kiro/skills/kiro/skill.md",
+      "type": "skill"
     },
     {
-      "source": "skills/claude-code/references/best-practices.md",
-      "target": ".kiro/skills/claude-code/references/best-practices.md",
+      "source": "skills/kiro/references/autonomy-modes.md",
+      "target": ".kiro/skills/kiro/references/autonomy-modes.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/references/cicd-integration.md",
-      "target": ".kiro/skills/claude-code/references/cicd-integration.md",
+      "source": "skills/kiro/references/best-practices.md",
+      "target": ".kiro/skills/kiro/references/best-practices.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/references/configuration.md",
-      "target": ".kiro/skills/claude-code/references/configuration.md",
+      "source": "skills/kiro/references/commands.md",
+      "target": ".kiro/skills/kiro/references/commands.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/references/enterprise-features.md",
-      "target": ".kiro/skills/claude-code/references/enterprise-features.md",
+      "source": "skills/kiro/references/configuration.md",
+      "target": ".kiro/skills/kiro/references/configuration.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/references/getting-started.md",
-      "target": ".kiro/skills/claude-code/references/getting-started.md",
+      "source": "skills/kiro/references/getting-started.md",
+      "target": ".kiro/skills/kiro/references/getting-started.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/references/hooks-and-plugins.md",
-      "target": ".kiro/skills/claude-code/references/hooks-and-plugins.md",
+      "source": "skills/kiro/references/hooks.md",
+      "target": ".kiro/skills/kiro/references/hooks.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/references/ide-integration.md",
-      "target": ".kiro/skills/claude-code/references/ide-integration.md",
+      "source": "skills/kiro/references/mcp-integration.md",
+      "target": ".kiro/skills/kiro/references/mcp-integration.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/references/mcp-integration.md",
-      "target": ".kiro/skills/claude-code/references/mcp-integration.md",
+      "source": "skills/kiro/references/skills.md",
+      "target": ".kiro/skills/kiro/references/skills.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/references/slash-commands.md",
-      "target": ".kiro/skills/claude-code/references/slash-commands.md",
+      "source": "skills/kiro/references/specs-workflow.md",
+      "target": ".kiro/skills/kiro/references/specs-workflow.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/references/troubleshooting.md",
-      "target": ".kiro/skills/claude-code/references/troubleshooting.md",
+      "source": "skills/kiro/references/steering-files.md",
+      "target": ".kiro/skills/kiro/references/steering-files.md",
       "type": "doc"
     },
     {
-      "source": "skills/claude-code/skill.md",
-      "target": ".kiro/skills/claude-code/skill.md",
+      "source": "skills/kiro/references/troubleshooting.md",
+      "target": ".kiro/skills/kiro/references/troubleshooting.md",
       "type": "doc"
     },
     {

package/dist/presets/backend/powers.json

@@ -0,0 +1,40 @@
+{
+  "powers": [
+    {
+      "name": "Supabase",
+      "url": "https://kiro.dev/powers/supabase",
+      "description": "Backend-as-a-service with Postgres, auth, and real-time subscriptions",
+      "tier": "essential"
+    },
+    {
+      "name": "Neon",
+      "url": "https://kiro.dev/powers/neon",
+      "description": "Serverless Postgres with branching and autoscaling",
+      "tier": "recommended"
+    },
+    {
+      "name": "Postman",
+      "url": "https://kiro.dev/powers/postman",
+      "description": "API testing and collection management",
+      "tier": "recommended"
+    },
+    {
+      "name": "Context7",
+      "url": "https://kiro.dev/powers/context7",
+      "description": "Up-to-date documentation lookup for libraries and frameworks",
+      "tier": "recommended"
+    },
+    {
+      "name": "Stripe",
+      "url": "https://kiro.dev/powers/stripe",
+      "description": "Payment processing, subscriptions, and billing integration",
+      "tier": "optional"
+    },
+    {
+      "name": "Snyk",
+      "url": "https://kiro.dev/powers/snyk",
+      "description": "Security scanning and vulnerability detection for dependencies",
+      "tier": "optional"
+    }
+  ]
+}

package/dist/presets/backend/skills/kiro/references/autonomy-modes.md

@@ -0,0 +1,26 @@
+# Autonomy Modes
+
+## Overview
+
+Kiro offers two modes for how the AI agent interacts with your workspace.
+
+## Autopilot Mode
+
+- Agent modifies files autonomously within the workspace
+- Best for: routine tasks, well-defined changes, trusted workflows
+- Changes are applied immediately
+- Use when you trust the agent's judgment for the task
+
+## Supervised Mode
+
+- User has opportunity to review and revert changes after application
+- Best for: complex refactors, unfamiliar codebases, learning
+- Changes can be inspected before accepting
+- Use when you want more control over modifications
+
+## Choosing a Mode
+
+- Start with Supervised for new projects or unfamiliar tasks
+- Switch to Autopilot for repetitive, well-understood operations
+- Use Supervised for security-sensitive changes
+- Autopilot works well for spec task execution

package/dist/presets/backend/skills/kiro/references/best-practices.md

@@ -0,0 +1,48 @@
+# Best Practices
+
+## Project Organization
+
+- Keep `.kiro/` directory in version control
+- Use consistent naming (kebab-case for directories)
+- Document custom skills and commands in project README
+- Share steering files across team via git
+
+## Steering Conventions
+
+- One topic per steering file
+- Use "always" only for critical, universal rules
+- Use "fileMatch" for language/framework-specific guidance
+- Keep files concise (under 100 lines ideally)
+- Include examples in steering content
+
+## Skill Design
+
+- Focus each skill on one domain
+- Write clear activation descriptions
+- Use references for detailed content
+- Keep main skill.md as an overview/router
+- Test activation with various phrasings
+
+## Hook Patterns
+
+- Use file hooks for linting and formatting
+- Use postTaskExecution for test validation
+- Use preToolUse for access control
+- Keep hook commands fast (under 30 seconds)
+- Log hook failures for debugging
+
+## Team Workflows
+
+- Standardize steering files across projects
+- Share skills via presets or git submodules
+- Document MCP server requirements in README
+- Use specs for all non-trivial features
+- Review spec documents before task execution
+
+## Cost Management
+
+- Use steering to keep responses focused
+- Avoid overly broad "always" steering
+- Disable unused MCP servers
+- Use Supervised mode for exploratory work
+- Keep skill references concise

package/dist/presets/backend/skills/kiro/references/commands.md

@@ -0,0 +1,61 @@
+# Commands
+
+## Overview
+
+Commands are user-defined operations in `.kiro/commands/` that expand to prompts. They provide shortcuts for common workflows.
+
+## File Format
+
+```markdown
+---
+description: Brief description of what this command does
+inclusion: manual
+argument-hint: "[pattern]"
+---
+
+## Arguments
+PATTERN: $1 (default: all)
+
+## Workflow
+1. Step one
+2. Step two
+3. Step three
+```
+
+## Front-Matter
+
+Required fields:
+- `description`: What the command does
+
+Optional fields:
+- `inclusion`: "manual" (default)
+- `argument-hint`: Hint for arguments shown to user
+
+## Arguments
+
+Use `$1`, `$2`, etc. for positional arguments passed by the user.
+
+## Nested Commands
+
+Commands can be organized in subdirectories:
+```
+.kiro/commands/
+  test.md
+  fix/
+    types.md
+    test.md
+    fast.md
+  git/
+    cm.md
+    cp.md
+    pr.md
+```
+
+Access nested commands with colon notation: `/fix:types`, `/git:cm`
+
+## Best Practices
+
+- Keep commands focused on one workflow
+- Include clear step-by-step instructions
+- Use argument hints to guide users
+- Document default behavior when no arguments provided

package/dist/presets/backend/skills/kiro/references/configuration.md

@@ -0,0 +1,41 @@
+# Configuration
+
+## Settings Hierarchy
+
+Settings are merged with precedence:
+1. User-level: `~/.kiro/settings/mcp.json` (global)
+2. Workspace-level: `.kiro/settings/mcp.json` (per project)
+
+Workspace settings override user settings.
+
+## MCP Configuration
+
+File: `.kiro/settings/mcp.json`
+
+```json
+{
+  "mcpServers": {
+    "server-name": {
+      "command": "uvx",
+      "args": ["package-name@latest"],
+      "env": {
+        "API_KEY": "your-key"
+      },
+      "disabled": false,
+      "autoApprove": ["tool-name"]
+    }
+  }
+}
+```
+
+## Key Settings
+
+- `command`: Executable to run the MCP server
+- `args`: Command-line arguments
+- `env`: Environment variables passed to the server
+- `disabled`: Enable/disable without removing config
+- `autoApprove`: Tools that don't require user confirmation
+
+## Multi-Root Workspaces
+
+Each workspace folder can have its own `.kiro/settings/mcp.json`. Configs merge with later folders taking precedence.

package/dist/presets/backend/skills/kiro/references/getting-started.md

@@ -0,0 +1,45 @@
+# Getting Started with Kiro
+
+## Prerequisites
+
+- Supported OS: Windows, macOS, Linux
+- Internet connection for AI features
+
+## Installation
+
+Download Kiro from https://kiro.dev and install for your platform.
+
+## First Run
+
+1. Open Kiro
+2. Open or create a workspace folder
+3. Start chatting with the AI agent in the chat panel
+
+## Workspace Setup
+
+Kiro stores configuration in `.kiro/` at the workspace root:
+
+```
+.kiro/
+  settings/
+    mcp.json          # MCP server configuration
+  steering/           # Steering files (conventions, rules)
+  skills/             # Custom skills
+  commands/           # Custom commands
+  hooks/              # Agent hooks
+  specs/              # Feature specs
+```
+
+## Authentication
+
+- Sign in with your AWS account or supported identity provider
+- API keys are managed automatically by the IDE
+
+## Key Concepts
+
+- **Chat**: Interact with the AI agent directly
+- **Specs**: Structured feature development (requirements -> design -> tasks)
+- **Steering**: Project-level instructions that guide the AI
+- **Skills**: Modular capabilities activated by context
+- **Hooks**: Automated actions on IDE events
+- **MCP**: External tool integrations