kiro-kit 0.2.4 → 0.3.0

package/dist/presets/backend/hooks/api-schema-validate.js

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+/**
+ * Validates that route handler files export proper HTTP method handlers
+ * and use input validation (checks for zod/joi imports in route files).
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROUTE_DIRS = ['src/app/api', 'src/routes', 'routes', 'api'];
+const ROUTE_FILES = ['route.ts', 'route.js', 'index.ts', 'index.js'];
+const VALIDATION_PATTERNS = [/from\s+['"]zod['"]/, /from\s+['"]joi['"]/, /require\(['"]zod['"]\)/, /require\(['"]joi['"]\)/];
+const HTTP_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
+
+const cwd = process.cwd();
+const issues = [];
+
+function findRouteFiles(dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        results.push(...findRouteFiles(full));
+      } else if (ROUTE_FILES.includes(entry.name)) {
+        results.push(full);
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+let routeFiles = [];
+for (const dir of ROUTE_DIRS) {
+  routeFiles.push(...findRouteFiles(path.resolve(cwd, dir)));
+}
+
+if (routeFiles.length === 0) {
+  process.exit(0);
+}
+
+for (const file of routeFiles) {
+  const content = fs.readFileSync(file, 'utf8');
+  const rel = path.relative(cwd, file);
+
+  // Check for exported HTTP method handlers
+  const hasMethod = HTTP_METHODS.some((m) =>
+    new RegExp(`export\\s+(async\\s+)?function\\s+${m}\\b`).test(content)
+  );
+  if (!hasMethod) {
+    issues.push(`${rel}: No exported HTTP method handler found (GET, POST, etc.)`);
+    continue;
+  }
+
+  // Check for input validation on POST/PUT/PATCH handlers
+  const hasMutation = ['POST', 'PUT', 'PATCH'].some((m) =>
+    new RegExp(`export\\s+(async\\s+)?function\\s+${m}\\b`).test(content)
+  );
+  if (hasMutation) {
+    const hasValidation = VALIDATION_PATTERNS.some((p) => p.test(content));
+    if (!hasValidation) {
+      issues.push(`${rel}: Mutation handler without input validation (zod/joi not imported)`);
+    }
+  }
+}
+
+if (issues.length > 0) {
+  process.stdout.write('[api-schema-validate] Issues found:\n');
+  issues.forEach((i) => process.stdout.write(`  - ${i}\n`));
+  process.exit(1);
+}
+
+process.exit(0);

package/dist/presets/backend/hooks/endpoint-test-coverage.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * Checks that API route files in src/app/api/ or routes/ have corresponding test files.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const ROUTE_DIRS = ['src/app/api', 'src/routes', 'routes'];
+const TEST_DIRS = ['__tests__', 'tests', 'test'];
+const ROUTE_FILES = ['route.ts', 'route.js', 'index.ts', 'index.js'];
+
+const cwd = process.cwd();
+
+function findRoutes(dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        results.push(...findRoutes(full));
+      } else if (ROUTE_FILES.includes(entry.name)) {
+        results.push({ file: full, dir: path.dirname(full) });
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+let routes = [];
+for (const dir of ROUTE_DIRS) {
+  routes.push(...findRoutes(path.resolve(cwd, dir)));
+}
+
+if (routes.length === 0) {
+  process.exit(0);
+}
+
+const missing = [];
+
+for (const route of routes) {
+  const routeDir = route.dir;
+  const routeRel = path.relative(cwd, routeDir);
+  const routeName = path.basename(routeDir);
+
+  // Look for test files in various locations
+  const testPatterns = [
+    path.join(routeDir, `route.test.ts`),
+    path.join(routeDir, `route.test.js`),
+    path.join(routeDir, `${routeName}.test.ts`),
+    path.join(routeDir, `${routeName}.test.js`),
+  ];
+
+  // Also check parent __tests__ directories
+  for (const testDir of TEST_DIRS) {
+    testPatterns.push(path.join(routeDir, '..', testDir, `${routeName}.test.ts`));
+    testPatterns.push(path.join(routeDir, '..', testDir, `${routeName}.test.js`));
+  }
+
+  const hasTest = testPatterns.some((t) => fs.existsSync(t));
+  if (!hasTest) {
+    missing.push(routeRel);
+  }
+}
+
+if (missing.length > 0) {
+  process.stdout.write(`[endpoint-test-coverage] ${missing.length} API route(s) without tests:\n`);
+  missing.slice(0, 10).forEach((m) => process.stdout.write(`  - ${m}\n`));
+  if (missing.length > 10) {
+    process.stdout.write(`  ... and ${missing.length - 10} more\n`);
+  }
+  process.exit(1);
+}
+
+process.exit(0);

package/dist/presets/backend/hooks/migration-safety-check.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+/**
+ * Scans migration files for dangerous operations (DROP TABLE, DROP COLUMN, TRUNCATE)
+ * and warns before execution.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const MIGRATION_DIRS = ['prisma/migrations', 'drizzle', 'migrations', 'db/migrations', 'src/db/migrations'];
+const DANGEROUS_PATTERNS = [
+  { pattern: /DROP\s+TABLE/gi, label: 'DROP TABLE' },
+  { pattern: /DROP\s+COLUMN/gi, label: 'DROP COLUMN' },
+  { pattern: /ALTER\s+TABLE\s+\S+\s+DROP/gi, label: 'ALTER TABLE DROP' },
+  { pattern: /TRUNCATE/gi, label: 'TRUNCATE' },
+  { pattern: /DELETE\s+FROM\s+\S+\s*;/gi, label: 'DELETE without WHERE' },
+];
+const SQL_EXTENSIONS = ['.sql', '.ts', '.js'];
+
+const cwd = process.cwd();
+const warnings = [];
+
+function findMigrationFiles(dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        results.push(...findMigrationFiles(full));
+      } else if (SQL_EXTENSIONS.includes(path.extname(entry.name).toLowerCase())) {
+        results.push(full);
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+let migrationFiles = [];
+for (const dir of MIGRATION_DIRS) {
+  migrationFiles.push(...findMigrationFiles(path.resolve(cwd, dir)));
+}
+
+if (migrationFiles.length === 0) {
+  process.exit(0);
+}
+
+for (const file of migrationFiles) {
+  const content = fs.readFileSync(file, 'utf8');
+  const rel = path.relative(cwd, file);
+
+  for (const { pattern, label } of DANGEROUS_PATTERNS) {
+    const matches = content.match(pattern);
+    if (matches) {
+      warnings.push(`${rel}: Contains ${label} (${matches.length} occurrence(s))`);
+    }
+  }
+}
+
+if (warnings.length > 0) {
+  process.stdout.write('[migration-safety-check] Dangerous operations detected:\n');
+  warnings.forEach((w) => process.stdout.write(`  - ${w}\n`));
+  process.stdout.write('  Review these changes carefully before applying.\n');
+  process.exit(1);
+}
+
+process.exit(0);

package/dist/presets/backend/manifest.json

@@ -523,6 +523,29 @@
       "type": "hook",
       "executable": true
     },
+    {
+      "source": "hooks/api-schema-validate.js",
+      "target": ".kiro/hooks/api-schema-validate.js",
+      "type": "hook",
+      "executable": true
+    },
+    {
+      "source": "hooks/migration-safety-check.js",
+      "target": ".kiro/hooks/migration-safety-check.js",
+      "type": "hook",
+      "executable": true
+    },
+    {
+      "source": "hooks/endpoint-test-coverage.js",
+      "target": ".kiro/hooks/endpoint-test-coverage.js",
+      "type": "hook",
+      "executable": true
+    },
+    {
+      "source": "powers.json",
+      "target": ".kiro/powers.json",
+      "type": "powers"
+    },
     {
       "source": "metadata.json",
       "target": ".kiro/metadata.json",

package/dist/presets/backend/powers.json

@@ -0,0 +1,40 @@
+{
+  "powers": [
+    {
+      "name": "Supabase",
+      "url": "https://kiro.dev/powers/supabase",
+      "description": "Backend-as-a-service with Postgres, auth, and real-time subscriptions",
+      "tier": "essential"
+    },
+    {
+      "name": "Neon",
+      "url": "https://kiro.dev/powers/neon",
+      "description": "Serverless Postgres with branching and autoscaling",
+      "tier": "recommended"
+    },
+    {
+      "name": "Postman",
+      "url": "https://kiro.dev/powers/postman",
+      "description": "API testing and collection management",
+      "tier": "recommended"
+    },
+    {
+      "name": "Context7",
+      "url": "https://kiro.dev/powers/context7",
+      "description": "Up-to-date documentation lookup for libraries and frameworks",
+      "tier": "recommended"
+    },
+    {
+      "name": "Stripe",
+      "url": "https://kiro.dev/powers/stripe",
+      "description": "Payment processing, subscriptions, and billing integration",
+      "tier": "optional"
+    },
+    {
+      "name": "Snyk",
+      "url": "https://kiro.dev/powers/snyk",
+      "description": "Security scanning and vulnerability detection for dependencies",
+      "tier": "optional"
+    }
+  ]
+}

package/dist/presets/data-ai/hooks/data-drift-check.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+/**
+ * Checks for schema changes in data models that could indicate data drift.
+ * Compares current vs baseline schema files.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const SCHEMA_DIRS = ['src/data', 'data/schemas', 'schemas', 'src/models'];
+const BASELINE_DIR = 'data/baseline';
+const SCHEMA_EXTENSIONS = ['.json', '.yaml', '.yml', '.avsc', '.proto'];
+
+const cwd = process.cwd();
+
+function findSchemaFiles(dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        results.push(...findSchemaFiles(full));
+      } else if (entry.isFile()) {
+        const ext = path.extname(entry.name).toLowerCase();
+        if (SCHEMA_EXTENSIONS.includes(ext) && entry.name.includes('schema')) {
+          results.push(full);
+        }
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+let schemaFiles = [];
+for (const dir of SCHEMA_DIRS) {
+  schemaFiles.push(...findSchemaFiles(path.resolve(cwd, dir)));
+}
+
+if (schemaFiles.length === 0) {
+  process.exit(0);
+}
+
+const baselineDir = path.resolve(cwd, BASELINE_DIR);
+if (!fs.existsSync(baselineDir)) {
+  process.stdout.write(
+    '[data-drift-check] No baseline directory found at data/baseline/.\n' +
+    '  Create baseline schemas to enable drift detection.\n'
+  );
+  process.exit(0);
+}
+
+const drifted = [];
+
+for (const schemaFile of schemaFiles) {
+  const name = path.basename(schemaFile);
+  const baselinePath = path.join(baselineDir, name);
+
+  if (!fs.existsSync(baselinePath)) continue;
+
+  const current = fs.readFileSync(schemaFile, 'utf8').trim();
+  const baseline = fs.readFileSync(baselinePath, 'utf8').trim();
+
+  if (current !== baseline) {
+    drifted.push(path.relative(cwd, schemaFile));
+  }
+}
+
+if (drifted.length > 0) {
+  process.stdout.write(`[data-drift-check] ${drifted.length} schema(s) differ from baseline:\n`);
+  drifted.forEach((d) => process.stdout.write(`  - ${d}\n`));
+  process.stdout.write('  Verify changes are intentional and update baseline if so.\n');
+  process.exit(1);
+}
+
+process.exit(0);

package/dist/presets/data-ai/hooks/experiment-log.js

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+/**
+ * Checks that experiment configs have corresponding log entries
+ * in the experiments/ directory.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const CONFIG_DIRS = ['configs', 'config', 'experiments/configs', 'src/configs'];
+const LOG_DIRS = ['experiments', 'experiments/logs', 'logs/experiments', 'mlruns'];
+const CONFIG_EXTENSIONS = ['.yaml', '.yml', '.toml', '.json'];
+
+const cwd = process.cwd();
+
+function findConfigs(dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        results.push(...findConfigs(full));
+      } else if (entry.isFile()) {
+        const ext = path.extname(entry.name).toLowerCase();
+        if (CONFIG_EXTENSIONS.includes(ext) && /experiment|exp|run/i.test(entry.name)) {
+          results.push(full);
+        }
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+let configFiles = [];
+for (const dir of CONFIG_DIRS) {
+  configFiles.push(...findConfigs(path.resolve(cwd, dir)));
+}
+
+if (configFiles.length === 0) {
+  process.exit(0);
+}
+
+// Find log directories
+let logDir = null;
+for (const dir of LOG_DIRS) {
+  const full = path.resolve(cwd, dir);
+  if (fs.existsSync(full)) {
+    logDir = full;
+    break;
+  }
+}
+
+if (!logDir) {
+  process.stdout.write(
+    '[experiment-log] Experiment configs found but no experiments/ log directory.\n' +
+    '  Create an experiments/ directory to track experiment results.\n'
+  );
+  process.exit(1);
+}
+
+// Check each config has a corresponding log entry
+const logEntries = new Set();
+try {
+  const entries = fs.readdirSync(logDir, { withFileTypes: true });
+  for (const entry of entries) {
+    logEntries.add(path.basename(entry.name, path.extname(entry.name)).toLowerCase());
+  }
+} catch (e) { /* skip */ }
+
+const unlogged = [];
+for (const config of configFiles) {
+  const baseName = path.basename(config, path.extname(config)).toLowerCase();
+  if (!logEntries.has(baseName)) {
+    unlogged.push(path.relative(cwd, config));
+  }
+}
+
+if (unlogged.length > 0) {
+  process.stdout.write(`[experiment-log] ${unlogged.length} experiment config(s) without log entries:\n`);
+  unlogged.forEach((u) => process.stdout.write(`  - ${u}\n`));
+  process.stdout.write('  Run experiments and log results before committing configs.\n');
+  process.exit(1);
+}
+
+process.exit(0);

package/dist/presets/data-ai/hooks/model-card-update.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+/**
+ * Reminds to update model card when model files (.pkl, .pt, .h5, saved_model/)
+ * are modified.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const MODEL_DIRS = ['models', 'src/models', 'artifacts', 'saved_models'];
+const MODEL_EXTENSIONS = ['.pkl', '.pt', '.pth', '.h5', '.onnx', '.pb', '.safetensors'];
+const MODEL_CARD_NAMES = ['MODEL_CARD.md', 'model_card.md', 'model-card.md', 'README.md'];
+
+const cwd = process.cwd();
+
+function findModelFiles(dir) {
+  const results = [];
+  if (!fs.existsSync(dir)) return results;
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory() && entry.name !== '__pycache__') {
+        // saved_model/ directories count as model artifacts
+        if (entry.name === 'saved_model' || entry.name === 'checkpoint') {
+          results.push(full);
+        } else {
+          results.push(...findModelFiles(full));
+        }
+      } else if (entry.isFile()) {
+        const ext = path.extname(entry.name).toLowerCase();
+        if (MODEL_EXTENSIONS.includes(ext)) {
+          results.push(full);
+        }
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+let modelFiles = [];
+for (const dir of MODEL_DIRS) {
+  modelFiles.push(...findModelFiles(path.resolve(cwd, dir)));
+}
+
+if (modelFiles.length === 0) {
+  process.exit(0);
+}
+
+// Check if model card exists
+let modelCardPath = null;
+for (const dir of MODEL_DIRS) {
+  for (const name of MODEL_CARD_NAMES) {
+    const full = path.resolve(cwd, dir, name);
+    if (fs.existsSync(full)) {
+      modelCardPath = full;
+      break;
+    }
+  }
+  if (modelCardPath) break;
+}
+
+// Also check project root
+if (!modelCardPath) {
+  for (const name of MODEL_CARD_NAMES.slice(0, -1)) {
+    const full = path.resolve(cwd, name);
+    if (fs.existsSync(full)) {
+      modelCardPath = full;
+      break;
+    }
+  }
+}
+
+if (!modelCardPath) {
+  process.stdout.write(
+    '[model-card-update] Model artifacts found but no model card exists.\n' +
+    '  Create a MODEL_CARD.md documenting model details, metrics, and limitations.\n'
+  );
+  process.exit(1);
+}
+
+// Check if model files are newer than model card
+const cardStat = fs.statSync(modelCardPath);
+const newerModels = modelFiles.filter((f) => {
+  try {
+    const stat = fs.statSync(f);
+    return stat.mtimeMs > cardStat.mtimeMs;
+  } catch (e) { return false; }
+});
+
+if (newerModels.length > 0) {
+  process.stdout.write(
+    `[model-card-update] ${newerModels.length} model file(s) updated after model card.\n` +
+    `  Update ${path.relative(cwd, modelCardPath)} with latest model information.\n`
+  );
+  process.exit(1);
+}
+
+process.exit(0);

package/dist/presets/data-ai/manifest.json

@@ -553,6 +553,29 @@
       "type": "hook",
       "executable": true
     },
+    {
+      "source": "hooks/data-drift-check.js",
+      "target": ".kiro/hooks/data-drift-check.js",
+      "type": "hook",
+      "executable": true
+    },
+    {
+      "source": "hooks/model-card-update.js",
+      "target": ".kiro/hooks/model-card-update.js",
+      "type": "hook",
+      "executable": true
+    },
+    {
+      "source": "hooks/experiment-log.js",
+      "target": ".kiro/hooks/experiment-log.js",
+      "type": "hook",
+      "executable": true
+    },
+    {
+      "source": "powers.json",
+      "target": ".kiro/powers.json",
+      "type": "powers"
+    },
     {
       "source": "metadata.json",
       "target": ".kiro/metadata.json",

package/dist/presets/data-ai/powers.json

@@ -0,0 +1,34 @@
+{
+  "powers": [
+    {
+      "name": "ClickHouse",
+      "url": "https://kiro.dev/powers/click-house",
+      "description": "High-performance analytics database for data pipelines",
+      "tier": "essential"
+    },
+    {
+      "name": "Context7",
+      "url": "https://kiro.dev/powers/context7",
+      "description": "Up-to-date documentation lookup for libraries and frameworks",
+      "tier": "recommended"
+    },
+    {
+      "name": "Exa",
+      "url": "https://kiro.dev/powers/exa",
+      "description": "Web search and research for finding datasets and papers",
+      "tier": "recommended"
+    },
+    {
+      "name": "Neon",
+      "url": "https://kiro.dev/powers/neon",
+      "description": "Serverless Postgres for ML feature stores",
+      "tier": "optional"
+    },
+    {
+      "name": "New Relic",
+      "url": "https://kiro.dev/powers/new-relic",
+      "description": "Observability and performance monitoring for ML services",
+      "tier": "optional"
+    }
+  ]
+}

package/dist/presets/devops/hooks/container-scan.js

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+/**
+ * Checks Dockerfile for security best practices: non-root user,
+ * no latest tag, and multi-stage build usage.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const cwd = process.cwd();
+const DOCKERFILE_NAMES = ['Dockerfile', 'dockerfile', 'Containerfile'];
+
+function findDockerfiles(dir) {
+  const results = [];
+  try {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isFile() && (DOCKERFILE_NAMES.includes(entry.name) || entry.name.startsWith('Dockerfile.'))) {
+        results.push(path.join(dir, entry.name));
+      } else if (entry.isDirectory() && !['node_modules', '.git', '.terraform'].includes(entry.name)) {
+        results.push(...findDockerfiles(path.join(dir, entry.name)));
+      }
+    }
+  } catch (e) { /* skip */ }
+  return results;
+}
+
+const dockerfiles = findDockerfiles(cwd);
+
+if (dockerfiles.length === 0) {
+  process.exit(0);
+}
+
+const issues = [];
+
+for (const df of dockerfiles) {
+  const content = fs.readFileSync(df, 'utf8');
+  const rel = path.relative(cwd, df);
+  const lines = content.split('\n');
+
+  // Check for latest tag
+  const fromLines = lines.filter((l) => /^\s*FROM\s+/i.test(l));
+  for (const line of fromLines) {
+    if (/:latest\b/.test(line) || (/^\s*FROM\s+\S+\s*/i.test(line) && !/:/.test(line) && !/\s+AS\s+/i.test(line.split(/\s+/).slice(2).join(' ')))) {
+      if (!/:/.test(line.split(/\s+/)[1] || '')) {
+        issues.push(`${rel}: FROM without pinned version tag`);
+      }
+    }
+    if (/:latest/.test(line)) {
+      issues.push(`${rel}: Uses :latest tag (pin a specific version)`);
+    }
+  }
+
+  // Check for non-root user
+  const hasUser = /^\s*USER\s+(?!root)/im.test(content);
+  if (!hasUser) {
+    issues.push(`${rel}: No non-root USER directive found`);
+  }
+
+  // Check for multi-stage build
+  if (fromLines.length < 2) {
+    issues.push(`${rel}: Single-stage build (consider multi-stage for smaller images)`);
+  }
+}
+
+if (issues.length > 0) {
+  process.stdout.write('[container-scan] Dockerfile security issues:\n');
+  issues.forEach((i) => process.stdout.write(`  - ${i}\n`));
+  process.exit(1);
+}
+
+process.stdout.write('[container-scan] All Dockerfiles pass security checks.\n');
+process.exit(0);