neotoma 0.3.0 → 0.3.2

package/foundation/scripts/report_error_create_dirs.sh

@@ -1,14 +0,0 @@
-#!/bin/bash
-# create_error_report_dirs.sh
-# Usage: create_error_report_dirs.sh <target-repo-path>
-
-TARGET_REPO="$1"
-ERROR_REPORTS_DIR="$TARGET_REPO/.cursor/error_reports"
-PENDING_DIR="$ERROR_REPORTS_DIR/pending"
-RESOLVED_DIR="$ERROR_REPORTS_DIR/resolved"
-
-mkdir -p "$PENDING_DIR" "$RESOLVED_DIR"
-echo "✅ Created error report directories in $TARGET_REPO"
-
-
-

package/foundation/scripts/report_error_generate_id.sh

@@ -1,10 +0,0 @@
-#!/bin/bash
-# generate_error_id.sh
-# Outputs: ERROR_ID|TIMESTAMP
-
-TIMESTAMP=$(date -u +"%Y%m%dT%H%M%S")
-ERROR_ID="01JQ$(echo $TIMESTAMP | tr -d 'T' | cut -c1-20)"
-echo "${ERROR_ID}|${TIMESTAMP}"
-
-
-

package/foundation/scripts/report_error_update_queue.sh

@@ -1,24 +0,0 @@
-#!/bin/bash
-# update_pending_queue.sh
-# Usage: update_pending_queue.sh <target-repo-path> <error-id> <timestamp> <category> <severity> <json-path>
-
-TARGET_REPO="$1"
-ERROR_ID="$2"
-TIMESTAMP="$3"
-CATEGORY="$4"
-SEVERITY="$5"
-JSON_PATH="$6"
-
-PENDING_FILE="$TARGET_REPO/.cursor/error_reports/pending.json"
-NEW_ENTRY="{\"error_id\": \"$ERROR_ID\", \"timestamp\": \"$(echo $TIMESTAMP | sed 's/\(....\)\(..\)\(..\)T\(..\)\(..\)\(..\)/\1-\2-\3T\4:\5:\6Z/')\", \"category\": \"$CATEGORY\", \"severity\": \"$SEVERITY\", \"file_path\": \"$JSON_PATH\"}"
-
-if [ -f "$PENDING_FILE" ]; then
-  cat "$PENDING_FILE" | jq ". + [$NEW_ENTRY]" > "$PENDING_FILE.tmp" && mv "$PENDING_FILE.tmp" "$PENDING_FILE"
-else
-  echo "[$NEW_ENTRY]" > "$PENDING_FILE"
-fi
-
-echo "✅ Pending queue updated"
-
-
-

package/foundation/scripts/report_error_validate_target.sh

@@ -1,34 +0,0 @@
-#!/bin/bash
-# validate_target_repo.sh
-# Usage: validate_target_repo.sh <target-repo-path>
-
-TARGET_REPO="$1"
-
-if [ -z "$TARGET_REPO" ]; then
-  echo "❌ Error: Target repository path required"
-  exit 1
-fi
-
-# Check if path exists
-if [ ! -d "$TARGET_REPO" ]; then
-  echo "❌ Error: Target repository not found: $TARGET_REPO"
-  exit 1
-fi
-
-# Check if it's a git repository
-if [ ! -d "$TARGET_REPO/.git" ]; then
-  echo "❌ Error: Target path is not a git repository: $TARGET_REPO"
-  exit 1
-fi
-
-# Check write permissions
-if [ ! -w "$TARGET_REPO" ]; then
-  echo "❌ Error: No write permission for target repository: $TARGET_REPO"
-  exit 1
-fi
-
-echo "✅ Target repository validated: $TARGET_REPO"
-exit 0
-
-
-

package/foundation/scripts/report_error_wait_resolution.sh

@@ -1,69 +0,0 @@
-#!/bin/bash
-# wait_for_resolution.sh
-# Usage: wait_for_resolution.sh <target-repo-path> <base-filename> [timeout] [poll-interval]
-
-TARGET_REPO="$1"
-BASE_FILENAME="$2"
-TIMEOUT="${3:-300}"
-POLL_INTERVAL="${4:-5}"
-
-ERROR_REPORTS_DIR="$TARGET_REPO/.cursor/error_reports"
-PENDING_DIR="$ERROR_REPORTS_DIR/pending"
-RESOLVED_DIR="$ERROR_REPORTS_DIR/resolved"
-
-START_TIME=$(date +%s)
-
-while true; do
-  CURRENT_TIME=$(date +%s)
-  ELAPSED=$((CURRENT_TIME - START_TIME))
-  
-  # Check timeout
-  if [ $ELAPSED -ge $TIMEOUT ]; then
-    echo "⏱️  Timeout reached (${TIMEOUT}s) while waiting for resolution"
-    # Check final status in either directory
-    if [ -f "$RESOLVED_DIR/$BASE_FILENAME" ]; then
-      STATUS=$(cat "$RESOLVED_DIR/$BASE_FILENAME" | jq -r '.resolution_status' || echo "unknown")
-    elif [ -f "$PENDING_DIR/$BASE_FILENAME" ]; then
-      STATUS=$(cat "$PENDING_DIR/$BASE_FILENAME" | jq -r '.resolution_status' || echo "unknown")
-    else
-      STATUS="unknown"
-    fi
-    echo "Final status: $STATUS"
-    exit 0
-  fi
-  
-  # Check both pending/ and resolved/ directories
-  REPORT_PATH=""
-  if [ -f "$PENDING_DIR/$BASE_FILENAME" ]; then
-    REPORT_PATH="$PENDING_DIR/$BASE_FILENAME"
-  elif [ -f "$RESOLVED_DIR/$BASE_FILENAME" ]; then
-    REPORT_PATH="$RESOLVED_DIR/$BASE_FILENAME"
-  else
-    echo "⚠️  Error report file not found in pending/ or resolved/: $BASE_FILENAME"
-    exit 1
-  fi
-  
-  # Read status
-  STATUS=$(cat "$REPORT_PATH" | jq -r '.resolution_status' 2>/dev/null || echo "pending")
-  ERROR_ID=$(cat "$REPORT_PATH" | jq -r '.error_id' 2>/dev/null || echo "unknown")
-  echo "[WAIT] Error $ERROR_ID status: $STATUS (elapsed: ${ELAPSED}s)"
-  
-  # Check if resolved or failed
-  if [ "$STATUS" = "resolved" ]; then
-    echo "✅ Error resolved!"
-    cat "$REPORT_PATH" | jq -r '.resolution_notes // "No resolution notes provided."'
-    exit 0
-  fi
-  
-  if [ "$STATUS" = "failed" ]; then
-    echo "❌ Error resolution failed"
-    cat "$REPORT_PATH" | jq -r '.resolution_notes // "No failure reason provided."'
-    exit 1
-  fi
-  
-  # Still pending or in_progress, wait and check again
-  sleep $POLL_INTERVAL
-done
-
-
-

package/foundation/scripts/validate_setup.sh

@@ -1,147 +0,0 @@
-#!/bin/bash
-# Foundation Setup Validation Script
-# Verifies foundation is properly installed and configured
-
-set -e
-
-# Colors
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-RED='\033[0;31m'
-NC='\033[0m'
-
-ERRORS=0
-WARNINGS=0
-
-print_success() {
-    echo -e "${GREEN}✅${NC} $1"
-}
-
-print_warning() {
-    echo -e "${YELLOW}⚠️ ${NC} $1"
-    ((WARNINGS++))
-}
-
-print_failure() {
-    echo -e "${RED}❌${NC} $1"
-    ((ERRORS++))
-}
-
-print_info() {
-    echo -e "${GREEN}[INFO]${NC} $1"
-}
-
-print_info "Validating foundation setup..."
-echo ""
-
-# Check 1: Foundation directory exists
-if [ -d "foundation" ]; then
-    print_success "Foundation directory exists"
-else
-    print_failure "Foundation directory not found"
-fi
-
-# Check 2: Foundation config exists
-if [ -f "foundation_config.yaml" ]; then
-    print_success "Foundation config file exists"
-    
-    # Check if config is still template
-    if grep -q "your-project" foundation_config.yaml; then
-        print_warning "Config appears to be template (contains 'your-project')"
-        print_info "   Please customize foundation_config.yaml for your repository"
-    fi
-else
-    print_failure "Foundation config file not found (foundation_config.yaml)"
-fi
-
-# Check 3: Check if foundation is a submodule
-if [ -f "foundation/.git" ] && [ ! -d "foundation/.git" ]; then
-    print_success "Foundation installed as git submodule"
-elif [ -d "foundation/.git" ]; then
-    print_warning "Foundation appears to be a full git repository (not a submodule)"
-    print_info "   Consider using git submodule for easier updates"
-elif [ -L "foundation" ]; then
-    print_success "Foundation installed as symlink"
-else
-    print_warning "Foundation installation method unclear"
-fi
-
-# Check 4: Key foundation files exist
-KEY_FILES=(
-    "foundation/README.md"
-    "foundation/conventions/code-conventions.md"
-    "foundation/conventions/documentation-standards.md"
-    "foundation/development/workflow.md"
-    "foundation/config/foundation_config.yaml"
-)
-
-MISSING_FILES=0
-for file in "${KEY_FILES[@]}"; do
-    if [ ! -f "$file" ]; then
-        ((MISSING_FILES++))
-    fi
-done
-
-if [ $MISSING_FILES -eq 0 ]; then
-    print_success "All key foundation files present"
-else
-    print_failure "$MISSING_FILES key foundation files missing"
-fi
-
-# Check 5: Git configuration
-if git rev-parse --is-inside-work-tree > /dev/null 2>&1; then
-    print_success "Repository is a git repository"
-else
-    print_failure "Not in a git repository"
-fi
-
-# Check 6: .gitignore configuration
-if [ -f ".gitignore" ]; then
-    if grep -q "foundation_config.local.yaml" .gitignore; then
-        print_success ".gitignore includes foundation_config.local.yaml"
-    else
-        print_warning ".gitignore should include foundation_config.local.yaml"
-    fi
-    
-    if grep -q "\.env" .gitignore; then
-        print_success ".gitignore includes .env files"
-    else
-        print_warning ".gitignore should include .env* files"
-    fi
-fi
-
-# Check 7: Security setup
-if [ -f "foundation/security/pre-commit-audit.sh" ]; then
-    if [ -x "foundation/security/pre-commit-audit.sh" ]; then
-        print_success "Pre-commit audit script is executable"
-    else
-        print_warning "Pre-commit audit script exists but is not executable"
-        print_info "   Run: chmod +x foundation/security/pre-commit-audit.sh"
-    fi
-fi
-
-# Summary
-echo ""
-echo "Validation complete:"
-if [ $ERRORS -eq 0 ] && [ $WARNINGS -eq 0 ]; then
-    print_success "All checks passed!"
-elif [ $ERRORS -eq 0 ]; then
-    print_warning "$WARNINGS warning(s) found"
-    print_info "Setup is functional but could be improved"
-else
-    print_failure "$ERRORS error(s) and $WARNINGS warning(s) found"
-    print_info "Please address errors before using foundation"
-    exit 1
-fi
-
-exit 0
-
-
-
-
-
-
-
-
-
-

package/foundation/security/credential_management.md

@@ -1,263 +0,0 @@
-# Credential Management
-
-## Purpose
-
-Define secure practices for storing, accessing, and managing credentials and sensitive data.
-
-## Principles
-
-1. **Never commit credentials to version control**
-2. **Use environment-specific variables** (DEV_*, PROD_*)
-3. **Store secrets securely** (encrypted at rest, access controlled)
-4. **Rotate credentials regularly** (monthly or after exposure)
-5. **Use least privilege** (minimum required access)
-
-## Environment Variable Management
-
-### Standard Approach
-
-Use `.env` files for local development (NEVER commit):
-
-```bash
-# .env (add to .gitignore)
-DATABASE_URL=postgres://localhost:5432/mydb
-API_KEY=your_api_key_here
-SECRET_KEY=your_secret_key_here
-```
-
-Add to `.gitignore`:
-
-```
-.env
-.env.*
-!.env.example
-```
-
-Provide `.env.example` template:
-
-```bash
-# .env.example (safe to commit)
-DATABASE_URL=postgres://localhost:5432/database_name
-API_KEY=your_api_key_here
-SECRET_KEY=your_secret_key_here
-```
-
-### Environment Separation (Optional)
-
-For projects requiring strict dev/prod separation:
-
-```bash
-# .env
-# Use prefixed variables to prevent dev/prod mixups
-
-# Development
-DEV_DATABASE_URL=postgres://localhost:5432/mydb_dev
-DEV_API_KEY=dev_api_key_here
-
-# Production (typically set in deployment environment)
-# PROD_DATABASE_URL=postgres://prod-host:5432/mydb_prod
-# PROD_API_KEY=prod_api_key_here
-```
-
-Configuration in `foundation-config.yaml`:
-
-```yaml
-security:
-  credential_management:
-    enabled: true
-    require_env_separation: true  # Require DEV_*/PROD_* prefixes
-```
-
-## Secrets Manager (Optional)
-
-For enhanced security, use encrypted secrets storage.
-
-### Setup
-
-1. **Initialize secrets storage:**
-
-```bash
-node scripts/secrets-manager.js init
-```
-
-Creates:
-
-- `.secrets/.key` - Encryption key (DO NOT COMMIT)
-- `.secrets/secrets.enc` - Encrypted secrets file (DO NOT COMMIT)
-
-2. **Store secrets:**
-
-```bash
-node scripts/secrets-manager.js set API_KEY "your-api-key"
-node scripts/secrets-manager.js set DATABASE_URL "postgres://..."
-```
-
-3. **Retrieve secrets:**
-
-```bash
-# Get a single secret
-node scripts/secrets-manager.js get API_KEY
-
-# List all stored keys
-node scripts/secrets-manager.js list
-
-# Export all secrets as environment variables
-eval $(node scripts/secrets-manager.js export)
-```
-
-### Key Management
-
-**Local Development:**
-
-- Encryption key stored in `.secrets/.key`
-- Keep secure (chmod 600)
-- Never commit to git
-
-**CI/CD / Production:**
-
-- Set `SECRETS_MASTER_KEY` environment variable
-- Value should be the hex-encoded encryption key
-- Store securely in CI/CD system's secrets manager
-
-**Key Rotation:**
-
-1. Export all secrets: `node scripts/secrets-manager.js export > backup.txt`
-2. Delete `.secrets/` directory
-3. Re-run setup to generate new key
-4. Re-import secrets from backup
-5. Update `SECRETS_MASTER_KEY` in CI/CD
-
-## Best Practices
-
-### 1. Development Credentials
-
-- **Use dedicated test credentials** - Never use production credentials
-- **Rotate regularly** - Monthly rotation recommended for sensitive services
-- **Limit access** - Only give access to authorized developers
-- **Monitor usage** - Check service dashboards for unusual activity
-
-### 2. Production Credentials
-
-- **Use CI/CD secrets management** - GitHub Secrets, GitLab CI/CD variables, etc.
-- **Never log credentials** - Sanitize logs to prevent credential exposure
-- **Use short-lived tokens** - Where possible, use tokens that expire
-- **Implement RBAC** - Role-based access control for team access
-
-### 3. Credential Exposure Response
-
-If credentials are accidentally exposed:
-
-1. **Rotate immediately** - Generate new credentials
-2. **Revoke old credentials** - Invalidate exposed credentials
-3. **Audit access logs** - Check for unauthorized access
-4. **Update all consumers** - Update services using the credentials
-5. **Document incident** - Record exposure and response for future reference
-
-## Configuration
-
-Configure credential management in `foundation-config.yaml`:
-
-```yaml
-security:
-  credential_management:
-    enabled: true
-    require_env_separation: false  # whether to require DEV_*/PROD_* prefixes
-    secrets_manager:
-      enabled: false
-      storage_path: ".secrets/secrets.enc"
-      key_path: ".secrets/.key"
-      algorithm: "aes-256-gcm"
-      master_key_env: "SECRETS_MASTER_KEY"
-
-tooling:
-  env_management:
-    enabled: true
-    env_file_priority:
-      - ".env.dev"
-      - ".env"
-      - ".env.development"
-    environment_separation:
-      enabled: false
-      dev_prefix: "DEV_"
-      prod_prefix: "PROD_"
-      require_explicit_env: false  # whether to prevent generic variables
-```
-
-## Common Patterns to Avoid
-
-❌ **Don't:**
-
-- Commit `.env` files to git
-- Hard-code credentials in source code
-- Use same credentials for dev and prod
-- Share credentials via email or chat
-- Store credentials in plain text files
-- Use weak or default passwords
-
-✅ **Do:**
-
-- Use `.env` files locally (gitignored)
-- Use environment variables or secrets manager
-- Use separate credentials for each environment
-- Share credentials via secure secrets management
-- Encrypt credentials at rest
-- Use strong, unique passwords/keys
-
-## Integration with CI/CD
-
-### GitHub Actions
-
-```yaml
-# .github/workflows/deploy.yml
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Deploy
-        env:
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          API_KEY: ${{ secrets.API_KEY }}
-        run: |
-          npm run deploy
-```
-
-### GitLab CI
-
-```yaml
-# .gitlab-ci.yml
-deploy:
-  script:
-    - npm run deploy
-  variables:
-    DATABASE_URL: $CI_DATABASE_URL
-    API_KEY: $CI_API_KEY
-```
-
-### Other CI/CD
-
-Consult your CI/CD platform's documentation for secrets management.
-
-## Compliance
-
-Ensure credential management practices comply with:
-
-- GDPR (for EU user data)
-- SOC 2 (for enterprise customers)
-- PCI DSS (for payment processing)
-- Industry-specific regulations
-
-## References
-
-- [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)
-- [12-Factor App: Config](https://12factor.net/config)
-
-
-
-
-
-
-
-
-
-

package/foundation/security/pre_commit_audit.sh

@@ -1,78 +0,0 @@
-#!/bin/bash
-# Pre-Commit Security Audit Script
-# Configurable security checks before committing changes
-
-set -e
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-# Configuration (override with environment variables or config file)
-PROTECTED_PATHS="${PROTECTED_PATHS:-docs/private/|data/}"
-PROTECTED_PATTERNS="${PROTECTED_PATTERNS:-\.env|secrets|credentials}"
-
-echo -e "${GREEN}🔒 Running pre-commit security audit...${NC}"
-
-# Check 1: Protected directories
-# Only check for additions/modifications, not deletions (deletions are allowed for cleanup)
-echo "Checking protected directories..."
-if git status --porcelain | grep -E "^[AM]|^\?\?" | grep -qE "$PROTECTED_PATHS"; then
-    echo -e "${RED}❌ SECURITY VIOLATION: Files in protected directories detected!${NC}"
-    echo "Files:"
-    git status --porcelain | grep -E "^[AM]|^\?\?" | grep -E "$PROTECTED_PATHS"
-    exit 1
-fi
-
-# Check staged files - only additions/modifications, not deletions
-if git diff --cached --name-status 2>/dev/null | grep -E "^[AM]" | cut -f2 | grep -qE "$PROTECTED_PATHS"; then
-    echo -e "${RED}❌ SECURITY VIOLATION: Protected files already staged!${NC}"
-    echo "Files:"
-    git diff --cached --name-status | grep -E "^[AM]" | cut -f2 | grep -E "$PROTECTED_PATHS"
-    exit 1
-fi
-
-# Check 2: Protected file patterns (e.g., .env files)
-# Exclude markdown files (.md) from filename pattern checks as they're typically documentation
-echo "Checking for protected file patterns..."
-if git status --porcelain | grep -vE "\.md$" | grep -qE "$PROTECTED_PATTERNS"; then
-    echo -e "${RED}❌ SECURITY VIOLATION: Protected file patterns detected!${NC}"
-    git status --porcelain | grep -vE "\.md$" | grep -E "$PROTECTED_PATTERNS"
-    exit 1
-fi
-
-if git diff --cached --name-only 2>/dev/null | grep -vE "\.md$" | grep -qE "$PROTECTED_PATTERNS"; then
-    echo -e "${RED}❌ SECURITY VIOLATION: Protected file patterns already staged!${NC}"
-    git diff --cached --name-only | grep -vE "\.md$" | grep -E "$PROTECTED_PATTERNS"
-    exit 1
-fi
-
-# Check 3: Hardcoded credentials (basic check)
-echo "Scanning for potential hardcoded credentials..."
-STAGED_FILES=$(git diff --cached --name-only 2>/dev/null || echo "")
-if [ -n "$STAGED_FILES" ]; then
-    for file in $STAGED_FILES; do
-        if [ -f "$file" ] && file "$file" | grep -q "text"; then
-            if grep -qE "(api[_-]?key|password|secret|token)\s*[:=]\s*['\"][^'\"]{10,}" "$file" 2>/dev/null; then
-                echo -e "${YELLOW}⚠️  WARNING: Potential hardcoded credentials detected in: $file${NC}"
-                echo "Please review this file before committing."
-                # Don't exit, just warn (can be configured to exit 1)
-            fi
-        fi
-    done
-fi
-
-echo -e "${GREEN}✅ Security audit passed${NC}"
-exit 0
-
-
-
-
-
-
-
-
-
-