novahiz 0.1.0

package/skills/env-secrets-manager/scripts/env_auditor.py

@@ -0,0 +1,145 @@
+#!/usr/bin/env python3
+"""Scan env files and source code for likely secret exposure patterns."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+from pathlib import Path
+from typing import Dict, Iterable, List
+
+IGNORED_DIRS = {
+    ".git",
+    "node_modules",
+    ".next",
+    "dist",
+    "build",
+    "coverage",
+    "venv",
+    ".venv",
+    "__pycache__",
+}
+
+SOURCE_EXTS = {
+    ".env",
+    ".py",
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".json",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".ini",
+    ".sh",
+    ".md",
+}
+
+PATTERNS = [
+    ("critical", "openai_key", re.compile(r"\bsk-[A-Za-z0-9]{20,}\b")),
+    ("critical", "github_pat", re.compile(r"\bghp_[A-Za-z0-9]{20,}\b")),
+    ("critical", "aws_access_key_id", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
+    ("high", "slack_token", re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b")),
+    ("high", "private_key_block", re.compile(r"-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----")),
+    ("high", "generic_secret_assignment", re.compile(r"(?i)\b(secret|token|password|passwd|api[_-]?key)\b\s*[:=]\s*['\"]?[A-Za-z0-9_\-\/.+=]{8,}")),
+    ("medium", "jwt_like", re.compile(r"\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b")),
+]
+
+
+def iter_files(root: Path) -> Iterable[Path]:
+    for dirpath, dirnames, filenames in os.walk(root):
+        dirnames[:] = [d for d in dirnames if d not in IGNORED_DIRS]
+        for name in filenames:
+            p = Path(dirpath) / name
+            if p.is_file():
+                yield p
+
+
+def is_candidate(path: Path) -> bool:
+    if path.name.startswith(".env"):
+        return True
+    return path.suffix.lower() in SOURCE_EXTS
+
+
+def scan_file(path: Path, max_bytes: int, root: Path) -> List[Dict[str, object]]:
+    findings: List[Dict[str, object]] = []
+    try:
+        if path.stat().st_size > max_bytes:
+            return findings
+        text = path.read_text(encoding="utf-8", errors="ignore")
+    except Exception:
+        return findings
+
+    for lineno, line in enumerate(text.splitlines(), start=1):
+        for severity, kind, pattern in PATTERNS:
+            if pattern.search(line):
+                findings.append(
+                    {
+                        "severity": severity,
+                        "pattern": kind,
+                        "file": str(path.relative_to(root)),
+                        "line": lineno,
+                        "snippet": line.strip()[:180],
+                    }
+                )
+    return findings
+
+
+def severity_counts(findings: List[Dict[str, object]]) -> Dict[str, int]:
+    counts = {"critical": 0, "high": 0, "medium": 0, "low": 0}
+    for item in findings:
+        sev = str(item.get("severity", "low"))
+        counts[sev] = counts.get(sev, 0) + 1
+    return counts
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="Audit a repository for likely secret leaks in env files and source.")
+    parser.add_argument("path", help="Path to repository root")
+    parser.add_argument("--max-file-size-kb", type=int, default=512, help="Skip files larger than this size (default: 512)")
+    parser.add_argument("--json", action="store_true", help="Output JSON")
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    root = Path(args.path).expanduser().resolve()
+    if not root.exists() or not root.is_dir():
+        raise SystemExit(f"Path is not a directory: {root}")
+
+    max_bytes = max(1, args.max_file_size_kb) * 1024
+    findings: List[Dict[str, object]] = []
+
+    for file_path in iter_files(root):
+        if is_candidate(file_path):
+            findings.extend(scan_file(file_path, max_bytes=max_bytes, root=root))
+
+    report = {
+        "root": str(root),
+        "total_findings": len(findings),
+        "severity_counts": severity_counts(findings),
+        "findings": findings,
+    }
+
+    if args.json:
+        print(json.dumps(report, indent=2))
+    else:
+        print("Env/Secrets Audit Report")
+        print(f"Root: {report['root']}")
+        print(f"Total findings: {report['total_findings']}")
+        print("Severity:")
+        for sev, count in report["severity_counts"].items():
+            print(f"- {sev}: {count}")
+        print("")
+        for item in findings[:200]:
+            print(f"[{item['severity'].upper()}] {item['file']}:{item['line']} ({item['pattern']})")
+            print(f"  {item['snippet']}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/skills/fix/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: "fix"
+description: >-
+  Fix failing or flaky Playwright tests. Use when user says "fix test",
+  "flaky test", "test failing", "debug test", "test broken", "test passes
+  sometimes", or "intermittent failure".
+---
+
+# Fix Failing or Flaky Tests
+
+Diagnose and fix a Playwright test that fails or passes intermittently using a systematic taxonomy.
+
+## Input
+
+`$ARGUMENTS` contains:
+- A test file path: `e2e/login.spec.ts`
+- A test name: ""should redirect after login"`
+- A description: `"the checkout test fails in CI but passes locally"`
+
+## Steps
+
+### 1. Reproduce the Failure
+
+Run the test to capture the error:
+
+```bash
+npx playwright test <file> --reporter=list
+```
+
+If the test passes, it's likely flaky. Run burn-in:
+
+```bash
+npx playwright test <file> --repeat-each=10 --reporter=list
+```
+
+If it still passes, try with parallel workers:
+
+```bash
+npx playwright test --fully-parallel --workers=4 --repeat-each=5
+```
+
+### 2. Capture Trace
+
+Run with full tracing:
+
+```bash
+npx playwright test <file> --trace=on --retries=0
+```
+
+Read the trace output. Use `/debug` to analyze trace files if available.
+
+### 3. Categorize the Failure
+
+Load `flaky-taxonomy.md` from this skill directory.
+
+Every failing test falls into one of four categories:
+
+| Category | Symptom | Diagnosis |
+|---|---|---|
+| **Timing/Async** | Fails intermittently everywhere | `--repeat-each=20` reproduces locally |
+| **Test Isolation** | Fails in suite, passes alone | `--workers=1 --grep "test name"` passes |
+| **Environment** | Fails in CI, passes locally | Compare CI vs local screenshots/traces |
+| **Infrastructure** | Random, no pattern | Error references browser internals |
+
+### 4. Apply Targeted Fix
+
+**Timing/Async:**
+- Replace `waitForTimeout()` with web-first assertions
+- Add `await` to missing Playwright calls
+- Wait for specific network responses before asserting
+- Use `toBeVisible()` before interacting with elements
+
+**Test Isolation:**
+- Remove shared mutable state between tests
+- Create test data per-test via API or fixtures
+- Use unique identifiers (timestamps, random strings) for test data
+- Check for database state leaks
+
+**Environment:**
+- Match viewport sizes between local and CI
+- Account for font rendering differences in screenshots
+- Use `docker` locally to match CI environment
+- Check for timezone-dependent assertions
+
+**Infrastructure:**
+- Increase timeout for slow CI runners
+- Add retries in CI config (`retries: 2`)
+- Check for browser OOM (reduce parallel workers)
+- Ensure browser dependencies are installed
+
+### 5. Verify the Fix
+
+Run the test 10 times to confirm stability:
+
+```bash
+npx playwright test <file> --repeat-each=10 --reporter=list
+```
+
+All 10 must pass. If any fail, go back to step 3.
+
+### 6. Prevent Recurrence
+
+Suggest:
+- Add to CI with `retries: 2` if not already
+- Enable `trace: 'on-first-retry'` in config
+- Add the fix pattern to project's test conventions doc
+
+## Output
+
+- Root cause category and specific issue
+- The fix applied (with diff)
+- Verification result (10/10 passes)
+- Prevention recommendation

package/skills/fix/flaky-taxonomy.md

@@ -0,0 +1,134 @@
+# Flaky Test Taxonomy
+
+## Decision Tree
+
+```
+Test is flaky
+│
+├── Fails locally with --repeat-each=20?
+│   ├── YES → TIMING / ASYNC
+│   │   ├── Missing await? → Add await
+│   │   ├── waitForTimeout? → Replace with assertion
+│   │   ├── Race condition? → Wait for specific event
+│   │   └── Animation? → Wait for animation end or disable
+│   │
+│   └── NO → Continue...
+│
+├── Passes alone, fails in suite?
+│   ├── YES → TEST ISOLATION
+│   │   ├── Shared variable? → Make per-test
+│   │   ├── Database state? → Reset per-test
+│   │   ├── localStorage? → Clear in beforeEach
+│   │   └── Cookie leak? → Use isolated contexts
+│   │
+│   └── NO → Continue...
+│
+├── Fails in CI, passes locally?
+│   ├── YES → ENVIRONMENT
+│   │   ├── Viewport? → Set explicit size
+│   │   ├── Fonts? → Use Docker locally
+│   │   ├── Timezone? → Use UTC everywhere
+│   │   └── Network? → Mock external services
+│   │
+│   └── NO → INFRASTRUCTURE
+│       ├── Browser crash? → Reduce workers
+│       ├── OOM? → Limit parallel tests
+│       ├── DNS? → Add retry config
+│       └── File system? → Use unique temp dirs
+```
+
+## Common Fixes by Category
+
+### Timing / Async
+
+**Missing await:**
+```typescript
+// BAD — race condition
+page.goto('/dashboard');
+expect(page.getByText('Welcome')).toBeVisible();
+
+// GOOD
+await page.goto('/dashboard');
+await expect(page.getByText('Welcome')).toBeVisible();
+```
+
+**Clicking before visible:**
+```typescript
+// BAD — element may not be ready
+await page.getByRole('button', { name: 'Submit' }).click();
+
+// GOOD — ensure visible first
+const submitBtn = page.getByRole('button', { name: 'Submit' });
+await expect(submitBtn).toBeVisible();
+await submitBtn.click();
+```
+
+**Race with network:**
+```typescript
+// BAD — data might not be loaded
+await page.goto('/users');
+await expect(page.getByRole('table')).toBeVisible();
+
+// GOOD — wait for API response
+const responsePromise = page.waitForResponse('**/api/users');
+await page.goto('/users');
+await responsePromise;
+await expect(page.getByRole('table')).toBeVisible();
+```
+
+### Test Isolation
+
+**Shared state fix:**
+```typescript
+// BAD — tests share userId
+let userId: string;
+test('create', async () => { userId = '123'; });
+test('read', async () => { /* uses userId */ });
+
+// GOOD — each test is independent
+test('read user', async ({ request }) => {
+  const response = await request.post('/api/users', { data: { name: 'Test' } });
+  const { id } = await response.json();
+  // Use id within this test
+});
+```
+
+**localStorage cleanup:**
+```typescript
+test.beforeEach(async ({ page }) => {
+  await page.goto('/');
+  await page.evaluate(() => localStorage.clear());
+});
+```
+
+### Environment
+
+**Explicit viewport:**
+```typescript
+test.use({ viewport: { width: 1280, height: 720 } });
+```
+
+**Timezone-safe dates:**
+```typescript
+// BAD
+expect(dateText).toBe('March 5, 2026');
+
+// GOOD — timezone independent
+expect(dateText).toMatch(/\d{1,2}\/\d{1,2}\/\d{4}/);
+```
+
+### Infrastructure
+
+**Retry config:**
+```typescript
+// playwright.config.ts
+export default defineConfig({
+  retries: process.env.CI ? 2 : 0,
+  workers: process.env.CI ? 2 : undefined,
+});
+```
+
+**Increase timeout for CI:**
+```typescript
+test.setTimeout(60_000); // 60s for slow CI
+```

package/skills/gate/SKILL.md

@@ -0,0 +1,13 @@
+---
+name: gate
+description: The guardian of the Novahiz system
+---
+
+# Novahiz Gate Skill
+
+This skill is MANDATORY before and after task execution.
+
+1. Call the MCP tool `novahiz_gate`.
+2. If the gate fails (FAIL), resolve the displayed rule violations.
+3. Never proceed with code modifications until the gate passes.
+4. Once validated, execute the plan or move to post-task.