oc-pilot 0.5.1 → 0.88.1

package/skills/secure-diff-gate/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: secure-diff-gate
+description: Use before a security-sensitive commit or pull request. Scans the diff for leaked secrets, reviews it against a security rule preset, flags prompt-injection payloads and risky dependency changes, and produces SARIF for code scanning.
+---
+
+# Secure diff gate
+
+A review that only reads logic misses the four things that actually ship
+incidents: committed credentials, injection sinks, agent-targeted instructions
+hidden in the diff, and a dependency that is not what its name claims. This
+skill checks all four before the change leaves the machine.
+
+## Setup
+
+```bash
+npm i -g https://github.com/MyNameIsNikki/oc-pilot/archive/refs/tags/v0.88.1.tar.gz
+oc-pilot init --preset security,devops
+```
+
+`--preset` accepts several rules packs (comma-separated) and writes
+`.oc-pilot/rules.md`, which is sent with every request. Add your stack too, for
+example `security,node` or `security,python,devops`.
+
+## Workflow
+
+1. **Secrets, offline.**
+
+   ```bash
+   oc-pilot scan --staged --json
+   ```
+
+   Catches provider keys, private-key blocks, and high-entropy assignments.
+   Exit `3` blocks. If a value is genuinely public, mark the line with
+   `oc-pilot:ignore-secret` or add a path glob to `.oc-pilot/ignore` — never
+   lower the threshold globally.
+
+2. **Security review with a second opinion.**
+
+   ```bash
+   oc-pilot review --staged \
+     --fail-on critical --fail-on-secrets \
+     --second-opinion --second-opinion-model <cheap-model>
+   ```
+
+   Critical findings are re-checked by a second model. A rejected finding is
+   downgraded and annotated instead of silently disappearing, so the report
+   still shows what was considered. Requires `--engine openai` for the
+   verifier.
+
+3. **Read the local signals.** `review` also inspects the diff without a model
+   call and prints, when relevant:
+
+   - `DEPENDENCY_CHANGES` — new or changed packages with typosquat matches,
+     unpinned specs, `git+`/URL references, and manifest/lockfile drift.
+   - `PROMPT_INJECTION_RISKS` — added lines that read like instructions to an
+     AI ("ignore previous instructions", role hijacks, long base64 blobs,
+     invisible Unicode).
+   - `TEST_COVERAGE_HINT` — logic changed without a matching test change.
+
+   Treat `DEPENDENCY_CHANGES` and `PROMPT_INJECTION_RISKS` as review
+   requirements, not as noise to acknowledge and forget.
+
+4. **Publish to code scanning.**
+
+   ```bash
+   oc-pilot review --base origin/main --format sarif -o oc-pilot.sarif
+   ```
+
+   Upload with `github/codeql-action/upload-sarif@v3`. Rule ids are stable:
+   `oc-pilot/secret`, `oc-pilot/critical`, `oc-pilot/warning`. Previews are
+   redacted, so SARIF never contains the secret value.
+
+5. **Make it non-optional.**
+
+   ```bash
+   oc-pilot install-hook --pre-push
+   ```
+
+   Installs `pre-commit` (`preflight --staged`; pass `--scan` for
+   `scan --staged` only) and `pre-push` (`review`) hooks,
+   backing up any existing hook. Bypass for a single command with
+   `OC_PILOT_SKIP=1`; uninstall with `oc-pilot install-hook --uninstall`.
+
+## Accepted risks
+
+```bash
+oc-pilot review --staged --interactive   # per finding: hide in baseline
+oc-pilot review --staged --baseline      # only new findings fail the gate
+```
+
+The baseline fingerprints `severity | file | normalized text`, so a moved line
+does not resurrect an accepted finding. A changed finding does. Review the
+baseline file like code; do not add to it to make a build green.
+
+## Guardrails
+
+- Never commit a real secret to test the scanner.
+- Never disable the secret scan for a whole run.
+- Review dependency additions by hand even when the gate is green; the gate
+  knows typosquats, not malicious packages that are correctly named.
+- Report which controls ran, their exit codes, and every accepted risk.

package/skills/stack-review-packs/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: stack-review-packs
+description: Use when setting up review rules for a new repository or a new stack. Installs a curated rules pack for one of 23 languages and frameworks, combines packs, and wires the same rules into the CLI, MCP server, and CI.
+---
+
+# Stack review packs
+
+A generic reviewer says "consider error handling". A reviewer that knows the
+stack says "this `async` handler returns a floating promise, and the Express 4
+router will not catch it". Rules packs are how the second reviewer happens.
+
+## Setup
+
+```bash
+npm i -g https://github.com/MyNameIsNikki/oc-pilot/archive/refs/tags/v0.88.1.tar.gz
+```
+
+## Available packs
+
+| Area | Ids |
+| --- | --- |
+| General | `base`, `typescript`, `security`, `devops` |
+| JavaScript | `node`, `react`, `next`, `vue`, `svelte`, `angular` |
+| Backend | `python`, `go`, `rust`, `java`, `kotlin`, `csharp`, `php`, `ruby` |
+| Mobile | `swift`, `flutter` |
+| Other | `elixir`, `zig`, `scala` |
+
+## Install
+
+```bash
+oc-pilot init --preset react,typescript,security
+oc-pilot init --preset python,devops --force
+```
+
+Several packs are joined under one header in `.oc-pilot/rules.md`, which is
+included in every review, fix, and docgen request. The file is plain Markdown:
+add project-specific constraints at the end, for example "money is integer
+cents", "do not log request bodies", "migrations must be reversible".
+
+## Verify the rules are actually used
+
+```bash
+oc-pilot review --staged --json
+```
+
+Check `meta.rules` in the JSON: it contains the resolved rules path, or `null`
+when no file was found. A rules file that is silently ignored is worse than
+none.
+
+## Keep the same rules everywhere
+
+- **CLI** — reads `.oc-pilot/rules.md` automatically; override with `--rules`.
+- **MCP server** — expose the file as the `oc-pilot://rules` resource so the
+  host agent can read it, and it is applied to every MCP review call.
+- **CI** — commit the file; the GitHub Action and the pre-commit hooks use the
+  same path.
+- **Agents** — `AGENTS.md` and `CLAUDE.md` are picked up automatically as an
+  additional context block. Keep stack rules in `.oc-pilot/rules.md` and
+  workflow rules in the agent file, so neither duplicates the other.
+
+## Writing a pack
+
+A good pack has three sections and no adjectives:
+
+1. **What breaks** — concrete failure modes for this stack.
+2. **What is unsafe** — injection sinks, auth boundaries, secret exposure.
+3. **What rots** — patterns that pass review now and cost later.
+
+One line per rule, imperative, no "consider" or "try to". If a rule cannot be
+checked by reading a diff, drop it.
+
+## Guardrails
+
+- Do not enable every pack; irrelevant rules dilute attention and cost tokens.
+- Do not copy rules between stacks without adapting the failure modes.
+- Re-read the pack after a framework major upgrade; idioms expire.

package/skills/test-failure-triage/SKILL.md

@@ -0,0 +1,88 @@
+---
+name: test-failure-triage
+description: Use when a test suite fails and the cause is unclear. Captures the failing output, explains the root cause from the diff and the log, produces a minimal patch, applies it with a snapshot, and verifies the suite is green.
+---
+
+# Test failure triage
+
+Most agent failures on red tests are not "the model cannot code". They are
+misdiagnosis: the agent patches the assertion instead of the cause, or fixes
+the cause but breaks a neighbouring test. This skill forces a root-cause step
+before any patch, and a verification step after it.
+
+## Setup
+
+```bash
+npm i -g https://github.com/MyNameIsNikki/oc-pilot/archive/refs/tags/v0.88.1.tar.gz
+```
+
+## Workflow
+
+1. **Capture the failure verbatim.** Do not summarise it from memory.
+
+   ```bash
+   npm test 2>&1 | tee /tmp/test.log; echo "exit=${PIPESTATUS[0]}"
+   ```
+
+2. **Ask for the root cause, not for a patch.**
+
+   ```bash
+   oc-pilot test-fix --log /tmp/test.log --command "npm test"
+   ```
+
+   The output separates the observed failure, the suspected root cause, and a
+   minimal fix. If the root cause references code that is not in the diff or
+   the log, the model is guessing. Say so and gather that file first.
+
+3. **Propose the patch without touching the tree.**
+
+   ```bash
+   oc-pilot fix --command "npm test" --rounds 1
+   ```
+
+   Inspect the unified diff. Reject anything that edits test expectations
+   without a stated behavioural reason, deletes assertions, or adds sleeps,
+   retries, or `skip`.
+
+4. **Apply with a snapshot.**
+
+   ```bash
+   oc-pilot fix --apply --command "npm test" --rounds 2
+   ```
+
+   A snapshot is created automatically before the patch is applied. If the
+   round limit is hit, the tree is reverted to the snapshot.
+
+5. **Verify independently.** Run the suite yourself, not only through the
+   tool, and check that the count of passing tests did not drop while the
+   failing test turned green.
+
+6. **Roll back if the fix is wrong.**
+
+   ```bash
+   oc-pilot restore --list
+   oc-pilot restore <snapshot-id>
+   ```
+
+   Restore refuses to run if `HEAD` moved since the snapshot, so commit or
+   stash first.
+
+## Triage heuristics
+
+| Symptom | Likely cause | Check before patching |
+| --- | --- | --- |
+| `undefined is not a function` | Wrong import shape or mock | The module's actual export |
+| `ECONNREFUSED` / timeouts | Missing fixture or port clash | Test isolation, not the code |
+| Snapshot diff | Intentional output change | Whether the change was requested |
+| Type error only in CI | Different TS/lib version | `tsconfig`, lockfile drift |
+| Flaky pass locally | Order dependence | Run the file alone, then the suite |
+
+## Guardrails
+
+- Never mark a failing test as skipped to close the task.
+- Never weaken an assertion unless the expected behaviour genuinely changed;
+  if it did, update the test in its own commit with an explanation.
+- If the suite takes longer than the timeout, raise `--timeout` rather than
+  removing tests.
+- Report the failing test name, the root cause, the patch summary, and the
+  final suite status.