opencode-skills-collection 3.1.11 → 3.1.13

package/bundled-skills/newman-cicd-integration/SKILL.md

@@ -0,0 +1,330 @@
+---
+name: newman-cicd-integration
+description: Generate ready-to-use CI/CD pipeline configurations that install and run Newman for automated API testing. Use this skill whenever the user wants to run Newman in a CI pipeline, integrate Postman collections into automated builds, set up API tests in GitHub Actions, GitLab CI, Jenkins,...
+risk: unknown
+source: https://github.com/LambdaTest/agent-skills/tree/main/api-skill/newman/newman-cicd-helper
+source_repo: LambdaTest/agent-skills
+source_type: community
+date_added: 2026-07-01
+license: MIT
+license_source: https://github.com/LambdaTest/agent-skills/blob/main/LICENSE
+---
+
+# Newman CI/CD Integration Generator
+## When to Use
+
+Use this skill when you need generate ready-to-use CI/CD pipeline configurations that install and run Newman for automated API testing. Use this skill whenever the user wants to run Newman in a CI pipeline, integrate Postman collections into automated builds, set up API tests in GitHub Actions, GitLab CI, Jenkins,...
+
+
+Generate complete, copy-paste-ready CI/CD pipeline configs that install Newman and run Postman collections as part of automated builds.
+
+---
+
+## What to Collect From the User
+
+Before generating a config, determine:
+1. **CI platform** — GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, Bitbucket?
+2. **Collection source** — local file in repo, or Postman API URL?
+3. **Environment** — local env file in repo, or env vars injected by CI secrets?
+4. **Reporters needed** — JUnit XML (for CI test results panel), HTML report, or both?
+5. **Node.js version** preference (default: 18)
+6. **Trigger** — on every push, pull request, schedule, or after deploy?
+7. **Fail build on test failure?** — almost always yes; confirm
+
+---
+
+## Platform Templates
+
+### GitHub Actions
+
+```yaml
+name: API Tests
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+
+jobs:
+  api-tests:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '18'
+
+      - name: Install Newman
+        run: |
+          npm install -g newman
+          npm install -g newman-reporter-htmlextra
+
+      - name: Run API tests
+        run: |
+          newman run ./collections/my-api.json \
+            -e ./environments/staging.json \
+            -r cli,junit,htmlextra \
+            --reporter-junit-export ./results/junit.xml \
+            --reporter-htmlextra-export ./results/report.html \
+            --reporter-htmlextra-title "API Test Results"
+        env:
+          BASE_URL: ${{ secrets.BASE_URL }}
+          API_KEY: ${{ secrets.API_KEY }}
+
+      - name: Publish test results
+        uses: dorny/test-reporter@v1
+        if: always()
+        with:
+          name: Newman API Tests
+          path: results/junit.xml
+          reporter: java-junit
+
+      - name: Upload HTML report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: api-test-report
+          path: results/report.html
+```
+
+---
+
+### GitLab CI
+
+```yaml
+stages:
+  - test
+
+api-tests:
+  stage: test
+  image: node:18-alpine
+  before_script:
+    - npm install -g newman newman-reporter-htmlextra
+  script:
+    - |
+      newman run ./collections/my-api.json \
+        -e ./environments/staging.json \
+        --env-var "BASE_URL=$BASE_URL" \
+        --env-var "API_KEY=$API_KEY" \
+        -r cli,junit,htmlextra \
+        --reporter-junit-export results/junit.xml \
+        --reporter-htmlextra-export results/report.html
+  artifacts:
+    when: always
+    reports:
+      junit: results/junit.xml
+    paths:
+      - results/report.html
+    expire_in: 7 days
+  variables:
+    BASE_URL: $BASE_URL   # Set in GitLab CI/CD > Variables
+    API_KEY: $API_KEY
+```
+
+---
+
+### Jenkins (Declarative Pipeline)
+
+```groovy
+pipeline {
+  agent any
+
+  tools {
+    nodejs 'NodeJS-18'   // Configure in Global Tool Configuration
+  }
+
+  stages {
+    stage('Install Newman') {
+      steps {
+        sh 'npm install -g newman newman-reporter-htmlextra'
+      }
+    }
+
+    stage('Run API Tests') {
+      steps {
+        sh '''
+          newman run ./collections/my-api.json \
+            -e ./environments/staging.json \
+            -r cli,junit,htmlextra \
+            --reporter-junit-export results/junit.xml \
+            --reporter-htmlextra-export results/report.html \
+            --reporter-htmlextra-title "API Tests - ${BUILD_NUMBER}"
+        '''
+      }
+    }
+  }
+
+  post {
+    always {
+      junit 'results/junit.xml'
+      publishHTML([
+        allowMissing: false,
+        alwaysLinkToLastBuild: true,
+        keepAll: true,
+        reportDir: 'results',
+        reportFiles: 'report.html',
+        reportName: 'Newman API Test Report'
+      ])
+    }
+  }
+}
+```
+
+---
+
+### Azure DevOps
+
+```yaml
+trigger:
+  branches:
+    include:
+      - main
+
+pool:
+  vmImage: 'ubuntu-latest'
+
+steps:
+  - task: NodeTool@0
+    inputs:
+      versionSpec: '18.x'
+    displayName: 'Set up Node.js'
+
+  - script: |
+      npm install -g newman newman-reporter-htmlextra
+    displayName: 'Install Newman'
+
+  - script: |
+      newman run ./collections/my-api.json \
+        -e ./environments/staging.json \
+        --env-var "API_KEY=$(API_KEY)" \
+        -r cli,junit,htmlextra \
+        --reporter-junit-export $(System.DefaultWorkingDirectory)/results/junit.xml \
+        --reporter-htmlextra-export $(System.DefaultWorkingDirectory)/results/report.html
+    displayName: 'Run API Tests'
+    env:
+      API_KEY: $(API_KEY)   # Set in Pipeline > Variables
+
+  - task: PublishTestResults@2
+    condition: always()
+    inputs:
+      testResultsFormat: 'JUnit'
+      testResultsFiles: 'results/junit.xml'
+      testRunTitle: 'Newman API Tests'
+
+  - task: PublishBuildArtifacts@1
+    condition: always()
+    inputs:
+      PathtoPublish: 'results/report.html'
+      ArtifactName: 'api-test-report'
+```
+
+---
+
+### CircleCI
+
+```yaml
+version: 2.1
+
+jobs:
+  api-tests:
+    docker:
+      - image: cimg/node:18.0
+    steps:
+      - checkout
+      - run:
+          name: Install Newman
+          command: npm install -g newman newman-reporter-htmlextra
+      - run:
+          name: Run API Tests
+          command: |
+            mkdir -p results
+            newman run ./collections/my-api.json \
+              -e ./environments/staging.json \
+              --env-var "API_KEY=$API_KEY" \
+              -r cli,junit,htmlextra \
+              --reporter-junit-export results/junit.xml \
+              --reporter-htmlextra-export results/report.html
+      - store_test_results:
+          path: results
+      - store_artifacts:
+          path: results/report.html
+
+workflows:
+  test:
+    jobs:
+      - api-tests
+```
+
+---
+
+## Best Practices
+
+### Secrets — never hardcode credentials
+Always inject sensitive values as CI environment variables/secrets:
+- GitHub: `Settings > Secrets and Variables > Actions`
+- GitLab: `Settings > CI/CD > Variables`
+- Jenkins: `Manage Jenkins > Credentials`
+- Azure DevOps: `Pipelines > Variables`
+
+Reference in Newman via `--env-var "KEY=$SECRET_NAME"` or pre-set in the environment file.
+
+### Store collection and environment files in the repo
+```
+/
+├── collections/
+│   └── my-api.json
+├── environments/
+│   ├── staging.json
+│   └── prod.json
+└── results/         ← gitignored, created by Newman
+```
+
+Add `results/` to `.gitignore`.
+
+### Always use `if: always()` / `when: always`
+Ensure test result artifacts are published even when Newman exits with a failure code.
+
+### Exit codes
+Newman exits with code `1` if any tests fail — this automatically fails the pipeline step. Use `--bail` if you want to stop on the first failure rather than running all tests.
+
+---
+
+## How to Generate Configs
+
+1. Confirm the CI platform and tailor the exact syntax
+2. Use the correct secret/variable injection syntax for that platform
+3. Include artifact publishing steps so test results appear in the CI UI
+4. Add comments explaining secrets that need to be configured
+5. Keep environment files in the repo (without secrets); inject sensitive values via CI vars
+
+---
+
+## After Completing the Newman CICD output
+
+Once the Newman CICD output is delivered, ask the user:
+
+"Would you like me to generate Postman Test Cases for these commands? (yes/no)"
+
+If the user says **yes**:
+- Check if the postman-testcase-generator skill is available in the installed skills list
+- If the skill **is available**:
+  - Read and follow the instructions in the postman-testcase-generator skill
+  - Use the CICD command output above as the input
+- If the skill **is NOT available**:
+  - Inform the user: "It looks like the postman-testcase-generator skill isn't installed.
+    You can install it and re-run.
+
+If the user says **no**:
+- End the task here
+
+---
+
+## Limitations
+
+- Use this skill only when the task clearly matches its upstream source and local project context.
+- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
+- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.

package/bundled-skills/observability-and-instrumentation/SKILL.md

@@ -0,0 +1,216 @@
+---
+name: observability-and-instrumentation
+description: Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting. Use when shipping any feature that runs in production and you need evidence it works. Use when production issues are reported but you can't tell what happened...
+risk: unknown
+source: https://github.com/addyosmani/agent-skills/tree/main/skills/observability-and-instrumentation
+source_repo: addyosmani/agent-skills
+source_type: community
+date_added: 2026-07-01
+license: MIT
+license_source: https://github.com/addyosmani/agent-skills/blob/main/LICENSE
+---
+
+# Observability and Instrumentation
+
+## Overview
+
+Code you can't observe is code you can't operate. Observability is the ability to answer "what is the system doing and why?" from the outside, using the telemetry the code emits. Instrumentation is not a post-launch add-on — it's written alongside the feature, the same way tests are. If a feature ships without telemetry, the first user-reported bug becomes archaeology instead of a query.
+
+## When to Use
+
+- Building any feature that will run in production
+- Adding a new service, endpoint, background job, or external integration
+- A production incident took too long to diagnose ("we couldn't tell what happened")
+- Setting up or reviewing alerting rules
+- Reviewing a PR that adds I/O, retries, queues, or cross-service calls
+
+**NOT for:**
+- Diagnosing a failure happening right now — use the `debugging-and-error-recovery` skill (observability is what makes that skill fast next time)
+- Profiling and optimizing measured slowness — use the `performance-optimization` skill
+- Launch-day monitoring checklists and rollback triggers — see the `shipping-and-launch` skill; this skill covers the instrumentation that feeds them
+
+## Process
+
+### 1. Define "working" before instrumenting
+
+Telemetry without a question is noise. Before adding any instrumentation, write down 2–4 questions an on-call engineer will ask about this feature:
+
+```
+FEATURE: checkout payment retry
+QUESTIONS ON-CALL WILL ASK:
+1. What fraction of payments succeed on first attempt vs after retry?
+2. When a payment fails permanently, why? (provider error? timeout? validation?)
+3. Is the payment provider slower than usual?
+→ Every signal below must help answer one of these.
+```
+
+If you can't name the questions, you're not ready to instrument — you'll log everything and learn nothing.
+
+### 2. Pick the right signal for each question
+
+| Signal | Answers | Cost profile | Example |
+|---|---|---|---|
+| **Structured log** | "What happened in this specific case?" | Per-event; grows with traffic | `payment_failed` with provider error code |
+| **Metric** | "How often / how fast, in aggregate?" | Fixed per series; cheap to query | p99 latency of provider calls |
+| **Trace** | "Where did time go across services?" | Per-request; usually sampled | One slow checkout, broken down by hop |
+
+Rule of thumb: metrics tell you **that** something is wrong, traces tell you **where**, logs tell you **why**.
+
+### 3. Structured logging
+
+Log events, not prose. Every log line is a JSON object with a stable event name and machine-readable fields:
+
+```typescript
+// BAD: string interpolation — unqueryable, inconsistent
+logger.info(`Payment ${id} failed for user ${userId} after ${n} retries`);
+
+// GOOD: stable event name + structured fields
+logger.warn({
+  event: 'payment_failed',
+  paymentId: id,
+  provider: 'stripe',
+  errorCode: err.code,
+  attempt: n,
+}, 'payment failed');
+```
+
+**Log levels — use them consistently:**
+
+| Level | Meaning | On-call action |
+|---|---|---|
+| `error` | Invariant broken; someone may need to act | Investigate |
+| `warn` | Degraded but handled (retry succeeded, fallback used) | Watch for trends |
+| `info` | Significant business event (order placed, job finished) | None |
+| `debug` | Diagnostic detail | Off in production by default |
+
+**Correlation IDs are mandatory.** Generate (or accept) a request ID at the system boundary and attach it to every log line, span, and outbound call. Without it, you cannot reconstruct a single request from interleaved logs:
+
+```typescript
+// Express: child logger per request, ID propagated downstream
+app.use((req, res, next) => {
+  req.id = req.headers['x-request-id'] ?? crypto.randomUUID();
+  req.log = logger.child({ requestId: req.id });
+  res.setHeader('x-request-id', req.id);
+  next();
+});
+```
+
+**Never log secrets, tokens, passwords, or full PII.** This is a hard rule from the `security-and-hardening` skill — telemetry pipelines are a classic data-leak path. Allowlist fields; don't log whole request bodies.
+
+### 4. Metrics
+
+For request-driven services, instrument **RED** on every endpoint and every external dependency: **R**ate (requests/sec), **E**rrors (failure rate), **D**uration (latency histogram, not average). For resources (queues, pools, hosts), use **USE**: **U**tilization, **S**aturation, **E**rrors.
+
+As with tracing, the vendor-neutral path is the OpenTelemetry metrics API (same SDK and context as step 5). The example below uses Prometheus' `prom-client` — one common backend choice, not the only one; the RED/USE and cardinality rules are identical either way.
+
+```typescript
+import { Histogram } from 'prom-client';
+
+const httpDuration = new Histogram({
+  name: 'http_request_duration_seconds',
+  help: 'HTTP request duration',
+  labelNames: ['method', 'route', 'status_class'],  // '2xx', not '200'
+  buckets: [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5],
+});
+```
+
+**Cardinality is the failure mode.** Every unique label combination is a separate time series. Labels must come from small, fixed sets (route template, status class, provider name). Never use user IDs, raw URLs, error messages, or other unbounded values as labels — that belongs in logs and traces.
+
+```
+OK as label:    route="/api/tasks/:id"   status_class="5xx"   provider="stripe"
+NEVER a label:  user_id, email, request_id, full URL, error message text
+```
+
+Track averages never, percentiles always: an average hides the 1% of users having a terrible time. Use histograms and read p50/p95/p99.
+
+### 5. Distributed tracing
+
+Use OpenTelemetry — it's the vendor-neutral standard, and auto-instrumentation covers HTTP, gRPC, and common DB clients with near-zero code:
+
+```typescript
+// tracing.ts — must be imported before anything else
+import { NodeSDK } from '@opentelemetry/sdk-node';
+import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node';
+
+const sdk = new NodeSDK({
+  serviceName: 'checkout-service',
+  instrumentations: [getNodeAutoInstrumentations()],
+});
+sdk.start();
+```
+
+Add manual spans only around meaningful internal units of work (e.g., `applyDiscounts`, `chargeProvider`) and attach the attributes on-call will filter by. Propagate context across every async boundary — HTTP headers, queue message metadata — or the trace dies at the gap. Sample head-based at a low rate by default; keep 100% of errors if your backend supports tail sampling.
+
+### 6. Alerting
+
+Alert on **symptoms users feel**, not on causes:
+
+```
+SYMPTOM (page-worthy):           CAUSE (dashboard, not a page):
+error rate > 1% for 5 min        CPU at 85%
+p99 latency > 2s                 one pod restarted
+queue age > 10 min               disk at 70%
+```
+
+Cause-based alerts fire when nothing is wrong and miss failures you didn't predict. Symptom-based alerts fire exactly when users are hurt, regardless of the cause.
+
+Rules for every alert you create:
+
+1. **It must be actionable.** If the response is "ignore it, it self-heals", delete the alert.
+2. **It links to a runbook** — even three lines: what it means, first query to run, escalation path.
+3. **It has a threshold and duration** justified by the SLO or by historical data, not by a guess.
+4. Use two severities only: **page** (user-facing, act now) and **ticket** (degradation, act this week). A third tier becomes noise that trains people to ignore everything.
+
+### 7. Verify the telemetry itself
+
+Instrumentation is code; it can be wrong. Before calling the work done, trigger the paths and look at the actual output:
+
+- Force an error in staging → find it in the logs by `requestId`, confirm fields are structured (not `[object Object]`)
+- Send test traffic → confirm metric series appear with the expected labels and sane values
+- Follow one request across services in the tracing UI → no broken spans
+- Fire each new alert once (lower the threshold temporarily) → confirm it reaches the right channel and the runbook link works
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+|---|---|
+| "I'll add logging after it works" | "After" becomes "after the first incident", which is the most expensive moment to discover you're blind. Instrument as you build. |
+| "More logs = more observability" | Unstructured noise makes incidents slower, not faster. Three queryable events beat three hundred prose lines. |
+| "console.log is fine for now" | Unstructured output can't be filtered, correlated, or alerted on. The structured logger costs five extra minutes once. |
+| "We can just look at the dashboards when something breaks" | Dashboards built without defined questions show you everything except the answer. Start from on-call questions. |
+| "Alert on everything important, we'll tune later" | A noisy pager trains people to ignore it. The tuning never happens; the missed real page does. |
+| "User ID as a metric label makes debugging easier" | It also makes your metrics backend fall over. High-cardinality lookups belong in logs and traces. |
+| "Tracing is overkill for our two services" | Two services already means cross-service latency questions logs can't answer. Auto-instrumentation makes the cost trivial. |
+
+## Red Flags
+
+- A feature PR with retries, queues, or external calls and zero new telemetry
+- Log lines built by string interpolation instead of structured fields
+- No correlation/request ID — each log line is an orphan
+- Metrics labeled with user IDs, raw URLs, or error message text (cardinality bomb)
+- Latency tracked as an average with no percentiles
+- Alerts that fire daily and get acknowledged without action
+- Alerts on causes (CPU, memory) paging humans while user-facing error rate is unmonitored
+- Secrets, tokens, or full request bodies appearing in logs
+- "It works on my machine" as the only evidence a production feature is healthy
+
+## Verification
+
+After instrumenting a feature, confirm:
+
+- [ ] The on-call questions for this feature are written down, and each signal maps to one
+- [ ] All log output is structured (JSON), with stable event names and a correlation ID on every line
+- [ ] No secrets, tokens, or unredacted PII in any log line (spot-check actual output)
+- [ ] RED metrics exist for every new endpoint and every external dependency, with bounded label sets
+- [ ] Latency is a histogram; p95/p99 are queryable
+- [ ] A single request can be followed end-to-end in the tracing UI without broken spans
+- [ ] Every new alert is symptom-based, has a runbook link, and was test-fired once
+- [ ] An induced failure in staging was located via telemetry alone, without reading the source
+
+For the at-a-glance version of this list, including the pre-launch instrumentation gate, see `references/observability-checklist.md`.
+
+## Limitations
+
+- Use this skill only when the task clearly matches its upstream source and local project context.
+- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
+- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.

package/bundled-skills/odw/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: odw
+description: Dynamic multi-agent workflows — plan first, then orchestrate parallel agents with adversarial verification via the local odw daemon. Use when the user asks for a "workflow", says "ultracode", or hands you a task spanning many files/items that benefits from parallel agents.
+risk: unknown
+source: https://github.com/Suraj1235/open-dynamic-workflows/tree/main/packages/antigravity-adapter/skills/odw
+source_repo: Suraj1235/open-dynamic-workflows
+source_type: community
+date_added: 2026-07-01
+license: MIT
+license_source: https://github.com/Suraj1235/open-dynamic-workflows/blob/main/LICENSE
+---
+
+# Open Dynamic Workflows (Antigravity)
+## When to Use
+
+Use this skill when you need dynamic multi-agent workflows — plan first, then orchestrate parallel agents with adversarial verification via the local odw daemon. Use when the user asks for a "workflow", says "ultracode", or hands you a task spanning many files/items that benefits from parallel agents.
+
+
+Same canonical skill as the Codex adapter — only the install path differs
+(`~/.gemini/skills/odw/`). The bridge scripts live next to this skill in `scripts/`.
+
+## Model & API key (read this first)
+
+Antigravity locks model invocation to its internal engine — skills, workflows, MCP servers, `invoke_subagent`, and the SDK can use its *tools* but **cannot call its configured model (Gemini/Claude/GPT-OSS) from extension code**. So, unlike the OpenCode plugin (which runs ODW's real engine *through* OpenCode's model with no extra key), there are two honest paths:
+
+- **No-key path (Native fallback):** Antigravity's own agent orchestrates with `invoke_subagent` (real isolation/worktrees) using its own model — no extra key, but **not** the ODW engine.
+- **Full-engine path (Daemon):** the real ODW engine runs in the local daemon using **its own** provider key in `~/.odw/config.json` (Ollama is keyless/local). This is the only way to get the full engine on Antigravity today.
+
+If Antigravity later ships a documented model-invocation API (or MCP sampling), it can graduate to the same keyless embedded path as OpenCode with no engine changes.
+
+## Step 0 — Daemon check
+
+Run: `node scripts/daemon-bridge.js --check`
+- Exit 0 → daemon is up; use the daemon path below.
+- Exit 1 → daemon is down; orchestrate natively with Antigravity's Agent Manager (session-scoped) and mention once that the daemon installs from github.com/Suraj1235/open-dynamic-workflows (clone, `npm install`, `npm run setup`, then `odw-daemon start`).
+
+## Daemon path
+
+1. **Plan:** `node scripts/daemon-bridge.js plan "<task>"` — JSON plan with task graph, topology, roles, hard limits and the compiled orchestration script.
+2. **Confirm:** summarize topology / agent count / est. cost / est. time before executing anything beyond read-only work.
+3. **Execute:** `node scripts/daemon-bridge.js exec plan.json` → `wf_...` id. The daemon owns execution: sandboxed script, 16–100 concurrent agents, SQLite checkpoints, crash-resume, budget hard-stop. It keeps running even if this IDE session ends.
+4. **Report:** `node scripts/daemon-bridge.js result <wf_id>` blocks until done; relay the synthesized result.
+
+## Native fallback path
+
+Decompose → parallel work → adversarial verification → synthesis, inside the current session. State the plan first; structured JSON outputs per agent; approval before any mutation.
+
+## Notes
+
+- The VS Code extension (`odw-vscode`) installs in Antigravity as-is (it is a VS Code fork) and gives a live workflow dashboard.
+- Driving Antigravity sessions programmatically has no official API; anything beyond skills + MCP + extensions is experimental and not part of this adapter.
+
+## Limitations
+
+- Use this skill only when the task clearly matches its upstream source and local project context.
+- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
+- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.