opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/fact-check-x-unified/tests/stage_checkpoint_test.py

@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SKILLS = ROOT / "modules" if (ROOT / "modules").is_dir() else ROOT.parent
+FIXTURES = SKILLS / "fact-check-x-knowledge-compare" / "tests" / "fixtures"
+PIPELINE = ROOT / "scripts" / "fact_check_x.py"
+
+
+def command(*arguments: str) -> list[str]:
+    return [sys.executable, str(PIPELINE), *arguments]
+
+
+def run(arguments: list[str], success: bool = True) -> dict:
+    process = subprocess.run(arguments, text=True, capture_output=True, check=False)
+    if success and process.returncode:
+        raise AssertionError(process.stdout or process.stderr)
+    if not success and process.returncode == 0:
+        raise AssertionError("命令应被阶段门禁拒绝")
+    return json.loads([line for line in process.stdout.splitlines() if line.strip()][-1])
+
+
+def acknowledge(run_dir: Path, checkpoint: dict, decision: str = "continue") -> dict:
+    return run(command(
+        "acknowledge-stage",
+        "--run-dir", str(run_dir),
+        "--stage", checkpoint["stage"],
+        "--token", checkpoint["acknowledgement"]["token"],
+        "--decision", decision,
+    ))
+
+
+def main() -> int:
+    with tempfile.TemporaryDirectory(prefix="fcx-stage-gate-") as temporary:
+        root = Path(temporary)
+        run_dir = root / "interactive"
+        results = FIXTURES / "results.json"
+        analysis = FIXTURES / "comparison-analysis.json"
+        capture = run(command(
+            "prepare-comparison",
+            "--results", str(results),
+            "--run-dir", str(run_dir),
+        ))
+        assert capture["checkpoint"]["status"] == "awaiting_user"
+        assert capture["checkpoint"]["acknowledgement"]["token"].startswith("fcx_")
+        blocked = run(command(
+            "complete-comparison",
+            "--results", str(results),
+            "--analysis", str(analysis),
+            "--run-dir", str(run_dir),
+        ), success=False)
+        assert "尚未得到" in blocked["error"]
+
+        wrong = run(command(
+            "acknowledge-stage",
+            "--run-dir", str(run_dir),
+            "--stage", "capture",
+            "--token", "wrong-token",
+            "--decision", "continue",
+        ), success=False)
+        assert "令牌无效" in wrong["error"]
+        assert acknowledge(run_dir, capture["checkpoint"])["nextStageAllowed"] is True
+
+        comparison = run(command(
+            "complete-comparison",
+            "--results", str(results),
+            "--analysis", str(analysis),
+            "--run-dir", str(run_dir),
+        ))
+        assert comparison["checkpoint"]["status"] == "awaiting_user"
+        authority_blocked = run(command(
+            "prepare-authority", "--run-dir", str(run_dir),
+        ), success=False)
+        assert "尚未得到" in authority_blocked["error"]
+        assert acknowledge(run_dir, comparison["checkpoint"], "stop")["nextStageAllowed"] is False
+        stopped = run(command(
+            "prepare-authority", "--run-dir", str(run_dir),
+        ), success=False)
+        assert "尚未得到" in stopped["error"]
+
+        automatic_dir = root / "automatic"
+        rejected = subprocess.run(command(
+            "prepare-comparison",
+            "--results", str(results),
+            "--run-dir", str(automatic_dir),
+            "--execution-mode", "full-auto",
+        ), text=True, capture_output=True, check=False)
+        assert rejected.returncode != 0
+        assert "invalid choice" in rejected.stderr
+
+    print("PASS 互动模式硬门禁且 full-auto 无法绕过")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/bundled-skills/fact-check-x-unified/tests/trusted_search_config_test.py

@@ -0,0 +1,156 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from unittest.mock import patch
+
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+
+from trusted_search_config import (  # noqa: E402
+    ConfigurationError,
+    configure,
+    credential_path,
+    load_trusted_search_key,
+    locate_onboarding_script,
+    trusted_search_key_for_execution,
+    validated_trusted_search_key,
+    validate_trusted_search_key,
+)
+
+
+TEST_KEY = "fixture_fact_check_x_key_123456"
+
+
+class SearchHandler(BaseHTTPRequestHandler):
+    def do_POST(self) -> None:
+        length = int(self.headers.get("Content-Length", "0"))
+        self.rfile.read(length)
+        if self.headers.get("api-key") != TEST_KEY:
+            self.send_response(403)
+            self.end_headers()
+            return
+        payload = json.dumps({"code": 200, "content": {"data": {"检索文章": []}}})
+        encoded = payload.encode("utf-8")
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(encoded)))
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def log_message(self, format: str, *args: object) -> None:
+        return
+
+
+def main() -> int:
+    previous = os.environ.copy()
+    server = ThreadingHTTPServer(("127.0.0.1", 0), SearchHandler)
+    worker = threading.Thread(target=server.serve_forever, daemon=True)
+    worker.start()
+    try:
+        with tempfile.TemporaryDirectory(prefix="fact-check-x-key-config-") as temp:
+            key_file = Path(temp) / "credentials" / "trusted-search-key"
+            key_file.parent.mkdir(parents=True)
+            key_file.write_text(f"{TEST_KEY}\n", encoding="utf-8")
+            key_file.chmod(0o600)
+            os.environ["TRUSTED_SEARCH_KEY"] = "fixture_stale_environment_key_123456"
+            os.environ["FACT_CHECK_X_TRUSTED_SEARCH_KEY_FILE"] = str(key_file)
+            os.environ["FACTCHECK_TRUSTED_SEARCH_URL"] = (
+                f"http://127.0.0.1:{server.server_port}/dependable/search"
+            )
+
+            assert credential_path() == key_file
+            assert load_trusted_search_key() == TEST_KEY
+            validate_trusted_search_key(TEST_KEY)
+            selected, source = validated_trusted_search_key()
+            assert selected == TEST_KEY
+            assert source == "shared_local_credential"
+            existing = configure()
+            assert existing["status"] == "already_configured"
+            assert existing["source"] == "shared_local_credential"
+            assert existing["created"] is False
+            assert existing["validated"] is True
+            assert locate_onboarding_script().name == "trusted-search-onboarding.js"
+
+            with patch(
+                "trusted_search_config.urllib.request.urlopen",
+                side_effect=OSError("The read operation timed out"),
+            ):
+                executable, executable_source, validation = (
+                    trusted_search_key_for_execution()
+                )
+            assert executable == TEST_KEY
+            assert executable_source == "shared_local_credential"
+            assert validation == "service_unavailable"
+
+            process = subprocess.run(
+                [
+                    sys.executable,
+                    str(ROOT / "scripts" / "trusted_search_config.py"),
+                    "status",
+                ],
+                text=True,
+                capture_output=True,
+                check=False,
+                env=os.environ.copy(),
+            )
+            assert process.returncode == 0
+            status = json.loads(process.stdout)
+            assert status == {
+                "status": "configured",
+                "configured": True,
+                "source": "shared_local_credential",
+                "providerUrl": "https://platform.dknowc.cn/auth/#/login",
+            }
+            assert TEST_KEY not in process.stdout
+            assert TEST_KEY not in process.stderr
+
+            try:
+                validate_trusted_search_key("fixture_invalid_key_123456")
+            except ConfigurationError as exc:
+                assert "无效" in str(exc)
+            else:
+                raise AssertionError("无效 Key 应被拒绝")
+
+            os.environ["FACTCHECK_TRUSTED_SEARCH_URL"] = (
+                "http://127.0.0.1:1/dependable/search"
+            )
+            executable, executable_source, validation = (
+                trusted_search_key_for_execution()
+            )
+            assert executable == TEST_KEY
+            assert executable_source == "shared_local_credential"
+            assert validation == "service_unavailable"
+            transient = configure()
+            assert transient["status"] == "already_configured"
+            assert transient["validated"] is False
+            assert transient["validation"] == "service_unavailable"
+            assert "不会要求重复登录" in transient["message"]
+
+            if os.name != "nt":
+                key_file.chmod(0o644)
+                try:
+                    load_trusted_search_key()
+                except ConfigurationError as exc:
+                    assert "权限不安全" in str(exc)
+                else:
+                    raise AssertionError("权限过宽的本机 Key 应被拒绝")
+    finally:
+        server.shutdown()
+        server.server_close()
+        os.environ.clear()
+        os.environ.update(previous)
+    print("PASS 可信搜索跨载体共享配置、Key 验证与秘密不外显")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/bundled-skills/feature-flags/SKILL.md

@@ -0,0 +1,426 @@
+---
+name: feature-flags
+description: Implement feature flags for progressive feature rollout using LaunchDarkly,
+  Unleash, or custom solutions.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant platform CLIs (kubectl, helm, terraform, git,
+  CI runners) and authorized access to the target environment. Docs-only; helper scripts
+  and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Feature Flags
+
+Control feature releases and enable progressive rollout with feature flag systems.
+
+## Prerequisites
+
+- Application code access
+- Feature flag service or self-hosted solution
+- Basic understanding of deployment patterns
+
+## Feature Flag Types
+
+| Type | Purpose | Example |
+|------|---------|---------|
+| Release | Control feature visibility | New checkout flow |
+| Experiment | A/B testing | Button color test |
+| Ops | Runtime configuration | Rate limiting |
+| Permission | User access control | Premium features |
+| Kill Switch | Emergency disable | Third-party integration |
+
+## LaunchDarkly
+
+### SDK Setup (Node.js)
+
+```javascript
+const LaunchDarkly = require('launchdarkly-node-server-sdk');
+
+const client = LaunchDarkly.init(process.env.LAUNCHDARKLY_SDK_KEY);
+
+await client.waitForInitialization();
+
+// Evaluate flag
+const user = {
+  key: 'user-123',
+  email: 'user@example.com',
+  custom: {
+    plan: 'premium',
+    company: 'acme'
+  }
+};
+
+const showNewFeature = await client.variation('new-checkout', user, false);
+
+if (showNewFeature) {
+  // New feature code
+} else {
+  // Existing code
+}
+```
+
+### React SDK
+
+```javascript
+import { withLDProvider, useFlags, useLDClient } from 'launchdarkly-react-client-sdk';
+
+// Provider setup
+export default withLDProvider({
+  clientSideID: 'your-client-side-id',
+  user: {
+    key: 'user-123',
+    email: 'user@example.com'
+  }
+})(App);
+
+// Using flags in component
+function FeatureComponent() {
+  const { newCheckout, experimentVariant } = useFlags();
+  const ldClient = useLDClient();
+
+  // Track events
+  const handleClick = () => {
+    ldClient.track('checkout-started');
+  };
+
+  if (newCheckout) {
+    return <NewCheckout onClick={handleClick} />;
+  }
+  return <OldCheckout onClick={handleClick} />;
+}
+```
+
+### Targeting Rules
+
+```yaml
+# LaunchDarkly targeting configuration
+flag: new-checkout
+targeting:
+  # Individual users
+  targets:
+    - variation: true
+      values: ['user-123', 'user-456']
+  
+  # Rules
+  rules:
+    # Beta users
+    - variation: true
+      clauses:
+        - attribute: email
+          op: endsWith
+          values: ['@company.com']
+    
+    # Premium plan
+    - variation: true
+      clauses:
+        - attribute: plan
+          op: in
+          values: ['premium', 'enterprise']
+    
+    # Percentage rollout
+    - variation: true
+      rollout:
+        variations:
+          - variation: true
+            weight: 20000  # 20%
+          - variation: false
+            weight: 80000  # 80%
+  
+  # Default
+  fallthrough:
+    variation: false
+```
+
+## Unleash
+
+### Server Setup
+
+```yaml
+# docker-compose.yml
+version: '3.8'
+
+services:
+  unleash:
+    image: unleashorg/unleash-server:latest
+    ports:
+      - "4242:4242"
+    environment:
+      - DATABASE_URL=postgres://postgres:password@db/unleash
+      - DATABASE_SSL=false
+    depends_on:
+      - db
+
+  db:
+    image: postgres:15
+    environment:
+      - POSTGRES_PASSWORD=password
+      - POSTGRES_DB=unleash
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+
+volumes:
+  postgres-data:
+```
+
+### SDK Setup (Node.js)
+
+```javascript
+const { initialize } = require('unleash-client');
+
+const unleash = initialize({
+  url: 'http://localhost:4242/api',
+  appName: 'my-app',
+  customHeaders: {
+    Authorization: 'your-api-token'
+  }
+});
+
+unleash.on('ready', () => {
+  // Check feature
+  const isEnabled = unleash.isEnabled('new-checkout');
+  
+  // With context
+  const context = {
+    userId: 'user-123',
+    properties: {
+      plan: 'premium'
+    }
+  };
+  
+  const isEnabledForUser = unleash.isEnabled('new-checkout', context);
+  
+  // Get variant
+  const variant = unleash.getVariant('experiment-flag', context);
+  console.log(variant.name); // 'control' or 'treatment'
+});
+```
+
+### Activation Strategies
+
+```yaml
+# Standard strategies
+strategies:
+  - name: default
+    # On/off for everyone
+    
+  - name: userWithId
+    parameters:
+      userIds: 'user-1,user-2,user-3'
+    
+  - name: gradualRolloutUserId
+    parameters:
+      percentage: 25
+      groupId: 'new-feature'
+    
+  - name: gradualRolloutRandom
+    parameters:
+      percentage: 50
+    
+  - name: flexibleRollout
+    parameters:
+      rollout: 30
+      stickiness: userId
+      groupId: 'checkout-exp'
+```
+
+## Custom Implementation
+
+### Database-Backed Flags
+
+```python
+# models.py
+from django.db import models
+
+class FeatureFlag(models.Model):
+    name = models.CharField(max_length=100, unique=True)
+    enabled = models.BooleanField(default=False)
+    rollout_percentage = models.IntegerField(default=0)
+    allowed_users = models.JSONField(default=list)
+    rules = models.JSONField(default=dict)
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+# service.py
+import hashlib
+
+class FeatureFlagService:
+    def __init__(self):
+        self._cache = {}
+    
+    def is_enabled(self, flag_name, user_id=None, context=None):
+        flag = self._get_flag(flag_name)
+        
+        if not flag or not flag.enabled:
+            return False
+        
+        # Check user allowlist
+        if user_id and user_id in flag.allowed_users:
+            return True
+        
+        # Check rules
+        if context and self._evaluate_rules(flag.rules, context):
+            return True
+        
+        # Check percentage rollout
+        if flag.rollout_percentage > 0 and user_id:
+            return self._is_in_rollout(flag_name, user_id, flag.rollout_percentage)
+        
+        return flag.rollout_percentage == 100
+    
+    def _is_in_rollout(self, flag_name, user_id, percentage):
+        hash_input = f"{flag_name}:{user_id}"
+        hash_value = int(hashlib.md5(hash_input.encode()).hexdigest(), 16)
+        return (hash_value % 100) < percentage
+    
+    def _evaluate_rules(self, rules, context):
+        for rule in rules.get('rules', []):
+            if self._evaluate_rule(rule, context):
+                return True
+        return False
+```
+
+### Redis-Backed Flags
+
+```python
+import redis
+import json
+
+class RedisFeatureFlags:
+    def __init__(self, redis_url):
+        self.redis = redis.from_url(redis_url)
+        self.prefix = 'feature_flag:'
+    
+    def set_flag(self, name, config):
+        key = f"{self.prefix}{name}"
+        self.redis.set(key, json.dumps(config))
+    
+    def is_enabled(self, name, user_id=None):
+        key = f"{self.prefix}{name}"
+        data = self.redis.get(key)
+        
+        if not data:
+            return False
+        
+        config = json.loads(data)
+        
+        if not config.get('enabled', False):
+            return False
+        
+        # User allowlist
+        if user_id in config.get('users', []):
+            return True
+        
+        # Percentage rollout
+        percentage = config.get('percentage', 0)
+        if percentage == 100:
+            return True
+        
+        if percentage > 0 and user_id:
+            return self._hash_user(name, user_id) < percentage
+        
+        return False
+    
+    def _hash_user(self, flag, user_id):
+        import hashlib
+        hash_input = f"{flag}:{user_id}"
+        return int(hashlib.sha256(hash_input.encode()).hexdigest(), 16) % 100
+```
+
+## Testing with Feature Flags
+
+### Unit Testing
+
+```javascript
+// Jest mocking
+jest.mock('launchdarkly-node-server-sdk', () => ({
+  init: jest.fn(() => ({
+    waitForInitialization: jest.fn().mockResolvedValue(undefined),
+    variation: jest.fn()
+  }))
+}));
+
+describe('Checkout', () => {
+  it('shows new checkout when flag enabled', async () => {
+    const ldClient = require('launchdarkly-node-server-sdk').init();
+    ldClient.variation.mockResolvedValue(true);
+    
+    const result = await renderCheckout(user);
+    expect(result).toContain('NewCheckout');
+  });
+  
+  it('shows old checkout when flag disabled', async () => {
+    const ldClient = require('launchdarkly-node-server-sdk').init();
+    ldClient.variation.mockResolvedValue(false);
+    
+    const result = await renderCheckout(user);
+    expect(result).toContain('OldCheckout');
+  });
+});
+```
+
+### Integration Testing
+
+```python
+# pytest fixtures
+import pytest
+
+@pytest.fixture
+def feature_flags():
+    """Provide controllable feature flags for testing."""
+    flags = {}
+    
+    class TestFlags:
+        def set(self, name, value):
+            flags[name] = value
+        
+        def is_enabled(self, name, **kwargs):
+            return flags.get(name, False)
+    
+    return TestFlags()
+
+def test_new_checkout(feature_flags):
+    feature_flags.set('new-checkout', True)
+    
+    response = client.get('/checkout')
+    assert 'new-checkout-form' in response.content
+```
+
+
+## Contents
+
+- [Monitoring and Analytics](references/details.md)
+- [Common Issues](references/details.md)
+- [Best Practices](references/details.md)
+- [Related Skills](references/details.md)
+
+## When to Use This Skill
+
+Use this skill when:
+- Implementing gradual feature rollouts
+- Enabling trunk-based development
+- Running A/B tests and experiments
+- Managing feature lifecycles
+- Implementing kill switches for production
+
+## Limitations
+
+- Guidance executes against real environments: confirm target, blast radius, and rollback plan before applying anything.
+- Never deploy to production without explicit approval. Docs-only import: upstream scripts and templates not bundled.
+
+### Example
+
+```bash
+git status && git diff --stat
+kubectl diff -f manifest.yaml
+```
+
+> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.