ops-wiki-agent-kit 0.1.1 → 0.1.3

package/.github/skills/database-query/references/client-commands.md

@@ -1,197 +0,0 @@
-# DB Client Commands
-
-這份 reference 提供使用 native CLI 進行查詢的方式。實際使用時需依 repo 的 DB type、environment、schema、VPN/bastion/container 條件調整。
-
-## General Handling
-
-- 優先使用 password prompts、wallets、DSN 或 session environment variables，避免把 password 直接放在 command-line arguments。
-- 查詢完成後，清除暫時性的 environment variables。
-- 可以的話，優先使用 read-only users。
-- query files 應維持為暫時用途，不要 commit。
-- logs 與 final answers 中的 credentials 要遮蔽。
-
-## Oracle
-
-建議使用的 clients: `sqlplus`、Oracle SQLcl `sql`。
-
-```powershell
-sqlplus -L /nolog
-```
-
-如果 `sqlplus -V` 或 `sqlplus -L /nolog` 出現 `Error 46 initializing SQL*Plus`、`HTTP proxy setting has incorrect value` 或 `SP2-1502`，先用乾淨的 child process 移除 proxy env 後重試：
-
-```powershell
-cmd /c "set HTTP_PROXY=& set HTTPS_PROXY=& set ALL_PROXY=& set GIT_HTTP_PROXY=& set GIT_HTTPS_PROXY=& set NO_PROXY=& sqlplus -V"
-```
-
-若版本檢查成功，後續 Oracle read-only query 也應在同樣清掉 proxy env 的 child process 或 helper wrapper 內執行，並在 acquisition ledger 記錄 `sqlplus proxy env cleared before retry`。若清掉 proxy 後仍失敗，才將狀態記為 `connection_failed` 或 `missing_tool`。
-
-接著在 client session 內連線：
-
-```sql
-connect <username>/<password>@//<host>:<port>/<service_name>
-SELECT 1 FROM dual;
-exit
-```
-
-實用的 inspection queries：
-
-```sql
-SELECT owner, table_name
-FROM all_tables
-WHERE owner = UPPER('<schema>')
-FETCH FIRST 50 ROWS ONLY;
-
-SELECT owner, table_name, column_name, data_type, nullable
-FROM all_tab_columns
-WHERE owner = UPPER('<schema>')
-  AND table_name = UPPER('<table_name>')
-ORDER BY column_id;
-```
-
-較舊的 Oracle versions 可能需要使用 `WHERE ROWNUM <= 50`，而不是 `FETCH FIRST`。
-
-## PostgreSQL
-
-建議使用的 client: `psql`。
-
-```powershell
-$env:PGPASSWORD = "<password>"
-psql -h <host> -p <port> -U <username> -d <database> -c "SELECT 1;"
-Remove-Item Env:\PGPASSWORD
-```
-
-實用的 inspection queries：
-
-```sql
-SELECT table_schema, table_name
-FROM information_schema.tables
-WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
-ORDER BY table_schema, table_name
-LIMIT 50;
-
-SELECT column_name, data_type, is_nullable
-FROM information_schema.columns
-WHERE table_schema = '<schema>'
-  AND table_name = '<table_name>'
-ORDER BY ordinal_position;
-```
-
-## SQL Server / Microsoft SQL Server / MS SQL / MSSQL
-
-建議使用的 client: `sqlcmd`。
-
-```powershell
-$env:SQLCMDPASSWORD = "<password>"
-sqlcmd -S <host>,<port> -d <database> -U <username> -Q "SELECT 1;"
-Remove-Item Env:\SQLCMDPASSWORD
-```
-
-若使用 Windows authentication：
-
-```powershell
-sqlcmd -S <host>,<port> -d <database> -E -Q "SELECT 1;"
-```
-
-實用的 inspection queries：
-
-```sql
-SELECT TOP (50) TABLE_SCHEMA, TABLE_NAME
-FROM INFORMATION_SCHEMA.TABLES
-WHERE TABLE_TYPE = 'BASE TABLE'
-ORDER BY TABLE_SCHEMA, TABLE_NAME;
-
-SELECT COLUMN_NAME, DATA_TYPE, IS_NULLABLE
-FROM INFORMATION_SCHEMA.COLUMNS
-WHERE TABLE_SCHEMA = '<schema>'
-  AND TABLE_NAME = '<table_name>'
-ORDER BY ORDINAL_POSITION;
-```
-
-## MySQL And MariaDB
-
-建議使用的 clients: `mysql`、`mariadb`。
-
-```powershell
-$env:MYSQL_PWD = "<password>"
-mysql --host=<host> --port=<port> --user=<username> --database=<database> --execute="SELECT 1;"
-Remove-Item Env:\MYSQL_PWD
-```
-
-實用的 inspection queries：
-
-```sql
-SELECT TABLE_SCHEMA, TABLE_NAME
-FROM information_schema.TABLES
-WHERE TABLE_SCHEMA = '<database>'
-ORDER BY TABLE_NAME
-LIMIT 50;
-
-SELECT COLUMN_NAME, DATA_TYPE, IS_NULLABLE
-FROM information_schema.COLUMNS
-WHERE TABLE_SCHEMA = '<database>'
-  AND TABLE_NAME = '<table_name>'
-ORDER BY ORDINAL_POSITION;
-```
-
-## SQLite
-
-建議使用的 client: `sqlite3`。
-
-```powershell
-sqlite3 <database_file> "SELECT 1;"
-```
-
-實用的 inspection commands：
-
-```sql
-.tables
-PRAGMA table_info('<table_name>');
-SELECT name, type FROM sqlite_master WHERE type IN ('table', 'view') ORDER BY name LIMIT 50;
-```
-
-## IBM Db2
-
-建議使用的 client: `db2`。
-
-```powershell
-db2 connect to <database> user <username> using <password>
-db2 -x "SELECT 1 FROM sysibm.sysdummy1"
-db2 connect reset
-```
-
-實用的 inspection queries：
-
-```sql
-SELECT tabschema, tabname
-FROM syscat.tables
-WHERE type = 'T'
-ORDER BY tabschema, tabname
-FETCH FIRST 50 ROWS ONLY;
-
-SELECT colname, typename, nulls
-FROM syscat.columns
-WHERE tabschema = UPPER('<schema>')
-  AND tabname = UPPER('<table_name>')
-ORDER BY colno;
-```
-
-## H2
-
-H2 常見於 tests 或 local development 中以 embedded 方式使用。優先使用 repo 的 test profile 或 app 提供的 console/tooling。
-
-常見的 JDBC URL patterns：
-
-```text
-jdbc:h2:mem:<database>
-jdbc:h2:file:<path>
-```
-
-實用的 inspection query：
-
-```sql
-SELECT TABLE_SCHEMA, TABLE_NAME
-FROM INFORMATION_SCHEMA.TABLES
-ORDER BY TABLE_SCHEMA, TABLE_NAME
-LIMIT 50;
-```

package/.github/skills/database-query/references/query-safety.md

@@ -1,109 +0,0 @@
-# Query Safety
-
-## Read-Only Default
-
-除非 user 明確要求資料修改，否則預設只允許 metadata 與 read-only `SELECT`。如果查詢內容涉及下列操作，必須先停下來確認：
-
-- `INSERT`, `UPDATE`, `DELETE`, `MERGE`, `TRUNCATE`
-- `CREATE`, `ALTER`, `DROP`
-- `GRANT`, `REVOKE`
-- 可能修改資料的 stored procedure/function/package calls
-- scheduler/job control、queue dequeue、lock/session kill
-
-## Row Limits By Dialect
-
-請使用有筆數上限的查詢：
-
-```sql
--- PostgreSQL, MySQL, MariaDB, SQLite, H2
-SELECT <columns>
-FROM <table>
-WHERE <condition>
-LIMIT 50;
-```
-
-```sql
--- SQL Server
-SELECT TOP (50) <columns>
-FROM <schema>.<table>
-WHERE <condition>;
-```
-
-```sql
--- Oracle 12c+, IBM Db2
-SELECT <columns>
-FROM <schema>.<table>
-WHERE <condition>
-FETCH FIRST 50 ROWS ONLY;
-```
-
-```sql
--- Older Oracle
-SELECT <columns>
-FROM <schema>.<table>
-WHERE <condition>
-  AND ROWNUM <= 50;
-```
-
-## Oracle Empty String Semantics
-
-這一節只在已確認 `db_type`、driver 或 client session 是 Oracle 時適用。不要把這組規則套用到 PostgreSQL、SQL Server、MySQL、MariaDB、SQLite、Db2 或其他 DB。
-
-Oracle 會把 `''` 視為 `NULL`。因此 Oracle predicate 對空字串的處理要直接用 `NULL` 語意，不要把 `''` 當成一般字串比較。
-
-- 不要用 `= ''`、`<> ''`，也不要用 `TRIM(NVL(<column>, '')) <> ''` 判斷空值或非空值。
-- 判斷 `NULL` / 非 `NULL` 時，使用 `IS NULL` 或 `IS NOT NULL`。
-- 判斷 trim 後是否有內容時，優先使用 `LENGTH(TRIM(NVL(<column>, ' '))) = 0` 或 `> 0`；若只需要確認 trim 後有值，可用 `TRIM(<column>) IS NOT NULL`。
-- 若 query 結果意外為 0 rows，先檢查是否誤用了 Oracle empty-string 語意，再解讀資料是否真的為空。
-
-範例：
-
-```sql
--- Avoid in Oracle
-WHERE path_program <> ''
-```
-
-```sql
--- Avoid in Oracle even after wrapping with TRIM/NVL
-WHERE TRIM(NVL(path_program, '')) <> ''
-```
-
-```sql
--- Prefer when checking for the presence of a trimmed value
-WHERE TRIM(path_program) IS NOT NULL
-```
-
-```sql
--- Prefer when checking for a non-empty value after trimming
-WHERE LENGTH(TRIM(NVL(path_program, ' '))) > 0
-```
-
-## Safer Investigation Pattern
-
-1. 先透過 metadata 確認 schema/table 存在。
-2. 只有在安全的前提下，才檢查大致筆數或精確 count。
-3. 先查 grouped summary，再看 row sample。
-4. 以關鍵欄位查詢範圍較小的 sample。
-5. 依照 user request 加上業務過濾條件。
-
-範例：
-
-```sql
-SELECT status, COUNT(*) AS row_count
-FROM <schema>.<table>
-WHERE created_at >= <start_date>
-GROUP BY status
-ORDER BY row_count DESC;
-```
-
-## Reporting
-
-最終回覆應提供足夠證據，讓結果可被重現，同時避免洩露敏感資訊：
-
-- connection source：`src/main/resources/application-dev.yml`、`.env`、`docker-compose.yml`、user-provided session value
-- DB type 與 target environment
-- SQL statements；如果使用了敏感 literal，則改提供摘要化 SQL
-- result rows 或 aggregate summary
-- 不確定之處與 permission gaps
-
-不可包含 plaintext password values、token values、帶有憑證資訊的 URL，或任何 private network secrets。

package/.github/skills/database-query/scripts/find_db_config.py

@@ -1,273 +0,0 @@
-#!/usr/bin/env python3
-import sys
-
-sys.dont_write_bytecode = True
-
-import argparse
-import json
-import os
-import re
-from pathlib import Path
-
-
-SKIP_DIRS = {
-    ".git",
-    ".hg",
-    ".svn",
-    ".idea",
-    ".vscode",
-    "__pycache__",
-    "node_modules",
-    "target",
-    "build",
-    "dist",
-    "out",
-    ".gradle",
-    ".mvn",
-    "vendor",
-}
-
-SCRIPT_SKILL_DIR = Path(__file__).resolve().parents[1]
-
-TEXT_EXTENSIONS = {
-    ".properties",
-    ".yml",
-    ".yaml",
-    ".xml",
-    ".json",
-    ".env",
-    ".ini",
-    ".conf",
-    ".cfg",
-    ".toml",
-    ".sql",
-    ".java",
-    ".kt",
-    ".groovy",
-    ".cs",
-    ".js",
-    ".ts",
-    ".py",
-    ".rb",
-    ".php",
-    ".sh",
-    ".ps1",
-    ".bat",
-    ".cmd",
-    ".txt",
-}
-
-CONFIG_EXTENSIONS = {
-    ".properties",
-    ".yml",
-    ".yaml",
-    ".xml",
-    ".json",
-    ".env",
-    ".ini",
-    ".conf",
-    ".cfg",
-    ".toml",
-}
-
-TEXT_NAMES = {
-    "Dockerfile",
-    "Jenkinsfile",
-    "docker-compose.yml",
-    "docker-compose.yaml",
-    "pom.xml",
-    "build.gradle",
-    "build.gradle.kts",
-    "package.json",
-    "requirements.txt",
-    "persistence.xml",
-    "context.xml",
-    "tnsnames.ora",
-    "pg_service.conf",
-}
-
-CONFIG_NAMES = TEXT_NAMES | {
-    ".env",
-    ".env.local",
-    ".env.dev",
-    ".env.test",
-    ".env.prod",
-    "application.properties",
-    "application.yml",
-    "application.yaml",
-}
-
-DB_PATTERNS = [
-    ("oracle", re.compile(r"jdbc:oracle:thin|oracle\.jdbc|tnsnames\.ora|SERVICE_NAME|ORACLE_SID", re.I)),
-    ("postgresql", re.compile(r"jdbc:postgresql|org\.postgresql|PGHOST|PGDATABASE|postgres(?:ql)?://", re.I)),
-    ("sqlserver", re.compile(r"jdbc:sqlserver|com\.microsoft\.sqlserver|sqlcmd|Data Source=|Initial Catalog=|Microsoft SQL Server|MS SQL|MSSQL", re.I)),
-    ("mysql", re.compile(r"jdbc:mysql|com\.mysql|mysql://|MYSQL_", re.I)),
-    ("mariadb", re.compile(r"jdbc:mariadb|org\.mariadb|mariadb://|MARIADB_", re.I)),
-    ("db2", re.compile(r"jdbc:db2|com\.ibm\.db2|DB2", re.I)),
-    ("sqlite", re.compile(r"jdbc:sqlite|sqlite3?|\.db\b|\.sqlite\b", re.I)),
-    ("h2", re.compile(r"jdbc:h2|org\.h2|H2_", re.I)),
-]
-
-CONFIG_KEY_PATTERN = re.compile(
-    r"(?i)("
-    r"spring\.datasource\.[\w.-]+|"
-    r"datasource\.[\w.-]+|"
-    r"r2dbc\.[\w.-]+|"
-    r"hibernate\.connection\.[\w.-]+|"
-    r"database[_\-.]?\w*|"
-    r"db[_\-.]?(host|port|name|user|username|password|passwd|pwd|url|schema)|"
-    r"jdbc[_\-.]?\w*|"
-    r"connection(string)?|"
-    r"url|username|user|password|passwd|pwd|host|port|schema|service_name|sid|"
-    r"PGHOST|PGPORT|PGDATABASE|PGUSER|PGPASSWORD|"
-    r"MYSQL_HOST|MYSQL_PORT|MYSQL_DATABASE|MYSQL_USER|MYSQL_PASSWORD|"
-    r"MARIADB_HOST|MARIADB_PORT|MARIADB_DATABASE|MARIADB_USER|MARIADB_PASSWORD|"
-    r"ORACLE_HOST|ORACLE_PORT|ORACLE_SERVICE|ORACLE_SID|"
-    r"SQLSERVER_HOST|SQLSERVER_PORT|SQLSERVER_DATABASE|SQLSERVER_USER|SQLSERVER_PASSWORD"
-    r")"
-)
-
-NON_CONFIG_HINT_PATTERN = re.compile(
-    r"(?i)("
-    r"jdbc:[\w:]+|"
-    r"postgres(?:ql)?://|mysql://|mariadb://|"
-    r"Data Source=|Initial Catalog=|"
-    r"PGHOST|PGDATABASE|MYSQL_|MARIADB_|ORACLE_|SQLSERVER_|"
-    r"tnsnames\.ora|sqlplus|sqlcmd|sqlite3|db2 connect"
-    r")"
-)
-
-SECRET_KEY_PATTERN = re.compile(r"(?i)(password|passwd|pwd|secret|token|credential|private[_-]?key|access[_-]?key)")
-USERNAME_KEY_PATTERN = re.compile(r"(?i)(^|[_.-])(user|username|uid)$|(^|[_.-])(user|username|uid)([_.-]|$)")
-ASSIGNMENT_PATTERN = re.compile(r"^\s*([^#;!\s][^:=\s]*?)\s*[:=]\s*(.+?)\s*$")
-MAX_FILE_BYTES = 2 * 1024 * 1024
-
-
-def is_text_candidate(path):
-    return path.name in TEXT_NAMES or path.suffix in TEXT_EXTENSIONS or path.name.startswith(".env")
-
-
-def is_config_file(path):
-    return path.name in CONFIG_NAMES or path.suffix in CONFIG_EXTENSIONS or path.name.startswith(".env")
-
-
-def detect_db_type(text):
-    matches = [name for name, pattern in DB_PATTERNS if pattern.search(text)]
-    return ",".join(matches) if matches else ""
-
-
-def redact_value(key, value):
-    value = value.strip().strip("\"'")
-    if SECRET_KEY_PATTERN.search(key):
-        return "<redacted>"
-    if USERNAME_KEY_PATTERN.search(key):
-        return "<redacted-user>"
-
-    redacted = value
-    redacted = re.sub(r"(?i)(password|passwd|pwd)=([^;&\s]+)", r"\1=<redacted>", redacted)
-    redacted = re.sub(r"(?i)(user(?:name)?\s*=\s*)([^;&\s]+)", r"\1<redacted-user>", redacted)
-    redacted = re.sub(r"(?i)(uid\s*=\s*)([^;&\s]+)", r"\1<redacted-user>", redacted)
-    redacted = re.sub(r"(?i)(User ID\s*=\s*)([^;&]+)", r"\1<redacted-user>", redacted)
-    redacted = re.sub(r"(?i)(Password\s*=\s*)([^;&]+)", r"\1<redacted>", redacted)
-    redacted = re.sub(r"://([^:/@\s]+):([^@\s]+)@", r"://<redacted-user>:<redacted>@", redacted)
-    return redacted
-
-
-def iter_files(root):
-    for current_root, dirs, files in os.walk(root):
-        dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
-        for name in files:
-            path = Path(current_root) / name
-            try:
-                path.resolve().relative_to(SCRIPT_SKILL_DIR)
-                continue
-            except ValueError:
-                pass
-            if is_text_candidate(path):
-                yield path
-
-
-def scan_file(path, root):
-    try:
-        if path.stat().st_size > MAX_FILE_BYTES:
-            return []
-        content = path.read_text(encoding="utf-8", errors="replace")
-    except OSError:
-        return []
-
-    results = []
-    rel_path = str(path.relative_to(root))
-    config_file = is_config_file(path)
-    for line_no, line in enumerate(content.splitlines(), start=1):
-        db_type = detect_db_type(line)
-        key = ""
-        value = line.strip()
-        match = ASSIGNMENT_PATTERN.match(line)
-
-        if match:
-            key = match.group(1).strip()
-            value = match.group(2).strip()
-            key_match = CONFIG_KEY_PATTERN.search(key)
-            if not db_type and not (config_file and key_match):
-                continue
-        else:
-            hint_match = NON_CONFIG_HINT_PATTERN.search(line)
-            if not db_type and not hint_match:
-                continue
-            if hint_match:
-                key = hint_match.group(1)
-
-        if not db_type:
-            db_type = detect_db_type(value)
-
-        results.append(
-            {
-                "file": rel_path,
-                "line": line_no,
-                "db_type": db_type or "unknown",
-                "key": key,
-                "value": redact_value(key, value),
-            }
-        )
-    return results
-
-
-def print_markdown(results):
-    if not results:
-        print("No DB config candidates found.")
-        return
-
-    print("| file | line | db_type | key | redacted_value |")
-    print("| --- | ---: | --- | --- | --- |")
-    for item in results:
-        value = item["value"].replace("|", "\\|")
-        key = item["key"].replace("|", "\\|")
-        print(f"| {item['file']} | {item['line']} | {item['db_type']} | `{key}` | `{value}` |")
-
-
-def main():
-    parser = argparse.ArgumentParser(description="Find DB connection config candidates with redacted output.")
-    parser.add_argument("repo", nargs="?", default=".", help="Repository path to scan.")
-    parser.add_argument("--json", action="store_true", help="Output JSON instead of markdown.")
-    args = parser.parse_args()
-
-    root = Path(args.repo).resolve()
-    if not root.exists():
-        print(f"Path does not exist: {root}", file=sys.stderr)
-        return 2
-
-    results = []
-    for path in iter_files(root):
-        results.extend(scan_file(path, root))
-
-    results.sort(key=lambda item: (item["file"], item["line"]))
-
-    if args.json:
-        print(json.dumps(results, indent=2, ensure_ascii=False))
-    else:
-        print_markdown(results)
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())