thanh-kit 2.5.0 → 2.5.2

package/templates/skills/markdown-novel-viewer/tests/run-tests.cjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+
+/**
+ * Test runner for dashboard tests
+ * Executes all test suites and generates report
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+// Load test framework first
+require('./test-framework.cjs');
+
+const testsDir = __dirname;
+const testFiles = [
+  'dashboard-renderer.test.cjs',
+  'http-server.test.cjs',
+  'dashboard-assets.test.cjs'
+];
+
+console.log('\n' + '='.repeat(70));
+console.log('Dashboard Implementation Test Suite');
+console.log('='.repeat(70));
+
+// Load all test files
+let loadErrors = [];
+for (const testFile of testFiles) {
+  const testPath = path.join(testsDir, testFile);
+
+  if (!fs.existsSync(testPath)) {
+    loadErrors.push(`Test file not found: ${testFile}`);
+    continue;
+  }
+
+  try {
+    require(testPath);
+  } catch (error) {
+    loadErrors.push(`${testFile}: ${error.message}`);
+  }
+}
+
+if (loadErrors.length > 0) {
+  console.error('\nErrors loading test files:');
+  loadErrors.forEach(err => {
+    console.error(`  - ${err}`);
+  });
+  process.exit(1);
+}
+
+// Run all tests
+global.runAllTests();

package/templates/skills/markdown-novel-viewer/tests/test-framework.cjs

@@ -0,0 +1,154 @@
+/**
+ * Simple test framework for Node.js (mocha-like)
+ */
+
+global.testStats = {
+  total: 0,
+  passed: 0,
+  failed: 0,
+  suites: [],
+  currentSuite: null
+};
+
+class TestSuite {
+  constructor(name) {
+    this.name = name;
+    this.tests = [];
+    this.beforeFn = null;
+    this.afterFn = null;
+  }
+
+  addTest(name, fn) {
+    this.tests.push({ name, fn });
+  }
+
+  setBefore(fn) {
+    this.beforeFn = fn;
+  }
+
+  setAfter(fn) {
+    this.afterFn = fn;
+  }
+
+  async run() {
+    const results = {
+      name: this.name,
+      passed: 0,
+      failed: 0,
+      errors: []
+    };
+
+    console.log(`\n  ${this.name}`);
+
+    for (const test of this.tests) {
+      try {
+        if (this.beforeFn) {
+          await this.beforeFn();
+        }
+
+        await test.fn();
+
+        if (this.afterFn) {
+          await this.afterFn();
+        }
+
+        results.passed++;
+        process.stdout.write('.');
+      } catch (error) {
+        results.failed++;
+        results.errors.push({
+          test: test.name,
+          error: error.message
+        });
+        process.stdout.write('F');
+      }
+    }
+
+    return results;
+  }
+}
+
+global.testSuites = {};
+
+global.describe = function(name, fn) {
+  const suite = new TestSuite(name);
+  global.testStats.currentSuite = suite;
+  global.testSuites[name] = suite;
+  fn();
+};
+
+global.it = function(name, fn) {
+  if (!global.testStats.currentSuite) {
+    throw new Error('it() called outside describe()');
+  }
+  global.testStats.currentSuite.addTest(name, fn);
+};
+
+global.before = function(fn) {
+  if (!global.testStats.currentSuite) {
+    throw new Error('before() called outside describe()');
+  }
+  global.testStats.currentSuite.setBefore(fn);
+};
+
+global.after = function(fn) {
+  if (!global.testStats.currentSuite) {
+    throw new Error('after() called outside describe()');
+  }
+  global.testStats.currentSuite.setAfter(fn);
+};
+
+global.runAllTests = async function() {
+  console.log('\n' + '='.repeat(70));
+  console.log('Running Test Suites');
+  console.log('='.repeat(70));
+
+  const suites = Object.values(global.testSuites);
+  const results = [];
+
+  for (const suite of suites) {
+    const result = await suite.run();
+    results.push(result);
+    global.testStats.passed += result.passed;
+    global.testStats.failed += result.failed;
+    global.testStats.total += result.passed + result.failed;
+  }
+
+  printTestResults(results);
+
+  return global.testStats;
+};
+
+function printTestResults(results) {
+  console.log('\n\n' + '='.repeat(70));
+  console.log('Test Results');
+  console.log('='.repeat(70) + '\n');
+
+  let totalPassed = 0;
+  let totalFailed = 0;
+
+  for (const result of results) {
+    const status = result.failed > 0 ? '✗' : '✓';
+    console.log(`${status} ${result.name}`);
+
+    if (result.errors.length > 0) {
+      result.errors.forEach(err => {
+        console.log(`  ✗ ${err.test}`);
+        console.log(`    ${err.error}`);
+      });
+    }
+
+    totalPassed += result.passed;
+    totalFailed += result.failed;
+  }
+
+  console.log('\n' + '='.repeat(70));
+  console.log(`Total: ${totalPassed + totalFailed} | Passed: ${totalPassed} | Failed: ${totalFailed}`);
+  console.log('='.repeat(70) + '\n');
+
+  if (totalFailed > 0) {
+    process.exit(1);
+  }
+}
+
+module.exports = { TestSuite, runAllTests };

package/templates/skills/markdown-novel-viewer/tests/verify-xss.cjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+
+/**
+ * XSS Protection Verification
+ */
+
+const renderer = require('../scripts/lib/dashboard-renderer.cjs');
+
+console.log('\nXSS Protection Verification');
+console.log('='.repeat(70));
+
+// Test 1: Image onerror payload
+const xssPayload1 = '<img src=x onerror="alert(1)">';
+const result1 = renderer.escapeHtml(xssPayload1);
+console.log('\nTest 1: Image onerror');
+console.log(`Input: ${xssPayload1}`);
+console.log(`Output: ${result1}`);
+const pass1 = !result1.includes('<img') && result1.includes('&lt;');
+console.log(`Result: ${pass1 ? 'PASS' : 'FAIL'}`);
+
+// Test 2: Script tag injection
+const xssPayload2 = '<script>alert("xss")</script>';
+const result2 = renderer.escapeHtml(xssPayload2);
+console.log('\nTest 2: Script tag');
+console.log(`Input: ${xssPayload2}`);
+console.log(`Output: ${result2}`);
+const pass2 = !result2.includes('<script') && result2.includes('&lt;script');
+console.log(`Result: ${pass2 ? 'PASS' : 'FAIL'}`);
+
+// Test 3: Full dashboard render with malicious plan
+const plans = [
+  {
+    id: 'xss-test',
+    name: '<script>alert(1)</script>',
+    status: 'pending',
+    progress: 0,
+    lastModified: '2025-12-11T10:00:00Z',
+    path: '"><script>alert(1)</script><"',
+    phases: { completed: 0, inProgress: 0, pending: 1, total: 1 }
+  }
+];
+
+const html = renderer.renderDashboard(plans, {
+  assetsDir: 'nonexistent' // Use fallback template
+});
+
+console.log('\nTest 3: Full dashboard render');
+console.log(`Input: Malicious plan name and path`);
+// Check that the HTML contains escaped version in plan card
+// JSON will also contain escaped content but that's safe
+const cardSectionStart = html.indexOf('<article');
+const cardSectionEnd = html.indexOf('</article>');
+const cardContent = cardSectionStart !== -1 ? html.substring(cardSectionStart, cardSectionEnd) : '';
+const hasEscapedInCard = cardContent.includes('&lt;script&gt;');
+const pass3 = hasEscapedInCard;
+console.log(`Result: ${pass3 ? 'PASS' : 'FAIL'}`);
+
+// Test 4: HTML structure
+console.log('\nTest 4: HTML structure validity');
+const hasDoctype = html.includes('<!DOCTYPE html');
+const hasHtmlClose = html.includes('</html>');
+const hasMain = html.includes('<main');
+const hasPlans = html.includes('{{plans-grid}}') || html.includes('class="plans-grid"');
+console.log(`DOCTYPE: ${hasDoctype ? 'PASS' : 'FAIL'}`);
+console.log(`Closing HTML: ${hasHtmlClose ? 'PASS' : 'FAIL'}`);
+console.log(`Main element: ${hasMain ? 'PASS' : 'FAIL'}`);
+console.log(`Plans section: ${hasPlans ? 'PASS' : 'FAIL'}`);
+const pass4 = hasDoctype && hasHtmlClose && hasMain;
+
+// Test 5: JSON embedded safely
+console.log('\nTest 5: JSON embedding');
+const jsonIncluded = html.includes('window.__plans');
+const jsonValid = html.includes('"id"') && html.includes('"name"');
+console.log(`JSON variable: ${jsonIncluded ? 'PASS' : 'FAIL'}`);
+console.log(`JSON valid: ${jsonValid ? 'PASS' : 'FAIL'}`);
+const pass5 = jsonIncluded && jsonValid;
+
+// Summary
+console.log('\n' + '='.repeat(70));
+console.log('Summary');
+console.log('='.repeat(70));
+const allPass = pass1 && pass2 && pass3 && pass4 && pass5;
+console.log(`XSS Escaping: ${pass1 && pass2 ? 'PASS (2/2)' : 'FAIL'}`);
+console.log(`Dashboard Render: ${pass3 ? 'PASS' : 'FAIL'}`);
+console.log(`HTML Structure: ${pass4 ? 'PASS' : 'FAIL'}`);
+console.log(`JSON Embedding: ${pass5 ? 'PASS' : 'FAIL'}`);
+console.log(`\nOverall: ${allPass ? 'PASS' : 'FAIL'}`);
+console.log('='.repeat(70) + '\n');
+
+process.exit(allPass ? 0 : 1);

package/templates/skills/mcp-builder/SKILL.md

@@ -1,7 +1,8 @@
 ---
-name: mcp-builder
-description: Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
+name: ck:mcp-builder
+description: Build MCP servers for LLM-external service integration. Use for FastMCP (Python), MCP SDK (Node/TypeScript), tool design, API integration, resource providers.
 license: Complete terms in LICENSE.txt
+argument-hint: "[service or API to integrate]"
 ---
 
 # MCP Server Development Guide

package/templates/skills/mcp-builder/scripts/evaluation.py

@@ -14,6 +14,14 @@ import xml.etree.ElementTree as ET
 from pathlib import Path
 from typing import Any
 
+# Fix Windows console encoding for Unicode output (emojis)
+if sys.platform == 'win32':
+    try:
+        sys.stdout.reconfigure(encoding='utf-8', errors='replace')
+        sys.stderr.reconfigure(encoding='utf-8', errors='replace')
+    except AttributeError:
+        pass  # Python < 3.7
+
 from anthropic import Anthropic
 
 from connections import create_connection
@@ -363,7 +371,7 @@ Examples:
         report = await run_evaluation(args.eval_file, connection, args.model)
 
         if args.output:
-            args.output.write_text(report)
+            args.output.write_text(report, encoding='utf-8')
             print(f"\n✅ Report saved to {args.output}")
         else:
             print("\n" + report)

package/templates/skills/mcp-management/SKILL.md

@@ -1,6 +1,7 @@
 ---
-name: mcp-management
-description: Manage Model Context Protocol (MCP) servers - discover, analyze, and execute tools/prompts/resources from configured MCP servers. Use when working with MCP integrations, need to discover available MCP capabilities, filter MCP tools for specific tasks, execute MCP tools programmatically, access MCP prompts/resources, or implement MCP client functionality. Supports intelligent tool selection, multi-server management, and context-efficient capability discovery.
+name: ck:mcp-management
+description: Manage MCP servers - discover, analyze, execute tools/prompts/resources. Use for MCP integrations, intelligent tool selection, multi-server management, context-efficient capability discovery.
+argument-hint: "[task or server-name]"
 ---
 
 # MCP Management
@@ -72,7 +73,7 @@ LLM analyzes `assets/tools.json` directly - better than keyword matching algorit
 **Primary: Gemini CLI** (if available)
 ```bash
 # IMPORTANT: Use stdin piping, NOT -p flag (deprecated, skips MCP init)
-echo "Take a screenshot of https://example.com" | gemini -y -m gemini-2.5-flash
+echo "Take a screenshot of https://example.com" | gemini -y -m <gemini.model>
 ```
 
 **Secondary: Direct Scripts**
@@ -94,7 +95,7 @@ Use Gemini CLI for automatic tool discovery and execution. Gemini CLI auto-loads
 ```bash
 # IMPORTANT: Use stdin piping, NOT -p flag (deprecated, skips MCP init)
 # Add "Return JSON only per GEMINI.md instructions" to enforce structured output
-echo "Take a screenshot of https://example.com. Return JSON only per GEMINI.md instructions." | gemini -y -m gemini-2.5-flash
+echo "Take a screenshot of https://example.com. Return JSON only per GEMINI.md instructions." | gemini -y -m <gemini.model>
 ```
 
 **Expected Output**:
@@ -154,7 +155,7 @@ npm install -g gemini-cli
 mkdir -p .gemini && ln -sf .claude/.mcp.json .gemini/settings.json
 # IMPORTANT: Use stdin piping, NOT -p flag (deprecated, skips MCP init)
 # GEMINI.md auto-loads to enforce JSON responses
-echo "Take a screenshot of https://example.com. Return JSON only per GEMINI.md instructions." | gemini -y -m gemini-2.5-flash
+echo "Take a screenshot of https://example.com. Return JSON only per GEMINI.md instructions." | gemini -y -m <gemini.model>
 ```
 
 Returns structured JSON: `{"server":"puppeteer","tool":"screenshot","success":true,"result":"screenshot.png","error":null}`
@@ -185,7 +186,7 @@ See [references/mcp-protocol.md](references/mcp-protocol.md) for:
 
 1. **Gemini CLI** (Primary): Fast, automatic, intelligent tool selection
    - Check: `command -v gemini`
-   - Execute: `echo "<task>" | gemini -y -m gemini-2.5-flash`
+   - Execute: `echo "<task>" | gemini -y -m <gemini.model>`
    - **IMPORTANT**: Use stdin piping, NOT `-p` flag (deprecated, skips MCP init)
    - Best for: All tasks when available
 
@@ -206,4 +207,4 @@ The `mcp-manager` agent uses this skill to:
 - Discover MCP capabilities without loading into main context
 - Report results back to main agent
 
-This keeps main agent context clean and enables efficient MCP integration.
+This keeps main agent context clean and enables efficient MCP integration.

package/templates/skills/mcp-management/references/gemini-cli-integration.md

@@ -1,15 +1,21 @@
 # Gemini CLI Integration Guide
 
+## Model Configuration
+
+Read model from `.claude/.ck.json`: `gemini.model` (default: `gemini-3-flash-preview`)
+
 ## ⚠️ CRITICAL: Use Stdin Piping, NOT -p Flag
 
 The `-p` flag is **deprecated** and skips MCP server initialization, causing tools to be unavailable:
 
 ```bash
-# ❌ WRONG - This skips MCP connections!
-gemini -y -m gemini-2.5-flash -p "Take a screenshot"
+# ❌ WRONG - Deprecated -p flag skips MCP connections!
+gemini -y -m <gemini.model> -p "Take a screenshot"
+# Also wrong: Using --model instead of -m
+gemini -y -p "Take a screenshot" --model gemini-3-flash-preview
 
 # ✅ CORRECT - This initializes MCP servers
-echo "Take a screenshot" | gemini -y -m gemini-2.5-flash
+echo "Take a screenshot" | gemini -y -m <gemini.model>
 ```
 
 **Why**: The `-p` flag runs in "quick mode" and bypasses MCP server connection initialization. Always use stdin piping (echo + pipe) to ensure MCP tools are available.
@@ -68,35 +74,35 @@ echo "<prompt>" | gemini [flags]
 
 - `-y`: Skip confirmation prompts (auto-approve tool execution)
 - `-m <model>`: Model selection
-  - `gemini-2.5-flash` (fast, recommended for MCP)
-  - `gemini-2.5-flash` (balanced)
+  - `gemini-3-flash-preview` (fast, recommended for MCP)
+  - `gemini-3-pro-preview` (balanced)
   - `gemini-pro` (high quality)
 
 ### Examples
 
 **Screenshot Capture**:
 ```bash
-echo "Take a screenshot of https://www.google.com.vn" | gemini -y -m gemini-2.5-flash
+echo "Take a screenshot of https://www.google.com.vn" | gemini -y -m <gemini.model>
 ```
 
 **Memory Operations**:
 ```bash
-echo "Remember that Alice is a React developer working on e-commerce projects" | gemini -y -m gemini-2.5-flash
+echo "Remember that Alice is a React developer working on e-commerce projects" | gemini -y -m <gemini.model>
 ```
 
 **Web Research**:
 ```bash
-echo "Search for latest Next.js 15 features and summarize the top 3" | gemini -y -m gemini-2.5-flash
+echo "Search for latest Next.js 15 features and summarize the top 3" | gemini -y -m <gemini.model>
 ```
 
 **Multi-Tool Orchestration**:
 ```bash
-echo "Search for Claude AI documentation, take a screenshot of the homepage, and save both to memory" | gemini -y -m gemini-2.5-flash
+echo "Search for Claude AI documentation, take a screenshot of the homepage, and save both to memory" | gemini -y -m <gemini.model>
 ```
 
 **Browser Automation**:
 ```bash
-echo "Navigate to https://example.com, click the signup button, and take a screenshot" | gemini -y -m gemini-2.5-flash
+echo "Navigate to https://example.com, click the signup button, and take a screenshot" | gemini -y -m <gemini.model>
 ```
 
 ## How It Works

package/templates/skills/media-processing/SKILL.md

@@ -1,7 +1,8 @@
 ---
-name: media-processing
-description: Process multimedia files with FFmpeg (video/audio encoding, conversion, streaming, filtering, hardware acceleration), ImageMagick (image manipulation, format conversion, batch processing, effects, composition), and RMBG (AI-powered background removal). Use when converting media formats, encoding videos with specific codecs (H.264, H.265, VP9), resizing/cropping images, removing backgrounds from images, extracting audio from video, applying filters and effects, optimizing file sizes, creating streaming manifests (HLS/DASH), generating thumbnails, batch processing images, creating composite images, or implementing media processing pipelines. Supports 100+ formats, hardware acceleration (NVENC, QSV), and complex filtergraphs.
+name: ck:media-processing
+description: Process media with FFmpeg (video/audio), ImageMagick (images), RMBG (AI background removal). Use for encoding, format conversion, filters, thumbnails, batch processing, HLS/DASH streaming.
 license: MIT
+argument-hint: "[input-file] [operation]"
 ---
 
 # Media Processing Skill

package/templates/skills/mermaidjs-v11/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: ck:mermaidjs-v11
+description: Create diagrams with Mermaid.js v11 syntax. Use for flowcharts, sequence diagrams, class diagrams, ER diagrams, Gantt charts, state diagrams, architecture diagrams, timelines, user journeys.
+argument-hint: "[diagram-type or description]"
+---
+
+# Mermaid.js v11
+
+## Overview
+
+Create text-based diagrams using Mermaid.js v11 declarative syntax. Convert code to SVG/PNG/PDF via CLI or render in browsers/markdown files.
+
+## Quick Start
+
+**Basic Diagram Structure:**
+```
+{diagram-type}
+  {diagram-content}
+```
+
+**Common Diagram Types:**
+- `flowchart` - Process flows, decision trees
+- `sequenceDiagram` - Actor interactions, API flows
+- `classDiagram` - OOP structures, data models
+- `stateDiagram` - State machines, workflows
+- `erDiagram` - Database relationships
+- `gantt` - Project timelines
+- `journey` - User experience flows
+
+See `references/diagram-types.md` for all 24+ types with syntax.
+
+## Creating Diagrams
+
+**Inline Markdown Code Blocks:**
+````markdown
+```mermaid
+flowchart TD
+    A[Start] --> B{Decision}
+    B -->|Yes| C[Action]
+    B -->|No| D[End]
+```
+````
+
+**Configuration via Frontmatter:**
+````markdown
+```mermaid
+---
+theme: dark
+---
+flowchart LR
+    A --> B
+```
+````
+
+**Comments:** Use `%% ` prefix for single-line comments.
+
+## CLI Usage
+
+Convert `.mmd` files to images:
+```bash
+# Installation
+npm install -g @mermaid-js/mermaid-cli
+
+# Basic conversion
+mmdc -i diagram.mmd -o diagram.svg
+
+# With theme and background
+mmdc -i input.mmd -o output.png -t dark -b transparent
+
+# Custom styling
+mmdc -i diagram.mmd --cssFile style.css -o output.svg
+```
+
+See `references/cli-usage.md` for Docker, batch processing, and advanced workflows.
+
+## JavaScript Integration
+
+**HTML Embedding:**
+```html
+<pre class="mermaid">
+  flowchart TD
+    A[Client] --> B[Server]
+</pre>
+<script src="https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.min.js"></script>
+<script>mermaid.initialize({ startOnLoad: true });</script>
+```
+
+See `references/integration.md` for Node.js API and advanced integration patterns.
+
+## Configuration & Theming
+
+**Common Options:**
+- `theme`: "default", "dark", "forest", "neutral", "base"
+- `look`: "classic", "handDrawn"
+- `fontFamily`: Custom font specification
+- `securityLevel`: "strict", "loose", "antiscript"
+
+See `references/configuration.md` for complete config options, theming, and customization.
+
+## Practical Patterns
+
+Load `references/examples.md` for:
+- Architecture diagrams
+- API documentation flows
+- Database schemas
+- Project timelines
+- State machines
+- User journey maps
+
+## Resources
+
+- `references/diagram-types.md` - Syntax for all 24+ diagram types
+- `references/configuration.md` - Config, theming, accessibility
+- `references/cli-usage.md` - CLI commands and workflows
+- `references/integration.md` - JavaScript API and embedding
+- `references/examples.md` - Practical patterns and use cases