thanh-kit 2.5.0 → 2.5.2

package/templates/commands/scout.md

@@ -1,283 +0,0 @@
----
-description: ⚡⚡ Scout codebase with priority-based file discovery and structured output
-argument-hint: [user-prompt] [scale]
----
-
-## Purpose
-
-Search the codebase for files needed to complete the task using fast, token-efficient parallel agents with **priority-based categorization**.
-
-## Variables
-
-- **USER_PROMPT**: $1
-- **SCALE**: $2 (defaults to 3)
-- **REPORT_OUTPUT_DIR**: Use `Report:` from `## Naming` section
-
----
-
-## PHASE 1: ANALYZE AND PLAN
-
-### Step 1: Parse Search Request
-
-Extract from USER_PROMPT:
-- **Keywords**: Entity names, feature names, patterns
-- **Intent**: CRUD, investigation, debugging, implementation
-- **Scope**: Backend, Frontend, Cross-service, Full-stack
-
-### Step 2: Generate Search Patterns
-
-**HIGH PRIORITY (Always Search):**
-```
-# Domain Entities
-**/Domain/Entities/**/*{keyword}*.cs
-**/{Entity}.cs
-
-# CQRS Commands & Queries
-**/UseCaseCommands/**/*{keyword}*.cs
-**/UseCaseQueries/**/*{keyword}*.cs
-**/Save{Entity}Command.cs
-**/Get{Entity}*Query.cs
-
-# Event Handlers & Consumers
-**/UseCaseEvents/**/*{keyword}*.cs
-**/*{keyword}*EventHandler.cs
-**/*{keyword}*Consumer.cs
-
-# Controllers
-**/Controllers/**/*{keyword}*.cs
-**/{Entity}Controller.cs
-
-# Background Jobs
-**/*{keyword}*BackgroundJob*.cs
-**/*{keyword}*Job.cs
-```
-
-**MEDIUM PRIORITY:**
-```
-# Services & Helpers
-**/*{keyword}*Service.cs
-**/*{keyword}*Helper.cs
-
-# DTOs & Shared
-**/*{keyword}*Dto.cs
-**/Shared/**/*{keyword}*.cs
-
-# Frontend Components
-**/*{keyword}*.component.ts
-**/*{keyword}*.store.ts
-**/*{keyword}*-api.service.ts
-```
-
-**LOW PRIORITY:**
-```
-# Tests & Config
-**/*{keyword}*.spec.ts
-**/*{keyword}*Test*.cs
-**/appsettings*.json
-```
-
----
-
-## PHASE 2: PARALLEL EXECUTION
-
-### Step 1: Divide Work
-
-Split directories intelligently for SCALE agents:
-
-| Agent | Focus Area | Directories |
-|-------|------------|-------------|
-| 1 | Backend Core | `src/PlatformExampleApp/*/Domain/`, `*/Application/UseCaseCommands/`, `*/Application/UseCaseQueries/` |
-| 2 | Backend Events/Jobs | `*/Application/UseCaseEvents/`, `*BackgroundJob*`, `*Consumer*`, `Controllers/` |
-| 3 | Frontend | `src/PlatformExampleAppWeb/`, `libs/apps-domains/`, `libs/platform-core/` |
-
-### Step 2: Launch Agents
-
-Spawn SCALE number of `Explore` subagents in **parallel** using Task tool:
-
-```
-For each agent:
-- Assign specific directories from division above
-- Include HIGH PRIORITY patterns for assigned area
-- Set 3-minute timeout
-- Request file paths only (no content)
-```
-
-**Agent Prompt Template:**
-```
-Search [directories] for files related to "[USER_PROMPT]".
-Patterns: [relevant patterns for this agent's focus]
-Return ONLY file paths, categorized by type.
-Timeout: 3 minutes. Be fast and focused.
-```
-
----
-
-## PHASE 3: SYNTHESIZE RESULTS
-
-### Step 1: Collect and Deduplicate
-
-- Gather results from all agents that complete within timeout
-- Skip timed-out agents (note coverage gaps)
-- Remove duplicate file paths
-
-### Step 2: Categorize by Priority
-
-Organize files into structured output:
-
-```markdown
-## Scout Results: [USER_PROMPT]
-
-### Summary
-- **Total Files Found**: X
-- **Agents Completed**: X/SCALE
-- **Coverage Gaps**: [list any timed-out agent areas]
-
----
-
-### HIGH PRIORITY (Analyze First)
-
-#### Domain Entities
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/Entity.cs` | Core domain entity |
-
-#### Commands & Handlers
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/SaveEntityCommand.cs` | Create/Update logic |
-
-#### Queries
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/GetEntityListQuery.cs` | List retrieval |
-
-#### Event Handlers
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/EntityEventHandler.cs` | Side effect handling |
-
-#### Consumers (Cross-Service)
-| # | File | Message Type | Source Service |
-|---|------|--------------|----------------|
-| 1 | `path/EntityConsumer.cs` | `EntityBusMessage` | [grep for producer] |
-
-#### Controllers
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/EntityController.cs` | API endpoints |
-
-#### Background Jobs
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/EntityBackgroundJob.cs` | Scheduled processing |
-
----
-
-### MEDIUM PRIORITY
-
-#### Services & Helpers
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/EntityService.cs` | Business logic |
-
-#### Frontend Components
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/entity-list.component.ts` | UI component |
-
-#### API Services
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/entity-api.service.ts` | HTTP client |
-
----
-
-### LOW PRIORITY
-
-#### Tests & Config
-| # | File | Purpose |
-|---|------|---------|
-| 1 | `path/EntityTest.cs` | Unit tests |
-
----
-
-### Suggested Starting Points
-
-1. **[Most relevant file]** - [Why start here]
-2. **[Second most relevant]** - [Why]
-3. **[Third most relevant]** - [Why]
-
-### Cross-Service Integration (if applicable)
-
-| Source Service | Message | Target Service | Consumer File |
-|----------------|---------|----------------|---------------|
-| ... | ... | ... | ... |
-
-### Unresolved Questions
-
-- [Any gaps or uncertainties]
-```
-
----
-
-## OUTPUT: Handoff to Investigate
-
-**When followed by `/investigate`:**
-
-Your numbered file list becomes the analysis target. The Investigate command will:
-1. **Use your HIGH PRIORITY files** as primary analysis targets
-2. **Reference your file numbers** (e.g., "File #3 from Scout")
-3. **Skip redundant discovery** - trusts your search results
-4. **Follow your Suggested Starting Points** for analysis order
-
-**Ensure your output includes:**
-- ✅ Numbered files in priority tables
-- ✅ Clear "Suggested Starting Points" section
-- ✅ Cross-Service Integration table (for message bus flows)
-- ✅ Purpose column explaining each file's role
-
----
-
-## PHASE 4: CONSUMER CROSS-SERVICE ANALYSIS
-
-**CRITICAL**: For any `*Consumer.cs` files found:
-
-1. Identify the `*BusMessage` type being consumed
-2. Run additional grep across ALL services:
-   ```
-   grep -r "BusMessage" --include="*.cs" src/
-   ```
-3. Find files that **produce/publish** the message
-4. Document in Cross-Service Integration table
-
----
-
-## Quality Standards
-
-| Metric | Target |
-|--------|--------|
-| Speed | < 5 minutes total |
-| Coverage | All relevant directories searched |
-| Accuracy | Only directly relevant files |
-| Structure | Organized by priority category |
-| Actionable | Clear starting points |
-
----
-
-## Error Handling
-
-| Scenario | Action |
-|----------|--------|
-| Agent timeout | Skip, note gap, continue |
-| All agents timeout | Manual fallback with Glob/Grep |
-| Sparse results | Expand patterns, try synonyms |
-| Overwhelming results | Filter to HIGH PRIORITY only |
-
----
-
-## Output Standards
-
-- **IMPORTANT:** Sacrifice grammar for concision
-- **IMPORTANT:** List unresolved questions at end
-- **IMPORTANT:** Number all files for easy reference
-- Use `file:line` format where possible

package/templates/commands/security.md

@@ -1,119 +0,0 @@
-# Security Review: $ARGUMENTS
-
-Perform security review on: $ARGUMENTS
-
-## Phase 1: Scope Identification
-
-1. **Parse target** from: $ARGUMENTS
-2. **Identify components:**
-    - API endpoints (Controllers)
-    - Command/Query handlers
-    - Frontend forms and inputs
-    - Data handling and storage
-    - External integrations
-
-## Phase 2: Security Checklist
-
-### Input Validation
-
-- [ ] All user inputs validated in Commands/Queries `Validate()` method
-- [ ] XSS protection - no raw HTML rendering of user content
-- [ ] SQL/NoSQL injection prevention (parameterized via EF Core/MongoDB driver)
-- [ ] File upload validation (type whitelist, size limits, content scanning)
-- [ ] URL validation for redirects (prevent open redirect)
-
-### Authorization
-
-- [ ] `[PlatformAuthorize]` attribute on sensitive endpoints
-- [ ] Entity-level access checks (company ownership, user permissions)
-- [ ] Role-based permissions verified in handlers:
-    ```csharp
-    RequestContext.HasRole(PlatformRoles.Admin)
-    RequestContext.HasRequestAdminRoleInCompany()
-    ```
-- [ ] Multi-tenancy boundaries respected (CompanyId filtering)
-- [ ] Resource ownership validation before modification
-
-### Sensitive Data Protection
-
-- [ ] No secrets in logs or error messages
-- [ ] PII properly encrypted at rest
-- [ ] Sensitive fields excluded from DTOs/responses
-- [ ] Audit logging for sensitive operations
-- [ ] No credentials in source code or config files
-
-### API Security
-
-- [ ] CORS properly configured (not `*` in production)
-- [ ] Rate limiting on public endpoints
-- [ ] Request size limits configured
-- [ ] Timeout handling to prevent DoS
-- [ ] HTTPS enforced
-
-### Frontend Security
-
-- [ ] No sensitive data in localStorage (use sessionStorage or memory)
-- [ ] XSS-safe rendering (no `innerHTML` with user data, use `[textContent]`)
-- [ ] CSRF tokens for state-changing operations
-- [ ] Proper error messages (no stack traces exposed to users)
-- [ ] Secure cookie flags (HttpOnly, Secure, SameSite)
-
-### Authentication
-
-- [ ] Strong password requirements enforced
-- [ ] Account lockout after failed attempts
-- [ ] Session timeout configured
-- [ ] Secure token storage and transmission
-- [ ] Password reset flow secure (time-limited tokens)
-
-## Phase 3: Common Vulnerability Patterns
-
-### Look for these anti-patterns:
-
-```csharp
-// ❌ Missing authorization
-[HttpPost]
-public async Task<IActionResult> DeleteUser(string userId) // No [PlatformAuthorize]
-
-// ❌ Missing ownership check
-await repository.DeleteAsync(request.Id); // Should verify ownership first
-
-// ❌ Logging sensitive data
-logger.LogInformation($"User {email} logged in with password {password}");
-
-// ❌ SQL injection (rare with EF but check raw queries)
-context.Database.ExecuteSqlRaw($"SELECT * FROM Users WHERE Id = '{id}'");
-```
-
-```typescript
-// ❌ XSS vulnerability
-element.innerHTML = userInput; // Use textContent instead
-
-// ❌ Sensitive data in localStorage
-localStorage.setItem('authToken', token); // Use memory or secure storage
-```
-
-## Phase 4: Report
-
-Present findings with:
-
-- **Severity rating:** Critical / High / Medium / Low / Informational
-- **Affected code locations** with file:line references
-- **Recommended fixes** with code examples
-- **OWASP reference** if applicable
-
-### Severity Guidelines:
-
-- **Critical:** Direct data breach, authentication bypass, RCE
-- **High:** Privilege escalation, sensitive data exposure
-- **Medium:** Missing security controls, information disclosure
-- **Low:** Security best practice violations
-- **Informational:** Suggestions for defense-in-depth
-
-## Phase 5: Wait for Approval
-
-**CRITICAL:** Present your security findings. Wait for explicit user approval before implementing fixes.
-
----
-
-Use `arch-security-review` skill for comprehensive analysis.

package/templates/commands/skill/add.md

@@ -1,36 +0,0 @@
----
-description: Add new reference files or scripts to a skill
-argument-hint: [skill-name] [reference-or-script-prompt]
----
-
-Think harder.
-Use `skill-creator` and `claude-code` skills.
-Use `docs-seeker` skills to search for documentation if needed.
-
-## Arguments
-$1: skill name (required, default: "")
-$2: reference or script prompt (required, default: "")
-If $1 or $2 is not provided, ask the user to provide it.
-
-## Your mission
-Add new reference files or scripts to a skill at `.claude/skills/$1` directory.
-
-## Requirements
-<reference-or-script-prompt>
-$2
-</reference-or-script-prompt>
-
-## Rules of Skill Creation:
-Base on the requirements:
-- Always keep in mind that `SKILL.md` and reference files should be token consumption efficient, so that **progressive disclosure** can be leveraged at best.
-- `SKILL.md` is always short and concise, straight to the point, treat it as a quick reference guide.
-- If you're given nothing, use `AskUserQuestion` tool for clarifications and `researcher` subagent to research about the topic.
-- If you're given an URL, it's documentation page, use `Explore` subagent to explore every internal link and report back to main agent, don't skip any link.
-- If you receive a lot of URLs, use multiple `Explore` subagents to explore them in parallel, then report back to main agent.
-- If you receive a lot of files, use multiple `Explore` subagents to explore them in parallel, then report back to main agent.
-- If you're given a Github URL, use [`repomix`](https://repomix.com/guide/usage) command to summarize ([install it](https://repomix.com/guide/installation) if needed) and spawn multiple `Explore` subagents to explore it in parallel, then report back to main agent.
-
-**IMPORTANT:**
-- Skills are not documentation, they are practical instructions for Claude Code to use the tools, packages, plugins or APIs to achieve the tasks.
-- Each skill teaches Claude how to perform a specific development task, not what a tool does.
-- Claude Code can activate multiple skills automatically to achieve the user's request.

package/templates/commands/skill/create.md

@@ -1,29 +0,0 @@
----
-description: Create a new agent skill
-argument-hint: [prompt-or-llms-or-github-url]
----
-
-Ultrathink.
-Use `skill-creator` and `claude-code` skills.
-Use `docs-seeker` skills to search for documentation if needed.
-
-## Your mission
-Create a new skill in `.claude/skills/` directory.
-
-## Requirements
-<user-prompt>$ARGUMENTS</user-prompt>
-
-## Rules of Skill Creation:
-Base on the requirements:
-- Always keep in mind that `SKILL.md` and reference files should be token consumption efficient, so that **progressive disclosure** can be leveraged at best.
-- `SKILL.md` is always short and concise, straight to the point, treat it as a quick reference guide.
-- If you're given nothing, use `AskUserQuestion` tool for clarifications and `researcher` subagent to research about the topic.
-- If you're given an URL, it's documentation page, use `Explore` subagent to explore every internal link and report back to main agent, don't skip any link.
-- If you receive a lot of URLs, use multiple `Explore` subagents to explore them in parallel, then report back to main agent.
-- If you receive a lot of files, use multiple `Explore` subagents to explore them in parallel, then report back to main agent.
-- If you're given a Github URL, use [`repomix`](https://repomix.com/guide/usage) command to summarize ([install it](https://repomix.com/guide/installation) if needed) and spawn multiple `Explore` subagents to explore it in parallel, then report back to main agent.
-
-**IMPORTANT:**
-- Skills are not documentation, they are practical instructions for Claude Code to use the tools, packages, plugins or APIs to achieve the tasks.
-- Each skill teaches Claude how to perform a specific development task, not what a tool does.
-- Claude Code can activate multiple skills automatically to achieve the user's request.

package/templates/commands/skill/fix-logs.md

@@ -1,22 +0,0 @@
----
-description: Fix the agent skill based on `logs.txt` file.
-argument-hint: [prompt-or-path-to-skill]
----
-
-Think harder.
-Use `skill-creator` and `claude-code` skills.
-Use `docs-seeker` skills to search for documentation if needed.
-
-## Your mission
-Fix the agent skill based on the current `logs.txt` file (in the project root directory).
-
-## Requirements
-<user-prompt>$ARGUMENTS</user-prompt>
-
-## Rules of Skill Fixing:
-Base on the requirements:
-- If you're given nothing, use `AskUserQuestion` tool for clarifications and `researcher` subagent to research about the topic.
-- If you're given an URL, it's documentation page, use `Explorer` subagent to explore every internal link and report back to main agent, don't skip any link.
-- If you receive a lot of URLs, use multiple `Explorer` subagents to explore them in parallel, then report back to main agent.
-- If you receive a lot of files, use multiple `Explorer` subagents to explore them in parallel, then report back to main agent.
-- If you're given a Github URL, use [`repomix`](https://repomix.com/guide/usage) command to summarize ([install it](https://repomix.com/guide/installation) if needed) and spawn multiple `Explorer` subagents to explore it in parallel, then report back to main agent.

package/templates/commands/skill/optimize/auto.md

@@ -1,25 +0,0 @@
----
-description: Optimize an existing agent skill [auto]
-argument-hint: [skill-name] [prompt]
----
-
-Think harder.
-Use `skill-creator` and `claude-code` skills.
-Use `docs-seeker` skills to search for documentation if needed.
-
-## Arguments
-SKILL: $1 (default: `*`)
-PROMPT: $2 (default: empty)
-
-## Your mission
-Optimize an existing skill in `.claude/skills/${SKILL}` directory. 
-Always keep in mind that `SKILL.md` and reference files should be token consumption efficient, so that **progressive disclosure** can be leveraged at best.
-`SKILL.md` is always short and concise, straight to the point, treat it as a quick reference guide.
-
-**IMPORTANT:**
-- Skills are not documentation, they are practical instructions for Claude Code to use the tools, packages, plugins or APIs to achieve the tasks.
-- Each skill teaches Claude how to perform a specific development task, not what a tool does.
-- Claude Code can activate multiple skills automatically to achieve the user's request.
-
-## Additional instructions
-<additional-instructions>$PROMPT</additional-instructions>

package/templates/commands/skill/optimize.md

@@ -1,34 +0,0 @@
----
-description: Optimize an existing agent skill
-argument-hint: [skill-name] [prompt]
----
-
-Think harder.
-Use `skill-creator` and `claude-code` skills.
-Use `docs-seeker` skills to search for documentation if needed.
-
-## Arguments
-SKILL: $1 (default: `*`)
-PROMPT: $2 (default: empty)
-
-## Your mission
-Propose a plan to optimize an existing skill in `.claude/skills/${SKILL}` directory. 
-When you finish, ask user to review your plan:
-- If the user approve: Write down a plan follow "Output Requirements", then ask user if they want to start implementing.
-- If the user reject: Revise the plan or ask more questions to clarify more about the user's request (ask one question at the time), then repeat the review process.
-
-## Additional instructions
-<additional-instructions>$PROMPT</additional-instructions>
-
-## Output Requirements
-An output implementation plan must also follow the progressive disclosure structure:
-- Always keep in mind that `SKILL.md` and reference files should be token consumption efficient, so that **progressive disclosure** can be leveraged at best.
-- `SKILL.md` is always short and concise, straight to the point, treat it as a quick reference guide.
-- Create a directory using naming pattern from `## Naming` section.
-- Save the overview access point at `plan.md`, keep it generic, under 80 lines, and list each phase with status/progress and links.
-- For each phase, add `phase-XX-phase-name.md` files containing sections (Context links, Overview with date/priority/statuses, Key Insights, Requirements, Architecture, Related code files, Implementation Steps, Todo list, Success Criteria, Risk Assessment, Security Considerations, Next steps).
-
-**IMPORTANT:**
-- Skills are not documentation, they are practical instructions for Claude Code to use the tools, packages, plugins or APIs to achieve the tasks.
-- Each skill teaches Claude how to perform a specific development task, not what a tool does.
-- Claude Code can activate multiple skills automatically to achieve the user's request.

package/templates/commands/skill/plan.md

@@ -1,45 +0,0 @@
----
-description: Plan to create a new agent skill
-argument-hint: [skill-name] [prompt]
----
-
-Think harder.
-First: Activate `skill-creator` and `claude-code` skills.
-Use `docs-seeker` skills to search for documentation if needed.
-Employ `sequential-thinking` or `problem-solving` skills for complex problem-solving that requires structured analysis
-Finally, when creating a plan, activate `planning` skill.
-
-## Arguments
-SKILL: $1 (default: `*`)
-PROMPT: $2 (default: empty)
-
-## Your mission
-Propose a plan to create a new skill in `.claude/skills/${SKILL}` directory. 
-When you finish, ask user to review your plan:
-- If the user approve: Write down a plan follow "Output Requirements", then ask user if they want to start implementing.
-- If the user reject: Revise the plan or ask more questions to clarify more about the user's request (ask one question at the time), then repeat the review process.
-
-## Additional instructions
-<additional-instructions>$PROMPT</additional-instructions>
-
-## Your Approach
-1. **Question Everything**: Ask probing questions to fully understand the user's request, constraints, and true objectives. Don't assume - clarify until you're 100% certain.
-2. **Brutal Honesty**: Provide frank, unfiltered feedback about ideas. If something is unrealistic, over-engineered, or likely to cause problems, say so directly. Your job is to prevent costly mistakes.
-3. **Explore Alternatives**: Always consider multiple approaches. Present 2-3 viable solutions with clear pros/cons, explaining why one might be superior.
-4. **Challenge Assumptions**: Question the user's initial approach. Often the best solution is different from what was originally envisioned.
-5. **Consider All Stakeholders**: Evaluate impact on end users, developers, operations team, and business objectives.
-
-## Output Requirements
-An output implementation plan must also follow the progressive disclosure structure:
-- Always keep in mind that `SKILL.md` and reference files should be token consumption efficient, so that **progressive disclosure** can be leveraged at best.
-- `SKILL.md` is always short and concise, straight to the point, treat it as a quick reference guide.
-- Create a directory using naming pattern from `## Naming` section.
-- Save the overview access point at `plan.md`, keep it generic, under 80 lines, and list each phase with status/progress and links.
-- For each phase, add `phase-XX-phase-name.md` files containing sections (Context links, Overview with date/priority/statuses, Key Insights, Requirements, Architecture, Related code files, Implementation Steps, Todo list, Success Criteria, Risk Assessment, Security Considerations, Next steps).
-
-**IMPORTANT:**
-- Analyze the given task and use `AskUserQuestion` tool to ask for more details if needed.
-- Ensure token consumption efficiency while maintaining high quality.
-- Skills are not documentation, they are practical instructions for Claude Code to use the tools, packages, plugins or APIs to achieve the tasks.
-- Each skill teaches Claude how to perform a specific development task, not what a tool does.
-- Claude Code can activate multiple skills automatically to achieve the user's request.