thanh-kit 2.5.0

package/templates/commands/review.md

@@ -0,0 +1,56 @@
+# Code Review: $ARGUMENTS
+
+Perform a comprehensive code review following EasyPlatform standards.
+
+## Review Scope
+
+Target: $ARGUMENTS (can be a PR number, file path, or branch name)
+
+## Review Checklist
+
+### 1. Architecture Compliance
+- [ ] Follows Clean Architecture layers (Domain, Application, Persistence, Service)
+- [ ] Uses correct repository pattern (I{Service}RootRepository<T>)
+- [ ] CQRS pattern: Command/Query + Handler + Result in ONE file
+- [ ] No cross-service direct database access
+
+### 2. Code Quality
+- [ ] Single Responsibility Principle
+- [ ] No code duplication
+- [ ] Meaningful variable/method names
+- [ ] Appropriate error handling with PlatformValidationResult
+
+### 3. Platform Patterns
+- [ ] Uses platform validation fluent API (.And(), .AndAsync())
+- [ ] No direct side effects in command handlers (use entity events)
+- [ ] DTO mapping in DTO classes, not handlers
+- [ ] Static expressions for entity queries
+
+### 4. Security
+- [ ] No hardcoded credentials
+- [ ] Proper authorization checks
+- [ ] Input validation at boundaries
+- [ ] No SQL injection risks
+
+### 5. Performance
+- [ ] Parallel operations where independent
+- [ ] Proper pagination for lists
+- [ ] No N+1 query patterns
+- [ ] Appropriate use of async/await
+
+## Output Format
+
+Provide feedback in this format:
+
+**Summary:** Brief overall assessment
+
+**Critical Issues:** (Must fix)
+- Issue 1: Description and suggested fix
+- Issue 2: Description and suggested fix
+
+**Suggestions:** (Nice to have)
+- Suggestion 1
+- Suggestion 2
+
+**Positive Notes:**
+- What was done well

package/templates/commands/scout/ext.md

@@ -0,0 +1,35 @@
+---
+description: ⚡ Use external agentic tools to scout given directories
+argument-hint: [user-prompt] [scale]
+---
+
+## Purpose
+
+Utilize external agentic tools to scout given directories or explore the codebase for files needed to complete the task using a fast, token efficient agent.
+
+## Variables
+
+USER_PROMPT: $1
+SCALE: $2 (defaults to 3)
+RELEVANT_FILE_OUTPUT_DIR: Use `Report:` from `## Naming` section
+
+## Workflow:
+- Write a prompt for 'SCALE' number of agents to the `Task` tool that will immediately call the `Bash` tool to run these commands to kick off your agents to conduct the search:
+  - `gemini -p "[prompt]" --model gemini-2.5-flash-preview-09-2025` (if count <= 3)
+  - `opencode run "[prompt]" --model opencode/grok-code` (if count > 3 and count < 6)
+  - if count >= 6, spawn `Explore` subagents to search the codebase in parallel
+
+**Why use external agentic tools?**
+- External agentic tools are faster and more efficient when using LLMs with large context windows (1M+ tokens).
+
+**How to prompt the agents:**
+- If `gemini` or `opencode` is not available, ask the user if they want to install it:
+  - If **yes**, install it (if there are permission issues, instruct the user to install it manually, including authentication steps)
+  - If **no**, use the default `Explore` subagents.
+- IMPORTANT: Kick these agents off in parallel using the `Task` tool, analyze and divide folders for each agent to scout intelligently and quickly.
+- IMPORTANT: These agents are calling OTHER agentic coding tools to search the codebase. DO NOT call any search tools yourself.
+- IMPORTANT: That means with the `Task` tool, you'll immediately call the Bash tool to run the respective agentic coding tool (gemini, opencode, claude, etc.)
+- IMPORTANT: Instruct the agents to quickly search the codebase for files needed to complete the task. This isn't about a full blown search, just a quick search to find the files needed to complete the task.
+- Instruct the subagent to use a timeout of 3 minutes for each agent's bash call. Skip any agents that don't return within the timeout, don't restart them.
+- **IMPORTANT:** Sacrifice grammar for the sake of concision when writing reports.
+- **IMPORTANT:** In reports, list any unresolved questions at the end, if any.

package/templates/commands/scout.md

@@ -0,0 +1,283 @@
+---
+description: ⚡⚡ Scout codebase with priority-based file discovery and structured output
+argument-hint: [user-prompt] [scale]
+---
+
+## Purpose
+
+Search the codebase for files needed to complete the task using fast, token-efficient parallel agents with **priority-based categorization**.
+
+## Variables
+
+- **USER_PROMPT**: $1
+- **SCALE**: $2 (defaults to 3)
+- **REPORT_OUTPUT_DIR**: Use `Report:` from `## Naming` section
+
+---
+
+## PHASE 1: ANALYZE AND PLAN
+
+### Step 1: Parse Search Request
+
+Extract from USER_PROMPT:
+- **Keywords**: Entity names, feature names, patterns
+- **Intent**: CRUD, investigation, debugging, implementation
+- **Scope**: Backend, Frontend, Cross-service, Full-stack
+
+### Step 2: Generate Search Patterns
+
+**HIGH PRIORITY (Always Search):**
+```
+# Domain Entities
+**/Domain/Entities/**/*{keyword}*.cs
+**/{Entity}.cs
+
+# CQRS Commands & Queries
+**/UseCaseCommands/**/*{keyword}*.cs
+**/UseCaseQueries/**/*{keyword}*.cs
+**/Save{Entity}Command.cs
+**/Get{Entity}*Query.cs
+
+# Event Handlers & Consumers
+**/UseCaseEvents/**/*{keyword}*.cs
+**/*{keyword}*EventHandler.cs
+**/*{keyword}*Consumer.cs
+
+# Controllers
+**/Controllers/**/*{keyword}*.cs
+**/{Entity}Controller.cs
+
+# Background Jobs
+**/*{keyword}*BackgroundJob*.cs
+**/*{keyword}*Job.cs
+```
+
+**MEDIUM PRIORITY:**
+```
+# Services & Helpers
+**/*{keyword}*Service.cs
+**/*{keyword}*Helper.cs
+
+# DTOs & Shared
+**/*{keyword}*Dto.cs
+**/Shared/**/*{keyword}*.cs
+
+# Frontend Components
+**/*{keyword}*.component.ts
+**/*{keyword}*.store.ts
+**/*{keyword}*-api.service.ts
+```
+
+**LOW PRIORITY:**
+```
+# Tests & Config
+**/*{keyword}*.spec.ts
+**/*{keyword}*Test*.cs
+**/appsettings*.json
+```
+
+---
+
+## PHASE 2: PARALLEL EXECUTION
+
+### Step 1: Divide Work
+
+Split directories intelligently for SCALE agents:
+
+| Agent | Focus Area | Directories |
+|-------|------------|-------------|
+| 1 | Backend Core | `src/PlatformExampleApp/*/Domain/`, `*/Application/UseCaseCommands/`, `*/Application/UseCaseQueries/` |
+| 2 | Backend Events/Jobs | `*/Application/UseCaseEvents/`, `*BackgroundJob*`, `*Consumer*`, `Controllers/` |
+| 3 | Frontend | `src/PlatformExampleAppWeb/`, `libs/apps-domains/`, `libs/platform-core/` |
+
+### Step 2: Launch Agents
+
+Spawn SCALE number of `Explore` subagents in **parallel** using Task tool:
+
+```
+For each agent:
+- Assign specific directories from division above
+- Include HIGH PRIORITY patterns for assigned area
+- Set 3-minute timeout
+- Request file paths only (no content)
+```
+
+**Agent Prompt Template:**
+```
+Search [directories] for files related to "[USER_PROMPT]".
+Patterns: [relevant patterns for this agent's focus]
+Return ONLY file paths, categorized by type.
+Timeout: 3 minutes. Be fast and focused.
+```
+
+---
+
+## PHASE 3: SYNTHESIZE RESULTS
+
+### Step 1: Collect and Deduplicate
+
+- Gather results from all agents that complete within timeout
+- Skip timed-out agents (note coverage gaps)
+- Remove duplicate file paths
+
+### Step 2: Categorize by Priority
+
+Organize files into structured output:
+
+```markdown
+## Scout Results: [USER_PROMPT]
+
+### Summary
+- **Total Files Found**: X
+- **Agents Completed**: X/SCALE
+- **Coverage Gaps**: [list any timed-out agent areas]
+
+---
+
+### HIGH PRIORITY (Analyze First)
+
+#### Domain Entities
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/Entity.cs` | Core domain entity |
+
+#### Commands & Handlers
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/SaveEntityCommand.cs` | Create/Update logic |
+
+#### Queries
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/GetEntityListQuery.cs` | List retrieval |
+
+#### Event Handlers
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/EntityEventHandler.cs` | Side effect handling |
+
+#### Consumers (Cross-Service)
+| # | File | Message Type | Source Service |
+|---|------|--------------|----------------|
+| 1 | `path/EntityConsumer.cs` | `EntityBusMessage` | [grep for producer] |
+
+#### Controllers
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/EntityController.cs` | API endpoints |
+
+#### Background Jobs
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/EntityBackgroundJob.cs` | Scheduled processing |
+
+---
+
+### MEDIUM PRIORITY
+
+#### Services & Helpers
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/EntityService.cs` | Business logic |
+
+#### Frontend Components
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/entity-list.component.ts` | UI component |
+
+#### API Services
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/entity-api.service.ts` | HTTP client |
+
+---
+
+### LOW PRIORITY
+
+#### Tests & Config
+| # | File | Purpose |
+|---|------|---------|
+| 1 | `path/EntityTest.cs` | Unit tests |
+
+---
+
+### Suggested Starting Points
+
+1. **[Most relevant file]** - [Why start here]
+2. **[Second most relevant]** - [Why]
+3. **[Third most relevant]** - [Why]
+
+### Cross-Service Integration (if applicable)
+
+| Source Service | Message | Target Service | Consumer File |
+|----------------|---------|----------------|---------------|
+| ... | ... | ... | ... |
+
+### Unresolved Questions
+
+- [Any gaps or uncertainties]
+```
+
+---
+
+## OUTPUT: Handoff to Investigate
+
+**When followed by `/investigate`:**
+
+Your numbered file list becomes the analysis target. The Investigate command will:
+1. **Use your HIGH PRIORITY files** as primary analysis targets
+2. **Reference your file numbers** (e.g., "File #3 from Scout")
+3. **Skip redundant discovery** - trusts your search results
+4. **Follow your Suggested Starting Points** for analysis order
+
+**Ensure your output includes:**
+- ✅ Numbered files in priority tables
+- ✅ Clear "Suggested Starting Points" section
+- ✅ Cross-Service Integration table (for message bus flows)
+- ✅ Purpose column explaining each file's role
+
+---
+
+## PHASE 4: CONSUMER CROSS-SERVICE ANALYSIS
+
+**CRITICAL**: For any `*Consumer.cs` files found:
+
+1. Identify the `*BusMessage` type being consumed
+2. Run additional grep across ALL services:
+   ```
+   grep -r "BusMessage" --include="*.cs" src/
+   ```
+3. Find files that **produce/publish** the message
+4. Document in Cross-Service Integration table
+
+---
+
+## Quality Standards
+
+| Metric | Target |
+|--------|--------|
+| Speed | < 5 minutes total |
+| Coverage | All relevant directories searched |
+| Accuracy | Only directly relevant files |
+| Structure | Organized by priority category |
+| Actionable | Clear starting points |
+
+---
+
+## Error Handling
+
+| Scenario | Action |
+|----------|--------|
+| Agent timeout | Skip, note gap, continue |
+| All agents timeout | Manual fallback with Glob/Grep |
+| Sparse results | Expand patterns, try synonyms |
+| Overwhelming results | Filter to HIGH PRIORITY only |
+
+---
+
+## Output Standards
+
+- **IMPORTANT:** Sacrifice grammar for concision
+- **IMPORTANT:** List unresolved questions at end
+- **IMPORTANT:** Number all files for easy reference
+- Use `file:line` format where possible

package/templates/commands/security.md

@@ -0,0 +1,119 @@
+# Security Review: $ARGUMENTS
+
+Perform security review on: $ARGUMENTS
+
+## Phase 1: Scope Identification
+
+1. **Parse target** from: $ARGUMENTS
+2. **Identify components:**
+    - API endpoints (Controllers)
+    - Command/Query handlers
+    - Frontend forms and inputs
+    - Data handling and storage
+    - External integrations
+
+## Phase 2: Security Checklist
+
+### Input Validation
+
+- [ ] All user inputs validated in Commands/Queries `Validate()` method
+- [ ] XSS protection - no raw HTML rendering of user content
+- [ ] SQL/NoSQL injection prevention (parameterized via EF Core/MongoDB driver)
+- [ ] File upload validation (type whitelist, size limits, content scanning)
+- [ ] URL validation for redirects (prevent open redirect)
+
+### Authorization
+
+- [ ] `[PlatformAuthorize]` attribute on sensitive endpoints
+- [ ] Entity-level access checks (company ownership, user permissions)
+- [ ] Role-based permissions verified in handlers:
+    ```csharp
+    RequestContext.HasRole(PlatformRoles.Admin)
+    RequestContext.HasRequestAdminRoleInCompany()
+    ```
+- [ ] Multi-tenancy boundaries respected (CompanyId filtering)
+- [ ] Resource ownership validation before modification
+
+### Sensitive Data Protection
+
+- [ ] No secrets in logs or error messages
+- [ ] PII properly encrypted at rest
+- [ ] Sensitive fields excluded from DTOs/responses
+- [ ] Audit logging for sensitive operations
+- [ ] No credentials in source code or config files
+
+### API Security
+
+- [ ] CORS properly configured (not `*` in production)
+- [ ] Rate limiting on public endpoints
+- [ ] Request size limits configured
+- [ ] Timeout handling to prevent DoS
+- [ ] HTTPS enforced
+
+### Frontend Security
+
+- [ ] No sensitive data in localStorage (use sessionStorage or memory)
+- [ ] XSS-safe rendering (no `innerHTML` with user data, use `[textContent]`)
+- [ ] CSRF tokens for state-changing operations
+- [ ] Proper error messages (no stack traces exposed to users)
+- [ ] Secure cookie flags (HttpOnly, Secure, SameSite)
+
+### Authentication
+
+- [ ] Strong password requirements enforced
+- [ ] Account lockout after failed attempts
+- [ ] Session timeout configured
+- [ ] Secure token storage and transmission
+- [ ] Password reset flow secure (time-limited tokens)
+
+## Phase 3: Common Vulnerability Patterns
+
+### Look for these anti-patterns:
+
+```csharp
+// ❌ Missing authorization
+[HttpPost]
+public async Task<IActionResult> DeleteUser(string userId) // No [PlatformAuthorize]
+
+// ❌ Missing ownership check
+await repository.DeleteAsync(request.Id); // Should verify ownership first
+
+// ❌ Logging sensitive data
+logger.LogInformation($"User {email} logged in with password {password}");
+
+// ❌ SQL injection (rare with EF but check raw queries)
+context.Database.ExecuteSqlRaw($"SELECT * FROM Users WHERE Id = '{id}'");
+```
+
+```typescript
+// ❌ XSS vulnerability
+element.innerHTML = userInput; // Use textContent instead
+
+// ❌ Sensitive data in localStorage
+localStorage.setItem('authToken', token); // Use memory or secure storage
+```
+
+## Phase 4: Report
+
+Present findings with:
+
+- **Severity rating:** Critical / High / Medium / Low / Informational
+- **Affected code locations** with file:line references
+- **Recommended fixes** with code examples
+- **OWASP reference** if applicable
+
+### Severity Guidelines:
+
+- **Critical:** Direct data breach, authentication bypass, RCE
+- **High:** Privilege escalation, sensitive data exposure
+- **Medium:** Missing security controls, information disclosure
+- **Low:** Security best practice violations
+- **Informational:** Suggestions for defense-in-depth
+
+## Phase 5: Wait for Approval
+
+**CRITICAL:** Present your security findings. Wait for explicit user approval before implementing fixes.
+
+---
+
+Use `arch-security-review` skill for comprehensive analysis.

package/templates/commands/skill/add.md

@@ -0,0 +1,36 @@
+---
+description: Add new reference files or scripts to a skill
+argument-hint: [skill-name] [reference-or-script-prompt]
+---
+
+Think harder.
+Use `skill-creator` and `claude-code` skills.
+Use `docs-seeker` skills to search for documentation if needed.
+
+## Arguments
+$1: skill name (required, default: "")
+$2: reference or script prompt (required, default: "")
+If $1 or $2 is not provided, ask the user to provide it.
+
+## Your mission
+Add new reference files or scripts to a skill at `.claude/skills/$1` directory.
+
+## Requirements
+<reference-or-script-prompt>
+$2
+</reference-or-script-prompt>
+
+## Rules of Skill Creation:
+Base on the requirements:
+- Always keep in mind that `SKILL.md` and reference files should be token consumption efficient, so that **progressive disclosure** can be leveraged at best.
+- `SKILL.md` is always short and concise, straight to the point, treat it as a quick reference guide.
+- If you're given nothing, use `AskUserQuestion` tool for clarifications and `researcher` subagent to research about the topic.
+- If you're given an URL, it's documentation page, use `Explore` subagent to explore every internal link and report back to main agent, don't skip any link.
+- If you receive a lot of URLs, use multiple `Explore` subagents to explore them in parallel, then report back to main agent.
+- If you receive a lot of files, use multiple `Explore` subagents to explore them in parallel, then report back to main agent.
+- If you're given a Github URL, use [`repomix`](https://repomix.com/guide/usage) command to summarize ([install it](https://repomix.com/guide/installation) if needed) and spawn multiple `Explore` subagents to explore it in parallel, then report back to main agent.
+
+**IMPORTANT:**
+- Skills are not documentation, they are practical instructions for Claude Code to use the tools, packages, plugins or APIs to achieve the tasks.
+- Each skill teaches Claude how to perform a specific development task, not what a tool does.
+- Claude Code can activate multiple skills automatically to achieve the user's request.

package/templates/commands/skill/create.md

@@ -0,0 +1,29 @@
+---
+description: Create a new agent skill
+argument-hint: [prompt-or-llms-or-github-url]
+---
+
+Ultrathink.
+Use `skill-creator` and `claude-code` skills.
+Use `docs-seeker` skills to search for documentation if needed.
+
+## Your mission
+Create a new skill in `.claude/skills/` directory.
+
+## Requirements
+<user-prompt>$ARGUMENTS</user-prompt>
+
+## Rules of Skill Creation:
+Base on the requirements:
+- Always keep in mind that `SKILL.md` and reference files should be token consumption efficient, so that **progressive disclosure** can be leveraged at best.
+- `SKILL.md` is always short and concise, straight to the point, treat it as a quick reference guide.
+- If you're given nothing, use `AskUserQuestion` tool for clarifications and `researcher` subagent to research about the topic.
+- If you're given an URL, it's documentation page, use `Explore` subagent to explore every internal link and report back to main agent, don't skip any link.
+- If you receive a lot of URLs, use multiple `Explore` subagents to explore them in parallel, then report back to main agent.
+- If you receive a lot of files, use multiple `Explore` subagents to explore them in parallel, then report back to main agent.
+- If you're given a Github URL, use [`repomix`](https://repomix.com/guide/usage) command to summarize ([install it](https://repomix.com/guide/installation) if needed) and spawn multiple `Explore` subagents to explore it in parallel, then report back to main agent.
+
+**IMPORTANT:**
+- Skills are not documentation, they are practical instructions for Claude Code to use the tools, packages, plugins or APIs to achieve the tasks.
+- Each skill teaches Claude how to perform a specific development task, not what a tool does.
+- Claude Code can activate multiple skills automatically to achieve the user's request.

package/templates/commands/skill/fix-logs.md

@@ -0,0 +1,22 @@
+---
+description: Fix the agent skill based on `logs.txt` file.
+argument-hint: [prompt-or-path-to-skill]
+---
+
+Think harder.
+Use `skill-creator` and `claude-code` skills.
+Use `docs-seeker` skills to search for documentation if needed.
+
+## Your mission
+Fix the agent skill based on the current `logs.txt` file (in the project root directory).
+
+## Requirements
+<user-prompt>$ARGUMENTS</user-prompt>
+
+## Rules of Skill Fixing:
+Base on the requirements:
+- If you're given nothing, use `AskUserQuestion` tool for clarifications and `researcher` subagent to research about the topic.
+- If you're given an URL, it's documentation page, use `Explorer` subagent to explore every internal link and report back to main agent, don't skip any link.
+- If you receive a lot of URLs, use multiple `Explorer` subagents to explore them in parallel, then report back to main agent.
+- If you receive a lot of files, use multiple `Explorer` subagents to explore them in parallel, then report back to main agent.
+- If you're given a Github URL, use [`repomix`](https://repomix.com/guide/usage) command to summarize ([install it](https://repomix.com/guide/installation) if needed) and spawn multiple `Explorer` subagents to explore it in parallel, then report back to main agent.

package/templates/commands/skill/optimize/auto.md

@@ -0,0 +1,25 @@
+---
+description: Optimize an existing agent skill [auto]
+argument-hint: [skill-name] [prompt]
+---
+
+Think harder.
+Use `skill-creator` and `claude-code` skills.
+Use `docs-seeker` skills to search for documentation if needed.
+
+## Arguments
+SKILL: $1 (default: `*`)
+PROMPT: $2 (default: empty)
+
+## Your mission
+Optimize an existing skill in `.claude/skills/${SKILL}` directory. 
+Always keep in mind that `SKILL.md` and reference files should be token consumption efficient, so that **progressive disclosure** can be leveraged at best.
+`SKILL.md` is always short and concise, straight to the point, treat it as a quick reference guide.
+
+**IMPORTANT:**
+- Skills are not documentation, they are practical instructions for Claude Code to use the tools, packages, plugins or APIs to achieve the tasks.
+- Each skill teaches Claude how to perform a specific development task, not what a tool does.
+- Claude Code can activate multiple skills automatically to achieve the user's request.
+
+## Additional instructions
+<additional-instructions>$PROMPT</additional-instructions>

package/templates/commands/skill/optimize.md

@@ -0,0 +1,34 @@
+---
+description: Optimize an existing agent skill
+argument-hint: [skill-name] [prompt]
+---
+
+Think harder.
+Use `skill-creator` and `claude-code` skills.
+Use `docs-seeker` skills to search for documentation if needed.
+
+## Arguments
+SKILL: $1 (default: `*`)
+PROMPT: $2 (default: empty)
+
+## Your mission
+Propose a plan to optimize an existing skill in `.claude/skills/${SKILL}` directory. 
+When you finish, ask user to review your plan:
+- If the user approve: Write down a plan follow "Output Requirements", then ask user if they want to start implementing.
+- If the user reject: Revise the plan or ask more questions to clarify more about the user's request (ask one question at the time), then repeat the review process.
+
+## Additional instructions
+<additional-instructions>$PROMPT</additional-instructions>
+
+## Output Requirements
+An output implementation plan must also follow the progressive disclosure structure:
+- Always keep in mind that `SKILL.md` and reference files should be token consumption efficient, so that **progressive disclosure** can be leveraged at best.
+- `SKILL.md` is always short and concise, straight to the point, treat it as a quick reference guide.
+- Create a directory using naming pattern from `## Naming` section.
+- Save the overview access point at `plan.md`, keep it generic, under 80 lines, and list each phase with status/progress and links.
+- For each phase, add `phase-XX-phase-name.md` files containing sections (Context links, Overview with date/priority/statuses, Key Insights, Requirements, Architecture, Related code files, Implementation Steps, Todo list, Success Criteria, Risk Assessment, Security Considerations, Next steps).
+
+**IMPORTANT:**
+- Skills are not documentation, they are practical instructions for Claude Code to use the tools, packages, plugins or APIs to achieve the tasks.
+- Each skill teaches Claude how to perform a specific development task, not what a tool does.
+- Claude Code can activate multiple skills automatically to achieve the user's request.