wize-dev-kit 0.7.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +10 -0
- package/README.es.md +226 -0
- package/README.md +90 -52
- package/README.pt-BR.md +226 -0
- package/package.json +3 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,16 @@ Format inspired by [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
|
|
5
5
|
|
|
6
6
|
## [Unreleased]
|
|
7
7
|
|
|
8
|
+
## [0.7.1] — 2026-06-21
|
|
9
|
+
|
|
10
|
+
### Changed
|
|
11
|
+
|
|
12
|
+
- **README reescrito** com TL;DR, perfil **Wize Security** na tabela, seção dedicada do AI Pentester (como funciona + garantias de design), roster com 10 agentes (red-teamer), `.wize/security/` no layout e status atualizado para v0.7.x.
|
|
13
|
+
|
|
14
|
+
### Added
|
|
15
|
+
|
|
16
|
+
- **Traduções do README:** `README.pt-BR.md` (Português) e `README.es.md` (Español), com seletor de idioma cruzado. Incluídos no pacote npm.
|
|
17
|
+
|
|
8
18
|
## [0.7.0] — 2026-06-21
|
|
9
19
|
|
|
10
20
|
### Added
|
package/README.es.md
ADDED
|
@@ -0,0 +1,226 @@
|
|
|
1
|
+
# Wize Development Kit
|
|
2
|
+
|
|
3
|
+
> **Kit de desarrollo asistido por IA, de ciclo completo** — lleva un proyecto del brief a la implementación testeada mediante 10 agentes especializados, con un Test Architect, un estudio de UX Whiteport y un Pentester de IA integrados. Funciona dentro de tu IDE con IA.
|
|
4
|
+
|
|
5
|
+
[](https://www.npmjs.com/package/wize-dev-kit)
|
|
6
|
+
[](LICENSE)
|
|
7
|
+
[](#estado)
|
|
8
|
+
[](https://github.com/qwize-br/wize-development-kit)
|
|
9
|
+
|
|
10
|
+
**🌐 Idiomas:** [English](README.md) · [Português (pt-BR)](README.pt-BR.md) · **Español**
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## Resumen rápido
|
|
15
|
+
|
|
16
|
+
```bash
|
|
17
|
+
npx wize-dev-kit install
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
Elige tus perfiles y tu IDE; luego, en tu IDE con IA, di *"Activa a Wizer y dale el briefing del proyecto."* Wizer te guía por el agente adecuado en cada fase — brief, PRD, UX, arquitectura, código testeado — y (opcionalmente) ejecuta un pentest de IA sobre tu aplicación.
|
|
21
|
+
|
|
22
|
+
---
|
|
23
|
+
|
|
24
|
+
## Qué es
|
|
25
|
+
|
|
26
|
+
Wize Development Kit (WDK) es un **stack de agentes de IA** instalable que funciona dentro de tu IDE con IA (Claude Code, Cursor, Windsurf, Codex y otros) y escribe artefactos estructurados en una carpeta oculta `.wize/` de tu repositorio. Lleva un proyecto de **brief → PRD → estrategia de UX → arquitectura → implementación testeada**, y también puede **hacer pentest de la app en ejecución y planificar el sprint de remediación**.
|
|
27
|
+
|
|
28
|
+
Es **file-first y zero-runtime**: los agentes son skills en Markdown que tu IDE lee; el tooling es Node puro (sin nuevas dependencias npm). Nada está simulado — cada paso lee el artefacto anterior y escribe uno real.
|
|
29
|
+
|
|
30
|
+
### Perfiles (combinables en monorepos)
|
|
31
|
+
|
|
32
|
+
| Perfil | Qué añade |
|
|
33
|
+
|---|---|
|
|
34
|
+
| **Wize Dev Core** | Ciclo completo (análisis → plan → solución → implementación) + Test Architect + UX Whiteport + Agent Builder. Siempre instalado. |
|
|
35
|
+
| **Wize Web Dev** *(overlay)* | Scaffolds web, SEO, analytics, playbook WCAG para Mantis, Playwright/Vitest para Hawkeye. |
|
|
36
|
+
| **Wize App Development** *(overlay)* | Scaffolds móviles, ficha de tienda, directrices de plataforma (HIG / Material 3), Detox/Maestro para Hawkeye. |
|
|
37
|
+
| **Wize Security** *(overlay)* 🆕 | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conducido por la persona `red-teamer`, con gate de alcance, clasificación OWASP/CVSS e informe ejecutivo. |
|
|
38
|
+
|
|
39
|
+
---
|
|
40
|
+
|
|
41
|
+
## Instalación
|
|
42
|
+
|
|
43
|
+
En cualquier repositorio, nuevo o existente (greenfield o brownfield):
|
|
44
|
+
|
|
45
|
+
```bash
|
|
46
|
+
npx wize-dev-kit install
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
O directamente desde GitHub (sin necesidad de npm):
|
|
50
|
+
|
|
51
|
+
```bash
|
|
52
|
+
npx github:qwize-br/wize-development-kit install
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
El instalador pregunta:
|
|
56
|
+
|
|
57
|
+
1. **Perfil(es)** — Core / +Web / +App / +Security (selección múltiple).
|
|
58
|
+
2. **IDE(s) objetivo** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity o fallback genérico (selección múltiple).
|
|
59
|
+
3. **Idiomas** — comunicación + salida de documentos.
|
|
60
|
+
4. **Carpeta de salida** — por defecto `.wize/`.
|
|
61
|
+
5. **Brownfield** — ofrece ejecutar `wize-document-project` para crear la baseline del código existente.
|
|
62
|
+
|
|
63
|
+
Tras instalar, abre tu IDE y di:
|
|
64
|
+
|
|
65
|
+
> "Activa a Wizer y dale el briefing del proyecto."
|
|
66
|
+
|
|
67
|
+
---
|
|
68
|
+
|
|
69
|
+
## El elenco
|
|
70
|
+
|
|
71
|
+
| # | Persona | Código | Rol |
|
|
72
|
+
|---|---|---|---|
|
|
73
|
+
| 1 | **Wizer** | `wize-orchestrator` | Orquestador, base de conocimiento, briefing, enrutamiento |
|
|
74
|
+
| 2 | **Pepper Potts** | `wize-agent-analyst` | Analista de Negocio + WDS Saga (brief de producto, trigger map) |
|
|
75
|
+
| 3 | **Peggy Carter** | `wize-agent-tech-writer` | Redactora Técnica (transversal) |
|
|
76
|
+
| 4 | **Maria Hill** | `wize-agent-pm` | Product Manager (PRD, epics, sprints) |
|
|
77
|
+
| 5 | **Mantis** | `wize-agent-ux-designer` | UX Designer + WDS Freya (escenarios, diseño, design system) |
|
|
78
|
+
| 6 | **Nick Fury** | `wize-agent-solution-strategist` | Estrategia de Solución, visión técnica, principios de NFR |
|
|
79
|
+
| 7 | **Tony Stark** | `wize-agent-architect` | Arquitecto de Sistemas (arquitectura, ADRs, epics, stories) |
|
|
80
|
+
| 8 | **Hawkeye** | `wize-agent-test-architect` | Test Architect — 6 gates (risk, design, trace, nfr, review, gate) |
|
|
81
|
+
| 9 | **Shuri** | `wize-agent-dev` | Desarrolladora Senior (TDD, código, refactor) |
|
|
82
|
+
| 10 | **red-teamer** 🆕 | `red-teamer` (overlay de seguridad) | Pentester de IA — recon, SAST/DAST, pruebas ofensivas con alcance, informe |
|
|
83
|
+
|
|
84
|
+
Consulta [`ROSTER.md`](ROSTER.md) para personas, estilos y equivalencias con BMAD.
|
|
85
|
+
|
|
86
|
+
---
|
|
87
|
+
|
|
88
|
+
## Recorrido — un proyecto completo, de principio a fin
|
|
89
|
+
|
|
90
|
+
Cada paso es un slash command en tu IDE; cada persona lee el artefacto anterior antes de escribir el suyo.
|
|
91
|
+
|
|
92
|
+
```
|
|
93
|
+
1. /wize-orchestrator Wizer saluda, lee config, detecta el estado y enruta.
|
|
94
|
+
|
|
95
|
+
2. /wize-product-brief Pepper convierte la demanda bruta en brief.md.
|
|
96
|
+
/wize-trigger-map Pepper mapea psicología del usuario → metas de negocio (WDS).
|
|
97
|
+
/wize-research Pepper sintetiza evidencia externa (opcional).
|
|
98
|
+
|
|
99
|
+
3. /wize-create-prd Maria Hill escribe prd.md (metas, alcance, ACs).
|
|
100
|
+
/wize-validate-prd Maria Hill (+ Mantis/Fury) aprueba.
|
|
101
|
+
|
|
102
|
+
4. /wize-ux-scenarios Mantis conduce el diálogo WDS de 8 preguntas.
|
|
103
|
+
/wize-ux-design Mantis escribe specs de pantalla (un .md por pantalla).
|
|
104
|
+
|
|
105
|
+
5. /wize-tech-vision Fury elige la familia de stack + innegociables.
|
|
106
|
+
/wize-nfr-principles Fury escribe el presupuesto de NFR (perf, seg, a11y…).
|
|
107
|
+
|
|
108
|
+
6. /wize-create-architecture Tony escribe architecture.md + ADRs (8 pasos).
|
|
109
|
+
/wize-design-system Mantis escribe design-system/ (tokens + componentes).
|
|
110
|
+
/wize-create-epics-and-stories
|
|
111
|
+
Tony divide epics → stories (cada una con ACs).
|
|
112
|
+
|
|
113
|
+
7. /wize-tea-risk Hawkeye construye el perfil global de riesgo.
|
|
114
|
+
/wize-tea-design Hawkeye escribe el test design de la próxima story.
|
|
115
|
+
/wize-dev-story Shuri implementa (TDD, IDs de AC en los commits).
|
|
116
|
+
/wize-tea-trace Hawkeye mapea cada AC → tests.
|
|
117
|
+
/wize-tea-review Hawkeye ejecuta la revisión de la story.
|
|
118
|
+
/wize-tea-gate Hawkeye emite PASS / CONCERNS / FAIL / WAIVED.
|
|
119
|
+
|
|
120
|
+
8. /wize-sprint-status Maria Hill mantiene el snapshot diario actualizado.
|
|
121
|
+
/wize-retrospective Wizer facilita la retro al final de cada sprint.
|
|
122
|
+
|
|
123
|
+
Transversales:
|
|
124
|
+
/wize-help Wizer averigua dónde estás y el próximo paso.
|
|
125
|
+
/wize-quick-dev Shuri toma un arreglo pequeño sin el ciclo completo.
|
|
126
|
+
/wize-code-review Revisión adversarial antes del gate TEA de Hawkeye.
|
|
127
|
+
/wize-party-mode Wizer reúne multi-persona para decisiones difíciles.
|
|
128
|
+
```
|
|
129
|
+
|
|
130
|
+
> Usa `/wize-help next` cuando tengas dudas — inspecciona `.wize/` y te dice la única acción siguiente.
|
|
131
|
+
|
|
132
|
+
---
|
|
133
|
+
|
|
134
|
+
## 🛡️ Overlay de seguridad — Pentester de IA
|
|
135
|
+
|
|
136
|
+
Con el perfil **Wize Security** instalado, la persona `red-teamer` ejecuta un pentest file-first de tu proyecto y produce un informe listo para stakeholders.
|
|
137
|
+
|
|
138
|
+
### Cómo funciona
|
|
139
|
+
|
|
140
|
+
1. **Autoriza el objetivo.** Declaras hosts/URLs permitidos en un `.wize/security/scope.md` firmado (integridad por SHA-256). Cualquier cosa fuera de la allowlist es **rechazada y auditada** — la herramienta nunca toca un objetivo que no autorizaste.
|
|
141
|
+
2. **Ejecuta el pipeline.**
|
|
142
|
+
```
|
|
143
|
+
/wize-sec-pentest # pasivo por defecto (chequeos read-only)
|
|
144
|
+
/wize-sec-pentest --active # habilita tooling ofensivo (sqlmap, ffuf)
|
|
145
|
+
```
|
|
146
|
+
Encadena: **recon** (nmap) → **enumerate** (superficie HTTP) → **SAST** (secrets con gitleaks + deps con osv-scanner/grype) → **DAST** (nuclei, nikto, sqlmap, ffuf) → **report**.
|
|
147
|
+
3. **Lee el informe.** `report.md` + un `report.html` self-contained (offline, WCAG 2.2 AA) con:
|
|
148
|
+
- **Puntuación de riesgo 0–100** + **briefing** ejecutivo (qué significa el riesgo para el negocio),
|
|
149
|
+
- hallazgos clasificados por **CVSS v3.1** y **OWASP Top 10**, con secrets redactados,
|
|
150
|
+
- **cobertura honesta** ("audit confidence" — qué se probó y qué no),
|
|
151
|
+
- un **plan de acción priorizado** (P0/P1/P2).
|
|
152
|
+
4. **Planifica la corrección.** El scan genera `security-backlog.md` (epics de remediación agrupados por tema, trazables a los hallazgos) e imprime el comando exacto para convertirlo en un sprint:
|
|
153
|
+
```
|
|
154
|
+
/wize-create-epics-and-stories --from .wize/security/security-backlog.md
|
|
155
|
+
```
|
|
156
|
+
|
|
157
|
+
### Garantías de diseño
|
|
158
|
+
|
|
159
|
+
- **Cero runtime propio** — solo built-ins de Node; ninguna dependencia npm nueva; el overlay nunca invoca una skill (imprime el comando para que tú/el agente lo ejecuten).
|
|
160
|
+
- **Los datos quedan locales** — informes y hallazgos se escriben en `.wize/security/`, nunca se suben a ningún lado.
|
|
161
|
+
- **Las herramientas se detectan, nunca se auto-instalan** — un preflight comprueba tu toolchain y genera un `install-pentest-tools.sh` consciente del SO (apt para nmap/nikto/sqlmap; releases de GitHub para gitleaks/nuclei/ffuf/osv-scanner; script oficial para grype). Una herramienta ausente degrada solo ese chequeo — el pipeline continúa.
|
|
162
|
+
- **Pasivo por defecto** — el tooling ofensivo (sqlmap/ffuf) solo corre con `--active`; flags peligrosas (`--dump`, `--os-shell`) son vetadas por una allowlist independiente del input.
|
|
163
|
+
|
|
164
|
+
> ⚠️ **Herramienta de doble uso.** Prueba solo sistemas que poseas o estés explícitamente autorizado a probar.
|
|
165
|
+
|
|
166
|
+
---
|
|
167
|
+
|
|
168
|
+
## Estructura de salida (en el repositorio objetivo)
|
|
169
|
+
|
|
170
|
+
```
|
|
171
|
+
.wize/
|
|
172
|
+
├── config/ # project.toml, user.toml, tea.toml
|
|
173
|
+
├── planning/ # brief, research, ux/, prd, tech-vision, nfr-principles
|
|
174
|
+
├── solutioning/ # architecture, adrs, epics, stories
|
|
175
|
+
├── implementation/ # sprint-status, retrospective, tea/{gates}
|
|
176
|
+
├── knowledge/ # docs y referencias de larga duración
|
|
177
|
+
├── security/ # scope.md, report.{md,html}, security-backlog.md (overlay de seguridad)
|
|
178
|
+
└── custom/ # agents/skills/workflows creados por Agent Builder
|
|
179
|
+
```
|
|
180
|
+
|
|
181
|
+
---
|
|
182
|
+
|
|
183
|
+
## Comandos de la CLI
|
|
184
|
+
|
|
185
|
+
```bash
|
|
186
|
+
npx wize-dev-kit install # setup interactivo
|
|
187
|
+
npx wize-dev-kit update # actualiza un kit instalado a la versión actual
|
|
188
|
+
npx wize-dev-kit sync # re-renderiza los adapters de IDE tras editar la config
|
|
189
|
+
npx wize-dev-kit agent list # lista agentes nativos + personalizados
|
|
190
|
+
npx wize-dev-kit agent create # crea un nuevo agente personalizado (validado + dry-run)
|
|
191
|
+
npx wize-dev-kit agent edit <code> # sobrescribe un agente nativo
|
|
192
|
+
npx wize-dev-kit doctor # diagnostica kit / proyecto / adapters / gates
|
|
193
|
+
npx wize-dev-kit validate # chequeos estructurales en los assets del kit
|
|
194
|
+
npx wize-dev-kit document-project [quick|initial_scan|full_rescan|deep_dive] [--resume] [--target <path>]
|
|
195
|
+
npx wize-dev-kit uninstall # elimina .wize/ (tu código queda intacto)
|
|
196
|
+
```
|
|
197
|
+
|
|
198
|
+
---
|
|
199
|
+
|
|
200
|
+
## Documentación
|
|
201
|
+
|
|
202
|
+
- [`ARCH.md`](ARCH.md) — arquitectura completa: distribución, flujos, layout, instalador.
|
|
203
|
+
- [`ROSTER.md`](ROSTER.md) — personas con estilo, rol, equivalencias BMAD.
|
|
204
|
+
- [`DECISIONS.md`](DECISIONS.md) — registro de decisiones.
|
|
205
|
+
- [`CHANGELOG.md`](CHANGELOG.md) — historial de releases.
|
|
206
|
+
|
|
207
|
+
---
|
|
208
|
+
|
|
209
|
+
## Estado
|
|
210
|
+
|
|
211
|
+
**v0.7.0 — beta.** El ciclo completo (análisis → plan → solución → implementación) está montado con 10 agentes y una biblioteca estructurada de skills. El `security-overlay` (Pentester de IA) entrega un pipeline de pentest completo, un informe ejecutivo (puntuación de riesgo + briefing + plan de acción por IA) y planificación de remediación post-scan — validado de principio a fin contra una aplicación Laravel/PHP real. Los adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode y Antigravity se regeneran automáticamente.
|
|
212
|
+
|
|
213
|
+
---
|
|
214
|
+
|
|
215
|
+
## Inspiración y créditos
|
|
216
|
+
|
|
217
|
+
- [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) por Brian (BMad) Madison — ciclo ágil de IA, personas de agentes, patrón de instalador, sistema de módulos.
|
|
218
|
+
- [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — metodología UX-first, panteón nórdico (Saga, Freya), estructura de fases.
|
|
219
|
+
|
|
220
|
+
Wize Development Kit es una **adaptación independiente** — no afiliada ni respaldada por los autores de BMAD o WDS. Los nombres de personas Marvel se usan como referencias creativas bajo uso nominativo justo.
|
|
221
|
+
|
|
222
|
+
---
|
|
223
|
+
|
|
224
|
+
## Licencia
|
|
225
|
+
|
|
226
|
+
MIT — consulta [`LICENSE`](LICENSE).
|
package/README.md
CHANGED
|
@@ -1,13 +1,41 @@
|
|
|
1
1
|
# Wize Development Kit
|
|
2
2
|
|
|
3
|
-
> **Full-lifecycle AI-assisted development kit** with Test Architect
|
|
4
|
-
> Inspired by [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) and [WDS Expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion).
|
|
3
|
+
> **Full-lifecycle AI-assisted development kit** — takes a project from brief to tested implementation through 10 specialized agents, with a Test Architect, a Whiteport UX studio, and an AI Pentester embedded. Runs inside your AI IDE.
|
|
5
4
|
|
|
6
5
|
[](https://www.npmjs.com/package/wize-dev-kit)
|
|
7
6
|
[](LICENSE)
|
|
8
|
-
[](#status)
|
|
9
8
|
[](https://github.com/qwize-br/wize-development-kit)
|
|
10
9
|
|
|
10
|
+
**🌐 Languages:** **English** · [Português (pt-BR)](README.pt-BR.md) · [Español](README.es.md)
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## TL;DR
|
|
15
|
+
|
|
16
|
+
```bash
|
|
17
|
+
npx wize-dev-kit install
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
Pick your profiles and IDE, then in your AI IDE say *"Activate Wizer and brief him on the project."* Wizer routes you through the right agent for each phase — brief, PRD, UX, architecture, tested code — and (optionally) runs an AI pentest of your app.
|
|
21
|
+
|
|
22
|
+
---
|
|
23
|
+
|
|
24
|
+
## What it is
|
|
25
|
+
|
|
26
|
+
Wize Development Kit (WDK) is an installable **AI agent stack** that runs inside your AI IDE (Claude Code, Cursor, Windsurf, Codex, and others) and writes structured artifacts to a hidden `.wize/` folder in your repo. It takes a project from **brief → PRD → UX strategy → architecture → tested implementation**, and can also **pentest the running app and plan the remediation sprint**.
|
|
27
|
+
|
|
28
|
+
It is **file-first and zero-runtime**: the agents are Markdown skills your IDE reads; the tooling is plain Node (no new npm dependencies). Nothing is mocked — every step reads the previous artifact and writes a real one.
|
|
29
|
+
|
|
30
|
+
### Profiles (combinable in monorepos)
|
|
31
|
+
|
|
32
|
+
| Profile | What it adds |
|
|
33
|
+
|---|---|
|
|
34
|
+
| **Wize Dev Core** | Full lifecycle (analysis → plan → solution → implementation) + Test Architect + Whiteport UX + Agent Builder. Always installed. |
|
|
35
|
+
| **Wize Web Dev** *(overlay)* | Web scaffolds, SEO, analytics, WCAG playbook for Mantis, Playwright/Vitest for Hawkeye. |
|
|
36
|
+
| **Wize App Development** *(overlay)* | Mobile scaffolds, store listing, platform guidelines (HIG / Material 3), Detox/Maestro for Hawkeye. |
|
|
37
|
+
| **Wize Security** *(overlay)* 🆕 | **AI Pentester.** File-first pentest pipeline (recon → enumerate → SAST → DAST → report) driven by the `red-teamer` persona, with a scope gate, OWASP/CVSS classification, and a stakeholder report. |
|
|
38
|
+
|
|
11
39
|
---
|
|
12
40
|
|
|
13
41
|
## Install
|
|
@@ -18,7 +46,7 @@ In any greenfield or brownfield repo:
|
|
|
18
46
|
npx wize-dev-kit install
|
|
19
47
|
```
|
|
20
48
|
|
|
21
|
-
Or straight from GitHub (no npm
|
|
49
|
+
Or straight from GitHub (no npm needed):
|
|
22
50
|
|
|
23
51
|
```bash
|
|
24
52
|
npx github:qwize-br/wize-development-kit install
|
|
@@ -26,32 +54,16 @@ npx github:qwize-br/wize-development-kit install
|
|
|
26
54
|
|
|
27
55
|
The installer asks:
|
|
28
56
|
|
|
29
|
-
1. Profile(s)
|
|
30
|
-
2. IDE target(s)
|
|
31
|
-
3.
|
|
32
|
-
4. Output folder
|
|
33
|
-
5.
|
|
57
|
+
1. **Profile(s)** — Core / +Web / +App / +Security (multi-select).
|
|
58
|
+
2. **IDE target(s)** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity, or generic fallback (multi-select).
|
|
59
|
+
3. **Languages** — communication + document output.
|
|
60
|
+
4. **Output folder** — default `.wize/`.
|
|
61
|
+
5. **Brownfield** — offers to run `wize-document-project` to baseline the existing codebase.
|
|
34
62
|
|
|
35
|
-
After install, open your IDE and
|
|
63
|
+
After install, open your IDE and say:
|
|
36
64
|
|
|
37
65
|
> "Activate Wizer and brief him on the project."
|
|
38
66
|
|
|
39
|
-
Wizer will route you to the right persona (Pepper for brief, Mantis for UX baseline, Tony for architecture preferences, etc.).
|
|
40
|
-
|
|
41
|
-
---
|
|
42
|
-
|
|
43
|
-
## What it is
|
|
44
|
-
|
|
45
|
-
Wize Development Kit (WDK) is an installable AI agent stack that takes a project from **brief → PRD → UX strategy → architecture → tested implementation** through 9 specialized agents (Marvel-themed) and a structured workflow library. It runs inside your AI IDE (Claude Code, Cursor, Windsurf, and others) and writes structured artifacts to a hidden `.wize/` folder in the target repo.
|
|
46
|
-
|
|
47
|
-
Three profiles, combinable in monorepos:
|
|
48
|
-
|
|
49
|
-
| Profile | What it adds |
|
|
50
|
-
|---|---|
|
|
51
|
-
| **Wize Dev Core** | Full lifecycle (analysis → plan → solution → implementation) + Test Architect + Whiteport UX + Agent Builder. Always installed. |
|
|
52
|
-
| **Wize Web Dev** (overlay) | Web stack scaffolds, SEO, analytics, WCAG playbook for Mantis, Playwright/Vitest playbook for Hawkeye. |
|
|
53
|
-
| **Wize App Development** (overlay) | Mobile scaffolds, store-listing, platform guidelines (HIG/Material 3), Detox/Maestro playbook for Hawkeye. |
|
|
54
|
-
|
|
55
67
|
---
|
|
56
68
|
|
|
57
69
|
## The roster
|
|
@@ -67,6 +79,7 @@ Three profiles, combinable in monorepos:
|
|
|
67
79
|
| 7 | **Tony Stark** | `wize-agent-architect` | System Architect (architecture, ADRs, epics, stories) |
|
|
68
80
|
| 8 | **Hawkeye** | `wize-agent-test-architect` | Test Architect — 6 gates (risk, design, trace, nfr, review, gate) |
|
|
69
81
|
| 9 | **Shuri** | `wize-agent-dev` | Senior Developer (TDD, code, refactor) |
|
|
82
|
+
| 10 | **red-teamer** 🆕 | `red-teamer` (security overlay) | AI Pentester — recon, SAST/DAST, scoped offensive testing, reporting |
|
|
70
83
|
|
|
71
84
|
See [`ROSTER.md`](ROSTER.md) for personas, styles and BMAD equivalences.
|
|
72
85
|
|
|
@@ -74,18 +87,14 @@ See [`ROSTER.md`](ROSTER.md) for personas, styles and BMAD equivalences.
|
|
|
74
87
|
|
|
75
88
|
## Walkthrough — a full project, end to end
|
|
76
89
|
|
|
77
|
-
|
|
90
|
+
Each step is a slash command in your IDE; each persona reads the previous artifact before writing its own.
|
|
78
91
|
|
|
79
92
|
```
|
|
80
|
-
1. /wize-orchestrator Wizer greets, reads
|
|
81
|
-
Detects the project state and routes you.
|
|
93
|
+
1. /wize-orchestrator Wizer greets, reads config, detects state, routes you.
|
|
82
94
|
|
|
83
95
|
2. /wize-product-brief Pepper turns raw demand into brief.md.
|
|
84
96
|
/wize-trigger-map Pepper maps user psychology → business goals (WDS).
|
|
85
97
|
/wize-research Pepper synthesizes external evidence (optional).
|
|
86
|
-
Or run a focused pass:
|
|
87
|
-
/wize-market-research, /wize-domain-research,
|
|
88
|
-
/wize-technical-research.
|
|
89
98
|
|
|
90
99
|
3. /wize-create-prd Maria Hill writes prd.md (goals, scope, ACs).
|
|
91
100
|
/wize-validate-prd Maria Hill (+ Mantis/Fury) signs off.
|
|
@@ -96,8 +105,7 @@ Below is the canonical flow Wizer drives in a real session. Each step is a slash
|
|
|
96
105
|
5. /wize-tech-vision Fury picks the stack family + non-negotiables.
|
|
97
106
|
/wize-nfr-principles Fury writes the NFR budget (perf, sec, a11y…).
|
|
98
107
|
|
|
99
|
-
6. /wize-create-architecture Tony writes architecture.md + ADRs
|
|
100
|
-
(context → decisions → patterns → structure → validation).
|
|
108
|
+
6. /wize-create-architecture Tony writes architecture.md + ADRs (8 steps).
|
|
101
109
|
/wize-design-system Mantis writes design-system/ (tokens + components).
|
|
102
110
|
/wize-create-epics-and-stories
|
|
103
111
|
Tony slices epics → stories (each has ACs).
|
|
@@ -111,20 +119,49 @@ Below is the canonical flow Wizer drives in a real session. Each step is a slash
|
|
|
111
119
|
|
|
112
120
|
8. /wize-sprint-status Maria Hill keeps the daily snapshot updated.
|
|
113
121
|
/wize-retrospective Wizer facilitates retro at end of each sprint.
|
|
114
|
-
/wize-tea-nfr Hawkeye assesses NFRs at epic boundary.
|
|
115
122
|
|
|
116
123
|
Cross-cutting:
|
|
117
|
-
/wize-help Wizer figures out where you are and
|
|
118
|
-
the next step (use anytime).
|
|
124
|
+
/wize-help Wizer figures out where you are and the next step.
|
|
119
125
|
/wize-quick-dev Shuri takes a small fix without the full ride.
|
|
120
|
-
/wize-code-review
|
|
121
|
-
Edge Case Hunter, Acceptance Auditor) before Hawkeye's TEA review.
|
|
122
|
-
/wize-spec Distill any intent into a canonical five-field spec.
|
|
126
|
+
/wize-code-review Adversarial peer review before Hawkeye's TEA gate.
|
|
123
127
|
/wize-party-mode Wizer convenes multi-persona for hard calls.
|
|
124
128
|
```
|
|
125
129
|
|
|
126
|
-
> Use `/wize-help next` whenever you're unsure — it inspects `.wize/` and tells
|
|
127
|
-
|
|
130
|
+
> Use `/wize-help next` whenever you're unsure — it inspects `.wize/` and tells you the single next action.
|
|
131
|
+
|
|
132
|
+
---
|
|
133
|
+
|
|
134
|
+
## 🛡️ Security overlay — AI Pentester
|
|
135
|
+
|
|
136
|
+
When the **Wize Security** profile is installed, the `red-teamer` persona runs a file-first pentest of your project and produces a stakeholder-ready report.
|
|
137
|
+
|
|
138
|
+
### How it works
|
|
139
|
+
|
|
140
|
+
1. **Authorize the target.** You declare allowed hosts/URLs in a signed `.wize/security/scope.md` (SHA-256 integrity). Anything outside the allowlist is **refused and audited** — the tool never touches a target you didn't authorize.
|
|
141
|
+
2. **Run the pipeline.**
|
|
142
|
+
```
|
|
143
|
+
/wize-sec-pentest # passive by default (read-only checks)
|
|
144
|
+
/wize-sec-pentest --active # enables active exploit tooling (sqlmap, ffuf)
|
|
145
|
+
```
|
|
146
|
+
It chains: **recon** (nmap) → **enumerate** (HTTP surface) → **SAST** (gitleaks secrets + osv-scanner/grype deps) → **DAST** (nuclei, nikto, sqlmap, ffuf) → **report**.
|
|
147
|
+
3. **Read the report.** `report.md` + a self-contained `report.html` (offline, WCAG 2.2 AA) with:
|
|
148
|
+
- **Risk score 0–100** + executive **briefing** (what the risk means for the business),
|
|
149
|
+
- findings classified by **CVSS v3.1** and **OWASP Top 10**, with redacted secrets,
|
|
150
|
+
- **honest coverage** ("audit confidence" — what was and wasn't tested),
|
|
151
|
+
- a **prioritized action plan** (P0/P1/P2).
|
|
152
|
+
4. **Plan the fix.** The scan emits `security-backlog.md` (remediation epics grouped by theme, traceable to findings) and prints the exact command to turn it into a sprint:
|
|
153
|
+
```
|
|
154
|
+
/wize-create-epics-and-stories --from .wize/security/security-backlog.md
|
|
155
|
+
```
|
|
156
|
+
|
|
157
|
+
### Design guarantees
|
|
158
|
+
|
|
159
|
+
- **Zero runtime of its own** — Node built-ins only; no new npm dependency; the overlay never invokes a skill (it prints the command for you/the agent to run).
|
|
160
|
+
- **Data stays local** — reports and findings are written under `.wize/security/`, never uploaded anywhere.
|
|
161
|
+
- **Tools are detected, never auto-installed** — a preflight checks your toolchain and generates an OS-aware `install-pentest-tools.sh` (apt for nmap/nikto/sqlmap; GitHub releases for gitleaks/nuclei/ffuf/osv-scanner; official script for grype). Missing tools degrade a single check gracefully — the pipeline keeps going.
|
|
162
|
+
- **Default passive** — offensive tooling (sqlmap/ffuf) runs only with `--active`; dangerous flags (`--dump`, `--os-shell`) are vetoed by an allowlist regardless of input.
|
|
163
|
+
|
|
164
|
+
> ⚠️ **Dual-use tool.** Only test systems you own or are explicitly authorized to test.
|
|
128
165
|
|
|
129
166
|
---
|
|
130
167
|
|
|
@@ -137,6 +174,7 @@ Cross-cutting:
|
|
|
137
174
|
├── solutioning/ # architecture, adrs, epics, stories
|
|
138
175
|
├── implementation/ # sprint-status, retrospective, tea/{gates}
|
|
139
176
|
├── knowledge/ # long-lived docs and references
|
|
177
|
+
├── security/ # scope.md, report.{md,html}, security-backlog.md (security overlay)
|
|
140
178
|
└── custom/ # agents/skills/workflows created by Agent Builder
|
|
141
179
|
```
|
|
142
180
|
|
|
@@ -146,15 +184,14 @@ Cross-cutting:
|
|
|
146
184
|
|
|
147
185
|
```bash
|
|
148
186
|
npx wize-dev-kit install # interactive setup
|
|
149
|
-
npx wize-dev-kit update # bring an installed kit up to the current
|
|
187
|
+
npx wize-dev-kit update # bring an installed kit up to the current version
|
|
150
188
|
npx wize-dev-kit sync # re-render IDE adapters after editing config
|
|
151
189
|
npx wize-dev-kit agent list # list built-in + custom agents
|
|
152
190
|
npx wize-dev-kit agent create # scaffold a new custom agent (validated + dry-run)
|
|
153
|
-
npx wize-dev-kit agent edit <code> # override a built-in
|
|
154
|
-
npx wize-dev-kit doctor # diagnose kit / project / adapters / gates
|
|
191
|
+
npx wize-dev-kit agent edit <code> # override a built-in agent
|
|
192
|
+
npx wize-dev-kit doctor # diagnose kit / project / adapters / gates
|
|
155
193
|
npx wize-dev-kit validate # structural checks on the kit assets
|
|
156
194
|
npx wize-dev-kit document-project [quick|initial_scan|full_rescan|deep_dive] [--resume] [--target <path>]
|
|
157
|
-
# document the current repo; quick baseline by default
|
|
158
195
|
npx wize-dev-kit uninstall # remove .wize/ (your code is left untouched)
|
|
159
196
|
```
|
|
160
197
|
|
|
@@ -162,22 +199,23 @@ npx wize-dev-kit uninstall # remove .wize/ (your code is left untouched)
|
|
|
162
199
|
|
|
163
200
|
## Documentation
|
|
164
201
|
|
|
165
|
-
- [`ARCH.md`](ARCH.md) — full architecture: distribution,
|
|
166
|
-
- [`ROSTER.md`](ROSTER.md) —
|
|
167
|
-
- [`DECISIONS.md`](DECISIONS.md) — decisions log
|
|
202
|
+
- [`ARCH.md`](ARCH.md) — full architecture: distribution, flows, layout, installer.
|
|
203
|
+
- [`ROSTER.md`](ROSTER.md) — personas with style, role, BMAD equivalences.
|
|
204
|
+
- [`DECISIONS.md`](DECISIONS.md) — decisions log.
|
|
205
|
+
- [`CHANGELOG.md`](CHANGELOG.md) — release history.
|
|
168
206
|
|
|
169
207
|
---
|
|
170
208
|
|
|
171
209
|
## Status
|
|
172
210
|
|
|
173
|
-
**v0.
|
|
211
|
+
**v0.7.0 — beta.** The full lifecycle (analysis → plan → solution → implementation) is wired with 10 agents and a structured skill library. The `security-overlay` (AI Pentester) ships a complete pentest pipeline, a stakeholder report (risk score + briefing + AI action plan), and post-scan remediation planning — validated end-to-end against a real Laravel/PHP app. IDE adapters for Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, and Antigravity are regenerated automatically.
|
|
174
212
|
|
|
175
213
|
---
|
|
176
214
|
|
|
177
215
|
## Inspiration & credits
|
|
178
216
|
|
|
179
|
-
- [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) by Brian (BMad) Madison —
|
|
180
|
-
- [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) —
|
|
217
|
+
- [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) by Brian (BMad) Madison — agile AI lifecycle, agent personas, installer pattern, module system.
|
|
218
|
+
- [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — UX-first methodology, Norse pantheon (Saga, Freya), phase structure.
|
|
181
219
|
|
|
182
220
|
Wize Development Kit is an **independent adaptation** — not affiliated with or endorsed by BMAD or WDS authors. Marvel persona names are used as creative references under nominative fair use.
|
|
183
221
|
|
package/README.pt-BR.md
ADDED
|
@@ -0,0 +1,226 @@
|
|
|
1
|
+
# Wize Development Kit
|
|
2
|
+
|
|
3
|
+
> **Kit de desenvolvimento assistido por IA, de ciclo completo** — leva um projeto do brief à implementação testada por meio de 10 agentes especializados, com um Test Architect, um estúdio de UX Whiteport e um Pentester de IA embarcados. Roda dentro da sua IDE com IA.
|
|
4
|
+
|
|
5
|
+
[](https://www.npmjs.com/package/wize-dev-kit)
|
|
6
|
+
[](LICENSE)
|
|
7
|
+
[](#status)
|
|
8
|
+
[](https://github.com/qwize-br/wize-development-kit)
|
|
9
|
+
|
|
10
|
+
**🌐 Idiomas:** [English](README.md) · **Português (pt-BR)** · [Español](README.es.md)
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## Resumo rápido
|
|
15
|
+
|
|
16
|
+
```bash
|
|
17
|
+
npx wize-dev-kit install
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
Escolha os perfis e a IDE; depois, na sua IDE com IA, diga *"Ative o Wizer e dê o briefing do projeto a ele."* O Wizer te conduz pelo agente certo em cada fase — brief, PRD, UX, arquitetura, código testado — e (opcionalmente) roda um pentest de IA na sua aplicação.
|
|
21
|
+
|
|
22
|
+
---
|
|
23
|
+
|
|
24
|
+
## O que é
|
|
25
|
+
|
|
26
|
+
O Wize Development Kit (WDK) é uma **stack de agentes de IA** instalável que roda dentro da sua IDE com IA (Claude Code, Cursor, Windsurf, Codex e outras) e grava artefatos estruturados em uma pasta oculta `.wize/` no seu repositório. Leva um projeto de **brief → PRD → estratégia de UX → arquitetura → implementação testada** e também pode **fazer pentest da aplicação rodando e planejar a sprint de correção**.
|
|
27
|
+
|
|
28
|
+
É **file-first e zero-runtime**: os agentes são skills em Markdown que sua IDE lê; o tooling é Node puro (sem novas dependências npm). Nada é simulado — cada passo lê o artefato anterior e grava um real.
|
|
29
|
+
|
|
30
|
+
### Perfis (combináveis em monorepos)
|
|
31
|
+
|
|
32
|
+
| Perfil | O que adiciona |
|
|
33
|
+
|---|---|
|
|
34
|
+
| **Wize Dev Core** | Ciclo completo (análise → plano → solução → implementação) + Test Architect + UX Whiteport + Agent Builder. Sempre instalado. |
|
|
35
|
+
| **Wize Web Dev** *(overlay)* | Scaffolds web, SEO, analytics, playbook WCAG para o Mantis, Playwright/Vitest para o Hawkeye. |
|
|
36
|
+
| **Wize App Development** *(overlay)* | Scaffolds mobile, listagem em loja, diretrizes de plataforma (HIG / Material 3), Detox/Maestro para o Hawkeye. |
|
|
37
|
+
| **Wize Security** *(overlay)* 🆕 | **Pentester de IA.** Pipeline de pentest file-first (recon → enumerate → SAST → DAST → report) conduzido pela persona `red-teamer`, com gate de escopo, classificação OWASP/CVSS e relatório executivo. |
|
|
38
|
+
|
|
39
|
+
---
|
|
40
|
+
|
|
41
|
+
## Instalação
|
|
42
|
+
|
|
43
|
+
Em qualquer repositório, novo ou existente (greenfield ou brownfield):
|
|
44
|
+
|
|
45
|
+
```bash
|
|
46
|
+
npx wize-dev-kit install
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
Ou direto do GitHub (sem precisar de npm):
|
|
50
|
+
|
|
51
|
+
```bash
|
|
52
|
+
npx github:qwize-br/wize-development-kit install
|
|
53
|
+
```
|
|
54
|
+
|
|
55
|
+
O instalador pergunta:
|
|
56
|
+
|
|
57
|
+
1. **Perfil(is)** — Core / +Web / +App / +Security (múltipla escolha).
|
|
58
|
+
2. **IDE(s) alvo** — Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode, Antigravity ou fallback genérico (múltipla escolha).
|
|
59
|
+
3. **Idiomas** — comunicação + saída de documentos.
|
|
60
|
+
4. **Pasta de saída** — padrão `.wize/`.
|
|
61
|
+
5. **Brownfield** — oferece rodar `wize-document-project` para criar a baseline do código existente.
|
|
62
|
+
|
|
63
|
+
Após instalar, abra sua IDE e diga:
|
|
64
|
+
|
|
65
|
+
> "Ative o Wizer e dê o briefing do projeto a ele."
|
|
66
|
+
|
|
67
|
+
---
|
|
68
|
+
|
|
69
|
+
## O elenco
|
|
70
|
+
|
|
71
|
+
| # | Persona | Código | Papel |
|
|
72
|
+
|---|---|---|---|
|
|
73
|
+
| 1 | **Wizer** | `wize-orchestrator` | Orquestrador, base de conhecimento, briefing, roteamento |
|
|
74
|
+
| 2 | **Pepper Potts** | `wize-agent-analyst` | Analista de Negócio + WDS Saga (brief de produto, trigger map) |
|
|
75
|
+
| 3 | **Peggy Carter** | `wize-agent-tech-writer` | Redatora Técnica (transversal) |
|
|
76
|
+
| 4 | **Maria Hill** | `wize-agent-pm` | Product Manager (PRD, epics, sprints) |
|
|
77
|
+
| 5 | **Mantis** | `wize-agent-ux-designer` | UX Designer + WDS Freya (cenários, design, design system) |
|
|
78
|
+
| 6 | **Nick Fury** | `wize-agent-solution-strategist` | Estratégia de Solução, visão técnica, princípios de NFR |
|
|
79
|
+
| 7 | **Tony Stark** | `wize-agent-architect` | Arquiteto de Sistemas (arquitetura, ADRs, epics, stories) |
|
|
80
|
+
| 8 | **Hawkeye** | `wize-agent-test-architect` | Test Architect — 6 gates (risk, design, trace, nfr, review, gate) |
|
|
81
|
+
| 9 | **Shuri** | `wize-agent-dev` | Desenvolvedora Sênior (TDD, código, refactor) |
|
|
82
|
+
| 10 | **red-teamer** 🆕 | `red-teamer` (overlay de segurança) | Pentester de IA — recon, SAST/DAST, testes ofensivos com escopo, relatório |
|
|
83
|
+
|
|
84
|
+
Veja [`ROSTER.md`](ROSTER.md) para personas, estilos e equivalências com o BMAD.
|
|
85
|
+
|
|
86
|
+
---
|
|
87
|
+
|
|
88
|
+
## Passo a passo — um projeto completo, de ponta a ponta
|
|
89
|
+
|
|
90
|
+
Cada passo é um slash command na sua IDE; cada persona lê o artefato anterior antes de escrever o seu.
|
|
91
|
+
|
|
92
|
+
```
|
|
93
|
+
1. /wize-orchestrator Wizer cumprimenta, lê config, detecta estado e roteia.
|
|
94
|
+
|
|
95
|
+
2. /wize-product-brief Pepper transforma a demanda bruta em brief.md.
|
|
96
|
+
/wize-trigger-map Pepper mapeia psicologia do usuário → metas de negócio (WDS).
|
|
97
|
+
/wize-research Pepper sintetiza evidências externas (opcional).
|
|
98
|
+
|
|
99
|
+
3. /wize-create-prd Maria Hill escreve prd.md (metas, escopo, ACs).
|
|
100
|
+
/wize-validate-prd Maria Hill (+ Mantis/Fury) aprova.
|
|
101
|
+
|
|
102
|
+
4. /wize-ux-scenarios Mantis conduz o diálogo WDS de 8 perguntas.
|
|
103
|
+
/wize-ux-design Mantis escreve specs de tela (um .md por tela).
|
|
104
|
+
|
|
105
|
+
5. /wize-tech-vision Fury escolhe a família de stack + não-negociáveis.
|
|
106
|
+
/wize-nfr-principles Fury escreve o orçamento de NFR (perf, seg, a11y…).
|
|
107
|
+
|
|
108
|
+
6. /wize-create-architecture Tony escreve architecture.md + ADRs (8 passos).
|
|
109
|
+
/wize-design-system Mantis escreve design-system/ (tokens + componentes).
|
|
110
|
+
/wize-create-epics-and-stories
|
|
111
|
+
Tony fatia epics → stories (cada uma com ACs).
|
|
112
|
+
|
|
113
|
+
7. /wize-tea-risk Hawkeye monta o perfil global de risco.
|
|
114
|
+
/wize-tea-design Hawkeye escreve o test design da próxima story.
|
|
115
|
+
/wize-dev-story Shuri implementa (TDD, IDs de AC nos commits).
|
|
116
|
+
/wize-tea-trace Hawkeye mapeia cada AC → testes.
|
|
117
|
+
/wize-tea-review Hawkeye faz a revisão da story.
|
|
118
|
+
/wize-tea-gate Hawkeye emite PASS / CONCERNS / FAIL / WAIVED.
|
|
119
|
+
|
|
120
|
+
8. /wize-sprint-status Maria Hill mantém o snapshot diário atualizado.
|
|
121
|
+
/wize-retrospective Wizer facilita a retro no fim de cada sprint.
|
|
122
|
+
|
|
123
|
+
Transversais:
|
|
124
|
+
/wize-help Wizer descobre onde você está e o próximo passo.
|
|
125
|
+
/wize-quick-dev Shuri pega uma correção pequena sem o ciclo completo.
|
|
126
|
+
/wize-code-review Revisão adversarial antes do gate TEA do Hawkeye.
|
|
127
|
+
/wize-party-mode Wizer reúne multi-persona para decisões difíceis.
|
|
128
|
+
```
|
|
129
|
+
|
|
130
|
+
> Use `/wize-help next` sempre que estiver em dúvida — ele inspeciona `.wize/` e diz a única próxima ação.
|
|
131
|
+
|
|
132
|
+
---
|
|
133
|
+
|
|
134
|
+
## 🛡️ Overlay de segurança — Pentester de IA
|
|
135
|
+
|
|
136
|
+
Com o perfil **Wize Security** instalado, a persona `red-teamer` roda um pentest file-first do seu projeto e produz um relatório pronto para stakeholders.
|
|
137
|
+
|
|
138
|
+
### Como funciona
|
|
139
|
+
|
|
140
|
+
1. **Autorize o alvo.** Você declara hosts/URLs permitidos em um `.wize/security/scope.md` assinado (integridade por SHA-256). Qualquer coisa fora da allowlist é **recusada e auditada** — a ferramenta nunca toca em um alvo que você não autorizou.
|
|
141
|
+
2. **Rode o pipeline.**
|
|
142
|
+
```
|
|
143
|
+
/wize-sec-pentest # passivo por padrão (checagens read-only)
|
|
144
|
+
/wize-sec-pentest --active # habilita tooling ofensivo (sqlmap, ffuf)
|
|
145
|
+
```
|
|
146
|
+
Encadeia: **recon** (nmap) → **enumerate** (superfície HTTP) → **SAST** (secrets via gitleaks + deps via osv-scanner/grype) → **DAST** (nuclei, nikto, sqlmap, ffuf) → **report**.
|
|
147
|
+
3. **Leia o relatório.** `report.md` + um `report.html` self-contained (offline, WCAG 2.2 AA) com:
|
|
148
|
+
- **Score de risco 0–100** + **briefing** executivo (o que o risco significa para o negócio),
|
|
149
|
+
- findings classificados por **CVSS v3.1** e **OWASP Top 10**, com secrets redatados,
|
|
150
|
+
- **cobertura honesta** ("audit confidence" — o que foi e o que não foi testado),
|
|
151
|
+
- um **plano de ação priorizado** (P0/P1/P2).
|
|
152
|
+
4. **Planeje a correção.** O scan gera `security-backlog.md` (epics de remediação agrupados por tema, rastreáveis aos findings) e imprime o comando exato para virar uma sprint:
|
|
153
|
+
```
|
|
154
|
+
/wize-create-epics-and-stories --from .wize/security/security-backlog.md
|
|
155
|
+
```
|
|
156
|
+
|
|
157
|
+
### Garantias de design
|
|
158
|
+
|
|
159
|
+
- **Zero runtime próprio** — só built-ins do Node; nenhuma dependência npm nova; o overlay nunca invoca uma skill (ele imprime o comando para você/o agente rodar).
|
|
160
|
+
- **Os dados ficam locais** — relatórios e findings são gravados em `.wize/security/`, nunca enviados a lugar nenhum.
|
|
161
|
+
- **Ferramentas são detectadas, nunca auto-instaladas** — um preflight checa seu toolchain e gera um `install-pentest-tools.sh` ciente do SO (apt para nmap/nikto/sqlmap; releases do GitHub para gitleaks/nuclei/ffuf/osv-scanner; script oficial para grype). Ferramenta ausente degrada só aquela checagem — o pipeline continua.
|
|
162
|
+
- **Passivo por padrão** — tooling ofensivo (sqlmap/ffuf) só roda com `--active`; flags perigosas (`--dump`, `--os-shell`) são vetadas por uma allowlist independente do input.
|
|
163
|
+
|
|
164
|
+
> ⚠️ **Ferramenta dual-use.** Só teste sistemas que você possui ou está explicitamente autorizado a testar.
|
|
165
|
+
|
|
166
|
+
---
|
|
167
|
+
|
|
168
|
+
## Layout de saída (no repositório alvo)
|
|
169
|
+
|
|
170
|
+
```
|
|
171
|
+
.wize/
|
|
172
|
+
├── config/ # project.toml, user.toml, tea.toml
|
|
173
|
+
├── planning/ # brief, research, ux/, prd, tech-vision, nfr-principles
|
|
174
|
+
├── solutioning/ # architecture, adrs, epics, stories
|
|
175
|
+
├── implementation/ # sprint-status, retrospective, tea/{gates}
|
|
176
|
+
├── knowledge/ # docs e referências de longa duração
|
|
177
|
+
├── security/ # scope.md, report.{md,html}, security-backlog.md (overlay de segurança)
|
|
178
|
+
└── custom/ # agents/skills/workflows criados pelo Agent Builder
|
|
179
|
+
```
|
|
180
|
+
|
|
181
|
+
---
|
|
182
|
+
|
|
183
|
+
## Comandos da CLI
|
|
184
|
+
|
|
185
|
+
```bash
|
|
186
|
+
npx wize-dev-kit install # setup interativo
|
|
187
|
+
npx wize-dev-kit update # atualiza um kit instalado para a versão atual
|
|
188
|
+
npx wize-dev-kit sync # re-renderiza os adapters de IDE após editar a config
|
|
189
|
+
npx wize-dev-kit agent list # lista agentes nativos + customizados
|
|
190
|
+
npx wize-dev-kit agent create # cria um novo agente customizado (validado + dry-run)
|
|
191
|
+
npx wize-dev-kit agent edit <code> # sobrescreve um agente nativo
|
|
192
|
+
npx wize-dev-kit doctor # diagnostica kit / projeto / adapters / gates
|
|
193
|
+
npx wize-dev-kit validate # checagens estruturais nos assets do kit
|
|
194
|
+
npx wize-dev-kit document-project [quick|initial_scan|full_rescan|deep_dive] [--resume] [--target <path>]
|
|
195
|
+
npx wize-dev-kit uninstall # remove .wize/ (seu código permanece intacto)
|
|
196
|
+
```
|
|
197
|
+
|
|
198
|
+
---
|
|
199
|
+
|
|
200
|
+
## Documentação
|
|
201
|
+
|
|
202
|
+
- [`ARCH.md`](ARCH.md) — arquitetura completa: distribuição, fluxos, layout, instalador.
|
|
203
|
+
- [`ROSTER.md`](ROSTER.md) — personas com estilo, papel, equivalências BMAD.
|
|
204
|
+
- [`DECISIONS.md`](DECISIONS.md) — log de decisões.
|
|
205
|
+
- [`CHANGELOG.md`](CHANGELOG.md) — histórico de releases.
|
|
206
|
+
|
|
207
|
+
---
|
|
208
|
+
|
|
209
|
+
## Status
|
|
210
|
+
|
|
211
|
+
**v0.7.0 — beta.** O ciclo completo (análise → plano → solução → implementação) está montado com 10 agentes e uma biblioteca estruturada de skills. O `security-overlay` (Pentester de IA) entrega um pipeline de pentest completo, um relatório executivo (score de risco + briefing + plano de ação por IA) e planejamento de correção pós-scan — validado de ponta a ponta contra uma aplicação Laravel/PHP real. Os adapters de IDE para Claude Code, Cursor, Windsurf, Codex, Continue, Kimi Code, OpenCode e Antigravity são regenerados automaticamente.
|
|
212
|
+
|
|
213
|
+
---
|
|
214
|
+
|
|
215
|
+
## Inspiração & créditos
|
|
216
|
+
|
|
217
|
+
- [BMAD Method](https://github.com/bmad-code-org/BMAD-METHOD) por Brian (BMad) Madison — ciclo ágil de IA, personas de agentes, padrão de instalador, sistema de módulos.
|
|
218
|
+
- [Whiteport Design Studio expansion](https://github.com/bmad-code-org/bmad-method-wds-expansion) — metodologia UX-first, panteão nórdico (Saga, Freya), estrutura de fases.
|
|
219
|
+
|
|
220
|
+
O Wize Development Kit é uma **adaptação independente** — não afiliada nem endossada pelos autores do BMAD ou do WDS. Os nomes de personas Marvel são referências criativas sob uso nominativo justo.
|
|
221
|
+
|
|
222
|
+
---
|
|
223
|
+
|
|
224
|
+
## Licença
|
|
225
|
+
|
|
226
|
+
MIT — veja [`LICENSE`](LICENSE).
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://json.schemastore.org/package.json",
|
|
3
3
|
"name": "wize-dev-kit",
|
|
4
|
-
"version": "0.7.
|
|
4
|
+
"version": "0.7.1",
|
|
5
5
|
"description": "Full-lifecycle AI-assisted development kit with Test Architect and Whiteport Design Studio embedded. Inspired by BMAD Method and WDS.",
|
|
6
6
|
"keywords": [
|
|
7
7
|
"ai",
|
|
@@ -43,6 +43,8 @@
|
|
|
43
43
|
"tools/",
|
|
44
44
|
"schemas/",
|
|
45
45
|
"README.md",
|
|
46
|
+
"README.pt-BR.md",
|
|
47
|
+
"README.es.md",
|
|
46
48
|
"LICENSE",
|
|
47
49
|
"CHANGELOG.md",
|
|
48
50
|
"ARCH.md",
|