moai-adk 0.34.0__py3-none-any.whl → 1.1.0__py3-none-any.whl

moai_adk/templates/.claude/skills/moai-tool-ast-grep/modules/refactoring-patterns.md

@@ -0,0 +1,260 @@
+# AST-Grep Refactoring Patterns
+
+Common code transformation patterns for large-scale refactoring.
+
+## API Migration
+
+### Function Rename
+
+```bash
+# Simple rename
+sg run --pattern 'oldFunction($$$ARGS)' --rewrite 'newFunction($$$ARGS)' --lang python
+
+# With method chain
+sg run --pattern '$OBJ.oldMethod($$$ARGS)' --rewrite '$OBJ.newMethod($$$ARGS)' --lang javascript
+```
+
+### Library Migration
+
+```yaml
+# axios to fetch
+id: axios-to-fetch-get
+language: typescript
+rule:
+  pattern: 'axios.get($URL)'
+fix: 'fetch($URL).then(res => res.json())'
+
+---
+id: axios-to-fetch-post
+language: typescript
+rule:
+  pattern: 'axios.post($URL, $DATA)'
+fix: |
+  fetch($URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify($DATA)
+  }).then(res => res.json())
+```
+
+### Import Statement Update
+
+```yaml
+id: update-import-path
+language: typescript
+rule:
+  pattern: "import { $$$IMPORTS } from 'old-package'"
+fix: "import { $$$IMPORTS } from '@new-scope/new-package'"
+```
+
+## Code Modernization
+
+### var to const/let
+
+```yaml
+id: var-to-const
+language: javascript
+rule:
+  pattern: 'var $NAME = $VALUE'
+  not:
+    has:
+      pattern: '$NAME = $OTHER'
+      inside:
+        not:
+          pattern: 'var $NAME = $VALUE'
+fix: 'const $NAME = $VALUE'
+message: 'Prefer const for variables that are never reassigned'
+```
+
+### Callback to Async/Await
+
+```yaml
+id: callback-to-async
+language: javascript
+rule:
+  pattern: |
+    $FUNC($$$ARGS, function($ERR, $DATA) {
+      $$$BODY
+    })
+fix: |
+  const $DATA = await $FUNC($$$ARGS)
+  $$$BODY
+message: 'Consider using async/await instead of callbacks'
+```
+
+### Promise.then to Async/Await
+
+```yaml
+id: then-to-await
+language: typescript
+rule:
+  pattern: '$PROMISE.then($CALLBACK)'
+  inside:
+    pattern: 'async function $NAME($$$ARGS) { $$$BODY }'
+fix: 'await $PROMISE'
+```
+
+## React Patterns
+
+### Class to Functional Component
+
+```yaml
+id: class-to-functional-state
+language: typescriptreact
+rule:
+  pattern: 'this.state.$PROP'
+  inside:
+    pattern: 'class $NAME extends $$$BASE { $$$BODY }'
+message: 'Consider converting to functional component with useState'
+```
+
+### componentDidMount to useEffect
+
+```yaml
+id: componentDidMount-to-useEffect
+language: typescriptreact
+rule:
+  pattern: |
+    componentDidMount() {
+      $$$BODY
+    }
+fix: |
+  useEffect(() => {
+    $$$BODY
+  }, [])
+```
+
+### PropTypes to TypeScript
+
+```yaml
+id: proptypes-to-typescript
+language: typescriptreact
+rule:
+  pattern: '$COMPONENT.propTypes = { $$$PROPS }'
+message: 'Consider using TypeScript interfaces instead of PropTypes'
+```
+
+## Python Patterns
+
+### String Format to f-string
+
+```yaml
+id: format-to-fstring
+language: python
+rule:
+  pattern: '"$$$STR".format($ARG)'
+fix: 'f"$$$STR"'  # Note: requires manual adjustment of placeholders
+message: 'Consider using f-strings for cleaner formatting'
+```
+
+### Dict Comprehension
+
+```yaml
+id: loop-to-dict-comprehension
+language: python
+rule:
+  pattern: |
+    $DICT = {}
+    for $KEY in $ITER:
+        $DICT[$KEY] = $VALUE
+fix: '$DICT = {$KEY: $VALUE for $KEY in $ITER}'
+```
+
+### Context Manager
+
+```yaml
+id: file-to-context-manager
+language: python
+rule:
+  pattern: |
+    $FILE = open($PATH)
+    $$$BODY
+    $FILE.close()
+fix: |
+  with open($PATH) as $FILE:
+      $$$BODY
+```
+
+## Go Patterns
+
+### Error Handling
+
+```yaml
+id: error-wrap
+language: go
+rule:
+  pattern: 'return $ERR'
+  inside:
+    pattern: 'if $ERR != nil { $$$BODY }'
+fix: 'return fmt.Errorf("$FUNC: %w", $ERR)'
+message: 'Wrap errors with context'
+```
+
+### Defer Pattern
+
+```yaml
+id: close-without-defer
+language: go
+rule:
+  pattern: '$RESOURCE.Close()'
+  not:
+    inside:
+      pattern: 'defer $RESOURCE.Close()'
+message: 'Consider using defer for resource cleanup'
+```
+
+## TypeScript Patterns
+
+### Type Assertion
+
+```yaml
+id: type-assertion-style
+language: typescript
+rule:
+  pattern: '<$TYPE>$EXPR'
+fix: '$EXPR as $TYPE'
+message: 'Prefer "as" syntax for type assertions'
+```
+
+### Optional Chaining
+
+```yaml
+id: use-optional-chaining
+language: typescript
+rule:
+  pattern: '$OBJ && $OBJ.$PROP'
+fix: '$OBJ?.$PROP'
+```
+
+### Nullish Coalescing
+
+```yaml
+id: use-nullish-coalescing
+language: typescript
+rule:
+  pattern: '$VAR !== null && $VAR !== undefined ? $VAR : $DEFAULT'
+fix: '$VAR ?? $DEFAULT'
+```
+
+## Batch Refactoring
+
+### Multi-file Transformation
+
+```bash
+# Find all files
+sg run --pattern '$OLD($$$ARGS)' --lang python src/
+
+# Preview changes
+sg run --pattern '$OLD($$$ARGS)' --rewrite '$NEW($$$ARGS)' --lang python src/ --interactive
+
+# Apply changes
+sg run --pattern '$OLD($$$ARGS)' --rewrite '$NEW($$$ARGS)' --lang python src/ --update-all
+```
+
+### JSON Output for Review
+
+```bash
+sg scan --config rules.yml --json > changes.json
+# Review changes before applying
+cat changes.json | jq '.[] | {file: .path, line: .range.start.line, fix: .fix}'
+```

moai_adk/templates/.claude/skills/moai-tool-ast-grep/modules/security-rules.md

@@ -0,0 +1,239 @@
+# AST-Grep Security Rules
+
+Security vulnerability detection patterns for common attack vectors.
+
+## SQL Injection
+
+### Python
+
+```yaml
+id: sql-injection-python-format
+language: python
+severity: error
+rule:
+  any:
+    - pattern: 'cursor.execute($QUERY % $ARGS)'
+    - pattern: 'cursor.execute($QUERY.format($$$ARGS))'
+    - pattern: 'cursor.execute(f"$$$SQL")'
+    - pattern: 'execute($QUERY + $ARGS)'
+message: 'Potential SQL injection. Use parameterized queries.'
+fix: 'cursor.execute($QUERY, ($ARGS,))'
+```
+
+### JavaScript/TypeScript
+
+```yaml
+id: sql-injection-js
+language: javascript
+severity: error
+rule:
+  any:
+    - pattern: '$DB.query(`$$$SQL ${$VAR} $$$REST`)'
+    - pattern: '$DB.query($SQL + $VAR)'
+    - pattern: '$DB.raw($SQL + $VAR)'
+message: 'Potential SQL injection. Use parameterized queries.'
+```
+
+## XSS (Cross-Site Scripting)
+
+### React
+
+```yaml
+id: xss-dangerouslySetInnerHTML
+language: typescriptreact
+severity: warning
+rule:
+  pattern: 'dangerouslySetInnerHTML={{ __html: $CONTENT }}'
+  not:
+    has:
+      pattern: 'DOMPurify.sanitize($CONTENT)'
+message: 'XSS risk: sanitize content before using dangerouslySetInnerHTML'
+```
+
+### JavaScript DOM
+
+```yaml
+id: xss-innerHTML
+language: javascript
+severity: warning
+rule:
+  any:
+    - pattern: '$EL.innerHTML = $CONTENT'
+    - pattern: 'document.write($CONTENT)'
+message: 'Potential XSS vulnerability. Sanitize user input.'
+```
+
+## Secrets Detection
+
+### Hardcoded Credentials
+
+```yaml
+id: hardcoded-password
+language: python
+severity: error
+rule:
+  any:
+    - pattern: 'password = "$$$VALUE"'
+    - pattern: 'PASSWORD = "$$$VALUE"'
+    - pattern: 'secret = "$$$VALUE"'
+    - pattern: 'api_key = "$$$VALUE"'
+constraints:
+  VALUE:
+    regex: '.{8,}'  # At least 8 characters
+message: 'Hardcoded credential detected. Use environment variables.'
+```
+
+### API Keys
+
+```yaml
+id: exposed-api-key
+language: javascript
+severity: error
+rule:
+  any:
+    - pattern: 'apiKey: "$$$KEY"'
+    - pattern: 'API_KEY = "$$$KEY"'
+    - pattern: 'Authorization: "Bearer $$$TOKEN"'
+message: 'API key should not be hardcoded. Use environment variables.'
+```
+
+## Command Injection
+
+### Python
+
+```yaml
+id: command-injection-python
+language: python
+severity: error
+rule:
+  any:
+    - pattern: 'os.system($CMD)'
+    - pattern: 'subprocess.call($CMD, shell=True)'
+    - pattern: 'subprocess.run($CMD, shell=True)'
+    - pattern: 'os.popen($CMD)'
+message: 'Potential command injection. Avoid shell=True and use subprocess with list arguments.'
+fix: 'subprocess.run(shlex.split($CMD), shell=False)'
+```
+
+### JavaScript
+
+```yaml
+id: command-injection-js
+language: javascript
+severity: error
+rule:
+  any:
+    - pattern: 'exec($CMD)'
+    - pattern: 'execSync($CMD)'
+    - pattern: 'spawn($CMD, { shell: true })'
+message: 'Potential command injection. Use spawn with shell: false.'
+```
+
+## Path Traversal
+
+```yaml
+id: path-traversal
+language: python
+severity: error
+rule:
+  any:
+    - pattern: 'open($PATH + $USER_INPUT)'
+    - pattern: 'open(f"$$$PATH{$USER_INPUT}$$$REST")'
+    - pattern: 'os.path.join($BASE, $USER_INPUT)'
+  not:
+    precedes:
+      any:
+        - pattern: 'os.path.realpath($$$ARGS)'
+        - pattern: 'os.path.abspath($$$ARGS)'
+message: 'Path traversal risk. Validate and sanitize file paths.'
+```
+
+## Insecure Cryptography
+
+### Weak Hashing
+
+```yaml
+id: weak-hash-algorithm
+language: python
+severity: warning
+rule:
+  any:
+    - pattern: 'hashlib.md5($$$ARGS)'
+    - pattern: 'hashlib.sha1($$$ARGS)'
+message: 'Weak hash algorithm. Use SHA-256 or stronger.'
+fix: 'hashlib.sha256($$$ARGS)'
+```
+
+### Insecure Random
+
+```yaml
+id: insecure-random
+language: python
+severity: warning
+rule:
+  pattern: 'random.random()'
+  inside:
+    any:
+      - pattern: 'def $FUNC($$$ARGS): $$$BODY'
+        constraints:
+          FUNC:
+            regex: '.*(token|secret|key|password).*'
+message: 'Use secrets module for security-sensitive random values.'
+fix: 'secrets.token_hex(16)'
+```
+
+## CSRF Protection
+
+```yaml
+id: missing-csrf-token
+language: html
+severity: warning
+rule:
+  pattern: '<form $$$ATTRS>'
+  not:
+    has:
+      pattern: 'csrf_token'
+message: 'Form may be missing CSRF token.'
+```
+
+## Authentication Issues
+
+### Hardcoded JWT Secret
+
+```yaml
+id: hardcoded-jwt-secret
+language: javascript
+severity: error
+rule:
+  pattern: 'jwt.sign($PAYLOAD, "$SECRET")'
+message: 'JWT secret should not be hardcoded.'
+```
+
+### Missing Token Verification
+
+```yaml
+id: jwt-no-verification
+language: javascript
+severity: error
+rule:
+  pattern: 'jwt.decode($TOKEN)'
+  not:
+    inside:
+      has:
+        pattern: 'jwt.verify($TOKEN, $SECRET)'
+message: 'Use jwt.verify() instead of jwt.decode() for security.'
+```
+
+## Usage
+
+Run security scan:
+
+```bash
+sg scan --config .claude/skills/moai-tool-ast-grep/rules/sgconfig.yml --severity error
+```
+
+JSON output for CI:
+
+```bash
+sg scan --config sgconfig.yml --json | jq '.[] | select(.severity == "error")'
+```