moai-adk 0.8.0__py3-none-any.whl → 1.1.0__py3-none-any.whl

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/quality/deprecated-apis.yml

@@ -0,0 +1,84 @@
+# Deprecated API Detection Rules
+
+id: deprecated-substr
+language: javascript
+severity: warning
+message: "substr() is deprecated. Use slice() or substring() instead."
+rule:
+  pattern: $STR.substr($$$ARGS)
+fix: $STR.slice($$$ARGS)
+
+---
+id: deprecated-escape
+language: javascript
+severity: warning
+message: "escape() is deprecated. Use encodeURIComponent() instead."
+rule:
+  pattern: escape($STR)
+fix: encodeURIComponent($STR)
+
+---
+id: deprecated-unescape
+language: javascript
+severity: warning
+message: "unescape() is deprecated. Use decodeURIComponent() instead."
+rule:
+  pattern: unescape($STR)
+fix: decodeURIComponent($STR)
+
+---
+id: deprecated-component-will-mount
+language: typescriptreact
+severity: error
+message: "componentWillMount is deprecated. Use componentDidMount or useEffect."
+rule:
+  pattern: componentWillMount() { $$$BODY }
+
+---
+id: deprecated-component-will-receive-props
+language: typescriptreact
+severity: error
+message: "componentWillReceiveProps is deprecated. Use getDerivedStateFromProps or useEffect."
+rule:
+  pattern: componentWillReceiveProps($PROPS) { $$$BODY }
+
+---
+id: deprecated-find-dom-node
+language: typescriptreact
+severity: warning
+message: "findDOMNode is deprecated. Use refs instead."
+rule:
+  pattern: ReactDOM.findDOMNode($COMPONENT)
+
+---
+id: deprecated-python-imp
+language: python
+severity: warning
+message: "imp module is deprecated. Use importlib instead."
+rule:
+  pattern: import imp
+
+---
+id: deprecated-python-optparse
+language: python
+severity: info
+message: "optparse is deprecated. Use argparse instead."
+rule:
+  pattern: import optparse
+
+---
+id: deprecated-python-thread
+language: python
+severity: warning
+message: "thread module is deprecated. Use threading instead."
+rule:
+  pattern: import thread
+
+---
+id: deprecated-python-cgi-escape
+language: python
+severity: warning
+message: "cgi.escape() is deprecated. Use html.escape() instead."
+rule:
+  pattern: cgi.escape($$$ARGS)
+fix: html.escape($$$ARGS)

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/security/secrets-detection.yml

@@ -0,0 +1,89 @@
+# Secrets and Credentials Detection Rules
+
+id: hardcoded-password-python
+language: python
+severity: error
+message: "Hardcoded credential detected. Use environment variables."
+rule:
+  any:
+    - pattern: password = "$$$VALUE"
+    - pattern: PASSWORD = "$$$VALUE"
+    - pattern: passwd = "$$$VALUE"
+    - pattern: secret = "$$$VALUE"
+    - pattern: SECRET = "$$$VALUE"
+    - pattern: api_key = "$$$VALUE"
+    - pattern: API_KEY = "$$$VALUE"
+    - pattern: apikey = "$$$VALUE"
+
+---
+id: hardcoded-password-js
+language: javascript
+severity: error
+message: "Hardcoded credential detected. Use environment variables."
+rule:
+  any:
+    - pattern: "password: '$$$VALUE'"
+    - pattern: 'password: "$$$VALUE"'
+    - pattern: "apiKey: '$$$VALUE'"
+    - pattern: 'apiKey: "$$$VALUE"'
+    - pattern: "secret: '$$$VALUE'"
+    - pattern: 'secret: "$$$VALUE"'
+    - pattern: const password = "$$$VALUE"
+    - pattern: const apiKey = "$$$VALUE"
+
+---
+id: hardcoded-password-ts
+language: typescript
+severity: error
+message: "Hardcoded credential detected. Use environment variables."
+rule:
+  any:
+    - pattern: "password: '$$$VALUE'"
+    - pattern: 'password: "$$$VALUE"'
+    - pattern: "apiKey: '$$$VALUE'"
+    - pattern: 'apiKey: "$$$VALUE"'
+    - pattern: const password = "$$$VALUE"
+    - pattern: const apiKey = "$$$VALUE"
+
+---
+id: hardcoded-jwt-secret
+language: javascript
+severity: error
+message: "JWT secret should not be hardcoded"
+rule:
+  any:
+    - pattern: jwt.sign($PAYLOAD, "$SECRET")
+    - pattern: jwt.verify($TOKEN, "$SECRET")
+
+---
+id: hardcoded-jwt-secret-ts
+language: typescript
+severity: error
+message: "JWT secret should not be hardcoded"
+rule:
+  any:
+    - pattern: jwt.sign($PAYLOAD, "$SECRET")
+    - pattern: jwt.verify($TOKEN, "$SECRET")
+
+---
+id: aws-credentials-python
+language: python
+severity: error
+message: "AWS credentials should not be hardcoded"
+rule:
+  any:
+    - pattern: aws_access_key_id = "$$$VALUE"
+    - pattern: aws_secret_access_key = "$$$VALUE"
+    - pattern: AWS_ACCESS_KEY_ID = "$$$VALUE"
+    - pattern: AWS_SECRET_ACCESS_KEY = "$$$VALUE"
+
+---
+id: private-key-detection
+language: python
+severity: error
+message: "Private key should not be hardcoded in source code"
+rule:
+  any:
+    - pattern: private_key = "$$$VALUE"
+    - pattern: PRIVATE_KEY = "$$$VALUE"
+    - pattern: ssh_key = "$$$VALUE"

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/security/sql-injection.yml

@@ -0,0 +1,45 @@
+# SQL Injection Detection Rules
+
+id: sql-injection-python-format
+language: python
+severity: error
+message: "Potential SQL injection: Use parameterized queries instead of string formatting"
+rule:
+  any:
+    - pattern: cursor.execute($QUERY % $ARGS)
+    - pattern: cursor.execute($QUERY.format($$$ARGS))
+    - pattern: cursor.execute(f"$$$SQL")
+    - pattern: execute($QUERY + $VAR)
+
+---
+id: sql-injection-python-fstring
+language: python
+severity: error
+message: "Potential SQL injection: f-strings in SQL queries are dangerous"
+rule:
+  pattern: |
+    cursor.execute(f"$$$SQL")
+
+---
+id: sql-injection-js-template
+language: javascript
+severity: error
+message: "Potential SQL injection: Use parameterized queries"
+rule:
+  any:
+    - pattern: $DB.query(`$$$SQL ${$VAR} $$$REST`)
+    - pattern: $DB.query($SQL + $VAR)
+    - pattern: $DB.raw($SQL + $VAR)
+    - pattern: knex.raw($SQL + $VAR)
+
+---
+id: sql-injection-ts-template
+language: typescript
+severity: error
+message: "Potential SQL injection: Use parameterized queries"
+rule:
+  any:
+    - pattern: $DB.query(`$$$SQL ${$VAR} $$$REST`)
+    - pattern: $DB.query($SQL + $VAR)
+    - pattern: prisma.$raw($SQL + $VAR)
+    - pattern: knex.raw($SQL + $VAR)

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/security/xss-prevention.yml

@@ -0,0 +1,50 @@
+# XSS Prevention Rules
+
+id: xss-dangerouslySetInnerHTML
+language: typescriptreact
+severity: warning
+message: "XSS risk: Sanitize content before using dangerouslySetInnerHTML"
+rule:
+  pattern: dangerouslySetInnerHTML={{ __html: $CONTENT }}
+
+---
+id: xss-dangerouslySetInnerHTML-jsx
+language: javascript
+severity: warning
+message: "XSS risk: Sanitize content before using dangerouslySetInnerHTML"
+rule:
+  pattern: dangerouslySetInnerHTML={{ __html: $CONTENT }}
+
+---
+id: xss-innerHTML
+language: javascript
+severity: warning
+message: "Potential XSS: innerHTML assignment with user input"
+rule:
+  any:
+    - pattern: $EL.innerHTML = $CONTENT
+    - pattern: document.write($CONTENT)
+    - pattern: $EL.outerHTML = $CONTENT
+
+---
+id: xss-document-write
+language: javascript
+severity: error
+message: "document.write is a security risk and bad practice"
+rule:
+  pattern: document.write($CONTENT)
+
+---
+id: xss-eval-usage
+language: javascript
+severity: error
+message: "eval() is dangerous and can lead to code injection"
+rule:
+  any:
+    - pattern: eval($CODE)
+    - pattern: new Function($CODE)
+    - pattern: setTimeout($CODE, $DELAY)
+    - pattern: setInterval($CODE, $DELAY)
+  constraints:
+    CODE:
+      kind: string

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/sgconfig.yml

@@ -0,0 +1,54 @@
+# AST-Grep Configuration for MoAI-ADK
+# https://ast-grep.github.io/reference/sgconfig.html
+
+ruleDirs:
+  - security
+  - quality
+  - languages
+
+testConfigs:
+  - ./**/__tests__/*.yml
+
+languageGlobs:
+  python:
+    - "**/*.py"
+    - "**/*.pyi"
+  javascript:
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  typescript:
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.mts"
+    - "**/*.cts"
+  go:
+    - "**/*.go"
+  rust:
+    - "**/*.rs"
+  java:
+    - "**/*.java"
+  kotlin:
+    - "**/*.kt"
+    - "**/*.kts"
+  cpp:
+    - "**/*.c"
+    - "**/*.cpp"
+    - "**/*.cc"
+    - "**/*.h"
+    - "**/*.hpp"
+  ruby:
+    - "**/*.rb"
+  php:
+    - "**/*.php"
+
+# Custom rules utilities
+utils:
+  is-security-sensitive:
+    any:
+      - pattern: password
+      - pattern: secret
+      - pattern: api_key
+      - pattern: token
+      - pattern: credential

moai_adk/templates/.claude/skills/moai-workflow-jit-docs/SKILL.md

@@ -0,0 +1,251 @@
+---
+name: "moai-workflow-jit-docs"
+description: "Enhanced Just-In-Time document loading system that intelligently discovers, loads, and caches relevant documentation based on user intent and project context. Use when users need specific documentation, when working with new technologies, when answering domain-specific questions, or when context indicates documentation gaps."
+version: 3.0.0
+category: "workflow"
+modularized: false
+user-invocable: false
+tags:
+  [
+    "workflow",
+    "documentation",
+    "jit-loading",
+    "context-aware",
+    "caching",
+    "discovery",
+  ]
+status: "active"
+updated: 2026-01-08
+allowed-tools:
+  - Read
+  - Grep
+  - Glob
+  - WebFetch
+  - WebSearch
+  - mcp__context7__resolve-library-id
+  - mcp__context7__get-library-docs
+---
+
+## Quick Reference (30 seconds)
+
+Purpose: Load relevant documentation on-demand based on user intent and context.
+
+Primary Tools:
+
+- WebSearch: Find latest documentation and resources online
+- WebFetch: Retrieve specific documentation pages
+- Context7 MCP: Access official library documentation (when available)
+- Read, Grep, Glob: Search local project documentation
+
+Trigger Patterns:
+
+- User asks specific technical questions
+- Technology keywords detected in conversation
+- Domain expertise required for task completion
+- Implementation guidance needed
+
+## Implementation Guide
+
+### Intent Detection
+
+The system recognizes documentation needs through several patterns:
+
+Question-Based Triggers:
+
+- When users ask specific implementation questions (e.g., "how do I implement JWT authentication?")
+- When users seek best practices or optimization guidance
+- When troubleshooting questions arise
+
+Technology-Specific Triggers:
+
+- Detection of framework names: FastAPI, React, PostgreSQL, Docker, Kubernetes
+- Detection of library names: pytest, TypeScript, GraphQL, Redis
+- Detection of tool names: npm, pip, cargo, maven
+
+Domain-Specific Triggers:
+
+- Authentication and authorization topics
+- Database and data modeling discussions
+- Performance optimization inquiries
+- Security-related questions
+
+Pattern-Based Triggers:
+
+- Implementation requests: "implement", "create", "build"
+- Architecture discussions: "design", "structure", "pattern"
+- Troubleshooting: "debug", "fix", "error", "not working"
+
+### Documentation Sources
+
+The system retrieves documentation from multiple sources in priority order:
+
+Local Project Documentation (Highest Priority):
+
+- Check .moai/docs/ for project-specific documentation
+- Check .moai/specs/ for requirements and specifications
+- Check README.md for project overview
+- Check docs/ directory for comprehensive documentation
+
+Official Documentation Sources:
+
+- Use WebFetch to retrieve official framework documentation
+- Use Context7 MCP tools when available for library documentation
+- Access technology-specific official websites
+
+Community Resources:
+
+- Use WebSearch to find high-quality tutorials
+- Search for Stack Overflow solutions with high vote counts
+- Find GitHub discussions for specific issues
+
+Real-Time Web Research:
+
+- Use WebSearch with current year for latest information
+- Search for recent best practices and updates
+- Find new features and deprecation notices
+
+### Loading Strategies
+
+Intent Analysis Process:
+
+- Identify technologies mentioned in user request
+- Determine domain areas relevant to the question
+- Classify question type (implementation, troubleshooting, conceptual)
+- Assess complexity to determine documentation depth needed
+
+Source Prioritization:
+
+- If local documentation exists: Load project-specific docs first
+- If official documentation available: Retrieve authoritative sources
+- If implementation examples needed: Search community resources
+- If latest information required: Perform web research
+
+Context-Aware Caching:
+
+- Cache retrieved documentation within session
+- Maintain relevance based on current conversation context
+- Remove outdated content when context shifts
+- Prioritize frequently accessed documentation
+
+### Quality Assessment
+
+Content Quality Evaluation:
+
+- Authority: Official sources receive highest trust
+- Recency: Content within 12 months preferred for fast-moving technologies
+- Completeness: Documentation with examples ranked higher
+- Relevance: Match between content and user intent
+
+Relevance Ranking:
+
+- Calculate match between documentation content and user question
+- Weight authority (30%), recency (25%), completeness (25%), relevance (20%)
+- Return highest-scoring documentation first
+- Indicate confidence level in retrieved information
+
+### Practical Workflows
+
+Authentication Implementation Workflow:
+
+- When user asks about authentication: Detect technologies (e.g., FastAPI, JWT)
+- Identify domains: authentication, security
+- Load FastAPI security documentation via WebFetch
+- Search for JWT best practices via WebSearch
+- Provide comprehensive guidance with source attribution
+
+Database Optimization Workflow:
+
+- When user asks about query performance: Detect database technology
+- Identify domain: performance, optimization
+- Load official database documentation
+- Search for optimization guides and tutorials
+- Provide actionable recommendations with sources
+
+New Technology Adoption Workflow:
+
+- When user introduces unfamiliar technology: Detect technology name
+- Load official getting started documentation
+- Search for migration guides if applicable
+- Find integration patterns with existing stack
+- Provide strategic adoption guidance
+
+### Error Handling
+
+Network Failures:
+
+- If web search fails: Fall back to cached content
+- If WebFetch fails: Use local documentation if available
+- Indicate partial results when some sources unreachable
+
+Content Quality Issues:
+
+- If retrieved content seems outdated: Search for newer sources
+- If relevance unclear: Ask user for clarification
+- If conflicting information found: Present multiple sources with dates
+
+Relevance Mismatches:
+
+- If initial search yields poor results: Refine search query
+- If user context unclear: Request clarification before loading
+- If documentation gap exists: Acknowledge limitation
+
+### Performance Optimization
+
+Caching Strategy:
+
+- Maintain session-level cache for frequently accessed docs
+- Keep project-specific documentation in memory
+- Evict stale content based on access time
+
+Efficient Loading:
+
+- Load documentation only when explicitly needed
+- Avoid preloading all possible documentation
+- Use targeted searches rather than broad queries
+
+Batch Processing:
+
+- Combine related searches when possible
+- Group documentation requests by technology
+- Process multiple sources in parallel when appropriate
+
+## Advanced Patterns
+
+Multi-Source Aggregation:
+
+- Combine official documentation with community examples
+- Cross-reference multiple authoritative sources
+- Synthesize comprehensive answers from diverse materials
+
+Context Persistence:
+
+- Remember documentation loaded earlier in conversation
+- Avoid redundant loading of same documentation
+- Build cumulative knowledge through session
+
+Proactive Loading:
+
+- Anticipate documentation needs based on conversation flow
+- Pre-load related topics when discussing complex features
+- Suggest relevant documentation before user asks
+
+---
+
+## Works Well With
+
+Agents:
+
+- workflow-docs: Documentation generation
+- core-planner: Documentation planning
+- workflow-spec: SPEC documentation
+
+Skills:
+
+- moai-docs-generation: Documentation generation
+- moai-workflow-docs: Documentation validation
+- moai-library-nextra: Nextra documentation
+
+Commands:
+
+- /moai:3-sync: Documentation synchronization
+- /moai:9-feedback: Documentation improvements