feat: add agent skills and security templates

Signed-off-by: zebbern <185730623+zebbern@users.noreply.github.com>

Author: zebbern

.agents/skills/README.md

@@ -0,0 +1,16 @@
+# Project Agent Skills
+
+Place skill folders here for automatic discovery by Sentris Agent Skills.
+
+Each skill is a **directory** containing at least `SKILL.md`, plus optional supporting files (scripts, references, assets as text):
+
+```
+.agents/skills/my-skill/
+  SKILL.md
+  scripts/
+  references/
+```
+
+Discovered folders also include `.claude/skills/`, `.github/skills/`, `.codex/skills/`, `.kimi/skills/`, and `.opencode/skills/` in this repository.
+
+Import them from **Manage → Agent Skills → Workspace skills** in the UI, or zip a folder and use **Import zip**.

AGENTS.md

@@ -30,23 +30,27 @@ bun install && cp backend/.env.example backend/.env && cp worker/.env.example wo
 # Start dev environment (Docker infra + PM2 apps)
 just dev                           # Recommended (Linux/macOS/WSL)
 # OR:
-bun run dev                        # Cross-platform (requires bash)
+bun run dev                        # Cross-platform; respects SENTRIS_INSTANCE/.sentris-instance
 # OR (manual):
 docker compose -f docker/docker-compose.infra.yml -f docker/docker-compose.dev-ports.yml up -d
-pm2 startOrReload pm2.config.cjs --only sentris-frontend-0,sentris-backend-0,sentris-worker-0
+bun run pm2 -- startOrReload pm2.config.cjs --only sentris-frontend-0,sentris-backend-0,sentris-worker-0
 
 # Status & logs
-just dev status                    # PM2 + Docker status
+just dev status                    # PM2 + Docker + runtime health status
 just dev logs                      # Tail app logs
-pm2 status                         # PM2 only
+bun run dev status                 # Cross-platform PM2 + Docker + runtime health status
+bun run dev logs                   # Cross-platform PM2 app logs
+bun run pm2 -- status              # PM2 only via repo-local binary
 docker ps --filter name=sentris    # Docker only
 
 # Stop
 just dev stop                      # Stop PM2 + Docker
 # OR:
+bun run dev stop
+# OR:
 bun run dev:stop
 # OR (manual):
-pm2 delete sentris-frontend-0 sentris-backend-0 sentris-worker-0 && docker compose -f docker/docker-compose.infra.yml -f docker/docker-compose.dev-ports.yml down
+bun run pm2 -- delete sentris-frontend-0 sentris-backend-0 sentris-worker-0 && docker compose -f docker/docker-compose.infra.yml -f docker/docker-compose.dev-ports.yml down
 
 # Health checks
 curl -sf http://localhost:3211/health        # Backend liveness
@@ -61,7 +65,9 @@ just help                          # All commands
 
 ```bash
 just instance show     # Print active instance number
+bun run instance show  # Cross-platform fallback; initializes .sentris-instance to 0 if missing
 just instance use 5    # Set active instance for this workspace
+bun run instance use 5 # Cross-platform fallback
 ```
 
 **Instance env files**:
@@ -86,20 +92,23 @@ Full details: `docs/MULTI-INSTANCE-DEV.mdx`
 
 Local development runs as **multiple app instances** (PM2) on top of **one shared Docker infra stack**.
 
-- Shared infra (Docker Compose project `sentris-infra`): Postgres/Temporal/Redpanda/Redis/MinIO/Loki on fixed ports.
+- Shared infra (Docker Compose project `sentris`): Postgres/Temporal/Redpanda/Redis/MinIO/Loki on fixed ports.
 - Per-instance apps: `sentris-{frontend,backend,worker}-N`.
 - Isolation is via per-instance DB + Temporal namespace/task queue + Kafka topic suffixing + instance-scoped Kafka consumer groups/client IDs (not per-instance infra containers).
-- The workspace can have an **active instance** (stored in `.sentris-instance`, gitignored).
+- The workspace has an **active instance** (stored in `.sentris-instance`, gitignored). If neither `SENTRIS_INSTANCE` nor `.sentris-instance` exists, cross-platform tooling initializes `.sentris-instance` to `0` instead of silently guessing.
 - Instance env files are stored at `.instances/instance-N/{backend,worker,frontend}.env` and can be managed with `just instance-env ...`.
+- `bun run dev` initializes or repairs the active instance env files before PM2 starts, so PowerShell and Bash dev startup use the same instance-scoped env behavior.
+- `just dev`, `bun run dev`, `just dev clean`, and `bun run dev clean` prune oversized PM2 logs for the selected instance. The default cap is 64MB per app log file; override with `SENTRIS_PM2_LOG_MAX_BYTES`.
+- Backend PM2 dev watch includes `backend/src`, `backend/scripts/seed-templates`, and `packages/shared/src`; worker PM2 dev watch includes worker source plus shared runtime package sources. Keep this in sync when template validation inputs, seed catalogs, or shared execution contracts move.
 
 **Agent rule:** before running any dev commands, ensure you’re targeting the intended instance.
 
-- Always check: `just instance show`
+- Always check: `just instance show`; if `just` is unavailable, run `bun run instance show`. Either command initializes `.sentris-instance` to `0` when no active instance has been selected.
 - If the task is ambiguous (logs, curl, E2E, “run locally”, etc.), ask the user which instance to use.
 - If the user says “use instance N”, prefer either:
   - `just instance use N` then run `just dev` / `bun run test:e2e`, or
-  - explicit env override (`SENTRIS_INSTANCE=N just dev ...`) for one-off commands.
-- Local maintenance scripts that mutate or inspect local Postgres data must use the shared script runtime (`scripts/lib/local-script-runtime.ts`) instead of reading `DATABASE_URL` directly. `DATABASE_URL` is for the running app process, Drizzle CLI, and explicit app env files; local scripts should target `SENTRIS_INSTANCE` / `.sentris-instance` by default and only use script-specific overrides such as `TEMPLATE_SEED_DATABASE_URL` or the generic `SENTRIS_SCRIPT_DATABASE_URL`.
+  - explicit env override (`SENTRIS_INSTANCE=N just dev ...` or `SENTRIS_INSTANCE=N bun run dev`) for one-off commands.
+- Local maintenance scripts that mutate or inspect local Postgres data must use the shared script runtime (`scripts/lib/local-script-runtime.ts`) instead of reading `DATABASE_URL` directly. `DATABASE_URL` is for the running app process, production Drizzle runs, and explicit app env files; local scripts should target `SENTRIS_INSTANCE` / `.sentris-instance` by default and only use script-specific overrides such as `TEMPLATE_SEED_DATABASE_URL`, `DRIZZLE_DATABASE_URL`, or the generic `SENTRIS_SCRIPT_DATABASE_URL`.
 - Local scripts that start or inspect Temporal workflows must also use `getScriptTemporalTarget()` from the shared script runtime instead of reading `TEMPORAL_NAMESPACE` / `TEMPORAL_TASK_QUEUE` directly. Use script-specific `*_TEMPORAL_NAMESPACE` + `*_TEMPORAL_TASK_QUEUE` variables or `SENTRIS_SCRIPT_TEMPORAL_NAMESPACE` + `SENTRIS_SCRIPT_TEMPORAL_TASK_QUEUE` when intentionally targeting another namespace.
 - Maintenance scripts must print the target database and/or Temporal target before mutating data or starting workflows.
 
@@ -111,8 +120,9 @@ Local development runs as **multiple app instances** (PM2) on top of **one share
 
 #### E2E tests
 
-- E2E targets the backend for `SENTRIS_INSTANCE` (or the active instance).
-- When asked to run E2E, confirm the instance and ensure that instance is running: `SENTRIS_INSTANCE=N just dev start` (or `just instance use N` then `just dev start`).
+- E2E targets the backend for `SENTRIS_INSTANCE`, then legacy `E2E_INSTANCE`, then the active instance.
+- `bun run test:e2e*` uses the cross-platform Node runner at `scripts/e2e-test.js`; do not reintroduce Bash-only active instance lookup in package scripts.
+- When asked to run E2E, confirm the instance and ensure that instance is running: `SENTRIS_INSTANCE=N just dev start`, `SENTRIS_INSTANCE=N bun run dev`, or `just instance use N` then `just dev start`.
 
 #### Keep docs in sync
 
@@ -136,7 +146,7 @@ bun run lint           # Lint
 ### Database
 
 ```bash
-just db-reset                              # Reset database
+just db-reset                              # Reset active instance database
 bun --cwd backend run migration:push       # Push schema
 bun --cwd backend run db:studio            # View data
 ```

README.md

@@ -54,7 +54,7 @@ Get the dev environment running in 3 steps:
 git clone https://github.com/zebbern/Sentris.git
 cd Sentris
 bun run setup   # Install deps + create .env files
-bun run dev     # Start Docker infra + all apps
+bun run dev     # Start Docker infra + all apps for the active instance
 ```
 
 Once running:
@@ -66,33 +66,34 @@ Once running:
 | Temporal UI | <http://localhost:8081> |
 
 ```bash
-bun run dev:stop   # Stop everything (PM2 + Docker)
-bun run dev:fe     # Frontend-only dev (no Docker needed)
-pm2 logs           # View application logs
-pm2 status         # Check process status
+bun run dev status  # PM2 + Docker + runtime health for the active instance
+bun run dev logs    # View application logs for the active instance
+bun run dev stop    # Stop the active instance apps; instance 0 also stops Docker infra
+bun run dev:stop    # Compatibility alias for bun run dev stop
+bun run dev:fe      # Frontend-only dev (no Docker needed)
 ```
 
-> **Advanced:** `just dev` remains available for multi-instance development, Clerk auth auto-detection, and TLS certificate generation. See the [Multi-Instance Guide](docs/MULTI-INSTANCE-DEV.mdx) for details.
+> **Advanced:** `bun run dev` and `just dev` both support multi-instance development and active instance env files. `just dev` also handles Clerk auth auto-detection and TLS certificate generation. See the [Multi-Instance Guide](docs/MULTI-INSTANCE-DEV.mdx) for details.
 
 ---
 
 ## Capabilities
 
 ### Integrated Tooling
 
-25 security components wrapping industry-standard open-source tools:
+29 security components wrapping industry-standard open-source tools:
 
 - **Discovery & Recon**: `Subfinder`, `Amass`, `DNSX`, `Naabu`, `HTTPx`, `Katana`, `theHarvester`, `ShuffleDNS`
 - **Vulnerability Scanning**: `Nuclei`, `Trivy`, `Semgrep`, `Checkov`, `TestSSL`
 - **Secret Detection**: `TruffleHog`
-- **Threat Intelligence**: `AbuseIPDB`, `VirusTotal`, `YARA`
+- **Threat Intelligence**: `AbuseIPDB`, `VirusTotal`, `YARA`, `NPM Registry Intel`
 - **Web Security**: `Ffuf`, `Wafw00f`, `Prowler`, `Supabase Scanner`
 - **Notifications**: `Notify` (Slack, Discord, Telegram, Email)
 - **Utility**: `JSON Transform`, `Logic Scripts`, `HTTP Requests`
 
 ### Template Library
 
-- **10 live-validated security workflow templates** focused on bug bounty recon, takeover triage, exposed services, repository risk, secrets, and CVE/dependency research.
+- **30 live-validated security workflow templates** focused on bug bounty recon, takeover triage, exposed services, repository risk, secrets, and CVE/dependency research.
 - **One-click deployment**: Browse, preview, and create workflows from templates instantly.
 - **Community publishing**: Share your workflows as templates via GitHub PR with automatic secret sanitization.
 - **Maintainer preflight**: Run `bun run template-library:check` before changing templates, then `bun run template-library:verify` before handoff. These use the validation ledger and focused template tests, so unchanged templates are not rerun.
@@ -133,11 +134,16 @@ Run multiple isolated dev instances on one machine for parallel feature work:
 
 ```bash
 # Instance 0 (default)
+just instance show
+bun run instance show
 just dev
+bun run dev
 
 # Switch active workspace instance
 just instance use 1
+bun run instance use 1
 just dev
+bun run dev
 
 # Manage per-instance env files
 just instance-env init 1

backend/drizzle.config.ts

@@ -1,17 +1,16 @@
 import { defineConfig } from 'drizzle-kit';
 import 'dotenv/config';
+import { getDrizzleDatabaseTarget } from '../scripts/lib/local-script-runtime';
 
-const connectionString = process.env.DATABASE_URL;
-
-if (!connectionString) {
-  throw new Error('DATABASE_URL is not set');
-}
+const databaseTarget = getDrizzleDatabaseTarget({
+  overrideEnvVar: 'DRIZZLE_DATABASE_URL',
+});
 
 export default defineConfig({
   dialect: 'postgresql',
   schema: './src/database/schema',
   out: './drizzle',
   dbCredentials: {
-    url: connectionString,
+    url: databaseTarget.connectionString,
   },
 });

backend/package.json

@@ -10,7 +10,7 @@
     "build": "bun build src/main.ts --outdir build --target bun --external @nestjs/websockets/socket-module --external nats --external @nestjs/mongoose --external @mikro-orm/core --external @nestjs/typeorm/dist/common/typeorm.utils --external @nestjs/sequelize/dist/common/sequelize.utils --external class-transformer/storage",
     "test": "bun test",
     "lint": "eslint .",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --build",
     "generate:openapi": "bun scripts/generate-openapi.ts",
     "migration:push": "bun x drizzle-kit push",
     "migration:smoke": "bun scripts/migration-smoke.ts",
@@ -41,6 +41,7 @@
     "@temporalio/client": "^1.14.1",
     "@temporalio/worker": "^1.14.1",
     "@temporalio/workflow": "^1.14.1",
+    "adm-zip": "^0.5.17",
     "ai": "^6.0.49",
     "amqp-connection-manager": "^5.0.0",
     "amqplib": "^0.10.9",
@@ -69,6 +70,7 @@
   "devDependencies": {
     "@eslint/js": "^9.39.2",
     "@nestjs/testing": "^10.4.22",
+    "@types/adm-zip": "^0.5.8",
     "@types/bcryptjs": "^3.0.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/express": "^5.0.6",

backend/scripts/__tests__/script-database-target.test.ts

@@ -4,6 +4,7 @@ import { dirname, join, resolve } from 'path';
 import { fileURLToPath } from 'url';
 import { afterEach, describe, expect, it } from 'bun:test';
 import {
+  getDrizzleDatabaseTarget,
   formatTemporalTarget,
   getScriptDatabaseTarget,
   getScriptTemporalTarget,
@@ -22,6 +23,12 @@ function createRootWithInstance(instance: string): string {
   return root;
 }
 
+function createRootWithoutInstance(): string {
+  const root = mkdtempSync(join(tmpdir(), 'sentris-script-db-target-'));
+  cleanupDirs.push(root);
+  return root;
+}
+
 describe('script database target resolver', () => {
   afterEach(() => {
     for (const dir of cleanupDirs) {
@@ -78,14 +85,64 @@ describe('script database target resolver', () => {
     expect(target.source).toBe('env:TEMPLATE_SEED_DATABASE_URL');
   });
 
-  it('falls back to instance 0 when no instance is configured', () => {
-    const target = getScriptDatabaseTarget({ env: {}, repoRoot: createRootWithInstance('') });
+  it('initializes the active instance marker to 0 when no instance is configured', () => {
+    const root = createRootWithoutInstance();
+    const target = getScriptDatabaseTarget({ env: {}, repoRoot: root });
 
     expect(target.connectionString).toBe(
       'postgresql://sentris:sentris@localhost:5433/sentris_instance_0',
     );
     expect(target.databaseName).toBe('sentris_instance_0');
-    expect(target.source).toBe('default:instance-0');
+    expect(target.source).toBe('file:.sentris-instance');
+    expect(readFileSync(join(root, '.sentris-instance'), 'utf8')).toBe('0\n');
+  });
+
+  it('uses the active instance for local Drizzle migrations instead of stale DATABASE_URL', () => {
+    const target = getDrizzleDatabaseTarget({
+      env: {
+        DATABASE_URL: 'postgresql://sentris:sentris@localhost:5433/sentris',
+      },
+      repoRoot: createRootWithInstance('6'),
+    });
+
+    expect(target.connectionString).toBe(
+      'postgresql://sentris:sentris@localhost:5433/sentris_instance_6',
+    );
+    expect(target.databaseName).toBe('sentris_instance_6');
+    expect(target.source).toBe('file:.sentris-instance');
+    expect(target.ignoredDatabaseUrl).toBe(true);
+  });
+
+  it('allows an explicit Drizzle database override for intentional local targeting', () => {
+    const target = getDrizzleDatabaseTarget({
+      env: {
+        DATABASE_URL: 'postgresql://sentris:sentris@localhost:5433/sentris',
+        DRIZZLE_DATABASE_URL: 'postgresql://sentris:sentris@localhost:5433/manual_drizzle',
+      },
+      repoRoot: createRootWithInstance('6'),
+    });
+
+    expect(target.connectionString).toBe(
+      'postgresql://sentris:sentris@localhost:5433/manual_drizzle',
+    );
+    expect(target.databaseName).toBe('manual_drizzle');
+    expect(target.source).toBe('env:DRIZZLE_DATABASE_URL');
+    expect(target.ignoredDatabaseUrl).toBe(true);
+  });
+
+  it('uses DATABASE_URL for production Drizzle migrations', () => {
+    const target = getDrizzleDatabaseTarget({
+      env: {
+        NODE_ENV: 'production',
+        DATABASE_URL: 'postgresql://sentris:sentris@db:5432/prod_sentris',
+      },
+      repoRoot: createRootWithInstance('6'),
+    });
+
+    expect(target.connectionString).toBe('postgresql://sentris:sentris@db:5432/prod_sentris');
+    expect(target.databaseName).toBe('prod_sentris');
+    expect(target.source).toBe('env:DATABASE_URL');
+    expect(target.ignoredDatabaseUrl).toBe(false);
   });
 
   it('rejects invalid instance values before building a database URL', () => {
@@ -156,6 +213,14 @@ describe('script database target resolver', () => {
     }
   });
 
+  it('keeps Drizzle CLI database targeting on the shared resolver', () => {
+    const source = readFileSync(join(repoRoot, 'backend', 'drizzle.config.ts'), 'utf-8');
+
+    expect(source).toContain('getDrizzleDatabaseTarget');
+    expect(source).toContain('DRIZZLE_DATABASE_URL');
+    expect(source).not.toContain('process.env.DATABASE_URL');
+  });
+
   it('prevents all local database maintenance scripts from reading DATABASE_URL directly', () => {
     const databaseScriptFiles = [
       join(scriptsDir, 'delete-all-workflow-runs.ts'),

backend/scripts/__tests__/setup-opensearch.test.ts

@@ -0,0 +1,14 @@
+import { readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { describe, expect, it } from 'bun:test';
+
+const backendRoot = resolve(import.meta.dir, '..', '..');
+
+describe('setup-opensearch script', () => {
+  it('uses the OpenSearch client DynamicMapping string literal for object mappings', () => {
+    const source = readFileSync(join(backendRoot, 'scripts', 'setup-opensearch.ts'), 'utf8');
+
+    expect(source).toContain("dynamic: 'true'");
+    expect(source).not.toContain('dynamic: true');
+  });
+});