@lifeaitools/rdc-skills 0.20.2 → 0.20.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/bin/rdc-skills-mcp.mjs

@@ -39,6 +39,7 @@ import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { execFileSync } from 'node:child_process';
 
 import {
   listSkills,
@@ -62,6 +63,29 @@ function pkgVersion() {
   }
 }
 
+// Commit the running process actually LOADED — resolved ONCE at startup, never
+// per-request, so /health reports a PROVABLE commit. Resolution order:
+//   1. git-sha.json — baked at pack/publish (scripts/stamp-git-sha.mjs). This is
+//      the PRODUCTION path: the process runs from the npm install (no .git), so
+//      runtime rev-parse can't work — the stamped file is the source of truth.
+//   2. runtime `git rev-parse` — the DEV path (running straight from the checkout).
+//   3. env override, then 'unknown'.
+const GIT_SHA = (() => {
+  try {
+    const stamped = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'git-sha.json'), 'utf8')).sha;
+    if (stamped && stamped !== 'unknown') return stamped;
+  } catch { /* not stamped — fall through to runtime/dev resolution */ }
+  try {
+    return execFileSync('git', ['rev-parse', 'HEAD'], {
+      cwd: REPO_ROOT,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return process.env.RDC_SKILLS_GIT_SHA || 'unknown';
+  }
+})();
+
 // Soft process-wide default variant, updated whenever a client initializes.
 let lastDetectedVariant = 'cloud';
 
@@ -188,7 +212,7 @@ function startHttp() {
     } catch {
       skills = 0;
     }
-    res.json({ status: 'ok', service: 'rdc-skills-mcp', version: pkgVersion(), skills });
+    res.json({ status: 'ok', service: 'rdc-skills-mcp', version: pkgVersion(), git_sha: GIT_SHA, skills });
   });
 
   // Block OAuth discovery so connectors skip OAuth and connect direct — /mcp is open.

package/git-sha.json

@@ -0,0 +1,3 @@
+{
+  "sha": "d7e04b5d2955e49d3a63357710e1691a48f2184b"
+}

package/hooks/check-rdc-environment.js

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+/**
+ * SessionStart hook — hard gate for the RDC skills runtime.
+ *
+ * This hook repairs the approved install path when it can do so safely:
+ *   npm install -g @lifeaitools/rdc-skills@latest
+ *   rdc-skills-install --profile lifeai --project-root <repo> --write-startup-blocks
+ *
+ * It then verifies that the local MCP server answers /health and sees a real
+ * skills catalog. If repair fails, startup is blocked before agents trust stale
+ * copied skill files.
+ */
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execFileSync, execSync } = require('child_process');
+const hookLog = require('./hook-logger');
+
+const MIN_SKILLS = 20;
+const MCP_HEALTH = 'http://127.0.0.1:3110/health';
+const PACKAGE = '@lifeaitools/rdc-skills';
+const stampPath = path.join(os.tmpdir(), 'rdc-skills-environment-last-repair.json');
+
+function q(value) {
+  return `"${String(value).replace(/"/g, '\\"')}"`;
+}
+
+function run(command, args, opts = {}) {
+  return execFileSync(command, args, {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: opts.timeout || 30000,
+    cwd: opts.cwd || process.cwd(),
+    env: { ...process.env, ...(opts.env || {}) },
+  }).trim();
+}
+
+function shell(command, opts = {}) {
+  return execSync(command, {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: opts.timeout || 30000,
+    cwd: opts.cwd || process.cwd(),
+    env: { ...process.env, ...(opts.env || {}) },
+  }).trim();
+}
+
+function commandExists(name) {
+  try {
+    if (process.platform === 'win32') run('where.exe', [name], { timeout: 5000 });
+    else run('which', [name], { timeout: 5000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function projectRoot() {
+  try {
+    return shell('git rev-parse --show-toplevel', { timeout: 5000 });
+  } catch {
+    return process.cwd();
+  }
+}
+
+function globalPackageJson() {
+  try {
+    const root = shell('npm root -g', { timeout: 10000 });
+    const pkg = path.join(root, '@lifeaitools', 'rdc-skills', 'package.json');
+    if (!fs.existsSync(pkg)) return null;
+    return JSON.parse(fs.readFileSync(pkg, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+async function health() {
+  try {
+    const res = await fetch(MCP_HEALTH, { signal: AbortSignal.timeout(4000) });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}
+
+function recentlyRepaired() {
+  try {
+    const data = JSON.parse(fs.readFileSync(stampPath, 'utf8'));
+    return Date.now() - Date.parse(data.ts) < 10 * 60 * 1000;
+  } catch {
+    return false;
+  }
+}
+
+function markRepaired(reason) {
+  try {
+    fs.writeFileSync(stampPath, JSON.stringify({ ts: new Date().toISOString(), reason }, null, 2));
+  } catch {
+    /* best effort */
+  }
+}
+
+function repair(reason) {
+  hookLog('check-rdc-environment', 'SessionStart', 'repair', { reason });
+  shell(`npm install -g ${q(`${PACKAGE}@latest`)}`, { timeout: 120000 });
+  shell(`rdc-skills-install --profile lifeai --project-root ${q(projectRoot())} --write-startup-blocks`, { timeout: 180000 });
+  markRepaired(reason);
+}
+
+function block(message, details = {}) {
+  hookLog('check-rdc-environment', 'SessionStart', 'block', { message, ...details });
+  process.stdout.write(JSON.stringify({
+    systemMessage:
+      `HARD BLOCK — RDC skills environment is not healthy.\n\n` +
+      `${message}\n\n` +
+      `Do not proceed with RDC work until the approved install path is repaired:\n` +
+      `npm install -g @lifeaitools/rdc-skills@latest\n` +
+      `rdc-skills-install --profile lifeai --project-root ${projectRoot()} --write-startup-blocks`
+  }));
+  process.exit(1);
+}
+
+async function main() {
+  const initialPkg = globalPackageJson();
+  const initialHealth = await health();
+  const reasons = [];
+
+  if (!initialPkg) reasons.push('global package missing');
+  if (!commandExists('rdc-skills-install')) reasons.push('installer command missing');
+  if (!initialHealth || initialHealth.status !== 'ok' || Number(initialHealth.skills || 0) < MIN_SKILLS) {
+    reasons.push('local MCP health/catalog invalid');
+  }
+
+  if (reasons.length) {
+    if (recentlyRepaired()) {
+      block(`RDC skills still unhealthy after a recent repair attempt: ${reasons.join(', ')}`);
+    }
+    try {
+      repair(reasons.join(', '));
+    } catch (err) {
+      block(`Automatic RDC skills repair failed: ${err.message}`, { reasons });
+    }
+  }
+
+  const finalPkg = globalPackageJson();
+  const finalHealth = await health();
+  if (!finalPkg) block('Global @lifeaitools/rdc-skills package is missing after repair.');
+  if (!commandExists('rdc-skills-install')) block('rdc-skills-install is missing after repair.');
+  if (!finalHealth || finalHealth.status !== 'ok' || Number(finalHealth.skills || 0) < MIN_SKILLS) {
+    block(`rdc-skills MCP is unhealthy after repair. Health: ${JSON.stringify(finalHealth)}`);
+  }
+
+  hookLog('check-rdc-environment', 'SessionStart', 'pass', {
+    version: finalPkg.version,
+    mcpVersion: finalHealth.version,
+    skills: finalHealth.skills,
+  });
+  process.exit(0);
+}
+
+main().catch((err) => block(`RDC skills environment check crashed: ${err.message}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.20.2",
+  "version": "0.20.4",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",
@@ -38,7 +38,7 @@
     "test:mcp:remote": "node tests/mcp.test.mjs --remote",
     "mcp": "node bin/rdc-skills-mcp.mjs",
     "rebuild-mcp": "node scripts/rebuild-mcp.mjs",
-    "prepack": "node scripts/validate-publish-manifests.js --mode warn || true && node scripts/validate-place-histories.js --mode warn || true"
+    "prepack": "node scripts/prepack.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",

package/scripts/install-rdc-skills.js

@@ -707,6 +707,7 @@ function buildHooksConfig(hooksDir, profile = 'core') {
 
   if (profile === 'lifeai') {
     config.SessionStart = [{ hooks: [
+      cmd('check-rdc-environment.js', 'Checking RDC skills runtime...'),
       cmd('check-cwd.js'),
       cmd('check-stale-work-items.js', 'Checking for stale work items...'),
     ]}];

package/scripts/prepack.mjs

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+/**
+ * Cross-platform prepack steps.
+ *
+ * The validators are advisory in package builds; they report drift in the
+ * LIFEAI publishing corpus, but they must not make `npm pack` fail on Windows
+ * because cmd.exe does not provide a POSIX `true` command (the old
+ * `... || true && ...` chain silently short-circuited under cmd.exe).
+ *
+ * stamp-git-sha bakes the current HEAD into git-sha.json so the MCP server can
+ * report a PROVABLE running commit on /health even when it runs from the npm
+ * install (no .git at runtime). It runs LAST and is required, not advisory.
+ */
+
+import { spawnSync } from 'node:child_process';
+
+const advisory = [
+  ['scripts/validate-publish-manifests.js', '--mode', 'warn'],
+  ['scripts/validate-place-histories.js', '--mode', 'warn'],
+];
+
+for (const args of advisory) {
+  const result = spawnSync(process.execPath, args, { stdio: 'inherit' });
+  if (result.error) {
+    console.warn(`[prepack] advisory check failed to launch: ${args[0]}: ${result.error.message}`);
+  } else if (result.status !== 0) {
+    console.warn(`[prepack] advisory check exited ${result.status}: ${args[0]}`);
+  }
+}
+
+// Required: stamp the git SHA (never fails the build — writes 'unknown' if git is unavailable).
+spawnSync(process.execPath, ['scripts/stamp-git-sha.mjs'], { stdio: 'inherit' });

package/scripts/self-test.mjs

@@ -331,6 +331,14 @@ function expectedSkillName(dirOrFile) {
   return "rdc:" + base;
 }
 
+function expectedFrontmatterName(dirOrFile, frontmatterName) {
+  const base = basename(dirOrFile, ".md");
+  if (frontmatterName && frontmatterName.startsWith("rdc:")) {
+    return expectedSkillName(dirOrFile);
+  }
+  return base;
+}
+
 function findReferencedFiles(body) {
   const refs = [];
   const guideRe = /(?:^|[\s(`'"/])(?:\.rdc\/)?guides\/([\w/-]+\.md)/g;
@@ -473,7 +481,7 @@ function auditSkill(filepath) {
     }
   }
 
-  const expected = expectedSkillName(skillDirOrFile);
+  const expected = expectedFrontmatterName(skillDirOrFile, fm.name);
   if (expected && fm.name !== expected) {
     addFinding(
       result,

package/scripts/stamp-git-sha.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+/**
+ * stamp-git-sha.mjs — bake the current git HEAD into git-sha.json at pack/publish
+ * time. The MCP server runs from the npm-installed copy (no .git), so it cannot
+ * `git rev-parse` at runtime; this build-time stamp is how /health reports a
+ * PROVABLE commit ("running artifact == this exact published commit"). Run from
+ * `prepack`, so `npm pack`/`npm publish` (incl. the publish.yml CI job at the
+ * tagged commit) embeds the right SHA. Never fails the build — writes 'unknown'
+ * if git is unavailable (e.g. a tarball-only checkout).
+ */
+import { execFileSync } from 'node:child_process';
+import { writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+let sha = 'unknown';
+try {
+  sha = execFileSync('git', ['rev-parse', 'HEAD'], {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'ignore'],
+  }).trim();
+} catch {
+  sha = process.env.RDC_SKILLS_GIT_SHA || 'unknown';
+}
+const out = path.join(root, 'git-sha.json');
+writeFileSync(out, JSON.stringify({ sha }, null, 2) + '\n');
+console.error(`[stamp-git-sha] wrote ${out} sha=${sha}`);