@lifeaitools/rdc-skills 0.31.0 → 0.31.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.31.0",
+  "version": "0.31.2",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/deploy/install-systemd.sh

@@ -10,6 +10,12 @@ if [[ "$repo_root" != "/srv/regen/rdc-skills" ]]; then
   exit 1
 fi
 
+cd "$repo_root"
+# The MCP imports declared runtime dependencies (including express).  A Git
+# checkout alone cannot satisfy those imports after a clean host or dependency
+# cleanup, so install the committed production graph before the unit is enabled.
+npm ci --omit=dev --no-audit --no-fund
+
 install -m 0644 "$unit_source" "$unit_target"
 systemctl daemon-reload
 systemctl enable --now rdc-skills-mcp.service

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.31.0",
+  "version": "0.31.2",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",

package/scripts/verify-live-install.mjs

@@ -38,7 +38,10 @@ const MCP_URL = mcpUrlIdx >= 0 ? args[mcpUrlIdx + 1] : 'https://rdc-skills.regen
 const codexRootIdx = args.indexOf('--codex-root');
 const CODEX_ROOT = codexRootIdx >= 0 ? path.resolve(args[codexRootIdx + 1]) : null;
 
-const repoRoot = path.resolve(new URL('.', import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1'), '..');
+const installedRoot = path.resolve(new URL('.', import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1'), '..');
+// Tests and package consumers can supply an unpacked package root.  A global npm
+// installation has no .git directory, so it must never be treated as a checkout.
+const repoRoot = process.env.RDC_SKILLS_ROOT ? path.resolve(process.env.RDC_SKILLS_ROOT) : installedRoot;
 const claudeHome = path.join(os.homedir(), '.claude');
 const PLUGIN_KEY = 'rdc-skills@rdc-skills';
 
@@ -73,11 +76,24 @@ function httpGetJson(url, timeoutMs = 8000) {
   });
 }
 
-// ── Source of truth — origin/master, FRESHLY FETCHED. Never local disk: a
-// checkout can silently sit behind origin (this is the exact failure the
-// "canonical fallback" repo had this session — 31 commits behind while being
-// treated as the source of truth). ──────────────────────────────────────────
+function packagedTruth() {
+  const pkg = readJson(path.join(repoRoot, 'package.json'));
+  if (!pkg.version) throw new Error(`package.json version missing at ${repoRoot}`);
+  const skillsRoot = path.join(repoRoot, 'skills');
+  const skillCount = fs.existsSync(skillsRoot)
+    ? fs.readdirSync(skillsRoot, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() && fs.existsSync(path.join(skillsRoot, entry.name, 'SKILL.md'))).length
+    : 0;
+  return { sha: null, shortSha: 'package', version: pkg.version, skillCount, authority: 'installed npm package' };
+}
+
+// ── Source of truth — origin/master when this is a checkout, otherwise the
+// installed npm package. A global npm install is intentionally not a Git repo;
+// requiring `git fetch` there made every successful install emit a false error.
+// Checkout mode remains fresh-remote authoritative to catch stale source trees.
+// ───────────────────────────────────────────────────────────────────────────
 function sourceOfTruth() {
+  if (!fs.existsSync(path.join(repoRoot, '.git'))) return packagedTruth();
   execSync('git fetch origin master', { cwd: repoRoot, stdio: 'pipe' });
   const sha = execSync('git rev-parse origin/master', { cwd: repoRoot, encoding: 'utf8' }).trim();
   const pkgRaw = execSync('git show origin/master:package.json', { cwd: repoRoot, encoding: 'utf8' });
@@ -93,7 +109,12 @@ function sourceOfTruth() {
       skillCount++;
     } catch { /* not a real skill dir */ }
   }
-  return { sha, shortSha: sha.slice(0, 7), version, skillCount };
+  return { sha, shortSha: sha.slice(0, 7), version, skillCount, authority: 'origin/master' };
+}
+
+if (args.includes('--self-test-source-of-truth')) {
+  console.log(JSON.stringify(sourceOfTruth()));
+  process.exit(0);
 }
 
 // ── Surface 1: Claude CLI ────────────────────────────────────────────────────
@@ -110,7 +131,7 @@ function checkClaudeCli(truth) {
     ? fs.readdirSync(cacheSkillsDir, { withFileTypes: true })
         .filter((e) => e.isDirectory() && fs.existsSync(path.join(cacheSkillsDir, e.name, 'SKILL.md'))).length
     : -1;
-  const shaMatch = entry.gitCommitSha === truth.sha;
+  const shaMatch = !truth.sha || entry.gitCommitSha === truth.sha;
   const versionMatch = entry.version === truth.version;
   const countMatch = cacheCount === truth.skillCount;
   const pass = shaMatch && versionMatch && countMatch;
@@ -118,7 +139,7 @@ function checkClaudeCli(truth) {
     surface: 'Claude CLI',
     pass,
     detail: pass
-      ? `v${entry.version} @ ${truth.shortSha}, ${cacheCount} skills — matches origin/master`
+      ? `v${entry.version} @ ${truth.shortSha}, ${cacheCount} skills — matches ${truth.authority}`
       : `v${entry.version || '?'} @ ${(entry.gitCommitSha || '?').slice(0, 7)}, ${cacheCount} skills`
         + ` — expected v${truth.version} @ ${truth.shortSha}, ${truth.skillCount} skills`
         + `${shaMatch ? '' : ' [SHA MISMATCH]'}${versionMatch ? '' : ' [VERSION MISMATCH]'}${countMatch ? '' : ' [COUNT MISMATCH]'}`,
@@ -171,17 +192,18 @@ async function checkClaudeMcp(truth) {
     return { surface: 'Claude MCP', pass: false, detail: `${MCP_URL}/health unreachable — ${res.error}` };
   }
   const { skills, git_sha, version, status } = res.json;
-  const shaMatch = git_sha === truth.sha;
+  const shaMatch = !truth.sha || git_sha === truth.sha;
   const countMatch = skills === truth.skillCount;
-  const pass = status === 'ok' && shaMatch && countMatch;
+  const versionMatch = version === truth.version;
+  const pass = status === 'ok' && shaMatch && versionMatch && countMatch;
   return {
     surface: 'Claude MCP',
     pass,
     detail: pass
-      ? `${MCP_URL}/health — v${version}, ${skills} skills @ ${truth.shortSha} — matches origin/master`
+      ? `${MCP_URL}/health — v${version}, ${skills} skills @ ${truth.shortSha} — matches ${truth.authority}`
       : `${MCP_URL}/health — status=${status} v${version} skills=${skills} sha=${(git_sha || '?').slice(0, 7)}`
-        + ` — expected ${truth.skillCount} skills @ ${truth.shortSha}`
-        + `${shaMatch ? '' : ' [SHA MISMATCH]'}${countMatch ? '' : ' [COUNT MISMATCH]'}`,
+        + ` — expected v${truth.version}, ${truth.skillCount} skills @ ${truth.shortSha}`
+        + `${shaMatch ? '' : ' [SHA MISMATCH]'}${versionMatch ? '' : ' [VERSION MISMATCH]'}${countMatch ? '' : ' [COUNT MISMATCH]'}`,
   };
 }
 
@@ -221,7 +243,7 @@ async function main() {
     console.log(JSON.stringify({ truth, rows, allPass }, null, 2));
   } else {
     console.log('');
-    console.log(`  Source of truth: origin/master @ ${truth.shortSha}, v${truth.version}, ${truth.skillCount} skills`);
+    console.log(`  Source of truth: ${truth.authority} @ ${truth.shortSha}, v${truth.version}, ${truth.skillCount} skills`);
     console.log('');
     for (const r of rows) {
       const mark = r.pass ? '\x1b[32m✓\x1b[0m' : '\x1b[31m✗\x1b[0m';

package/tests/install-rdc-skills.test.mjs

@@ -2,7 +2,7 @@
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
-import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -10,6 +10,7 @@ import { fileURLToPath } from 'node:url';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(__dirname, '..');
 const script = join(REPO_ROOT, 'scripts', 'install-rdc-skills.js');
+const liveVerifier = join(REPO_ROOT, 'scripts', 'verify-live-install.mjs');
 const require = createRequire(import.meta.url);
 
 const syntax = spawnSync(process.execPath, ['--check', script], { encoding: 'utf8' });
@@ -30,6 +31,16 @@ assert.equal(
   packageJson.version,
   'plugin manifest version must match the published package version',
 );
+const packageLockPath = join(REPO_ROOT, 'package-lock.json');
+assert.equal(existsSync(packageLockPath), true, 'systemd deployment requires a committed package-lock.json for npm ci');
+const packageLock = JSON.parse(readFileSync(packageLockPath, 'utf8'));
+assert.equal(packageLock.version, packageJson.version, 'package-lock version must match package.json');
+const systemdInstaller = readFileSync(join(REPO_ROOT, 'deploy', 'install-systemd.sh'), 'utf8');
+assert.match(
+  systemdInstaller,
+  /npm ci --omit=dev --no-audit --no-fund/,
+  'systemd installer must install the locked production dependency graph before starting the MCP',
+);
 const skillCount = Array.isArray(plugin.skills_meta)
   ? plugin.skills_meta.length
   : Object.keys(plugin.skills_meta || {}).length;
@@ -86,4 +97,29 @@ try {
   rmSync(codexSkills, { recursive: true, force: true });
 }
 
+const packagedRoot = mkdtempSync(join(tmpdir(), 'rdc-packaged-truth-'));
+try {
+  writeFileSync(join(packagedRoot, 'package.json'), JSON.stringify({ version: '9.9.9' }));
+  mkdirSync(join(packagedRoot, 'skills', 'first'), { recursive: true });
+  writeFileSync(join(packagedRoot, 'skills', 'first', 'SKILL.md'), '---\nname: rdc:first\n---\n');
+  mkdirSync(join(packagedRoot, 'skills', 'second'), { recursive: true });
+  writeFileSync(join(packagedRoot, 'skills', 'second', 'SKILL.md'), '---\nname: rdc:second\n---\n');
+
+  const packagedTruth = spawnSync(process.execPath, [liveVerifier, '--self-test-source-of-truth'], {
+    cwd: REPO_ROOT,
+    encoding: 'utf8',
+    env: { ...process.env, RDC_SKILLS_ROOT: packagedRoot },
+  });
+  assert.equal(packagedTruth.status, 0, `${packagedTruth.stdout}\n${packagedTruth.stderr}`);
+  assert.deepEqual(JSON.parse(packagedTruth.stdout), {
+    sha: null,
+    shortSha: 'package',
+    version: '9.9.9',
+    skillCount: 2,
+    authority: 'installed npm package',
+  });
+} finally {
+  rmSync(packagedRoot, { recursive: true, force: true });
+}
+
 console.log('install-rdc-skills tests — PASS');