@lifeaitools/rdc-skills 0.35.16 → 0.35.18

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.35.16",
+  "version": "0.35.18",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.35.16",
+  "version": "0.35.18",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",

package/scripts/install-rdc-skills.js

@@ -417,7 +417,16 @@ function shippedSkillNames() {
         }
       }
     }
-  } catch { /* no skills/ dir — every check below simply returns false */ }
+  } catch { /* no skills/ dir — handled by the emptiness check below */ }
+  // H5: an EMPTY set silently collapses isRdcSkillDuplicate back to the legacy
+  // rdc: prefix test — i.e. back to the exact dead predicate this whole change
+  // exists to fix, reporting "0 removed", indistinguishable from success. Say so
+  // rather than returning quietly; that is the same reasoning applied to the
+  // post-purge verifier.
+  if (_shippedSkillNames.size === 0) {
+    console.warn('  ! shippedSkillNames() is EMPTY — skills/ missing or unreadable. '
+      + 'Duplicate detection is degraded to the legacy rdc: prefix only.');
+  }
   return _shippedSkillNames;
 }
 
@@ -434,6 +443,63 @@ function resolvesInsideOurSkills(candidate) {
   }
 }
 
+/**
+ * Is this entry PROVABLY ours, as opposed to merely suspect?
+ *
+ * Only two signals are unambiguous:
+ *   1. the legacy `rdc:` frontmatter prefix — no user names a skill that
+ *   2. it resolves inside our own skills/ tree — then it IS our file
+ *
+ * The third signal (shipped name + output-contract marker) is NOT proof: the
+ * marker is a documentation path every agent is told to follow, and 14 of the
+ * shipped names are bare generic words. A user skill called "report" that cites
+ * the output contract matches it. That entry gets quarantined, never deleted.
+ */
+function isProvablyOurRdcSkill(candidate, skillFile) {
+  const fm = readFrontmatter(skillFile);
+  if (fm.name && fm.name.startsWith('rdc:')) return true;
+  return resolvesInsideOurSkills(candidate);
+}
+
+/** Where quarantined entries go. Printed, never silently removed. */
+function rdcQuarantineDir(userSkillsDir) {
+  return path.join(userSkillsDir, '.rdc-quarantine');
+}
+
+/**
+ * Remove a duplicate — or, when we cannot prove it is ours, move it aside and
+ * say so. Returns 1 if the entry was dealt with, 0 if it was left alone.
+ *
+ * The log line is not decoration. The previous version deleted inside
+ * try{}catch{} and reported only a count, so a wrongly-removed user skill left
+ * no trace at all — indistinguishable from having removed nothing.
+ */
+function disposeRdcDuplicate(candidate, skillFile, { isDir, log = console.log } = {}) {
+  if (!isRdcSkillDuplicate(candidate, skillFile)) return 0;
+
+  if (isProvablyOurRdcSkill(candidate, skillFile)) {
+    try {
+      if (isDir) fs.rmSync(candidate, { recursive: true, force: true });
+      else fs.unlinkSync(candidate);
+      return 1;
+    } catch { return 0; }
+  }
+
+  // Suspect only. Quarantine, and name the path so it can be put back.
+  try {
+    const parent = path.dirname(candidate);
+    const qdir = rdcQuarantineDir(parent);
+    fs.mkdirSync(qdir, { recursive: true });
+    const dest = path.join(qdir, path.basename(candidate));
+    if (fs.existsSync(dest)) fs.rmSync(dest, { recursive: true, force: true });
+    fs.renameSync(candidate, dest);
+    log(`      quarantined (name matches a shipped skill, but provenance unproven): ${candidate} -> ${dest}`);
+    return 1;
+  } catch {
+    return 0;
+  }
+}
+
 function isRdcSkillDuplicate(candidate, skillFile) {
   const fm = readFrontmatter(skillFile);
 
@@ -475,17 +541,13 @@ function cleanUserSkills(userSkillsDir) {
         if (fs.existsSync(p)) { skillFile = p; break; }
       }
       if (!skillFile) continue;
-      if (isRdcSkillDuplicate(candidate, skillFile)) {
-        try { fs.rmSync(candidate, { recursive: true, force: true }); removed++; } catch {}
-      }
+      removed += disposeRdcDuplicate(candidate, skillFile, { isDir: true });
     } else if (entry.isFile() && entry.name.endsWith('.md')) {
       // ANY .md file at this level — including skill.md / SKILL.md / README.md
       // if their frontmatter declares an rdc:* skill. A previous version skipped
       // those names; that left an orphan rdc:build copy at user/skill.md which
       // registered as a duplicate "user" skill.
-      if (isRdcSkillDuplicate(candidate, candidate)) {
-        try { fs.unlinkSync(candidate); removed++; } catch {}
-      }
+      removed += disposeRdcDuplicate(candidate, candidate, { isDir: false });
     }
   }
   return removed;
@@ -500,9 +562,7 @@ function cleanGlobalSkillsRoot(skillsDir) {
     if (entry.name === 'user') continue; // handled separately
     const candidate = path.join(skillsDir, entry.name);
     if (entry.isFile() && entry.name.endsWith('.md')) {
-      if (isRdcSkillDuplicate(candidate, candidate)) {
-        try { fs.unlinkSync(candidate); removed++; } catch {}
-      }
+      removed += disposeRdcDuplicate(candidate, candidate, { isDir: false });
     }
   }
   return removed;
@@ -879,10 +939,7 @@ function registerCodexTarget(targetDir) {
       fs.rmSync(candidate, { recursive: true, force: true });
       removed++;
     } else {
-      if (isRdcSkillDuplicate(candidate, path.join(candidate, 'SKILL.md'))) {
-        fs.rmSync(candidate, { recursive: true, force: true });
-        removed++;
-      }
+      removed += disposeRdcDuplicate(candidate, path.join(candidate, 'SKILL.md'), { isDir: true });
     }
   }
 
@@ -1469,7 +1526,7 @@ async function main() {
 // scripts/probe-installed-hooks.mjs verify the real install path instead of
 // re-implementing it — a probe that copies its own way proves nothing about what
 // ships. Without this guard, requiring the module would run a full install.
-module.exports = { copyHookFiles, assertHooksLoadable, registerCodexTarget, syncMarketplaceCheckout, RDC_ENV_HOOK_TIMEOUT_SEC, isRdcSkillDuplicate, cleanUserSkills, cleanGlobalSkillsRoot, shippedSkillNames };
+module.exports = { copyHookFiles, assertHooksLoadable, registerCodexTarget, syncMarketplaceCheckout, RDC_ENV_HOOK_TIMEOUT_SEC, isRdcSkillDuplicate, cleanUserSkills, cleanGlobalSkillsRoot, shippedSkillNames, isProvablyOurRdcSkill, disposeRdcDuplicate, rdcQuarantineDir };
 
 if (require.main === module) {
   main().catch(e => { fail(e.message); process.exit(1); });

package/tests/foreground-process-gate.test.mjs

@@ -20,6 +20,8 @@
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawnSync } from 'node:child_process';
+import { mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(__dirname, '..');
@@ -31,10 +33,27 @@ function assert(name, condition, detail = '') {
   else process.stdout.write(`  ok  ${name}\n`);
 }
 
+/**
+ * Every spawn gets an ISOLATED block ledger.
+ *
+ * This suite deliberately drives blocking fixtures, and the hook now records
+ * each refusal through the guard mitigator. Without an override it writes the
+ * REAL session ledger under %TEMP%/lifeai-guard-blocks — measured 2026-08-30,
+ * which already held this suite's fixtures ("npx playwright test --headed" and
+ * friends). A few suite runs cross REPEAT_THRESHOLD, after which a genuine
+ * --headed block reports "RULE DEFECT SUSPECTED" against a rule that is working
+ * perfectly. Test runs must never be able to discredit a live guard.
+ *
+ * lifeai-env's own guard tests carry this isolation plus a regression assertion
+ * that the live ledger is untouched; these two hooks shipped without either.
+ */
+const LEDGER = mkdtempSync(join(tmpdir(), 'fpg-ledger-'));
+
 function runGate(command) {
   const res = spawnSync(process.execPath, [HOOK], {
     input: JSON.stringify({ tool_name: 'Bash', tool_input: { command } }),
     encoding: 'utf8',
+    env: { ...process.env, LIFEAI_GUARD_BLOCK_DIR: LEDGER, RDC_TEST: '1' },
   });
   const blocked = res.status === 1;
   return { blocked, stdout: res.stdout, status: res.status };

package/tests/install-duplicate-purge.test.mjs

@@ -23,8 +23,10 @@ import { fileURLToPath } from 'node:url';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = resolve(__dirname, '..');
 const require = createRequire(import.meta.url);
-const { isRdcSkillDuplicate, cleanUserSkills, cleanGlobalSkillsRoot, shippedSkillNames } =
-  require(join(REPO_ROOT, 'scripts', 'install-rdc-skills.js'));
+const {
+  isRdcSkillDuplicate, cleanUserSkills, cleanGlobalSkillsRoot, shippedSkillNames,
+  isProvablyOurRdcSkill, rdcQuarantineDir,
+} = require(join(REPO_ROOT, 'scripts', 'install-rdc-skills.js'));
 
 const MARKER = 'guides/output-contract.md';
 let sandbox;
@@ -131,4 +133,49 @@ assert.ok(shipped.has('build'), 'expected "build" among shipped skill names');
 assert.equal(cleanUserSkills(join(tmpdir(), 'rdc-purge-does-not-exist')), 0);
 assert.equal(cleanGlobalSkillsRoot(join(tmpdir(), 'rdc-purge-does-not-exist')), 0);
 
+// ── 8. C2 REGRESSION: a user's own skill is never irrecoverably deleted ──────
+//
+// Found by independent code review and proven against the real module. Signal 3
+// is "shipped name AND body cites guides/output-contract.md" — but that marker
+// is a DOCUMENTATION PATH that CLAUDE.md and AGENTS.md tell every agent to
+// follow, and 14 of the shipped names are bare generic words (build, report,
+// status, design, open, edit, plan, deploy, help, watch, convert, release,
+// collab, review). A user skill called "report" that cites the output contract
+// matched, and was rmSync'd recursively with no backup and no log.
+//
+// It must still be MOVED (it does shadow a shipped skill), but it must be
+// recoverable, and the entry must not be classed as provably ours.
+{
+  const root = fresh();
+  const d = skillDir(root, 'report',
+    fm('report', 'My own reporting skill. House style: follow .rdc/guides/output-contract.md.'));
+
+  assert.equal(isProvablyOurRdcSkill(d, join(d, 'SKILL.md')), false,
+    "a user's own skill citing the output contract must NOT be classed as provably ours");
+
+  const removed = cleanUserSkills(root);
+  assert.equal(removed, 1, 'it still shadows a shipped skill, so it is dealt with');
+  assert.equal(existsSync(d), false, 'moved out of the load path');
+
+  const quarantined = join(rdcQuarantineDir(root), 'report');
+  assert.equal(existsSync(quarantined), true,
+    'RECOVERABLE: it must be in quarantine, never deleted');
+  assert.equal(existsSync(join(quarantined, 'SKILL.md')), true, 'contents preserved intact');
+  rmSync(root, { recursive: true, force: true });
+}
+
+// ── 9. provably-ours entries ARE deleted outright, not quarantined ───────────
+// Quarantine is for uncertainty. A legacy rdc:-prefixed copy is unambiguous, and
+// leaving it in a sibling directory would just be litter.
+{
+  const root = fresh();
+  const d = skillDir(root, 'rdc-plan', fm('rdc:plan'));
+  assert.equal(isProvablyOurRdcSkill(d, join(d, 'SKILL.md')), true);
+  assert.equal(cleanUserSkills(root), 1);
+  assert.equal(existsSync(d), false);
+  assert.equal(existsSync(join(rdcQuarantineDir(root), 'rdc-plan')), false,
+    'provably ours is deleted, not quarantined');
+  rmSync(root, { recursive: true, force: true });
+}
+
 console.log('install-rdc-skills duplicate-purge test — PASS');

package/tests/require-work-item-on-commit.test.mjs

@@ -66,11 +66,24 @@ function makeRepo() {
   return { dir, head };
 }
 
+/**
+ * Isolated block ledger — see the same note in foreground-process-gate.test.mjs.
+ *
+ * This hook records refusals through the guard mitigator, which keys on
+ * (rule id, argv shape) and escalates once a shape repeats. Fixtures that
+ * deliberately trigger a refusal would otherwise accumulate in the REAL session
+ * ledger under %TEMP%/lifeai-guard-blocks and eventually make a genuine refusal
+ * report "RULE DEFECT SUSPECTED" against a rule that is working.
+ *
+ * extraEnv still wins, so a case can override either value deliberately.
+ */
+const LEDGER = mkdtempSync(join(tmpdir(), 'rwi-ledger-'));
+
 function runHook(payload, extraEnv = {}) {
   return spawnSync(process.execPath, [HOOK], {
     input: JSON.stringify(payload),
     encoding: 'utf8',
-    env: { ...process.env, ...extraEnv },
+    env: { ...process.env, LIFEAI_GUARD_BLOCK_DIR: LEDGER, RDC_TEST: '1', ...extraEnv },
   });
 }