@lifeaitools/rdc-skills 0.35.3 → 0.35.4

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.35.3",
+  "version": "0.35.4",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## v0.35.4 — marketplace sync false-positive: untracked file blocked it forever
+
+### Fixed
+- `syncMarketplaceCheckout()`'s dirty-check used plain `git status --porcelain`,
+  which also reports untracked files. A single harmless untracked file in a
+  marketplace clone (e.g. a stray local scratch file) made the check treat the
+  clone as "has local changes" and permanently refuse to sync it, on every
+  single install run, forever — even though `git reset --hard` never touches
+  untracked files and there was no real edit to preserve. This is the
+  confirmed root cause of the marketplace checkout sitting stale for over a
+  week despite repeated installer runs. Fixed to `--untracked-files=no`, which
+  checks only tracked-file modifications — genuine local edits still block the
+  sync exactly as before (PRESERVE-DIRTY intact); a stray untracked file no
+  longer does.
+- Regression test added: a real temp git origin+clone pair reproduces both the
+  untracked-cruft case (must sync) and the genuine-local-edit case (must still
+  block), so this cannot silently regress.
+- `tests/install-rdc-skills.test.mjs` also had two stale fixtures caught while
+  fixing this: `package-lock.json` version drifted from `package.json`
+  (0.35.2 vs 0.35.3+), and a hardcoded `skillCount === 36` assertion had rotted
+  against the real, current 43 skill directories. The count assertion now
+  compares against the actual `skills/*/SKILL.md` directories on disk instead
+  of a hardcoded number, so it can't go stale the same way again.
+
+---
+
 ## v0.35.3 — coding standards wired into plan/preplan/build/fixit/review
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.35.3",
+  "version": "0.35.4",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",

package/scripts/install-rdc-skills.js

@@ -508,8 +508,16 @@ function syncMarketplaceCheckout(mktDir) {
   const git = (...args) =>
     execSync(`git -C "${mktDir}" ${args.join(' ')}`, { encoding: 'utf8', stdio: 'pipe' }).trim();
   try {
-    if (git('status', '--porcelain')) {
-      warn(`marketplace clone has local changes at ${mktDir} — left untouched; it may serve stale commands`);
+    // PRESERVE-DIRTY means "don't discard a real local edit to a TRACKED file" —
+    // `--untracked-files=no` is deliberate. Plain `git status --porcelain` also
+    // reports untracked files (`?? some-cruft.txt`), which `git reset --hard`
+    // never touches and never conflicts with. Treating that as "dirty" made this
+    // sync silently refuse forever the moment ANY stray untracked file appeared
+    // in the clone — which is exactly how this checkout sat 39+ commits behind
+    // for over a week (2026-08-23), still warning "left untouched" on every run,
+    // while a plain `git status` on the same directory read completely clean.
+    if (git('status', '--porcelain', '--untracked-files=no')) {
+      warn(`marketplace clone has local changes to tracked files at ${mktDir} — left untouched; it may serve stale commands`);
       return;
     }
     const branch = git('rev-parse', '--abbrev-ref', 'HEAD') || 'master';
@@ -1347,7 +1355,7 @@ async function main() {
 // scripts/probe-installed-hooks.mjs verify the real install path instead of
 // re-implementing it — a probe that copies its own way proves nothing about what
 // ships. Without this guard, requiring the module would run a full install.
-module.exports = { copyHookFiles, assertHooksLoadable, registerCodexTarget, RDC_ENV_HOOK_TIMEOUT_SEC };
+module.exports = { copyHookFiles, assertHooksLoadable, registerCodexTarget, syncMarketplaceCheckout, RDC_ENV_HOOK_TIMEOUT_SEC };
 
 if (require.main === module) {
   main().catch(e => { fail(e.message); process.exit(1); });

package/tests/install-rdc-skills.test.mjs

@@ -44,7 +44,22 @@ assert.match(
 const skillCount = Array.isArray(plugin.skills_meta)
   ? plugin.skills_meta.length
   : Object.keys(plugin.skills_meta || {}).length;
-assert.equal(skillCount, 36, 'test fixture should expose all 36 MCP skills from plugin skills_meta');
+// A hardcoded magic number here (previously 36, silently stale against the
+// real 43) rots the instant a skill is added or removed and stops proving
+// anything — it only proves someone remembered to bump a number. Assert
+// against the actual skills/ directory instead: every dir containing a
+// SKILL.md must be represented in plugin.json's skills_meta, and vice versa.
+const skillsDir = join(REPO_ROOT, 'skills');
+const realSkillDirs = require('node:fs')
+  .readdirSync(skillsDir, { withFileTypes: true })
+  .filter((e) => e.isDirectory() && existsSync(join(skillsDir, e.name, 'SKILL.md')))
+  .map((e) => e.name)
+  .sort();
+assert.equal(
+  skillCount,
+  realSkillDirs.length,
+  `plugin.json skills_meta (${skillCount}) must match the actual skill directories on disk (${realSkillDirs.length}): ${realSkillDirs.join(', ')}`,
+);
 assert.match(
   source,
   /Available MCP skills.*\/rdc:\* command shorthands/,
@@ -97,6 +112,81 @@ try {
   rmSync(codexSkills, { recursive: true, force: true });
 }
 
+// Regression for the 2026-08-23 incident: a marketplace clone with ZERO real
+// local edits — only a stray untracked file — sat 39+ commits behind for over
+// a week because `git status --porcelain` (which also reports untracked
+// files) was treated as "has local changes, never touch it". `git reset
+// --hard` never touches untracked files, so an untracked file is irrelevant
+// to whether the sync is safe. This builds a real origin + clone pair,
+// reproduces the exact scenario, and asserts the clone actually advances.
+const { syncMarketplaceCheckout } = require(script);
+const gitTestRoot = mkdtempSync(join(tmpdir(), 'rdc-marketplace-sync-'));
+try {
+  const originDir = join(gitTestRoot, 'origin');
+  const cloneDir = join(gitTestRoot, 'clone');
+  const runGit = (cwd, args) => {
+    const res = spawnSync('git', args, { cwd, encoding: 'utf8' });
+    assert.equal(res.status, 0, `git ${args.join(' ')} failed: ${res.stderr}`);
+    return res.stdout.trim();
+  };
+
+  mkdirSync(originDir, { recursive: true });
+  runGit(originDir, ['init', '--initial-branch=master']);
+  runGit(originDir, ['config', 'user.email', 'test@example.com']);
+  runGit(originDir, ['config', 'user.name', 'Test']);
+  writeFileSync(join(originDir, 'file.txt'), 'v1\n');
+  runGit(originDir, ['add', '.']);
+  runGit(originDir, ['commit', '-m', 'v1']);
+
+  runGit(gitTestRoot, ['clone', originDir, cloneDir]);
+
+  // Advance origin so the clone is genuinely behind.
+  writeFileSync(join(originDir, 'file.txt'), 'v2\n');
+  runGit(originDir, ['add', '.']);
+  runGit(originDir, ['commit', '-m', 'v2']);
+  const originHead = runGit(originDir, ['rev-parse', 'HEAD']);
+
+  // The exact reproduction: a stray UNTRACKED file, nothing modified/staged.
+  writeFileSync(join(cloneDir, 'some-local-cruft.cjs'), 'module.exports = {};\n');
+  assert.match(
+    runGit(cloneDir, ['status', '--porcelain']),
+    /^\?\? some-local-cruft\.cjs$/,
+    'precondition: clone must show ONLY an untracked file, nothing modified',
+  );
+
+  syncMarketplaceCheckout(cloneDir);
+
+  assert.equal(
+    runGit(cloneDir, ['rev-parse', 'HEAD']),
+    originHead,
+    'a clone with only an untracked file must still advance to origin — untracked cruft is not a local edit',
+  );
+  assert.equal(
+    existsSync(join(cloneDir, 'some-local-cruft.cjs')),
+    true,
+    'the untracked file itself must survive the sync — reset --hard never touches it',
+  );
+
+  // Genuine dirt — a MODIFIED tracked file — must still block the sync.
+  writeFileSync(join(originDir, 'file.txt'), 'v3\n');
+  runGit(originDir, ['add', '.']);
+  runGit(originDir, ['commit', '-m', 'v3']);
+  const originHeadV3 = runGit(originDir, ['rev-parse', 'HEAD']);
+  writeFileSync(join(cloneDir, 'file.txt'), 'local edit, never committed\n');
+  const beforeDirtySync = runGit(cloneDir, ['rev-parse', 'HEAD']);
+
+  syncMarketplaceCheckout(cloneDir);
+
+  assert.equal(
+    runGit(cloneDir, ['rev-parse', 'HEAD']),
+    beforeDirtySync,
+    'a real local edit to a TRACKED file must still block the sync (PRESERVE-DIRTY)',
+  );
+  assert.notEqual(beforeDirtySync, originHeadV3, 'sanity: origin did advance further in this step');
+} finally {
+  rmSync(gitTestRoot, { recursive: true, force: true });
+}
+
 const packagedRoot = mkdtempSync(join(tmpdir(), 'rdc-packaged-truth-'));
 try {
   writeFileSync(join(packagedRoot, 'package.json'), JSON.stringify({ version: '9.9.9' }));