@lifeaitools/rdc-skills 0.37.9 → 0.37.11

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.37.9",
+  "version": "0.37.11",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/clauth-plugin.json

@@ -1,7 +1,7 @@
 {
   "schema": "lifeai.plugin.v1",
   "id": "rdc-skills",
-  "version": "0.37.9",
+  "version": "0.37.11",
   "publisher": "LIFEAI",
   "core": false,
   "documentation": {

package/git-sha.json

@@ -1,3 +1,3 @@
 {
-  "sha": "74680b31a041d74e9c4c72e58cbc876fd5e920c3"
+  "sha": "a26cb2cc3a96f0b96f52c7b28c5dfef0264856e0"
 }

package/hooks/require-work-item-on-commit.js

@@ -385,6 +385,19 @@ async function preToolUse(raw) {
   const command = raw.tool_input?.command || '';
   if (!command.includes('git commit')) return process.exit(0);
 
+  // Scope guard (2026-10-01, Dave, direct instruction): this gate exists for
+  // the RDC/regen-root work-item contract, not for every git repo on the box.
+  // Same pattern as no-stop-open-epics.js's PROJECT_SCOPE check — a commit
+  // outside the configured scope (default 'regen-root') is none of this
+  // hook's business and must not be fail-closed into requiring an RDC work
+  // item it has no way to reference.
+  const scope = process.env.RDC_PROJECT_SCOPE || 'regen-root';
+  const cwd = (raw.cwd || process.cwd()).replace(/\\/g, '/').toLowerCase();
+  if (!cwd.includes(scope.toLowerCase())) {
+    hookLog('require-work-item', 'PreToolUse', 'pass-out-of-scope', { cwd, scope });
+    return process.exit(0);
+  }
+
   if (!(await requiresWorkItemNow())) {
     hookLog('require-work-item', 'PreToolUse', 'pass-flow-exempt', {});
     return process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.37.9",
+  "version": "0.37.11",
   "description": "RDC typed-agent dispatch skill suite for Claude Code - plan, build, review, overnight builds",
   "keywords": [
     "claude-code",
@@ -19,7 +19,7 @@
     "type": "plugin",
     "skills": "skills/",
     "guides": "guides/",
-    "version": "0.37.9",
+    "version": "0.37.11",
     "commands": "commands/"
   },
   "bin": {

package/skills/release/SKILL.md

@@ -93,6 +93,18 @@ shipping one verb as two documents produces.
 - **Never declare success without verifying the installed or deployed version.**
   A publish that exits 0 is not a published package — the registry can lag
   minutes behind, so check the version endpoint, not the success line.
+- **npm auth: publish with the stored token until interactive login is fixed.**
+  Operator instruction, 2026-10-02. The `dladouceur` npm account cannot log in
+  interactively (2FA reset is with npm support). So `npm error need auth`, `E401`
+  or "needs an OTP" is NOT a blocker and is never handed back to Dave: publish with
+  the clauth `npm` service token, which `node $LIFEAI_ENV/sessions/work-ship.mjs
+  --repo <name> --lane <path> -F <msgfile> --publish` fetches and passes to npm
+  in-process. Never `curl .../v/npm`
+  into a shell, print the token, or write it into an `.npmrc` (`~/.npmrc` holds only
+  a GitHub Packages token). A 404 on publish means the token is package-scoped and
+  lacks that package; say which package, do not retry. Verify the exact version on
+  the registry afterwards. Delete this rule once `npm whoami` works from a plain
+  shell again.
 
 For a `package`-class target that already resolves through `rdc-harness` (a real
 monorepo subtree, not a standalone repo like this one),

package/tests/require-work-item-on-commit.test.mjs

@@ -163,12 +163,24 @@ function runHook(payload, extraEnv = {}) {
   const flowState = join(fakeHome, 'flow.json');
   const modeState = join(fakeHome, 'mode.json');
   try {
-    const preEnv = { HOME: fakeHome, USERPROFILE: fakeHome, RDC_FLOW_STATE: flowState, RDC_MODE_STATE: modeState };
+    // RDC_PROJECT_SCOPE pinned explicitly, not inherited: an ambient shell
+    // that has it set (e.g. a session mid-scoped to a non-regen-root project)
+    // would otherwise silently change what "in scope" means for every case
+    // below.
+    const preEnv = {
+      HOME: fakeHome, USERPROFILE: fakeHome, RDC_FLOW_STATE: flowState, RDC_MODE_STATE: modeState,
+      RDC_PROJECT_SCOPE: 'regen-root',
+    };
+
+    // These cases exercise flow-gating, not scope — pin cwd inside the RDC
+    // scope so the scope guard below never interferes.
+    const IN_SCOPE_CWD = 'C:/Dev/regen-root.wt/fixture-lane';
 
     // No flow declared -> fail-closed default -> requires a work item -> BLOCK.
     const blocked = runHook({
       hook_event_name: 'PreToolUse',
       tool_name: 'Bash',
+      cwd: IN_SCOPE_CWD,
       tool_input: { command: 'git commit -m "no convention and no uuid"' },
     }, preEnv);
     assert('pre: no-flow-declared BLOCKS (was: warn, never blocked)',
@@ -178,6 +190,7 @@ function runHook(payload, extraEnv = {}) {
     const ok = runHook({
       hook_event_name: 'PreToolUse',
       tool_name: 'Bash',
+      cwd: IN_SCOPE_CWD,
       tool_input: { command: 'git commit -m "feat(x): conventional"' },
     }, preEnv);
     assert('pre: conventional passes silently even when required', ok.status === 0 && ok.stdout.trim() === '', ok.stdout);
@@ -187,9 +200,23 @@ function runHook(payload, extraEnv = {}) {
     const exempt = runHook({
       hook_event_name: 'PreToolUse',
       tool_name: 'Bash',
+      cwd: IN_SCOPE_CWD,
       tool_input: { command: 'git commit -m "no convention and no uuid"' },
     }, preEnv);
     assert('pre: plan flow exempts silently', exempt.status === 0 && exempt.stdout.trim() === '', exempt.stdout);
+
+    // Scope guard (2026-10-01): a commit outside RDC_PROJECT_SCOPE is none of
+    // this hook's business, even with no flow declared at all — it must pass
+    // silently rather than fail-closed into demanding a work item it has no
+    // way to reference.
+    const outOfScope = runHook({
+      hook_event_name: 'PreToolUse',
+      tool_name: 'Bash',
+      cwd: 'C:/Dev/fullstack-agent',
+      tool_input: { command: 'git commit -m "no convention and no uuid"' },
+    }, preEnv);
+    assert('pre: out-of-scope cwd passes silently regardless of flow',
+      outOfScope.status === 0 && outOfScope.stdout.trim() === '', outOfScope.stdout);
   } finally {
     rmSync(fakeHome, { recursive: true, force: true });
   }