@lifeaitools/rdc-skills 0.9.30 → 0.9.32

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "rdc",
-  "version": "0.9.28",
+  "version": "0.9.32",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight unattended builds with work-item tracking and TDD enforcement.",
   "author": {
     "name": "LIFEAI",

package/commands/deploy.md

@@ -120,11 +120,25 @@ Severity rules:
 
 `--fix` auto-remediates only: missing watch_paths, registry row updates, CF cache purges. Never touches env vars, DNS, or container config without explicit confirmation.
 
+## Coolify Access — clauth + REST API
+
+All Coolify operations use the clauth daemon and the Coolify REST API directly.
+There is no Coolify MCP server — do not reference `@masonator/coolify-mcp`.
+
+```bash
+_COOLIFY=$(curl -s http://127.0.0.1:52437/v/coolify-api)
+curl -s -H "Authorization: Bearer $_COOLIFY" https://deploy.regendevcorp.com/api/v1/applications
+```
+
+If clauth daemon is not responding:
+```
+BLOCKED: clauth daemon not responding. Run scripts\restart-clauth.bat, unlock at http://127.0.0.1:52437
+```
+
 ## References
 
 - Type-specific checklists + DNS tree + gate commands: `docs/runbooks/coolify-deploy-checklist.md`
 - Rules / registry RPCs / hard limits: `.claude/rules/coolify-deployment.md`
-- MCP server: `@masonator/coolify-mcp` (38 tools)
 - Infrastructure constants:
   ```
   Server UUID:     ih386anenvvvn6fy1umtyow0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/rdc-skills",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "RDC typed-agent dispatch skill suite for Claude Code — plan, build, review, overnight builds",
   "keywords": [
     "claude-code",

package/scripts/fixtures/guides/bad-guide.md

@@ -0,0 +1,15 @@
+# Bad Infrastructure Guide — FIXTURE (contains banned terms for self-test)
+> This file is used by the rdc:self-test guide-content validator fixture test.
+> It intentionally contains banned terms in positive-instruction context.
+
+## Coolify Access
+
+All Coolify operations via `@masonator/coolify-mcp` (38 tools, pre-authenticated).
+
+Use the `@masonator/coolify-mcp` MCP tool to deploy apps.
+
+You can also use brand-studio for design token work via @regen/brand-studio.
+
+## Clauth Key
+
+Use `curl -s http://127.0.0.1:52437/v/nonexistent-key` for that service.

package/scripts/fixtures/guides-clean/good-guide.md

@@ -0,0 +1,16 @@
+# Good Infrastructure Guide — FIXTURE (clean, no banned terms)
+> This file is used by the rdc:self-test guide-content validator fixture test.
+> It is a clean guide with no banned terms.
+
+## Coolify Access
+
+There is no Coolify MCP server. Do not reference `@masonator/coolify-mcp`.
+Never use brand-studio — the canonical name is Studio.
+The @regen/brand-studio package does not exist — use @regen/studio.
+
+All Coolify operations use the clauth daemon + REST API:
+
+```bash
+_COOLIFY=$(curl -s http://127.0.0.1:52437/v/coolify-api)
+curl -s -H "Authorization: Bearer $_COOLIFY" https://deploy.regendevcorp.com/api/v1/applications
+```

package/scripts/install-rdc-skills.js

@@ -140,30 +140,53 @@ function buildPluginCache(cacheDir, version, gitSha) {
 // Claude Code loads that directory AND the plugin cache, so any rdc skills left
 // there produce duplicate registrations and break the resolver.
 // This function nukes any entry whose frontmatter name starts with "rdc:".
+// Scans BOTH the immediate dir and nested .md files (e.g. `user/skill.md`,
+// `user/rdc-build/SKILL.md`) so pre-plugin orphans are caught regardless of
+// naming convention.
 function cleanUserSkills(userSkillsDir) {
   if (!fs.existsSync(userSkillsDir)) return 0;
   let removed = 0;
   for (const entry of fs.readdirSync(userSkillsDir, { withFileTypes: true })) {
     const candidate = path.join(userSkillsDir, entry.name);
-    let skillFile = null;
     if (entry.isDirectory()) {
-      // New format: <name>/SKILL.md or <name>/skill.md
+      // Subdir form: <name>/SKILL.md or <name>/skill.md
+      let skillFile = null;
       for (const sf of ['SKILL.md', 'skill.md']) {
         const p = path.join(candidate, sf);
         if (fs.existsSync(p)) { skillFile = p; break; }
       }
-    } else if (entry.isFile() && entry.name.endsWith('.md') && entry.name !== 'skill.md' && entry.name !== 'SKILL.md' && entry.name !== 'README.md') {
-      // Old format: rdc-deploy.md flat file
-      skillFile = candidate;
+      if (!skillFile) continue;
+      const fm = readFrontmatter(skillFile);
+      if (fm.name && fm.name.startsWith('rdc:')) {
+        try { fs.rmSync(candidate, { recursive: true, force: true }); removed++; } catch {}
+      }
+    } else if (entry.isFile() && entry.name.endsWith('.md')) {
+      // ANY .md file at this level — including skill.md / SKILL.md / README.md
+      // if their frontmatter declares an rdc:* skill. A previous version skipped
+      // those names; that left an orphan rdc:build copy at user/skill.md which
+      // registered as a duplicate "user" skill.
+      const fm = readFrontmatter(candidate);
+      if (fm.name && fm.name.startsWith('rdc:')) {
+        try { fs.unlinkSync(candidate); removed++; } catch {}
+      }
     }
-    if (!skillFile) continue;
-    const fm = readFrontmatter(skillFile);
-    if (fm.name && fm.name.startsWith('rdc:')) {
-      try {
-        if (entry.isDirectory()) fs.rmSync(candidate, { recursive: true, force: true });
-        else fs.unlinkSync(candidate);
-        removed++;
-      } catch {}
+  }
+  return removed;
+}
+
+// Scrub legacy rdc orphans from ~/.claude/skills/ (top-level), not just user/.
+// Some older installs landed flat skill files alongside the plugin tree.
+function cleanGlobalSkillsRoot(skillsDir) {
+  if (!fs.existsSync(skillsDir)) return 0;
+  let removed = 0;
+  for (const entry of fs.readdirSync(skillsDir, { withFileTypes: true })) {
+    if (entry.name === 'user') continue; // handled separately
+    const candidate = path.join(skillsDir, entry.name);
+    if (entry.isFile() && entry.name.endsWith('.md')) {
+      const fm = readFrontmatter(candidate);
+      if (fm.name && fm.name.startsWith('rdc:')) {
+        try { fs.unlinkSync(candidate); removed++; } catch {}
+      }
     }
   }
   return removed;
@@ -192,11 +215,14 @@ function cleanStaleHooks(hooksDstDir) {
 }
 
 // ── Cache flush helper ────────────────────────────────────────────────────────
-function flushOldCaches(cacheBase, keepVersion) {
+// Only `latest/` is ever kept. Earlier versions wrote BOTH `<version>/` and
+// `latest/`, which caused the plugin loader to scan and register every rdc:*
+// skill twice (once per directory). The fix is permanent single-dir layout.
+function flushOldCaches(cacheBase /* keepVersion intentionally unused */) {
   if (!fs.existsSync(cacheBase)) return 0;
   let flushed = 0;
   for (const entry of fs.readdirSync(cacheBase)) {
-    if (entry === keepVersion || entry === 'latest') continue;
+    if (entry === 'latest') continue;
     try {
       fs.rmSync(path.join(cacheBase, entry), { recursive: true, force: true });
       flushed++;
@@ -211,7 +237,6 @@ function registerCLI(version, gitSha) {
   const mktDir     = path.join(pluginDir, 'marketplaces', MARKETPLACE);
   const mktPlugDir = path.join(mktDir, '.claude-plugin');
   const cacheBase  = path.join(pluginDir, 'cache', MARKETPLACE, 'rdc-skills');
-  const cacheDir   = path.join(cacheBase, version);
   const latestDir  = path.join(cacheBase, 'latest');
 
   // 1. Marketplace manifest
@@ -224,12 +249,11 @@ function registerCLI(version, gitSha) {
   knownMp[MARKETPLACE] = { source: { source: 'github', repo: 'LIFEAI/rdc-skills' }, installLocation: mktDir, lastUpdated: new Date().toISOString() };
   writeJson(kmpPath, knownMp, 4);
 
-  // 3. Flush stale version caches, then write versioned + stable latest
-  const flushed = flushOldCaches(cacheBase, version);
+  // 3. Flush every cache dir except `latest/`, then rewrite `latest/`. We
+  // intentionally do NOT keep a versioned dir — the plugin loader registers
+  // every dir it finds, so two dirs = duplicate skills.
+  const flushed = flushOldCaches(cacheBase);
   if (flushed > 0) info(`       flushed  : ${flushed} stale cache dir(s)`);
-  buildPluginCache(cacheDir, version, gitSha);
-  // Write to stable 'latest/' so open terminals can pick up changes if they
-  // re-read installed_plugins.json between skill invocations.
   if (fs.existsSync(latestDir)) fs.rmSync(latestDir, { recursive: true, force: true });
   buildPluginCache(latestDir, version, gitSha);
 
@@ -312,7 +336,6 @@ function registerCowork(version, gitSha) {
   for (const { dir, settingsFile } of bases) {
     const pluginsDir = path.join(dir, 'cowork_plugins');
     const cacheBase  = path.join(pluginsDir, 'cache', MARKETPLACE, 'rdc-skills');
-    const cacheDir   = path.join(cacheBase, version);
     const latestDir  = path.join(cacheBase, 'latest');
     const mktDir     = path.join(pluginsDir, 'marketplaces', MARKETPLACE);
     const mktPlugDir = path.join(mktDir, '.claude-plugin');
@@ -327,9 +350,8 @@ function registerCowork(version, gitSha) {
     knownMp[MARKETPLACE] = { source: { source: 'github', repo: 'LIFEAI/rdc-skills' }, installLocation: mktDir, lastUpdated: new Date().toISOString() };
     writeJson(kmpPath, knownMp, 4);
 
-    // Flush stale caches, write versioned + stable latest
-    flushOldCaches(cacheBase, version);
-    buildPluginCache(cacheDir, version, gitSha);
+    // Flush all non-latest caches and rewrite `latest/` only — single-dir layout
+    flushOldCaches(cacheBase);
     if (fs.existsSync(latestDir)) fs.rmSync(latestDir, { recursive: true, force: true });
     buildPluginCache(latestDir, version, gitSha);
 
@@ -622,6 +644,10 @@ async function main() {
     const userSkillsDir = path.join(claudeHome, 'skills', 'user');
     const purged = cleanUserSkills(userSkillsDir);
     if (purged > 0) ok(`[0.5a] Skills cleanup — removed ${purged} stale rdc: skill(s) from skills/user/`);
+    // Also scan the parent ~/.claude/skills/ for any flat-file rdc orphans.
+    const skillsRoot = path.join(claudeHome, 'skills');
+    const rootPurged = cleanGlobalSkillsRoot(skillsRoot);
+    if (rootPurged > 0) ok(`[0.5a] Skills cleanup — removed ${rootPurged} stale rdc: file(s) from skills/`);
   }
 
   // 0.5b. Stale hook cleanup — remove hooks we no longer ship
@@ -742,6 +768,53 @@ async function main() {
   console.log('  \x1b[36mPreflight:\x1b[0m');
   runPreflight();
 
+  // 6.5 Post-install verification — duplication guard
+  console.log('');
+  console.log('  \x1b[36mPost-install verification:\x1b[0m');
+  let verifyFailed = false;
+  {
+    const cacheBase = path.join(claudeHome, 'plugins', 'cache', MARKETPLACE, 'rdc-skills');
+    const cacheDirs = fs.existsSync(cacheBase) ? fs.readdirSync(cacheBase) : [];
+    if (cacheDirs.length === 1 && cacheDirs[0] === 'latest') {
+      ok(`plugin cache    : 1 dir (latest/)`);
+    } else {
+      fail(`plugin cache    : expected exactly [latest/], found [${cacheDirs.join(', ')}]`);
+      verifyFailed = true;
+    }
+    const ipPath    = path.join(claudeHome, 'plugins', 'installed_plugins.json');
+    const installed = readJson(ipPath, { plugins: {} });
+    const rdcEntries = installed.plugins[PLUGIN_KEY] || [];
+    if (rdcEntries.length === 1) {
+      ok(`installed_plugins: 1 entry for ${PLUGIN_KEY}`);
+    } else {
+      fail(`installed_plugins: expected 1 entry, found ${rdcEntries.length}`);
+      verifyFailed = true;
+    }
+    const userSkillsDir = path.join(claudeHome, 'skills', 'user');
+    const stillThere = fs.existsSync(userSkillsDir)
+      ? fs.readdirSync(userSkillsDir).filter(f => {
+          const p = path.join(userSkillsDir, f);
+          const skillFile = fs.statSync(p).isDirectory()
+            ? ['SKILL.md','skill.md'].map(s => path.join(p, s)).find(fs.existsSync)
+            : (f.endsWith('.md') ? p : null);
+          if (!skillFile) return false;
+          const fm = readFrontmatter(skillFile);
+          return fm.name && fm.name.startsWith('rdc:');
+        })
+      : [];
+    if (stillThere.length === 0) {
+      ok(`skills/user/    : no rdc: orphans`);
+    } else {
+      fail(`skills/user/    : still has rdc: orphans: ${stillThere.join(', ')}`);
+      verifyFailed = true;
+    }
+  }
+  if (verifyFailed) {
+    console.log('');
+    fail('Post-install verification FAILED — duplicates or orphans remain. Investigate.');
+    process.exit(2);
+  }
+
   // Done
   console.log('');
   console.log('  \x1b[32mDone!\x1b[0m');

package/scripts/self-test.mjs

@@ -49,6 +49,181 @@ const HOOKS_DIR = join(REPO_ROOT, "hooks");
 const PLUGIN_MANIFEST = join(REPO_ROOT, ".claude-plugin", "plugin.json");
 const PACKAGE_JSON = join(REPO_ROOT, "package.json");
 
+// ─── Guide-content validator constants ───────────────────────────────────────
+// Path to the regen-root project (sibling of rdc-skills).
+// Override with REGEN_ROOT env var when running from a non-standard location.
+const REGEN_ROOT = process.env.REGEN_ROOT || "C:/Dev/regen-root";
+
+// Terms that must NOT appear in guide/rule files as positive instructions.
+// A line is flagged only when it does NOT contain a known negation pattern.
+const GUIDE_BANNED_TERMS = [
+  "@masonator/coolify-mcp",
+  "@masonator",
+  "coolify-mcp",
+  "@regen/brand-studio",
+  "brand-studio",
+];
+
+// Negation patterns — if a line contains one of these, the banned-term
+// occurrence is an explicit "don't use" warning and should NOT be flagged.
+const GUIDE_NEGATION_PATTERNS = [
+  /\bdo not\b/i,
+  /\bnever\b/i,
+  /\bno such\b/i,
+  /\bdoes not exist\b/i,
+  /\bbanned\b/i,
+  /\bnot reference\b/i,
+  /\bnot use\b/i,
+  /\bavoid\b/i,
+  /\bremoved\b/i,
+  /\bdeprecated\b/i,
+  // Markdown table row showing a WRONG→CORRECT mapping (naming-corrections.md pattern)
+  /^\|[^|]*WRONG[^|]*\|/i,
+  // A table row where the term is in the WRONG column (first data column after the | WRONG | header)
+  // Heuristic: line starts with | and the term appears before the first CORRECT value
+  /^\|\s*(Brand Studio|brand-studio|@regen\/brand-studio|@masonator[^ |]*|coolify-mcp)[^|]*\|\s*\*\*/,
+];
+
+// Known valid clauth key names. Extend when new keys are added to the vault.
+// Source: C:/Dev/regen-root/.rdc/guides/agent-bootstrap.md credential table
+//         + C:/Dev/regen-root/.claude/rules/clauth-endpoints.md
+const KNOWN_CLAUTH_KEYS = new Set([
+  "coolify-api",
+  "cloudflare",
+  "npm",
+  "supabase",
+  "supabase-anon",
+  "supabase-db",
+  "r2-access-key-id",
+  "r2-secret-key",
+  "anthropic",
+  "openai",
+  "github",
+  "github-token",
+  "vultr-dev-ssh",
+  "mcp-web-research-secret",
+  "mcp-regen-media-secret",
+  "web-research",
+  "regen-media",
+]);
+
+/**
+ * Audit a single guide or rule file for banned terms and clauth key validity.
+ *
+ * Returns an array of finding objects:
+ *   { level: 'error'|'warn', code: string, file: string, line: number, message: string }
+ */
+function auditGuideFile(filepath, relPath) {
+  const findings = [];
+  let text;
+  try {
+    text = readFileSync(filepath, "utf8");
+  } catch (e) {
+    findings.push({ level: "error", code: "guide-unreadable", file: relPath, line: 0, message: `cannot read: ${e.message}` });
+    return findings;
+  }
+
+  const lines = text.split(/\r?\n/);
+  lines.forEach((line, i) => {
+    const lineNo = i + 1;
+
+    // Check banned terms (skip negation lines and comment lines)
+    for (const term of GUIDE_BANNED_TERMS) {
+      if (line.includes(term)) {
+        const isNegated = GUIDE_NEGATION_PATTERNS.some((re) => re.test(line));
+        if (!isNegated) {
+          findings.push({
+            level: "error",
+            code: "guide-banned-term",
+            file: relPath,
+            line: lineNo,
+            message: `banned term "${term}" found as positive instruction — replace with clauth+REST pattern`,
+          });
+        }
+      }
+    }
+
+    // Check clauth /v/<key> references — flag unknown key names
+    // Pattern: /v/some-key-name (standalone path, not inside a larger URL path)
+    const clauthKeyRe = /\bhttp:\/\/127\.0\.0\.1:52437\/v\/([\w-]+)/g;
+    let m;
+    while ((m = clauthKeyRe.exec(line)) !== null) {
+      const key = m[1];
+      if (!KNOWN_CLAUTH_KEYS.has(key)) {
+        findings.push({
+          level: "warn",
+          code: "guide-clauth-key-unknown",
+          file: relPath,
+          line: lineNo,
+          message: `clauth key "${key}" not in known key list — verify it exists in the vault`,
+        });
+      }
+    }
+  });
+
+  return findings;
+}
+
+/**
+ * Run the guide-content validator across:
+ *   1. C:/Dev/rdc-skills/guides/**\/*.md  (base guides shipped with the plugin)
+ *   2. REGEN_ROOT/.rdc/guides/**\/*.md    (project-level agent guides)
+ *   3. REGEN_ROOT/.claude/rules/**\/*.md  (project auto-loaded rules)
+ *
+ * Also scans fixture guides under scripts/fixtures/guides/ when GUIDE_FIXTURE_DIR is set
+ * (used by the self-test's own test suite).
+ *
+ * Returns { findings[], ok, stats }
+ */
+function runGuideContentValidator({ fixtureDir } = {}) {
+  const allFindings = [];
+  let filesScanned = 0;
+
+  function scanDir(dir, prefix) {
+    if (!existsSync(dir)) return;
+    let entries;
+    try { entries = readdirSync(dir); } catch { return; }
+    for (const entry of entries) {
+      const fullPath = join(dir, entry);
+      let stat;
+      try { stat = statSync(fullPath); } catch { continue; }
+      if (stat.isDirectory()) {
+        scanDir(fullPath, `${prefix}/${entry}`);
+      } else if (entry.endsWith(".md")) {
+        const relPath = `${prefix}/${entry}`;
+        const findings = auditGuideFile(fullPath, relPath);
+        allFindings.push(...findings);
+        filesScanned++;
+      }
+    }
+  }
+
+  // 1. Base guides in rdc-skills repo
+  scanDir(GUIDES_DIR, "guides");
+
+  // 2. Regen-root agent guides
+  scanDir(join(REGEN_ROOT, ".rdc", "guides"), "regen-root/.rdc/guides");
+
+  // 3. Regen-root auto-loaded rules
+  scanDir(join(REGEN_ROOT, ".claude", "rules"), "regen-root/.claude/rules");
+
+  // 4. Fixture directory (for self-test's own test assertions)
+  if (fixtureDir && existsSync(fixtureDir)) {
+    scanDir(fixtureDir, "fixtures");
+  }
+
+  const errors = allFindings.filter((f) => f.level === "error");
+  const warnings = allFindings.filter((f) => f.level === "warn");
+
+  return {
+    findings: allFindings,
+    errors,
+    warnings,
+    ok: errors.length === 0,
+    stats: { files_scanned: filesScanned, errors: errors.length, warnings: warnings.length },
+  };
+}
+
 const STANDARD_BANNER = [
   "> **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`",
   "> Checklist-only output. No tool-call narration. No raw MCP/JSON/log dumps.",
@@ -775,6 +950,8 @@ function main() {
       agentResults = agentFiles.map((f) => auditAgentGuide(join(AGENT_GUIDES_DIR, f)));
     }
 
+    const guideValidatorResultJson = !ONLY_SKILL ? runGuideContentValidator() : null;
+
     const failed = results.filter((r) => r.errors.length > 0);
     const warned = results.filter((r) => r.warnings.length > 0 && r.errors.length === 0);
     const clean = results.filter((r) => r.errors.length === 0 && r.warnings.length === 0);
@@ -785,11 +962,13 @@ function main() {
       ...manifestAudit.findings.filter((f) => f.level === "error"),
       ...duplicateFindings.filter((f) => f.level === "error"),
       ...orphanHookFindings.filter((f) => f.level === "error"),
+      ...(guideValidatorResultJson ? guideValidatorResultJson.errors : []),
     ];
     const globalWarnings = [
       ...manifestAudit.findings.filter((f) => f.level === "warn"),
       ...duplicateFindings.filter((f) => f.level === "warn"),
       ...orphanHookFindings.filter((f) => f.level === "warn"),
+      ...(guideValidatorResultJson ? guideValidatorResultJson.warnings : []),
     ];
     const fail =
       failed.length > 0 ||
@@ -819,6 +998,13 @@ function main() {
             findings: manifestAudit.findings,
           },
           global_findings: [...duplicateFindings, ...orphanHookFindings],
+          guide_content_validator: guideValidatorResultJson
+            ? {
+                ok: guideValidatorResultJson.ok,
+                stats: guideValidatorResultJson.stats,
+                findings: guideValidatorResultJson.findings,
+              }
+            : null,
           results: results.map((r) => ({
             skill: r.skill,
             file: r.file,
@@ -918,6 +1104,28 @@ function main() {
     }
   }
 
+  // Guide-content validation — check .rdc/guides + .claude/rules for banned terms and invalid clauth keys
+  let guideValidatorResult = null;
+  if (!ONLY_SKILL) {
+    guideValidatorResult = runGuideContentValidator();
+    if (guideValidatorResult.stats.files_scanned > 0) {
+      console.log(`\nguide-content validator (${guideValidatorResult.stats.files_scanned} files)\n`);
+      console.log("─".repeat(80));
+      if (guideValidatorResult.findings.length === 0) {
+        console.log("  ✓ no banned terms or invalid clauth keys found");
+      } else {
+        for (const f of guideValidatorResult.findings) {
+          const tag = f.level === "error" ? "FAIL" : "WARN";
+          console.log(`  [${tag}] ${f.file}:${f.line}  ${f.code}  ${f.message}`);
+        }
+      }
+      console.log("─".repeat(80));
+      const gErrors = guideValidatorResult.errors.length;
+      const gWarnings = guideValidatorResult.warnings.length;
+      console.log(`total: ${guideValidatorResult.stats.files_scanned}  |  errors: ${gErrors}  |  warnings: ${gWarnings}`);
+    }
+  }
+
   // Cross-skill checks — deferred until all audits complete
   let duplicateFindings = [];
   let orphanHookFindings = [];
@@ -944,11 +1152,13 @@ function main() {
     ...manifestAudit.findings.filter((f) => f.level === "error"),
     ...duplicateFindings.filter((f) => f.level === "error"),
     ...orphanHookFindings.filter((f) => f.level === "error"),
+    ...(guideValidatorResult ? guideValidatorResult.errors : []),
   ];
   const globalWarnings = [
     ...manifestAudit.findings.filter((f) => f.level === "warn"),
     ...duplicateFindings.filter((f) => f.level === "warn"),
     ...orphanHookFindings.filter((f) => f.level === "warn"),
+    ...(guideValidatorResult ? guideValidatorResult.warnings : []),
   ];
 
   const fail =

package/scripts/test-guide-validator.mjs

@@ -0,0 +1,194 @@
+#!/usr/bin/env node
+// test-guide-validator.mjs — Unit test for the guide-content validator
+//
+// Proves:
+//   1. The validator flags guides containing banned terms in positive-instruction context
+//   2. The validator passes guides that mention banned terms only as warnings/negations
+//   3. The validator flags unknown clauth key names
+//   4. The validator passes known clauth key names
+//
+// Usage:
+//   node scripts/test-guide-validator.mjs
+//
+// Exit codes:
+//   0 = all assertions pass
+//   1 = one or more assertions failed
+
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(__dirname, "..");
+
+// Import the validator functions from self-test.mjs by running it in test mode.
+// Since self-test.mjs is not a module that exports cleanly, we replicate the
+// validator logic here using the same constants and algorithms.
+// (The shared implementation lives in runGuideContentValidator / auditGuideFile.)
+//
+// We import via dynamic import of the self-test module's exported helpers —
+// but since self-test.mjs has no exports (it runs immediately), we inline
+// the equivalent test using the same fixture files it targets.
+
+// ─── Inline validator (mirrors self-test.mjs logic) ────────────────────────
+import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
+
+const GUIDE_BANNED_TERMS = [
+  "@masonator/coolify-mcp",
+  "@masonator",
+  "coolify-mcp",
+  "@regen/brand-studio",
+  "brand-studio",
+];
+
+const GUIDE_NEGATION_PATTERNS = [
+  /\bdo not\b/i,
+  /\bnever\b/i,
+  /\bno such\b/i,
+  /\bdoes not exist\b/i,
+  /\bbanned\b/i,
+  /\bnot reference\b/i,
+  /\bnot use\b/i,
+  /\bavoid\b/i,
+  /\bremoved\b/i,
+  /\bdeprecated\b/i,
+  // Markdown table row showing a WRONG→CORRECT mapping (naming-corrections.md pattern)
+  /^\|[^|]*WRONG[^|]*\|/i,
+  // A table row where the term is in the WRONG column (first data column after the | WRONG | header)
+  /^\|\s*(Brand Studio|brand-studio|@regen\/brand-studio|@masonator[^ |]*|coolify-mcp)[^|]*\|\s*\*\*/,
+];
+
+const KNOWN_CLAUTH_KEYS = new Set([
+  "coolify-api",
+  "cloudflare",
+  "npm",
+  "supabase",
+  "supabase-anon",
+  "supabase-db",
+  "r2-access-key-id",
+  "r2-secret-key",
+  "anthropic",
+  "openai",
+  "github",
+  "github-token",
+  "vultr-dev-ssh",
+  "mcp-web-research-secret",
+  "mcp-regen-media-secret",
+  "web-research",
+  "regen-media",
+]);
+
+function auditGuideFile(filepath, relPath) {
+  const findings = [];
+  let text;
+  try {
+    text = readFileSync(filepath, "utf8");
+  } catch (e) {
+    findings.push({ level: "error", code: "guide-unreadable", file: relPath, line: 0, message: `cannot read: ${e.message}` });
+    return findings;
+  }
+  const lines = text.split(/\r?\n/);
+  lines.forEach((line, i) => {
+    const lineNo = i + 1;
+    for (const term of GUIDE_BANNED_TERMS) {
+      if (line.includes(term)) {
+        const isNegated = GUIDE_NEGATION_PATTERNS.some((re) => re.test(line));
+        if (!isNegated) {
+          findings.push({ level: "error", code: "guide-banned-term", file: relPath, line: lineNo, message: `banned term "${term}"` });
+        }
+      }
+    }
+    const clauthKeyRe = /\bhttp:\/\/127\.0\.0\.1:52437\/v\/([\w-]+)/g;
+    let m;
+    while ((m = clauthKeyRe.exec(line)) !== null) {
+      const key = m[1];
+      if (!KNOWN_CLAUTH_KEYS.has(key)) {
+        findings.push({ level: "warn", code: "guide-clauth-key-unknown", file: relPath, line: lineNo, message: `unknown clauth key "${key}"` });
+      }
+    }
+  });
+  return findings;
+}
+
+function scanDir(dir, prefix) {
+  const findings = [];
+  if (!existsSync(dir)) return findings;
+  let entries;
+  try { entries = readdirSync(dir); } catch { return findings; }
+  for (const entry of entries) {
+    const fullPath = join(dir, entry);
+    let stat;
+    try { stat = statSync(fullPath); } catch { continue; }
+    if (stat.isDirectory()) {
+      findings.push(...scanDir(fullPath, `${prefix}/${entry}`));
+    } else if (entry.endsWith(".md")) {
+      findings.push(...auditGuideFile(fullPath, `${prefix}/${entry}`));
+    }
+  }
+  return findings;
+}
+
+// ─── Test runner ─────────────────────────────────────────────────────────────
+
+let passed = 0;
+let failed = 0;
+
+function assert(description, condition, detail = "") {
+  if (condition) {
+    console.log(`  ✓ ${description}`);
+    passed++;
+  } else {
+    console.error(`  ✗ FAIL: ${description}${detail ? ` — ${detail}` : ""}`);
+    failed++;
+  }
+}
+
+console.log("\nrdc:self-test — guide-content validator unit tests\n");
+
+// ─── Test 1: bad-guide.md should produce errors for banned terms ─────────────
+console.log("Test 1: bad-guide.md flags banned terms");
+const BAD_FIXTURE = join(REPO_ROOT, "scripts/fixtures/guides/bad-guide.md");
+const badFindings = auditGuideFile(BAD_FIXTURE, "fixtures/guides/bad-guide.md");
+const badErrors = badFindings.filter((f) => f.level === "error" && f.code === "guide-banned-term");
+assert("bad-guide.md produces at least 2 banned-term errors", badErrors.length >= 2, `got ${badErrors.length}`);
+assert("flags @masonator/coolify-mcp", badErrors.some((f) => f.message.includes("@masonator/coolify-mcp")));
+assert("flags brand-studio or @regen/brand-studio", badErrors.some((f) => f.message.includes("brand-studio")));
+
+// ─── Test 2: bad-guide.md flags unknown clauth key ───────────────────────────
+console.log("\nTest 2: bad-guide.md flags unknown clauth key");
+const badKeyWarnings = badFindings.filter((f) => f.code === "guide-clauth-key-unknown");
+assert("bad-guide.md warns on unknown clauth key 'nonexistent-key'", badKeyWarnings.length >= 1, `got ${badKeyWarnings.length}`);
+assert("warning message references nonexistent-key", badKeyWarnings.some((f) => f.message.includes("nonexistent-key")));
+
+// ─── Test 3: good-guide.md produces no errors (negated mentions are OK) ──────
+console.log("\nTest 3: good-guide.md passes (negated mentions are not flagged)");
+const GOOD_FIXTURE = join(REPO_ROOT, "scripts/fixtures/guides-clean/good-guide.md");
+const goodFindings = auditGuideFile(GOOD_FIXTURE, "fixtures/guides-clean/good-guide.md");
+const goodErrors = goodFindings.filter((f) => f.level === "error");
+assert("good-guide.md produces 0 banned-term errors", goodErrors.length === 0, `got ${goodErrors.length}: ${goodErrors.map((f) => f.message).join("; ")}`);
+
+// good-guide uses coolify-api which is a known key — no key warnings
+const goodKeyWarnings = goodFindings.filter((f) => f.code === "guide-clauth-key-unknown");
+assert("good-guide.md produces 0 unknown-key warnings", goodKeyWarnings.length === 0, `got ${goodKeyWarnings.length}`);
+
+// ─── Test 4: scan fixture directory returns combined findings ─────────────────
+console.log("\nTest 4: scanDir finds findings across fixture dirs");
+const BAD_DIR = join(REPO_ROOT, "scripts/fixtures/guides");
+const dirFindings = scanDir(BAD_DIR, "fixtures");
+const dirErrors = dirFindings.filter((f) => f.level === "error");
+assert("scanDir on bad fixture dir returns errors", dirErrors.length >= 2, `got ${dirErrors.length}`);
+
+const GOOD_DIR = join(REPO_ROOT, "scripts/fixtures/guides-clean");
+const cleanFindings = scanDir(GOOD_DIR, "fixtures");
+const cleanErrors = cleanFindings.filter((f) => f.level === "error");
+assert("scanDir on clean fixture dir returns 0 errors", cleanErrors.length === 0, `got ${cleanErrors.length}`);
+
+// ─── Summary ─────────────────────────────────────────────────────────────────
+console.log(`\n${"─".repeat(60)}`);
+console.log(`guide-validator tests: ${passed} passed, ${failed} failed`);
+if (failed > 0) {
+  console.error(`\n❌ FAIL — ${failed} assertion(s) did not pass`);
+  process.exit(1);
+} else {
+  console.log(`\n✓ PASS — all guide-content validator assertions passed`);
+  process.exit(0);
+}

package/skills/deploy/SKILL.md

@@ -134,11 +134,57 @@ Severity rules:
 
 `--fix` auto-remediates only: missing watch_paths, registry row updates, CF cache purges. Never touches env vars, DNS, or container config without explicit confirmation.
 
+## Coolify Access — clauth + REST API
+
+All Coolify operations use the clauth daemon and the Coolify REST API directly.
+There is no Coolify MCP server. Do not reference `@masonator/coolify-mcp`.
+
+```bash
+# Get token (plain text — no JSON parsing needed)
+_COOLIFY=$(curl -s http://127.0.0.1:52437/v/coolify-api)
+
+# List applications
+curl -s -H "Authorization: Bearer $_COOLIFY" \
+  https://deploy.regendevcorp.com/api/v1/applications
+
+# Get application details
+curl -s -H "Authorization: Bearer $_COOLIFY" \
+  https://deploy.regendevcorp.com/api/v1/applications/<uuid>
+
+# Deploy (trigger)
+curl -s -X POST -H "Authorization: Bearer $_COOLIFY" \
+  https://deploy.regendevcorp.com/api/v1/applications/<uuid>/deploy
+
+# Get deployment logs
+curl -s -H "Authorization: Bearer $_COOLIFY" \
+  https://deploy.regendevcorp.com/api/v1/deployments/<deployment-id>
+
+# Set env var
+curl -s -X POST -H "Authorization: Bearer $_COOLIFY" \
+  -H "Content-Type: application/json" \
+  -d '{"key":"<KEY>","value":"<VALUE>"}' \
+  https://deploy.regendevcorp.com/api/v1/applications/<uuid>/envs
+
+# Set watch_paths
+curl -s -X PATCH -H "Authorization: Bearer $_COOLIFY" \
+  -H "Content-Type: application/json" \
+  -d '{"watch_paths":"apps/<name>/**\npackages/**"}' \
+  https://deploy.regendevcorp.com/api/v1/applications/<uuid>
+```
+
+**Never print `$_COOLIFY` to stdout.** Inline from clauth only — do not assign raw strings.
+
+If clauth daemon is not responding (`curl -s http://127.0.0.1:52437/ping` fails):
+```
+BLOCKED: clauth daemon is not responding.
+Fix: Run C:\Dev\regen-root\scripts\restart-clauth.bat, then unlock at http://127.0.0.1:52437
+I cannot proceed until this is resolved.
+```
+
 ## References
 
 - Type-specific checklists + DNS tree + gate commands: `docs/runbooks/coolify-deploy-checklist.md`
 - Rules / registry RPCs / hard limits: `.claude/context/coolify-deployment.md`
-- MCP server: `@masonator/coolify-mcp` (38 tools)
 - Infrastructure constants:
   ```
   Server UUID:     ih386anenvvvn6fy1umtyow0

package/skills/terminal-config/SKILL.md

@@ -1,13 +1,13 @@
 ---
-name: terminal-config
-description: "Read and safely modify Windows Terminal settings and cell startup sequencing. Contains the canonical file locations, profile GUIDs, keybinding map, and what NEVER to change."
+name: rdc:terminal-config
+description: "Usage `rdc:terminal-config <task>` — read and safely modify Windows Terminal settings and cell startup sequencing. Contains canonical file locations, profile GUIDs, keybinding map, and what NEVER to change."
 ---
 
 > **⚠️ OUTPUT CONTRACT (READ FIRST):** `guides/output-contract.md`
 > Checklist-only output. No tool-call narration. No raw MCP/JSON/log dumps.
 > One checklist upfront, updated in place, shown again at end with a 1-line verdict.
 
-# terminal-config — Windows Terminal & Cell Startup Reference
+# rdc:terminal-config — Windows Terminal & Cell Startup Reference
 
 ## When to Use
 - Before modifying any terminal setting, profile, or keybinding
@@ -31,7 +31,7 @@ description: "Read and safely modify Windows Terminal settings and cell startup
 | File | Path | Purpose |
 |------|------|---------|
 | **Terminal settings** | `C:\Users\DaveLadouceur\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json` | Main config — profiles, keybindings, color schemes |
-| **Cell init script** | `C:\Dev\regen-root\scripts\cell-init.cmd` | Launched by each cell profile. Sets CELL_ROLE, prints banner, runs `claude --append-system-prompt` |
+| **Cell init script** | `C:\Dev\regen-root\scripts\cell-init.ps1` | Launched by each cell profile (PowerShell 7). Sets CELL_ROLE, prints banner, runs `claude --append-system-prompt` |
 | **Cell state dir** | `C:\Dev\regen-root\.cell-state\` | PID lockfiles per cell (`sv.lock`, `cell-portal.lock`, etc.) |
 | **Claude keybindings** | `C:\Users\DaveLadouceur\.claude\keybindings.json` | Claude Code keybindings (separate from Terminal) |
 | **Claude settings** | `C:\Dev\regen-root\.claude\settings.json` | Project-level Claude Code settings, hooks, permissions |
@@ -46,9 +46,9 @@ Every profile has a fixed GUID. Do not change them.
 | GUID | Name | Tab Color | Purpose |
 |------|------|-----------|---------|
 | `{574e775e-4f2a-5b96-ac1e-a2962a402336}` | PowerShell | — | **Default profile** — PowerShell 7 Core |
-| `{e7c1128b-e51f-4eba-bcdb-85f550c31b97}` | SV | `#1A6B3C` (green) | Supervisor cell — full repo access, runs `cell-init.cmd sv` |
-| `{190a2f39-f6ad-4638-8fef-e4c7aa58c349}` | Claude | `#B91C1C` (red) | Claude conversation cell, runs `cell-init.cmd sv` |
-| `{2d0248ef-7bb7-4b9e-b381-c4aa1f570f49}` | Codex | `#0F766E` (teal) | Codex AI cell — runs `powershell -NoLogo -NoExit -Command codex` |
+| `{e7c1128b-e51f-4eba-bcdb-85f550c31b97}` | SV | `#1A6B3C` (green) | Supervisor cell — full repo access, runs `cell-init.ps1 sv` |
+| `{190a2f39-f6ad-4638-8fef-e4c7aa58c349}` | Claude | `#B91C1C` (red) | Claude conversation cell, runs `cell-init.ps1 sv` |
+| `{2d0248ef-7bb7-4b9e-b381-c4aa1f570f49}` | Codex | `#0F766E` (teal) | Codex AI cell — runs `pwsh.exe -NoLogo -NoExit -Command codex` |
 | `{767642b0-606c-468c-89a0-4573df6fcdaf}` | VS Code | `#2D5986` (blue) | Launches `code-safe C:\Dev\regen-root` |
 | `{6cbd327a-5b5e-4e83-96f6-041615382d36}` | PowerShell (Admin) | `#1E3A5F` (dark blue) | Elevated PowerShell — uses `LIFEAI Slate` color scheme |
 | `{0caa0dad-35be-5f56-a8ff-afceeeaa6101}` | Command Prompt | — | Legacy CMD — visible but rarely used |
@@ -57,13 +57,14 @@ Every profile has a fixed GUID. Do not change them.
 ### Profile commandlines
 
 ```
-SV / Claude:   cmd.exe /k "C:\Dev\regen-root\scripts\cell-init.cmd" sv
-Codex:         powershell.exe -NoLogo -NoExit -Command codex
+SV / Claude:   pwsh.exe -NoLogo -NoExit -ExecutionPolicy Bypass -File "C:\Dev\regen-root\scripts\cell-init.ps1" sv
+Codex:         pwsh.exe -NoLogo -NoExit -Command codex
 VS Code:       cmd.exe /c start "" code-safe C:\Dev\regen-root
 Admin PS:      powershell.exe -NoLogo   (+ elevate: true)
 ```
 
 All cell profiles set `"startingDirectory": "C:\\Dev\\regen-root"`.
+SV / Claude / Codex all run on **PowerShell 7 (`pwsh.exe`)** — never bare `powershell.exe` (that resolves to legacy Windows PowerShell 5.1).
 
 ---
 
@@ -140,15 +141,14 @@ Font defaults (in `profiles.defaults`):
 
 ## Cell Startup Sequencing
 
-`cell-init.cmd` is the startup script for all cell profiles. It:
+`cell-init.ps1` is the PowerShell 7 startup script for all cell profiles. It:
 
-1. Accepts `ROLE` arg (`sv`, `cell-portal`, `cell-data`, `cell-cs2`, `cell-mktg`, `cell-infra`, `specialist`)
-2. Looks up `LABEL`, `COLOR`, `SCOPE`, `PATHS`, `PROMPT_SCOPE` from a role table
+1. Accepts `Role` arg (`sv`, `cell-portal`, `cell-data`, `cell-cs2`, `cell-mktg`, `cell-infra`, `specialist`)
+2. Looks up `Label`, `Color`, `Scope`, `Paths`, `Prompt` from the `$roles` hashtable
 3. Prints a colored banner
 4. Writes a PID lockfile to `.cell-state\<role>.lock`
 5. Runs `git log` filtered to that cell's path scope
-6. Opens VS Code for the project
-7. Launches: `claude --append-system-prompt "<PROMPT_SCOPE>"`
+6. Launches: `claude --append-system-prompt "<Prompt>"`
 
 ### Cell role → prompt scope mapping
 
@@ -184,9 +184,9 @@ Font defaults (in `profiles.defaults`):
 
 ### When editing cell startup
 
-Edit `C:\Dev\regen-root\scripts\cell-init.cmd` — it's in the repo, so changes are tracked.
-- Adding a new role: add a new `if "%ROLE%"=="..."` block with all five vars
-- Changing scope: update `PATHS` and `PROMPT_SCOPE` only — don't touch banner/lockfile/git logic
+Edit `C:\Dev\regen-root\scripts\cell-init.ps1` — it's in the repo, so changes are tracked.
+- Adding a new role: add a new entry to the `$roles` hashtable with all five keys (`Label`, `Color`, `Scope`, `Paths`, `Prompt`)
+- Changing scope: update `Paths` and `Prompt` only — don't touch banner/lockfile/git logic
 
 ---
 
@@ -211,7 +211,7 @@ If Windows Terminal settings keep getting corrupted or misedited, **WezTerm** is
 - Config is a Lua file (`~/.wezterm.lua` or `C:\Users\<user>\.config\wezterm\wezterm.lua`)
 - Committed to git — every change is a reviewable diff, not an opaque JSON blob
 - Startup layouts (tabs, panes, commands) are defined programmatically
-- Equivalent to current setup: `wezterm.mux.spawn_window()` per cell with `args` set to `cmd.exe /k cell-init.cmd <role>`
+- Equivalent to current setup: `wezterm.mux.spawn_window()` per cell with `args` set to `pwsh.exe -NoLogo -NoExit -File cell-init.ps1 <role>`
 - Download: https://wezfurlong.org/wezterm/installation.html
 
 Migration path: copy existing color schemes as `wezterm.color.get_default_colors()` override tables, map keybindings to `config.keys` array, define tab bar with cell roles.