@rashidee/co2 1.3.3 → 1.3.5

package/dist/.co2-dat/config.json

@@ -0,0 +1,4 @@
+{
+  "port": 3001,
+  "workspacePath": "C:\\Users\\vedee\\workspace"
+}

package/dist/index.js

@@ -6809,7 +6809,7 @@ var {
 // package.json
 var package_default = {
   name: "@rashidee/co2",
-  version: "1.3.3",
+  version: "1.3.5",
   description: "Compound Context Studio \u2014 self-hosted team context authoring for CO2 projects",
   type: "module",
   license: "MIT",
@@ -22248,6 +22248,29 @@ function cicdRoutes(db, workspacePath, studioPort) {
       return errorResponse3(c, e);
     }
   });
+  app.post("/:projectId/rescan", async (c) => {
+    const projectId = parseProjectId(c);
+    if (projectId === null) return c.json({ code: "INVALID_ID" }, 400);
+    const user = c.get("user");
+    try {
+      const setup = getOrCreateSetup(db, projectId, user.id);
+      if (setup.status === "planning") {
+        pollCicdTracking(db, workspacePath, setup.id, "plan", user.id);
+      } else if (setup.status === "generating") {
+        pollCicdTracking(db, workspacePath, setup.id, "generation", user.id);
+      }
+      const fresh = getOrCreateSetup(db, projectId, user.id);
+      if (fresh.status === "planning" && !hasCicdWatcher(fresh.id, "plan")) {
+        startCicdWatcher(db, workspacePath, fresh.id, "plan", user.id);
+      }
+      if (fresh.status === "generating" && !hasCicdWatcher(fresh.id, "generation")) {
+        startCicdWatcher(db, workspacePath, fresh.id, "generation", user.id);
+      }
+      return c.json(await toDto8(c, fresh));
+    } catch (e) {
+      return errorResponse3(c, e);
+    }
+  });
   app.post("/:projectId/plan", (c) => {
     const projectId = parseProjectId(c);
     if (projectId === null) return c.json({ code: "INVALID_ID" }, 400);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rashidee/co2",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "Compound Context Studio — self-hosted team context authoring for CO2 projects",
   "type": "module",
   "license": "MIT",

package/plugin/skills/util-gencicdscript/SKILL.md

@@ -17,7 +17,9 @@ description: >
   has never completed a conductor-develop workflow run (checked against the studio's
   /api/cicd-guard endpoint using the spawn-env token). Health/port probing marks apps already
   running — even ones started outside this app. No version selector: only the latest built
-  applications are operated. Writes cicd/CICD_GENERATION.md with `**Status**:` IN PROGRESS →
+  applications are operated. When the approved plan declares an `## Infrastructure` list, the
+  main page shows an "Infrastructure" link that opens a separate status-only page listing every
+  supporting 3rd-party service with a live TCP-reachability indicator and a console link. Writes cicd/CICD_GENERATION.md with `**Status**:` IN PROGRESS →
   COMPLETED so the studio watcher detects completion. Idempotent — re-running regenerates
   cicd/app in place. Trigger on keywords: "generate cicd", "gen cicd script", "generate ci/cd
   app", "cicd app", "generate deployment app". Accepts one MANDATORY argument: the
@@ -56,9 +58,12 @@ Read `references/cicd-app-template.md` for the complete file templates. Produce:
 
 1. `cicd/app/cicd.config.json` — from the plan's tables:
    `{ "port": <CI/CD app port>, "apps": [{ "name", "folder", "method", "port", "build",
-   "start", "stop", "deployMethod", "deploy", "health" }] }` — `deployMethod` is the plan's
-   Deploy Method column (`none|web-server|docker|kubernetes`) and `deploy` its command
-   (`null` when the method is `none`).
+   "start", "stop", "deployMethod", "deploy", "health" }], "infra": [{ "id", "name", "host",
+   "port", "url", "description" }] }` — `deployMethod` is the plan's Deploy Method column
+   (`none|web-server|docker|kubernetes`) and `deploy` its command (`null` when the method is
+   `none`). The `infra` array comes from the plan's `## Infrastructure` table (one entry per
+   row); `url` is `null` when the Console URL cell is `-`. Emit `"infra": []` when the plan's
+   Infrastructure table is empty — never invent services the plan does not list.
 2. `cicd/app/server.js` — the template verbatim (it is generic; all project specifics live in
    cicd.config.json). Zero npm dependencies.
 3. Ensure `cicd/logs/` and `cicd/state.json` are ignored: append `cicd/logs/` and
@@ -73,8 +78,17 @@ port, application count) and STOP — the studio starts/embeds the app.
 
 - Zero npm dependencies — plain node:http only (the WebSocket log stream is hand-rolled in the
   template); no install step may be required.
+- Live config: the generated server re-reads `cicd.config.json` on demand (mtime-cached), so a
+  regenerated plan — corrected build/start commands, a renamed build artifact, added apps or
+  changed infra — is applied WITHOUT restarting the running app (only the listen port is bound
+  once at boot). Never cache the parsed config in a top-level `const`.
 - The page is bare: no header, sidebar or footer (it is iframed by the studio). Light theme,
   one nav tab per application; the tab body is that application's live log.
+- Infrastructure page: when `infra` is non-empty the main page shows an "Infrastructure" link
+  that opens the separate `/infra` page in a new tab — a status-only list of supporting
+  3rd-party services, each with a live TCP-reachability dot (polled) and a console link when a
+  `url` is set. Infrastructure is never built/started/stopped/deployed (no lifecycle controls,
+  no develop gate); the link is hidden when `infra` is empty.
 - Build/Start/Stop/Deploy run the plan's commands verbatim, each with the APPLICATION FOLDER
   (`<project>/<folder>`) as working directory — command paths are relative to the application
   folder (e.g. `java -jar target\app.jar`), never to the project root. Deploy renders only
@@ -85,7 +99,13 @@ port, application count) and STOP — the studio starts/embeds the app.
   with the CO2_GUARD_TOKEN from the spawn env (refreshed every 30 s, last answer cached).
 - Log streaming must stay bounded: per-app log file on disk, bounded tail on connect, live
   append broadcast only, slow subscribers dropped on backpressure, client DOM buffer trimmed.
-- Already-running detection: `/api/state` probes each application's health URL (falling back
-  to its port) so an app started outside this page still shows as running; a Stop on an
-  externally started process is refused with a hint instead of killed.
+- Already-running detection: `/api/state` decides "is it running?" by a raw TCP connect to the
+  application's `port` on BOTH IPv4 (`127.0.0.1`) and IPv6 (`::1`) loopback plus the host named
+  in its `health` URL — up if any connects. This is family-agnostic (Spring binds `127.0.0.1`,
+  Vite/Next preview bind IPv6 `::1` only) and reliable where an HTTP fetch is not, so an app
+  started outside this page still shows as running. Carry `health` and `port` from the plan
+  verbatim into `cicd.config.json`.
+- Stop works for any running app: if the app was started outside this CI/CD app (no child
+  handle), Stop kills whatever process tree is listening on its `port` (kill-by-port), so the
+  Stop control is enabled/usable whenever an app is detected running.
 - Never touch PRD.md/CLAUDE.md; never run builds or deploys yourself during generation.

package/plugin/skills/util-gencicdscript/references/cicd-app-template.md

@@ -11,6 +11,7 @@
 // server retains nothing per subscriber beyond the socket itself (bounded initial tail,
 // slow clients are dropped on backpressure), and the client trims its DOM log buffer.
 const http = require('node:http')
+const net = require('node:net')
 const { spawn, execFileSync } = require('node:child_process')
 const { createHash } = require('node:crypto')
 const { readFileSync, writeFileSync, mkdirSync, existsSync, statSync, openSync, readSync, closeSync, createWriteStream } = require('node:fs')
@@ -20,8 +21,23 @@ const APP_DIR = __dirname
 const PROJECT_DIR = resolve(APP_DIR, '..', '..')
 const LOG_DIR = join(PROJECT_DIR, 'cicd', 'logs')
 const STATE_FILE = join(PROJECT_DIR, 'cicd', 'state.json')
-const CONFIG = JSON.parse(readFileSync(join(APP_DIR, 'cicd.config.json'), 'utf8'))
-const PORT = Number(process.env.PORT || CONFIG.port || 4100)
+const CONFIG_PATH = join(APP_DIR, 'cicd.config.json')
+// Config is re-read on demand (mtime-cached), so a regenerated plan — corrected build/start
+// commands, renamed artifacts, added apps or changed infra — is picked up WITHOUT restarting
+// this app. Only the listen PORT is bound once at boot (a port change still needs a respawn).
+let configCache = { mtimeMs: -1, data: { port: 4100, apps: [], infra: [] } }
+function loadConfig() {
+  try {
+    const mtimeMs = statSync(CONFIG_PATH).mtimeMs
+    if (mtimeMs !== configCache.mtimeMs) {
+      configCache = { mtimeMs, data: JSON.parse(readFileSync(CONFIG_PATH, 'utf8')) }
+    }
+  } catch {
+    /* unreadable or mid-write — keep the last good config */
+  }
+  return configCache.data
+}
+const PORT = Number(process.env.PORT || loadConfig().port || 4100)
 const STUDIO = process.env.CO2_STUDIO_URL || 'http://127.0.0.1:3001'
 const PROJECT_ID = process.env.CO2_PROJECT_ID || ''
 const TOKEN = process.env.CO2_GUARD_TOKEN || ''
@@ -35,7 +51,7 @@ const lastError = new Map() // app name -> string
 
 function saveState() {
   const s = {}
-  for (const a of CONFIG.apps) s[a.name] = running.has(a.name) ? 'running' : 'stopped'
+  for (const a of loadConfig().apps) s[a.name] = running.has(a.name) ? 'running' : 'stopped'
   try { writeFileSync(STATE_FILE, JSON.stringify(s)) } catch {}
 }
 
@@ -133,12 +149,39 @@ function runLogged(app, command, onExit) {
 }
 
 // ---- App lifecycle ---------------------------------------------------------------------
+// Candidate loopback hosts to check for liveness: IPv4 (127.0.0.1) AND IPv6 (::1) loopback
+// always, plus whatever host the plan's health URL names. Frameworks bind different families —
+// Spring Boot listens on 127.0.0.1, but Vite/Next preview dev servers bind IPv6 ::1 only — so
+// probing a single family misses half of them. `localhost` in a health URL is included as-is
+// and resolved by the OS.
+function probeHosts(app) {
+  const hosts = new Set(['127.0.0.1', '::1'])
+  try { if (app.health) hosts.add(new URL(app.health).hostname) } catch {}
+  return [...hosts]
+}
+// Liveness = a raw TCP connect to the app's listen port on ANY candidate host, NOT an HTTP
+// fetch of a health URL. A listening port means the app is up regardless of auth (Spring
+// Security 401s), path (actuator disabled), or protocol — and it is reliable where Node's fetch
+// is not (undici can stall on localhost keep-alive and time out against a server curl reaches
+// in 20 ms). This also detects apps started outside this CI/CD app, so their state shows right.
 async function probe(app) {
-  const url = app.health || `http://127.0.0.1:${app.port}/`
-  try {
-    await fetch(url, { signal: AbortSignal.timeout(800) })
-    return true
-  } catch { return false }
+  const results = await Promise.all(probeHosts(app).map((h) => tcpProbe(h, app.port, 800)))
+  return results.some(Boolean)
+}
+
+// Infrastructure reachability — a raw TCP connect, so it works for non-HTTP services
+// (PostgreSQL, Redis) as well as web consoles. Status-only: infra is never controlled here.
+function tcpProbe(host, port, timeout = 1000) {
+  return new Promise((resolve) => {
+    const socket = new net.Socket()
+    let done = false
+    const finish = (ok) => { if (done) return; done = true; try { socket.destroy() } catch {} ; resolve(ok) }
+    socket.setTimeout(timeout)
+    socket.once('connect', () => finish(true))
+    socket.once('timeout', () => finish(false))
+    socket.once('error', () => finish(false))
+    try { socket.connect(Number(port), host || '127.0.0.1') } catch { finish(false) }
+  })
 }
 
 function buildApp(app) {
@@ -191,17 +234,45 @@ function killTree(child) {
   }
 }
 
+// Stop an app we DON'T hold a child handle for (started outside this app, or before this app
+// last restarted) by killing whatever process tree is listening on its port — so Stop works
+// for any running app, not only ones this CI/CD app spawned. Returns true if a PID was killed.
+function killByPort(port) {
+  try {
+    if (process.platform === 'win32') {
+      const out = execFileSync('netstat', ['-ano', '-p', 'tcp'], { encoding: 'utf8' })
+      const pids = new Set()
+      for (const line of out.split(/\r?\n/)) {
+        const m = line.match(/:(\d+)\s+\S+\s+LISTENING\s+(\d+)/)
+        if (m && Number(m[1]) === Number(port)) pids.add(m[2])
+      }
+      for (const pid of pids) {
+        try { execFileSync('taskkill', ['/pid', pid, '/T', '/F'], { stdio: 'ignore' }) } catch {}
+      }
+      return pids.size > 0
+    }
+    const out = execFileSync('sh', ['-c', `lsof -ti tcp:${port} || true`], { encoding: 'utf8' })
+    const pids = out.split(/\s+/).filter(Boolean)
+    for (const pid of pids) { try { process.kill(Number(pid)) } catch {} }
+    return pids.length > 0
+  } catch { return false }
+}
+
 function stopApp(app) {
   if (app.method === 'container' && app.stop && app.stop !== 'process-kill') {
     try { execFileSync(app.stop.split(' ')[0], app.stop.split(' ').slice(1), { cwd: PROJECT_DIR }) } catch {}
   } else {
     const child = running.get(app.name)
-    if (!child) {
-      lastError.set(app.name, 'running outside this CI/CD app — stop it from where it was started')
-      return
+    if (child) {
+      stopping.add(app.name)
+      killTree(child)
+    } else {
+      // No child handle — kill by port so an externally/previously started app still stops.
+      lastError.delete(app.name)
+      if (!killByPort(app.port)) {
+        lastError.set(app.name, `could not stop — nothing found listening on port ${app.port}`)
+      }
     }
-    stopping.add(app.name)
-    killTree(child)
   }
   running.delete(app.name)
   saveState()
@@ -233,7 +304,7 @@ button:disabled{opacity:.4;cursor:default}
 .err{padding:4px 12px;font-size:11px;color:#c23b3b;display:none;white-space:pre-wrap}
 #log{flex:1;margin:0;padding:10px 12px;background:#0f1216;color:#d7dde4;font-size:11px;line-height:1.5;overflow:auto;white-space:pre-wrap}
 </style></head><body>
-<div class="top"><strong>CI/CD</strong><span id="branch" class="meta"></span></div>
+<div class="top"><strong>CI/CD</strong><span id="branch" class="meta"></span><span style="flex:1"></span><a id="infralink" class="url" href="/infra" target="_blank" rel="noreferrer" style="display:none">Infrastructure ↗</a></div>
 <div class="tabs" id="tabs"></div>
 <div class="bar" id="bar"></div>
 <div class="notice" id="notice"></div>
@@ -265,7 +336,7 @@ function renderBar(){
     <span style="flex:1"></span>
     <button onclick="act('build')" \${!gate||busy||a.phase==='running'?'disabled':''}>Build</button>
     <button onclick="act('start')" \${!gate||busy||a.phase==='running'?'disabled':''}>Start</button>
-    <button onclick="act('stop')" \${a.phase!=='running'||(a.external&&a.method!=='container')?'disabled':''}>Stop</button>
+    <button onclick="act('stop')" \${a.phase!=='running'?'disabled':''}>Stop</button>
     \${a.deploy?\`<button onclick="act('deploy')" \${!gate||busy?'disabled':''}>Deploy (\${a.deployMethod})</button>\`:''}\`
   const notice = document.getElementById('notice')
   if (a.developedOnce === false) {
@@ -312,6 +383,7 @@ async function refresh(){
   if (!s) return
   state = s
   document.getElementById('branch').textContent = s.currentBranch ? 'branch: '+s.currentBranch : ''
+  document.getElementById('infralink').style.display = s.hasInfra ? 'inline' : 'none'
   if (!active && s.apps.length) setActive(s.apps[0].name)
   renderTabs(); renderBar()
 }
@@ -319,6 +391,51 @@ async function act(op){
   await fetch('/api/apps/'+encodeURIComponent(active)+'/'+op, { method: 'POST' })
   refresh()
 }
+// Rescan immediately when the user returns to this page (tab focus / regained visibility), so
+// coming back from another screen reflects the true app + infra state without waiting the poll.
+document.addEventListener('visibilitychange', () => { if (!document.hidden) refresh() })
+window.addEventListener('focus', refresh)
+refresh(); setInterval(refresh, 3000)
+</script></body></html>`
+
+// ---- Infrastructure page ---------------------------------------------------------------
+// Standalone status-only page (opened in a new tab from the main page's Infrastructure link).
+// Lists every supporting 3rd-party service with a live TCP-reachability dot and a console link
+// when the service exposes a web UI. No lifecycle controls — infra is externally managed.
+const INFRA_PAGE = `<!doctype html><html><head><meta charset="utf-8"><title>Infrastructure</title><style>
+body{font-family:system-ui,sans-serif;margin:0;background:#f6f7f9;color:#1c2128;padding:16px}
+h1{font-size:16px;margin:0 0 12px}
+table{border-collapse:collapse;width:100%;max-width:820px;font-size:13px}
+th,td{text-align:left;padding:8px 10px;border-bottom:1px solid #e1e5ea}
+th{font-size:11px;text-transform:uppercase;color:#5b6572}
+.dot{display:inline-block;width:9px;height:9px;border-radius:99px;background:#8a94a0;margin-right:6px;vertical-align:middle}
+.dot.up{background:#1c8a4a}.dot.down{background:#c23b3b}
+.url{color:#1a66d0;text-decoration:underline}
+.muted{color:#5b6572;font-size:12px}
+.legend{margin-top:12px;font-size:11px;color:#5b6572}
+</style></head><body>
+<h1>Infrastructure</h1>
+<table><thead><tr><th>Status</th><th>Service</th><th>Endpoint</th><th>Console</th></tr></thead>
+<tbody id="rows"><tr><td colspan="4" class="muted">Loading…</td></tr></tbody></table>
+<div class="legend">● up ○ down — TCP reachability, polled every 3s</div>
+<script>
+function esc(s){ return String(s==null?'':s).replace(/[&<>"]/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])) }
+async function refresh(){
+  const s = await fetch('/api/infra').then(r=>r.json()).catch(()=>null)
+  if(!s) return
+  const rows = (s.infra||[]).map(i => \`
+    <tr>
+      <td><span class="dot \${i.up?'up':'down'}"></span>\${i.up?'up':'down'}</td>
+      <td>\${esc(i.name)}\${i.description?' <span class="muted">— '+esc(i.description)+'</span>':''}</td>
+      <td class="muted">\${esc(i.host)}:\${esc(i.port)}</td>
+      <td>\${i.url?'<a class="url" href="'+esc(i.url)+'" target="_blank" rel="noreferrer">open ↗</a>':'—'}</td>
+    </tr>\`).join('')
+  document.getElementById('rows').innerHTML = rows || '<tr><td colspan="4" class="muted">No infrastructure declared.</td></tr>'
+}
+// Rescan immediately when the user returns to this page (tab focus / regained visibility), so
+// coming back from another screen reflects the true app + infra state without waiting the poll.
+document.addEventListener('visibilitychange', () => { if (!document.hidden) refresh() })
+window.addEventListener('focus', refresh)
 refresh(); setInterval(refresh, 3000)
 </script></body></html>`
 
@@ -328,8 +445,20 @@ const server = http.createServer(async (req, res) => {
     res.writeHead(200, { 'content-type': 'text/html' })
     return res.end(PAGE)
   }
+  if (req.method === 'GET' && req.url === '/infra') {
+    res.writeHead(200, { 'content-type': 'text/html' })
+    return res.end(INFRA_PAGE)
+  }
+  if (req.method === 'GET' && req.url === '/api/infra') {
+    const infra = await Promise.all((loadConfig().infra || []).map(async (i) => ({
+      id: i.id, name: i.name, host: i.host || '127.0.0.1', port: i.port,
+      url: i.url || null, description: i.description || '',
+      up: await tcpProbe(i.host || '127.0.0.1', i.port),
+    })))
+    return json(res, 200, { infra })
+  }
   if (req.method === 'GET' && req.url === '/api/state') {
-    const apps = await Promise.all(CONFIG.apps.map(async (a) => {
+    const apps = await Promise.all(loadConfig().apps.map(async (a) => {
       const healthy = await probe(a)
       const phase = activity.get(a.name) || (healthy ? 'running' : failed.has(a.name) ? 'failed' : 'stopped')
       return {
@@ -340,11 +469,11 @@ const server = http.createServer(async (req, res) => {
         error: lastError.get(a.name) || null,
       }
     }))
-    return json(res, 200, { currentBranch: currentBranch(), apps })
+    return json(res, 200, { currentBranch: currentBranch(), hasInfra: (loadConfig().infra || []).length > 0, apps })
   }
   const m = req.url && req.url.match(/^\/api\/apps\/([^/]+)\/(build|start|stop|deploy)$/)
   if (m && req.method === 'POST') {
-    const app = CONFIG.apps.find((a) => a.name === decodeURIComponent(m[1]))
+    const app = loadConfig().apps.find((a) => a.name === decodeURIComponent(m[1]))
     if (!app) return json(res, 404, { error: 'unknown app' })
     if (m[2] !== 'stop' && developedOnce(app) === false) {
       return json(res, 409, { error: 'application has not completed a develop workflow run' })
@@ -368,7 +497,7 @@ server.on('upgrade', (req, socket) => {
     name = url.searchParams.get('app') || ''
   } catch {}
   const key = req.headers['sec-websocket-key']
-  const app = CONFIG.apps.find((a) => a.name === name)
+  const app = loadConfig().apps.find((a) => a.name === name)
   if (!app || !key || !isWsPath) { socket.destroy(); return }
   const accept = createHash('sha1').update(key + WS_GUID).digest('base64')
   socket.write(
@@ -389,9 +518,11 @@ server.on('upgrade', (req, socket) => {
 server.listen(PORT, () => console.log(`cicd app on :${PORT}`))
 ```
 
-`cicd/app/cicd.config.json` shape — one entry per application from the plan's Deployment
-Decisions table. `deployMethod`/`deploy` come from the plan's Deploy columns (`deploy` is
-`null` when the method is `none`):
+`cicd/app/cicd.config.json` shape — one `apps` entry per application from the plan's Deployment
+Decisions table, one `infra` entry per row of the plan's `## Infrastructure` table.
+`deployMethod`/`deploy` come from the plan's Deploy columns (`deploy` is `null` when the method
+is `none`). `infra[].url` is `null` for a headless service (Console URL cell `-`); emit
+`"infra": []` when the plan declares no supporting services:
 
 ```json
 {
@@ -409,6 +540,24 @@ Decisions table. `deployMethod`/`deploy` come from the plan's Deploy columns (`d
       "deploy": "kubectl apply -f my-app/k8s/",
       "health": "http://127.0.0.1:3000/"
     }
+  ],
+  "infra": [
+    {
+      "id": "postgres-main",
+      "name": "PostgreSQL (app db)",
+      "host": "127.0.0.1",
+      "port": 5432,
+      "url": null,
+      "description": "Shared application database"
+    },
+    {
+      "id": "keycloak",
+      "name": "Keycloak",
+      "host": "127.0.0.1",
+      "port": 8180,
+      "url": "http://127.0.0.1:8180",
+      "description": "Single sign-on"
+    }
   ]
 }
 ```

package/plugin/skills/util-plancicd/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: util-plancicd
-model: claude-sonnet-5
+model: claude-opus-4-8
 effort: high
 description: >
   Infer a local-deployment plan for every custom application of a CO2 project and write it to
@@ -10,7 +10,11 @@ description: >
   method (container vs bare process), build command (e.g. Spring Boot jar vs Docker image),
   start command, stop mechanism, deploy method + command (none / web-server copy / docker run /
   kubectl apply — only when the environment calls for one), port and health-check URL, plus a
-  port for the generated CI/CD app itself. The plan carries a top-level
+  port for the generated CI/CD app itself. It also enumerates the project's supporting
+  infrastructure (3rd-party services from CLAUDE.md's `# Supporting 3rd Party Applications` and
+  ENVIRONMENT.md — host, port and optional console URL) into an `## Infrastructure` section so
+  the generated CI/CD app can surface a status-only Infrastructure page. The plan carries a
+  top-level
   `**Status**: IN PROGRESS` header flipped to `COMPLETED` when done — the studio's watcher reads
   it. This skill NEVER generates the CI/CD app (that is util-gencicdscript, which runs only
   after the studio stamps an **Approved**: line into the plan). Trigger on keywords: "plan
@@ -43,6 +47,7 @@ If the argument is missing or the file does not exist, STOP and tell the user to
 | Dev tools | `DEVTOOL.md` (project root) |
 | Project context | `CLAUDE.md` (project root; `source/CLAUDE.md` fallback) |
 | App specification | `<app_folder>/context/specification/SPECIFICATION.md` |
+| Infrastructure | `CLAUDE.md` `# Supporting 3rd Party Applications` + `ENVIRONMENT.md` |
 | Output plan | `cicd/CICD_PLAN.md` |
 
 ## Phase 1 — Gather
@@ -50,11 +55,18 @@ If the argument is missing or the file does not exist, STOP and tell the user to
 1. Read the plan-request markdown; its `## Applications` list is the authoritative application set.
 2. Read `ENVIRONMENT.md` (registries, credentials, external services) and `DEVTOOL.md`
    (installed tools + paths: node/pnpm/docker/kubectl/python versions).
-3. Read `CLAUDE.md`: `# Custom Applications` (folder names, Depends on) and `# Port Allocation`
-   (per-application ports).
+3. Read `CLAUDE.md`: `# Custom Applications` (folder names, Depends on), `# Port Allocation`
+   (per-application ports), and `# Supporting 3rd Party Applications` (the infrastructure the
+   applications depend on — databases, caches, object storage, SSO, mail, message brokers, etc.).
 4. For each application, read its SPECIFICATION.md tech-stack section if present; otherwise
    infer the stack from build files (`package.json` → node, `pom.xml` → spring-boot,
    `composer.json` → laravel).
+5. Build the **infrastructure list**: one entry per supporting 3rd-party service the project
+   declares. For each, resolve `host` (default `127.0.0.1`), `port` and — when it exposes a web
+   console/UI — a `url`, cross-referencing ENVIRONMENT.md for the actual host/port/endpoint. A
+   service with no host:port to probe (or a purely external SaaS with no local endpoint) is
+   omitted. If the project declares no supporting 3rd-party services, the infrastructure list is
+   empty and the plan's `## Infrastructure` section is written empty.
 
 ## Phase 2 — Decide (per application)
 
@@ -84,9 +96,33 @@ If the argument is missing or the file does not exist, STOP and tell the user to
   needs no deploy step beyond Start; never invent a target the config does not name.
 - **Port**: from `# Port Allocation`; if absent, assign sequentially from 3000 avoiding
   collisions with the studio (3001) and the CI/CD app port.
-- **Health**: `http://127.0.0.1:<port>/` or a documented health endpoint from the spec.
+- **Health / running-detection**: the endpoint the generated CI/CD app uses to tell whether the
+  application is already running. Detection is a **raw TCP connect to the app's port on loopback**
+  — the generated app probes BOTH IPv4 (`127.0.0.1`) and IPv6 (`::1`) loopback, plus the host
+  named in this Health value — so it does not matter which family the framework binds. This
+  matters because dev servers differ: Spring Boot binds `127.0.0.1`, but **Vite / Next preview
+  servers bind IPv6 `::1` (localhost) only** and are invisible to an IPv4-only probe. Therefore
+  set the Health host to **`localhost`** (not `127.0.0.1`) for any Node/Vite/Next dev-server app
+  so the detection host set includes the interface it actually binds; use `127.0.0.1` for JVM
+  apps. Value form: `http://localhost:<port>/` or a documented health path from the spec (the
+  path is informational — detection keys on the port, not the path).
 - **CI/CD app port**: 4100 unless taken in `# Port Allocation`; record it in the plan.
 
+### Infrastructure (status-only)
+
+Supporting 3rd-party services are **not** built/started/deployed by the CI/CD app — they are
+surfaced status-only. For each service resolved in Gather step 5, decide:
+
+- **id**: a stable kebab-case key unique within the plan (e.g. `postgres-main`, `keycloak`).
+- **name**: display name (e.g. `PostgreSQL (skf_main)`, `Keycloak`).
+- **host** / **port**: the address the CI/CD app TCP-probes for reachability; default host
+  `127.0.0.1`. Use the values ENVIRONMENT.md documents.
+- **url**: the web console/UI opened in a new tab, when the service has one (Keycloak admin,
+  MinIO console, Mailcatcher inbox); `-` for headless services (PostgreSQL, Redis).
+- **description**: a short blurb (e.g. `Shared app database`, `S3-compatible object storage`).
+
+Never emit credentials into the infrastructure entries — status and links only.
+
 ## Phase 3 — Write the plan
 
 Create `cicd/` if missing and write `cicd/CICD_PLAN.md`:
@@ -108,6 +144,20 @@ Create `cicd/` if missing and write `cicd/CICD_PLAN.md`:
 |---|---|---|---|---|---|---|---|---|---|
 | <name> | <folder> | process|container | <port> | `<cmd>` | `<cmd>` | process-kill|docker stop | none|web-server|docker|kubernetes | `<cmd or ->` | <url> |
 
+> **Running-detection**: the generated CI/CD app determines "is it running?" by a TCP connect to
+> each application's **Port** on both IPv4 (`127.0.0.1`) and IPv6 (`::1`) loopback plus the
+> **Health** host — so an app is detected whichever family it binds. Use a `localhost` Health host
+> for Node/Vite/Next apps (they bind IPv6 `::1`) and `127.0.0.1` for JVM apps.
+
+## Infrastructure
+
+Supporting 3rd-party services shown status-only (TCP reachability) on the CI/CD app's
+Infrastructure page. Leave the table body empty when the project declares no supporting services.
+
+| Id | Service | Host | Port | Console URL | Description |
+|---|---|---|---|---|---|
+| <id> | <name> | <host> | <port> | `<url or ->` | <blurb> |
+
 ## Rationale
 
 - <per-application: why this method/commands, citing ENVIRONMENT.md/DEVTOOL.md evidence>

package/static/assets/{abnfDiagram-VRR7QNED-BwxjNDj8.js → abnfDiagram-VRR7QNED-DPeOXHkD.js}

@@ -1 +1 @@
-import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-BbMHSSXk.js";import{p as f}from"./chunk-JWPE2WC7-RVdgT8k5.js";import{_ as n,l as o}from"./index-CgNepcKp.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-B7HPqh-Z.js";var v=d().RailroadAbnf.parser.LangiumParser,l=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),i=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:i,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return l(e.element);case"AbnfOptionalGroup":return{type:"optional",element:l(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:l(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},w={parser:R,db:a,renderer:u,styles:p};export{w as diagram};
+import{g as p,r as u,d as a}from"./chunk-MOJQB5TN-Do9cetyI.js";import{p as f}from"./chunk-JWPE2WC7-DbWRh-D_.js";import{_ as n,l as o}from"./index-BeEg-X0n.js";import{M as c,b as d}from"./cynefin-VYW2F7L2-DJsuSCkt.js";var v=d().RailroadAbnf.parser.LangiumParser,l=n(e=>{const r=e.alternatives.map(g);return r.length===1?r[0]:{type:"choice",alternatives:r}},"transformAlternation"),g=n(e=>{const r=e.elements.map(y);return r.length===1?r[0]:{type:"sequence",elements:r}},"transformConcatenation"),b=n(e=>{if(e.includes("*")){const[t,s]=e.split("*"),i=t?parseInt(t,10):0,m=s?parseInt(s,10):1/0;return{min:i,max:m}}const r=parseInt(e,10);return{min:r,max:r}},"parseRepeat"),y=n(e=>{const r=A(e.primary);if(!e.repeat)return r;const{min:t,max:s}=b(e.repeat);return t===0&&s===1?{type:"optional",element:r}:{type:"repetition",element:r,min:t,max:s}},"transformElement"),A=n(e=>{switch(e.$type){case"AbnfStringLiteral":return{type:"terminal",value:e.value};case"AbnfNumVal":return{type:"terminal",value:e.value};case"AbnfRuleName":return{type:"nonterminal",name:e.name};case"AbnfGroup":return l(e.element);case"AbnfOptionalGroup":return{type:"optional",element:l(e.element)};default:throw new Error(`Unsupported ABNF primary node: ${e.$type}`)}},"transformPrimary"),P=n(e=>({name:e.name,definition:l(e.definition)}),"transformRule"),h=n(e=>{f(e,a),e.title&&a.setTitle(e.title),e.rules.map(r=>a.addRule(P(r)))},"populateDb"),R={parse:n(e=>{a.clear(),o.debug("[ABNF Parser] Starting Langium parse");const r=v.parse(e);if(r.lexerErrors.length>0||r.parserErrors.length>0)throw new c(r);const t=r.value;o.debug("[ABNF Parser] Parsed rules:",t.rules.length),h(t),o.debug("[ABNF Parser] Parse complete")},"parse"),parser:{yy:a}},w={parser:R,db:a,renderer:u,styles:p};export{w as diagram};

package/static/assets/{arc-Bf00Zylw.js → arc-Bb2ZEtXe.js}

@@ -1 +1 @@
-import{Y as ln,$ as an,a0 as y,a1 as tn,a2 as F,a3 as q,a4 as _,a5 as un,a6 as rn,a7 as J,a8 as o,a9 as j,aa as sn,ab as on,ac as fn}from"./index-CgNepcKp.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(fn(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-an,c=A.apply(this,arguments)-an,B=un(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(un(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<rn)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(on((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-rn/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};
+import{Y as ln,$ as an,a0 as y,a1 as tn,a2 as F,a3 as q,a4 as _,a5 as un,a6 as rn,a7 as J,a8 as o,a9 as j,aa as sn,ab as on,ac as fn}from"./index-BeEg-X0n.js";function cn(l){return l.innerRadius}function yn(l){return l.outerRadius}function gn(l){return l.startAngle}function dn(l){return l.endAngle}function mn(l){return l&&l.padAngle}function pn(l,h,I,D,v,A,z,a){var O=I-l,i=D-h,n=z-v,d=a-A,u=d*O-n*i;if(!(u*u<y))return u=(n*(h-A)-d*(l-v))/u,[l+u*O,h+u*i]}function U(l,h,I,D,v,A,z){var a=l-I,O=h-D,i=(z?A:-A)/J(a*a+O*O),n=i*O,d=-i*a,u=l+n,s=h+d,f=I+n,c=D+d,B=(u+f)/2,t=(s+c)/2,m=f-u,g=c-s,R=m*m+g*g,T=v-A,P=u*c-f*s,S=(g<0?-1:1)*J(fn(0,T*T*R-P*P)),Y=(P*g-m*S)/R,$=(-P*m-g*S)/R,w=(P*g+m*S)/R,p=(-P*m+g*S)/R,x=Y-B,e=$-t,r=w-B,C=p-t;return x*x+e*e>r*r+C*C&&(Y=w,$=p),{cx:Y,cy:$,x01:-n,y01:-d,x11:Y*(v/T-1),y11:$*(v/T-1)}}function hn(){var l=cn,h=yn,I=j(0),D=null,v=gn,A=dn,z=mn,a=null,O=ln(i);function i(){var n,d,u=+l.apply(this,arguments),s=+h.apply(this,arguments),f=v.apply(this,arguments)-an,c=A.apply(this,arguments)-an,B=un(c-f),t=c>f;if(a||(a=n=O()),s<u&&(d=s,s=u,u=d),!(s>y))a.moveTo(0,0);else if(B>tn-y)a.moveTo(s*F(f),s*q(f)),a.arc(0,0,s,f,c,!t),u>y&&(a.moveTo(u*F(c),u*q(c)),a.arc(0,0,u,c,f,t));else{var m=f,g=c,R=f,T=c,P=B,S=B,Y=z.apply(this,arguments)/2,$=Y>y&&(D?+D.apply(this,arguments):J(u*u+s*s)),w=_(un(s-u)/2,+I.apply(this,arguments)),p=w,x=w,e,r;if($>y){var C=sn($/u*q(Y)),K=sn($/s*q(Y));(P-=C*2)>y?(C*=t?1:-1,R+=C,T-=C):(P=0,R=T=(f+c)/2),(S-=K*2)>y?(K*=t?1:-1,m+=K,g-=K):(S=0,m=g=(f+c)/2)}var G=s*F(m),H=s*q(m),L=u*F(T),M=u*q(T);if(w>y){var N=s*F(g),Q=s*q(g),V=u*F(R),W=u*q(R),E;if(B<rn)if(E=pn(G,H,V,W,N,Q,L,M)){var X=G-E[0],Z=H-E[1],b=N-E[0],k=Q-E[1],nn=1/q(on((X*b+Z*k)/(J(X*X+Z*Z)*J(b*b+k*k)))/2),en=J(E[0]*E[0]+E[1]*E[1]);p=_(w,(u-en)/(nn-1)),x=_(w,(s-en)/(nn+1))}else p=x=0}S>y?x>y?(e=U(V,W,G,H,s,x,t),r=U(N,Q,L,M,s,x,t),a.moveTo(e.cx+e.x01,e.cy+e.y01),x<w?a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,x,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,s,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),!t),a.arc(r.cx,r.cy,x,o(r.y11,r.x11),o(r.y01,r.x01),!t))):(a.moveTo(G,H),a.arc(0,0,s,m,g,!t)):a.moveTo(G,H),!(u>y)||!(P>y)?a.lineTo(L,M):p>y?(e=U(L,M,N,Q,u,-p,t),r=U(G,H,V,W,u,-p,t),a.lineTo(e.cx+e.x01,e.cy+e.y01),p<w?a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(r.y01,r.x01),!t):(a.arc(e.cx,e.cy,p,o(e.y01,e.x01),o(e.y11,e.x11),!t),a.arc(0,0,u,o(e.cy+e.y11,e.cx+e.x11),o(r.cy+r.y11,r.cx+r.x11),t),a.arc(r.cx,r.cy,p,o(r.y11,r.x11),o(r.y01,r.x01),!t))):a.arc(0,0,u,T,R,t)}if(a.closePath(),n)return a=null,n+""||null}return i.centroid=function(){var n=(+l.apply(this,arguments)+ +h.apply(this,arguments))/2,d=(+v.apply(this,arguments)+ +A.apply(this,arguments))/2-rn/2;return[F(d)*n,q(d)*n]},i.innerRadius=function(n){return arguments.length?(l=typeof n=="function"?n:j(+n),i):l},i.outerRadius=function(n){return arguments.length?(h=typeof n=="function"?n:j(+n),i):h},i.cornerRadius=function(n){return arguments.length?(I=typeof n=="function"?n:j(+n),i):I},i.padRadius=function(n){return arguments.length?(D=n==null?null:typeof n=="function"?n:j(+n),i):D},i.startAngle=function(n){return arguments.length?(v=typeof n=="function"?n:j(+n),i):v},i.endAngle=function(n){return arguments.length?(A=typeof n=="function"?n:j(+n),i):A},i.padAngle=function(n){return arguments.length?(z=typeof n=="function"?n:j(+n),i):z},i.context=function(n){return arguments.length?(a=n??null,i):a},i}export{hn as d};