@slamb2k/mad-skills 2.0.26 → 2.0.28

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mad-skills",
   "description": "AI-assisted planning, development and governance tools",
-  "version": "2.0.26",
+  "version": "2.0.28",
   "author": {
     "name": "slamb2k",
     "url": "https://github.com/slamb2k"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@slamb2k/mad-skills",
-  "version": "2.0.26",
+  "version": "2.0.28",
   "description": "Claude Code skills collection — full lifecycle development tools",
   "type": "module",
   "repository": {

package/skills/brace/SKILL.md

@@ -273,13 +273,24 @@ Parse VERIFY_REPORT. Present the final summary using the format in
 
 **Only if the project is a git repo** (from SCAN_REPORT `git_initialized`).
 
-Check if the default branch (main or master) has branch protection:
+Detect the default branch and hosting platform:
 
 ```bash
 default_branch=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@' || echo "main")
+
+REMOTE_URL=$(git remote get-url origin 2>/dev/null)
+if echo "$REMOTE_URL" | grep -qiE 'dev\.azure\.com|visualstudio\.com'; then
+  PLATFORM="azdo"
+elif echo "$REMOTE_URL" | grep -qi 'github\.com'; then
+  PLATFORM="github"
+else
+  PLATFORM="unknown"
+fi
 ```
 
-If a GitHub remote is detected (`git remote get-url origin` matches github.com):
+### GitHub
+
+If `PLATFORM == github`:
 1. Check for existing branch protection via `gh api repos/{owner}/{repo}/branches/{default_branch}/protection` (404 = unprotected)
 2. If unprotected, ask via AskUserQuestion:
 
@@ -299,6 +310,108 @@ If a GitHub remote is detected (`git remote get-url origin` matches github.com):
      -F allow_deletions=false
    ```
 
+### Azure DevOps
+
+If `PLATFORM == azdo`:
+
+Extract org and project from the remote URL (same pattern as `/ship`):
+```bash
+if echo "$REMOTE_URL" | grep -q 'dev\.azure\.com'; then
+  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*dev\.azure\.com/\([^/]*\)/.*|\1|p')
+  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*dev\.azure\.com/[^/]*/\([^/]*\)/.*|\1|p')
+  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
+elif echo "$REMOTE_URL" | grep -q 'vs-ssh\.visualstudio\.com'; then
+  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*vs-ssh\.visualstudio\.com:v3/\([^/]*\)/.*|\1|p')
+  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*vs-ssh\.visualstudio\.com:v3/[^/]*/\([^/]*\)/.*|\1|p')
+  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
+elif echo "$REMOTE_URL" | grep -q 'visualstudio\.com'; then
+  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*//\([^.]*\)\.visualstudio\.com.*|\1|p')
+  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*/\([^/]*\)/_git/.*|\1|p')
+  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
+fi
+REPO_NAME=$(basename -s .git "$REMOTE_URL")
+```
+
+If org/project extraction fails, report ⚠️ and skip branch policies.
+
+1. Check for existing branch policies. Use `az repos` CLI if available,
+   otherwise fall back to REST API:
+
+   **CLI:**
+   ```bash
+   az repos policy list \
+     --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+     --repository-id "$REPO_NAME" --branch "$default_branch" \
+     --query "[].type.displayName" -o tsv
+   ```
+
+   **REST fallback:**
+   ```bash
+   AUTH="Authorization: Basic $(echo -n ":$PAT" | base64)"
+   # Get repository ID first
+   REPO_ID=$(curl -s -H "$AUTH" \
+     "$AZDO_ORG_URL/$AZDO_PROJECT/_apis/git/repositories/$REPO_NAME?api-version=7.0" \
+     | jq -r '.id')
+   # List branch policies
+   curl -s -H "$AUTH" \
+     "$AZDO_ORG_URL/$AZDO_PROJECT/_apis/policy/configurations?api-version=7.0" \
+     | jq "[.value[] | select(.settings.scope[]?.refName == \"refs/heads/$default_branch\" and .settings.scope[]?.repositoryId == \"$REPO_ID\")]"
+   ```
+
+2. If no "Minimum number of reviewers" policy exists, ask via AskUserQuestion:
+
+   Question: "Default branch `{default_branch}` has no minimum reviewer policy. Add it?"
+   Options:
+   - "Yes, require PR reviews (Recommended)" — require 1 approval, block direct push
+   - "Skip" — leave unprotected
+
+3. If user accepts, create the policy:
+
+   **CLI:**
+   ```bash
+   REPO_ID=$(az repos show --repository "$REPO_NAME" \
+     --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+     --query 'id' -o tsv)
+
+   az repos policy approver-count create \
+     --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+     --repository-id "$REPO_ID" --branch "$default_branch" \
+     --minimum-approver-count 1 \
+     --creator-vote-counts false \
+     --allow-downvotes false \
+     --reset-on-source-push true \
+     --blocking true --enabled true
+   ```
+
+   **REST fallback:**
+   ```bash
+   curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" \
+     "$AZDO_ORG_URL/$AZDO_PROJECT/_apis/policy/configurations?api-version=7.0" \
+     -d "{
+       \"isEnabled\": true,
+       \"isBlocking\": true,
+       \"type\": {\"id\": \"fa4e907d-c16b-4a4c-9dfa-4906e5d171dd\"},
+       \"settings\": {
+         \"minimumApproverCount\": 1,
+         \"creatorVoteCounts\": false,
+         \"allowDownvotes\": false,
+         \"resetOnSourcePush\": true,
+         \"scope\": [{
+           \"repositoryId\": \"$REPO_ID\",
+           \"refName\": \"refs/heads/$default_branch\",
+           \"matchKind\": \"exact\"
+         }]
+       }
+     }"
+   ```
+
+### Unknown Platform
+
+If `PLATFORM == unknown`, skip branch protection and report:
+```
+⏭️ Branch protection — skipped (unrecognized remote, not GitHub or Azure DevOps)
+```
+
 Include result in the final report under a "🔒 Branch protection" section.
 
 ---

package/skills/manifest.json

@@ -1,12 +1,12 @@
 {
-  "generated": "2026-03-12T03:25:58.495Z",
+  "generated": "2026-03-12T13:35:25.365Z",
   "count": 10,
   "skills": [
     {
       "name": "brace",
       "directory": "brace",
       "description": "'Initialize any project directory with a standard scaffold for AI-assisted development. Creates specs/ and context/ directories, a project CLAUDE.md with development workflow and guardrails, .gitignore, and branch protection. Recommends claude-mem for persistent memory. Idempotent — safe to run on existing projects. Triggers: \"init project\", \"setup brace\", \"brace\", \"initialize\", \"bootstrap\", \"scaffold\".'",
-      "lines": 328,
+      "lines": 441,
       "hasScripts": false,
       "hasReferences": true,
       "hasAssets": true,
@@ -66,7 +66,7 @@
       "name": "rig",
       "directory": "rig",
       "description": "'Idempotently bootstrap any repository with standard development tools, hooks, and workflows. Use when starting work on a new repo, onboarding to an existing project, or ensuring a repo has proper CI/CD setup. Configures: git hooks (lefthook), commit message templates, PR templates, and GitHub Actions for lint/format/type-check/build. Prompts for user confirmation before changes. Triggers: \"bootstrap repo\", \"setup hooks\", \"configure CI\", \"rig\", \"standardize repo\".'",
-      "lines": 231,
+      "lines": 338,
       "hasScripts": false,
       "hasReferences": true,
       "hasAssets": true,

package/skills/rig/SKILL.md

@@ -68,9 +68,31 @@ get approval, then act.
 
 ---
 
+## Platform Detection
+
+Detect the hosting platform **before** pre-flight so dependency checks are
+platform-specific:
+
+```bash
+REMOTE_URL=$(git remote get-url origin 2>/dev/null)
+if echo "$REMOTE_URL" | grep -qiE 'dev\.azure\.com|visualstudio\.com'; then
+  PLATFORM="azdo"
+elif echo "$REMOTE_URL" | grep -qi 'github\.com'; then
+  PLATFORM="github"
+else
+  PLATFORM="github"   # default fallback
+fi
+```
+
+Pass `{PLATFORM}` into all phase prompts. Each phase uses the appropriate
+CLI tool: `gh` for GitHub, `az repos`/`az pipelines` for Azure DevOps.
+
+---
+
 ## Pre-flight
 
-Before starting, check all dependencies in this table:
+Before starting, check all dependencies in this table. The table contains
+**all** dependencies — some are platform-conditional (see notes after table).
 
 | Dependency | Type | Check | Required | Resolution | Detail |
 |-----------|------|-------|----------|------------|--------|
@@ -78,17 +100,102 @@ Before starting, check all dependencies in this table:
 | sync | skill | `~/.claude/skills/sync/SKILL.md` or `~/.claude/plugins/marketplaces/slamb2k/skills/sync/SKILL.md` | no | fallback | Repo sync; falls back to manual git pull |
 | lefthook | npm | `npx lefthook --help` | yes | install | `npm install -g lefthook` |
 | gh | cli | `gh --version` | yes | url | https://cli.github.com |
+| az devops | cli | `az devops -h 2>/dev/null` | no | fallback | Falls back to REST API with PAT; see AzDO tooling below |
 
-For each row, in order:
-1. Run the Check command (for cli/npm) or test file existence (for agent/skill)
-2. If found: continue silently
-3. If missing: apply Resolution strategy
+**Platform-conditional rules:**
+- **`gh`**: Only required when `PLATFORM == github`. Skip for AzDO repos.
+- **`az devops`**: Only checked when `PLATFORM == azdo`. Skip for GitHub repos.
+
+For each applicable row, in order:
+1. Skip rows that don't apply to the detected `{PLATFORM}`
+2. Run the Check command (for cli/npm) or test file existence (for agent/skill)
+3. If found: continue silently
+4. If missing: apply Resolution strategy
    - **stop**: notify user with Detail, halt execution
    - **url**: notify user with Detail (install link), halt execution
    - **install**: notify user, run the command in Detail, continue if successful
    - **ask**: notify user, offer to run command in Detail, continue either way (or halt if required)
    - **fallback**: notify user with Detail, continue with degraded behavior
-4. After all checks: summarize what's available and what's degraded
+5. After all checks: summarize what's available and what's degraded
+
+### AzDO Tooling Detection
+
+When `PLATFORM == azdo`, determine which tooling is available. Set `AZDO_MODE`
+for use in all subsequent phases:
+
+```bash
+if az devops -h &>/dev/null; then
+  AZDO_MODE="cli"
+else
+  AZDO_MODE="rest"
+fi
+```
+
+- **`cli`**: Use `az repos` / `az pipelines` commands (preferred)
+- **`rest`**: Use Azure DevOps REST API via `curl`. Requires a PAT (personal
+  access token) in `AZURE_DEVOPS_EXT_PAT` or `AZDO_PAT` env var. If no PAT
+  is found, prompt the user to either install the CLI or set the env var.
+
+Report in pre-flight:
+- ✅ `az devops cli` — version found
+- ⚠️ `az devops cli` — not found → using REST API fallback
+- ❌ `az devops cli` — not found, no PAT configured → halt with setup instructions
+
+### AzDO Configuration Validation
+
+When `PLATFORM == azdo`, extract organization and project from the remote URL
+and validate they are usable. These values are needed by every `az repos` /
+`az pipelines` command and every REST API call.
+
+```bash
+# Extract org and project from remote URL patterns:
+#   https://dev.azure.com/{ORG}/{PROJECT}/_git/{REPO}
+#   https://{ORG}@dev.azure.com/{ORG}/{PROJECT}/_git/{REPO}
+#   {ORG}@vs-ssh.visualstudio.com:v3/{ORG}/{PROJECT}/{REPO}
+
+REMOTE_URL=$(git remote get-url origin 2>/dev/null)
+
+if echo "$REMOTE_URL" | grep -q 'dev\.azure\.com'; then
+  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*dev\.azure\.com/\([^/]*\)/.*|\1|p')
+  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*dev\.azure\.com/[^/]*/\([^/]*\)/.*|\1|p')
+  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
+elif echo "$REMOTE_URL" | grep -q 'vs-ssh\.visualstudio\.com'; then
+  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*vs-ssh\.visualstudio\.com:v3/\([^/]*\)/.*|\1|p')
+  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*vs-ssh\.visualstudio\.com:v3/[^/]*/\([^/]*\)/.*|\1|p')
+  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
+elif echo "$REMOTE_URL" | grep -q 'visualstudio\.com'; then
+  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*//\([^.]*\)\.visualstudio\.com.*|\1|p')
+  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*/\([^/]*\)/_git/.*|\1|p')
+  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
+fi
+
+if [ -z "$AZDO_ORG" ] || [ -z "$AZDO_PROJECT" ]; then
+  echo "❌ Could not extract organization/project from remote URL"
+  echo "   Remote: $REMOTE_URL"
+  echo ""
+  echo "Ensure the remote URL follows one of these formats:"
+  echo "  https://dev.azure.com/{ORG}/{PROJECT}/_git/{REPO}"
+  echo "  https://{ORG}.visualstudio.com/{PROJECT}/_git/{REPO}"
+  echo "  {ORG}@vs-ssh.visualstudio.com:v3/{ORG}/{PROJECT}/{REPO}"
+  # HALT — cannot proceed without org/project context
+fi
+```
+
+When `AZDO_MODE == cli`, also configure the defaults so commands work correctly:
+```bash
+az devops configure --defaults organization="$AZDO_ORG_URL" project="$AZDO_PROJECT"
+```
+
+When `AZDO_MODE == rest`, store these for API calls:
+- Base URL: `$AZDO_ORG_URL/$AZDO_PROJECT/_apis`
+- Auth header: `Authorization: Basic $(echo -n ":$PAT" | base64)`
+
+Report in pre-flight:
+- ✅ `azdo context` — org: `{AZDO_ORG}`, project: `{AZDO_PROJECT}`
+- ❌ `azdo context` — could not parse from remote URL → halt with instructions
+
+Pass `{AZDO_MODE}`, `{AZDO_ORG}`, `{AZDO_PROJECT}`, `{AZDO_ORG_URL}` into
+all phase prompts alongside `{PLATFORM}`.
 
 ---
 

package/skills/rig/assets/azure-pipelines.yml

@@ -1,3 +1,11 @@
+# Azure Pipelines CI template for Node.js projects
+#
+# NOTE: Azure Pipelines does not have a built-in concurrency control equivalent
+# to GitHub Actions' `concurrency` key. To cancel redundant runs on the same
+# branch/PR, configure "Run number" or use the Azure DevOps UI/REST API to
+# cancel superseded builds. For PR triggers, enable "Cancel running CI builds
+# for a push" in the pipeline settings.
+
 trigger:
   branches:
     include:
@@ -22,8 +30,18 @@ stages:
               versionSpec: '20.x'
             displayName: 'Setup Node.js'
 
+          - task: Cache@2
+            inputs:
+              key: 'npm | "$(Agent.OS)" | package-lock.json'
+              restoreKeys: |
+                npm | "$(Agent.OS)"
+              path: '$(Pipeline.Workspace)/.npm'
+            displayName: 'Cache npm packages'
+
           - script: npm ci
             displayName: 'Install dependencies'
+            env:
+              npm_config_cache: '$(Pipeline.Workspace)/.npm'
 
           - script: npm run lint --if-present
             displayName: 'Run linter'
@@ -36,8 +54,18 @@ stages:
               versionSpec: '20.x'
             displayName: 'Setup Node.js'
 
+          - task: Cache@2
+            inputs:
+              key: 'npm | "$(Agent.OS)" | package-lock.json'
+              restoreKeys: |
+                npm | "$(Agent.OS)"
+              path: '$(Pipeline.Workspace)/.npm'
+            displayName: 'Cache npm packages'
+
           - script: npm ci
             displayName: 'Install dependencies'
+            env:
+              npm_config_cache: '$(Pipeline.Workspace)/.npm'
 
           - script: npm run format:check --if-present || npx prettier --check .
             displayName: 'Check formatting'
@@ -50,8 +78,18 @@ stages:
               versionSpec: '20.x'
             displayName: 'Setup Node.js'
 
+          - task: Cache@2
+            inputs:
+              key: 'npm | "$(Agent.OS)" | package-lock.json'
+              restoreKeys: |
+                npm | "$(Agent.OS)"
+              path: '$(Pipeline.Workspace)/.npm'
+            displayName: 'Cache npm packages'
+
           - script: npm ci
             displayName: 'Install dependencies'
+            env:
+              npm_config_cache: '$(Pipeline.Workspace)/.npm'
 
           - script: npm run typecheck --if-present || npm run type-check --if-present || npx tsc --noEmit
             displayName: 'Run type check'
@@ -67,8 +105,18 @@ stages:
               versionSpec: '20.x'
             displayName: 'Setup Node.js'
 
+          - task: Cache@2
+            inputs:
+              key: 'npm | "$(Agent.OS)" | package-lock.json'
+              restoreKeys: |
+                npm | "$(Agent.OS)"
+              path: '$(Pipeline.Workspace)/.npm'
+            displayName: 'Cache npm packages'
+
           - script: npm ci
             displayName: 'Install dependencies'
+            env:
+              npm_config_cache: '$(Pipeline.Workspace)/.npm'
 
           - script: npm run build
             displayName: 'Build'
@@ -84,8 +132,18 @@ stages:
               versionSpec: '20.x'
             displayName: 'Setup Node.js'
 
+          - task: Cache@2
+            inputs:
+              key: 'npm | "$(Agent.OS)" | package-lock.json'
+              restoreKeys: |
+                npm | "$(Agent.OS)"
+              path: '$(Pipeline.Workspace)/.npm'
+            displayName: 'Cache npm packages'
+
           - script: npm ci
             displayName: 'Install dependencies'
+            env:
+              npm_config_cache: '$(Pipeline.Workspace)/.npm'
 
           - script: npm test --if-present
             displayName: 'Run tests'

package/skills/rig/tests/evals.json

@@ -25,5 +25,14 @@
       { "type": "contains", "value": "██" },
       { "type": "semantic", "value": "Mentions that the process is idempotent (safe to run multiple times) and will prompt the user for confirmation before making changes" }
     ]
+  },
+  {
+    "name": "azdo-awareness",
+    "prompt": "Bootstrap CI for my Azure DevOps repository at https://dev.azure.com/myorg/myproject/_git/myrepo",
+    "assertions": [
+      { "type": "contains", "value": "██" },
+      { "type": "regex", "value": "(Azure Pipelines|Azure DevOps|azdo)", "flags": "i" },
+      { "type": "semantic", "value": "Recognizes the repository is hosted on Azure DevOps and mentions Azure Pipelines as the CI platform instead of or alongside GitHub Actions" }
+    ]
   }
 ]