@slamb2k/mad-skills 2.0.41 → 2.0.42

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mad-skills",
   "description": "AI-assisted planning, development and governance tools",
-  "version": "2.0.41",
+  "version": "2.0.42",
   "author": {
     "name": "slamb2k",
     "url": "https://github.com/slamb2k"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@slamb2k/mad-skills",
-  "version": "2.0.41",
+  "version": "2.0.42",
   "description": "Claude Code skills collection — full lifecycle development tools",
   "type": "module",
   "repository": {

package/skills/brace/SKILL.md

@@ -342,12 +342,12 @@ elif echo "$REMOTE_URL" | grep -q 'vs-ssh\.visualstudio\.com'; then
 elif echo "$REMOTE_URL" | grep -q 'visualstudio\.com'; then
   AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*//\([^.]*\)\.visualstudio\.com.*|\1|p')
   AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*/\([^/]*\)/_git/.*|\1|p')
-  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
+  AZDO_ORG_URL="https://${AZDO_ORG}.visualstudio.com"
 fi
 # URL-decode for CLI/display; keep URL-safe versions for REST API paths
 AZDO_PROJECT_URL_SAFE="$AZDO_PROJECT"
-AZDO_ORG=$(printf '%b' "${AZDO_ORG//%/\\x}")
-AZDO_PROJECT=$(printf '%b' "${AZDO_PROJECT//%/\\x}")
+AZDO_ORG=$(python3 -c "import urllib.parse; print(urllib.parse.unquote('$AZDO_ORG'))")
+AZDO_PROJECT=$(python3 -c "import urllib.parse; print(urllib.parse.unquote('$AZDO_PROJECT_URL_SAFE'))")
 REPO_NAME=$(basename -s .git "$REMOTE_URL")
 ```
 
@@ -366,7 +366,7 @@ If org/project extraction fails, report ⚠️ and skip branch policies.
 
    **REST fallback:**
    ```bash
-   AUTH="Authorization: Basic $(echo -n ":$PAT" | base64)"
+   AUTH="Authorization: Basic $(printf ":%s" "$PAT" | base64 | tr -d '\n')"
    # Get repository ID first
    REPO_ID=$(curl -s -H "$AUTH" \
      "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/git/repositories/$REPO_NAME?api-version=7.0" \

package/skills/dock/SKILL.md

@@ -128,8 +128,9 @@ For each applicable row, in order:
    - **fallback**: notify user with Detail, continue with degraded behavior
 5. After all checks: summarize what's available and what's degraded
 
-When `PLATFORM == azdo`, follow `references/azdo-platform.md` for tooling
-detection (`AZDO_MODE`) and configuration validation (`AZDO_ORG`, `AZDO_PROJECT`).
+When `PLATFORM == azdo`, follow the shared AzDO platform guide
+(repo root: references/azdo-platform.md) for tooling detection (`AZDO_MODE`)
+and configuration validation (`AZDO_ORG`, `AZDO_PROJECT`).
 Pass these variables into all phase prompts alongside `{PLATFORM}`.
 
 ---

package/skills/keel/SKILL.md

@@ -124,8 +124,9 @@ For each applicable row, in order:
    - **fallback**: notify user with Detail, continue with degraded behavior
 5. After all checks: summarize what's available and what's degraded
 
-When `PLATFORM == azdo`, follow `references/azdo-platform.md` for tooling
-detection (`AZDO_MODE`) and configuration validation (`AZDO_ORG`, `AZDO_PROJECT`).
+When `PLATFORM == azdo`, follow the shared AzDO platform guide
+(repo root: references/azdo-platform.md) for tooling detection (`AZDO_MODE`)
+and configuration validation (`AZDO_ORG`, `AZDO_PROJECT`).
 Pass these variables into all phase prompts alongside `{PLATFORM}`.
 
 ---

package/skills/manifest.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-03-22T07:57:16.501Z",
+  "generated": "2026-03-24T07:52:19.071Z",
   "count": 10,
   "skills": [
     {
@@ -36,7 +36,7 @@
       "name": "dock",
       "directory": "dock",
       "description": ">- Generate container-based release pipelines that build once and promote immutable artifacts through environments (dev → staging → prod). Detects your stack, interviews for infrastructure choices, then outputs deterministic CI/CD files (Dockerfile, workflows, deployment manifests) that run without an LLM. Use when setting up deployment pipelines, containerizing an app, creating release workflows, or connecting CI to container-friendly infrastructure (Azure Container Apps, AWS Fargate, Google Cloud Run, Kubernetes, Dokku, Coolify, CapRover, etc.).",
-      "lines": 431,
+      "lines": 432,
       "hasScripts": false,
       "hasReferences": true,
       "hasAssets": false,
@@ -46,7 +46,7 @@
       "name": "keel",
       "directory": "keel",
       "description": ">- Generate Infrastructure as Code (IaC) pipelines that provision the cloud and container infrastructure your app deploys to. Interview-driven: detects your stack and cloud provider, then outputs deterministic IaC files (Terraform, Bicep, Pulumi, or CDK) plus CI/CD pipelines that plan on PR and apply on merge. Use when setting up cloud infrastructure, provisioning container registries, databases, networking, DNS, or any infrastructure that containers deploy onto. Designed to run before /dock — /keel lays the infrastructure, /dock deploys to it.",
-      "lines": 419,
+      "lines": 420,
       "hasScripts": false,
       "hasReferences": true,
       "hasAssets": false,

package/skills/rig/SKILL.md

@@ -166,13 +166,13 @@ elif echo "$REMOTE_URL" | grep -q 'vs-ssh\.visualstudio\.com'; then
 elif echo "$REMOTE_URL" | grep -q 'visualstudio\.com'; then
   AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*//\([^.]*\)\.visualstudio\.com.*|\1|p')
   AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*/\([^/]*\)/_git/.*|\1|p')
-  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
+  AZDO_ORG_URL="https://${AZDO_ORG}.visualstudio.com"
 fi
 
 # URL-decode for CLI/display; keep URL-safe versions for REST API paths
 AZDO_PROJECT_URL_SAFE="$AZDO_PROJECT"
-AZDO_ORG=$(printf '%b' "${AZDO_ORG//%/\\x}")
-AZDO_PROJECT=$(printf '%b' "${AZDO_PROJECT//%/\\x}")
+AZDO_ORG=$(python3 -c "import urllib.parse; print(urllib.parse.unquote('$AZDO_ORG'))")
+AZDO_PROJECT=$(python3 -c "import urllib.parse; print(urllib.parse.unquote('$AZDO_PROJECT_URL_SAFE'))")
 
 if [ -z "$AZDO_ORG" ] || [ -z "$AZDO_PROJECT" ]; then
   echo "❌ Could not extract organization/project from remote URL"
@@ -193,7 +193,7 @@ az devops configure --defaults organization="$AZDO_ORG_URL" project="$AZDO_PROJE
 
 When `AZDO_MODE == rest`, store these for API calls:
 - Base URL: `$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis`
-- Auth header: `Authorization: Basic $(echo -n ":$PAT" | base64)`
+- Auth header: `Authorization: Basic $(printf ":%s" "$PAT" | base64 | tr -d '\n')`
 
 Report in pre-flight:
 - ✅ `azdo context` — org: `{AZDO_ORG}`, project: `{AZDO_PROJECT}`

package/skills/ship/SKILL.md

@@ -183,13 +183,13 @@ elif echo "$REMOTE_URL" | grep -q 'visualstudio\.com'; then
   # Legacy HTTPS format: https://{ORG}.visualstudio.com/{PROJECT}/_git/{REPO}
   AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*//\([^.]*\)\.visualstudio\.com.*|\1|p')
   AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*/\([^/]*\)/_git/.*|\1|p')
-  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
+  AZDO_ORG_URL="https://${AZDO_ORG}.visualstudio.com"
 fi
 
 # URL-decode for CLI/display; keep URL-safe versions for REST API paths
 AZDO_PROJECT_URL_SAFE="$AZDO_PROJECT"
-AZDO_ORG=$(printf '%b' "${AZDO_ORG//%/\\x}")
-AZDO_PROJECT=$(printf '%b' "${AZDO_PROJECT//%/\\x}")
+AZDO_ORG=$(python3 -c "import urllib.parse; print(urllib.parse.unquote('$AZDO_ORG'))")
+AZDO_PROJECT=$(python3 -c "import urllib.parse; print(urllib.parse.unquote('$AZDO_PROJECT_URL_SAFE'))")
 
 if [ -z "$AZDO_ORG" ] || [ -z "$AZDO_PROJECT" ]; then
   echo "❌ Could not extract organization/project from remote URL"
@@ -210,7 +210,7 @@ az devops configure --defaults organization="$AZDO_ORG_URL" project="$AZDO_PROJE
 
 When `AZDO_MODE == rest`, store these for API calls:
 - Base URL: `$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis`
-- Auth header: `Authorization: Basic $(echo -n ":$PAT" | base64)`
+- Auth header: `Authorization: Basic $(printf ":%s" "$PAT" | base64 | tr -d '\n')`
 
 Report in pre-flight:
 - ✅ `azdo context` — org: `{AZDO_ORG}`, project: `{AZDO_PROJECT}`

package/skills/ship/references/stage-prompts.md

@@ -130,7 +130,7 @@ Bad examples:
 
    **If PLATFORM == azdo AND AZDO_MODE == rest:**
      REPO_NAME=$(basename -s .git "$(git remote get-url origin)")
-     AUTH="Authorization: Basic $(echo -n ":{PAT}" | base64)"
+     AUTH="Authorization: Basic $(printf ":%s" "{PAT}" | base64 | tr -d '\n')"
      PR_JSON=$(curl -s -X POST \
        -H "$AUTH" \
        -H "Content-Type: application/json" \
@@ -231,7 +231,7 @@ FAILING CHECKS: {FAILING_CHECKS}
      rm -rf "$LOGDIR"
 
    **If PLATFORM == azdo AND AZDO_MODE == rest:**
-     AUTH="Authorization: Basic $(echo -n ":{PAT}" | base64)"
+     AUTH="Authorization: Basic $(printf ":%s" "{PAT}" | base64 | tr -d '\n')"
      # Get failed build ID
      RUN_ID=$(curl -s -H "$AUTH" \
        "{AZDO_ORG_URL}/{AZDO_PROJECT_URL_SAFE}/_apis/build/builds?branchName=refs/heads/{BRANCH}&resultFilter=failed&\$top=1&api-version=7.0" \

package/skills/ship/scripts/ci-watch.sh

@@ -88,21 +88,31 @@ if [ "$AZDO_MODE" = "rest" ]; then
     CHECKS="error:no PAT configured"
     emit_report; exit 3
   fi
-  AUTH="Authorization: Basic $(echo -n ":$PAT" | base64)"
+  AUTH="Authorization: Basic $(printf ":%s" "$PAT" | base64 | tr -d '\n')"
 fi
 
 # ── AzDO CLI mode ──────────────────────────────────────
 if [ "$AZDO_MODE" = "cli" ]; then
   # Grace period: wait for CI to start (max 2 min)
+  # Try PR merge ref first, then fall back to branch name
   RUNS_FOUND=false
+  CI_BRANCH=""
   GRACE_POLLS=0
   for _ in $(seq 1 8); do
     GRACE_POLLS=$((GRACE_POLLS + 1))
+    # Try PR merge ref first (AzDO sets sourceBranch to refs/pull/<N>/merge)
+    RUN_COUNT=$(az pipelines runs list --branch "refs/pull/$PR_NUMBER/merge" --top 5 \
+      --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+      --query "length(@)" -o tsv 2>/dev/null)
+    if [ -n "$RUN_COUNT" ] && [ "$RUN_COUNT" != "0" ]; then
+      RUNS_FOUND=true; CI_BRANCH="refs/pull/$PR_NUMBER/merge"; break
+    fi
+    # Fallback: try branch name directly
     RUN_COUNT=$(az pipelines runs list --branch "$BRANCH" --top 5 \
       --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
       --query "length(@)" -o tsv 2>/dev/null)
     if [ -n "$RUN_COUNT" ] && [ "$RUN_COUNT" != "0" ]; then
-      RUNS_FOUND=true; break
+      RUNS_FOUND=true; CI_BRANCH="$BRANCH"; break
     fi
     sleep 15
   done
@@ -120,14 +130,14 @@ if [ "$AZDO_MODE" = "cli" ]; then
 
   # Wait for runs to complete with fail-fast (max 30 min)
   for _ in $(seq 1 120); do
-    FAILED=$(az pipelines runs list --branch "$BRANCH" --top 5 \
+    FAILED=$(az pipelines runs list --branch "$CI_BRANCH" --top 5 \
       --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
       --query "[?result=='failed'] | length(@)" -o tsv 2>/dev/null)
     if [ -n "$FAILED" ] && [ "$FAILED" != "0" ]; then
       break
     fi
 
-    IN_PROGRESS=$(az pipelines runs list --branch "$BRANCH" --top 5 \
+    IN_PROGRESS=$(az pipelines runs list --branch "$CI_BRANCH" --top 5 \
       --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
       --query "[?status=='inProgress'] | length(@)" -o tsv 2>/dev/null)
     if [ "$IN_PROGRESS" = "0" ] || [ -z "$IN_PROGRESS" ]; then break; fi
@@ -135,7 +145,7 @@ if [ "$AZDO_MODE" = "cli" ]; then
   done
 
   # Determine final status
-  RUNS_TABLE=$(az pipelines runs list --branch "$BRANCH" --top 5 \
+  RUNS_TABLE=$(az pipelines runs list --branch "$CI_BRANCH" --top 5 \
     --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
     --query "[].{name:definition.name, result:result}" -o json 2>/dev/null || echo "[]")
   CHECKS=$(echo "$RUNS_TABLE" | jq -r '.[] | "\(.name):\(.result // "pending")"' | paste -sd, -)
@@ -163,33 +173,64 @@ fi
 
 # ── AzDO REST mode ─────────────────────────────────────
 if [ "$AZDO_MODE" = "rest" ]; then
-  BUILDS_URL="$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/build/builds?branchName=refs/heads/$BRANCH&\$top=5&api-version=7.0"
+  BUILDS_BASE="$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/build/builds"
 
   # Grace period: wait for CI to start (max 2 min)
+  # Try PR merge ref first, then fall back to branch name
   RUNS_FOUND=false
+  BUILDS_URL=""
   GRACE_POLLS=0
   for _ in $(seq 1 8); do
     GRACE_POLLS=$((GRACE_POLLS + 1))
-    RUN_COUNT=$(curl -s -H "$AUTH" "$BUILDS_URL" | jq '.value | length')
+    # Try PR merge ref first (AzDO sets sourceBranch to refs/pull/<N>/merge)
+    PR_BUILDS_URL="${BUILDS_BASE}?branchName=refs/pull/$PR_NUMBER/merge&\$top=5&api-version=7.0"
+    RESPONSE=$(curl -s -H "$AUTH" "$PR_BUILDS_URL" 2>&1)
+    if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
+      STATUS="no_checks"; FAILING="none"; CHECKS="error:non-JSON API response"
+      emit_report; exit 3
+    fi
+    RUN_COUNT=$(echo "$RESPONSE" | jq '.value | length')
+    if [ -n "$RUN_COUNT" ] && [ "$RUN_COUNT" != "0" ]; then
+      RUNS_FOUND=true; BUILDS_URL="$PR_BUILDS_URL"; break
+    fi
+    # Fallback: try branch name directly
+    BRANCH_BUILDS_URL="${BUILDS_BASE}?branchName=refs/heads/$BRANCH&\$top=5&api-version=7.0"
+    RESPONSE=$(curl -s -H "$AUTH" "$BRANCH_BUILDS_URL" 2>&1)
+    if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
+      STATUS="no_checks"; FAILING="none"; CHECKS="error:non-JSON API response"
+      emit_report; exit 3
+    fi
+    RUN_COUNT=$(echo "$RESPONSE" | jq '.value | length')
     if [ -n "$RUN_COUNT" ] && [ "$RUN_COUNT" != "0" ]; then
-      RUNS_FOUND=true; break
+      RUNS_FOUND=true; BUILDS_URL="$BRANCH_BUILDS_URL"; break
     fi
     sleep 15
   done
 
   if [ "$RUNS_FOUND" = false ]; then
-    EVALS=$(curl -s -H "$AUTH" \
-      "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/$AZDO_PROJECT_URL_SAFE/$PR_NUMBER&api-version=7.0")
-    EVAL_COUNT=$(echo "$EVALS" | jq '.value | length')
+    RESPONSE=$(curl -s -H "$AUTH" \
+      "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/$AZDO_PROJECT_URL_SAFE/$PR_NUMBER&api-version=7.0" 2>&1)
+    if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
+      STATUS="no_checks"; FAILING="none"; CHECKS="error:non-JSON API response"
+      emit_report; exit 3
+    fi
+    EVAL_COUNT=$(echo "$RESPONSE" | jq '.value | length')
     if [ "$EVAL_COUNT" = "0" ] || [ -z "$EVAL_COUNT" ]; then
       STATUS="no_checks"; CHECKS=""; FAILING="none"
       emit_report; exit 0
     fi
+    # Default BUILDS_URL for subsequent polling if policies exist but no runs yet
+    BUILDS_URL="${BUILDS_BASE}?branchName=refs/pull/$PR_NUMBER/merge&\$top=5&api-version=7.0"
   fi
 
   # Wait for runs with fail-fast (max 30 min)
   for _ in $(seq 1 120); do
-    BUILDS_JSON=$(curl -s -H "$AUTH" "$BUILDS_URL")
+    RESPONSE=$(curl -s -H "$AUTH" "$BUILDS_URL" 2>&1)
+    if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
+      STATUS="no_checks"; FAILING="none"; CHECKS="error:non-JSON API response"
+      emit_report; exit 3
+    fi
+    BUILDS_JSON="$RESPONSE"
 
     FAIL_COUNT=$(echo "$BUILDS_JSON" | jq '[.value[] | select(.result=="failed")] | length')
     if [ "${FAIL_COUNT:-0}" -gt 0 ]; then break; fi
@@ -200,16 +241,25 @@ if [ "$AZDO_MODE" = "rest" ]; then
   done
 
   # Final status
-  BUILDS_JSON=$(curl -s -H "$AUTH" "$BUILDS_URL")
+  RESPONSE=$(curl -s -H "$AUTH" "$BUILDS_URL" 2>&1)
+  if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
+    STATUS="no_checks"; FAILING="none"; CHECKS="error:non-JSON API response"
+    emit_report; exit 3
+  fi
+  BUILDS_JSON="$RESPONSE"
   CHECKS=$(echo "$BUILDS_JSON" | jq -r '.value[] | "\(.definition.name):\(.result // "pending")"' | paste -sd, -)
   FAILING=$(echo "$BUILDS_JSON" | jq -r '.value[] | select(.result=="failed") | .definition.name' | paste -sd, -)
   FAIL_COUNT=$(echo "$BUILDS_JSON" | jq '[.value[] | select(.result=="failed")] | length')
   STILL_RUNNING=$(echo "$BUILDS_JSON" | jq '[.value[] | select(.status=="inProgress")] | length')
 
   # Check policy evaluations
-  EVALS=$(curl -s -H "$AUTH" \
-    "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/$AZDO_PROJECT_URL_SAFE/$PR_NUMBER&api-version=7.0")
-  REJECTED=$(echo "$EVALS" | jq '[.value[] | select(.status=="rejected")] | length')
+  RESPONSE=$(curl -s -H "$AUTH" \
+    "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/$AZDO_PROJECT_URL_SAFE/$PR_NUMBER&api-version=7.0" 2>&1)
+  if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
+    REJECTED="0"
+  else
+    REJECTED=$(echo "$RESPONSE" | jq '[.value[] | select(.status=="rejected")] | length')
+  fi
 
   if [ "${FAIL_COUNT:-0}" -gt 0 ] || [ "${REJECTED:-0}" -gt 0 ]; then
     STATUS="some_failed"

package/skills/ship/scripts/merge.sh

@@ -96,7 +96,7 @@ if [ "$AZDO_MODE" = "cli" ]; then
 
   # Complete the PR
   if az repos pr update --id "$PR_NUMBER" --status completed \
-    --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+    --org "$AZDO_ORG_URL" \
     --squash "$SQUASH_FLAG" \
     --delete-source-branch "$DELETE_FLAG" 2>/dev/null; then
     STATUS="success"
@@ -106,7 +106,7 @@ if [ "$AZDO_MODE" = "cli" ]; then
     # Retry once after 30s (policies may still be evaluating)
     sleep 30
     if az repos pr update --id "$PR_NUMBER" --status completed \
-      --org "$AZDO_ORG_URL" --project "$AZDO_PROJECT" \
+      --org "$AZDO_ORG_URL" \
       --squash "$SQUASH_FLAG" \
       --delete-source-branch "$DELETE_FLAG" 2>/dev/null; then
       STATUS="success"
@@ -125,7 +125,7 @@ fi
 
 # ── AzDO REST mode ─────────────────────────────────────
 if [ "$AZDO_MODE" = "rest" ]; then
-  AUTH="Authorization: Basic $(echo -n ":$PAT" | base64)"
+  AUTH="Authorization: Basic $(printf ":%s" "$PAT" | base64 | tr -d '\n')"
   REPO_NAME=$(basename -s .git "$(git remote get-url origin)")
   PR_API="$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/git/repositories/$REPO_NAME/pullrequests/$PR_NUMBER"
 
@@ -133,7 +133,10 @@ if [ "$AZDO_MODE" = "rest" ]; then
   POLICY_TIMEOUT=20
   for POLICY_ITER in $(seq 1 $POLICY_TIMEOUT); do
     EVALS=$(curl -s -H "$AUTH" \
-      "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/$AZDO_PROJECT_URL_SAFE/$PR_NUMBER&api-version=7.0" 2>/dev/null || echo '{"value":[]}')
+      "$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis/policy/evaluations?artifactId=vstfs:///CodeReview/CodeReviewId/$AZDO_PROJECT_URL_SAFE/$PR_NUMBER&api-version=7.0" 2>&1)
+    if ! echo "$EVALS" | jq empty 2>/dev/null; then
+      EVALS='{"value":[]}'
+    fi
 
     REJECTED=$(echo "$EVALS" | jq '[.value[] | select(.status=="rejected")] | length')
     PENDING=$(echo "$EVALS" | jq '[.value[] | select(.status=="running" or .status=="queued" or .status=="pending")] | length')
@@ -165,7 +168,13 @@ if [ "$AZDO_MODE" = "rest" ]; then
   # Complete the PR
   RESPONSE=$(curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
     "$PR_API?api-version=7.0" \
-    -d "{\"status\": \"completed\", \"completionOptions\": {\"mergeStrategy\": \"$MERGE_STRATEGY\", \"deleteSourceBranch\": $DELETE_FLAG}}")
+    -d "{\"status\": \"completed\", \"completionOptions\": {\"mergeStrategy\": \"$MERGE_STRATEGY\", \"deleteSourceBranch\": $DELETE_FLAG}}" 2>&1)
+  if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
+    STATUS="failed"
+    ERRORS="REST merge returned non-JSON response"
+    MERGE_COMMIT=""; BRANCH_DELETED=false
+    emit_report; exit 1
+  fi
 
   PR_STATUS=$(echo "$RESPONSE" | jq -r '.status // empty')
   if [ "$PR_STATUS" = "completed" ]; then

package/skills/dock/references/azdo-platform.md

@@ -1,88 +0,0 @@
-# Azure DevOps Platform Support
-
-Shared procedures for AzDO tooling detection and configuration validation.
-Referenced by SKILL.md during pre-flight when `PLATFORM == azdo`.
-
-## AzDO Tooling Detection
-
-When `PLATFORM == azdo`, determine which tooling is available. Set `AZDO_MODE`
-for use in all subsequent phases:
-
-```bash
-if az devops -h &>/dev/null; then
-  AZDO_MODE="cli"
-else
-  AZDO_MODE="rest"
-fi
-```
-
-- **`cli`**: Use `az repos` / `az pipelines` commands (preferred)
-- **`rest`**: Use Azure DevOps REST API via `curl`. Requires a PAT (personal
-  access token) in `AZURE_DEVOPS_EXT_PAT` or `AZDO_PAT` env var. If no PAT
-  is found, prompt the user to either install the CLI or set the env var.
-
-Report in pre-flight:
-- ✅ `az devops cli` — version found
-- ⚠️ `az devops cli` — not found → using REST API fallback
-- ❌ `az devops cli` — not found, no PAT configured → halt with setup instructions
-
-## AzDO Configuration Validation
-
-When `PLATFORM == azdo`, extract organization and project from the remote URL
-and validate they are usable. These values are needed by every `az repos` /
-`az pipelines` command and every REST API call.
-
-```bash
-# Extract org and project from remote URL patterns:
-#   https://dev.azure.com/{ORG}/{PROJECT}/_git/{REPO}
-#   https://{ORG}@dev.azure.com/{ORG}/{PROJECT}/_git/{REPO}
-#   {ORG}@vs-ssh.visualstudio.com:v3/{ORG}/{PROJECT}/{REPO}
-
-REMOTE_URL=$(git remote get-url origin 2>/dev/null)
-
-if echo "$REMOTE_URL" | grep -q 'dev\.azure\.com'; then
-  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*dev\.azure\.com/\([^/]*\)/.*|\1|p')
-  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*dev\.azure\.com/[^/]*/\([^/]*\)/.*|\1|p')
-  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
-elif echo "$REMOTE_URL" | grep -q 'vs-ssh\.visualstudio\.com'; then
-  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*vs-ssh\.visualstudio\.com:v3/\([^/]*\)/.*|\1|p')
-  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*vs-ssh\.visualstudio\.com:v3/[^/]*/\([^/]*\)/.*|\1|p')
-  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
-elif echo "$REMOTE_URL" | grep -q 'visualstudio\.com'; then
-  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*//\([^.]*\)\.visualstudio\.com.*|\1|p')
-  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*/\([^/]*\)/_git/.*|\1|p')
-  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
-fi
-
-# URL-decode for CLI/display; keep URL-safe versions for REST API paths
-AZDO_PROJECT_URL_SAFE="$AZDO_PROJECT"
-AZDO_ORG=$(printf '%b' "${AZDO_ORG//%/\\x}")
-AZDO_PROJECT=$(printf '%b' "${AZDO_PROJECT//%/\\x}")
-
-if [ -z "$AZDO_ORG" ] || [ -z "$AZDO_PROJECT" ]; then
-  echo "❌ Could not extract organization/project from remote URL"
-  echo "   Remote: $REMOTE_URL"
-  echo ""
-  echo "Ensure the remote URL follows one of these formats:"
-  echo "  https://dev.azure.com/{ORG}/{PROJECT}/_git/{REPO}"
-  echo "  https://{ORG}.visualstudio.com/{PROJECT}/_git/{REPO}"
-  echo "  {ORG}@vs-ssh.visualstudio.com:v3/{ORG}/{PROJECT}/{REPO}"
-  # HALT — cannot proceed without org/project context
-fi
-```
-
-When `AZDO_MODE == cli`, also configure the defaults so commands work correctly:
-```bash
-az devops configure --defaults organization="$AZDO_ORG_URL" project="$AZDO_PROJECT"
-```
-
-When `AZDO_MODE == rest`, store these for API calls:
-- Base URL: `$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis`
-- Auth header: `Authorization: Basic $(echo -n ":$PAT" | base64)`
-
-Report in pre-flight:
-- ✅ `azdo context` — org: `{AZDO_ORG}`, project: `{AZDO_PROJECT}`
-- ❌ `azdo context` — could not parse from remote URL → halt with instructions
-
-Pass `{AZDO_MODE}`, `{AZDO_ORG}`, `{AZDO_PROJECT}`, `{AZDO_ORG_URL}` into
-all phase prompts alongside `{PLATFORM}`.

package/skills/keel/references/azdo-platform.md

@@ -1,88 +0,0 @@
-# Azure DevOps Platform Support
-
-Shared procedures for AzDO tooling detection and configuration validation.
-Referenced by SKILL.md during pre-flight when `PLATFORM == azdo`.
-
-## AzDO Tooling Detection
-
-When `PLATFORM == azdo`, determine which tooling is available. Set `AZDO_MODE`
-for use in all subsequent phases:
-
-```bash
-if az devops -h &>/dev/null; then
-  AZDO_MODE="cli"
-else
-  AZDO_MODE="rest"
-fi
-```
-
-- **`cli`**: Use `az repos` / `az pipelines` commands (preferred)
-- **`rest`**: Use Azure DevOps REST API via `curl`. Requires a PAT (personal
-  access token) in `AZURE_DEVOPS_EXT_PAT` or `AZDO_PAT` env var. If no PAT
-  is found, prompt the user to either install the CLI or set the env var.
-
-Report in pre-flight:
-- ✅ `az devops cli` — version found
-- ⚠️ `az devops cli` — not found → using REST API fallback
-- ❌ `az devops cli` — not found, no PAT configured → halt with setup instructions
-
-## AzDO Configuration Validation
-
-When `PLATFORM == azdo`, extract organization and project from the remote URL
-and validate they are usable. These values are needed by every `az repos` /
-`az pipelines` command and every REST API call.
-
-```bash
-# Extract org and project from remote URL patterns:
-#   https://dev.azure.com/{ORG}/{PROJECT}/_git/{REPO}
-#   https://{ORG}@dev.azure.com/{ORG}/{PROJECT}/_git/{REPO}
-#   {ORG}@vs-ssh.visualstudio.com:v3/{ORG}/{PROJECT}/{REPO}
-
-REMOTE_URL=$(git remote get-url origin 2>/dev/null)
-
-if echo "$REMOTE_URL" | grep -q 'dev\.azure\.com'; then
-  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*dev\.azure\.com/\([^/]*\)/.*|\1|p')
-  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*dev\.azure\.com/[^/]*/\([^/]*\)/.*|\1|p')
-  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
-elif echo "$REMOTE_URL" | grep -q 'vs-ssh\.visualstudio\.com'; then
-  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*vs-ssh\.visualstudio\.com:v3/\([^/]*\)/.*|\1|p')
-  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*vs-ssh\.visualstudio\.com:v3/[^/]*/\([^/]*\)/.*|\1|p')
-  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
-elif echo "$REMOTE_URL" | grep -q 'visualstudio\.com'; then
-  AZDO_ORG=$(echo "$REMOTE_URL" | sed -n 's|.*//\([^.]*\)\.visualstudio\.com.*|\1|p')
-  AZDO_PROJECT=$(echo "$REMOTE_URL" | sed -n 's|.*/\([^/]*\)/_git/.*|\1|p')
-  AZDO_ORG_URL="https://dev.azure.com/$AZDO_ORG"
-fi
-
-# URL-decode for CLI/display; keep URL-safe versions for REST API paths
-AZDO_PROJECT_URL_SAFE="$AZDO_PROJECT"
-AZDO_ORG=$(printf '%b' "${AZDO_ORG//%/\\x}")
-AZDO_PROJECT=$(printf '%b' "${AZDO_PROJECT//%/\\x}")
-
-if [ -z "$AZDO_ORG" ] || [ -z "$AZDO_PROJECT" ]; then
-  echo "❌ Could not extract organization/project from remote URL"
-  echo "   Remote: $REMOTE_URL"
-  echo ""
-  echo "Ensure the remote URL follows one of these formats:"
-  echo "  https://dev.azure.com/{ORG}/{PROJECT}/_git/{REPO}"
-  echo "  https://{ORG}.visualstudio.com/{PROJECT}/_git/{REPO}"
-  echo "  {ORG}@vs-ssh.visualstudio.com:v3/{ORG}/{PROJECT}/{REPO}"
-  # HALT — cannot proceed without org/project context
-fi
-```
-
-When `AZDO_MODE == cli`, also configure the defaults so commands work correctly:
-```bash
-az devops configure --defaults organization="$AZDO_ORG_URL" project="$AZDO_PROJECT"
-```
-
-When `AZDO_MODE == rest`, store these for API calls:
-- Base URL: `$AZDO_ORG_URL/$AZDO_PROJECT_URL_SAFE/_apis`
-- Auth header: `Authorization: Basic $(echo -n ":$PAT" | base64)`
-
-Report in pre-flight:
-- ✅ `azdo context` — org: `{AZDO_ORG}`, project: `{AZDO_PROJECT}`
-- ❌ `azdo context` — could not parse from remote URL → halt with instructions
-
-Pass `{AZDO_MODE}`, `{AZDO_ORG}`, `{AZDO_PROJECT}`, `{AZDO_ORG_URL}` into
-all phase prompts alongside `{PLATFORM}`.