@soleur/opencode 0.0.0-stage → 3.354.2

package/skills/ux-audit/scripts/bot-fixture.ts

@@ -0,0 +1,270 @@
+#!/usr/bin/env bun
+/**
+ * bot-fixture.ts — seed/reset the ux-audit bot's DB state.
+ *
+ * Scope: DB-only v1. KB file seeding deferred to #2351 (files live in GitHub
+ * workspace, not Supabase Storage).
+ *
+ * Usage: bun "${CLAUDE_PLUGIN_ROOT}/skills/ux-audit/scripts/bot-fixture.ts" <seed|reset>
+ *
+ * Env (from Doppler prd + prd_scheduled):
+ *   SUPABASE_URL                    prd
+ *   SUPABASE_SERVICE_ROLE_KEY       prd
+ *   UX_AUDIT_BOT_EMAIL              prd_scheduled
+ *
+ * CI-caller contract: any GitHub Actions job that invokes `seed` or
+ * `reset` MUST set job-level
+ *   concurrency:
+ *     group: bot-fixture-shared-state
+ *     cancel-in-progress: false
+ * so parallel workflows never race on the shared bot user. The existing
+ * consumer is .github/workflows/scheduled-ux-audit.yml — mirror that
+ * stanza in any new caller.
+ */
+
+const TC_VERSION = "1.0.0";
+
+// Error-body truncation bound for Supabase REST error surfaces. 200 chars
+// captures the PostgREST `{code, message}` envelope without dumping long
+// `details` enumerations into CI logs. Referenced by symbol at every
+// `res.text()` callsite below.
+const ERROR_BODY_MAX = 200;
+
+// Defense-in-depth allowlist. Matches the test-side guard in
+// `bot-fixture.test.ts` and rule `cq-destructive-prod-tests-allowlist`.
+// seed()/reset() DELETE+PATCH live prod rows; a misconfigured
+// UX_AUDIT_BOT_EMAIL would otherwise cascade onto a real user. Add new
+// synthetic emails here explicitly.
+const ALLOWED_BOT_EMAILS = new Set(["ux-audit-bot@jikigai.com"]);
+
+const FIXTURE_CONVERSATIONS = [
+  {
+    session_id: "ux-audit-fixture-conv-1",
+    domain_leader: "cmo",
+    messages: [
+      { role: "user" as const, content: "What's the highest-leverage thing I can do this week to grow?" },
+      { role: "assistant" as const, content: "Given your current stage, I'd focus on outbound to the 12 closest-fit prospects from last month's signups. Want me to draft the sequence?" },
+      { role: "user" as const, content: "Yes, draft it." },
+    ],
+  },
+  {
+    session_id: "ux-audit-fixture-conv-2",
+    domain_leader: "cto",
+    messages: [
+      { role: "user" as const, content: "Is our CI pipeline a bottleneck?" },
+      { role: "assistant" as const, content: "Looking at the last 50 runs, median is 6m 40s. The Eleventy build step is the longest single job. Want me to profile it?" },
+      { role: "user" as const, content: "Please do, and share the top 3 wins." },
+      { role: "assistant" as const, content: "Top wins: (1) cache node_modules between jobs, (2) parallelize lint + typecheck, (3) skip docs build on non-docs PRs." },
+    ],
+  },
+] as const;
+
+function env(key: string): string {
+  const v = process.env[key];
+  if (!v) throw new Error(`Missing env: ${key}`);
+  return v;
+}
+
+export async function sbFetch(
+  path: string,
+  init: RequestInit = {},
+): Promise<Response> {
+  const SUPABASE_URL = env("SUPABASE_URL");
+  const SERVICE_KEY = env("SUPABASE_SERVICE_ROLE_KEY");
+  return fetch(`${SUPABASE_URL}${path}`, {
+    ...init,
+    headers: {
+      apikey: SERVICE_KEY,
+      Authorization: `Bearer ${SERVICE_KEY}`,
+      "Content-Type": "application/json",
+      ...init.headers,
+    },
+  });
+}
+
+export async function sbDelete(path: string): Promise<void> {
+  const res = await sbFetch(path, { method: "DELETE" });
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`DELETE ${path} failed: ${res.status} ${body}`);
+  }
+}
+
+async function getBotUserId(): Promise<string> {
+  const email = env("UX_AUDIT_BOT_EMAIL");
+  if (!ALLOWED_BOT_EMAILS.has(email)) {
+    throw new Error(
+      `UX_AUDIT_BOT_EMAIL=${email} is not in the synthetic allowlist. ` +
+        `seed/reset would mutate a real user's data. Refusing to proceed. ` +
+        `See ALLOWED_BOT_EMAILS + rule cq-destructive-prod-tests-allowlist.`,
+    );
+  }
+  const res = await sbFetch(`/auth/v1/admin/users?per_page=1000`);
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`admin users GET failed: ${res.status} ${body}`);
+  }
+  const data = (await res.json()) as {
+    users: Array<{ id: string; email: string }>;
+  };
+  const bot = data.users.find((u) => u.email === email);
+  if (!bot) throw new Error(`bot user ${email} not found — run 1.1 first`);
+  return bot.id;
+}
+
+async function updateUserRow(
+  userId: string,
+  patch: Record<string, unknown>,
+): Promise<void> {
+  const res = await sbFetch(`/rest/v1/users?id=eq.${userId}`, {
+    method: "PATCH",
+    body: JSON.stringify(patch),
+  });
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`PATCH users failed: ${res.status} ${body}`);
+  }
+}
+
+async function upsertConversation(
+  userId: string,
+  sessionId: string,
+  domainLeader: string,
+): Promise<string> {
+  // Body intentionally omits `created_at`: PostgREST's
+  // resolution=merge-duplicates compiles to `ON CONFLICT ... DO UPDATE
+  // SET col = EXCLUDED.col` for every column in the body. Leaving
+  // `created_at` out preserves the original insert timestamp on re-seed.
+  // The non-partial unique index `uniq_conversations_user_id_session_id_total`
+  // (migration 035) is the arbiter — PostgREST cannot infer a partial unique
+  // index because it does not emit the index's WHERE predicate. With NULLS
+  // DISTINCT (Postgres default) multiple (user_id, NULL) rows coexist, so an
+  // empty sessionId would defeat merge-duplicates and silently insert a new
+  // row on every re-seed.
+  if (!sessionId) {
+    throw new Error(
+      `upsertConversation requires a non-empty sessionId (NULLs would bypass merge-duplicates and insert duplicate rows)`,
+    );
+  }
+  const res = await sbFetch(
+    `/rest/v1/conversations?on_conflict=user_id,session_id`,
+    {
+      method: "POST",
+      headers: {
+        Prefer: "return=representation,resolution=merge-duplicates",
+      },
+      body: JSON.stringify({
+        user_id: userId,
+        session_id: sessionId,
+        domain_leader: domainLeader,
+        status: "completed",
+      }),
+    },
+  );
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`POST conversations (upsert) failed: ${res.status} ${body}`);
+  }
+  const rows = (await res.json()) as Array<{ id: string }>;
+  if (!rows[0]) {
+    throw new Error(`POST conversations returned empty array — representation missing`);
+  }
+  return rows[0].id;
+}
+
+async function insertMessages(
+  conversationId: string,
+  messages: ReadonlyArray<{ role: "user" | "assistant"; content: string }>,
+): Promise<void> {
+  const res = await sbFetch(`/rest/v1/messages`, {
+    method: "POST",
+    body: JSON.stringify(
+      messages.map((m) => ({
+        conversation_id: conversationId,
+        role: m.role,
+        content: m.content,
+      })),
+    ),
+  });
+  if (!res.ok) {
+    const body = (await res.text()).slice(0, ERROR_BODY_MAX);
+    throw new Error(`POST messages failed: ${res.status} ${body}`);
+  }
+}
+
+export async function seed(): Promise<void> {
+  const botId = await getBotUserId();
+  console.log(`[seed] bot user id: ${botId}`);
+
+  await updateUserRow(botId, {
+    tc_accepted_version: TC_VERSION,
+    tc_accepted_at: new Date().toISOString(),
+    onboarding_completed_at: new Date().toISOString(),
+    subscription_status: "active",
+    stripe_customer_id: "cus_ux_audit_fixture",
+    stripe_subscription_id: "sub_ux_audit_fixture",
+    current_period_end: new Date(Date.now() + 365 * 24 * 3600 * 1000).toISOString(),
+    cancel_at_period_end: false,
+  });
+  console.log("[seed] users row patched (tc + subscription + onboarding)");
+
+  for (const c of FIXTURE_CONVERSATIONS) {
+    const cid = await upsertConversation(botId, c.session_id, c.domain_leader);
+    // DELETE-then-INSERT keeps message count stable across re-seeds. Without
+    // this, upsert's merge-duplicates would re-insert and double the count
+    // (the messages table has no natural unique key we want to index).
+    // NOT atomic — two separate PostgREST calls. If the process dies between
+    // the DELETE and the INSERT, the conversation is left with zero messages.
+    // That is self-healing: the next `seed` run restores the full set.
+    // Acceptable for a fixture; do NOT wrap the pair in a misguided retry.
+    await sbDelete(`/rest/v1/messages?conversation_id=eq.${cid}`);
+    await insertMessages(cid, c.messages);
+    console.log(`[seed] conversation ${c.session_id} upserted (${cid}) with ${c.messages.length} messages`);
+  }
+
+  console.log("[seed] done");
+}
+
+export async function reset(): Promise<void> {
+  const botId = await getBotUserId();
+  console.log(`[reset] bot user id: ${botId}`);
+
+  const convRes = await sbFetch(
+    `/rest/v1/conversations?user_id=eq.${botId}&select=id`,
+  );
+  if (!convRes.ok) throw new Error(`conversations GET ${convRes.status}`);
+  const conversations = (await convRes.json()) as Array<{ id: string }>;
+
+  for (const c of conversations) {
+    await sbDelete(`/rest/v1/messages?conversation_id=eq.${c.id}`);
+  }
+  if (conversations.length > 0) {
+    await sbDelete(`/rest/v1/conversations?user_id=eq.${botId}`);
+  }
+  console.log(`[reset] deleted ${conversations.length} conversations + messages`);
+
+  await updateUserRow(botId, {
+    tc_accepted_version: null,
+    tc_accepted_at: null,
+    onboarding_completed_at: null,
+    subscription_status: "none",
+    stripe_customer_id: null,
+    stripe_subscription_id: null,
+    current_period_end: null,
+    cancel_at_period_end: false,
+  });
+  console.log("[reset] users row cleared");
+  console.log("[reset] done");
+}
+
+if (import.meta.main) {
+  const cmd = process.argv[2];
+  if (cmd === "seed") {
+    await seed();
+  } else if (cmd === "reset") {
+    await reset();
+  } else {
+    console.error("Usage: bun bot-fixture.ts <seed|reset>");
+    process.exit(2);
+  }
+}

package/skills/ux-audit/scripts/bot-signin.ts

@@ -0,0 +1,135 @@
+#!/usr/bin/env bun
+/**
+ * bot-signin.ts — signs in as the ux-audit bot and writes a Playwright-compatible
+ * storageState JSON containing the Supabase SSR auth cookie.
+ *
+ * Usage: bun "${CLAUDE_PLUGIN_ROOT}/skills/ux-audit/scripts/bot-signin.ts"
+ *
+ * Env:
+ *   SUPABASE_URL                    prd
+ *   NEXT_PUBLIC_SUPABASE_ANON_KEY   prd
+ *   NEXT_PUBLIC_APP_URL             prd                (domain for the cookie)
+ *   UX_AUDIT_BOT_EMAIL              prd_scheduled
+ *   UX_AUDIT_BOT_PASSWORD           prd_scheduled
+ *   UX_AUDIT_STORAGE_STATE          (optional)         output path override
+ *
+ * Default output path: $GITHUB_WORKSPACE/tmp/ux-audit/storage-state.json
+ *                      or ./tmp/ux-audit/storage-state.json when run locally.
+ * Pattern source: apps/web-platform/e2e/global-setup.ts
+ */
+
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+function env(key: string): string {
+  const v = process.env[key];
+  if (!v) throw new Error(`Missing env: ${key}`);
+  return v;
+}
+
+export function projectRef(supabaseUrl: string): string {
+  const m = supabaseUrl.match(/^https:\/\/([^.]+)\.supabase\.co/);
+  if (!m) throw new Error(`Cannot derive project ref from SUPABASE_URL=${supabaseUrl}`);
+  return m[1];
+}
+
+export function cookieDomain(siteUrl: string): string {
+  const u = new URL(siteUrl);
+  return u.hostname;
+}
+
+function defaultStoragePath(): string {
+  const workspace = process.env.GITHUB_WORKSPACE ?? process.cwd();
+  return resolve(workspace, "tmp/ux-audit/storage-state.json");
+}
+
+export interface Session {
+  access_token: string;
+  refresh_token: string;
+  expires_in: number;
+  expires_at: number;
+  token_type: string;
+  user: unknown;
+}
+
+function isSession(x: unknown): x is Session {
+  if (typeof x !== "object" || x === null) return false;
+  const s = x as Record<string, unknown>;
+  return (
+    typeof s.access_token === "string" &&
+    typeof s.refresh_token === "string" &&
+    typeof s.expires_at === "number" &&
+    typeof s.token_type === "string"
+  );
+}
+
+export async function signIn(): Promise<Session> {
+  const supabaseUrl = env("SUPABASE_URL");
+  const anonKey = env("NEXT_PUBLIC_SUPABASE_ANON_KEY");
+  const email = env("UX_AUDIT_BOT_EMAIL");
+  const password = env("UX_AUDIT_BOT_PASSWORD");
+
+  const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=password`, {
+    method: "POST",
+    headers: {
+      apikey: anonKey,
+      "Content-Type": "application/json",
+    },
+    body: JSON.stringify({ email, password }),
+  });
+
+  const body = await res.json();
+  if (!res.ok) {
+    const msg = (body as { error_description?: string; msg?: string }).error_description
+      ?? (body as { msg?: string }).msg
+      ?? `http ${res.status}`;
+    throw new Error(`signin failed: invalid credentials (${msg})`);
+  }
+  if (!isSession(body)) {
+    throw new Error(
+      `signin returned malformed session (missing access_token, refresh_token, expires_at, or token_type)`,
+    );
+  }
+  return body;
+}
+
+export function writeStorageState(
+  session: Session,
+  outPath: string,
+  supabaseUrl: string,
+  siteUrl: string,
+): void {
+  const ref = projectRef(supabaseUrl);
+  const domain = cookieDomain(siteUrl);
+  const cookieName = `sb-${ref}-auth-token`;
+
+  const storageState = {
+    cookies: [
+      {
+        name: cookieName,
+        value: JSON.stringify(session),
+        domain,
+        path: "/",
+        expires: session.expires_at,
+        httpOnly: false,
+        secure: true,
+        sameSite: "Lax" as const,
+      },
+    ],
+    origins: [],
+  };
+
+  mkdirSync(dirname(outPath), { recursive: true, mode: 0o700 });
+  writeFileSync(outPath, JSON.stringify(storageState, null, 2), { mode: 0o600 });
+  console.log(`[signin] wrote storageState to ${outPath} (cookie ${cookieName} for ${domain})`);
+}
+
+async function main() {
+  const session = await signIn();
+  const outPath = process.env.UX_AUDIT_STORAGE_STATE ?? defaultStoragePath();
+  writeStorageState(session, outPath, env("SUPABASE_URL"), env("NEXT_PUBLIC_APP_URL"));
+}
+
+if (import.meta.main) {
+  await main();
+}

package/skills/ux-audit/scripts/dedup-hash.ts

@@ -0,0 +1,46 @@
+/**
+ * dedup-hash.ts — canonical finding-hash computation.
+ *
+ * Hash format: sha256(utf8("{route}|{selector}|{category}")).
+ * Embedded in issue bodies as `<!-- ux-audit-hash: <64-hex> -->` so the skill
+ * can dedupe via a single `gh issue list --search "ux-audit-hash: <hash>"` call
+ * (TR3 in the plan).
+ */
+
+import { createHash } from "node:crypto";
+
+/**
+ * Canonical category list. Drift-guarded by `category-drift.test.ts`
+ * (see `plugins/soleur/test/ux-audit/category-drift.test.ts`). Any
+ * edit here requires updating SKILL.md §"Constants", ux-design-lead.md
+ * §"5-category rubric" + `category` field rule, and the
+ * `properties.category.enum` in
+ * `plugins/soleur/skills/ux-audit/references/finding.schema.json`.
+ */
+export const FINDING_CATEGORIES = [
+  "real-estate",
+  "ia",
+  "consistency",
+  "responsive",
+  "comprehension",
+  "anti-slop",
+] as const;
+
+export type FindingCategory = (typeof FINDING_CATEGORIES)[number];
+
+export interface Finding {
+  route: string;
+  selector: string;
+  category: FindingCategory;
+}
+
+export function computeFindingHash(f: Finding): string {
+  if (!FINDING_CATEGORIES.includes(f.category as FindingCategory)) {
+    throw new Error(
+      `invalid category "${f.category}" — expected one of: ${FINDING_CATEGORIES.join(", ")}`,
+    );
+  }
+  const selector = f.selector === "" ? "*" : f.selector;
+  const canonical = `${f.route}|${selector}|${f.category}`;
+  return createHash("sha256").update(canonical, "utf8").digest("hex");
+}

package/skills/verification-scaffold/SKILL.md

@@ -0,0 +1,73 @@
+---
+name: verification-scaffold
+description: "This skill should be used when installing the generic guardrail set (secret-scan, commit-on-main, block-stash, orphan-test) into a user repository's hooks and CI, advisory-first."
+---
+
+<!-- grok-harness-invoke:start -->
+**Grok Build (`plugins/soleur/lib/harness.ts` `invokeSkill()`):** Read this SKILL.md in this process and run it to completion. A one-segment `soleur:<name>` in this document names a SKILL — on Grok Build, Read `plugins/soleur/skills/<name>/SKILL.md` in this process; it is not a nested tool_use. A multi-segment id such as `soleur:<domain>:<name>` names an AGENT: spawn it, never Read it, and on Grok Build spawn_subagent takes the id with its colons replaced by hyphens (`agentIdToGrokSubagentType`). **Claude Code:** Skill tool for a skill (`soleur:<name>`), Task tool with `subagent_type` for an agent. Forbidden is executing a subset, not the Read.
+<!-- grok-harness-invoke:end -->
+
+# verification-scaffold
+
+Installs a fixed, tested set of **generic** repo guardrails into a user repository —
+the repo-generic fraction of Soleur's own hook/lint corpus, classified in
+[guardrail-audit.md](references/guardrail-audit.md) (which corpus member is `generic`,
+`generic-after-extraction`, or `soleur-coupled`, and why). This is the
+`constraint-scaffold` sibling for the guardrail *corpus* rather than a single gate
+(#10404, epic #10397).
+
+## Usage
+
+```bash
+bash "${CLAUDE_PLUGIN_ROOT}/skills/verification-scaffold/scripts/verification-scaffold.sh" --headless
+```
+
+Installs the v1 set into the current repo. Flags: `--target <path>` (default
+cwd), `--guards a,b` / `--all` (default: all v1 rows of [guards.tsv](references/guards.tsv)),
+`--mode advisory|enforce` (default `advisory`), `--dry-run`, `--list`,
+`--uninstall <guard>`.
+
+## What it emits
+
+| Guard | Surfaces | Emitted |
+|---|---|---|
+| `secret-scan` | hook + CI | `.claude/hooks/secret-scan.sh` (gitleaks staged scan), `.gitleaks.toml` (only when absent — a default-ruleset pointer, never overwrites a user's), the `secret-scan` job in `.github/workflows/verification-gates.yml` |
+| `commit-on-main` | hook | `.claude/hooks/commit-on-main.sh` → [scripts/verification/precommit-guard.sh](references/guards/precommit-guard.sh.template) + [lib/wrapper-boundary.sh](references/guards/wrapper-boundary.sh.template) (the near-verbatim canonical emit, default-branch set stamped) |
+| `block-stash` | hook | `.claude/hooks/block-stash.sh` (chain-boundary `git stash`; `list`/`show` are documented read-only exceptions) |
+| `orphan-test` | CI | [scripts/verification/orphan-test-check.sh](references/guards/orphan-test-check.sh.template) + the `orphan-test` job + `.github/verification-known-orphans.txt` (reason-required exclusion manifest, seeded with grandfathered rows) |
+
+Hooks are registered as `PreToolUse` `Bash` entries in `.claude/settings.json`
+(node-first, `jq` fallback — a repo with neither is refused with the dependency
+named; malformed existing JSON is refused before any write). The workflow lands
+at repo ROOT — a nested `.github/workflows/` is dormant.
+
+## Advisory-first contract
+
+Every guard installs **advisory**: identical predicates, different decision verb
+— hooks warn+allow (`ask` only on a REAL secret-scan finding), CI jobs carry
+`continue-on-error: true`. Promotion is the one-line flip the emitted
+`VERIFICATION.md` documents (`MODE="enforce"`, `continue-on-error: false`), and
+it requires ≥1 observed clean advisory run first. Non-destructive: any existing
+artifact is a refusal — there is no `--force`.
+
+## Agent-owns-gates
+
+Same model as `constraint-scaffold`: the agent owns the emitted files; the
+target user never hand-edits a gate. `--uninstall <guard>` removes only that
+guard's artifacts + settings entry; it is idempotent and prints "not installed"
+for a never-installed guard, and it strips the marker doc block from
+VERIFICATION.md/README.md once no guard artifact remains.
+
+## Bite-proof
+
+Every install proves each selected guard **pass → fail → pass** on a detached
+worktree under TMPDIR (a TMPDIR inside the repo is refused, exit 69) before the
+doc block is written; a mid-install failure removes exactly the files that run
+emitted. The `secret-scan` arm requires `gitleaks` on PATH and is reported as a
+loud SKIP when absent — an advisory hook that cannot scan is a tool error, not
+a silent guard.
+
+## Requirements
+
+bash + POSIX tools on the target host (stock macOS included). Emitted artifacts
+carry no Soleur couplings and zero network egress; `manifest.test.sh` pins both.

package/skills/verification-scaffold/references/gitleaks.toml.template

@@ -0,0 +1,13 @@
+# .gitleaks.toml — emitted by soleur:verification-scaffold ONLY because the repo
+# had none (a pre-existing ruleset is never overwritten). It is deliberately a
+# default-pack pointer: `useDefault = true` inherits the gitleaks default rules
+# (cloud keys, vendor tokens, PEM bodies, webhooks). Narrow or widen by editing
+# this file — the emitted hook and the emitted CI job both read it.
+#
+# Waivers: annotate a known-safe line with `# gitleaks:allow <reason>` (or the
+# `//` form) — never commit-then-rotate.
+
+title = "verification-scaffold secret-scan floor"
+
+[extend]
+useDefault = true