@spardutti/claude-skills 2.60.4 → 2.61.0

package/README.md

@@ -135,7 +135,7 @@ Portable slash commands installed to `.claude/commands/`. Some orchestrate paral
 | `/ship` | Unified delivery pipeline — commit → gate → PR → merge → release. The gate is the one enforcement moment: it checks the diff's file lengths and that new files sit in their kind folder, audits it against the skills installed in the project, mutation-tests the changed lines to prove the tests would catch a break, and runs one `/code-review` round for logic bugs — **fixing what it finds** rather than handing you a list. It runs before the **PR**, not before every commit: its scope is the whole branch, so gating each commit re-mutated every file the branch had ever touched. `--force` skips it. No argument steps through interactively; `/ship pr` runs through PR creation; `/ship release` runs the full pipeline |
 | `/discover` | Find the right problem before deciding what to build — diverges first: generates competing framings through blind subagents under forced constraints, stress-tests the winner with a blind critic, and refuses to converge until every open question is answered or deferred, then drafts scope, non-goals, edge cases and success criteria for you to correct. Run before `/plan-feature` |
 | `/plan-feature` | Integration-first feature planning, then building — one agent scans the repo for reusable code, patterns and touch points, grounded clarifying questions follow, the plan is written as type-checked stubs at the real paths, and on your go it fills them in. It reads every `*.registry.yaml` first and must mark each one reuse or skip |
-| `/registry` | Record the project's reusable systems — aiming methods, a state machine, an effect pipeline — as a small `<name>.registry.yaml` next to their code, so `/plan-feature` extends them instead of rebuilding them. You name the system, it drafts the entry for your yes. Nothing reads the registry outside planning |
+| `/registry` | Record the project's reusable systems — aiming methods, a state machine, an effect pipeline — as a small `<name>.registry.yaml` next to their code, so `/plan-feature` extends them instead of rebuilding them. You name the system, it drafts the entry for your yes. `/registry eval` lists existing code that does an entry's job outside its folder |
 | `/optimize` | Make one measured job faster without changing what it proves — fixes a benchmark and a result that must not move, sends 4 read-only subagents to find suspects, then changes one thing per round with a prediction written first, keeping only what beats the noise. Profiles after every wrong prediction, reruns before judging a result that flipped, and ends by writing the cause as a skill rule for you |
 | `/handoff` | Write a handoff doc so a fresh session picks the work up — captures what auto-compaction loses: decisions made and rejected, dead ends already ruled out, why the tree is dirty, and the one next step |
 | `/lockdown` | Per-repo supply-chain hardening — detects the package managers, Dockerfiles, and CI in use, then guides you through and applies install-time, deploy, and pipeline hardening for npm/pnpm, pip/uv, Docker, and GitHub Actions |
@@ -177,7 +177,9 @@ never: sort or filter enemies inside a skill
 
 `/plan-feature` reads every entry and must mark each one `reuse` or `skip`. A plan
 fails if it says `reuse` while its stubs never use the names in `extend_by`, and an
-entry whose names left the code is flagged as stale. Nothing else reads the registry.
+entry whose names left the code is flagged as stale. An entry can also list the calls
+that do its job, `does: [insert(events)]`, and `/registry eval` names every file outside
+its folder that makes one — the second way to save an event that nobody planned.
 `/registry aim` drafts an entry for your yes. Replayed on a real game feature, the
 targeting rule went inside the skill without an entry, and into `Aim` with one, 5 runs of 5.
 

package/hooks/registry-lib.mjs

@@ -40,7 +40,7 @@ export function parseEntry(text) {
     const m = line.match(/^([a-z_]+):\s*(.*?)\s*(?:\s#.*)?$/);
     if (m) entry[m[1]] = value(m[2]);
   }
-  entry.triggers = [].concat(entry.triggers ?? []).filter(Boolean);
+  for (const key of ["triggers", "does", "allowed"]) entry[key] = [].concat(entry[key] ?? []).filter(Boolean);
   return entry;
 }
 

package/hooks/registry.mjs

@@ -16,6 +16,8 @@ const usesIn = (text, name) => {
   return uses(text, parts[0]) && new RegExp(`\\.${escape(parts.at(-1))}\\b`).test(text);
 };
 const fromCwd = (f) => relative(root, resolve(f));
+// `insert(events)` is code, not a word: it may follow a dot, never more letters.
+const calls = (text, code) => new RegExp(`${/^\w/.test(code) ? "\\b" : ""}${escape(code)}`).test(text);
 
 function list() {
   if (!entries.length) return console.log(`registry none — no *${REGISTRY_SUFFIX} in this project`);
@@ -56,6 +58,17 @@ function checkPlan(planPath, stubs) {
   if (!asks.length) console.log("registry ok");
 }
 
+function evaluate() {
+  if (!entries.length) return console.log(`registry none — no *${REGISTRY_SUFFIX} in this project`);
+  for (const e of entries) {
+    if (!e.does.length) { console.log(`registry eval ${e.name}: skipped, no does`); continue; }
+    const outside = files.filter((f) => !insideLocation(e, f) && !e.allowed.includes(f) && !f.endsWith(REGISTRY_SUFFIX));
+    const hits = outside.flatMap((f) => readFileSync(join(root, f), "utf8").split("\n").flatMap((line, i) =>
+      e.does.filter((code) => calls(line, code)).map((code) => `registry SUSPECT ${e.name} ${f}:${i + 1} ${code}`)));
+    console.log(hits.length ? hits.join("\n") : `registry eval ${e.name}: nothing outside ${e.location} does its job`);
+  }
+}
+
 function stale() {
   const problems = [];
   const seen = new Set();
@@ -65,6 +78,8 @@ function stale() {
       if (!e[key]) say(`no ${key}`);
       else if (/^[|>]/.test(e[key])) say(`${key} must sit on one line`);
     }
+    if (!e.triggers.length) say("no triggers");
+    for (const f of e.allowed) if (!existsSync(join(root, f))) say(`allowed ${f} not found`);
     if (e.name && !/^[\w.-]+$/.test(e.name)) say(`name ${e.name} may hold only letters, digits, dashes and dots`);
     if (/^\s+-\s/m.test(e.text)) say("write lists on one line, like triggers: [aim, target]");
     if (seen.has(e.name)) say(`name ${e.name} is used twice`);
@@ -82,6 +97,7 @@ function stale() {
       if (/^[a-z][a-z0-9]*$/.test(s)) say(`\`${s}\` is too common a word to prove use — name its owner, like \`Owner.${s}\``);
       else if (!s.split(".").every((part) => uses(code, part))) say(`${s} from extend_by is not found in ${e.location}`);
     }
+    for (const c of e.does) if (!calls(code, c)) say(`does ${c} is not found in ${e.location}`);
   }
   if (problems.length) fail(problems);
 }
@@ -95,7 +111,8 @@ const [mode, ...rest] = process.argv.slice(2);
 if (mode === undefined) list();
 else if (mode === "--plan" && rest[0]) checkPlan(resolve(rest[0]), rest.slice(1));
 else if (mode === "--stale") stale();
+else if (mode === "--eval") evaluate();
 else {
-  console.error("usage: registry.mjs [--plan PLAN.md <stub files…> | --stale]");
+  console.error("usage: registry.mjs [--plan PLAN.md <stub files…> | --stale | --eval]");
   process.exit(2);
 }

package/hooks/ship-log.mjs

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { git, parseReport, prSize } from "./ship-log-parse.mjs";
 import { printReport, tally } from "./ship-log-report.mjs";
 
 const HERE = dirname(resolve(process.argv[1]));
 const VERDICTS = ["confirmed", "refuted", "unconfirmed", "skipped"];
+// A release ships only work its feature PRs already logged.
+const RELEASE = /^(main|master|dev|develop|development|chore\/release-.*)$/;
 const now = () => new Date().toISOString().replace(/\.\d+Z$/, "Z");
 
 // gate-config.sh owns the config files and their order, so the gate and this agree on "on".
@@ -69,7 +71,7 @@ function finalize(dir, path, record, tag, status, reason, at) {
 }
 
 function prOf(branch) {
-  const r = spawnSync("gh", ["pr", "list", "--head", branch, "--state", "all", "--json", "number,createdAt,state", "--limit", "1"], { encoding: "utf8" });
+  const r = spawnSync("gh", ["pr", "list", "--head", branch, "--state", "all", "--json", "number,createdAt,closedAt,state", "--limit", "1"], { encoding: "utf8" });
   try { return r.status === 0 ? JSON.parse(r.stdout)[0] : undefined; } catch { return undefined; }
 }
 
@@ -80,8 +82,10 @@ function closeOpened(dir, app) {
   const open = join(dir, "open");
   for (const f of existsSync(open) ? readdirSync(open).filter((n) => n.startsWith(`${app}__`)) : []) {
     const path = join(open, f), record = JSON.parse(readFileSync(path, "utf8"));
-    if (!record.gate.length && !record.findings.length) continue;
-    const pr = prOf(record.branch);
+    const pr = prOf(record.branch), empty = !record.gate.length && !record.findings.length;
+    // A /ship that only merged fills nothing, so once its PR closes there is nothing to keep.
+    if (empty && pr?.closedAt >= record.started) { rmSync(path); continue; }
+    if (empty) continue;
     const opened = pr && pr.createdAt >= record.started;
     if (!pr || (!opened && pr.state !== "OPEN")) continue;
     finalize(dir, path, Object.assign(record, { pr: pr.number }), `pr${pr.number}`,
@@ -156,6 +160,11 @@ function run(mode, args) {
   if (mode === "on") return c.on ? 0 : 1;
   if (!c.on) return 0;
   const id = identity(c.root), path = openPath(c.dir, id), record = load(path, id);
+  if (mode === "start" && RELEASE.test(id.branch)) {
+    closeOpened(c.dir, id.app);
+    if (existsSync(path)) rmSync(path);
+    return 0;
+  }
   if (mode === "start") return restart(c.dir, path, record, id), 0;
   if (mode === "ready") {
     const todo = existsSync(path) ? missing(record, c) : [];

package/hooks/ship-prep.sh

@@ -69,11 +69,8 @@ scope() {
   fi
   echo "diff $diff"
   echo "review /code-review medium origin/$(base_branch)...$branch"
-  # A release branch skips the audit and the review, so starting them left steps that never end.
-  case "$branch" in chore/release-*) ;; *)
-    node "$HERE/ship-log.mjs" step audit start >/dev/null 2>&1
-    node "$HERE/ship-log.mjs" step review start >/dev/null 2>&1 ;;
-  esac
+  node "$HERE/ship-log.mjs" step audit start >/dev/null 2>&1
+  node "$HERE/ship-log.mjs" step review start >/dev/null 2>&1
   return 0
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spardutti/claude-skills",
-  "version": "2.60.4",
+  "version": "2.61.0",
   "description": "Guardrails for Claude Code — best-practice skills, planning commands, and delivery gates.",
   "type": "module",
   "repository": {