coding-agent-skills 0.2.8 → 0.2.10

package/tests/fixtures/env-audit/adapter-project/src/config.ts

@@ -0,0 +1,2 @@
+export const adapterScoped = process.env.ADAPTER_ONLY_VALUE;
+export const adapterOptional = process.env.ADAPTER_OPTIONAL_VALUE ?? "fallback";

package/tests/fixtures/env-audit/static-project/.env.example

@@ -0,0 +1,3 @@
+DATABASE_URL=
+NEXT_PUBLIC_APP_URL=
+OPTIONAL_FEATURE_FLAG=

package/tests/fixtures/env-audit/static-project/README.md

@@ -0,0 +1,3 @@
+# Env Audit Static Fixture
+
+Requires DATABASE_URL and optional NEXT_PUBLIC_APP_URL. Workers may use QUEUE_NAME.

package/tests/fixtures/env-audit/static-project/docs/setup.md

@@ -0,0 +1,3 @@
+# Setup
+
+Set DATABASE_URL before starting locally. NEXT_PUBLIC_APP_URL is optional.

package/tests/fixtures/env-audit/static-project/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "fixture-env-audit-static",
+  "type": "module"
+}

package/tests/fixtures/env-audit/static-project/src/config.ts

@@ -0,0 +1,4 @@
+export const databaseUrl = process.env.DATABASE_URL;
+export const port = process.env.PORT ?? "3000";
+export const publicUrl = import.meta.env.NEXT_PUBLIC_APP_URL;
+export const requiredToken = env("SERVICE_TOKEN");

package/tests/fixtures/env-audit/static-project/src/deno.ts

@@ -0,0 +1 @@
+export const denoValue = Deno.env.get("DENO_REGION");

package/tests/fixtures/route-trace/adapter-project/.coding-agent/adapters/route-trace-fixture/adapter.json

@@ -0,0 +1,59 @@
+{
+  "adapterId": "route-trace-fixture",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "route-trace-fixture",
+    "detection": {
+      "rootMarkers": [{"kind": "file", "path": "package.json"}],
+      "maximumDepth": 2,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "route-trace",
+      "compatibleVersions": ["0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["app", "pages", "src"],
+    "ignoredPaths": ["dist", "build", "node_modules"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": [
+      "adapter scope",
+      "verified route files",
+      "inferred route patterns",
+      "skipped route paths",
+      "not-verified runtime classes"
+    ],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/route-trace/adapter-project/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "route-trace-fixture",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": ">=0.2.3 <0.3.0"
+  },
+  "compatibleSkillIds": ["route-trace"],
+  "adapters": [
+    {
+      "id": "route-trace-fixture",
+      "version": "1.0.0",
+      "skillIds": ["route-trace"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/route-trace.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/route-trace/adapter-project/README.md

@@ -0,0 +1,3 @@
+# Route Trace Adapter Fixture
+
+Synthetic adapter-scoped route tracing fixture.

package/tests/fixtures/route-trace/adapter-project/app/api/items/route.ts

@@ -0,0 +1,3 @@
+export async function GET() {
+  return Response.json({ items: [] });
+}

package/tests/fixtures/route-trace/adapter-project/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "route-trace-adapter-fixture",
+  "private": true,
+  "type": "module"
+}

package/tests/fixtures/route-trace/adapter-project/pages/index.tsx

@@ -0,0 +1,3 @@
+export default function IndexPage() {
+  return <main>Index</main>;
+}

package/tests/fixtures/route-trace/adapter-project/src/routes.ts

@@ -0,0 +1,3 @@
+export function register(app) {
+  app.get("/adapter-health", () => ({ ok: true }));
+}

package/tests/fixtures/route-trace/static-project/.env.example

@@ -0,0 +1 @@
+PUBLIC_EXAMPLE=value

package/tests/fixtures/route-trace/static-project/README.md

@@ -0,0 +1,3 @@
+# Route Trace Static Fixture
+
+Synthetic fixture for static route tracing. It is not an installable project.

package/tests/fixtures/route-trace/static-project/app/api/users/route.ts

@@ -0,0 +1,3 @@
+export async function GET() {
+  return Response.json({ ok: true });
+}

package/tests/fixtures/route-trace/static-project/app/blog/[slug]/page.tsx

@@ -0,0 +1,3 @@
+export default function BlogPostPage() {
+  return <article>Post</article>;
+}

package/tests/fixtures/route-trace/static-project/app/page.tsx

@@ -0,0 +1,3 @@
+export default function HomePage() {
+  return <main>Home</main>;
+}

package/tests/fixtures/route-trace/static-project/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "route-trace-static-fixture",
+  "private": true,
+  "type": "module"
+}

package/tests/fixtures/route-trace/static-project/pages/about.tsx

@@ -0,0 +1,3 @@
+export default function AboutPage() {
+  return <main>About</main>;
+}

package/tests/fixtures/route-trace/static-project/pages/api/hello.ts

@@ -0,0 +1,3 @@
+export default function handler(_request, response) {
+  response.status(200).json({ ok: true });
+}

package/tests/fixtures/route-trace/static-project/server/routes.ts

@@ -0,0 +1,4 @@
+export function registerRoutes(app) {
+  app.get("/health", () => ({ ok: true }));
+  app.post("/api/widgets", () => ({ ok: true }));
+}

package/tests/fixtures/route-trace/static-project/src/route-config.ts

@@ -0,0 +1,4 @@
+export const routes = [
+  { path: "/reports" },
+  { path: "/reports/:id" },
+];

package/tests/fixtures/route-trace/static-project/src/router.tsx

@@ -0,0 +1,10 @@
+import { Route } from "react-router-dom";
+
+export function Routes() {
+  return (
+    <>
+      <Route path="/dashboard" element={null} />
+      <Route path="/settings/profile" element={null} />
+    </>
+  );
+}

package/tests/fixtures/triggers/cases.json

@@ -19,6 +19,30 @@
       "expectedSkill": "repo-map",
       "notSkills": ["llm-drift-control"]
     },
+    {
+      "id": "route-trace-static-routes",
+      "prompt": "Trace the static route surface and identify Next.js API route files before I edit a handler.",
+      "expectedSkill": "route-trace",
+      "notSkills": ["repo-map", "runtime-truth"]
+    },
+    {
+      "id": "route-trace-express",
+      "prompt": "Find the Express routes and React Router paths that are statically visible without running the app.",
+      "expectedSkill": "route-trace",
+      "notSkills": ["build-verify", "runtime-truth"]
+    },
+    {
+      "id": "env-audit-process-env",
+      "prompt": "Audit process.env and import.meta.env references without reading .env files.",
+      "expectedSkill": "env-audit",
+      "notSkills": ["secret-audit", "runtime-truth"]
+    },
+    {
+      "id": "env-audit-setup-docs",
+      "prompt": "Identify environment variables and configuration requirements from static docs and .env.example only.",
+      "expectedSkill": "env-audit",
+      "notSkills": ["build-verify", "deployment-preflight"]
+    },
     {
       "id": "build-after-implementation",
       "prompt": "The implementation is finished. Run the existing typecheck, tests, and build.",
@@ -71,7 +95,7 @@
       "id": "negative-deploy",
       "prompt": "Deploy this application to production.",
       "expectedSkill": null,
-      "notSkills": ["repo-map", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
+      "notSkills": ["repo-map", "route-trace", "env-audit", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
     },
     {
       "id": "negative-install",

package/tests/trigger/README.md

@@ -3,6 +3,9 @@
 `tests/fixtures/triggers/cases.json` provides executable positive, negative, and wrong-skill cases for every pilot skill.
 
 - Repository orientation must trigger `repo-map`, not build or runtime validation.
+- Static route-surface tracing must trigger `route-trace`, not repository mapping or runtime truth.
+- Value-free environment variable mapping must trigger `env-audit`, not runtime truth or
+  secret-value inspection.
 - Local validation must trigger `build-verify` only when project-native checks are requested.
 - Git readiness must trigger `git-preflight`, not publication.
 - Process/listener/health questions must trigger `runtime-truth`, not restart behavior.

package/work-ledger.md

@@ -4,25 +4,29 @@
 
 - Repository: `coding-agent-skills`
 - Branch: `main`
-- Pilot skills: `repo-map`, `build-verify`, `git-preflight`, `runtime-truth`, `llm-drift-control`
+- Pilot skills: `repo-map`, `route-trace`, `env-audit`, `build-verify`, `git-preflight`, `runtime-truth`, `llm-drift-control`
 - Adapter discovery, project adapter installation, stale-pin detection, upgrade evidence, compatibility-chain validation, evidence-bundle verification, retention policy, provenance design, archive-report rendering, archive-index fixtures, retention-expiry advisory reporting, and detached-signature verification planning are implemented.
 - Real-project adapter adoption readiness is documented as a planning-only approval gate.
 - First external project-owned adapter adoption completed for `/home/oneclickwebsitedesignfactory/tax-lien-platform` at candidate commit `c548b1a6cbb3455a70b89d0e301e22435bfccac9`.
 - The adopted adapter is `repo-map` only, docs/metadata-only, and contains no commands, runtime checks, build/test/package behavior, platform/deployment behavior, or secret-aware behavior.
 - The shared repository does not contain real adapter manifests; real project adapters remain owned by their project repositories.
-- Public npm package release `v0.2.8` exposes the existing dependency-free
+- Public npm package release `v0.2.10` exposes the dependency-free
   `coding-agent-skills` CLI under MIT license.
-- New skills are not approved.
+- `route-trace` is implemented as an audit-only static route tracing skill.
+- `env-audit` is implemented as an audit-only value-free environment variable name mapping
+  skill.
+- Builder-mode approval: complete the remaining read-only skill wave for
+  `coding-agent-skills` itself. Real-world project execution constraints remain unchanged.
 
 ## Last Completed Version
 
-`v0.2.8`
+`v0.2.10`
 
 ## Current Recommended Milestone
 
-The public npm release is complete for the existing CLI surface. No further real
-adapters, adapter expansion, new skills, platform skills, deployment/preflight work,
-signing infrastructure, or evidence-harness milestone is approved.
+The `env-audit` public npm release is in progress under builder-mode approval. Continue the
+remaining read-only skill wave one release at a time unless a real safety, validation,
+publication, or authentication boundary appears.
 
 ## Allowed Next Actions
 
@@ -40,7 +44,7 @@ signing infrastructure, or evidence-harness milestone is approved.
 
 ## Blocked Actions
 
-- Adding new skills.
+- Adding skills outside the approved builder-mode read-only wave.
 - Creating real project adapters.
 - Modifying real project repositories.
 - Publishing release artifacts without explicit approval.
@@ -72,14 +76,15 @@ signing infrastructure, or evidence-harness milestone is approved.
 - Implementing the next evidence-retention or provenance milestone.
 - Selecting a real project adapter candidate.
 - Gathering evidence from a real project repository.
-- Creating, changing, or removing skills.
+- Creating, changing, or removing skills outside the approved builder-mode read-only wave.
 - Adding real project adapters.
 - Expanding the adopted `tax-lien-platform` adapter beyond `repo-map`.
 - Enabling candidate repo package scripts, build verification, runtime checks, or command aliases.
 - Allowing or bypassing project Git hooks during future adapter publication.
 - Touching real project repositories.
 - Changing release publication behavior.
-- Publishing a new npm version beyond the approved release.
+- Publishing a new npm version outside the approved builder-mode read-only wave or another
+  explicitly approved release.
 - Commit, tag, or push operations.
 - Any action not listed in the allowed next actions above.
 
@@ -93,6 +98,15 @@ No next runner command is currently queued.
 
 No autonomous maintainer-loop run has been recorded yet.
 
+### 2026-07-03T10:00:00Z
+
+- Latest tag observed: `v0.2.9`
+- Implemented milestone: `env-audit` audit-only environment variable name mapping skill and CLI command.
+- Required permission: `builder-mode-skill-implementation`
+- Validation result: pass pending final publication evidence
+- Next recommended milestone: continue builder-mode wave with `secret-audit-skill` after
+  `v0.2.10` publication completes.
+
 
 ### 2026-06-19T00:00:00Z
 
@@ -105,6 +119,17 @@ No autonomous maintainer-loop run has been recorded yet.
   skills require separate human approval.
 
 
+### 2026-07-03T00:00:00Z
+
+- Latest tag observed: `v0.2.8`
+- Implemented milestone: `route-trace` audit-only static route tracing skill and CLI command.
+- Required permission: `skill-implementation`
+- Validation result: pass pending final publication evidence
+- Next recommended milestone: no next runner command is queued; future real adapter
+  expansion, new skills, platform work, deployment/preflight skills, and release-policy
+  changes require separate human approval.
+
+
 ### 2026-06-15T21:02:34.116Z
 
 - Latest tag observed: `v0.2.0`