codymaster 7.0.2 → 7.0.3

package/skills/cm-safe-deploy/references/gate-0-secret-hygiene.md

@@ -0,0 +1,68 @@
+# Gate 0 — Secret Hygiene
+
+> Fastest fail. Prevent secrets, tracked env files, and unsafe config from reaching a remote.
+
+## Use When
+- Before any deploy
+- While setting up a deploy pipeline
+- After any secret-related incident
+
+## What This Gate Checks
+- secrets embedded in deploy config
+- missing `.gitignore` coverage for local secret files
+- tracked `.env` or `.dev.vars` files
+- dangerous secret placement in repo-managed config
+
+## Essential Check
+```bash
+node -e "
+const fs = require('fs');
+const { execSync } = require('child_process');
+const wranglerFiles = ['wrangler.jsonc', 'wrangler.toml', 'wrangler.json'];
+const dangerous = ['SERVICE_KEY', 'ANON_KEY', 'DB_PASSWORD', 'SECRET_KEY', 'PRIVATE_KEY', 'API_SECRET'];
+let failed = false;
+
+for (const wf of wranglerFiles) {
+  if (!fs.existsSync(wf)) continue;
+  const src = fs.readFileSync(wf, 'utf-8');
+  for (const key of dangerous) {
+    const valuePattern = new RegExp(key + '\\\\s*[=:]\\\\s*[\"\\'][a-zA-Z0-9/+=]{20,}', 'g');
+    if (valuePattern.test(src)) {
+      console.error('❌ DANGEROUS: ' + wf + ' contains a ' + key + ' VALUE');
+      failed = true;
+    }
+  }
+}
+
+if (fs.existsSync('.gitignore')) {
+  const gi = fs.readFileSync('.gitignore', 'utf-8');
+  const required = ['.env', '.dev.vars'];
+  const missing = required.filter(r => !gi.includes(r));
+  if (missing.length > 0) {
+    console.error('❌ .gitignore missing: ' + missing.join(', '));
+    failed = true;
+  }
+}
+
+try {
+  const tracked = execSync('git ls-files', { encoding: 'utf-8' });
+  const badFiles = ['.env', '.dev.vars', '.env.local', '.env.production'];
+  const trackedBad = badFiles.filter(f => tracked.split('\\n').includes(f));
+  if (trackedBad.length > 0) {
+    console.error('❌ tracked secret files: ' + trackedBad.join(', '));
+    failed = true;
+  }
+} catch {}
+
+if (failed) process.exit(1);
+console.log('✅ Gate 0 passed');
+"
+```
+
+## Remediation
+- move secrets to platform secret managers
+- scrub or untrack local secret files
+- rotate any leaked values immediately
+
+## Rule
+If Gate 0 fails, do not continue to later gates.

package/skills/cm-safe-deploy/references/gate-1-syntax.md

@@ -0,0 +1,23 @@
+# Gate 1 — Syntax Validation
+
+> Fast fail before slow tests. Catch parse and compile issues early.
+
+## Use When
+- every deploy path
+- especially frontend-heavy projects where one syntax error can white-screen production
+
+## Common Commands
+| Stack | Command |
+|---|---|
+| Vanilla JS | `node -c path/to/app.js` |
+| TypeScript | `npx tsc --noEmit` |
+| Python | `python -m py_compile app.py` |
+| Go | `go vet ./...` |
+
+## Why This Gate Exists
+- syntax checks are cheaper than test suites
+- they produce precise failure locations
+- they prevent wasting time on later gates when the build is already invalid
+
+## Rule
+If syntax fails, do not proceed to test or build gates.

package/skills/cm-safe-deploy/references/gate-2-test-suite.md

@@ -0,0 +1,28 @@
+# Gate 2 — Test Suite
+
+> Validate behavior, not just syntax.
+
+## Required Coverage Areas
+| Category | Purpose |
+|---|---|
+| Frontend safety | syntax, integrity, corruption checks |
+| Backend API | route behavior |
+| Business logic | rules, transforms, calculations |
+| i18n sync | key parity and drift |
+| Integration | workflow coverage when practical |
+
+## Script Convention
+```json
+{
+  "scripts": {
+    "test:gate": "vitest run --reporter=verbose"
+  }
+}
+```
+
+## Rule
+- `test:gate` must pass with zero failures before later gates
+- if tests are missing, that is a setup problem, not a reason to skip the gate
+
+## Integration
+Use `cm-quality-gate` when you need parser-based or evidence-focused validation patterns inside the test gate.

package/skills/cm-safe-deploy/references/gate-3-i18n.md

@@ -0,0 +1,19 @@
+# Gate 3 — i18n Parity
+
+> Only for multilingual projects, but mandatory when those projects ship localized content.
+
+## Use When
+- project has multiple locales
+- localized content is user-facing
+
+## What to Check
+- key-count parity
+- missing translations
+- orphaned translations
+- locale files staying in sync after changes
+
+## Rule
+If the project is multilingual, this gate is not optional.
+
+## Integration
+Use `cm-safe-i18n` to establish safer extraction, batching, and sync rules when localization work is active.

package/skills/cm-safe-deploy/references/gate-4-5-build-dist.md

@@ -0,0 +1,16 @@
+# Gates 4-5 — Build Verification and Dist Verification
+
+> Validate the artifact you are actually about to ship.
+
+## Gate 4 — Build
+- run the production build
+- confirm exit status is clean
+- capture final warnings or errors
+
+## Gate 5 — Dist
+- verify expected dist assets exist
+- verify entry files and output structure are sane
+- confirm deployment target receives the right artifact shape
+
+## Rule
+Passing tests is not enough. The built artifact must also be validated.

package/skills/cm-safe-deploy/references/gate-6-deploy-smoke.md

@@ -0,0 +1,18 @@
+# Gate 6 — Deploy + Smoke Test
+
+> Final stage: deploy the validated artifact, then prove the deployed target behaves.
+
+## Steps
+1. Deploy using the project’s approved command or workflow.
+2. Confirm deploy success signal or URL.
+3. Run smoke checks against the deployed target.
+4. Stop immediately if smoke checks fail.
+
+## Smoke Test Focus
+- app loads
+- key routes respond
+- critical UI does not white-screen
+- critical backend endpoint responds if relevant
+
+## Rule
+A green deploy command without a green smoke test is not a successful deployment.

package/skills/cm-safe-deploy/references/rollback.md

@@ -0,0 +1,17 @@
+# Rollback Protocol
+
+> Use when a deploy fails or the deployed target is unhealthy.
+
+## Trigger
+- Gate 6 smoke test fails
+- production issue detected immediately after release
+- wrong artifact or config shipped
+
+## Response
+1. Stop forward rollout
+2. Revert to last known good artifact or deployment target
+3. Verify the rollback target with smoke checks
+4. Capture incident details and root cause
+
+## Rule
+Rollback is part of the deploy system, not a last-minute improvisation.

package/skills/cm-safe-deploy/references/setup-new-project.md

@@ -0,0 +1,20 @@
+# Setup — New Project Deploy Infrastructure
+
+> Use this when a project does not yet have a reliable gated deploy path.
+
+## Setup Sequence
+1. Create test infrastructure
+2. Add gate scripts to `package.json`
+3. Add frontend safety tests where relevant
+4. Create deploy workflow / script
+5. Ensure secret handling and identity checks are in place
+
+## Minimum Outcome
+- `test:gate` exists
+- syntax and build checks exist
+- deploy command is scripted
+- smoke verification path is defined
+- rollback path is known
+
+## Rule
+Do not mix “setup the pipeline” with “run a live deploy” in one uncontrolled step.

package/skills/cm-skill-index/SKILL.md

@@ -58,7 +58,7 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 | `cm-tdd` | test, TDD, red-green-refactor | Red-Green-Refactor cycle before any implementation |
 | `cm-debugging` | bug, error, fix, debug, broken | Root cause analysis before fixing. 5-phase investigation |
 | `cm-quality-gate` | deploy, ship, verify, quality, gate | 6-gate verification: static analysis → blind review → ship |
-| `cm-test-gate` | test setup, CI, test infrastructure | Setup 4-layer test gate for any project type |
+| `cm-quality-gate` | test setup, CI, verification | Test + verification gate before claiming completion |
 | `cm-code-review` | review, PR, feedback, branch | Request reviews, handle feedback, complete branches |
 | `cm-codeintell` | understand codebase, call graph, impact, architecture, what calls X, what breaks | AST knowledge graph + architecture diagrams + smart context (30% fewer tokens) |
 | `cm-reactor` | rewrite, pivot, migrate, direction change, architecture wrong, restructure | TRIZ-powered strategic codebase re-direction — 5-phase incremental migration |
@@ -70,14 +70,14 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 |-------|----------|---------|
 | `cm-safe-deploy` | deploy, staging, production, release | Multi-gate deploy pipeline with rollback strategy |
 | `cm-identity-guard` | git push, deploy, Cloudflare, Supabase, account | Verify identity before any push/deploy to prevent wrong-account |
-| `cm-git-worktrees` | branch, isolate, worktree, parallel | Isolated git worktrees for feature work |
+| `cm-execution` | branch, isolate, worktree, parallel | Execution modes including isolated workspaces and parallel batches |
 | `cm-terminal` | command, terminal, run, execute | Safe terminal execution with progress logging |
 
 ### Security Swarm 🔒
 
 | Skill | Triggers | Summary |
 |-------|----------|---------|
-| `cm-secret-shield` | secret, token, leak, security, scan, pre-commit, gitleaks, rotate | Defense-in-depth: pre-commit hooks, repo scanning, token lifecycle |
+| `cm-safe-deploy` | secret, token, leak, security, scan, pre-commit, gitleaks, rotate | Defense-in-depth: repo scanning, token lifecycle, and release safety |
 
 ### Product Swarm 🎨
 
@@ -86,7 +86,7 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 | `cm-brainstorm-idea` | analyze, enhance, improve, initiative, evaluate, review product | Strategic analysis gate: 9 Windows + Double Diamond → 2-3 qualified options |
 | `cm-planning` | plan, design, brainstorm, feature | Brainstorm intent → write implementation plan → then code |
 | `cm-ux-master` | UI, UX, design, interface, usability | 48 UX Laws + 37 Design Tests + Figma/Stitch integration |
-| `cm-ui-preview` | preview, visual, mockup, render UI, wireframe | Live UI concept generation via Google Stitch or Pencil MCP |
+| `cm-design-system` | preview, visual, mockup, render UI, wireframe | Live UI concept generation via design-token and Stitch/Open Design workflows |
 | `cm-dockit` | docs, documentation, knowledge base, SOP | Generate complete knowledge base from codebase |
 | `cm-project-bootstrap` | new project, init, bootstrap, setup | Full project setup: design system → staging → CI → deploy |
 | `cm-jtbd` | customer discovery, JTBD, jobs to be done, product-market fit, why users churn | JTBD canvas: Switch Interview → Outcome Metrics → Opportunity Scoring |
@@ -105,11 +105,10 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 |-------|----------|---------|
 | `cm-execution` | execute, implement, plan, RARV, batch | Execute plans: batch mode, subagent-driven, parallel, or RARV |
 | `cm-continuity` | memory, context, CONTINUITY, learnings | Working memory protocol: read at start, update at end |
-| `cm-skill-mastery` | which skill, skill list, discover, help | Meta-skill: when to invoke skills, how to create new ones |
+| `cm-skill-index` | which skill, skill list, discover, help | Meta-skill: when to invoke skills and how to discover the right one |
 | `cm-skill-health` | skill broken, skill drift, missing skill, stale skill, health | Audit a skill using docs drift, retro notes, validation, and gates |
 | `cm-skill-evolution` | repair skill, evolve skill, fix skill, derive skill | Recover a degraded skill with FIX, DERIVED, or CAPTURED mode |
-| `cm-skill-search` | find skill, lookup skill, which skill, search skill | Find the right skill through indexes, suggestions, and repo search |
-| `cm-skill-share` | export skill, import skill, share skill, move skill | Package and transfer skill folders safely across repos and machines |
+| `cm-skill-evolution` | repair skill, evolve skill, capture skill | Repair, derive, or capture skills from execution feedback |
 | `cm-safe-i18n` | translate, i18n, language, localize | Safe translation with multi-pass batching and audit gates |
 | `cm-skill-chain` | chain, pipeline, workflow, multi-step, full process | Compose skills into automated multi-step pipelines |
 | `cm-deep-search` | semantic search, find docs, large codebase, qmd | Optional power-up for semantic search across large projects |
@@ -121,8 +120,9 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 | Skill | Triggers | Summary |
 |-------|----------|---------|
 | `cm-start` | /cm-start, start workflow, begin objective, new task | Orchestrate full cm-* workflow from objective to production code |
-| `cm-dashboard` | /cm-dashboard, kanban, task board, show tasks, status board | Render Kanban board from OpenSpec `tasks.md` and `cm-tasks.json` — visual task overview |
 | `cm-status` | /cm-status, quick status, progress, what's next, blocked | Ultra-concise progress summary: done / next / blocked |
+| `cm-status` | /cm-status, quick status, progress, what's next, blocked | Ultra-concise progress summary: done / next / blocked |
+
 
 ### Planned (not yet implemented) 🧪
 
@@ -259,7 +259,7 @@ Traditional approach: Load every SKILL.md to decide which skill to use.
 
 **Discovery Protocol:**
 ```
-1. Check THIS index first (59 skills above)
+1. Check THIS index first (62 skills above)
    → Match found? → npx skills add {source} --skill {name} -a antigravity
 2. No match? → npx skills find "{keyword}" on skills.sh
 3. Still nothing? → Proceed without skill, note gap in .cm-skills-log.json
@@ -322,13 +322,13 @@ view_file /path/to/skills/cm-tdd/SKILL.md
 For dynamic agent selection (Phase 3), skills map to domains:
 
 ```yaml
-engineering: [cm-tdd, cm-debugging, cm-quality-gate, cm-test-gate, cm-code-review, cm-codeintell, cm-reactor, cm-clean-code]
-operations: [cm-safe-deploy, cm-identity-guard, cm-git-worktrees, cm-terminal, cm-safe-i18n]
-security: [cm-secret-shield]
-product: [cm-brainstorm-idea, cm-planning, cm-ux-master, cm-ui-preview, cm-dockit, cm-project-bootstrap, cm-jtbd]
+engineering: [cm-tdd, cm-debugging, cm-quality-gate, cm-code-review, cm-codeintell, cm-reactor, cm-clean-code]
+operations: [cm-safe-deploy, cm-identity-guard, cm-terminal, cm-safe-i18n]
+security: [cm-safe-deploy]
+product: [cm-brainstorm-idea, cm-planning, cm-ux-master, cm-design-system, cm-dockit, cm-project-bootstrap, cm-jtbd]
 growth: [cm-content-factory, cm-ads-tracker, cm-cro-methodology]
-orchestration: [cm-execution, cm-continuity, cm-skill-mastery, cm-skill-health, cm-skill-evolution, cm-skill-search, cm-skill-share, cm-skill-chain, cm-deep-search, cm-readit, cm-how-it-work]
-commands: [cm-start, cm-dashboard, cm-status]
+orchestration: [cm-execution, cm-continuity, cm-skill-index, cm-skill-health, cm-skill-evolution, cm-skill-chain, cm-deep-search, cm-readit, cm-how-it-work]
+commands: [cm-start, cm-status]
 # planned (no SKILL.md yet): mom-test, release-it, medical-research, tailwind-mastery, pandasai-analytics, cm-google-form
 ```
 

package/skills/cm-start/SKILL.md

@@ -30,7 +30,7 @@ When this workflow is called, the AI Assistant should execute the following acti
 0.5. **Skill Coverage Check (Adaptive Discovery):**
     - Scan the objective for technologies, frameworks, or patterns mentioned
     - Cross-reference with `cm-skill-index` Layer 1 triggers
-    - If gap detected → trigger Discovery Loop from `cm-skill-mastery` Part C:
+    - If gap detected → trigger Discovery Loop from `cm-skill-index`:
       `npx skills find "{keyword}"` → review → ask user → install if approved
     - Log any discovered skills to `.cm-skills-log.json`