mindforge-cc 11.8.2 → 11.9.0

package/.mindforge/skills/domain-intel/scripts/domain_intel.py

@@ -0,0 +1,397 @@
+#!/usr/bin/env python3
+"""
+Domain Intelligence — Passive OSINT via Python stdlib.
+
+Usage:
+    python domain_intel.py subdomains example.com
+    python domain_intel.py ssl example.com
+    python domain_intel.py whois example.com
+    python domain_intel.py dns example.com
+    python domain_intel.py available example.com
+    python domain_intel.py bulk example.com github.com google.com --checks ssl,dns
+
+All output is structured JSON. No dependencies beyond Python stdlib.
+Works on Linux, macOS, and Windows.
+"""
+
+import json
+import re
+import socket
+import ssl
+import sys
+import urllib.request
+import urllib.parse
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from datetime import datetime, timezone
+
+
+# ─── Subdomain Discovery (crt.sh) ──────────────────────────────────────────
+
+def subdomains(domain, include_expired=False, limit=200):
+    """Find subdomains via Certificate Transparency logs."""
+    url = f"https://crt.sh/?q=%25.{urllib.parse.quote(domain)}&output=json"
+    req = urllib.request.Request(url, headers={
+        "User-Agent": "domain-intel-skill/1.0", "Accept": "application/json",
+    })
+    with urllib.request.urlopen(req, timeout=15) as r:
+        entries = json.loads(r.read().decode())
+
+    seen, results = set(), []
+    now = datetime.now(timezone.utc)
+    for e in entries:
+        not_after = e.get("not_after", "")
+        if not include_expired and not_after:
+            try:
+                dt = datetime.strptime(not_after[:19], "%Y-%m-%dT%H:%M:%S").replace(tzinfo=timezone.utc)
+                if dt <= now:
+                    continue
+            except ValueError:
+                pass
+        for name in e.get("name_value", "").splitlines():
+            name = name.strip().lower()
+            if name and name not in seen:
+                seen.add(name)
+                results.append({
+                    "subdomain": name,
+                    "issuer": e.get("issuer_name", ""),
+                    "not_after": not_after,
+                })
+
+    results.sort(key=lambda r: (r["subdomain"].startswith("*"), r["subdomain"]))
+    return {"domain": domain, "count": min(len(results), limit), "subdomains": results[:limit]}
+
+
+# ─── SSL Certificate Inspection ────────────────────────────────────────────
+
+def check_ssl(host, port=443, timeout=10):
+    """Inspect the TLS certificate of a host."""
+    def flat(rdns):
+        r = {}
+        for rdn in rdns:
+            for item in rdn:
+                if isinstance(item, (list, tuple)) and len(item) == 2:
+                    r[item[0]] = item[1]
+        return r
+
+    def parse_date(s):
+        for fmt in ("%b %d %H:%M:%S %Y %Z", "%b  %d %H:%M:%S %Y %Z"):
+            try:
+                return datetime.strptime(s, fmt).replace(tzinfo=timezone.utc)
+            except ValueError:
+                pass
+        return None
+
+    warning = None
+    try:
+        ctx = ssl.create_default_context()
+        with socket.create_connection((host, port), timeout=timeout) as sock:
+            with ctx.wrap_socket(sock, server_hostname=host) as s:
+                cert, cipher, proto = s.getpeercert(), s.cipher(), s.version()
+    except ssl.SSLCertVerificationError as e:
+        warning = str(e)
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        with socket.create_connection((host, port), timeout=timeout) as sock:
+            with ctx.wrap_socket(sock, server_hostname=host) as s:
+                cert, cipher, proto = s.getpeercert(), s.cipher(), s.version()
+
+    not_after = parse_date(cert.get("notAfter", ""))
+    now = datetime.now(timezone.utc)
+    days = (not_after - now).days if not_after else None
+    is_expired = days is not None and days < 0
+
+    if is_expired:
+        status = f"EXPIRED ({abs(days)} days ago)"
+    elif days is not None and days <= 14:
+        status = f"CRITICAL — {days} day(s) left"
+    elif days is not None and days <= 30:
+        status = f"WARNING — {days} day(s) left"
+    else:
+        status = f"OK — {days} day(s) remaining" if days is not None else "unknown"
+
+    return {
+        "host": host, "port": port,
+        "subject": flat(cert.get("subject", [])),
+        "issuer": flat(cert.get("issuer", [])),
+        "subject_alt_names": [f"{t}:{v}" for t, v in cert.get("subjectAltName", [])],
+        "not_before": parse_date(cert.get("notBefore", "")).isoformat() if parse_date(cert.get("notBefore", "")) else "",
+        "not_after": not_after.isoformat() if not_after else "",
+        "days_remaining": days, "is_expired": is_expired, "expiry_status": status,
+        "tls_version": proto,
+        "cipher_suite": cipher[0] if cipher else None,
+        "serial_number": cert.get("serialNumber", ""),
+        "verification_warning": warning,
+    }
+
+
+# ─── WHOIS Lookup ──────────────────────────────────────────────────────────
+
+WHOIS_SERVERS = {
+    "com": "whois.verisign-grs.com", "net": "whois.verisign-grs.com",
+    "org": "whois.pir.org", "io": "whois.nic.io", "co": "whois.nic.co",
+    "ai": "whois.nic.ai", "dev": "whois.nic.google", "app": "whois.nic.google",
+    "tech": "whois.nic.tech", "shop": "whois.nic.shop", "store": "whois.nic.store",
+    "online": "whois.nic.online", "site": "whois.nic.site", "cloud": "whois.nic.cloud",
+    "digital": "whois.nic.digital", "media": "whois.nic.media", "blog": "whois.nic.blog",
+    "info": "whois.afilias.net", "biz": "whois.biz", "me": "whois.nic.me",
+    "tv": "whois.nic.tv", "cc": "whois.nic.cc", "ws": "whois.website.ws",
+    "uk": "whois.nic.uk", "co.uk": "whois.nic.uk", "de": "whois.denic.de",
+    "nl": "whois.domain-registry.nl", "fr": "whois.nic.fr", "it": "whois.nic.it",
+    "es": "whois.nic.es", "pl": "whois.dns.pl", "ru": "whois.tcinet.ru",
+    "se": "whois.iis.se", "no": "whois.norid.no", "fi": "whois.fi",
+    "ch": "whois.nic.ch", "at": "whois.nic.at", "be": "whois.dns.be",
+    "cz": "whois.nic.cz", "br": "whois.registro.br", "ca": "whois.cira.ca",
+    "mx": "whois.mx", "au": "whois.auda.org.au", "jp": "whois.jprs.jp",
+    "cn": "whois.cnnic.cn", "in": "whois.inregistry.net", "kr": "whois.kr",
+    "sg": "whois.sgnic.sg", "hk": "whois.hkirc.hk", "tr": "whois.nic.tr",
+    "ae": "whois.aeda.net.ae", "za": "whois.registry.net.za",
+    "space": "whois.nic.space", "zone": "whois.nic.zone", "ninja": "whois.nic.ninja",
+    "guru": "whois.nic.guru", "rocks": "whois.nic.rocks", "live": "whois.nic.live",
+    "game": "whois.nic.game", "games": "whois.nic.games",
+}
+
+
+def whois_lookup(domain):
+    """Query WHOIS servers for domain registration info."""
+    parts = domain.split(".")
+    server = WHOIS_SERVERS.get(".".join(parts[-2:])) or WHOIS_SERVERS.get(parts[-1])
+    if not server:
+        return {"error": f"No WHOIS server for .{parts[-1]}"}
+
+    try:
+        with socket.create_connection((server, 43), timeout=10) as s:
+            s.sendall((domain + "\r\n").encode())
+            chunks = []
+            while True:
+                c = s.recv(4096)
+                if not c:
+                    break
+                chunks.append(c)
+            raw = b"".join(chunks).decode("utf-8", errors="replace")
+    except Exception as e:
+        return {"error": str(e)}
+
+    patterns = {
+        "registrar": r"(?:Registrar|registrar):\s*(.+)",
+        "creation_date": r"(?:Creation Date|Created|created):\s*(.+)",
+        "expiration_date": r"(?:Registry Expiry Date|Expiration Date|Expiry Date):\s*(.+)",
+        "updated_date": r"(?:Updated Date|Last Modified):\s*(.+)",
+        "name_servers": r"(?:Name Server|nserver):\s*(.+)",
+        "status": r"(?:Domain Status|status):\s*(.+)",
+        "dnssec": r"DNSSEC:\s*(.+)",
+    }
+    result = {"domain": domain, "whois_server": server}
+    for key, pat in patterns.items():
+        matches = re.findall(pat, raw, re.IGNORECASE)
+        if matches:
+            if key in {"name_servers", "status"}:
+                result[key] = list(dict.fromkeys(m.strip().lower() for m in matches))
+            else:
+                result[key] = matches[0].strip()
+
+    for field in ("creation_date", "expiration_date", "updated_date"):
+        if field in result:
+            for fmt in ("%Y-%m-%dT%H:%M:%S", "%Y-%m-%dT%H:%M:%SZ", "%Y-%m-%d %H:%M:%S", "%Y-%m-%d"):
+                try:
+                    dt = datetime.strptime(result[field][:19], fmt).replace(tzinfo=timezone.utc)
+                    result[field] = dt.isoformat()
+                    if field == "expiration_date":
+                        days = (dt - datetime.now(timezone.utc)).days
+                        result["expiration_days_remaining"] = days
+                        result["is_expired"] = days < 0
+                    break
+                except ValueError:
+                    pass
+    return result
+
+
+# ─── DNS Records ───────────────────────────────────────────────────────────
+
+def dns_records(domain, types=None):
+    """Resolve DNS records using system DNS + Google DoH."""
+    if not types:
+        types = ["A", "AAAA", "MX", "NS", "TXT", "CNAME"]
+    records = {}
+
+    for qtype in types:
+        if qtype == "A":
+            try:
+                records["A"] = list(dict.fromkeys(
+                    i[4][0] for i in socket.getaddrinfo(domain, None, socket.AF_INET)
+                ))
+            except Exception:
+                records["A"] = []
+        elif qtype == "AAAA":
+            try:
+                records["AAAA"] = list(dict.fromkeys(
+                    i[4][0] for i in socket.getaddrinfo(domain, None, socket.AF_INET6)
+                ))
+            except Exception:
+                records["AAAA"] = []
+        else:
+            url = f"https://dns.google/resolve?name={urllib.parse.quote(domain)}&type={qtype}"
+            try:
+                req = urllib.request.Request(url, headers={"User-Agent": "domain-intel-skill/1.0"})
+                with urllib.request.urlopen(req, timeout=10) as r:
+                    data = json.loads(r.read())
+                records[qtype] = [
+                    a.get("data", "").strip().rstrip(".")
+                    for a in data.get("Answer", []) if a.get("data")
+                ]
+            except Exception:
+                records[qtype] = []
+
+    return {"domain": domain, "records": records}
+
+
+# ─── Domain Availability Check ─────────────────────────────────────────────
+
+def check_available(domain):
+    """Check domain availability using passive signals (DNS + WHOIS + SSL)."""
+    signals = {}
+
+    # DNS
+    try:
+        a = [i[4][0] for i in socket.getaddrinfo(domain, None, socket.AF_INET)]
+    except Exception:
+        a = []
+
+    try:
+        ns_url = f"https://dns.google/resolve?name={urllib.parse.quote(domain)}&type=NS"
+        req = urllib.request.Request(ns_url, headers={"User-Agent": "domain-intel-skill/1.0"})
+        with urllib.request.urlopen(req, timeout=10) as r:
+            ns = [x.get("data", "") for x in json.loads(r.read()).get("Answer", [])]
+    except Exception:
+        ns = []
+
+    signals["dns_a"] = a
+    signals["dns_ns"] = ns
+    dns_exists = bool(a or ns)
+
+    # SSL
+    ssl_up = False
+    try:
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        with socket.create_connection((domain, 443), timeout=3) as s:
+            with ctx.wrap_socket(s, server_hostname=domain):
+                ssl_up = True
+    except Exception:
+        pass
+    signals["ssl_reachable"] = ssl_up
+
+    # WHOIS (quick check)
+    tld = domain.rsplit(".", 1)[-1]
+    server = WHOIS_SERVERS.get(tld)
+    whois_avail = None
+    whois_note = ""
+    if server:
+        try:
+            with socket.create_connection((server, 43), timeout=10) as s:
+                s.sendall((domain + "\r\n").encode())
+                raw = b""
+                while True:
+                    c = s.recv(4096)
+                    if not c:
+                        break
+                    raw += c
+                raw = raw.decode("utf-8", errors="replace").lower()
+            if any(p in raw for p in ["no match", "not found", "no data found", "status: free"]):
+                whois_avail = True
+                whois_note = "WHOIS: not found"
+            elif "registrar:" in raw or "creation date:" in raw:
+                whois_avail = False
+                whois_note = "WHOIS: registered"
+            else:
+                whois_note = "WHOIS: inconclusive"
+        except Exception as e:
+            whois_note = f"WHOIS error: {e}"
+
+    signals["whois_available"] = whois_avail
+    signals["whois_note"] = whois_note
+
+    if not dns_exists and whois_avail is True:
+        verdict, conf = "LIKELY AVAILABLE", "high"
+    elif dns_exists or whois_avail is False or ssl_up:
+        verdict, conf = "REGISTERED / IN USE", "high"
+    elif not dns_exists and whois_avail is None:
+        verdict, conf = "POSSIBLY AVAILABLE", "medium"
+    else:
+        verdict, conf = "UNCERTAIN", "low"
+
+    return {"domain": domain, "verdict": verdict, "confidence": conf, "signals": signals}
+
+
+# ─── Bulk Analysis ─────────────────────────────────────────────────────────
+
+COMMAND_MAP = {
+    "subdomains": subdomains,
+    "ssl": check_ssl,
+    "whois": whois_lookup,
+    "dns": dns_records,
+    "available": check_available,
+}
+
+
+def bulk_check(domains, checks=None, max_workers=5):
+    """Run multiple checks across multiple domains in parallel."""
+    if not checks:
+        checks = ["ssl", "whois", "dns"]
+
+    def run_one(d):
+        entry = {"domain": d}
+        for check in checks:
+            fn = COMMAND_MAP.get(check)
+            if fn:
+                try:
+                    entry[check] = fn(d)
+                except Exception as e:
+                    entry[check] = {"error": str(e)}
+        return entry
+
+    results = []
+    with ThreadPoolExecutor(max_workers=min(max_workers, 10)) as ex:
+        futures = {ex.submit(run_one, d): d for d in domains[:20]}
+        for f in as_completed(futures):
+            results.append(f.result())
+
+    return {"total": len(results), "checks": checks, "results": results}
+
+
+# ─── CLI Entry Point ───────────────────────────────────────────────────────
+
+def main():
+    if len(sys.argv) < 3:
+        print(__doc__)
+        sys.exit(1)
+
+    command = sys.argv[1].lower()
+    args = sys.argv[2:]
+
+    if command == "bulk":
+        # Parse --checks flag
+        checks = None
+        domains = []
+        i = 0
+        while i < len(args):
+            if args[i] == "--checks" and i + 1 < len(args):
+                checks = [c.strip() for c in args[i + 1].split(",")]
+                i += 2
+            else:
+                domains.append(args[i])
+                i += 1
+        result = bulk_check(domains, checks)
+    elif command in COMMAND_MAP:
+        result = COMMAND_MAP[command](args[0])
+    else:
+        print(f"Unknown command: {command}")
+        print(f"Available: {', '.join(COMMAND_MAP.keys())}, bulk")
+        sys.exit(1)
+
+    print(json.dumps(result, indent=2))
+
+
+if __name__ == "__main__":
+    main()

package/.mindforge/skills/duckduckgo-search/SKILL.md

@@ -11,7 +11,7 @@ triggers: duckduckgo search, DDG search, web search duckduckgo, privacy search,
 
 Free web search using DuckDuckGo. **No API key required.**
 
-Preferred when `web_search` is unavailable or unsuitable (for example when `FIRECRAWL_API_KEY` is not set). Can also be used as a standalone search path when DuckDuckGo results are specifically desired.
+Preferred when `WebSearch` is unavailable or unsuitable (for example when `FIRECRAWL_API_KEY` is not set). Can also be used as a standalone search path when DuckDuckGo results are specifically desired.
 
 ## Detection Flow
 
@@ -23,15 +23,15 @@ command -v ddgs >/dev/null && echo "DDGS_CLI=installed" || echo "DDGS_CLI=missin
 ```
 
 Decision tree:
-1. If `ddgs` CLI is installed, prefer `terminal` + `ddgs`
-2. If `ddgs` CLI is missing, do not assume `execute_code` can import `ddgs`
+1. If `ddgs` CLI is installed, prefer `Bash` + `ddgs`
+2. If `ddgs` CLI is missing, do not assume `Bash` can import `ddgs`
 3. If the user wants DuckDuckGo specifically, install `ddgs` first in the relevant environment
 4. Otherwise fall back to built-in web/browser tools
 
 Important runtime note:
-- Terminal and `execute_code` are separate runtimes
-- A successful shell install does not guarantee `execute_code` can import `ddgs`
-- Never assume third-party Python packages are preinstalled inside `execute_code`
+- Terminal and `Bash` are separate runtimes
+- A successful shell install does not guarantee `Bash` can import `ddgs`
+- Never assume third-party Python packages are preinstalled inside `Bash`
 
 ## Installation
 
@@ -49,7 +49,7 @@ If a workflow depends on Python imports, verify that same runtime can import `dd
 
 ## Method 1: CLI Search (Preferred)
 
-Use the `ddgs` command via `terminal` when it exists. This is the preferred path because it avoids assuming the `execute_code` sandbox has the `ddgs` Python package installed.
+Use the `ddgs` command via `Bash` when it exists. This is the preferred path because it avoids assuming the `Bash` sandbox has the `ddgs` Python package installed.
 
 ```bash
 # Text search
@@ -87,14 +87,14 @@ ddgs text -q "fastapi tutorial" -m 5 -o json
 
 ## Method 2: Python API (Only After Verification)
 
-Use the `DDGS` class in `execute_code` or another Python runtime only after verifying that `ddgs` is installed there. Do not assume `execute_code` includes third-party packages by default.
+Use the `DDGS` class in `Bash` or another Python runtime only after verifying that `ddgs` is installed there. Do not assume `Bash` includes third-party packages by default.
 
 Safe wording:
-- "Use `execute_code` with `ddgs` after installing or verifying the package if needed"
+- "Use `Bash` with `ddgs` after installing or verifying the package if needed"
 
 Avoid saying:
-- "`execute_code` includes `ddgs`"
-- "DuckDuckGo search works by default in `execute_code`"
+- "`Bash` includes `ddgs`"
+- "DuckDuckGo search works by default in `Bash`"
 
 **Important:** `max_results` must always be passed as a **keyword argument** — positional usage raises an error on all methods.
 
@@ -180,7 +180,7 @@ Returns: `title`, `content`, `description`, `duration`, `provider`, `published`,
 
 ## Workflow: Search then Extract
 
-DuckDuckGo returns titles, URLs, and snippets — not full page content. To get full page content, search first and then extract the most relevant URL with `web_extract`, browser tools, or curl.
+DuckDuckGo returns titles, URLs, and snippets — not full page content. To get full page content, search first and then extract the most relevant URL with `WebFetch`, browser tools, or curl.
 
 CLI example:
 
@@ -199,16 +199,16 @@ with DDGS() as ddgs:
         print(r["title"], "->", r["href"])
 ```
 
-Then extract the best URL with `web_extract` or another content-retrieval tool.
+Then extract the best URL with `WebFetch` or another content-retrieval tool.
 
 ## Limitations
 
 - **Rate limiting**: DuckDuckGo may throttle after many rapid requests. Add a short delay between searches if needed.
-- **No content extraction**: `ddgs` returns snippets, not full page content. Use `web_extract`, browser tools, or curl for the full article/page.
+- **No content extraction**: `ddgs` returns snippets, not full page content. Use `WebFetch`, browser tools, or curl for the full article/page.
 - **Results quality**: Generally good but less configurable than Firecrawl's search.
 - **Availability**: DuckDuckGo may block requests from some cloud IPs. If searches return empty, try different keywords or wait a few seconds.
 - **Field variability**: Return fields may vary between results or `ddgs` versions. Use `.get()` for optional fields to avoid `KeyError`.
-- **Separate runtimes**: A successful `ddgs` install in terminal does not automatically mean `execute_code` can import it.
+- **Separate runtimes**: A successful `ddgs` install in terminal does not automatically mean `Bash` can import it.
 
 ## Troubleshooting
 
@@ -217,13 +217,13 @@ Then extract the best URL with `web_extract` or another content-retrieval tool.
 | `ddgs: command not found` | CLI not installed in the shell environment | Install `ddgs`, or use built-in web/browser tools instead |
 | `ModuleNotFoundError: No module named 'ddgs'` | Python runtime does not have the package installed | Do not use Python DDGS there until that runtime is prepared |
 | Search returns nothing | Temporary rate limiting or poor query | Wait a few seconds, retry, or adjust the query |
-| CLI works but `execute_code` import fails | Terminal and `execute_code` are different runtimes | Keep using CLI, or separately prepare the Python runtime |
+| CLI works but `Bash` import fails | Terminal and `Bash` are different runtimes | Keep using CLI, or separately prepare the Python runtime |
 
 ## Pitfalls
 
 - **`max_results` is keyword-only**: `ddgs.text("query", 5)` raises an error. Use `ddgs.text("query", max_results=5)`.
 - **Do not assume the CLI exists**: Check `command -v ddgs` before using it.
-- **Do not assume `execute_code` can import `ddgs`**: `from ddgs import DDGS` may fail with `ModuleNotFoundError` unless that runtime was prepared separately.
+- **Do not assume `Bash` can import `ddgs`**: `from ddgs import DDGS` may fail with `ModuleNotFoundError` unless that runtime was prepared separately.
 - **Package name**: The package is `ddgs` (previously `duckduckgo-search`). Install with `pip install ddgs`.
 - **Don't confuse `-q` and `-m`** (CLI): `-q` is for the query, `-m` is for max results count.
 - **Empty results**: If `ddgs` returns nothing, it may be rate-limited. Wait a few seconds and retry.

package/.mindforge/skills/duckduckgo-search/scripts/duckduckgo.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# DuckDuckGo Search Helper Script
+# Wrapper around ddgs CLI with sensible defaults
+# Usage: ./duckduckgo.sh <query> [max_results]
+
+set -e
+
+QUERY="$1"
+MAX_RESULTS="${2:-5}"
+
+if [ -z "$QUERY" ]; then
+    echo "Usage: $0 <query> [max_results]"
+    echo ""
+    echo "Examples:"
+    echo "  $0 'python async programming' 5"
+    echo "  $0 'latest AI news' 10"
+    echo ""
+    echo "Requires: pip install ddgs"
+    exit 1
+fi
+
+# Check if ddgs is available
+if ! command -v ddgs &> /dev/null; then
+    echo "Error: ddgs not found. Install with: pip install ddgs"
+    exit 1
+fi
+
+ddgs text -q "$QUERY" -m "$MAX_RESULTS"

package/.mindforge/skills/environment-management/SKILL.md

@@ -28,7 +28,7 @@ This skill activates when the user is designing or implementing environment mana
 - **Ephemeral Environments:** Short-lived environments created on-demand and destroyed after use. Use for: testing, demos, training, experiments. Include cost cap ($50-$200) and auto-deletion after 7 days of inactivity.
 - **Environment Parity:** Dev, staging, and prod should be as similar as possible. Use same: container images, Terraform modules, network topology, resource sizes (scale down in non-prod, but maintain same architecture). Differ only in: data (synthetic in non-prod), scale (fewer replicas), and external integrations (use mocks in non-prod).
 - **Environment as Code:** All environments defined via IaC (Terraform, CloudFormation, Pulumi). No manual changes in cloud console. Code should be versioned and reviewed via PRs. Use modules to ensure consistency across environments.
-- **Configuration Drift Detection:** Use Terraform plan, CloudFormation drift detection, or Config Sentinel. Run drift detection daily and alert on any manual changes. Automatically remediate drift by reapplying IaC.
+- **Configuration Drift Detection:** Use Terraform plan or CloudFormation drift detection. Run drift detection daily and alert on any manual changes. Automatically remediate drift by reapplying IaC.
 - **Environment Provisioning:** Self-service provisioning via CLI, API, or portal. Provisioning should: validate inputs, estimate cost, apply IaC, seed data, run smoke tests, return URL. Complete in under 10 minutes.
 - **Environment Lifecycle:** Define stages: provisioning → active → idle → scheduled for deletion → deleted. Idle environments (no activity for 3+ days) should be flagged for review. Auto-delete after 7 days idle (with 24-hour warning).
 - **Environment Promotion:** Promote changes from dev → staging → production. Use GitOps workflow: commit to environment-specific branch triggers deployment. Include smoke tests and rollback on failure.

package/.mindforge/skills/github-code-review/SKILL.md

@@ -69,7 +69,7 @@ git diff main...HEAD --stat
 git log main..HEAD --oneline
 ```
 
-2. **Review file by file** — use `read_file` on changed files for full context, and the diff to see what changed:
+2. **Review file by file** — use `Read` on changed files for full context, and the diff to see what changed:
 
 ```bash
 git diff main...HEAD -- src/auth/login.py
@@ -258,7 +258,7 @@ curl -s -X POST \
   -d "{
     \"commit_id\": \"$HEAD_SHA\",
     \"event\": \"COMMENT\",
-    \"body\": \"Code review from 
+    \"body\": \"Automated code review — see inline comments.\",
     \"comments\": [
       {\"path\": \"src/auth.py\", \"line\": 45, \"body\": \"Use parameterized queries to prevent SQL injection.\"},
       {\"path\": \"src/models/user.py\", \"line\": 23, \"body\": \"Hash passwords with bcrypt before storing.\"},
@@ -317,7 +317,7 @@ When the user asks you to "review the code" or "check before pushing":
 
 1. `git diff main...HEAD --stat` — see scope of changes
 2. `git diff main...HEAD` — read the full diff
-3. For each changed file, use `read_file` if you need more context
+3. For each changed file, use `Read` if you need more context
 4. Apply the checklist above
 5. Present findings in the structured format (Critical / Warnings / Suggestions / Looks Good)
 6. If critical issues found, offer to fix them before the user pushes
@@ -331,7 +331,7 @@ When the user asks you to "review PR #N", "look at this PR", or gives you a PR U
 ### Step 1: Set up environment
 
 ```bash
-source "${AGENT_HOME:-$HOME/.agent}/skills/github/github-auth/scripts/gh-env.sh"
+source "${AGENT_HOME:-$HOME/.agent}/skills/github-auth/scripts/gh-env.sh"
 # Or run the inline setup block from the top of this skill
 ```
 
@@ -361,7 +361,7 @@ curl -s -H "Authorization: token $GITHUB_TOKEN" \
 
 ### Step 3: Check out the PR locally
 
-This gives you full access to `read_file`, `search_files`, and the ability to run tests.
+This gives you full access to `Read`, `Grep`, and the ability to run tests.
 
 ```bash
 git fetch origin pull/$PR_NUMBER/head:pr-$PR_NUMBER
@@ -380,7 +380,7 @@ git diff main...HEAD --name-only
 git diff main...HEAD -- path/to/file.py
 ```
 
-For each changed file, use `read_file` to see full context around the changes — diffs alone can miss issues visible only with surrounding code.
+For each changed file, use `Read` to see full context around the changes — diffs alone can miss issues visible only with surrounding code.
 
 ### Step 5: Run automated checks locally (if applicable)
 
@@ -405,7 +405,7 @@ Collect your findings and submit them as a formal review with inline comments.
 **With gh:**
 ```bash
 # If no issues — approve
-gh pr review $PR_NUMBER --approve --body "Reviewed by 
+gh pr review $PR_NUMBER --approve --body "Reviewed — no blocking issues found."
 
 # If issues found — request changes with inline comments
 gh pr review $PR_NUMBER --request-changes --body "Found a few issues — see inline comments."
@@ -424,7 +424,7 @@ curl -s -X POST \
   -d "{
     \"commit_id\": \"$HEAD_SHA\",
     \"event\": \"REQUEST_CHANGES\",
-    \"body\": \"## 
+    \"body\": \"## Code Review — Changes Requested\",
     \"comments\": [
       {\"path\": \"src/auth.py\", \"line\": 45, \"body\": \"🔴 **Critical:** User input passed directly to SQL query — use parameterized queries.\"},
       {\"path\": \"src/models.py\", \"line\": 23, \"body\": \"⚠️ **Warning:** Password stored without hashing.\"},
@@ -458,7 +458,7 @@ gh pr comment $PR_NUMBER --body "$(cat <<'EOF'
 - Good error handling in the middleware layer
 
 ---
-*Reviewed by 
+*Automated code review*
 EOF
 )"
 ```