fix: restore CI clean install and canonical registration

Author: Aitomates

docs/operator-testing.md

@@ -0,0 +1,141 @@
+# Operator Testing Guide
+
+Use this guide to verify PromptImprover from a clean Windows operator session.
+
+## 1. Enter The Active Package
+
+```powershell
+cd C:\PersonalRepo\portfolio\Promptimprover\universal-refiner
+```
+
+## 2. Run The Full Release Gate
+
+```powershell
+npm.cmd run release:verify
+```
+
+Expected result:
+
+- TypeScript build passes.
+- Vitest coverage reports 100% statements, branches, functions, and lines.
+- MCP tool acceptance passes.
+- Semantic fallback acceptance passes.
+- Tracked-turn acceptance links a `prm_...` prompt ID in SQLite.
+- EventStore stress, abrupt recovery, and soak pass.
+- Production and full dependency audits report zero high-or-higher vulnerabilities.
+- Secret scan passes.
+- Package dry-run passes.
+- `acceptance:package-runtime` installs the packed tarball into a temporary global prefix and serves `/api/health`.
+
+## 3. Check Global MCP Registration
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\register-global.ps1 -Check -ProfileRoot C:\Users\KimHarjamaki -CodexHome C:\codex-home
+```
+
+Expected result:
+
+```text
+OK      Codex
+OK      Claude Code MCP
+OK      Claude Code hooks
+OK      Gemini
+```
+
+If any row reports `DRIFT`, run `-Apply` only after confirming the drift is expected:
+
+```powershell
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\register-global.ps1 -Apply -ProfileRoot C:\Users\KimHarjamaki -CodexHome C:\codex-home
+```
+
+## 4. List MCP Servers In Each CLI
+
+```powershell
+codex.cmd mcp list | Select-String -Pattern 'prompt-refiner|obsidian|Connected|enabled'
+claude.cmd mcp list | Select-String -Pattern 'prompt-refiner|obsidian|Connected|Configured'
+gemini.cmd mcp list | Select-String -Pattern 'prompt-refiner|obsidian|Connected|Configured'
+```
+
+Expected result:
+
+- Codex lists `prompt-refiner` and `obsidian` as enabled.
+- Claude lists `prompt-refiner` and `obsidian` as connected.
+- Gemini lists `prompt-refiner` and `obsidian` as connected.
+
+Codex may show `Unsupported` in the status column for stdio MCP entries. Treat the registration doctor as the authoritative config drift check.
+
+## 5. Verify Dashboard Runtime Health
+
+Start or restart the local background runtime:
+
+```powershell
+$repo = 'C:\PersonalRepo\portfolio\Promptimprover\universal-refiner'
+Get-CimInstance Win32_Process |
+  Where-Object { $_.Name -eq 'node.exe' -and ($_.CommandLine -match 'universal-refiner.*dist/src/index.js' -or $_.CommandLine -match 'universal-refiner.*dist\\src\\index.js') } |
+  ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
+
+$env:PROMPT_REFINER_BACKGROUND = 'true'
+Start-Process -WindowStyle Hidden -FilePath node -ArgumentList (Join-Path $repo 'dist\src\index.js') -WorkingDirectory $repo
+```
+
+Check health:
+
+```powershell
+Invoke-RestMethod http://127.0.0.1:3000/api/health | ConvertTo-Json -Depth 6
+```
+
+Expected result:
+
+- `runtime.status` is `online`.
+- `semantic.local.enabled` is `true`.
+- `semantic.local.models` includes `gemma3:12b` and `gemma3:1b`.
+
+## 6. Verify Live Gemma Integration
+
+```powershell
+$env:PROMPT_REFINER_ACCEPTANCE_BASE_URL = 'http://localhost:9000/v1'
+npm.cmd run acceptance:gemma:live
+```
+
+Expected result:
+
+```text
+Live semantic acceptance passed for gemma3:12b and gemma3:1b at http://localhost:9000/v1.
+Semantic acceptance passed: gemma3:12b -> gemma3:1b and outage provider fallback.
+```
+
+Warnings such as `HTTP 503` for `gemma3:12b` and `fetch failed` during the outage section are expected. They prove fallback and outage paths are being exercised. The command must still exit successfully.
+
+## 7. Verify Packaged Runtime Directly
+
+```powershell
+npm.cmd run acceptance:package-runtime
+```
+
+Expected result:
+
+```text
+Package runtime smoke passed: installed gemini-prompt-refiner-8.0.0 and served /api/health on <port>.
+```
+
+This catches missing production dependencies that are hidden by the local workspace.
+
+## 8. Confirm GitHub CI
+
+After pushing a branch and opening a pull request:
+
+```powershell
+gh pr checks <PR_NUMBER> --repo Coding-Autopilot-System/Promptimprover
+gh run list --repo Coding-Autopilot-System/Promptimprover --branch <BRANCH_NAME> --limit 10
+```
+
+Expected result:
+
+- `build-and-test` passes.
+- Both acceptance matrix jobs pass.
+- `stress` passes.
+- `windows` passes.
+- `supply-chain` passes.
+- `release-gate` passes.
+
+Remote CI is the authoritative proof for Linux and Windows clean-checkout behavior.

universal-refiner/package-lock.json

@@ -2,7 +2,7 @@
 param(
     [switch]$Check,
     [switch]$Apply,
-    [string]$ProfileRoot = ("C:\Users\KimHarjam{0}ki" -f [char]0x00E4),
+    [string]$ProfileRoot = "C:\Users\KimHarjamaki",
     [string]$CodexHome,
     [string]$ObsidianVaultPath = "C:\repo\global.obsidian"
 )

universal-refiner/register-global.ps1

@@ -2,7 +2,7 @@
 param(
     [switch]$Check,
     [switch]$Apply,
-    [string]$ProfileRoot = ("C:\Users\KimHarjam{0}ki" -f [char]0x00E4),
+    [string]$ProfileRoot = "C:\Users\KimHarjamaki",
     [string]$CodexHome,
     [string]$ObsidianVaultPath = "C:\repo\global.obsidian"
 )

universal-refiner/scripts/operations/register-global.ps1

@@ -6,10 +6,18 @@ const PATTERNS = [
   { name: "OpenAI API key", expression: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
   { name: "Azure storage connection string", expression: /\bDefaultEndpointsProtocol=https?;AccountName=[^;\s]+;AccountKey=[^;\s]+/gi },
   { name: "Private key", expression: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g },
+  {
+    name: "Credential assignment",
+    expression: /\b(?:authorization|password|passwd|pwd|secret|client[_-]?secret|access[_-]?token|refresh[_-]?token|api[_-]?key|x-api-key|private[_-]?key|connection[_-]?string|accountkey|sig|token|aws[_-]?(?:access[_-]?key[_-]?id|secret[_-]?access[_-]?key)|azure[_-]?client[_-]?secret|openai[_-]?api[_-]?key|github[_-]?token|gitlab[_-]?token|database[_-]?url|redis[_-]?url)\b\s*[:=]\s*(?:(["'])[^"'\r\n]{8,}\1|[A-Za-z0-9._~+/=-]{16,})/gi,
+  },
+  {
+    name: "URL embedded credential",
+    expression: /\b[a-z][a-z0-9+.-]*:\/\/(?:[^/\s:@]+:[^@\s]+@|[^\s?#]+[?&](?:password|secret|client[_-]?secret|access[_-]?token|refresh[_-]?token|api[_-]?key|x-api-key|accountkey|sig|token)=)/gi,
+  },
 ];
 
 const ALLOWED_FIXTURE_MARKER = "secret-scan: allow-fixture";
-const files = execFileSync("git", ["ls-files", "-z"], { encoding: "utf8" })
+const files = execFileSync("git", ["ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" })
   .split("\0")
   .filter(Boolean);
 const findings = [];
@@ -34,4 +42,4 @@ if (findings.length > 0) {
   process.exit(1);
 }
 
-console.log(`Secret scan passed for ${files.length} tracked files.`);
+console.log(`Secret scan passed for ${files.length} tracked and untracked non-ignored files.`);

universal-refiner/scripts/security/scan-secrets.mjs

@@ -1,3 +1,4 @@
+// secret-scan: allow-fixture
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import * as fs from "fs";
 import * as os from "os";

universal-refiner/tests/dashboard-api.test.ts

@@ -1,3 +1,4 @@
+// secret-scan: allow-fixture
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import * as fs from "node:fs";
 import * as os from "node:os";

universal-refiner/tests/dashboard-events.test.ts

@@ -1,3 +1,4 @@
+// secret-scan: allow-fixture
 import { afterEach, describe, expect, it } from "vitest";
 import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";

universal-refiner/tests/register-global.test.ts

@@ -1,3 +1,4 @@
+// secret-scan: allow-fixture
 import { describe, it, expect, beforeEach, afterEach } from "vitest";
 import * as fs from "fs";
 import * as path from "path";