[cleo] stuff

claude/CLAUDE.md

@@ -5,7 +5,7 @@
 - Anything mentioning Retool refers to `~/Projects/cleo-retool`.
 
 ## Worktrees
-- Never write or edit code in the main checkouts (`~/Projects/cleo-infinite`, `~/Projects/cleo-retool`). Work in a treehouse worktree under `~/.treehouse/<repo>-<hash>/<slot>/<repo>`. Check with `git rev-parse --show-toplevel` and `git worktree list`.
+- Never write or edit code in the main checkouts (`~/Projects/cleo-infinite`, `~/Projects/cleo-retool`). Work in a treehouse worktree under `~/.local/share/treehouse/<repo>-<hash>/<slot>/<repo>`. Check with `git rev-parse --show-toplevel` and `git worktree list`.
 - If code changes are needed and the current directory is not a treehouse worktree, start one yourself without asking first, then continue there. Read-only investigation can stay where it is.
 - Treehouse is a zsh alias for `nix run github:kunchenguid/treehouse --`, so it is not on PATH in non-interactive shells. Run the full `nix run` form, and run it with `--help` first rather than guessing subcommands or flags.
 - Branch names follow the repo's own rules (cleo-infinite: `<JIRA-KEY>-short_slug` from latest `origin/main`). Take the Jira key from the user or the current branch. If there isn't one, ask. Never invent a key.

claude/skills/prod-db/prod-query.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROFILE="prod-mono-reader"
+PROFILE="production.rds-reader"
 REGION="us-east-1"
 DB_USER="reader"
 MAX_ROWS=200

claude/skills/redis/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: redis
+description: >-
+  Inspect Cleo ElastiCache (Valkey/Redis) caches through a local read-only proxy.
+  Use when the user asks to look at, list, or check Redis/Valkey/cache keys,
+  TTLs, sizes, or key counts for a service in dev or prod.
+user-invocable: true
+argument-hint: '[service and question about cache contents]'
+---
+# redis
+
+`~/Projects/redis-proxy/redis-proxy` finds the cluster, reads its AUTH token from SSM, and listens on `127.0.0.1` with no auth. TLS and AUTH happen upstream, so never handle a token or use `rediss://`. Only read commands are forwarded; anything else returns `-ERR redis-proxy: <CMD> blocked (read-only)`.
+
+```sh
+~/Projects/redis-proxy/redis-proxy list --env dev|prod
+~/Projects/redis-proxy/redis-proxy up <name> --env dev|prod [--port 16379] [--primary]   # run with run_in_background
+valkey-cli -p 16379 <command>
+```
+
+Wait for `listening on 127.0.0.1:<port>` in the background output before connecting. Stop the proxy when done. If it reports no SSO session, ask the user to run the `! aws sso login --profile <profile>` command it prints.
+
+## PII/PHI rules (org policy: never put PII/PHI into Claude)
+
+- Prefer `SCAN ... COUNT`, `TYPE`, `TTL`, `STRLEN`, `MEMORY USAGE`, `DBSIZE`, `INFO keyspace` over reading values. Avoid `KEYS`.
+- Key names can contain emails or IDs. Don't repeat a key that looks like an email in output; refer to "the key".
+- In prod, don't `GET`/`HGETALL`/`LRANGE` etc. on keys that look like sessions, users, messages, or profiles unless the user explicitly asks, and then summarize shape (field names, sizes) rather than pasting values.
+- Never read or print the SSM token.
+
+## Notes
+
+- The proxy uses the reader endpoint by default; `--primary` switches. Dev can pass `--allow-writes`; prod refuses it.
+- Default port is 16379. Pass `--port` to run several proxies side by side.
+- Logs show blocked command names only.