[cleo] stuff

claude/skills/prod-db/prod-query.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROFILE="prod-mono-reader"
+PROFILE="production.rds-reader"
 REGION="us-east-1"
 DB_USER="reader"
 MAX_ROWS=200

claude/skills/redis/SKILL.md

@@ -0,0 +1,33 @@
+---
+name: redis
+description: >-
+  Inspect Cleo ElastiCache (Valkey/Redis) caches through a local read-only proxy.
+  Use when the user asks to look at, list, or check Redis/Valkey/cache keys,
+  TTLs, sizes, or key counts for a service in dev or prod.
+user-invocable: true
+argument-hint: '[service and question about cache contents]'
+---
+# redis
+
+`~/Projects/redis-proxy/redis-proxy` finds the cluster, reads its AUTH token from SSM, and listens on `127.0.0.1` with no auth. TLS and AUTH happen upstream, so never handle a token or use `rediss://`. Only read commands are forwarded; anything else returns `-ERR redis-proxy: <CMD> blocked (read-only)`.
+
+```sh
+~/Projects/redis-proxy/redis-proxy list --env dev|prod
+~/Projects/redis-proxy/redis-proxy up <name> --env dev|prod [--port 16379] [--primary]   # run with run_in_background
+valkey-cli -p 16379 <command>
+```
+
+Wait for `listening on 127.0.0.1:<port>` in the background output before connecting. Stop the proxy when done. If it reports no SSO session, ask the user to run the `! aws sso login --profile <profile>` command it prints.
+
+## PII/PHI rules (org policy: never put PII/PHI into Claude)
+
+- Prefer `SCAN ... COUNT`, `TYPE`, `TTL`, `STRLEN`, `MEMORY USAGE`, `DBSIZE`, `INFO keyspace` over reading values. Avoid `KEYS`.
+- Key names can contain emails or IDs. Don't repeat a key that looks like an email in output; refer to "the key".
+- In prod, don't `GET`/`HGETALL`/`LRANGE` etc. on keys that look like sessions, users, messages, or profiles unless the user explicitly asks, and then summarize shape (field names, sizes) rather than pasting values.
+- Never read or print the SSM token.
+
+## Notes
+
+- The proxy uses the reader endpoint by default; `--primary` switches. Dev can pass `--allow-writes`; prod refuses it.
+- Default port is 16379. Pass `--port` to run several proxies side by side.
+- Logs show blocked command names only.