cleanup-guid-projects

name	cleanup-guid-projects
description	Bulk-delete ephemeral test projects on a Hydrolix cluster (default pattern `bundle_verification_*`, produced by the Rust validator's `--guid` flag). Lists matching projects, confirms with the user, then deletes sequentially. Use when the user wants to clean up leftover GUID test projects, or projects matching a name prefix, on a cluster.
user-invocable	true

Cleanup GUID Test Projects

Bulk-deletes Hydrolix projects whose names match a prefix on a Hydrolix cluster. Built for cleaning up the ephemeral bundle_verification_<suffix> projects produced by cargo run -- --local --guid, but the prefix is configurable.

When to use

• User says they've accumulated a pile of bundle_verification_* projects from local --guid runs.
• User wants to bulk-delete any set of projects on a cluster by name prefix.
• Any variant: "clean up test projects", "delete the guid projects", "bulk delete projects on demo".

If the user only wants to delete ONE project, defer to cargo run --bin cleanup -- --project <name> instead — no need for this skill.

Phase 1: Gather inputs

Collect these values — use defaults when the user doesn't override:

Input	Default	Notes
Prefix	bundle_verification_	Only projects whose .name starts with this prefix are candidates.
Cluster	$BUNDLE_TESTING_CLUSTER env var	Hostname without scheme (e.g., demo.aws.hydrolix.live).
Username	$BUNDLE_TESTING_USERNAME
Password	$BUNDLE_TESTING_PASSWORD	Never write to disk.
Org UUID	2b8cbbf8-dcb8-4c28-bd94-cb46147296d1 (demo.aws.hydrolix.live)	Only correct for demo cluster. For other clusters, discover via GET /config/v1/orgs/.
--force	off	If set, skip the confirmation prompt. Only pass when the user explicitly asked for non-interactive mode.

If any env var is unset, ask the user.

How to carry state across Bash calls

Each Bash tool call runs in a fresh shell — $TOKEN and other variables set in one call do NOT survive to the next. Do not work around this by writing the token to a file (that violates the security rule below).

The right pattern: re-authenticate at the top of any Bash call that needs the token. Auth is ~1s and idempotent. Concretely:

• Combine Phase 2 (auth) + Phase 3 (list) into a single Bash call so $TOKEN is in scope for both.
• Phase 5 (delete) is its own Bash call — re-auth from $BUNDLE_TESTING_USERNAME / $BUNDLE_TESTING_PASSWORD at the top.
• Phase 6 (verify) can either run in the same call as Phase 5 (preferred) or re-auth.

The TSV at /tmp/cleanup_targets.tsv is fine to leave on disk between calls — it only contains public project names + UUIDs.

Phase 2: Authenticate

TOKEN=$(curl -sf --max-time 30 -X POST "https://${CLUSTER}/config/v1/login" \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"${BUNDLE_TESTING_USERNAME}\",\"password\":\"${BUNDLE_TESTING_PASSWORD}\"}" \
  | jq -r '.auth_token.access_token')

Verify $TOKEN is non-empty and not null. If auth fails, stop and show the error.

If the user's cluster is not demo.aws.hydrolix.live, discover the org UUID:

curl -sf --max-time 15 -H "Authorization: Bearer $TOKEN" \
  "https://${CLUSTER}/config/v1/orgs/" | jq -r '.[0].uuid'

If multiple orgs, ask which to use.

Phase 3: List matching projects

curl -sf --max-time 15 -H "Authorization: Bearer $TOKEN" \
  "https://${CLUSTER}/config/v1/orgs/${ORG_UUID}/projects/" \
  | jq -r --arg p "$PREFIX" '(.results // .) | .[] | select(.name | startswith($p)) | "\(.name)\t\(.uuid)"' \
  > /tmp/cleanup_targets.tsv
TOTAL=$(wc -l < /tmp/cleanup_targets.tsv | tr -d ' ')

Handle both response shapes: top-level array or {results: [...]}.

Show the user the count and the first ~20 names. Full list is in /tmp/cleanup_targets.tsv.

If TOTAL == 0, stop and tell the user there's nothing to delete.

Phase 4: Confirm (unless --force)

Print the cluster name, the prefix, the count, and the exact endpoint that will be used (DELETE https://${CLUSTER}/config/v1/orgs/${ORG_UUID}/projects/<uuid>). Ask the user to say proceed before deleting. This is destructive and affects shared cluster state.

Skip this prompt only if the user explicitly asked for --force or a non-interactive run.

Phase 5: Delete sequentially

Use this exact loop pattern — while IFS=$'\t' read -r ... < file with curl --max-time 60. Do NOT use cat file | xargs -P N bash -c '...' or process substitution < <(...) — those patterns hang silently inside the Bash tool for 10+ minutes with zero output (see memory/feedback_bash_loop_patterns.md).

The snippet re-authenticates at the top so it's self-contained and the token never has to cross Bash invocations:

TOKEN=$(curl -sf --max-time 30 -X POST "https://${BUNDLE_TESTING_CLUSTER}/config/v1/login" \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"${BUNDLE_TESTING_USERNAME}\",\"password\":\"${BUNDLE_TESTING_PASSWORD}\"}" \
  | jq -r '.auth_token.access_token')
[ -z "$TOKEN" ] || [ "$TOKEN" = "null" ] && { echo "AUTH FAILED"; exit 1; }
TOTAL=$(wc -l < /tmp/cleanup_targets.tsv | tr -d ' ')

OK=0; FAIL=0; i=0
while IFS=$'\t' read -r NAME UUID; do
  i=$((i+1))
  code=$(curl -s --max-time 60 -o /dev/null -w '%{http_code}' \
    -X DELETE -H "Authorization: Bearer $TOKEN" \
    "https://${CLUSTER}/config/v1/orgs/${ORG_UUID}/projects/${UUID}")
  case "$code" in
    204|200) printf "[%2d/%d] ✓ %s\n" "$i" "$TOTAL" "$NAME"; OK=$((OK+1));;
    404)     printf "[%2d/%d] — %s (already gone)\n" "$i" "$TOTAL" "$NAME"; OK=$((OK+1));;
    *)       printf "[%2d/%d] ✗ %s HTTP=%s\n" "$i" "$TOTAL" "$NAME" "$code"; FAIL=$((FAIL+1));;
  esac
done < /tmp/cleanup_targets.tsv
echo "summary: ${OK}/${TOTAL} deleted, ${FAIL} failed"

Timing: one delete is typically ~1s, so 50 projects ≈ under a minute. If the loop slows noticeably (many 5s+ deletes), the cluster may be cascade-deleting large tables — let it finish.

Phase 6: Verify

Re-query the cluster and assert the count is zero:

curl -sf --max-time 15 -H "Authorization: Bearer $TOKEN" \
  "https://${CLUSTER}/config/v1/orgs/${ORG_UUID}/projects/" \
  | jq -r --arg p "$PREFIX" '(.results // .) | .[] | select(.name | startswith($p)) | .name' | wc -l

If non-zero, report which names remain and suggest re-running.

Error handling

Error	Behavior
Auth failure	Stop immediately, show response body.
List API failure	Stop — don't guess the project list.
404 on DELETE	Count as success (project already gone).
5xx or network timeout on DELETE	Log, mark failed, continue with next.
5+ consecutive failures	Stop and report — the cluster may be down.

Security

• Never write BUNDLE_TESTING_PASSWORD or $TOKEN to disk. If you need the token in a later Bash call, re-authenticate (see "How to carry state across Bash calls" above) — auth is ~1s and idempotent, there's no reason to persist the token.
• Use curl -s (silent) so progress output doesn't leak headers.
• The target list TSV only contains public project names + UUIDs — safe to keep in /tmp.

Why not just cargo run --bin cleanup -- --project <name> in a loop?

That works for a handful, but (a) re-authenticates each iteration and (b) rebuilds aren't the bottleneck but each invocation has startup overhead. For N>5 this skill is faster and shows unified progress. For one project, prefer the Rust binary.