@1aboveio/skills 1.0.6 → 1.0.8

package/skills/app-dev/android-foundation/scripts/device-run.test.mjs

@@ -1,18 +1,31 @@
-// device-run.sh against stand-in emulator, adb and docker binaries: the cleanup
-// owns exactly what the run started, keeps the stage's status, and treats a
-// stalled command as terminal.
+// Run the real shell lifecycle against fake external executables, never a device
+// or container daemon. Every fixture records its own processes for test cleanup.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { spawn, spawnSync } from 'node:child_process';
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, existsSync, rmSync } from 'node:fs';
 import { createServer } from 'node:net';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { setTimeout as delay } from 'node:timers/promises';
 
-const SCRIPT = join(dirname(fileURLToPath(import.meta.url)), 'device-run.sh');
+const SCRIPT = process.env.DEVICE_RUN_SCRIPT ?? join(dirname(fileURLToPath(import.meta.url)), 'device-run.sh');
 
-async function fakeHost() {
+function alive(pid) {
+  const r = spawnSync('ps', ['-o', 'stat=', '-p', String(pid)], { encoding: 'utf8' });
+  return r.status === 0 && r.stdout.trim() !== '' && !r.stdout.trim().startsWith('Z');
+}
+
+async function until(check, message, milliseconds = 5000) {
+  const end = Date.now() + milliseconds;
+  while (!check()) {
+    assert.ok(Date.now() < end, message);
+    await delay(20);
+  }
+}
+
+async function fakeHost(t) {
   const root = mkdtempSync(join(tmpdir(), 'device-run-'));
   const bin = join(root, 'bin');
   const sdk = join(root, 'sdk');
@@ -20,31 +33,72 @@ async function fakeHost() {
   mkdirSync(join(sdk, 'emulator'), { recursive: true });
   const log = join(root, 'calls.log');
   writeFileSync(log, '');
+  const pids = () => existsSync(join(root, 'pids'))
+    ? readFileSync(join(root, 'pids'), 'utf8').trim().split('\n').filter(Boolean).map((line) => Number(line.split(' ')[1])) : [];
+  t.after(() => {
+    for (const pid of pids()) {
+      if (alive(pid)) { try { process.kill(pid, 'SIGKILL'); } catch {} }
+    }
+    rmSync(root, { recursive: true, force: true });
+  });
   const tool = (path, body) => {
     writeFileSync(path, `#!/usr/bin/env bash\necho "$(basename "$0") $*" >> "$FAKE_LOG"\n${body}\n`);
     chmodSync(path, 0o755);
   };
+  writeFileSync(join(bin, 'worker'), `#!/usr/bin/env python3
+import os, signal, sys, time
+label = sys.argv[1]
+root = os.environ['FAKE_ROOT']
+def record(name):
+    with open(root + '/pids', 'a') as f: f.write('%s %s\\n' % (name, os.getpid()))
+record(label)
+if label in ('startup', 'journey', 'emulator-tree'):
+    pid = os.fork()
+    if pid == 0:
+        signal.signal(signal.SIGTERM, signal.SIG_IGN)
+        record(label + '-child')
+        open(root + '/' + label + '-child-ready', 'w').close()
+        while True: time.sleep(1)
+    while not os.path.exists(root + '/' + label + '-child-ready'): time.sleep(0.01)
+if label == 'emulator-tree':
+    open(root + '/emulator-ready', 'w').close()
+    while not os.path.exists(root + '/release-emulator'): time.sleep(0.01)
+    sys.exit(0)
+if os.environ.get('FAKE_EMULATOR_IGNORES_TERM') and label == 'emulator':
+    signal.signal(signal.SIGTERM, signal.SIG_IGN)
+open(root + '/' + label + '-ready', 'w').close()
+while True: time.sleep(1)
+`);
+  chmodSync(join(bin, 'worker'), 0o755);
   tool(join(sdk, 'emulator', 'emulator'), `
-if test -n "\${FAKE_EMULATOR_IGNORES_TERM:-}"; then trap '' TERM; fi
-while :; do sleep 0.1; done`);
+if test -n "\${FAKE_EMULATOR_TREE:-}"; then exec worker emulator-tree; fi
+exec worker emulator`);
   tool(join(bin, 'adb'), `
+printf 'adb-env %s %s\\n' "\${ADB_SERVER_SOCKET:-}" "\${ANDROID_SERIAL:-}" >> "$FAKE_LOG"
 case "$*" in
-  start-server) exit 0 ;;
-  *getprop*) if test -n "\${FAKE_ADB_HANG:-}"; then sleep 30; fi; echo 1 ;;
+  start-server)
+    if test -n "\${FAKE_ADB_START_HANG:-}"; then exec worker startup; fi
+    if test -n "\${FAKE_ADB_START_SIGNAL:-}"; then kill -TERM $$; fi
+    exit 0 ;;
+  *getprop*) if test -n "\${FAKE_ADB_HANG:-}"; then exec worker probe; fi; echo 1 ;;
 esac`);
   tool(join(bin, 'docker'), `
 case "$1" in
-  run) while test $# -gt 0; do if test "$1" = --cidfile; then echo fakecid42 > "$2"; fi; shift; done; echo fakecid42 ;;
+  run)
+    while test $# -gt 0; do
+      if test "$1" = --cidfile && test -z "\${FAKE_NO_CID:-}"; then echo fakecid42 > "$2"; fi
+      shift
+    done
+    if test -n "\${FAKE_DOCKER_RUN_HANG:-}"; then exec worker startup; fi
+    echo fakecid42 ;;
   port) echo 127.0.0.1:55432 ;;
   exec) exit 0 ;;
-  rm) exit 0 ;;
-  ps) exit 0 ;;
+  rm) if test -n "\${FAKE_RM_HANG:-}"; then exec worker remove; fi; exit 0 ;;
+  ps) if test -n "\${FAKE_CONTAINER_REMAINS:-}"; then echo fakecid42; fi; exit 0 ;;
 esac`);
-  return { root, bin, sdk, log, ports: await hostPorts() };
+  return { root, bin, sdk, log, pids, ports: await hostPorts() };
 }
 
-// Runners share the host network, so every port this suite hands the script is one the
-// OS reports free right now, never a fixed number another job may already hold.
 function listen(port) {
   return new Promise((resolve, reject) => {
     const server = createServer();
@@ -64,7 +118,8 @@ async function freeEmulatorPort() {
   for (let port = 5554; port <= 5584; port += 2) {
     const held = [];
     try {
-      held.push(await listen(port), await listen(port + 1));
+      held.push(await listen(port));
+      held.push(await listen(port + 1));
       return port;
     } catch {
       // taken; try the next pair
@@ -83,90 +138,299 @@ async function hostPorts() {
   };
 }
 
-function run(host, { journey = ['bash', '-c', 'exit 0'], env = {} } = {}) {
-  const drop = ['bash', '-c', 'echo "drop $SHARD_DB_NAME $SHARD_ADMIN_URL" >> "$FAKE_LOG"'];
-  const result = spawnSync('bash', [SCRIPT, '--drop', ...drop, '--', ...journey], {
+async function run(host, { journey = ['bash', '-c', 'exit 0'], drop, env = {}, signalAt, input = '' } = {}) {
+  drop ??= ['bash', '-c', 'echo "drop $SHARD_DB_NAME $SHARD_ADMIN_URL" >> "$FAKE_LOG"'];
+  const child = spawn('bash', [SCRIPT, '--drop', ...drop, '--', ...journey], {
     cwd: host.root,
-    encoding: 'utf8',
-    timeout: 60_000,
+    detached: true,
     env: {
       PATH: `${host.bin}:${process.env.PATH}`,
       TMPDIR: host.root,
       FAKE_LOG: host.log,
+      FAKE_ROOT: host.root,
       ANDROID_HOME: host.sdk,
       SETUP_AVD: 'Test_Phone',
       ...host.ports,
       DB_NAME_PREFIX: 'app_e2e_',
-      KILL_GRACE_SECONDS: '2',
-      BOUNDED_SECONDS: '5',
+      KILL_GRACE_SECONDS: '1',
+      BOUNDED_SECONDS: '2',
       ...env,
     },
   });
-  return { ...result, calls: readFileSync(host.log, 'utf8') };
+  child.stdin.end(input);
+  let stdout = '', stderr = '';
+  child.stdout.on('data', (chunk) => { stdout += chunk; });
+  child.stderr.on('data', (chunk) => { stderr += chunk; });
+  let expired = false;
+  const timer = setTimeout(() => {
+    expired = true;
+    try { process.kill(-child.pid, 'SIGKILL'); } catch {}
+    for (const pid of host.pids()) { try { process.kill(pid, 'SIGKILL'); } catch {} }
+  }, 12_000);
+  const closed = new Promise((resolve) => child.once('close', (status, signal) => resolve({ status, signal })));
+  try {
+    if (signalAt) {
+      await until(() => existsSync(join(host.root, signalAt)), `never reached ${signalAt}`);
+      child.kill('SIGTERM'); // Signal only the launcher, as an external caller does.
+    }
+    const result = await closed;
+    const emulatorLog = join(host.root, '.cache/logs/emulator.log');
+    return { ...result, stdout, stderr: stderr + (existsSync(emulatorLog) ? readFileSync(emulatorLog, 'utf8') : ''), expired, calls: readFileSync(host.log, 'utf8') };
+  } finally {
+    clearTimeout(timer);
+    if (child.exitCode === null && child.signalCode === null) {
+      try { process.kill(-child.pid, 'SIGKILL'); } catch {}
+    }
+  }
+}
+
+async function stopped(host) {
+  await until(() => host.pids().every((pid) => !alive(pid)), 'owned descendants survived cleanup', 1500);
+}
+
+function outcome(r, original, cleanup) {
+  assert.equal(r.expired, false, `test safety deadline fired: ${r.stderr}`);
+  assert.equal(r.status, original || cleanup, r.stderr);
+  assert.match(r.stdout, new RegExp(`original_stage_exit=${original} cleanup_exit=${cleanup}\\n$`), r.stderr);
 }
 
-test('a passing journey cleans up everything it started and exits 0', async () => {
-  const host = await fakeHost();
+test('a passing journey cleans up everything it started and exits 0', async (t) => {
+  const host = await fakeHost(t);
   const marker = join(host.root, 'journey ran.txt');
-  const r = run(host, { journey: ['bash', '-c', 'echo "$ANDROID_EMULATOR_SERIAL $SHARD_DB_NAME" > "$1"', 'journey', marker] });
-  assert.equal(r.status, 0, r.stderr);
-  assert.match(r.stdout, /original_stage_exit=0 cleanup_exit=0\n$/);
+  const r = await run(host, { journey: ['bash', '-c', 'echo "$ANDROID_EMULATOR_SERIAL $SHARD_DB_NAME" > "$1"', 'journey', marker] });
+  outcome(r, 0, 0);
   const port = host.ports.EMULATOR_PORT;
   assert.match(readFileSync(marker, 'utf8'), new RegExp(`^emulator-${port} app_e2e_\\d+_\\d+\\n$`));
-  assert.match(r.calls, /^adb start-server$/m);
   assert.ok(r.calls.indexOf('adb start-server') < r.calls.indexOf(`emulator -avd Test_Phone -port ${port}`));
   assert.match(r.calls, new RegExp(`^emulator -avd Test_Phone -port ${port} -memory 4096 `, 'm'));
   assert.match(r.calls, /^drop app_e2e_\d+_\d+ postgresql:\/\/postgres:postgres@127\.0\.0\.1:55432\/postgres$/m);
   assert.match(r.calls, /^docker rm --force fakecid42$/m);
+  await stopped(host);
 });
 
-test('a failing journey keeps its status and still cleans up', async () => {
-  const host = await fakeHost();
-  const r = run(host, { journey: ['bash', '-c', 'exit 42'] });
-  assert.equal(r.status, 42);
-  assert.match(r.stdout, /original_stage_exit=42 cleanup_exit=0/);
+test('a failing journey keeps its status and still cleans up', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, { journey: ['bash', '-c', 'exit 42'] });
+  outcome(r, 42, 0);
   assert.match(r.calls, /^drop app_e2e_/m);
   assert.match(r.calls, /^docker rm --force fakecid42$/m);
 });
 
-test('an emulator that ignores TERM is killed and reported as a cleanup failure', async () => {
-  const host = await fakeHost();
-  const r = run(host, { env: { FAKE_EMULATOR_IGNORES_TERM: '1' } });
-  assert.equal(r.status, 1);
-  assert.match(r.stdout, /original_stage_exit=0 cleanup_exit=1/);
+test('an emulator that ignores TERM is killed and reported as a cleanup failure', async (t) => {
+  const host = await fakeHost(t);
+  // Wait for the fake to install its handler, not an assumed startup delay.
+  const r = await run(host, { env: { FAKE_EMULATOR_IGNORES_TERM: '1' }, journey: ['bash', '-c', 'while ! test -e "$FAKE_ROOT/emulator-ready"; do sleep 0.02; done'] });
+  outcome(r, 0, 1);
   assert.match(r.calls, /^docker rm --force fakecid42$/m);
+  await stopped(host);
 });
 
-test('a stalled readiness probe ends the run with 124 and no journey', async () => {
-  const host = await fakeHost();
+test('a stalled readiness probe ends the run with 124 and no journey', async (t) => {
+  const host = await fakeHost(t);
   const marker = join(host.root, 'journey-ran');
-  const started = Date.now();
-  const r = run(host, { journey: ['touch', marker], env: { FAKE_ADB_HANG: '1', BOUNDED_SECONDS: '1' } });
-  assert.equal(r.status, 124);
-  assert.ok(Date.now() - started < 15_000, 'the deadline must not wait for the stalled command\'s children');
-  assert.match(r.stdout, /original_stage_exit=124 cleanup_exit=0/);
+  const r = await run(host, { journey: ['touch', marker], env: { FAKE_ADB_HANG: '1', BOUNDED_SECONDS: '0.5' } });
+  outcome(r, 124, 0);
   assert.equal(existsSync(marker), false);
-  assert.doesNotMatch(r.calls, /^drop /m, 'no database was handed to the harness, so none is dropped');
+  assert.doesNotMatch(r.calls, /^drop /m);
   assert.match(r.calls, /^docker rm --force fakecid42$/m);
+  await stopped(host);
 });
 
-test('a busy port stops the run before anything starts', async () => {
-  const host = await fakeHost();
+test('a busy port stops the run before anything starts', async (t) => {
+  const host = await fakeHost(t);
   const server = await listen(Number(host.ports.ANDROID_BACKEND_PORT));
   try {
-    const r = run(host);
+    const r = await run(host);
     assert.notEqual(r.status, 0);
     assert.match(r.stdout, /cleanup_exit=0/);
-    assert.doesNotMatch(r.calls, /emulator -avd|docker run/);
+    assert.equal(r.calls, '');
   } finally {
-    server.close();
+    await new Promise((resolve) => server.close(resolve));
   }
 });
 
-test('an emulator port outside the range adb scans is refused', async () => {
-  const host = await fakeHost();
-  const r = run(host, { env: { EMULATOR_PORT: '5588' } });
+test('an emulator port outside the range adb scans is refused', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, { env: { EMULATOR_PORT: '5588' } });
   assert.equal(r.status, 2);
   assert.match(r.stderr, /even port in 5554-5584/);
   assert.equal(r.calls, '');
 });
+
+test('a timed out docker startup removes its recorded CID and kills descendants', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, { env: { FAKE_DOCKER_RUN_HANG: '1', BOUNDED_SECONDS: '0.5' } });
+  outcome(r, 124, 0);
+  assert.match(r.calls, /^docker rm --force fakecid42$/m);
+  assert.doesNotMatch(r.calls, /^drop /m);
+  await stopped(host);
+});
+
+for (const stage of ['startup', 'journey']) {
+  test(`SIGTERM during ${stage} stops descendants and preserves 143`, async (t) => {
+    const host = await fakeHost(t);
+    const r = await run(host, {
+      signalAt: `${stage}-ready`,
+      journey: ['worker', 'journey'],
+      env: stage === 'startup' ? { FAKE_DOCKER_RUN_HANG: '1', BOUNDED_SECONDS: '8' } : {},
+    });
+    outcome(r, 143, 0);
+    assert.match(r.calls, /^docker rm --force fakecid42$/m);
+    if (stage === 'journey') assert.match(r.calls, /^drop /m);
+    else assert.doesNotMatch(r.calls, /^drop /m);
+    await stopped(host);
+  });
+}
+
+test('a journey deadline kills its whole process group and still drops the database', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, { journey: ['worker', 'journey'], env: { JOURNEY_SECONDS: '0.5' } });
+  outcome(r, 124, 0);
+  assert.match(r.calls, /^drop /m);
+  assert.match(r.calls, /^docker rm --force fakecid42$/m);
+  await stopped(host);
+});
+
+test('an emulator descendant is removed even after the emulator leader exits', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, {
+    env: { FAKE_EMULATOR_TREE: '1' },
+    journey: ['bash', '-c', 'while ! test -e "$FAKE_ROOT/emulator-ready"; do sleep 0.02; done; touch "$FAKE_ROOT/release-emulator"'],
+  });
+  assert.equal(r.expired, false);
+  await stopped(host);
+  outcome(r, 0, 1); // A descendant that requires KILL is a cleanup failure.
+});
+
+test('cleanup timeouts do not replace an original failure or skip remaining cleanup', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, {
+    journey: ['bash', '-c', 'exit 42'], drop: ['worker', 'drop'],
+    env: { FAKE_RM_HANG: '1', BOUNDED_SECONDS: '0.5' },
+  });
+  outcome(r, 42, 1);
+  assert.match(r.calls, /^docker rm --force fakecid42$/m);
+  assert.match(r.calls, /^docker ps /m);
+  await stopped(host);
+});
+
+test('a command killed by a signal keeps the shell signal status', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, { journey: ['bash', '-c', 'kill -TERM $$'] });
+  outcome(r, 143, 0);
+});
+
+test('a missing journey executable keeps shell status 127', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, { journey: [join(host.root, 'missing')] });
+  outcome(r, 127, 0);
+  assert.match(r.calls, /^drop /m);
+  assert.match(r.calls, /^docker rm --force fakecid42$/m);
+});
+
+test('a non-executable journey keeps shell status 126', async (t) => {
+  const host = await fakeHost(t);
+  const path = join(host.root, 'not executable');
+  writeFileSync(path, '#!/bin/sh\nexit 0\n');
+  const r = await run(host, { journey: [path] });
+  outcome(r, 126, 0);
+});
+
+test('a signal-ended startup command preserves shell status 143', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, { env: { FAKE_ADB_START_SIGNAL: '1' } });
+  outcome(r, 143, 0);
+  assert.doesNotMatch(r.calls, /emulator -avd|docker run/);
+});
+
+test('an unacknowledged docker startup reports uncertain cleanup without guessing an ID', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, { env: { FAKE_DOCKER_RUN_HANG: '1', FAKE_NO_CID: '1', BOUNDED_SECONDS: '0.5' } });
+  outcome(r, 124, 1);
+  assert.doesNotMatch(r.calls, /^docker rm |^drop /m);
+  await stopped(host);
+});
+
+test('a container still listed after removal is a cleanup failure', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, { env: { FAKE_CONTAINER_REMAINS: '1' } });
+  outcome(r, 0, 1);
+});
+
+test('journey stdin and literal argument boundaries are preserved', async (t) => {
+  const host = await fakeHost(t);
+  const r = await run(host, {
+    input: 'input line\n',
+    journey: ['bash', '-c', 'IFS= read -r line; printf "received <%s> <%s> <%s>\\n" "$line" "$1" "$2"', 'journey', 'a b', '--'],
+  });
+  outcome(r, 0, 0);
+  assert.match(r.stdout, /^received <input line> <a b> <-->$/m);
+});
+
+test('cleanup leaves an unrelated process running', async (t) => {
+  const host = await fakeHost(t);
+  const peer = spawn(join(host.bin, 'worker'), ['peer'], {
+    detached: true, stdio: 'ignore', env: { ...process.env, FAKE_ROOT: host.root },
+  });
+  const exited = new Promise((resolve) => peer.once('close', resolve));
+  t.after(async () => { peer.kill('SIGKILL'); await exited; });
+  await until(() => existsSync(join(host.root, 'peer-ready')), 'peer did not start');
+  const r = await run(host);
+  outcome(r, 0, 0);
+  assert.equal(alive(peer.pid), true);
+});
+
+for (const env of [
+  { BOUNDED_SECONDS: '0' }, { BOUNDED_SECONDS: 'NaN' },
+  { JOURNEY_SECONDS: '-1' }, { KILL_GRACE_SECONDS: 'infinity' },
+  { BOOT_ATTEMPTS: '0' }, { DB_URL_VAR: 'bad-name' }, { DB_NAME_VAR: 'SHARD_ADMIN_URL' },
+]) {
+  test(`invalid settings are refused before startup: ${JSON.stringify(env)}`, async (t) => {
+    const host = await fakeHost(t);
+    const r = await run(host, { env });
+    assert.equal(r.status, 2, r.stderr);
+    assert.equal(r.calls, '');
+  });
+}
+
+for (const assignment of ['active_pid=$!', 'emulator_pid=$!']) {
+  test(`TERM between spawn and recording ${assignment} retains ownership`, async (t) => {
+    const host = await fakeHost(t);
+    const hook = join(host.root, 'launch-race.bash');
+    const ready = assignment.startsWith('active') ? 'startup-ready' : 'emulator-ready';
+    writeFileSync(hook, `
+set -T
+trap 'if [[ "$BASH_SUBSHELL" = "0" && "$BASH_COMMAND" = "$RACE_ASSIGNMENT" && ! -e "$FAKE_ROOT/race-fired" ]]; then
+  printf "supervisor %s\\n" "$!" >> "$FAKE_ROOT/pids"
+  touch "$FAKE_ROOT/race-fired"
+  while ! test -e "$FAKE_ROOT/$RACE_READY"; do sleep 0.02; done
+  kill -TERM "$$"
+fi' DEBUG
+`);
+    const r = await run(host, { env: {
+      BASH_ENV: hook, RACE_ASSIGNMENT: assignment, RACE_READY: ready,
+      ...(assignment.startsWith('active') ? { FAKE_ADB_START_HANG: '1', BOUNDED_SECONDS: '60' } : {}),
+    } });
+    assert.equal(existsSync(join(host.root, 'race-fired')), true, r.stderr);
+    outcome(r, 143, 0);
+    assert.doesNotMatch(r.calls, /^docker run/m);
+    await stopped(host);
+  });
+}
+
+// The default commands intentionally use the original environment-variable contract.
+test('caller-selected adb endpoint and custom database names reach both commands', async (t) => {
+  const host = await fakeHost(t);
+  const command = ['bash', '-c', 'printf "contract %s %s %s %s\\n" "$ADB_SERVER_SOCKET" "$ANDROID_EMULATOR_SERIAL" "$TEST_ADMIN_URL" "$TEST_DB" >> "$FAKE_LOG"'];
+  const r = await run(host, {
+    journey: command, drop: command,
+    env: { ADB_SERVER_SOCKET: 'tcp:127.0.0.1:15037', DB_URL_VAR: 'TEST_ADMIN_URL', DB_NAME_VAR: 'TEST_DB' },
+  });
+  outcome(r, 0, 0);
+  assert.match(r.calls, /^adb-env tcp:127\.0\.0\.1:15037 /m);
+  const lines = r.calls.split('\n').filter((line) => line.startsWith('contract '));
+  assert.equal(lines.length, 2);
+  assert.equal(lines[0], lines[1]);
+  assert.match(lines[0], new RegExp(`^contract tcp:127\\.0\\.0\\.1:15037 emulator-${host.ports.EMULATOR_PORT} postgresql://postgres:postgres@127\\.0\\.0\\.1:55432/postgres app_e2e_`));
+  assert.doesNotMatch(r.calls, /kill-server|emu kill|system prune/);
+});

package/skills/app-dev/app-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: app-debug
 description: "Diagnose runtime failures in deployed Cloud Run services — 5xx/422 errors, tracebacks, Next.js SSR/hydration or Server Action failures, DB/Secret Manager connection errors, cold-start timeouts, container OOM. NOT for build or deploy failures (cloud-debug)."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # App Debug

package/skills/app-dev/better-auth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: better-auth
 description: "Add or debug Better Auth for Next.js App Router: login, sessions, protected routes, middleware, OAuth (including Feishu/Lark), cookies, Prisma, and Auth.js migration."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Better Auth for Next.js

package/skills/app-dev/data-catalog/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-catalog
 description: "Column definitions for warehouse tables, written inside the Spark/PySpark or SQL script that builds each table (CATALOG_TABLE / CATALOG_FIELDS, or a `-- @field` comment block), with a generated markdown catalog in docs/catalog/ and a CI check that fails a PR whose catalog is stale. Use when writing or changing a table script that adds, renames, removes, or changes the meaning of an output column or feature; when asked what a warehouse column or feature means; to set a repo up ('init the data catalog', 'generate the data dictionary', '字段字典', 'add catalog CI'); or to audit existing SQL or Spark scripts for undocumented columns. NOT for implementing or tuning the Spark job itself (pyspark), DAG wiring (airflow), or general workflow YAML (github-actions)."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Data catalog

package/skills/app-dev/data-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-quality
 description: "Check a published warehouse table's data against its data-catalog definitions with read-only SELECTs: columns never filled or stuck at one value, counts below zero, ratios outside 0–1, declared values that never appear and undeclared values that do. Then classify each finding as a wrong definition, wrong code, or wrong data. Use when asked whether a table's data is right, to profile or sanity-check a dwd/ads table, to find dead or constant columns, to check a column's values against its documented list, after a pipeline change ships, or when a data-catalog definition and the data might disagree. NOT for validating a Spark change before it ships (pyspark canary and reconciliation), writing definitions (data-catalog), or monitoring dashboards."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Data quality

package/skills/app-dev/ios-foundation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ios-foundation
 description: "Set up and prove an Expo / React Native native iOS workspace from a clean checkout to a manual Login smoke on an owned iOS Simulator: isolated worktree and private caches, Xcode/runtime/CocoaPods preflight, frozen install with `pod install --deployment`, platform-scoped prebuild, an ad-hoc-signed Debug simulator build, a private simulator by exact UDID, Metro on a free port, a disposable PostgreSQL backend with owned cleanup, and the evidence record (setup proof only; feature work reports the smoke result). Use for 'set up iOS', 'build the iOS app', 'run the app on the iOS simulator', 'add iOS to the React Native app', 'prove the iOS build', or when a pod install, xcodebuild, simulator boot, Metro connection or Keychain session fails. NOT for Android (android-foundation), signing, TestFlight or App Store release, or general workflow YAML (github-actions)."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # iOS foundation

package/skills/app-dev/monorepo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: monorepo
 description: Turborepo architecture for shared packages, pnpm workspaces, DAL boundaries, and pipelines.
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Turborepo Monorepo Architecture

package/skills/app-dev/nextjs-fullstack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: nextjs-fullstack
 description: "Build or debug Next.js App Router features with React 19 — pages/layouts/route handlers, Server/Client Components, Server Actions, forms, middleware, DAL, strict TypeScript, Zod — plus our conventions: nuqs URL state, SWR cache, Skeleton/Progress + Sonner feedback, drag-and-drop upload, the portal app shell, list pages as filter/sort/paginate tables. shadcn component mechanics: see the shadcn skill."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Next.js 16 Fullstack Development

package/skills/app-dev/prisma-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: prisma-setup
 description: Use when adding or debugging Prisma with PostgreSQL, Next.js, or Turborepo, including schema.prisma, prisma.config.ts, client generation, migrations, seeds, relations, adapters, and DAL/database-layer setup. Triggers on phrases like "Prisma schema", "prisma migrate", "schema.prisma", "seed the database", "PrismaClient error", "relation issue", or "database layer".
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Prisma v7 Setup Guide

package/skills/app-dev/pyspark/SKILL.md

@@ -12,7 +12,7 @@ description: >
   Connect, spark-submit, Hudi commits, backfills, validate-only canaries,
   cluster reconciliation, or Spark event-log profiling — including warehouse
   job timeouts, empty Hudi writes, or EMR/Dataproc performance regressions.
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # PySpark

package/skills/app-dev/python-backend/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: python-backend
 description: "Python backend architecture for FastAPI, Tortoise ORM, Pydantic Settings, loguru, and uv. Also: uv.lock installs in CI/Docker via a proxy or mirror (`uv sync --frozen` bypasses it), slow uv installs on runners, relocking."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Python Backend Conventions

package/skills/app-dev/shadcn/SKILL.md

@@ -2,7 +2,7 @@
 name: shadcn
 description: "Add or debug shadcn/ui in a React/Next.js project: components.json, shadcn init/add, presets, registries, Tailwind styling, base/radix/aria composition, component fixes, and list-index pages — where the default is the DiceUI data table with filter/sort/pagination in the URL via nuqs, not a bare shadcn Table."
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # shadcn/ui

package/skills/app-dev/zod-v4/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: zod-v4
 description: Zod v4 schema conventions and v3 migration for errors, validators, objects, enums, records, and async parsing.
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Zod v3 to v4 Migration

package/skills/cicd/cloud-build/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cloud-build
 description: "Build or debug Cloud Build pipelines for Cloud Run: cloudbuild.yaml, triggers, Artifact Registry, builds, migrations, deploys, secrets, VPC, notifications. Use cloud-deploy for staged promotion. NOT for GitHub Actions PR checks (github-actions)."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Build Direct Deploy to Cloud Run

package/skills/cicd/cloud-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cloud-debug
 description: "Debug Cloud Build or Deploy failures: builds, deployments, health checks, and pipeline errors. Inputs: service, build ID, region. NOT for GitHub Actions runs (github-actions) or runtime errors in a running service (app-debug)."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Build & Cloud Deploy Debug Skill

package/skills/cicd/cloud-deploy/SKILL.md

@@ -5,7 +5,7 @@ description: >
   CI/CD pipelines with staged promotion, verification gates, or GitFlow branching.
   Also use when debugging Cloud Deploy pipeline failures. NOT for simple single-container
   deploys — use cloud-build instead.
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Deploy + Skaffold + Kustomize for Cloud Run

package/skills/cicd/docker/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docker
 description: Docker/Podman container architecture and build patterns. Read when designing or reviewing containerization, Dockerfile structure, multi-stage builds, PyPI mirror support, or docker-compose setup for Python/uv projects, and when a Dockerfile's dependency install misses the layer cache on every build (build args such as a commit SHA or version declared too early) or an image build is slow in CI.
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Docker Build Patterns

package/skills/cicd/github-actions/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-actions
 description: "Author, review, audit, profile, optimize, or debug GitHub Actions workflows (.github/workflows/*.yml): run-history audits, job and step timing, resource bottlenecks, before/after comparisons, conditional CI by changed path, the one required gate check, PR and merge-queue lanes, sharding, workers, caching, self-hosted runners, timeouts, concurrency, permissions and action pinning, post-deploy verification, npm publishing. Use for 'set up CI', 'CI is slow', 'profile CI', 'optimize our pipeline', 'audit CI for redundant or wasted jobs', 'why is this check stuck expected or never started', 'harden this workflow', or 'browser not found on the runner'. NOT for pushing, opening, or merging a PR, or writing CI conventions into CONTRIBUTING.md (github-flow), queue rules or a check unmet inside Mergify (mergify), Playwright config and specs (e2e-test), cloudbuild.yaml or Cloud Run deploys (cloud-build), or which gates a repo must prove (ensure-coverage)."
-release-version: 0.42.1
+release-version: 0.43.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # GitHub Actions