@aibyzero/byz 0.1.1 → 0.1.3

package/workflows/cm-plugin/skills/cm-plugin-qa-engineer/references/cws-scan-checklist.md

@@ -0,0 +1,136 @@
+# Scan Checklist — Detection Patterns
+
+Run these grep/search patterns against the extension source code.
+
+## 1. Remote Code Execution (Blue Argon) — CRITICAL
+
+```bash
+# External script tags
+grep -rn '<script.*src=.*http' src/ --include="*.html"
+# eval usage
+grep -rn 'eval(' src/ --include="*.ts" --include="*.js" --include="*.tsx"
+# Function constructor
+grep -rn 'new Function(' src/ --include="*.ts" --include="*.js"
+# Dynamic import from URL
+grep -rn "import(.*http" src/ --include="*.ts" --include="*.js"
+# fetch + eval pattern
+grep -rn "fetch.*then.*eval\|fetch.*\.text().*Function" src/
+```
+
+**Pass if**: Zero matches.
+
+## 2. Code Obfuscation (Red Titanium) — CRITICAL
+
+```bash
+# Base64 encoded strings (long ones, >100 chars)
+grep -rn "atob\|btoa" src/ --include="*.ts" --include="*.js"
+# String.fromCharCode patterns
+grep -rn "String\.fromCharCode" src/ --include="*.ts" --include="*.js"
+# Hex-encoded strings
+grep -rn '\\x[0-9a-f]\{2\}\\x[0-9a-f]\{2\}' src/
+```
+
+**Pass if**: Zero matches or justified usage (e.g., atob for JWT decoding — note in report).
+
+## 3. Excessive Permissions (Purple Potassium) — HIGH
+
+```bash
+# List all declared permissions
+cat manifest.json | jq '.permissions, .host_permissions, .optional_permissions'
+# Check for <all_urls>
+grep -n '<all_urls>\|*://*/*' manifest.json
+# Check for broad host permissions
+grep -n '"http" | "https"' manifest.json
+```
+
+**Then**: For each permission, grep source code for its API usage. Flag unused permissions.
+
+| Permission | Verify usage of |
+|------------|----------------|
+| `tabs` | `chrome.tabs.query` (URL/title access) |
+| `history` | `chrome.history.*` |
+| `bookmarks` | `chrome.bookmarks.*` |
+| `cookies` | `chrome.cookies.*` |
+| `webRequest` | `chrome.webRequest.*` |
+| `downloads` | `chrome.downloads.*` |
+
+## 4. Missing Privacy Policy (Purple Lithium) — HIGH
+
+Check if extension collects any user data:
+```bash
+# Storage of user data
+grep -rn "chrome\.storage\|localStorage\|indexedDB" src/
+# Network requests (might send data)
+grep -rn "fetch(\|XMLHttpRequest\|axios\|\.post(" src/
+# Identity/auth
+grep -rn "chrome\.identity\|chrome\.cookies" src/
+```
+
+**If any match**: Privacy policy is REQUIRED. Check manifest for `"privacy_policy"` field.
+
+## 5. Missing Metadata (Yellow Zinc) — HIGH
+
+```bash
+# Check manifest has required fields
+cat manifest.json | jq '{name, description, icons, version}'
+# Check icon files exist
+for size in 16 48 128; do ls icons/icon${size}.png 2>/dev/null || echo "MISSING: icon${size}.png"; done
+```
+
+**Also verify**: Description is meaningful (not generic), icons are non-placeholder.
+
+## 6. Single Purpose (Red Magnesium) — HIGH
+
+Read manifest `description` and all entrypoints. Flag if:
+- Multiple unrelated features (e.g., ad blocker + weather widget)
+- New tab override doing unrelated things
+- Content scripts on `<all_urls>` without clear single purpose
+
+## 7. Insecure Data Transmission (Purple Copper) — HIGH
+
+```bash
+# HTTP URLs (not HTTPS)
+grep -rn "http://" src/ --include="*.ts" --include="*.js" | grep -v "localhost\|127\.0\.0\.1"
+# Sensitive data in URL params
+grep -rn "password=\|token=\|key=\|secret=" src/ | grep -v ".env\|config"
+```
+
+## 8. Keyword Stuffing (Yellow Argon) — MEDIUM
+
+Check manifest `description` and `name` for:
+- Repeated keywords
+- List of competitor names
+- Unrelated buzzwords
+
+## 9. Minimum Functionality (Yellow Potassium) — MEDIUM
+
+Flag if:
+- Only `manifest.json` and icons exist (no JS/TS)
+- Extension only opens an external URL
+- Popup just shows a link to a website
+
+## 10. Crypto Mining (Grey Silicon) — CRITICAL
+
+```bash
+grep -rn "coinhive\|cryptonight\|mineralt\|webminer\|coin-hive" src/
+grep -rn "WebAssembly.*mining\|hashrate\|nonce.*increment" src/
+```
+
+## 11. Copyright Circumvention (Blue Zinc) — CRITICAL
+
+```bash
+# Video/audio download patterns
+grep -rn "youtube.*download\|download.*video\|saveAs.*blob" src/
+grep -rn "paywall\|bypass.*subscription\|unlock.*premium" src/
+```
+
+## 12. Data Collection Without Consent (Purple Nickel) — HIGH
+
+```bash
+# Browsing history collection
+grep -rn "chrome\.history\|chrome\.webNavigation" src/
+# Tab URL tracking
+grep -rn "chrome\.tabs\.onUpdated\|tab\.url" src/
+```
+
+If found, verify: Is consent dialog shown before collection?

package/workflows/cm-plugin/skills/cm-plugin-qa-engineer/references/cws-violation-codes.md

@@ -0,0 +1,68 @@
+# Chrome Web Store Violation Codes
+
+Reference: https://developer.chrome.com/docs/webstore/troubleshooting
+
+## CRITICAL — Immediate Rejection
+
+| Code | Name | Description |
+|------|------|-------------|
+| Blue Argon | Remote Code Execution | eval(), external scripts, remote code loading |
+| Red Titanium | Code Obfuscation | Base64 encoding, char encoding (minification OK) |
+| Grey Silicon | Cryptocurrency Mining | Mining on user machines |
+| Blue Zinc | Copyright Circumvention | Paywall bypass, video downloaders |
+| Blue Copper | Unauthorized Downloads | Facilitating piracy |
+| Blue Titanium | Enforcement Circumvention | Evading review process |
+
+## HIGH — Very Likely Rejection
+
+| Code | Name | Description |
+|------|------|-------------|
+| Purple Potassium | Excessive Permissions | Requesting unused or unnecessary permissions |
+| Purple Lithium | Missing Privacy Policy | Collecting data without privacy policy |
+| Yellow Zinc | Missing Metadata | No icons, description, or screenshots |
+| Red Magnesium | Single Purpose Violation | Multiple unrelated features |
+| Red Nickel | Deceptive Behavior | Functionality doesn't match description |
+| Red Copper | Impersonation | Copying other extensions or brands |
+| Purple Copper | Insecure Transmission | Sending user data over HTTP |
+| Purple Nickel | No Data Disclosure | Collecting data without consent |
+| Purple Magnesium | Data Handling Violation | Unnecessary browsing activity collection |
+| Red Zinc | Deceptive Installation | Misleading marketing or CTAs |
+| Yellow Magnesium | Non-Functional | Extension doesn't work as described |
+
+## MEDIUM — May Cause Rejection
+
+| Code | Name | Description |
+|------|------|-------------|
+| Yellow Argon | Keyword Stuffing | Spam keywords in metadata |
+| Yellow Potassium | Minimum Functionality | No real value or features |
+| Yellow Nickel | Spam | Duplicate extensions, fake reviews |
+| Yellow Lithium | Redirection Only | Just launches another app/site |
+| Grey Titanium | Undisclosed Affiliates | Hidden affiliate links |
+| Blue Nickel | Override API Bypass | Modifying new tab without Overrides API |
+
+## CONTENT — Content Policy
+
+| Code | Name | Description |
+|------|------|-------------|
+| Grey Zinc | Illegal Activities | Facilitating illegal activities |
+| Grey Copper | Online Gambling | Gambling functionality |
+| Grey Lithium | Pornographic Content | Sexually explicit material |
+| Grey Magnesium | Hate Content | Hate speech or discrimination |
+| Grey Nickel | Non-Family-Safe | Adult content without "Mature" flag |
+| Grey Potassium | Violent Content | Gratuitous violence or harassment |
+
+## Appeal Process
+
+1. Review rejection email for specific violation code
+2. Fix ALL identified issues
+3. Submit appeal via Chrome Web Store Developer Dashboard
+4. Provide detailed explanation of changes made
+5. Typical response time: 1-3 business days
+
+## Key Rules
+
+- **Minification is OK** (webpack/vite output) — obfuscation is NOT
+- **activeTab > host_permissions** — always prefer narrowest permission
+- **Privacy policy required** if ANY user data is collected/transmitted
+- **Single purpose**: one clear, defined functionality per extension
+- **Description must match** actual functionality exactly

package/workflows/cm-plugin/skills/cm-plugin-ui-engineer/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: cm-plugin-ui-engineer
+description: UI 还原工程师 Skill，把已确认的设计基准像素级还原为生产代码（token 先行、原子顺序、按交付形态量化验收：Web 用 BackstopJS、App 用 Maestro+模拟器截图）；有基准才出场，不做业务逻辑
+---
+
+# cm-plugin-ui-engineer — UI 还原工程师
+
+把设计基准工程化还原进项目代码库。**管"像不像"，不管"能不能用"**——业务逻辑、状态、API 归 cm-plugin-extension-engineer。
+
+## 出场条件（有基准才出场）
+
+仅当 feature 存在**已确认的设计基准**（`specs/{N}.{feature}/design-baseline/`，由 /cm-plugin:prd 阶段生成并经人审规格确认）时，才生成和执行 UI 还原任务。无基准 → 本角色不出场，UI 由前端按现有行为实现。
+
+**执行期零决策**：方向确认已在规格期完成（人审规格时看过原型/基准），本 skill 执行时不得中途向用户征求设计意见；发现基准缺失或矛盾 → 上报，不脑补。
+
+## 职责边界
+
+- **管**：design token、纯展示组件（props 驱动）、静态页面结构、样式、资产、像素级验收
+- **不管**：业务逻辑/状态/API（→ cm-plugin-extension-engineer）、设计基准生成（→ /cm-plugin:prd 阶段）
+- **契约**：组件契约（组件名 / props / 事件）写在 design.md，与前端的交接以此为准，适用三级契约协议（只报不改）
+
+## 工作流程
+
+### 1. 读取基准
+
+- `specs/{N}.{feature}/design-baseline/`：截图、导出的 HTML/CSS、token 提取物
+- design.md 的组件契约与基准路径
+- **不得修改基准文件**；基准与需求矛盾 → 上报
+
+### 2. Token 先行（共享状态纪律）
+
+先建立/对齐 design token（颜色、间距、字号、圆角、阴影 → Tailwind theme 或 CSS 变量），后续所有组件**只引用 token，不写裸值**。
+
+**token 是跨 feature 共享状态**：
+
+- 新增 token → 自由添加
+- **修改既有 token 值 → 按契约偏差处理**：写入汇报「契约相关」栏，由主流程评估波及的已完成页面，必要时问人——绝不默默改（一个颜色值的变更会让已验收页面全部变样）
+
+### 3. 原子顺序还原
+
+token → 基础组件（按钮/输入框/标签）→ 组合组件（卡片/表单）→ 页面。不跳级——页面还原中发现缺基础组件，先补组件再拼页面。
+
+- 遵循项目组件目录约定，新组件入公共目录确保复用
+- 组件纯 props 驱动，不含业务逻辑；接口与 design.md 组件契约一致
+- 响应式：按基准标注的断点逐档实现，未标注的断点行为上报确认（规格期遗漏的补充问题）
+
+### 4. 交互态核对
+
+对照基准中的状态设计（hover / active / disabled / loading / 空态 / 错误态）逐一实现。基准缺失的状态 → 上报（规格期应已确认过一轮，执行期仍缺失说明规格有洞）。
+
+### 5. 反 AI slop 与品牌资产纪律
+
+- **品牌资产协议**：logo、品牌色、字体一律使用基准中的真实资产文件，**禁止凭记忆编造色值或找相似替代**
+- **反 AI slop 清单**（无基准细节可依时的兜底审美纪律）：不用紫蓝渐变默认色、不用 emoji 充当图标、不无脑圆角+阴影卡片、间距用 token 刻度不用随机值
+
+### 6. 量化验收（按 CLAUDE.md 交付形态选链，二选一）
+
+**popup / options / side panel 等浏览器可渲染表面 —— BackstopJS 链：**
+
+```bash
+npx backstop test   # reference = design-baseline 截图, test = 还原页面截图
+```
+
+- **默认 mismatch ≤ 1%**（`.claude/rules/` 有规定时以 rules 为准）
+- 特殊效果（复杂渐变、毛玻璃、动效帧）白名单制：列明白名单项及理由，其余差异修复后复测
+- 逐断点跑一遍；差异报告随任务汇报输出，供 N6 可视化回归复用
+- **像素基准档的交互验收**：按 design.md 提取的交互走查清单逐条 E2E 断言（跳转目标、状态切换、操作反馈）——**UI 像了但交互不 1:1，同样是验收失败**
+
+**App（React Native / Expo）—— Maestro 链：**
+
+App 产物不在浏览器里，BackstopJS/Playwright 不适用；react-native-web 的浏览器渲染只可用于开发期快速目检，**不作为任何验收证据**。
+
+- **交互验收**：Maestro flow（YAML）逐条断言 design.md 的交互走查清单（跳转目标、状态切换、操作反馈），在 iOS/Android 模拟器上执行
+- **像素验收**：Maestro `takeScreenshot` 采集模拟器截图，与 design-baseline 截图分辨率对齐后逐屏对比（odiff/pixelmatch，默认 mismatch ≤ 1%，白名单制同上）
+- **环境降级**：本机无模拟器或装不上 Maestro → 上报并降级为 Expo Go 真机人工对照（并排截图发人确认），METRICS 备注"App 像素验收降级"——**不得静默改用浏览器截图充当验收**
+
+**两条链共同要求**：**首个页面任务的汇报必须附"实现 vs 基准"并排截图**（App 形态截图必须来自模拟器/真机）——人眼对照点前置到第一个页面完成时，不等全部做完（历史事故教训）
+
+## 常见坑
+
+| 问题 | 处理 |
+| ---- | ---- |
+| 改全局 token 导致已验收页面变样 | 修改既有 token 值必须走契约偏差上报,不默默改 |
+| 硬编码 hex/px 绕过 token | 全部走 token 引用,review 时 grep 裸值 |
+| 字体渲染差异导致像素对比误报 | 对比容器锁定字体与尺寸,阈值内噪声不追 |
+| 只还原了理想态 | 交互态清单逐项核对,缺失上报 |
+| 组件 props 与前端预期不一致 | 以 design.md 组件契约为准,偏差只报不改 |
+
+## 输出
+
+- 创建/修改的文件列表（token / 组件 / 页面 / 资产）
+- BackstopJS 对比结果（各断点 mismatch 值 + 白名单项）
+- **契约相关**：组件契约实现情况及偏差、token 变更清单（无则写"无"）
+- 需要其他工种配合的事项（前端可接线的组件清单及 props）