@ccoalm/ccl-skills 0.15.0 → 0.15.2

package/README.md

@@ -23,7 +23,7 @@ Restart your CLI so it reloads the skills.
 
 `install` configures every host it detects. The package carries an immutable snapshot of the skills, agent context, plugin manifests, and runtime hooks, so installation needs no Git checkout.
 
-Requirements: Node.js 20 or later, macOS or Linux, and at least one host CLI — Claude Code, Codex 0.133.0 or later, or OpenCode.
+Requirements: Node.js 20 or later, macOS or Linux, and at least one host CLI — Claude Code, Codex with working `plugin marketplace list` and `plugin list` commands, or OpenCode. Codex availability is checked through these commands rather than its version number.
 
 Run it without a global install:
 
@@ -62,6 +62,8 @@ ccl-skills uninstall --yes   # remove host assets
 
 Limit any operation to one host with `--host claude`, `--host codex`, or `--host opencode`. Add `--json` for machine-readable output.
 
+For `--host codex`, unreadable public plugin state returns exit `3` with `host-state-unknown`; a missing CLI or failed capability probe returns `4`. If that host failure occurs with a pending journal, recovery is deferred: exit `5` with `partial-journal` retains the journal and records `details.hostFailure`. Restore the CLI or readable public plugin state, then rerun the command. Other outcomes can share these exit codes, so inspect the JSON status as well.
+
 `update` and `uninstall` are previews unless `--yes` is supplied. `update --yes` first upgrades the global npm package to `@latest`, then asks the freshly installed CLI to refresh host assets. Set `CCL_SKILLS_SKIP_SELF_UPDATE=1` for an assets-only refresh; `--allow-downgrade` always uses the currently invoked package without installing `@latest` first.
 
 After `ccl-skills uninstall --yes`, remove the CLI package itself with `npm uninstall --global @ccoalm/ccl-skills` if it is no longer needed.

package/dist/assets/marketplace/plugins/ccl-skills/agent-context/session-start.md

@@ -41,5 +41,5 @@
 - **完整优先**：能多花几分钟做完就别交半成品；但"完整"是把该做的做完，不是镀金或扩范围（详见 product-rd / feature-risk-router 的 gate）。
 - **持久件锚定（长/多阶段/委托/跨会话工作）**：锚到持久件、别只靠对话或临时任务卡——交付级 spec/plan → product-rd-workflow、委托进度 → multi-agent-delegation、技能/流程教训 → skill-extraction-workflow 的 source-register；更新/取代既有件，别复制（只提醒，不是第二个 plan 门，深度归 product-rd）。
 - **大文件/大技能分块读（读取易丢中段）**：单次读取**输出**超过 ~256 行 / 10KB 时，codex 等工具会头尾截断、丢中段（[openai/codex#6426](https://github.com/openai/codex/issues/6426)），常有截断标记但极易忽略、某些场景无标记（无标记 ≠ 读全）。需要看全时（完整评审 / 下"没有 X"结论 / 加载技能照做）分块读（每块 < ~200 行**且** < 8KB）并确认**中段**已读到，别一次整文件读就当看全（定点 `sed -n 'Np'` 不受限）。写码/测试/评审同样适用，详见 skill-extraction blocked-source-read。（`project_doc_max_bytes` 只管 project-doc 预算、不影响工具输出截断，不是绕过手段。）
-- **委托三方模型评审前先自审到收敛（任何开发都适用）**：codex/Claude 等是**最后一层对抗性兜底，不是主要发现机制**。先做**可证明的实现者自检**到预期通过再交评审——想清楚影响结果的分支/路径/状态，自审 security/privacy/authority/数据丢失轴；别把未收敛的活丢过去，再拿 findings 当清单陷进 review→改→再 review 的循环。深浅按对应 owner/风险闸定，不无差别全量、也不给窄/未触发改动强加 product-rd self-review row。自审**不缩短/不软化**那道闸（仍是一次全量对抗性 pass，按 diff 给对抗 prompt、别附"确认我的结论"导向），findings 仍按门处置不可降级。详见 product-rd 验证门 + skill-extraction `dual-track-review-gate.md`（shared-skill dual-track 的 persisted row 与有效性规则按 extraction-quickstart）。
+- **开发完成自动评审（含窄修复和测试代码）**：实现者先自检分支/失败路径及 security/privacy/authority/数据丢失风险，按 `testing-strategy` 完成适用测试，再自动调用 `code-review`，无需用户提醒；执行与收尾见 `skills/code-review/references/development-completion.md`。自审、读技能或说“下一步评审”都不算独立评审。按风险定深度；窄任务不额外套 product-rd self-review row，既有高风险/shared-skill gate 不降级。评审覆盖实际 diff，采用对抗问题，不要求确认实现者结论；findings 先核实再修复或有证据处置，避免循环追逐建议。用户明确跳过时记录 skipped；当前候选已有有效独立评审则复用。详见 product-rd 验证门 + skill-extraction `dual-track-review-gate.md`。
 </ccl-skills-routing>

package/dist/assets/marketplace/plugins/ccl-skills/packages/opencode-plugin/ccl-skills.ts

@@ -6,6 +6,7 @@ import {
   mkdirSync,
   mkdtempSync,
   readFileSync,
+  readdirSync,
   realpathSync,
   rmSync,
   statSync,
@@ -337,6 +338,7 @@ export const CclSkills = async (context: {
   const hooksRoot = runtimeRoot()
   const parentSessions = new Map<string, string>()
   const idleInFlight = new Set<string>()
+  const pendingSkills = new Map<string, string>()
   let stateRoot: string | null = null
 
   function ensureStateRoot() {
@@ -390,9 +392,67 @@ export const CclSkills = async (context: {
     return typeof command === "string" && /\b(?:git\s+(?:push|merge)|gh\b[^\n;&|]*\bpr\s+merge|glab\b[^\n;&|]*\bmr\s+(?:merge|accept)|curl|wget)\b/i.test(command)
   }
 
-  function safeTranscriptInput(tool: string, args: Record<string, unknown>) {
-    if (tool === "skill") return typeof args.skill === "string" ? { skill: args.skill } : {}
-    return {}
+  function sameSkillDirectory(loaded: string, active: string) {
+    if (loaded === realpathSync(active)) return true
+    const pending = [[loaded, active]]
+    while (pending.length) {
+      const [copy, owner] = pending.pop()!
+      const copyStat = lstatSync(copy), ownerStat = lstatSync(owner)
+      if (copyStat.isSymbolicLink() || ownerStat.isSymbolicLink()) return false
+      if (copyStat.isDirectory() && ownerStat.isDirectory()) {
+        const copyNames = readdirSync(copy).sort(), ownerNames = readdirSync(owner).sort()
+        if (copyNames.length !== ownerNames.length || copyNames.some((name, index) => name !== ownerNames[index])) return false
+        for (const name of ownerNames) pending.push([join(copy, name), join(owner, name)])
+      } else if (!copyStat.isFile() || !ownerStat.isFile() || copyStat.size !== ownerStat.size || !readFileSync(copy).equals(readFileSync(owner))) return false
+    }
+    return true
+  }
+
+  function completedSkill(name: string | undefined, metadata: unknown) {
+    if (!name || !hooksRoot || !metadata || typeof metadata !== "object") return null
+    const result = metadata as { name?: unknown; dir?: unknown }
+    if (result.name !== name || typeof result.dir !== "string") return null
+    // The native tool reports the loaded source directory. A same-named skill
+    // elsewhere must never be promoted to a CCL owner by its caller's argument.
+    try {
+      const loaded = realpathSync(result.dir)
+      const entry = join(loaded, "SKILL.md")
+      if (!lstatSync(entry).isFile() || lstatSync(entry).isSymbolicLink()) return null
+      const content = readFileSync(entry, "utf8")
+      if (!content.startsWith(`---\nname: ${name}\n`)) return null
+      const activeRoot = existsSync(join(hooksRoot, "skills")) ? hooksRoot : resolve(hooksRoot, "../..")
+      // Bind the full skill to the running runtime: progressive disclosure loads
+      // references/scripts relative to this directory. Active source/project edits
+      // remain valid; inactive copies must match current files, without a stale cache.
+      const activeSkill = join(activeRoot, "skills", name)
+      const activeEntry = join(activeSkill, "SKILL.md")
+      if (!existsSync(activeEntry) || !lstatSync(activeEntry).isFile() || lstatSync(activeEntry).isSymbolicLink() || !sameSkillDirectory(loaded, activeSkill)) return null
+      const nativeRoots = [activeRoot, join(HOST_HOME, ".config/opencode"), join(directory, ".opencode"), join(context.worktree ?? directory, ".opencode")]
+      for (const root of nativeRoots) {
+        const expected = join(root, "skills", name)
+        if (existsSync(expected) && realpathSync(expected) === loaded && (root === activeRoot || existsSync(join(root, "ccl-skills/runtime/hooks/hooks.json")))) return `ccl-skills:${name}`
+      }
+      // Explicit skills.paths can select a CCL source checkout while a global
+      // adapter supplies the runtime. Require both its layout and the active bytes.
+      const sourceRoot = resolve(loaded, "../..")
+      const manifestPath = join(sourceRoot, ".claude-plugin/plugin.json")
+      if (loaded === join(sourceRoot, "skills", name) && existsSync(manifestPath)) {
+        const manifest = JSON.parse(readFileSync(manifestPath, "utf8"))
+        if (manifest?.name === "ccl-skills" && manifest?.skills === "./skills/") return `ccl-skills:${name}`
+      }
+      // The source installer also supports ~/.agents/skills. Require its existing
+      // receipt and the current native skill's bytes, not just a same-named file.
+      const compatibility = join(HOST_HOME, ".agents/skills", name)
+      const native = join(HOST_HOME, ".config/opencode/skills", name, "SKILL.md")
+      const receipt = join(HOST_HOME, ".config/opencode/ccl-skills/install-manifest.json")
+      if (existsSync(compatibility) && realpathSync(compatibility) === loaded && existsSync(receipt) && existsSync(native)) {
+        const manifest = JSON.parse(readFileSync(receipt, "utf8"))
+        if (manifest?.installer === "scripts/install-opencode.sh" && manifest?.install_mode === "global" && readFileSync(native, "utf8") === content) return `ccl-skills:${name}`
+      }
+      return null
+    } catch {
+      return null
+    }
   }
 
   async function resumeForStop(sessionID: string, reasons: string[]) {
@@ -446,6 +506,9 @@ export const CclSkills = async (context: {
       output.args = args
       const targets = editPaths(tool, args, directory)
       const toolName = claudeToolName(tool)
+      if (tool === "skill" && typeof args.name === "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(args.name) && args.name.length <= 64) {
+        pendingSkills.set(`${sessionID}\0${callID}`, args.name)
+      }
       if (targets.length) {
         targets.forEach((filePath, index) => appendTranscript(sessionID, {
           type: "assistant",
@@ -454,7 +517,7 @@ export const CclSkills = async (context: {
       } else {
         appendTranscript(sessionID, {
           type: "assistant",
-          message: { content: [{ type: "tool_use", id: callID, name: toolName, input: safeTranscriptInput(tool, args) }] },
+          message: { content: [{ type: "tool_use", id: callID, name: toolName, input: {} }] },
         })
       }
 
@@ -507,6 +570,15 @@ export const CclSkills = async (context: {
       const tool = input.tool.toLowerCase()
       const sessionID = input.sessionID ?? `pid-${process.ppid}`
       const callID = input.callID ?? "unknown-call"
+      if (tool === "skill") {
+        const key = `${sessionID}\0${callID}`
+        const owner = completedSkill(pendingSkills.get(key), output.metadata)
+        pendingSkills.delete(key)
+        if (owner) appendTranscript(sessionID, {
+          type: "assistant",
+          message: { content: [{ type: "tool_use", id: callID, name: "Skill", input: { skill: owner } }] },
+        })
+      }
       appendTranscript(sessionID, {
         type: "user",
         message: { content: [{ type: "tool_result", tool_use_id: callID, content: "" }] },
@@ -536,6 +608,9 @@ export const CclSkills = async (context: {
           ? (properties.info as { id: string }).id
           : ""
       if (!sessionID) return
+      if (event.type === "session.deleted" || event.type === "session.idle" || (properties.status as { type?: string } | undefined)?.type === "idle") {
+        for (const key of pendingSkills.keys()) if (key.startsWith(`${sessionID}\0`)) pendingSkills.delete(key)
+      }
       if (event.type === "session.deleted") {
         const path = transcriptPath(sessionID)
         if (path) rmSync(path, { force: true })
@@ -562,6 +637,7 @@ export const CclSkills = async (context: {
     },
 
     dispose: async () => {
+      pendingSkills.clear()
       if (stateRoot) rmSync(stateRoot, { recursive: true, force: true })
       stateRoot = null
     },

package/dist/assets/marketplace/plugins/ccl-skills/packages/opencode-plugin/commands/ccl-install-skills.md

@@ -3,12 +3,24 @@ description: Install or refresh CCL skills for OpenCode
 argument-hint: "[--project]"
 ---
 
-Run the CCL OpenCode installer from the repository root.
+Install or reapply the CCL assets using the current installation mode. Check the existing CCL installation record and available entrypoint before running a command.
 
-Use `--project` when the user wants project-local `.opencode/skills`, `.opencode/commands`, and `.opencode/plugins` copied into this repository.
+For an npm installation, reapply the invoked package's OpenCode assets:
 
 ```bash
-bash scripts/install-opencode.sh $ARGUMENTS
+ccl-skills install --host opencode
 ```
 
-After installation, tell the user to restart OpenCode or open a new session.
+For a newer package version, follow `/ccl-update-skills`. The npm package does not include the source installer or support `--project`; do not forward that flag to the npm CLI.
+
+For a source checkout, locate the actual CCL repository and verify its installer exists. By default, from that checkout run:
+
+```bash
+bash scripts/install-opencode.sh --no-agent $ARGUMENTS
+```
+
+Use `--project` only for source mode when the user wants `.opencode/skills`, `.opencode/commands`, and `.opencode/plugins` copied into that checkout. Do not run a relative source-installer path in an unrelated project.
+
+For a global source installation, omit `--no-agent` when the user also needs `~/.agents/skills` for another tool. To sync only that compatibility path, run `bash scripts/install-opencode.sh --only-agent`; this mode does not install OpenCode assets and cannot be combined with `--project` or `--no-agent`.
+
+After OpenCode assets change, restart OpenCode or open a new session. After a compatibility-only sync, restart the tool that reads `~/.agents/skills`.

package/dist/assets/marketplace/plugins/ccl-skills/scripts/owner-dispatch/owner-dispatch.sh

@@ -1059,7 +1059,15 @@ def main(argv):
     head_enabled = enabled(head_cfg)
     base_enabled = enabled(base_cfg)
 
-    diff = run_git(["diff", "-z", "--name-only", base, "HEAD"], cwd=repo, text=False)
+    # --no-renames so a file moved OUT of a gated directory is still seen at its old
+    # (gated) path; rename detection would only report the exempt destination.
+    # --ignore-submodules=none so repository config (diff.ignoreSubmodules=all) cannot
+    # suppress a gitlink move out of the gated tree, which would leave only .gitmodules.
+    diff = run_git(
+        ["diff", "-z", "--name-only", "--no-renames", "--ignore-submodules=none", base, "HEAD"],
+        cwd=repo,
+        text=False,
+    )
     if diff.returncode != 0:
         return fail("owner-dispatch ci: diff failed — FAIL-CLOSED (2)")
     changed = [p.decode("utf-8", "surrogateescape") for p in diff.stdout.split(b"\0") if p]
@@ -1183,7 +1191,10 @@ cmd_ci() {
   # file (NUL can't survive a shell var) so paths with spaces/newlines classify exactly.
   local CHANGED=() difftmp rel
   difftmp=$(mktemp 2>/dev/null) || { echo "owner-dispatch ci: mktemp failed — FAIL-CLOSED (2)" >&2; return 2; }
-  git diff -z --name-only "$base" HEAD > "$difftmp" 2>/dev/null || { rm -f "$difftmp"; echo "owner-dispatch ci: diff failed — FAIL-CLOSED (2)" >&2; return 2; }
+  # -C "$repo" so diff.relative cannot truncate the set when ci runs from a subdirectory;
+  # --no-renames and --ignore-submodules=none: see the Python path above. Both paths must
+  # classify the same file set regardless of repository diff configuration or cwd.
+  git -C "$repo" diff -z --name-only --no-renames --ignore-submodules=none "$base" HEAD > "$difftmp" 2>/dev/null || { rm -f "$difftmp"; echo "owner-dispatch ci: diff failed — FAIL-CLOSED (2)" >&2; return 2; }
   while IFS= read -r -d '' rel; do CHANGED+=("$rel"); done < "$difftmp"
   rm -f "$difftmp"
 

package/dist/assets/marketplace/plugins/ccl-skills/scripts/owner-dispatch/test.sh

@@ -523,6 +523,59 @@ echo "// z" >> "$REPO/src/foo.go"; gc more
 # 10i. CI fails CLOSED when it cannot determine a base (no --base, no upstream).
 if ( cd "$REPO" && bash "$ENGINE" ci >/dev/null 2>&1 ); then bad "ci no-base should fail-closed"; else ok "ci: no base => fail-closed (non-zero)"; fi
 
+# 10j. a gated file moved OUT of the gated tree is still a gated change. Two ways the diff
+#      can hide it: rename detection resolves a pure move to the exempt destination only,
+#      and diff.ignoreSubmodules=all drops a moved gitlink entirely. Both ci paths (jq and
+#      the python fallback) must classify the same set, so each case runs on both.
+command -v jq >/dev/null 2>&1 || bad "ci rename-out: jq absent" "the jq lane would silently be a second python run"
+[ -z "$(PATH="$NOJQBIN" command -v jq || true)" ] || bad "ci rename-out: NOJQBIN still resolves jq" "the python lane would silently be a second jq run"
+printf '%s\n' "$EN" | rawcfg
+mkdir -p "$REPO/design" "$REPO/exempt"; echo "owners: x" > "$REPO/design/map.md"
+echo "package x" > "$REPO/src/moved.go"; gc renamebase
+rnbase=$(git -C "$REPO" rev-parse HEAD)
+git -C "$REPO" config diff.renames true   # else the base engine reports the source anyway
+git -C "$REPO" mv src/moved.go exempt/moved.go; gc renameout
+jq_rc=0; jq_out=$( cd "$REPO" && bash "$ENGINE" ci --base "$rnbase" 2>&1 ) || jq_rc=$?
+py_rc=0; py_out=$( cd "$REPO" && PATH="$NOJQBIN" bash "$ENGINE" ci --base "$rnbase" 2>&1 ) || py_rc=$?
+[ "$jq_rc" = 1 ] && [ "$py_rc" = 1 ] && ok "ci: gated file renamed out of scope, stale map => fail on both lanes" || bad "ci rename-out rc" "jq=$jq_rc py=$py_rc"
+case "$jq_out$py_out" in *src/moved.go*src/moved.go*) ok "ci rename-out: both lanes name the gated source path" ;; *) bad "ci rename-out diagnostic" "$jq_out | $py_out" ;; esac
+# cwd must not change the verdict: with diff.relative=true a diff run from a subdirectory
+# would drop paths outside it, and the two lanes would disagree.
+git -C "$REPO" config diff.relative true
+rel_jq=0; ( cd "$REPO/exempt" && bash "$ENGINE" ci --base "$rnbase" >/dev/null 2>&1 ) || rel_jq=$?
+rel_py=0; ( cd "$REPO/exempt" && PATH="$NOJQBIN" bash "$ENGINE" ci --base "$rnbase" >/dev/null 2>&1 ) || rel_py=$?
+[ "$rel_jq" = 1 ] && [ "$rel_py" = 1 ] && ok "ci: run from a subdirectory under diff.relative=true => still fail on both lanes" || bad "ci rename-out relative rc" "jq=$rel_jq py=$rel_py"
+git -C "$REPO" config --unset diff.relative
+echo "owners: y" >> "$REPO/design/map.md"; gc renameoutmap
+ok_jq=0; ( cd "$REPO" && bash "$ENGINE" ci --base "$rnbase" >/dev/null 2>&1 ) || ok_jq=$?
+ok_py=0; ( cd "$REPO" && PATH="$NOJQBIN" bash "$ENGINE" ci --base "$rnbase" >/dev/null 2>&1 ) || ok_py=$?
+[ "$ok_jq" = 0 ] && [ "$ok_py" = 0 ] && ok "ci: renamed-out gated file with updated map => ok on both lanes" || bad "ci rename-out with map" "jq=$ok_jq py=$ok_py"
+# an option-like base must be rejected before any diff runs, on both lanes
+for badbase in "--output=$WORK/pwned" "-z"; do
+  b_jq=0; ( cd "$REPO" && bash "$ENGINE" ci --base "$badbase" >/dev/null 2>&1 ) || b_jq=$?
+  b_py=0; ( cd "$REPO" && PATH="$NOJQBIN" bash "$ENGINE" ci --base "$badbase" >/dev/null 2>&1 ) || b_py=$?
+  [ "$b_jq" = 2 ] && [ "$b_py" = 2 ] && ok "ci: option-like base '$badbase' => fail-closed(2) on both lanes" || bad "ci option-base rc" "jq=$b_jq py=$b_py"
+done
+[ ! -e "$WORK/pwned" ] && ok "ci: option-like base created no file" || bad "ci option-base wrote a file"
+
+# 10j2. the same bypass through a submodule, which repository config can hide outright.
+SUBSRC="$WORK/subsrc"; mkdir -p "$SUBSRC"
+git -C "$SUBSRC" init -q; git -C "$SUBSRC" config user.email t@t; git -C "$SUBSRC" config user.name t
+echo hi > "$SUBSRC/f.txt"; git -C "$SUBSRC" add -A; git -C "$SUBSRC" commit -qm sub
+sub_err=$(git -C "$REPO" -c protocol.file.allow=always submodule add -q "$SUBSRC" src/vendor 2>&1) || true
+if [ -e "$REPO/src/vendor/f.txt" ]; then
+  gc subbase
+  sub_base=$(git -C "$REPO" rev-parse HEAD)
+  git -C "$REPO" config diff.ignoreSubmodules all
+  git -C "$REPO" mv src/vendor exempt/vendor; gc submove
+  sm_jq=0; sm_jq_out=$( cd "$REPO" && bash "$ENGINE" ci --base "$sub_base" 2>&1 ) || sm_jq=$?
+  sm_py=0; sm_py_out=$( cd "$REPO" && PATH="$NOJQBIN" bash "$ENGINE" ci --base "$sub_base" 2>&1 ) || sm_py=$?
+  [ "$sm_jq" = 1 ] && [ "$sm_py" = 1 ] && ok "ci: submodule moved out of scope under diff.ignoreSubmodules=all => fail on both lanes" || bad "ci submodule-move rc" "jq=$sm_jq py=$sm_py"
+  git -C "$REPO" config --unset diff.ignoreSubmodules
+else
+  bad "ci submodule-move: could not create the submodule fixture" "$sub_err"
+fi
+
 # ---- 11. SubagentStop: agent_id-scoped enforcement (the same engine handles Stop +
 #         SubagentStop; agent_id is present only for the latter and scopes markers/cap). ----
 rm -rf "$BDIR"

package/dist/assets/marketplace/plugins/ccl-skills/skills/app-cross-platform-dev/SKILL.md

@@ -5,7 +5,7 @@ description: Use when designing, implementing, reviewing, debugging, testing, or
 
 # App Cross-Platform Dev
 
-Use this skill for mobile app and cross-platform client engineering. It covers Flutter, React Native, native Android, and native iOS. It does not own mini-programs, React web, backend service design, product requirements, or visual design rules.
+Use this skill for mobile app and cross-platform client engineering. It covers Flutter, React Native, native Android, and native iOS. It does not own mini-programs, React web, backend service design, product requirements, or visual design rules. After code/test edits, self-check and invoke `code-review` automatically before completion.
 
 ## Routing
 
@@ -15,7 +15,7 @@ Use this skill for mobile app and cross-platform client engineering. It covers F
 - Use `web-react-dev` for React web and browser-specific client work.
 - Use Go or Python backend skills for server contracts, persistence, queues, auth services, and API ownership.
 - Use `testing-strategy` to choose the test layer; return here for Flutter, React Native, Android, or iOS implementation details.
-- Use `test-artifact-management` when the ask is about generating structured test cases from a Feishu requirements doc or codebase and tracking them in Feishu Bitable before implementation begins.
+- Use `test-artifact-management` for structured Feishu Bitable cases derived from Feishu requirements or code before implementation.
 - Use `defect-diagnosis` first for bugs, failed tests, flaky behavior, crashes, rendering regressions, build failures, or store/release symptoms.
 - For money, quota, permission, tenant/user data, high-impact AI, repeated submit, async finality, or support-traceable incidents, apply `product-rd-workflow` high-risk resilience gates before treating the app flow as complete.
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: code-review
-description: Use when an implementation needs an independent CLI reviewer or adversarial challenger, routing across Claude Code, Kimi, OpenCode, or Codex according to local availability, model-family independence, and the user's client order; also covers Claude-only bounded consultation and requests such as code review, Claude review, Kimi review, OpenCode review, second opinion, 找茬, 唱反调, or 第二意见. Skip 某个改动/提交还有没有价值、值不值得修这类交付裁决 → product-rd-workflow：本技能执行评审、找缺陷与风险，不裁决交付价值。
+description: Use automatically after changing code or executable tests, before completion or landing handoff, even without a user review request. Obtain independent CLI review/challenge across Claude Code, Kimi, OpenCode, or Codex by capability, model-family independence, and the user's client order; also covers Claude-only consultation, code review, Claude review, Kimi review, OpenCode review, second opinion, 找茬, 唱反调, or 第二意见. Skip 改动/提交值不值得修这类交付裁决 → product-rd-workflow；本技能执行评审，不裁决交付价值。
 ---
 
 # Code Review
 
-Use this skill from Claude, Codex, OpenCode, or another compatible agent to obtain an independent, attributable review or adversarial challenge. The job is not to delegate implementation. The caller supplies the model family that produced the candidate so the router can exclude same-family reviewers.
+After changing code or executable tests, invoke this skill automatically before completion or landing handoff; follow `references/development-completion.md`. Compatible hosts obtain independent review/challenge here, never delegate implementation. The caller supplies the implementer's model family so the router excludes same-family reviewers.
 
 ## Modes
 
@@ -13,7 +13,7 @@ Choose the smallest useful mode:
 
 - **Review mode**: normal pre-merge or plan review. Find blocking or materially misleading issues.
 - **Challenge mode**: adversarial pass modeled after `codex challenge`. Try to break the diff or decision by finding production failure paths.
-- **Complete mode**: local exact-candidate deep-self-review checkpoint after a passed final round. It invokes no reviewer and grants no human or merge authority.
+- **Complete mode**: local exact-candidate checkpoint after passing review or bound source refutations under the staged contract. It invokes no reviewer and grants no merge authority.
 - **Consult mode**: ask Claude a bounded question when no diff or plan review is needed.
 
 Use challenge mode when the user asks for "challenge", "poke holes", "try to break it", "adversarial", or when the change touches money, permissions, privacy, compliance, tenant/user data, production rollout, high-impact AI, architecture, economics, or IA.
@@ -74,7 +74,7 @@ Positive challenge capacity opens it at index 1; budget zero is untracked.
 The sole release/high-risk budget-zero exception is a controller-proved
 `markdown-punctuation-only` review: it requires `wording_only_boundary`, permits
 no `complete`, and rejects an author assertion alone (recipe:
-`references/staged-review-contract.md`). After a clean tracked
+`references/staged-review-contract.md`). After a clean/source-refuted tracked
 challenge, `complete` may close early and preserve unused rounds. Every result
 exposes controller-owned `self_review_gate`; an outstanding checkpoint blocks
 only external review or completion, not implementation or tests. Even a passed
@@ -215,10 +215,11 @@ Run the script by path while keeping `--cwd` pointed at the product repository u
 
 **The packet is the reviewer's whole world — compose it deliberately.** Review and challenge are built packet-bounded — Claude runs `--tools ""` with no `--add-dir`, and the other wrappers run in an isolated run workspace or a packet-only read surface. Treat the packet as the reviewer's whole world when deciding coverage: it is the only content bound by the packet hash and scanned before egress, so anything outside it is neither reliably visible to the reviewer nor covered by the verdict; a diff-only packet surfaces defects visible inside the changed lines and little else, and `--paths` only narrows it further. Whatever is absent from the packet is unreachable, not merely missed: a contradiction with an unchanged sibling clause, drift against a carrier outside the diff, or a silent weakening of upstream wording cannot be found by a reviewer who never saw the other side — that is the packet's shape, not the reviewer's weakness.
 
+- Codex permits frozen-packet read/search; see [tool boundaries](references/development-completion.md#review-tools).
 - To widen the packet, assemble it yourself and pass `--diff-file`: it replaces base-derived generation, is mutually exclusive with `--base`/`--paths`, and must name a regular file (no symlink or hardlink) holding text without NUL bytes. Worth adding beyond the diff — the canonical rule or contract text the changed lines must not contradict, the sibling clauses in the same file, the derived carriers that restate the change (commit message, MR/PR body), and the actual output of a gate or script under review. The gate hard-caps a packet at 200,000 bytes; split a larger candidate as described in the next bullet.
 - A verdict covers exactly the packet it was taken on, because the recorded packet hash is the reviewed identity. Within a packet, added context sits on top of the candidate diff and never in place of part of it. A candidate too large for one packet is split by file group or risk class into a partition that still covers the whole candidate — every part in some packet, none dropped — each partition's verdict recorded against its own packet hash, and the candidate-wide claim withheld until every partition is conclusive; one partition's `no blocking findings` is never a verdict on the landing candidate. Cross-partition contradictions are unreachable by construction, so repeat the shared canonical context in every partition's packet and review anything that spans partitions as its own packet.
 - Added context egresses to the selected reviewer exactly like the diff does, through the same credential tripwire — which catches machine-detectable secrets only. Paste rule text, carriers, and tool output; never paste credentials or material you would not send to that provider.
-- A finding that the input is insufficient to judge the change is an input defect, not a candidate defect: widen the packet and rerun that lane rather than editing the candidate to satisfy it. A reviewer reporting that the input is insufficient to judge the change is reporting an input defect — add the missing context and rerun that lane, do not edit the candidate to satisfy it.
+- A finding that the input is insufficient to judge the change is an input defect, not a candidate defect: widen the packet and rerun that lane rather than editing the candidate to satisfy it.
 
 When intentionally reviewing `code-review` itself, override the resolver from the ccl-skills repo under review before invoking the gate:
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/development-completion.md

@@ -0,0 +1,26 @@
+# Automatic review after development
+
+This transition applies across implementation owners, including narrow fixes and executable-test changes. Do not wait for the user to request review. Use the actual diff to classify the work: an implementation diff triggers this transition regardless of the task label. Read-only investigation, status answers and design-only work retain their owning workflow; they do not acquire an implementation-review requirement merely by using a development skill.
+
+## Before invoking review
+
+1. Recover the current task, actual diff, scope and authorization. Changing the implementation or scope reopens this check; an earlier plan review cannot discharge review of the resulting code.
+2. Finish proportionate implementer self-review and affected verification. A failed quality check calls for available in-scope diagnosis and cleanup under [refactoring discipline](../../product-rd-workflow/references/refactoring-discipline.md#responding-to-quality-gates); preserve behavior and readability, rerun the check, and escalate only a remaining real blocker. Use `testing-strategy` to select tests: changed named test properties require the killing-mutation walk on disposable or restore-guarded resources; when the same contract has two implementations or paths, use differential/equivalence checks with bounded, asserted known differences. Record a concrete applicability or unavailable-evidence reason when a test family does not run. Do not force a full mutation framework or differential suite onto an unrelated change.
+3. Reuse a terminal independent review only when it covers the current candidate and satisfies the applicable owner gate, reviewer independence and required depth. Record the receipt location and its candidate identifier (commit or diff/packet digest), then compare with the current candidate using the owning gate's binding rules; HEAD alone cannot cover uncommitted edits. A different or missing candidate identifier cannot discharge review. A loaded skill, self-review, planned command, unfinished handle or unverified prose claim is not that evidence. A native subagent result counts only when the owning gate accepts its independence and evidence; it never silently substitutes for a required CLI receipt.
+4. An explicit user instruction to skip review controls this task: record `skipped`, not `passed`, and preserve any separate landing restrictions. Record its original wording and current scope; a superseded or unrelated instruction is not a skip for this task. Do not ask for confirmation of ordinary review already within the authorized development task. User client restrictions and existing confidentiality boundaries still control reviewer selection; capability matters, not a numeric CLI or skill version.
+
+## Invoke and finish
+
+When no valid current review discharges the requirement, invoke `scripts/review_gate.sh` from this skill's actual installed/source directory with the current candidate, real implementer family, user client order and applicable risk tags. Follow the entrypoint's script contract; narrow work may use its derived-default plan. Use ordinary review for ordinary development; challenge and additional owner gates apply when triggered. Do not inflate a narrow repair into a product-design or shared-skill review ceremony.
+
+Invoke the reviewer in the same turn once self-checks are ready. Await an existing handle to its terminal result; do not stop at “review next,” start a duplicate process, or present timeout, invalid output or authentication failure as pass. Handle operational failures using the existing bounded recovery rules; a stopped reviewer lane does not stop safe independent work or authorize completion.
+
+Verify each finding against the actual call path and evidence. Fix confirmed defects and rerun affected checks; record evidenced rejection, deferral or acceptance under the owning gate. Pre-existing issues and optional suggestions do not automatically expand the task. After a tracked review and challenge on the unchanged candidate, when every finding is source-refuted, run the local disposition completion path in [the staged contract](staged-review-contract.md#mechanical-self-review-gate). Keep the raw findings; do not rerun merely to obtain zero findings or reset a review budget. Budget exhaustion limits reviewer calls, so finish available disposition, self-review and validation work in the same turn. A changed candidate still needs the owning gate's renewed review.
+
+Before completion or landing handoff, report the actual diff classification and a concrete reason if review is inapplicable. Support that classification with the change-inspection command and result, including untracked implementation files. Report the actual review outcome and candidate it covers, relevant tests and their results, skips, unresolved findings and remaining restrictions. A failed or missing required review leaves review/completion pending. Review does not grant permission to commit, push, merge, publish or deploy.
+
+## Review tools
+
+Packet-only allows read-only tools over the frozen material. Codex exposes pathless `read_packet` and `search_packet`; the parser checks returned content against the same packet and requires completed calls. Each server read checks the packet hash. Shell execution is disabled by effective capability, and inherited MCP servers are disabled only for this invocation. Unsupported capability falls back without a CLI version requirement. A read-only sandbox alone does not disable commands.
+
+Installed owner skills supply review lenses, not permission to execute development workflows or fetch references outside the packet. Add missing source context to the packet through the entrypoint's packet-composition contract. Read/search does not expand the verdict's coverage beyond its recorded packet.

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/staged-review-contract.md

@@ -8,10 +8,10 @@ The controller has three modes:
 
 Explore/build may configure `challenge_budget=0..4`; release/high-risk requires
 at least one challenge unless the exact candidate qualifies for the
-proof-bound wording-only single-review exception below. The initial review consumes Agent round 1, so total
-Agent-autonomous external review is at most five rounds. Human-requested review
-is outside this budget and must be attributed by the consuming trusted platform.
-The budget is a ceiling, not a quota: after a clean tracked challenge, local
+proof-bound wording-only single-review exception below. The initial review consumes chain round 1;
+each bounded chain uses at most five rounds. Necessary task-scoped review after a
+checkpoint inherits existing task authority; attribute explicit human round requests separately.
+The budget is a ceiling, not a quota: after a clean or fully source-refuted tracked challenge, local
 `complete` may close the chain early. It preserves unused-round count but sets
 `autonomous_review_allowed=false`; release/high-risk still requires at least one
 challenge before this early close is eligible.
@@ -283,7 +283,7 @@ Multi-round Agent automation supplies `review_chain_id`, a contiguous
 `autonomous_review_index` in `1..5`, and every earlier result through ordered
 `--prior-review-result-file` arguments. Prior rounds may contain findings and
 older candidate hashes; they remain consumed. Candidate edits, commits, plan
-refreshes, mode changes, and renamed invocations do not reset Agent authority.
+refreshes, mode changes, and renamed invocations never erase spending or broaden task authority.
 An initial `review` with positive challenge capacity must start this chain at
 index 1; an untracked initial review is single-round and therefore uses budget 0.
 
@@ -324,7 +324,7 @@ Envelope `schema_version` is `3`; a legacy `2` envelope predates the recorded
 scope and is rejected, which requires restarting an in-flight chain. Every
 prior round must retain the same controller digest, owner-selection source,
 selected owner names, and selected-owner digest. Missing, substituted,
-inconclusive, reordered, renamed-chain, or fourth-round input fails before any
+inconclusive, reordered, renamed-chain, or over-budget input fails before any
 provider runs. Scope drift returns `review_scope_changed` and requires deep
 self-review plus explicit task reframing; it does not silently create a new
 Agent budget. An untracked challenge is one-off advisory evidence; it cannot
@@ -332,8 +332,8 @@ enter a later Agent round or satisfy the local completion checkpoint.
 
 Two consequences follow from those stable bindings and must be planned for before round 1:
 
-- The selected-owner digest hashes each selected owner package's current working tree, and owners derive from the candidate's own paths — so a candidate edit inside any selected owner package invalidates every prior receipt and the next tracked round fails `review_chain_invalid`. For a self-hosted candidate (a skill-repo diff editing the package that owns it) that is nearly every applied fix — one confined to files outside every selected owner drifts only the candidate hash and may continue in-chain: "do not reset Agent authority" promises no continuation, and the in-chain tolerance for older candidate hashes is reachable only while the fix stays outside its selected owners.
-- A chain restarted after such a break re-enters the same cumulative Agent budget and must never be counted as fresh authority; the bounded restart recipe for the extraction lane (batched dispositions, cross-chain round accounting, full-context first packet, terminal disposition at the cap) is owned by the extraction workflow's dual-track gate reference.
+- The selected-owner digest hashes each selected owner package's current working tree, and owners derive from the candidate's own paths — so a candidate edit inside any selected owner package invalidates every prior receipt and the next tracked round fails `review_chain_invalid`. For a self-hosted candidate (a skill-repo diff editing the package that owns it) that is nearly every applied fix — one confined to files outside every selected owner drifts only the candidate hash and may continue in-chain: in-chain tolerance for older candidate hashes applies only while fixes stay outside selected owners. Necessary recovery uses fresh bindings after the task checkpoint below.
+- A chain restarted after such a break never erases cumulative spending or task history. An existing task includes necessary fixes, tests and review by default. At exhaustion, first disposition findings from source, run deep self-review and tests, and change the failed method or add missing evidence before another necessary bounded sequence. Record `continuation_basis=existing-task-scope`, the original authority reference and scope, the reason and changed method/evidence, cumulative rounds, and old/new sequence links in the caller-owned task artifact. Preserve every earlier receipt, focus and disposition; do not add this field to CLI arguments or runtime receipts. Existing per-chain and consuming-owner sequence bounds still apply; the extraction recipe remains in its dual-track gate reference. No repeated calls solely to obtain an empty verdict, invented human round requests, history reset or ignored user cost/round/stop limit is allowed.
 
 The controller is stateless and prevents accidental/cooperative resets only. A
 trusted host or platform must retain the ledger when hostile local callers are in
@@ -370,10 +370,34 @@ allowing refreshed self-review conclusions and evidence, and is the Agent path t
 round index, prior-result hashes, and prior challenge focuses. It is not a human
 waiver or merge authorization.
 
+For an unchanged candidate with a conclusive tracked review and challenge,
+`complete` also accepts `--finding-dispositions-file`. Supply every earlier raw
+receipt with ordered `--prior-review-result-file` arguments and the final one
+with `--completion-review-result-file`. The UTF-8 JSON has `schema_version: 1`,
+`candidate_sha256`, ordered `review_result_sha256` hashes including the final
+receipt, and `dispositions`. Each disposition contains `receipt_sha256`, the
+canonical-JSON `finding_sha256`, `disposition: "source_refuted"`, and a non-empty
+`evidence` array naming the first-hand source or failure-path counter-evidence.
+Every original finding occurrence must appear exactly once. Within one receipt,
+findings with identical canonical content share one hash-pair identity in
+first-seen order; retain every raw entry unchanged. Different content or a
+different receipt remains a separate occurrence. Missing history,
+changed candidates, inconclusive results, open findings and risk acceptance do
+not qualify. A code fix with changed bytes requires renewed review.
+
+This local checkpoint records `completion_basis=source_refuted_findings`, the
+dispositions digest and resolved occurrence bindings; original external
+findings remain unchanged. A clean external result uses `external_pass`.
+Validation proves binding and coverage, not the truth of an evidence statement:
+the implementer must trace the cited source, and the judgment remains open to
+challenge. No budget is refreshed and no model is called. At the review cap,
+finish this local work instead of requesting another round solely to obtain an
+empty verdict. Unresolved findings still block completion, not independent work.
+
 ## Human and failure boundary
 
-Only an external authenticated platform action may prove human request, stop,
-resume, waiver, commit, or merge authority. A `review_waiver` clears only the
+Existing task scope covers necessary continuation; exhaustion alone creates no new grant.
+Only an external authenticated platform action may prove new human request, stop, resume, waiver, commit, or merge authority. A `review_waiver` clears only the
 review-process gate. A distinct exact-candidate `merge_authorization` is the
 human's final decision: CI may keep running and reporting every failed/pending
 gate, but none may block that authorized merge. Report
@@ -381,9 +405,9 @@ gate, but none may block that authorized merge. Report
 
 Provider/input/integrity failures stop that reviewer lane, not the whole task.
 Their stable action is `stop_reviewer_lane`, never the ambiguous `stop`.
-Budget exhaustion likewise stops only automatic reviewer calls. Continue local
-fixes, self-review, tests, and independent work; park only decision-dependent
-work. Enter `awaiting_human` only when no independent runnable work remains.
+Budget exhaustion triggers the method/authority checkpoint, not an automatic user handoff. Check legacy
+`human_decision_required` / `continuation_authorization_required` against existing task scope first.
+Continue necessary bounded review; enter `awaiting_human` only for a genuine missing decision, explicit user limit or authority outside that scope.
 
 The current result envelope is schema 3. The generic per-invocation `--timeout`
 keeps its 600-second default and accepts 5..1200 seconds; direct wrappers clamp

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/AGENTS.md

@@ -5,8 +5,11 @@ parsers for Claude, Kimi, OpenCode, and Codex.
 
 Rules:
 
-- Preserve no-tools posture and structured output validation. A malformed,
-  timeout, or inconclusive wrapper result is not a pass.
+- Preserve the packet boundary and structured output validation. A wrapper may
+  expose pathless read/search tools over its frozen, hash-bound packet; verify
+  their arguments, returned bytes and completed lifecycle. This does not permit
+  arbitrary commands or workspace access. A malformed, timeout, or inconclusive
+  wrapper result is not a pass.
 - **Never pin the parser to a CLI version's vocabulary.** `parse_probe_result.py`
   gates on *shape*, not on field/value names: the isolation proof is the exact
   `tools` allowlist plus the tool_use scan, which no init field can bypass.