@ccoalm/ccl-skills 0.15.0 → 0.15.2

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/codex_review.sh

@@ -140,10 +140,15 @@ CODEX_EXEC_HELP="$(timeout --kill-after=1s 5s "$CODEX_BIN_PATH" exec --disable h
 # supported lifecycle state: `features list` still prints removed keys, and a
 # removed or unknown-state row means `--disable hooks` may be a silent no-op
 # that lets user-trusted hooks run during packet-only review.
-CODEX_FEATURES_LIST="$(timeout --kill-after=1s 5s "$CODEX_BIN_PATH" features list 2>/dev/null)" \
+CODEX_FEATURES_LIST="$(timeout --kill-after=1s 5s "$CODEX_BIN_PATH" features list --disable hooks --disable shell_tool 2>/dev/null)" \
   || die_inconclusive codex_hook_disable_unavailable capability_missing true
-grep -Eq '^hooks[[:space:]]+(stable|under development|experimental)([[:space:]]|$)' <<<"$CODEX_FEATURES_LIST" \
+grep -Eq '^hooks[[:space:]]+(stable|under development|experimental)[[:space:]]+false[[:space:]]*$' <<<"$CODEX_FEATURES_LIST" \
   || die_inconclusive codex_hook_disable_unavailable capability_missing true
+# A read-only sandbox still exposes command execution. Disable the actual
+# shell surface, including its unified-exec implementation, before inference.
+# Check effective capability rather than a CLI release number or flag parsing.
+grep -Eq '^shell_tool[[:space:]]+(stable|under development|experimental)[[:space:]]+false[[:space:]]*$' <<<"$CODEX_FEATURES_LIST" \
+  || die_inconclusive codex_shell_disable_unavailable capability_missing true
 if [ -n "${CODEX_HOME:-}" ]; then
   SOURCE_HOME="$CODEX_HOME"
 else
@@ -240,6 +245,72 @@ fi
 DIFF_TEXT="$(cat "$DIFF_FILE" || exit 1; printf '\001')" \
   || die_inconclusive diff_read_failed local_tool_failure false
 DIFF_TEXT="${DIFF_TEXT%$'\001'}"
+PACKET_FILE="$RUN_ROOT/packet.txt"
+PACKET_SERVER="$SCRIPT_DIR/kimi_packet_mcp.py"
+[ -f "$PACKET_SERVER" ] && [ -r "$PACKET_SERVER" ] && [ ! -L "$PACKET_SERVER" ] \
+  || die_inconclusive packet_server_missing local_tool_failure false
+printf '%s' "$DIFF_TEXT" >"$PACKET_FILE"
+PACKET_SHA256="$(python3 - "$PACKET_FILE" <<'PY_HASH'
+import hashlib, sys
+from pathlib import Path
+print(hashlib.sha256(Path(sys.argv[1]).read_bytes()).hexdigest())
+PY_HASH
+)" || die_inconclusive packet_hash_failed local_tool_failure false
+MCP_CONFIG="$(python3 - "$PACKET_FILE" "$PACKET_SERVER" "$PACKET_SHA256" <<'PY_MCP_CONFIG'
+import json, sys
+values = [sys.argv[2], "--packet", sys.argv[1], "--sha256", sys.argv[3], "--allow-search"]
+print('mcp_servers={code_review_packet={command=' + json.dumps(sys.executable)
+      + ',args=[' + ','.join(json.dumps(value) for value in values)
+      + '],enabled=true,enabled_tools=["read_packet","search_packet"]}}')
+PY_MCP_CONFIG
+)" || die_inconclusive packet_config_failed local_tool_failure false
+# TOML overrides merge server tables. Disable inherited servers for this run
+# without changing user configuration, then verify the effective public list.
+CODEX_PACKET_CONFIG=(-c "$MCP_CONFIG" -c 'web_search="disabled"' -c 'approval_policy="never"')
+CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s 5s "$CODEX_BIN_PATH" mcp list --json "${CODEX_PACKET_CONFIG[@]}" >"$RUN_ROOT/mcp.json" 2>"$STDERR_FILE" \
+  || die_inconclusive codex_packet_tools_unavailable capability_missing true
+MCP_CONFIG="$(python3 - "$RUN_ROOT/mcp.json" "$MCP_CONFIG" <<'PY_MCP_OVERRIDES'
+import json, sys
+from pathlib import Path
+try:
+    rows = json.loads(Path(sys.argv[1]).read_text())
+    if not isinstance(rows, list):
+        raise ValueError()
+    disabled = []
+    for row in rows:
+        if not isinstance(row, dict) or not isinstance(row.get("name"), str) or not row["name"]:
+            raise ValueError()
+        if row["name"] != "code_review_packet":
+            disabled.append(json.dumps(row["name"]) + "={enabled=false}")
+    print(sys.argv[2][:-1] + "".join("," + entry for entry in disabled) + "}")
+except (OSError, ValueError, TypeError):
+    sys.exit(1)
+PY_MCP_OVERRIDES
+)" || die_inconclusive codex_packet_tools_unavailable capability_missing true
+CODEX_PACKET_CONFIG=(-c "$MCP_CONFIG" -c 'web_search="disabled"' -c 'approval_policy="never"')
+CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s 5s "$CODEX_BIN_PATH" mcp list --json "${CODEX_PACKET_CONFIG[@]}" >"$RUN_ROOT/mcp.json" 2>"$STDERR_FILE" \
+  || die_inconclusive codex_packet_tools_unavailable capability_missing true
+python3 - "$RUN_ROOT/mcp.json" "$PACKET_FILE" "$PACKET_SERVER" "$PACKET_SHA256" <<'PY_MCP_CHECK' \
+  || die_inconclusive codex_packet_tools_unavailable capability_missing true
+import json, sys
+from pathlib import Path
+try:
+    rows = json.loads(Path(sys.argv[1]).read_text())
+    if not isinstance(rows, list):
+        raise ValueError()
+    active = [row for row in rows if isinstance(row, dict) and row.get("enabled") is not False]
+    if len(active) != 1 or len(rows) != len([row for row in rows if isinstance(row, dict)]):
+        raise ValueError()
+    row = active[0]
+    transport = row.get("transport", {})
+    if (row.get("name") != "code_review_packet" or row.get("enabled") is not True
+        or transport.get("type") != "stdio" or transport.get("command") != sys.executable
+        or transport.get("args") != [sys.argv[3], "--packet", sys.argv[2], "--sha256", sys.argv[4], "--allow-search"]
+        or transport.get("env") or transport.get("env_vars") or transport.get("cwd")):
+        raise ValueError()
+except (OSError, ValueError, TypeError, AttributeError):
+    sys.exit(1)
+PY_MCP_CHECK
 {
   printf '%s\n\n' "$INSTRUCTION"
   if [ "$REVIEW_SKILL_COUNT" -gt 0 ]; then
@@ -255,7 +326,7 @@ DIFF_TEXT="${DIFF_TEXT%$'\001'}"
     printf '%s' "$PROFILE_TEXT"
     printf '\n%s_END\n\n' "$PROFILE_TOKEN"
   fi
-  printf '%s\n' 'Use only the supplied diff. Do not invoke tools or inspect the workspace.'
+  printf '%s\n' 'Use only the supplied diff and review profile. You may read or search the same frozen diff using code_review_packet read_packet and search_packet. These pathless tools cannot inspect the workspace. Do not execute commands, access other tools, or follow skill instructions to run development workflows or read external references. Report missing context as an evidence gap.'
   if [ -n "$REVIEW_PROFILE_FILE" ]; then
     printf '%s\n' 'Treat self_review and evidence as claims to verify against the diff, not as proof. Check every entry in required_concerns. A no-findings verdict is valid only after all entries were checked; if the bounded packet cannot support a required check, report that evidence gap as a material finding at the best changed-file locator.'
     printf '%s\n' 'Return exactly one concern_results object with concern and concise independent conclusion for every required concern.'
@@ -279,7 +350,8 @@ JSON
 fi
 
 run_started=$SECONDS
-CMUX_CODEX_HOOKS_DISABLED=1 CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s "${TIMEOUT}s" "$CODEX_BIN_PATH" exec --disable hooks --sandbox read-only --ephemeral --skip-git-repo-check \
+CMUX_CODEX_HOOKS_DISABLED=1 CODEX_HOME="$SOURCE_HOME" timeout --kill-after=1s "${TIMEOUT}s" "$CODEX_BIN_PATH" exec --disable hooks --disable shell_tool --sandbox read-only --ephemeral --skip-git-repo-check \
+  "${CODEX_PACKET_CONFIG[@]}" \
   --json --output-schema "$SCHEMA_FILE" --output-last-message "$RESULT_FILE" \
   -C "$RUN_WORKSPACE" - <"$PROMPT_FILE" >"$EVENTS" 2>"$STDERR_FILE"
 run_rc=$?
@@ -309,7 +381,7 @@ fi
 
 python3 "$PARSER" --client codex --mode "$MODE" --implementer-family "$IMPL_FAMILY" \
   --reviewer-family "$FAMILY" --provider "$PROVIDER" --model "$MODEL" \
-  --events "$EVENTS" --result-file "$RESULT_FILE" >"$PARSED_FILE"
+  --events "$EVENTS" --result-file "$RESULT_FILE" --packet "$PACKET_FILE" --packet-sha256 "$PACKET_SHA256" >"$PARSED_FILE"
 parser_rc=$?
 if [ "$parser_rc" -eq 0 ]; then
   native_skill_binding="not_requested"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/kimi_packet_mcp.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Expose one SHA-256-bound review packet through a pathless stdio MCP tool."""
+"""Expose one SHA-256-bound review packet through pathless stdio MCP tools."""
 
 from __future__ import annotations
 
@@ -12,8 +12,11 @@ from typing import Any
 
 
 TOOL_NAME = "read_packet"
+SEARCH_TOOL_NAME = "search_packet"
 MAX_PAGE_BYTES = 48_000
 MAX_CHUNK_BYTES = 46_000
+MAX_QUERY_BYTES = 1_024
+MAX_SEARCH_RESULTS = 100
 
 
 def packet_bytes(path: Path, expected_sha256: str) -> bytes:
@@ -57,6 +60,84 @@ def tool_result(text: str, *, error: bool = False) -> dict[str, Any]:
     return {"content": [{"type": "text", "text": text}], "isError": error}
 
 
+def search_tool_definition() -> dict[str, Any]:
+    return {
+        "name": SEARCH_TOOL_NAME,
+        "description": (
+            "Find non-overlapping, case-sensitive literal substrings in the one "
+            "controller-frozen review packet. No regex or filesystem paths. "
+            "Query is at most 1024 UTF-8 bytes; byte_offset must be a UTF-8 "
+            "boundary. Returns byte offsets and 1-based line numbers, with "
+            "next_byte_offset for more matches or null when exhausted. "
+            "Use read_packet at a match offset to inspect its context."
+        ),
+        "inputSchema": {
+            "type": "object",
+            "properties": {
+                "query": {"type": "string", "minLength": 1, "maxLength": MAX_QUERY_BYTES},
+                "byte_offset": {"type": "integer", "minimum": 0},
+                "limit": {"type": "integer", "minimum": 1, "maximum": MAX_SEARCH_RESULTS},
+            },
+            "required": ["query", "byte_offset", "limit"],
+            "additionalProperties": False,
+        },
+    }
+
+
+def search_packet(path: Path, expected_sha256: str, arguments: Any) -> dict[str, Any]:
+    if not isinstance(arguments, dict) or set(arguments) != {"query", "byte_offset", "limit"}:
+        return tool_result("invalid packet search arguments", error=True)
+    query = arguments.get("query")
+    byte_offset = arguments.get("byte_offset")
+    limit = arguments.get("limit")
+    if (
+        not isinstance(query, str)
+        or not isinstance(byte_offset, int)
+        or isinstance(byte_offset, bool)
+        or byte_offset < 0
+        or not isinstance(limit, int)
+        or isinstance(limit, bool)
+        or not 1 <= limit <= MAX_SEARCH_RESULTS
+    ):
+        return tool_result("invalid packet search arguments", error=True)
+    try:
+        needle = query.encode("utf-8")
+    except UnicodeEncodeError:
+        return tool_result("invalid packet search arguments", error=True)
+    if not 1 <= len(needle) <= MAX_QUERY_BYTES:
+        return tool_result("invalid packet search arguments", error=True)
+    try:
+        data = packet_bytes(path, expected_sha256)
+    except (OSError, ValueError):
+        return tool_result("packet binding changed", error=True)
+    if byte_offset > len(data):
+        return tool_result("packet search starts beyond end", error=True)
+    try:
+        data[:byte_offset].decode("utf-8")
+    except UnicodeDecodeError:
+        return tool_result("packet search starts inside a UTF-8 character", error=True)
+
+    matches = []
+    cursor = byte_offset
+    while len(matches) < limit:
+        found = data.find(needle, cursor)
+        if found < 0:
+            break
+        matches.append({"byte_offset": found, "line": data.count(b"\n", 0, found) + 1})
+        cursor = found + len(needle)
+    rendered = json.dumps(
+        {
+            "matches": matches,
+            "next_byte_offset": cursor if data.find(needle, cursor) >= 0 else None,
+            "total_bytes": len(data),
+        },
+        separators=(",", ":"),
+    )
+    if len(rendered.encode("utf-8")) > MAX_PAGE_BYTES:
+        return tool_result("packet search exceeds result bound", error=True)
+    return tool_result(rendered)
+
+
 def read_chunk(path: Path, expected_sha256: str, arguments: Any) -> dict[str, Any]:
     if not isinstance(arguments, dict) or set(arguments) != {"byte_offset", "max_bytes"}:
         return tool_result("invalid packet chunk arguments", error=True)
@@ -119,7 +200,9 @@ def response(request_id: Any, *, result: Any = None, error: Any = None) -> dict[
     return payload
 
 
-def handle(message: Any, path: Path, expected_sha256: str) -> dict[str, Any] | None:
+def handle(
+    message: Any, path: Path, expected_sha256: str, *, allow_search: bool = False
+) -> dict[str, Any] | None:
     if not isinstance(message, dict) or message.get("jsonrpc") != "2.0":
         return response(None, error={"code": -32600, "message": "Invalid Request"})
     request_id = message.get("id")
@@ -140,9 +223,17 @@ def handle(message: Any, path: Path, expected_sha256: str) -> dict[str, Any] | N
     if method == "ping":
         return response(request_id, result={})
     if method == "tools/list":
-        return response(request_id, result={"tools": [tool_definition()]})
+        definitions = [tool_definition()]
+        if allow_search:
+            definitions.append(search_tool_definition())
+        return response(request_id, result={"tools": definitions})
     if method == "tools/call":
         params = message.get("params")
+        if isinstance(params, dict) and allow_search and params.get("name") == SEARCH_TOOL_NAME:
+            return response(
+                request_id,
+                result=search_packet(path, expected_sha256, params.get("arguments")),
+            )
         if not isinstance(params, dict) or params.get("name") != TOOL_NAME:
             return response(request_id, result=tool_result("unknown tool", error=True))
         return response(
@@ -156,6 +247,9 @@ def main() -> int:
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("--packet", required=True)
     parser.add_argument("--sha256", required=True)
+    parser.add_argument(
+        "--allow-search", action="store_true", help="also expose bounded literal packet search"
+    )
     args = parser.parse_args()
     if not len(args.sha256) == 64 or any(ch not in "0123456789abcdef" for ch in args.sha256):
         parser.error("--sha256 must be a lowercase SHA-256 digest")
@@ -169,7 +263,7 @@ def main() -> int:
     for raw_line in sys.stdin:
         try:
             message = json.loads(raw_line)
-            payload = handle(message, path, args.sha256)
+            payload = handle(message, path, args.sha256, allow_search=args.allow_search)
         except (json.JSONDecodeError, UnicodeError):
             payload = response(None, error={"code": -32700, "message": "Parse error"})
         if payload is not None:

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/parse_cli_review.py

@@ -10,6 +10,7 @@ import re
 from typing import Any
 
 from concern_excerpt import bounded_reason_detail, concern_fields
+import kimi_packet_mcp as packet_tools
 from kimi_packet_mcp import MAX_CHUNK_BYTES
 
 
@@ -652,6 +653,18 @@ def audit_codex(
     def invalid(reason: str) -> dict[str, Any]:
         return invalid_model_output(args, reason, "\n".join(concern_fragments))
 
+    packet_path = getattr(args, "packet", None)
+    packet_sha256 = getattr(args, "packet_sha256", None)
+    if packet_path or packet_sha256:
+        try:
+            if not packet_path or not packet_sha256:
+                raise ValueError()
+            packet_tools.packet_bytes(Path(packet_path), packet_sha256)
+        except (OSError, ValueError):
+            return inconclusive(args, "Codex packet binding changed", "binding_mismatch", False)
+    pending_packet_calls: dict[str, tuple[str, Any]] = {}
+    completed_packet_calls: set[str] = set()
+
     for event in events:
         event_type = event.get("type")
         if event_type == "turn.completed":
@@ -678,6 +691,39 @@ def audit_codex(
                 attempted_tool=event_type,
             )
         item_type = item.get("type")
+        if item_type == "mcp_tool_call" and packet_path and packet_sha256:
+            tool = item.get("tool")
+            if item.get("server") != "code_review_packet" or tool not in {"read_packet", "search_packet"}:
+                return inconclusive(args, "Codex attempted a tool outside the frozen packet", "tool_boundary_violation", False)
+            reader = packet_tools.read_chunk if tool == "read_packet" else packet_tools.search_packet
+            expected = reader(Path(packet_path), packet_sha256, item.get("arguments"))
+            content = expected["content"]
+            if expected.get("isError") and content[0]["text"] == "packet binding changed":
+                return inconclusive(args, "Codex packet binding changed", "binding_mismatch", False)
+            if expected.get("isError") and content[0]["text"].startswith("invalid packet"):
+                return inconclusive(args, "Codex supplied arguments outside the packet tool schema", "tool_boundary_violation", False)
+            call_id = item.get("id")
+            signature = (tool, item.get("arguments"))
+            if (not isinstance(call_id, str) or not call_id or call_id in completed_packet_calls
+                or (call_id in pending_packet_calls and pending_packet_calls[call_id] != signature)):
+                return inconclusive(args, "Codex packet tool lifecycle is unverifiable", "transport_unverifiable", False)
+            if event_type != "item.completed":
+                if item.get("status") != "in_progress":
+                    return inconclusive(args, "Codex packet tool lifecycle is unverifiable", "transport_unverifiable", False)
+                pending_packet_calls[call_id] = signature
+                continue
+            result = item.get("result")
+            if not isinstance(result, dict):
+                return invalid("Codex packet tool returned no verifiable result")
+            if (result.get("content") != content or result.get("structured_content") not in (None, {})
+                or result.get("structuredContent") not in (None, {})):
+                return inconclusive(args, "Codex packet tool result did not match frozen bytes", "binding_mismatch", False)
+            allowed_statuses = {"completed", "failed"} if expected.get("isError") else {"completed"}
+            if item.get("status") not in allowed_statuses or (item.get("error") and not expected.get("isError")):
+                return invalid("Codex packet tool did not complete successfully")
+            pending_packet_calls.pop(call_id, None)
+            completed_packet_calls.add(call_id)
+            continue
         if item_type == "agent_message":
             item_text = item.get("text")
             if isinstance(item_text, str) and item_text.strip():
@@ -729,7 +775,7 @@ def audit_codex(
             )
         if event_type == "item.completed" and item_type == "agent_message":
             saw_completed_agent_message = True
-    if not saw_completed_agent_message or not saw_completed_turn:
+    if pending_packet_calls or not saw_completed_agent_message or not saw_completed_turn:
         return inconclusive(
             args,
             "Codex event stream lacked positive completion evidence",
@@ -926,6 +972,7 @@ def main() -> int:
     parser.add_argument("--model", default="")
     parser.add_argument("--events", required=True)
     parser.add_argument("--packet")
+    parser.add_argument("--packet-sha256")
     parser.add_argument("--packet-delivery", choices=("mcp", "inline"), default="mcp")
     parser.add_argument("--packet-receipt", default="")
     parser.add_argument("--result-file")