@ccoalm/ccl-skills 0.18.7 → 0.18.9

package/dist/assets/marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/pre-final-continuation-gate.md

@@ -89,17 +89,17 @@ The entrypoint uses `proposed-next:` as an observable handoff, not an authorizat
 
 At the start of the next turn, recover intent in this order:
 
-1. Follow the current explicit user instruction, including a correction, changed scope, stop, or status-only request.
+1. Follow the current explicit user instruction, including a correction, changed scope, stop, or status-only request. A clarifying question is not a status-only request: answer it, then continue the active authorized action unless the user also stopped it.
 2. For short assent, read back the original wording of the most recent still-active concrete proposal and check that later messages or task state have not withdrawn or superseded its action, scope, or authority. Quote that original proposal when stating the recovered action and scope; a summary or paraphrase alone cannot bind short assent. If recovery adds an action or broadens that quoted scope, select `blocked:` and ask. One recoverable action can bind with or without a marker; a stale, repeated, or conflicting marker is an assistant formatting defect to repair.
 3. If materially different proposals remain unresolved, or scope/authority is still unclear, ask one targeted question about that uncertainty. Do not ask the user to repair a marker or repeat a clear instruction. A marker alone never supplies missing authority.
 
-- Use the active owner's entry and safety gates for the recovered action. An authorized task includes necessary fixes, tests and review by default; neither a router nor a dispatched owner may discard that authority by relabeling its turn or exhausting an internal review sequence. Apply the owning review checkpoint and record `continuation_basis=existing-task-scope` with cumulative history in the caller-owned task artifact, not runtime JSON. Legacy `human_decision_required` / `continuation_authorization_required` values first require checking existing authority, not asking again. Explicit user cost, round-count and stop limits prevail; new scope, missing authority or real tradeoffs need a decision. Continuation grants no merge, publication or waiver authority. Intent recovery and authorization remain prose obligations. The optional `proposed-next-stop.sh` backstop checks missing handoff labels and declared next actions as described below; a label or hook receipt never proves the action is correct, authorized or complete.
+- Use the active owner's entry and safety gates for the recovered action. An authorized task includes necessary fixes, tests and review by default. A failure or diagnosis goal also includes the verified narrow fix through branch push and MR/PR to the development target unless an explicit user limit says otherwise (diagnosis only, no push, a cost cap); "you only asked me to investigate" is not missing authority. Neither a router nor a dispatched owner may discard that authority by relabeling its turn or exhausting an internal review sequence. Apply the owning review checkpoint and record `continuation_basis=existing-task-scope` with cumulative history in the caller-owned task artifact, not runtime JSON. Legacy `human_decision_required` / `continuation_authorization_required` values first require checking existing authority, not asking again. Explicit user cost, round-count and stop limits prevail; new scope, missing authority or real tradeoffs need a decision. Continuation grants no merge, publication or waiver authority. Intent recovery and authorization remain prose obligations. The optional `proposed-next-stop.sh` backstop checks missing handoff labels and declared next actions as described below; a label or hook receipt never proves the action is correct, authorized or complete.
 
 ### Stop-time continuation reminder
 
 On hosts providing a current final message, `proposed-next-stop.sh` returns one bounded Stop reminder when the assistant declares a non-status `proposed-next:` action. Recheck the active request: execute a runnable, already-authorized action in the same turn; otherwise preserve explicit stop, planning-only and status-only scope, or state the concrete decision/resource/authority blocker. Missing labels with observable delivery evidence retain their formatting reminder. A status-only marker without another action declaration, quoted example, complete machine artifact, unsupported payload or host `stop_hook_active` retry does not trigger a continuation reminder.
 
-- A stop that waits on the user gets one bounded decision recheck instead: a `blocked:` handoff, a `none` explanation naming an approval, confirmation, decision or resource wait, or a last prose line asking permission to continue, either before any handoff label or, without a label, after observable delivery or edits. The recheck names the real blockers (missing credentials or authority; a fact unavailable from local evidence; an action the safety rules gate, such as destructive or irreversible work without recovery, production or customer data, or merge or publication outside the goal; overturning an established user direction; a material product tradeoff the evidence cannot settle) and returns security self-review, owner-skill, approach, test and naming choices and the next in-scope step to the agent. A real blocker survives it by restating `blocked:` after independent work is finished.
+- A stop that waits on the user gets one bounded decision recheck instead: a `blocked:` handoff, a `none` explanation naming an approval, confirmation, decision or resource wait, or a last prose line asking permission to continue, either before any handoff label or, without a label, after observable delivery or edits. The recheck names the real blockers (missing credentials or authority; a fact unavailable from local evidence; an action the safety rules gate, such as destructive or irreversible work without recovery, production or customer data, or merge or publication outside the goal; overturning an established user direction; a material product tradeoff the evidence cannot settle) and returns security self-review, owner-skill, approach, test and naming choices and the next in-scope step to the agent. Both reminders also state the test a blocker must pass — it names something only the user can supply (a decision the evidence cannot settle, a credential or access grant, permission the goal does not cover, or a fact absent from every readable source) — so a step the agent can perform itself is never a blocker, whatever it costs in time or runs: a failure goal's verified fix through its MR/PR, a feature-branch push or MR/PR, a rerun or retry of a failed, timed-out or inconclusive check, and a lookup of facts or access the agent can reuse. A count or stop bar the agent proposed is not a user limit unless the user adopted it as one, and a clarifying question is not a status-only request. A real blocker survives it by restating `blocked:` after independent work is finished.
 - Do not request continuation for `none — status only` or another `none` status explanation, and never treat `blocked:` as a continuation request; the decision recheck above is separate. Mixed status/action markers still require reconciliation.
 
 The hook recognizes declarations, not authorization or actual task completion, and cannot force the model to follow through. OpenCode idle does not expose the required final-message evidence; its Stop behavior remains unverified.
@@ -110,7 +110,7 @@ An eligible next slice comes from an explicit status/task/acceptance source or a
 
 Action-scoped stop conditions are: an explicit stop/pause instruction; a user-requested status-only answer; a failed, pending or inconclusive required gate; a dirty/conflicting worktree that cannot be isolated; a required environment unavailable after remediation; a high-impact product, architecture or compliance decision; a destructive action; an external purchase or financial commitment; unclear ownership; ambiguous assent; missing stricter authorization; materially different viable approaches with none dominant and reversible; a speculative fix without evidenced cause; or no low-risk slice. Apply each condition to the affected action. For a failed check, perform available authorized diagnosis and remediation before stopping the whole task: cite the failure output, repair attempts (or evidence that repair is unsafe or outside authority), and residual blocker. A failed verdict alone does not block diagnosis.
 
-**Awaiting work you started yourself is not a stop condition.** A finite command, suite, gate, or review you launched, whose result only you consume, is in-flight work rather than a handoff: wait for it and continue in the same turn. A process meant to stay up — a dev server, a watch-mode runner, a tail — has no terminal result to wait for: take its readiness signal and proceed. Never poll it forever, and do not infer anything about its lifetime from this rule; whether it keeps running is the delivery's decision, and a service the user asked for is a deliverable, not a leftover. Ending the turn to report that it is running is a premature stop even when the report is accurate — the user gains nothing they can act on, and the next step was already authorized. Host behavior invites this: a backgrounded step returns control immediately, so the pause *looks* like a turn boundary. It is not one. Before ending any turn, name the next action; if you can perform it now, the turn is not over. The turn ends at the first action that genuinely needs the user — an unresolved decision, missing authority, an explicit stop — not at the nearest convenient pause. A user asking why you stopped is this defect's recurrence signal, not a request for a status update.
+**Awaiting work you started yourself is not a stop condition.** A finite command, suite, gate, or review you launched, whose result only you consume, is in-flight work rather than a handoff: wait for it and continue in the same turn. A process meant to stay up — a dev server, a watch-mode runner, a tail — has no terminal result to wait for: take its readiness signal and proceed. Never poll it forever, and do not infer anything about its lifetime from this rule; whether it keeps running is the delivery's decision, and a service the user asked for is a deliverable, not a leftover. Ending the turn to report that it is running is a premature stop even when the report is accurate — the user gains nothing they can act on, and the next step was already authorized. Host behavior invites this: a backgrounded step returns control immediately, so the pause *looks* like a turn boundary. It is not one. Before ending any turn, name the next action; if you can perform it now, the turn is not over. The turn ends at the first action that genuinely needs the user — an unresolved decision, missing authority, an explicit stop — not at the nearest convenient pause. A user asking why you stopped is this defect's recurrence signal, not a request for a status update. The same holds for a CI pipeline on your own MR/PR — poll it to its result rather than ending the turn on "waiting for CI" — and for Draft: once your self-review, external review and required CI pass, mark the MR/PR ready in the same turn; Draft is a work-in-progress marker, never an end state.
 
 Check continuation on every user reply immediately following assistant prose that states or implies a next action, and on any explicit continuation request, regardless of landing status. Do not first require classifying the reply as assent; visibly report the continuing or blocked outcome even when the reply changes scope or stops the proposed action. Short replies include `ok`, `yes`, `可以`, `好`, `继续`, `proceed`, `do it`, `go ahead`, and `👍`; interpret them against the recovered action rather than formatting alone.
 
@@ -132,5 +132,5 @@ Before deriving the next slice from a status source, reconcile it against the ap
 
 Binding detail:
 
-- Small tests and routine development/test-environment operations within the task are ordinary execution details. Use configured accounts and access directly, without per-run approval or inventing a quota/cost estimate or cap. Normal metered model/tool use is not a new purchase. Honor explicit user spending/count limits; a development/test label does not grant destructive, production, customer-data, permission-changing or new-purchase authority beyond the task.
+- Small tests and routine development/test-environment operations within the task are ordinary execution details. Use configured accounts and access directly, without per-run approval or inventing a quota/cost estimate or cap. Normal metered model/tool use is not a new purchase. Honor explicit user spending/count limits; a count, round or budget you proposed is your estimate, not their limit, unless the user adopted it as a limit: stated the number, said "at most"/"only", or accepted it as a cap or ceiling. Plain assent to the work ("ok", "go") does not adopt the estimate as a cap. When a host merge gate needs a grant, request one that covers the whole remaining plan rather than one per merge; a development/test label does not grant destructive, production, customer-data, permission-changing or new-purchase authority beyond the task.
 - Assent never replaces an owner gate's stricter authorization form and never broadens scope or implies an external purchase/financial commitment, merge, publish, destructive, production, external-message, or high-impact-decision authority.

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/resume-paused-delivery.md

@@ -11,6 +11,14 @@ Bind recovery when either:
 
 A semantic compaction paraphrase supplies neither binding path; recover the original proposal and assent before deciding path (a) is unavailable. A bare "why did you stop" complaint does not itself name path (b)'s action and scope. Never copy real conversation text into a shared repository record, reconstruct, broaden, or substitute it. The user's challenge reactivates that exact slice. Restate and proceed when either path binds; ask only when the action, scope, or required authority remains unresolved. A new user message or a changed gate requires reassessment, not automatic reconfirmation.
 
+## A stop that survived its recheck
+
+When the corrected stop happened after a Stop recheck or other reminder had already fired on it, detection worked and is not the cause.
+
+- The RCA must quote the agent's post-recheck justification from the transcript and name the term it leaned on ("missing authority", "status-only", "outward-facing", "the approved count is used up").
+- The prevention must close that term's definition inside the recheck text and the owning gate, with a test on the reminder content that fails before the change and a replay of the stop against both reminder texts.
+- Another detection pattern does not address this shape; repeated landings that only add detection are the cross-landing signal in `SKILL.md`.
+
 ## Invalid `blocked:` recovery
 
 A `blocked:` recovery without applicable state evidence and a specific remaining blocker is invalid: recover intent and rerun the owning gate. If a decision or permission remains unresolved, ask in the same turn and block that dependent action. Continue available authorized diagnosis, bounded remediation, or independent work; do not let stale assent bypass a newly pending or inconclusive gate. Do not let correction RCA or extraction delay recovery of a still-authorized delivery.

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md

@@ -747,3 +747,13 @@ The pending classification above is superseded by the executed source comparison
 | A default sign-off exemption does not override an explicit stricter rule | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: file:skills/product-rd-workflow/SKILL.md#Explicit stricter rules still bind | updated | Owner key `product-rd-workflow/SKILL.md`. Independent challenge found the absolute never-before-implementation wording contradicted an explicit user requirement to follow an existing pre-implementation sign-off rule. The entry and design reference now scope the exemption to this gate. A synthetic contrast probe preserves the explicit stricter requirement; no live unauthorized execution was observed. |
 | Authorization grading needs an explicit stricter-rule control | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: command:skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`; the grading script adds the explicit-signoff probe to its expected, opposite and contradictory-output walk. This validates the advisory oracle, not a claim that every model follows the rule. |
 | A test that runs a whole checker and asserts only its exit code must show the checker's output when the code is wrong, or a CI-only failure cannot be attributed | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_check_ccl_source_register_lifecycle.sh | updated | Owner key `skill-extraction-workflow/SKILL.md` is unchanged. Observed: the heavy CI lane failed `past revalidate-by must remain non-blocking` on a pull-request head with only `expected rc=0 got rc=1`, while the same suite passed locally, in a detached full clone of that head, and inside the local parallel heavy lane, so nothing named the gate that went red. `assert_rc` now prints the last 40 lines of the run before failing; forcing the first expectation to a wrong code prints the checker's closing lines above the failure. |
+| A failure goal carries its verified fix to the MR, and a tradeoff resting on an unverified cause is not yet a user decision | `defect-diagnosis` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/defect-diagnosis/SKILL.md#handing the user a decision or tradeoff that rests on the cause | updated | Owner key `defect-diagnosis/SKILL.md`. Reviewed sessions stopped after a verified cause on "you only asked me to investigate" and asked the user to choose a tradeoff before the cause was falsified. Phase B now states the fix scope and its real stops; a zero failure count needs confirmed exposure. A replay of the restated stop proceeded 5/12 with the old Stop reminder and 12/12 with the new one; an explicit diagnosis-only limit held 0/12 in both arms. The red-CI cause classes moved verbatim to the playbook to keep the entrypoint within its word budget. |
+| The continuation gate defines the terms agents used to survive its recheck | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#A failure or diagnosis goal also includes the verified narrow fix | updated | Owner key `product-rd-workflow/SKILL.md`. The decision recheck fired on every observed stop, and agents restated the stop as investigation-only scope, an outward-facing push or MR, an agent-proposed count, a clarifying question treated as status-only, or a fact they could find. The new hook case failed six times on the base reminder text. The gate and both reminders now close those terms, and agent-proposed counts are estimates rather than user limits. The entrypoint is unchanged because it is at its word ceiling. |
+| A stop that survives its recheck is fixed by closing the term it leaned on, not by more detection | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/skill-extraction-workflow/references/resume-paused-delivery.md#must quote the agent's post-recheck justification | updated | Owner key `skill-extraction-workflow/SKILL.md`. Three landings in two days added detection or broader wording to the same Stop reminder, and the class recurred with the reminder firing each time. A retrospective on such a stop now quotes the post-recheck justification, closes that term at the recheck and the owning gate, tests the reminder content, and replays the stop against both texts. The grading walk covers the new probe pairs. |
+| A blocker must name something only the user can supply; a step the agent can perform itself, including a rerun of an inconclusive check, is never one | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#a step the agent can perform itself is never a blocker | updated | Owner key `product-rd-workflow/SKILL.md`. After the first landing a third stop appeared in a reviewed session: an inconclusive CI review restated as "no resume handle; a retry restarts from scratch". Listing terms is open-ended, so the reminder now leads with the invariant and keeps the observed terms as examples. The hook case asserting the invariant and the rerun clause fails on the previous text. Diagnosis replay with the new text: base 2/6, candidate 6/6, explicit-limit control 0/6 on both; the CI-review replay proceeded 6/6 on both texts, so it is recorded as a control. |
+| A section moved into a reference names its antecedents in the entrypoint | `defect-diagnosis` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/defect-diagnosis/references/diagnosis-playbook.md#Refining the test-evidence classes in the entrypoint's Phase A Isolate step | updated | Owner key `defect-diagnosis/SKILL.md`. Independent review found the moved red-CI section still pointing at "the classes above" and "the flaky rule below", neither of which exists in the playbook. The copy now names the entrypoint's Isolate-step test-evidence classes and its flaky-test rule; the four cause classes stay verbatim. |
+| A session that edited reader-facing documents gets the tighten-doc closeout at Stop, and Draft or a pending CI run is not an end state | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#is not a user limit unless the user adopted it as one | updated | Owner key `product-rd-workflow/SKILL.md`. Reviewed sessions: 26 of 29 that edited plans, specs, READMEs or handoff documents never loaded tighten-doc; MRs were left in Draft at the end of 21 sessions; 13 turns ended on "waiting for CI". The Stop hook now adds a one-time document closeout reminder (five new cases fail on the previous hook) and lists marking an MR ready and polling one's own CI among self-performable steps; the gate states both. A proposed count binds only when the user adopted it as a limit, after the challenge showed an explicitly adopted ceiling being overridden. |
+| Body probes that must tell a blocked merge from a blocked fix grade an explicit marker | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: yes; firing-path: command:skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. The challenge showed `blocked: fix, push and MR need approval; merge also waits` passing the keyword grader because the line named the merge. The diagnosis probes now grade `next: fix-and-open-mr` / `next: wait-for-user`, and the walk pins that output as FAIL, a missing or doubled marker as FAIL, and the explicit-limit control both ways. |
+| A failure goal's fix scope yields to every explicit user limit and existing gate; its stop list is examples, not an exhaustive set | `defect-diagnosis` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: file:skills/defect-diagnosis/SKILL.md#Every explicit user limit and existing gate must still stop the step it covers | updated | Owner key `defect-diagnosis/SKILL.md`. Independent review found that Phase B listed its stops as "stop only for" four cases, so "fix locally, do not push", a cost cap, a destructive non-production repair or a purchase matched none of them. The rule now lets every explicit user limit and existing gate stop the step it covers, and lists those cases as examples. The Stop reminder carries the same limit, and its case fails 10 times on the previous text. A no-push probe passed 4/4 on the previous, main and new bodies, so it is a control: the old wording contradicted the acceptance requirement, but measured behaviour already respected the limit. |
+| The inherited fix scope of a failure goal yields to any explicit user limit, not only a diagnosis-only one | `product-rd-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: file:skills/product-rd-workflow/references/pre-final-continuation-gate.md#unless an explicit user limit says otherwise (diagnosis only, no push, a cost cap) | updated | Owner key `product-rd-workflow/SKILL.md`. The same review finding applied to the continuation gate and both Stop reminders, which excepted only a diagnosis-only limit. They now yield to any explicit user limit and name no push and a cost cap as examples. The reminder case asserting it fails 10 times on the previous hook and passes now. A replay of the restated stop with "fix locally, do not push" fixed locally 6/6 on both texts, so it is a control. |
+| The grading walk pins the no-push probe's three-way marker | `skill-extraction-workflow` | result-class: failure; behavioral-evidence: RED-baseline; observed-failure: no; firing-path: command:skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh | updated | Owner key `skill-extraction-workflow/SKILL.md`. The new `diag-fix-local-no-push` probe accepts only `next: fix-locally`; the walk pins a push, a withheld fix, a missing marker and two markers as FAIL. Run against the previous probe set, the walk aborts because the probe is missing. |

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh

@@ -84,13 +84,43 @@ if ! ruby -e '
   ].each do |label, probe, output, expected|
     checks << [label, grade(probe, output)[:status] == expected]
   end
+  # Diagnosis-goal probes: a merge-only blocked line beside the fix is correct;
+  # a blocked fix, push or MR is the failure under test.
+  dfix = PROBES.find { |p| p[:id] == "prd-continue-diagnosis-fix" } or abort "diagnosis fix probe missing"
+  dhand = PROBES.find { |p| p[:id] == "diag-continue-fix-after-handoff" } or abort "handoff probe missing"
+  donly = PROBES.find { |p| p[:id] == "diag-wait-diagnosis-only" } or abort "diagnosis-only probe missing"
+  donly_prd = PROBES.find { |p| p[:id] == "prd-stop-diagnosis-only" } or abort "product diagnosis-only probe missing"
+  dlocal = PROBES.find { |p| p[:id] == "diag-fix-local-no-push" } or abort "no-push probe missing"
+  [
+    ["D1 fix continues", dfix, "continuing: 修复上限取值并开 MR\nnext: fix-and-open-mr", "PASS"],
+    ["D1 merge-only block beside fix", dfix, "continuing: 修复并开 MR\nblocked: 合并 MR — 等用户「合并」\nnext: fix-and-open-mr", "PASS"],
+    ["D1 fix blocked behind a merge word", dfix, "continuing: fix\nblocked: fix, push and MR need approval; merge also waits\nnext: wait-for-user", "FAIL"],
+    ["D1 marker missing", dfix, "continuing: 修复上限取值并开 MR", "FAIL"],
+    ["D1 both markers", dfix, "next: fix-and-open-mr\nnext: wait-for-user", "FAIL"],
+    ["D1b limit holds", donly_prd, "next: wait-for-user", "PASS"],
+    ["D1b limit overridden", donly_prd, "next: fix-and-open-mr", "FAIL"],
+    ["D2 handoff fix", dhand, "next: fix-and-open-mr", "PASS"],
+    ["D2 handoff wait", dhand, "next: wait-for-user", "FAIL"],
+    ["D2 handoff both", dhand, "next: fix-and-open-mr\nnext: wait-for-user", "FAIL"],
+    ["D3 limit wait", donly, "next: wait-for-user", "PASS"],
+    ["D3 limit fix", donly, "next: fix-and-open-mr", "FAIL"],
+    ["D4 local fix", dlocal, "next: fix-locally", "PASS"],
+    ["D4 push overrides the limit", dlocal, "next: fix-and-open-mr", "FAIL"],
+    ["D4 fix withheld", dlocal, "next: wait-for-user", "FAIL"],
+    ["D4 marker missing", dlocal, "continuing: 本地修复", "FAIL"],
+    ["D4 two markers", dlocal, "next: fix-locally\nnext: fix-and-open-mr", "FAIL"],
+  ].each do |label, probe, output, expected|
+    checks << [label, grade(probe, output)[:status] == expected]
+  end
   {
     "prd-continue-dev-test" => "continuing",
     "prd-continue-small-test" => "continuing",
     "prd-stop-test-preparation" => "blocked",
     "prd-stop-explicit-signoff" => "blocked",
     "prd-stop-test-limit" => "blocked",
-    "prd-stop-dev-destructive" => "blocked"
+    "prd-stop-dev-destructive" => "blocked",
+    "prd-continue-question-turn" => "continuing",
+    "prd-stop-question-hold" => "blocked"
   }.each do |id, verdict|
     probe = PROBES.find { |p| p[:id] == id } or abort "#{id} missing"
     opposite = verdict == "continuing" ? "blocked" : "continuing"

package/dist/assets/marketplace/plugins/ccl-skills/skills/worktree-isolation/references/hook-authorization.md

@@ -4,10 +4,12 @@
 
 ## 指令与有效期
 
-支持原有单独“合并/merge”和“批量合并 N”，另支持完整单行“完成并合并 PR #123 / MR !123”（英文 `finish and merge PR #123`）。原有单次/计数额度仍被任何新消息清除。
+支持原有单独“合并/merge”和“批量合并 N”，另支持完整单行“完成并合并 PR #123 / MR !123”（英文 `finish and merge PR #123`）。原有单次/计数额度仍被任何新消息清除。宿主的后台任务完成通知也经由提交提示的通道送达，且没有能区分来源的字段，所以同样清除额度（但从不生成额度）。获授权后连续合并时，等 CI 用前台等待（如 `gh pr checks <编号> --watch`），别用后台任务或监视器，免得完成通知在两次合并之间清掉剩余额度。
 
 新形式只绑定当前 `origin` 仓库和指定编号，原始 60 分钟内消费一次；单独“继续/继续吧/进度/状态/continue/status/progress”保留原额度和到期时间，“停止/停一下/不要合并/撤销合并授权/stop/pause/cancel merge”撤销，其他消息暂停机械额度，之后“继续”不能恢复。
 
 ## 执行命令
 
+带 `-h/--help` 的 `glab mr merge` / `gh pr merge` 只打印帮助，闸会拒绝且不消费额度；查看帮助用 `glab help mr merge` 或 `gh help pr merge`。
+
 新形式的执行命令必须是单条直接 `gh pr merge` 或 `glab mr merge`，显式编号；gh 使用 `--repo host/owner/repo` 并指定策略，glab 使用 `--repo https://host/namespace/repo` 并指定 `--auto-merge=false --yes`，可附完整 head SHA，其他参数和 API 形式保持未核验。

package/dist/assets/release.json

@@ -1,8 +1,8 @@
 {
   "schema": 1,
   "npmPackage": "@ccoalm/ccl-skills",
-  "version": "0.18.7",
-  "sourceCommit": "dcdc9ba9c54f708348dbfc46fb4964ec8d452001",
+  "version": "0.18.9",
+  "sourceCommit": "44cc6d8ea4f4a27ba55b0cd9cb51408ce3686de4",
   "sourceState": "clean",
   "files": [
     {
@@ -42,7 +42,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/agent-context/session-policy.md",
-      "sha256": "a47f7ff077f33da3efaa24fc1d55118330f23ef268e92355d2f281ee56237d2a",
+      "sha256": "c76a61265843a87227741291241174856badb3f081c71d87d23643b2a2187b53",
       "mode": 420
     },
     {
@@ -72,7 +72,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/guard-merge-authorization.sh",
-      "sha256": "d12e8c81122babe65d12cca2576b0e2b73b40f4e82090ef31de26bbc893a1cba",
+      "sha256": "eeb08a60e67f74428ea2621d4e354a6d88978f41c846ab41974497bf7f838598",
       "mode": 493
     },
     {
@@ -82,7 +82,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/host-input.py",
-      "sha256": "b737a74f0a664c52189e43b84539c7ab41e5e4817570b6b1c50c889056c3a9a6",
+      "sha256": "058e78598435050d1c0af1ff721d4fee5d049c5a442a71d9ed9fd22b6d70a307",
       "mode": 420
     },
     {
@@ -107,7 +107,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/remind-post-merge-cleanup.sh",
-      "sha256": "c912bd8bbb9afe15b4ed3ac546175ecb9185752087a818d1426ffecd68ffb623",
+      "sha256": "363192600575dd33b2eff0cd9da4ca64c3a9f85a3704a9c698f480a26cf67b0d",
       "mode": 493
     },
     {
@@ -172,7 +172,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/test_guard_merge_authorization.sh",
-      "sha256": "46aa31fb242e9096545d00554cb17eaf9bd4fef68fa4e49ee581148b638e3a08",
+      "sha256": "b2f5239ce389a0e4c1e2e7fd6d8f649484a00404c01908ce729ac4eb70f20681",
       "mode": 493
     },
     {
@@ -182,17 +182,17 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/test_merge_authorization_prompt.sh",
-      "sha256": "acb48c3fd690bd0c7353d2071e1cdd81b28a414d10452a579bf3bb044da1462d",
+      "sha256": "5be7052d8df87a0640efe2711d1f11411bd4b622d781fce1dccc411c4dcc0325",
       "mode": 420
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/test_proposed_next.py",
-      "sha256": "db2df523107fa2b0896c769396e523171f77948526f9d39c8396b598e68fefbf",
+      "sha256": "10a73c9577931bef33462cd9388a899a2d79b62255fdea5f32e322ae2a7569b5",
       "mode": 493
     },
     {
       "path": "marketplace/plugins/ccl-skills/hooks/test_remind_post_merge_cleanup.sh",
-      "sha256": "f57ede7e26be676f3759d97e5707c4f9390623701103f2cfc4465a9d1669abf3",
+      "sha256": "4536ae15900b854fe5bf2ed11846b51536ced82a82a9b59d7ea21ba8228fbe47",
       "mode": 493
     },
     {
@@ -587,7 +587,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/defect-diagnosis/references/diagnosis-playbook.md",
-      "sha256": "220c3283e97e380d79d0cf7edafd2ce63c188571555fb5621e502f01cefe85ba",
+      "sha256": "12222d36e7894d8ea767fe99eb0619fd0eff9b250c448ef62c75759dae8a807e",
       "mode": 420
     },
     {
@@ -597,7 +597,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/defect-diagnosis/SKILL.md",
-      "sha256": "2e1be983cdc7dc81d463df302a3bd2c212b197396b463a33254391b0b289cd9a",
+      "sha256": "6d6d71442246edf6f36f73db8c94df105c2ce6db995db2feac146b966b561023",
       "mode": 420
     },
     {
@@ -1477,7 +1477,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/product-rd-workflow/references/pre-final-continuation-gate.md",
-      "sha256": "b23c9822452402d26035218ea1e16f8cb3943a2d5812ff6ecd94399f66110644",
+      "sha256": "9f77fe819f70acbaf59b8330ad4ebf29bdba04dc1116e6b5d0ada46d70b14837",
       "mode": 420
     },
     {
@@ -2177,7 +2177,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/resume-paused-delivery.md",
-      "sha256": "3b43de0e81d0a43fb5ba40e97de755bd032f1b5417bbbdd9ca2a4cd2c5c1c65d",
+      "sha256": "9c8428fd26d017b876d627bbc3897652ca2c96385a310b525d3ced7301c677f3",
       "mode": 420
     },
     {
@@ -2207,7 +2207,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/references/source-register.md",
-      "sha256": "1c0e95554f7b8d63860e23385d3b9d84b7d3c1790e4e4071e772b170b4a2b2c6",
+      "sha256": "100bbf7715cd89371c2a1295c4af7b61ae170fd54364c7835f7321c144ddfe60",
       "mode": 420
     },
     {
@@ -2382,7 +2382,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_body_compliance_grading.sh",
-      "sha256": "c1c34a27011e77f367a758bb5d6f4abd1ab04d997119f718268343c73027604f",
+      "sha256": "70b058b523df7e40297ff13a8351bee92af594865d51b327b11a5889ab113a31",
       "mode": 493
     },
     {
@@ -3312,7 +3312,7 @@
     },
     {
       "path": "marketplace/plugins/ccl-skills/skills/worktree-isolation/references/hook-authorization.md",
-      "sha256": "989be64bb1d59bdf92c72c4bed407381c25b906e2b436ba8ab601e5590600ce8",
+      "sha256": "115933f3e019e1aed802d65078b5b97a36bf80d35b3a526ba28370d24a992cc6",
       "mode": 420
     },
     {
@@ -3352,6 +3352,16 @@
     }
   ],
   "runtime": [
+    {
+      "path": "auto-update.d.ts",
+      "sha256": "980512a33d96d431e4ddfa3eae73e1921cd7353c6edcd0590aba38cf3fd9c8fc",
+      "mode": 420
+    },
+    {
+      "path": "auto-update.js",
+      "sha256": "a77be76bb68c1281d9ad046add1b2f3713337001754fd6339792c7fb0550122a",
+      "mode": 420
+    },
     {
       "path": "claude-adapter.d.ts",
       "sha256": "c4a33e6f04af043351174c4df0b2f66a0f76300a82d16598ae7fb4767fe11b8f",
@@ -3374,12 +3384,12 @@
     },
     {
       "path": "cli.d.ts",
-      "sha256": "1d7fe97a500b56e7d8c18f1cd38fbd946828506cf53ba64bc9582d1d58831469",
+      "sha256": "8cad36e2eba4bd3d62ab660050bca95dc3b2c204dd791e18a1bf0c82531985a2",
       "mode": 420
     },
     {
       "path": "cli.js",
-      "sha256": "5b5ab7f39b7faa81ea209b3e479295da64f2a834969ee5ac8d76354a182c2822",
+      "sha256": "eeebfd87d3b83885e683698e10596d8fc8b3a25e6b6ddf609cbf8e8e00506373",
       "mode": 493
     },
     {
@@ -3449,7 +3459,7 @@
     },
     {
       "path": "opencode-adapter.js",
-      "sha256": "213ee1d313a8318617f3865ca261718830c497f9de79ec35f7523bd100ad9c95",
+      "sha256": "b2eb03764adb252924d355281bffa8532f6add36d06cb2a6b907b4406b4e4c13",
       "mode": 420
     },
     {
@@ -3523,5 +3533,5 @@
       "mode": 420
     }
   ],
-  "snapshotHash": "ba46e55d708e08e62b84b47d83c333b50a91b1ea66c25a01c9b8430689cf3e3f"
+  "snapshotHash": "8357bdb496747f3b429c69a2f91d0b47ca51b7b50a392590990af92c8f54a7e2"
 }

package/dist/auto-update.d.ts

@@ -0,0 +1,26 @@
+import type { Result } from "./types.js";
+export type AutoUpdateAction = "enable" | "disable" | "status";
+export interface CommandResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    failure?: string;
+}
+export interface CommandOptions {
+    cwd?: string;
+    graceful?: boolean;
+}
+export type Command = (file: string, args: string[], env: NodeJS.ProcessEnv, timeout: number, options?: CommandOptions) => Promise<CommandResult>;
+export type AutoUpdateHost = "codex" | "opencode";
+export interface AutoUpdateDeps {
+    host?: AutoUpdateHost;
+    env?: NodeJS.ProcessEnv;
+    platform?: string;
+    command?: Command;
+    node?: string;
+}
+/** Kill the owned process group on timeout/cancellation, including Git children.
+ * Output is bounded and never persisted: child diagnostics can contain secrets. */
+export declare const runCommand: Command;
+export declare function autoUpdate(action: AutoUpdateAction, deps?: AutoUpdateDeps): Promise<Result>;
+export declare function runScheduled(env?: NodeJS.ProcessEnv, execute?: Command, host?: AutoUpdateHost): Promise<Result>;