@ccoalm/ccl-skills 0.3.0 → 0.5.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/classify_envelope.py

@@ -12,7 +12,7 @@ fallback. Exit 3 means a JSON object/envelope was present but carried no classif
 error; callers must not grep its model-controlled payload as transport diagnostics.
 
 Reason tokens printed on exit 0:
-  auth                 -> not logged in / login required
+  auth                 -> not logged in / login required / explicit 401 auth failure
   quota:<text>         -> rate limit / quota / api_error_status 429
   permission_denied    -> tool permission denials present
   error:<subtype>:<text> -> generic errored envelope
@@ -24,6 +24,10 @@ import re
 import sys
 
 NOT_LOGGED_IN = re.compile(r"(^|[^a-z])not logged in([^a-z]|$)|please run /login", re.I)
+AUTH_FAILURE = re.compile(
+    r"^\s*failed to authenticate\.\s+api error:\s*401\b",
+    re.I,
+)
 QUOTA = re.compile(r"rate limit exceeded|quota exceeded|hit your limit", re.I)
 
 
@@ -32,17 +36,44 @@ def result_text(env: dict) -> str:
     return result if isinstance(result, str) else ""
 
 
+def api_status_int(env: dict) -> int | None:
+    """Normalize `api_error_status` before comparing it to a number.
+
+    A bare `== 401` matches only a Python int, so a transport that serializes the
+    status as `"401"` silently misses the arm — and then the text arm misses too
+    unless the wording is the one pinned phrase, re-creating the generic
+    `error:success` false negative this classifier exists to remove. The sibling
+    `parse_probe_result.py` already normalizes the same field (its accepted set
+    carries `"0"`, so a string status is an observed shape here, not a
+    hypothetical); this mirrors that existing standard rather than inventing one.
+    """
+    status = env.get("api_error_status")
+    if isinstance(status, bool):
+        # `int(True)` is 1, so a boolean would silently become a status code.
+        return None
+    if isinstance(status, int):
+        return status
+    if isinstance(status, str) and re.fullmatch(r"\s*\d+\s*", status):
+        return int(status)
+    # Anything else — float, None, object, non-numeric text — is not a status.
+    # `int()` on a float truncates (401.9 -> 401), which would let a value that
+    # is not a status code select the auth arm; refuse instead of coercing.
+    return None
+
+
 def classify(env: dict) -> str | None:
     text = result_text(env)
     if env.get("permission_denials"):
         return "permission_denied"
-    api_status = env.get("api_error_status")
+    api_status = api_status_int(env)
+    if api_status == 401:
+        return "auth"
     if api_status == 429:
         snippet = " ".join(text.split())[:200]
         return f"quota:{snippet}" if snippet else "quota:rate limit or quota exceeded"
     subtype = env.get("subtype")
     errored = env.get("is_error") is True or subtype not in (None, "success")
-    if errored and NOT_LOGGED_IN.search(text):
+    if errored and (NOT_LOGGED_IN.search(text) or AUTH_FAILURE.search(text)):
         return "auth"
     if errored and QUOTA.search(text):
         snippet = " ".join(text.split())[:200]

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_abort_leak_state_helpers.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# Pins the abort-leak probe's process-state vocabulary and the one helper that consumes
+# it, against real processes in each state.
+#
+# The probe exists because three spellings of "is it there?" disagreed about one pid.
+# The fix was to give the whole probe a single vocabulary — so the vocabulary itself is
+# now load-bearing, and every consumer must agree with it. That is not free: adding
+# `stopped` as a third state silently changed the meaning of every consumer that had been
+# written when there were two, and `await_suite_exit` went on treating "not live" as
+# "gone" — which would have called a STOPPED suite exited and let leg 2 pass while the
+# suite it was supposed to have killed was still sitting there.
+#
+#   bash skills/code-review/scripts/test_abort_leak_state_helpers.sh
+set -uo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+PROBE="$DIR/test_review_gate_abort_leak.sh"
+[ -f "$PROBE" ] || { echo "FAIL: probe not found: $PROBE" >&2; exit 1; }
+
+pass=0; fail=0
+note() { fail=$((fail+1)); printf 'FAIL  %s\n' "$1" >&2; }
+ok()   { pass=$((pass+1)); }
+
+TMP=$(mktemp -d "${TMPDIR:-/tmp}/abort-leak-helpers.XXXXXX") || exit 1
+cleanup_all() {
+  local p
+  for p in ${KIDS:-}; do kill -CONT "$p" 2>/dev/null; kill -KILL "$p" 2>/dev/null; done
+  rm -rf "$TMP"
+}
+KIDS=""
+# Own it only while it is outstanding. A pid that has been reaped is a number the OS is
+# free to hand to somebody else, so leaving it in KIDS turns the EXIT trap into a signal
+# aimed at a stranger — and this repo runs suites eight-way parallel, so the stranger is
+# plausibly another lane. Same rule the probe under test applies before it signals
+# anything: prove current ownership, never trust a cached pid.
+drop_kid() {
+  local keep="" k
+  for k in ${KIDS:-}; do [ "$k" = "$1" ] || keep="$keep $k"; done
+  KIDS="$keep"
+}
+reap_kid() { # reap_kid <pid> — stop owning it the moment it is reaped
+  kill -CONT "$1" 2>/dev/null
+  kill -KILL "$1" 2>/dev/null
+  wait "$1" 2>/dev/null
+  drop_kid "$1"
+}
+trap cleanup_all EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM HUP
+
+# Lift the helpers out rather than sourcing the probe, which would run both legs.
+helpers=$TMP/helpers.sh
+{
+  echo '#!/usr/bin/env bash'
+  echo 'set -uo pipefail'
+  awk '/^wrapper_state\(\) \{/{p=1} p; p && /^\}$/{exit}' "$PROBE"
+  awk '/^await_suite_exit\(\) \{/{p=1} p; p && /^\}$/{exit}' "$PROBE"
+} > "$helpers"
+grep -q 'wrapper_state()' "$helpers" || { echo "FAIL: could not lift wrapper_state (moved?)" >&2; exit 1; }
+grep -q 'await_suite_exit()' "$helpers" || { echo "FAIL: could not lift await_suite_exit (moved?)" >&2; exit 1; }
+# shellcheck disable=SC1090
+. "$helpers"
+
+# --- states -----------------------------------------------------------------
+sleep 300 & live_pid=$!; KIDS="$KIDS $live_pid"
+[ "$(wrapper_state "$live_pid")" = live ] && ok || note "a running child must read live, got $(wrapper_state "$live_pid")"
+
+kill -STOP "$live_pid" 2>/dev/null
+stopped_seen=""
+for _ in 1 2 3 4 5 6 7 8 9 10; do
+  stopped_seen="$(wrapper_state "$live_pid")"
+  [ "$stopped_seen" = stopped ] && break
+  sleep 0.2
+done
+[ "$stopped_seen" = stopped ] && ok || note "a stopped child must read stopped, got $stopped_seen"
+
+# THE regression: a stopped process is still present. Treating "not live" as gone is how
+# a suite that was never killed reads as exited.
+GRACE=2
+suite_pid="$live_pid"
+if await_suite_exit; then
+  note "await_suite_exit reported a STOPPED child as exited — 'not live' is not 'gone'"
+else
+  ok
+fi
+
+reap_kid "$live_pid"
+suite_pid="$live_pid"
+if await_suite_exit; then ok; else note "await_suite_exit must report a reaped child as gone"; fi
+
+# A never-existing pid, and a non-numeric one, are both absent rather than an error.
+[ "$(wrapper_state 999999999)" = absent ] && ok || note "an unused pid must read absent"
+[ "$(wrapper_state "")" = absent ] && ok || note "an empty pid must read absent"
+[ "$(wrapper_state notanumber)" = absent ] && ok || note "a non-numeric pid must read absent"
+
+# A zombie: exited, not yet reaped. It answers kill -0 and reports a ppid, which is the
+# whole reason this vocabulary exists.
+python3 -c '
+import os, sys, time
+pid = os.fork()
+if pid == 0:
+    os._exit(0)
+sys.stdout.write(str(pid) + "\n")
+sys.stdout.flush()
+time.sleep(6)
+' >"$TMP/zombie.out" 2>/dev/null &
+zparent=$!; KIDS="$KIDS $zparent"
+zpid=""
+for _ in 1 2 3 4 5 6 7 8 9 10; do
+  zpid="$(head -1 "$TMP/zombie.out" 2>/dev/null || true)"
+  [ -n "$zpid" ] && break
+  sleep 0.3
+done
+if [ -n "$zpid" ]; then
+  zstate=""
+  for _ in 1 2 3 4 5; do
+    zstate="$(wrapper_state "$zpid")"
+    [ "$zstate" = zombie ] && break
+    sleep 0.3
+  done
+  [ "$zstate" = zombie ] && ok || note "an unreaped corpse must read zombie, got $zstate"
+  # And it must NOT read live, which is the exact confusion that red CI three times.
+  [ "$zstate" != live ] && ok || note "a corpse must never read live"
+else
+  note "could not construct a zombie to test against"
+fi
+reap_kid "$zparent"
+
+# A `ps` that cannot run is not a process that is gone. Shadow ps with a stub that
+# exits 127 and prove the state reads unknown, and that await_suite_exit does NOT then
+# report the suite exited — the expensive direction of this error.
+psdir="$TMP/fakebin"; mkdir -p "$psdir"
+printf '#!/bin/sh\nexit 127\n' > "$psdir/ps"; chmod +x "$psdir/ps"
+sleep 300 & unknown_pid=$!; KIDS="$KIDS $unknown_pid"
+unknown_state="$(PATH="$psdir:$PATH" wrapper_state "$unknown_pid")"
+[ "$unknown_state" = unknown ] && ok || note "a failing ps must read unknown, got $unknown_state"
+GRACE=2
+suite_pid="$unknown_pid"
+if PATH="$psdir:$PATH" await_suite_exit; then
+  note "await_suite_exit reported exited while ps was broken — a tool failure is not an exit"
+else
+  ok
+fi
+reap_kid "$unknown_pid"
+
+printf 'abort_leak_state_helpers: pass=%s fail=%s\n' "$pass" "$fail"
+[ "$fail" -eq 0 ] || exit 1
+echo "abort_leak_state_helpers_ok"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_classify_envelope.sh

@@ -49,6 +49,34 @@ expect_no_envelope() {
 }
 
 expect_token '{"type":"result","subtype":"error","is_error":true,"result":"Not logged in. Please run /login"}' auth
+expect_token '{"type":"result","subtype":"success","is_error":true,"result":"Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue."}' auth
+expect_token '{"type":"result","subtype":"success","is_error":true,"result":"  \r\nFailed to authenticate. API Error: 401 OAuth access token has expired."}' auth
+expect_token '{"type":"result","subtype":"success","is_error":false,"api_error_status":401,"result":"authentication rejected"}' auth
+# String-serialized transport status. A bare `== 401` matches only an int, so this
+# shape used to fall through BOTH arms and land on the generic `error:success`
+# token — the exact false negative this change removes. Pinned per status so the
+# normalization cannot be dropped for one arm while the other keeps its fixture.
+expect_token '{"type":"result","subtype":"success","is_error":false,"api_error_status":"401","result":"authentication rejected"}' auth
+expect_token '{"type":"result","subtype":"success","is_error":false,"api_error_status":"429","result":"slow down"}' quota:
+# A non-numeric status is not a status: it must not be coerced into either arm.
+expect_token '{"type":"result","subtype":"error","is_error":true,"api_error_status":"unauthorized","result":"boom"}' error:
+# Nor is a bool or a float. `int(True)` is 1 and `int(401.9)` truncates to 401,
+# so a permissive coercion would let a value that is not a status code select the
+# auth arm — pinned in both directions rather than left to the reader.
+expect_token '{"type":"result","subtype":"error","is_error":true,"api_error_status":true,"result":"boom"}' error:
+expect_token '{"type":"result","subtype":"error","is_error":true,"api_error_status":401.9,"result":"boom"}' error:
+# The TEXT arm deliberately still requires an errored envelope, while the
+# STRUCTURED arm does not. The asymmetry is the trust boundary: `api_error_status`
+# is a transport field, `result` is model-controlled, so payload prose needs a
+# second signal before it can select an auth decision. A challenge argued this
+# shape reproduces the observed `error:success` defect; it does not — it exits 3
+# ("envelope present, nothing classifiable"), a different path the caller is
+# already told not to raw-text grep. Pinned so the boundary is a decision on
+# record rather than an accident, in both directions.
+expect_clean '{"type":"result","subtype":"success","is_error":false,"result":"Failed to authenticate. API Error: 401 OAuth access token has expired."}'
+expect_token '{"type":"result","subtype":"error","is_error":true,"result":"P1: authentication failed when the reviewed session expires"}' error:
+expect_token '{"type":"result","subtype":"error","is_error":true,"result":"Failed to authenticate after a dependency timeout. API Error: 500"}' error:
+expect_token '{"type":"result","subtype":"error","is_error":true,"result":"review preamble\nFailed to authenticate. API Error: 401 OAuth access token has expired."}' error:
 expect_token '{"type":"result","subtype":"error","is_error":true,"result":"API Error: rate limit exceeded"}' quota:
 expect_token '{"type":"result","subtype":"success","is_error":false,"api_error_status":429,"result":"slow down"}' quota:
 expect_token '{"type":"result","subtype":"success","is_error":false,"permission_denials":["Read"],"result":""}' permission_denied

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_parse_review_json.sh

@@ -105,6 +105,13 @@ run_fail challenge '{"subtype":"success","is_error":false,"structured_output":{"
 run_fail challenge '{"type":"result","structured_output":{"mode":"challenge","findings":[]}}'
 run_fail challenge '{"structured_output":{"mode":"challenge","findings":[]}}'
 run_fail challenge '{"type":"result","subtype":"success","is_error":false,"api_error_status":429,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}'
+# Twin of the 429 row for the status the envelope classifier now maps to `auth`.
+# The ordering between this parser and that classifier is what decides whether a
+# transport-flagged envelope can still be read as a completed verdict, and until
+# now only 429 pinned it. Pinned here rather than left to prose: an envelope
+# carrying ANY api_error_status is not a clean verdict, so adding an auth arm
+# downstream cannot turn one into a verdict-dropping regression unnoticed.
+run_fail challenge '{"type":"result","subtype":"success","is_error":false,"api_error_status":401,"terminal_reason":"completed","structured_output":{"mode":"challenge","findings":[]}}'
 run_fail challenge '{"type":"result","subtype":"success","is_error":false,"terminal_reason":"max_turns","structured_output":{"mode":"challenge","findings":[]}}'
 run_fail challenge '{"type":"result","subtype":"success","is_error":false,"permission_denials":["Read"],"structured_output":{"mode":"challenge","findings":[]}}'
 run_fail challenge '{"type":"assistant","is_error":true,"structured_output":{"mode":"challenge","findings":[]}}'

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/test_review_gate.sh

@@ -658,7 +658,15 @@ case "$behavior" in
       # group — it is TERM-immune and lives in its own session — so an unbounded loop
       # is a wrapper that survives for days. Measured before this bound: 39 hours.
       hang_left="${REVIEW_GATE_TEST_HANG_SECONDS:-300}"
+      hang_bound="$hang_left"
       while [ "$hang_left" -gt 0 ]; do sleep 1; hang_left=$((hang_left-1)); done
+      # Record that the BOUND is what ended this process. Nothing else writes this file,
+      # and a signalled process never reaches the line, so its presence is a fact about
+      # which code path ran rather than an observation of when. The abort probe reads it
+      # to tell "the fixture's own bound expired" apart from "some reaper got here first"
+      # — a distinction it used to make by checking whether the process was still alive
+      # at one instant, which a corpse awaiting reaping answers wrongly.
+      printf '%s\n' "$hang_bound" >"$state/claude_hang_bound_reached"
     ) &
     wait "$!"
     ;;
@@ -816,7 +824,12 @@ case "$behavior" in
     # Bounded for the same reason as the claude stub's hang: an abort that removes
     # the controller leaves this TERM-immune process with no other reaper.
     hang_left="${REVIEW_GATE_TEST_HANG_SECONDS:-300}"
+    hang_bound="$hang_left"
     while [ "$hang_left" -gt 0 ]; do sleep 1; hang_left=$((hang_left-1)); done
+    # Same bound-reached record as the claude stub, per client: the abort probe points
+    # its two jobs at different stubs, so each stub must be able to say for itself that
+    # its own bound is what ended it.
+    printf '%s\n' "$hang_bound" >"$state/${client}_hang_bound_reached"
     ;;
   auth)
     if [ "$host_attempted" = 1 ]; then