@ccoalm/ccl-skills 0.6.2 → 0.8.0

package/dist/assets/marketplace/plugins/ccl-skills/hooks/test_remind_unverified_cli_flag.sh

@@ -0,0 +1,483 @@
+#!/usr/bin/env bash
+# Deterministic behavior suite for hooks/remind-unverified-cli-flag.sh.
+# Registered in the Makefile `test` target; requires jq (the hook's dependency —
+# without jq the hook degrades to silence, so this suite requires it and fails
+# loudly instead of false-greening).
+#
+# The hook deliberately does NOT parse shell, so this suite does not probe shell
+# forms. It probes the three things the hook actually asserts — tool-word match,
+# long-flag presence, per-session dedup — plus the two contracts it must never
+# break (exit 0 / valid JSON / silent stderr) and the marker-safety guards. The
+# documented FALSE FIRES are asserted too, so they stay intentional rather than
+# drifting into accidents.
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+HOOK="${CLI_FLAG_HOOK:-$SCRIPT_DIR/remind-unverified-cli-flag.sh}"
+[ -f "$HOOK" ] || { echo "FAIL: hook not found: $HOOK" >&2; exit 1; }
+command -v jq >/dev/null 2>&1 || { echo "FAIL: jq required for this suite" >&2; exit 1; }
+# Fail LOUDLY on a hook syntax error rather than as a wall of mysterious probe
+# failures — one stray apostrophe inside an embedded program did exactly that.
+bash -n "$HOOK" 2>/dev/null || { echo "FAIL: hook is not syntactically valid" >&2; bash -n "$HOOK"; exit 1; }
+
+pass=0; fail=0; probe_n=0
+
+# Isolate the hook's dedup markers into a per-RUN directory. Without this the
+# suite self-poisoned across runs: sessions derive from `$$`, the hook persists
+# markers, and after PID reuse a stale one silently turned an expected `remind`
+# into `quiet`.
+MARKER_DIR=$(mktemp -d "${TMPDIR:-/tmp}/cliflag-suite-XXXXXX") || {
+  echo "FAIL: cannot create isolated marker dir" >&2; exit 1; }
+trap 'rm -rf "$MARKER_DIR"' EXIT INT TERM
+export TMPDIR="$MARKER_DIR"
+
+# The hook's core promise is that it never disturbs the Bash call: exit 0, valid
+# JSON, silent stderr. All three were discarded by an earlier version of this
+# suite, so a nonzero exit or a stray diagnostic passed every assertion.
+contract_check() {
+  local out="$1" rc="$2" label="$3" errbytes
+  if [ -n "${PROBE_ERR:-}" ] && [ -f "$PROBE_ERR" ]; then
+    errbytes=$(wc -c < "$PROBE_ERR" | tr -d ' ')
+    if [ "$errbytes" != "0" ]; then
+      fail=$((fail+1)); printf 'FAIL  [wrote %s bytes to stderr]  %s\n' "$errbytes" "$label" >&2
+      printf '        %s\n' "$(head -1 "$PROBE_ERR")" >&2; return
+    fi
+  fi
+  if [ "$rc" -ne 0 ]; then
+    fail=$((fail+1)); printf 'FAIL  [exit=%s, must be 0]  %s\n' "$rc" "$label" >&2; return
+  fi
+  if [ -n "$out" ] && ! printf '%s' "$out" | jq -e . >/dev/null 2>&1; then
+    fail=$((fail+1)); printf 'FAIL  [output is not valid JSON]  %s\n' "$label" >&2; return
+  fi
+  pass=$((pass+1))
+}
+
+run_hook() { # run_hook <command> <session>; sets HOOK_OUT / HOOK_RC
+  PROBE_ERR=$(mktemp "${MARKER_DIR}/err-XXXXXX")
+  HOOK_OUT=$(jq -nc --arg c "$1" --arg s "$2" \
+    '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' | bash "$HOOK" 2>"$PROBE_ERR"); HOOK_RC=$?
+  contract_check "$HOOK_OUT" "$HOOK_RC" "$1"
+  rm -f "$PROBE_ERR"; PROBE_ERR=""
+}
+
+# probe <remind|quiet> <command> [session]
+probe() {
+  local expect="$1" cmd="$2" sess="${3:-}" got
+  probe_n=$((probe_n+1)); [ -n "$sess" ] || sess="probe-$$-$probe_n"
+  run_hook "$cmd" "$sess"
+  got="quiet"
+  # Assert the STRUCTURE the PreToolUse consumer reads, not just the key name: a
+  # top-level `additionalContext` is valid JSON the host ignores.
+  printf '%s' "$HOOK_OUT" | jq -e \
+    '.hookSpecificOutput.hookEventName == "PreToolUse"
+     and (.hookSpecificOutput.additionalContext | type) == "string"
+     and (.hookSpecificOutput.additionalContext | length) > 0' >/dev/null 2>&1 && got="remind"
+  if [ "$got" = "$expect" ]; then pass=$((pass+1))
+  else fail=$((fail+1)); printf 'FAIL  [want=%s got=%s]  %s\n' "$expect" "$got" "$cmd" >&2; fi
+}
+
+# attrib <expected tool> <command> — which tool the advisory names.
+attrib() {
+  local want="$1" cmd="$2" got
+  probe_n=$((probe_n+1))
+  run_hook "$cmd" "attrib-$$-$probe_n"
+  got=$(printf '%s' "$HOOK_OUT" | jq -r '.hookSpecificOutput.additionalContext // ""' 2>/dev/null \
+        | grep -o '`[^`]*`' | head -1 | tr -d '`')
+  if [ "$got" = "$want" ]; then pass=$((pass+1))
+  else fail=$((fail+1)); printf 'FAIL  [want-attrib=%s got=%s]  %s\n' "$want" "${got:-<none>}" "$cmd" >&2; fi
+}
+
+# --- FIRES: the recorded failure shapes this hook exists to catch ---
+probe remind 'glab mr list --state opened'
+probe remind 'glab ci list --branch dev'
+probe remind 'glab pipeline view 21852 --output json'
+probe remind 'gh pr list --state open'
+probe remind 'lark-cli schema tbl --jq .fields'
+probe remind 'uv publish --check-url https://example.invalid/simple'
+attrib 'glab' 'glab mr list --state opened'
+attrib 'uv'   'uv publish --check-url https://example.invalid/simple'
+# No shell parsing means every spelling of the same invocation behaves alike —
+# this is the property the fifteen-round parser was failing to achieve.
+probe remind 'cd /some/path && glab mr list --state merged'
+probe remind 'GITLAB_HOST=x glab mr list --state opened'
+probe remind 'env GITLAB_HOST=x glab mr list --state opened'
+probe remind 'command glab mr list --state opened'
+probe remind 'gh --repo=owner/repo pr list --state open'
+probe remind 'gh -R owner/repo pr list --state open'
+probe remind 'glab mr list \
+  --state opened'
+probe remind 'git --help && glab mr list --state opened'
+
+# --- QUIET: no long flag means nothing to guess ---
+probe quiet 'glab mr view 123'
+probe quiet 'gh pr list'
+probe quiet 'uv sync'
+# --- QUIET: tools outside the list are a documented NON-fire ---
+probe quiet 'git log --oneline --graph'
+probe quiet 'kubectl get pods --all-namespaces'
+probe quiet 'npm install --save-dev typescript'
+# --- QUIET: the tool name must appear as a WORD ---
+probe quiet 'echo glabber --state opened'
+probe quiet './myglab --state opened'
+# --- QUIET: whitespace-bearing quoted prose is masked ---
+probe quiet 'git commit -m "note that glab mr list --state is unsupported"'
+probe quiet 'git log --grep="glab mr list --state"'
+# --- QUIET: a help request whose FIRST WORD is the tool ---
+probe quiet 'glab mr list --help'
+probe quiet 'glab mr list -h'
+probe quiet 'glab help mr list --json'
+# A bare `help` counts only in the SUBCOMMAND slot: as a positional argument it
+# is an endpoint name, not a help request, and suppressing there swallowed the
+# advisory for a genuine flag.
+probe remind 'gh api help --paginate'
+probe quiet 'gh pr merge --help'
+# A standalone `--` hands the rest of the line to another program, so a `--help`
+# after it is that program's, not this tool's — the flag before it still needs
+# the advisory.
+probe remind 'uv run --python 3.12 -- python --help'
+# ...but suppression must NOT extend to a compound command: the first word is
+# still the tool while the unrelated `--help` belongs to something else, and the
+# whole-command grep swallowed the advisory for a genuine invocation.
+probe remind 'glab mr list --state opened && git --help'
+probe remind 'glab mr list --state opened; gh pr list --help'
+# A NEWLINE separates commands exactly as `;` does, and grep is line-oriented so
+# a character class can never see one — a two-line command read as "simple" and
+# the second line's `--help` suppressed the advisory for the first line.
+probe remind 'glab mr list --state opened
+git --help'
+
+# --- DOCUMENTED FALSE FIRES (asserted so they stay intentional) ---
+# A mention inside a heredoc body fires once for that session. Accepted: chasing
+# it is what produced the fifteen-round parser.
+probe remind 'cat <<EOF
+glab mr list --state opened
+EOF'
+# A help request that is not the command's first word still fires.
+probe remind 'cd /x && glab mr list --help'
+# A payload inside a whitespace-bearing quoted string is masked away and stays
+# QUIET. The mask cannot separate a launcher payload from a commit message
+# without parsing, which is exactly what this hook refuses to do; asserted so the
+# trade-off stays deliberate rather than drifting into an accident.
+probe quiet "sh -c 'glab mr list --state opened'"
+probe quiet 'bash -c "glab mr list --state opened"'
+
+# --- DEDUP: once per (session, tool); a different tool still fires ---
+d="dedup-$$"
+probe remind 'glab mr list --state opened' "$d"
+probe quiet  'glab ci list --branch dev'   "$d"
+probe remind 'gh pr list --state open'     "$d"
+probe remind 'glab mr list --state opened' "${d}-other"
+# A tool that always TRAILS another in the same command must still get its own
+# advisory: taking only the first tool word meant `gh` stayed silent for the
+# whole session once `glab` was deduped.
+m="mask-$$"
+probe  remind 'glab mr list --state opened'                            "$m"
+attrib_in_session() { # attrib_in_session <expected tool> <cmd> <session>
+  probe_n=$((probe_n+1)); run_hook "$2" "$3"
+  local got
+  got=$(printf '%s' "$HOOK_OUT" | jq -r '.hookSpecificOutput.additionalContext // ""' 2>/dev/null \
+        | grep -o '`[^`]*`' | head -1 | tr -d '`')
+  if [ "$got" = "$1" ]; then pass=$((pass+1))
+  else fail=$((fail+1)); printf 'FAIL  [want-attrib=%s got=%s]  %s\n' "$1" "${got:-<none>}" "$2" >&2; fi
+}
+attrib_in_session 'gh' 'glab mr list --state opened && gh pr list --state open' "$m"
+probe quiet 'glab mr list --state opened && gh pr list --state open'   "$m"
+
+# --- UNSAFE TEMP ROOT: the marker TOCTOU cannot be closed from bash, so where
+#     the temp root is group/world-writable and NOT sticky the hook must decline
+#     to dedup rather than pretend the window is shut. Sticky is what makes a
+#     shared /tmp safe; a per-user temp root is not other-writable at all, so
+#     neither normal case is affected. ---
+unsafe_root=$(mktemp -d "${MARKER_DIR}/unsafe-XXXXXX")
+chmod 777 "$unsafe_root"; chmod -t "$unsafe_root" 2>/dev/null || true
+u_in=$(mktemp "${MARKER_DIR}/in-XXXXXX")
+jq -nc --arg c 'glab mr list --state opened' --arg s 'unsafe-sess' \
+   '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' > "$u_in"
+u1=$(TMPDIR="$unsafe_root" bash "$HOOK" < "$u_in" 2>/dev/null)
+u2=$(TMPDIR="$unsafe_root" bash "$HOOK" < "$u_in" 2>/dev/null)
+rm -f "$u_in"
+if printf '%s' "$u1" | grep -q additionalContext && printf '%s' "$u2" | grep -q additionalContext; then
+  pass=$((pass+1))
+else
+  fail=$((fail+1)); printf 'FAIL  [unsafe temp root: dedup was applied instead of skipped]\n' >&2
+fi
+if [ ! -e "$unsafe_root/ccl-skills-cliflag" ]; then pass=$((pass+1))
+else fail=$((fail+1)); printf 'FAIL  [unsafe temp root: marker directory was created]\n' >&2; fi
+
+# Sticky exempts a writable directory only when we or root own it, so a
+# self-owned sticky temp root must STILL dedup (the common shared-/tmp shape).
+own_sticky=$(mktemp -d "${MARKER_DIR}/own-XXXXXX"); chmod 1777 "$own_sticky"
+o_in=$(mktemp "${MARKER_DIR}/in-XXXXXX")
+jq -nc --arg c 'glab mr list --state opened' --arg s 'own-sess' \
+   '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' > "$o_in"
+o1=$(TMPDIR="$own_sticky" bash "$HOOK" < "$o_in" 2>/dev/null)
+o2=$(TMPDIR="$own_sticky" bash "$HOOK" < "$o_in" 2>/dev/null)
+rm -f "$o_in"
+if printf '%s' "$o1" | grep -q additionalContext && ! printf '%s' "$o2" | grep -q additionalContext; then
+  pass=$((pass+1))
+else
+  fail=$((fail+1)); printf 'FAIL  [self-owned sticky temp root: dedup was skipped]\n' >&2
+fi
+
+# The walk must use the PHYSICAL path: `dirname` on a logical path resolves
+# neither symlinks nor `..`, so a TMPDIR that merely POINTS at a hostile-ancestor
+# directory walked a chain that does not exist on disk.
+sym_parent=$(mktemp -d "${MARKER_DIR}/sym-XXXXXX")
+chmod 777 "$sym_parent"; chmod -t "$sym_parent" 2>/dev/null || true
+sym_real="$sym_parent/inner"; mkdir -p "$sym_real"; chmod 700 "$sym_real"
+sym_link="${MARKER_DIR}/symlink-root-$$"; ln -s "$sym_real" "$sym_link"
+s_in=$(mktemp "${MARKER_DIR}/in-XXXXXX")
+jq -nc --arg c 'glab mr list --state opened' --arg s 'sym-sess' \
+   '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' > "$s_in"
+s1=$(TMPDIR="$sym_link" bash "$HOOK" < "$s_in" 2>/dev/null)
+s2=$(TMPDIR="$sym_link" bash "$HOOK" < "$s_in" 2>/dev/null)
+rm -f "$s_in"
+if printf '%s' "$s1" | grep -q additionalContext && printf '%s' "$s2" | grep -q additionalContext; then
+  pass=$((pass+1))
+else
+  fail=$((fail+1)); printf 'FAIL  [symlinked temp root to hostile ancestor: dedup was applied]\n' >&2
+fi
+
+# A mode-0700 temp root under a world-writable NON-STICKY parent is swappable
+# wholesale, so checking only the temp root itself proves nothing about the path.
+anc_parent=$(mktemp -d "${MARKER_DIR}/anc-XXXXXX")
+chmod 777 "$anc_parent"; chmod -t "$anc_parent" 2>/dev/null || true
+anc_root="$anc_parent/inner"; mkdir -p "$anc_root"; chmod 700 "$anc_root"
+a_in=$(mktemp "${MARKER_DIR}/in-XXXXXX")
+jq -nc --arg c 'glab mr list --state opened' --arg s 'anc-sess' \
+   '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' > "$a_in"
+a1=$(TMPDIR="$anc_root" bash "$HOOK" < "$a_in" 2>/dev/null)
+a2=$(TMPDIR="$anc_root" bash "$HOOK" < "$a_in" 2>/dev/null)
+rm -f "$a_in"
+if printf '%s' "$a1" | grep -q additionalContext && printf '%s' "$a2" | grep -q additionalContext \
+   && [ ! -e "$anc_root/ccl-skills-cliflag" ]; then
+  pass=$((pass+1))
+else
+  fail=$((fail+1)); printf 'FAIL  [unsafe ANCESTOR of temp root: dedup was applied]\n' >&2
+fi
+
+# --- BOUNDED INPUT: past the 1 MiB read cap the payload is ignored entirely.
+#     Deterministic, not a timing bound: a timing probe could not fail at a
+#     CI-safe size, so it was removed rather than shipped. ---
+big_in=$(mktemp "${MARKER_DIR}/big-XXXXXX")
+awk 'BEGIN{printf "{\"tool_input\":{\"command\":\"glab mr list --state opened "; for(i=0;i<2200000;i++)printf "x"; printf "\"},\"session_id\":\"bigpay\",\"cwd\":\"/tmp\"}"}' > "$big_in"
+big_out=$(bash "$HOOK" < "$big_in" 2>/dev/null); big_rc=$?
+if [ "$big_rc" -ne 0 ]; then
+  fail=$((fail+1)); printf 'FAIL  [oversized payload: rc=%s]\n' "$big_rc" >&2
+elif printf '%s' "$big_out" | grep -q additionalContext; then
+  fail=$((fail+1)); printf 'FAIL  [oversized payload parsed past the 1MiB read cap]\n' >&2
+else pass=$((pass+1)); fi
+rm -f "$big_in"
+
+# --- MARKER SAFETY. Every attack here was reproduced first-hand before its fix.
+#     Each plant targets BOTH the current directory layout AND the pre-hardening
+#     flat path: planting only at the current path made this whole group vacuous
+#     (a mutation reverting the layout passed all of it). ---
+FLAT='ccl-skills-cliflag-hostile-sess'
+DIRP='ccl-skills-cliflag'
+
+run_bounded() { # run_bounded <seconds> <input-file> <cmd...>
+  # `timeout` is NOT installed on stock macOS; calling it there returns 127 and
+  # would fail every probe here on a Darwin runner with a correct hook.
+  local limit="$1" infile="$2"; shift 2
+  local outfile pid waited=0
+  outfile=$(mktemp "${MARKER_DIR}/bounded-XXXXXX")
+  "$@" <"$infile" >"$outfile" 2>/dev/null & pid=$!
+  while kill -0 "$pid" 2>/dev/null && [ "$waited" -lt "$limit" ]; do sleep 1; waited=$((waited+1)); done
+  if kill -0 "$pid" 2>/dev/null; then kill -9 "$pid" 2>/dev/null; wait "$pid" 2>/dev/null; BOUNDED_RC=124
+  else wait "$pid"; BOUNDED_RC=$?; fi
+  BOUNDED_OUT=$(cat "$outfile"); rm -f "$outfile"
+}
+
+hostile() { # hostile <label> <plant-fn>; publishes HOSTILE_SANDBOX
+  local label="$1" plant="$2" sandbox infile start elapsed
+  sandbox=$(mktemp -d "${MARKER_DIR}/hostile-XXXXXX") || { fail=$((fail+1)); return; }
+  "$plant" "$sandbox"
+  infile=$(mktemp "${MARKER_DIR}/in-XXXXXX")
+  jq -nc --arg c 'glab mr list --state opened' --arg s 'hostile-sess' \
+     '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' > "$infile"
+  start=$(date +%s)
+  TMPDIR="$sandbox" run_bounded 8 "$infile" bash "$HOOK"
+  elapsed=$(( $(date +%s) - start )); rm -f "$infile"
+  if [ "$BOUNDED_RC" -ne 0 ] || [ "$elapsed" -ge 5 ]; then
+    fail=$((fail+1)); printf 'FAIL  [hostile %s: rc=%s elapsed=%ss]\n' "$label" "$BOUNDED_RC" "$elapsed" >&2
+  elif ! printf '%s' "$BOUNDED_OUT" | grep -q 'additionalContext'; then
+    fail=$((fail+1)); printf 'FAIL  [hostile %s: advisory suppressed]\n' "$label" >&2
+  else pass=$((pass+1)); fi
+  HOSTILE_SANDBOX="$sandbox"
+}
+
+victim_intact() { # victim_intact <label>
+  if [ -f "$HOSTILE_SANDBOX/victim.txt" ] \
+     && [ "$(cat "$HOSTILE_SANDBOX/victim.txt")" = 'original content' ]; then
+    pass=$((pass+1))
+  else
+    fail=$((fail+1)); printf 'FAIL  [hostile %s: victim file was written through]\n' "$1" >&2
+  fi
+}
+
+plant_symlink()    { echo 'original content' > "$1/victim.txt"
+                     ln -s "$1/victim.txt" "$1/$DIRP"; ln -s "$1/victim.txt" "$1/$FLAT"; }
+plant_fifo()       { mkfifo "$1/$DIRP" 2>/dev/null || true; mkfifo "$1/$FLAT" 2>/dev/null || true; }
+# NOT an ownership probe: it creates the directory as the SAME uid, so `-O`
+# stays true and that rejection is never reached. What it covers is a
+# PRE-EXISTING marker directory being reused without incident, plus the flat
+# hostile object. Cross-uid `-O` has no executable probe here.
+plant_preexisting(){ mkdir -p "$1/$DIRP"; chmod 700 "$1/$DIRP"; mkfifo "$1/$FLAT" 2>/dev/null || true; }
+plant_inner_fifo() { mkdir -p -m 700 "$1/$DIRP"; mkfifo "$1/$DIRP/hostile-sess" 2>/dev/null || true
+                     mkfifo "$1/$FLAT" 2>/dev/null || true; }
+plant_inner_link() { mkdir -p -m 700 "$1/$DIRP"; echo 'original content' > "$1/victim.txt"
+                     ln -s "$1/victim.txt" "$1/$DIRP/hostile-sess"; ln -s "$1/victim.txt" "$1/$FLAT"; }
+# A HARD LINK passes -f, -O and the symlink test alike; reachable when the marker
+# directory pre-existed group/world-writable.
+plant_inner_hard() { mkdir -p "$1/$DIRP"; chmod 777 "$1/$DIRP"
+                     echo 'original content' > "$1/victim.txt"
+                     ln "$1/victim.txt" "$1/$DIRP/hostile-sess"
+                     ln "$1/victim.txt" "$1/$FLAT" 2>/dev/null || true; }
+
+hostile 'symlink at marker dir' plant_symlink;        victim_intact 'symlink at marker dir'
+hostile 'FIFO at marker dir' plant_fifo
+hostile 'pre-existing marker dir' plant_preexisting
+hostile 'FIFO as marker file' plant_inner_fifo
+hostile 'symlink as marker file' plant_inner_link;    victim_intact 'symlink as marker file'
+hostile 'hard link as marker file' plant_inner_hard;  victim_intact 'hard link as marker file'
+
+# A pre-existing world-writable marker directory must be TIGHTENED, not merely
+# accepted: `mkdir -p -m 700` does not touch an existing directory's mode.
+mode_sb=$(mktemp -d "${MARKER_DIR}/mode-XXXXXX")
+mkdir -p "$mode_sb/$DIRP"; chmod 777 "$mode_sb/$DIRP"
+mode_in=$(mktemp "${MARKER_DIR}/in-XXXXXX")
+jq -nc --arg c 'glab mr list --state opened' --arg s 'mode-sess' \
+   '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' > "$mode_in"
+TMPDIR="$mode_sb" run_bounded 8 "$mode_in" bash "$HOOK"; rm -f "$mode_in"
+if [ "$BOUNDED_RC" -eq 0 ] && [ "$(ls -ld "$mode_sb/$DIRP" | cut -c1-10)" = 'drwx------' ]; then
+  pass=$((pass+1))
+else
+  fail=$((fail+1)); printf 'FAIL  [world-writable marker dir not tightened]\n' >&2
+fi
+
+# An OVERSIZED marker must be neither read nor written, in BOTH shapes. The size
+# cap was once removed on the argument that the line-count bound already covered
+# this — an argument checked only against the many-line shape, where it holds. A
+# single enormous LINE has a line count of 1, sails past that bound, and gets
+# appended to. Probing one dimension and concluding over both is the mistake;
+# both shapes are asserted here so the removal cannot recur on the same reasoning.
+big_sb=$(mktemp -d "${MARKER_DIR}/bigm-XXXXXX")
+mkdir -p -m 700 "$big_sb/ccl-skills-cliflag"
+awk 'BEGIN{for(i=0;i<5000;i++)print "junk"}' > "$big_sb/ccl-skills-cliflag/big-sess"
+# ...and the single-enormous-line shape, which the line-count bound does not see.
+awk 'BEGIN{for(i=0;i<300000;i++)printf "x"; print ""}' > "$big_sb/ccl-skills-cliflag/one-sess"
+b_in=$(mktemp "${MARKER_DIR}/in-XXXXXX")
+jq -nc --arg c 'glab mr list --state opened' --arg s 'big-sess' \
+   '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' > "$b_in"
+b1=$(TMPDIR="$big_sb" bash "$HOOK" < "$b_in" 2>/dev/null)
+b2=$(TMPDIR="$big_sb" bash "$HOOK" < "$b_in" 2>/dev/null)
+rm -f "$b_in"
+if printf '%s' "$b1" | grep -q additionalContext && printf '%s' "$b2" | grep -q additionalContext \
+   && [ "$(wc -l < "$big_sb/ccl-skills-cliflag/big-sess" | tr -d ' ')" = "5000" ]; then
+  pass=$((pass+1))
+else
+  fail=$((fail+1)); printf 'FAIL  [oversized many-line marker: appended to or dedup applied]\n' >&2
+fi
+o_in=$(mktemp "${MARKER_DIR}/in-XXXXXX")
+jq -nc --arg c 'glab mr list --state opened' --arg s 'one-sess' \
+   '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' > "$o_in"
+o1=$(TMPDIR="$big_sb" bash "$HOOK" < "$o_in" 2>/dev/null)
+rm -f "$o_in"
+if printf '%s' "$o1" | grep -q additionalContext \
+   && [ "$(wc -l < "$big_sb/ccl-skills-cliflag/one-sess" | tr -d ' ')" = "1" ]; then
+  pass=$((pass+1))
+else
+  fail=$((fail+1)); printf 'FAIL  [oversized single-line marker: was appended to]\n' >&2
+fi
+
+# An EMPTY marker: `grep -c ''` prints 0 but exits 1, which produced "0\n0" and a
+# stderr diagnostic from the numeric test.
+empty_sb=$(mktemp -d "${MARKER_DIR}/empty-XXXXXX")
+mkdir -p -m 700 "$empty_sb/$DIRP"; : > "$empty_sb/$DIRP/probe-empty"
+PROBE_ERR=$(mktemp "${MARKER_DIR}/err-XXXXXX")
+e_out=$(TMPDIR="$empty_sb" jq -nc --arg c 'glab mr list --state opened' --arg s 'probe-empty' \
+      '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' \
+      | TMPDIR="$empty_sb" bash "$HOOK" 2>"$PROBE_ERR"); e_rc=$?
+contract_check "$e_out" "$e_rc" 'empty marker file'
+rm -f "$PROBE_ERR"; PROBE_ERR=""
+
+# A marker that is owned and single-link but NOT WRITABLE: the append is
+# attempted and must fail SILENTLY. This is the probe that covers the subshell —
+# an explicit `-w` check used to short-circuit here, which is why removing the
+# subshell used to change nothing observable.
+# Skipped as root: `chmod 400` does not stop uid 0 from appending, so under a
+# container CI running as root this probe would pass without exercising anything.
+# Recording the skip beats a vacuous pass.
+if [ "$(id -u)" = "0" ]; then
+  printf 'SKIP  [read-only marker probe: running as root, chmod 400 is not a barrier]\n' >&2
+else
+ro_sb=$(mktemp -d "${MARKER_DIR}/ro-XXXXXX")
+mkdir -p -m 700 "$ro_sb/$DIRP"; : > "$ro_sb/$DIRP/ro-sess"; chmod 400 "$ro_sb/$DIRP/ro-sess"
+PROBE_ERR=$(mktemp "${MARKER_DIR}/err-XXXXXX")
+r_out=$(TMPDIR="$ro_sb" jq -nc --arg c 'glab mr list --state opened' --arg s 'ro-sess' \
+      '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' \
+      | TMPDIR="$ro_sb" bash "$HOOK" 2>"$PROBE_ERR"); r_rc=$?
+contract_check "$r_out" "$r_rc" 'read-only marker file'
+rm -f "$PROBE_ERR"; PROBE_ERR=""
+fi
+
+# An over-long session id became an over-long filename and the failed open
+# printed `File name too long` to real stderr.
+long_sess=$(awk 'BEGIN{for(i=0;i<400;i++)printf "s"}')
+probe remind 'glab mr list --state opened' "$long_sess"
+# ...and the capped name must still DEDUP; without the cap the marker can never
+# be written and the advisory repeats forever.
+probe quiet  'glab ci list --branch dev'   "$long_sess"
+
+# A TMPDIR that looks like an OPTION (`-P`, `-L`) must not send `cd` to HOME and
+# plant the marker directory there.
+# NEVER delete anything this suite did not create. An earlier version removed
+# `$HOME/ccl-skills-cliflag` on failure — and this suite runs in `make test`, so
+# a developer whose real marker directory happened to sit there would have had it
+# destroyed by a test run. If the path already exists, the probe cannot attribute
+# what it finds and SKIPS rather than guess.
+if [ -e "$HOME/ccl-skills-cliflag" ]; then
+  printf 'SKIP  [option-shaped TMPDIR probe: %s pre-exists, refusing to touch it]\n' \
+    "$HOME/ccl-skills-cliflag" >&2
+else
+  opt_in=$(mktemp "${MARKER_DIR}/in-XXXXXX")
+  jq -nc --arg c 'glab mr list --state opened' --arg s 'opt-sess' \
+     '{tool_input:{command:$c},session_id:$s,cwd:"/tmp"}' > "$opt_in"
+  TMPDIR=-P bash "$HOOK" < "$opt_in" >/dev/null 2>&1
+  TMPDIR=-L bash "$HOOK" < "$opt_in" >/dev/null 2>&1
+  rm -f "$opt_in"
+  if [ ! -e "$HOME/ccl-skills-cliflag" ]; then
+    pass=$((pass+1))
+  else
+    fail=$((fail+1))
+    # DO NOT REMOVE IT. "It was absent a moment ago, so this probe must have made
+    # it" is an inference, not attribution — a concurrent process can create the
+    # path inside that window, and this suite runs in `make test` on machines
+    # that are doing other things. A test does not delete anything it did not
+    # certainly create; reporting the path and leaving it is the correct end.
+    printf 'FAIL  [option-shaped TMPDIR: %s now exists; NOT removed, inspect it yourself]\n' \
+      "$HOME/ccl-skills-cliflag" >&2
+  fi
+fi
+
+# --- PRESENCE, NOT BEHAVIOR. Two guards cannot be reached by any portable probe
+#     here (both need a second user id), and this suite says so. That honesty has
+#     a cost the review named: a later change could delete either one and stay
+#     green. These checks close only that half — they assert the guard is still
+#     WRITTEN, never that it works. A green here is not evidence of behavior, and
+#     must not be cited as if it were. If a guard is deliberately removed, delete
+#     its check in the same change and say why in the header. ---
+for guard in '-O "$marker_dir"' '"$dir_owner" != "root"'; do
+  # `--` because the first guard string starts with `-O`, which grep would
+  # otherwise take as an option — the check then always failed, on a clean hook.
+  if grep -Fq -- "$guard" "$HOOK"; then
+    pass=$((pass+1))
+  else
+    fail=$((fail+1))
+    printf 'FAIL  [unprobed guard vanished from the hook: %s]\n' "$guard" >&2
+  fi
+done
+
+printf '\n%s: pass=%d fail=%d\n' "$(basename "$0")" "$pass" "$fail"
+[ "$fail" -eq 0 ] || exit 1

package/dist/assets/marketplace/plugins/ccl-skills/packages/opencode-plugin/ccl-skills.ts

@@ -54,6 +54,7 @@ export const OPENCODE_HOOK_BINDINGS = Object.freeze({
   "guard-edit-isolation.sh": "tool.execute.before:edit/write/apply_patch",
   "owner-dispatch-guard.sh": "tool.execute.before:edit/write/apply_patch/bash",
   "guard-merge-authorization.sh": "tool.execute.before:bash",
+  "remind-unverified-cli-flag.sh": "tool.execute.before:bash",
   "guard-delegation-owner.sh": "tool.execute.before:task/agent",
   "remind-post-merge-cleanup.sh": "tool.execute.after:bash",
   "merge-authorization-prompt.sh": "chat.message",
@@ -482,6 +483,10 @@ export const CclSkills = async (context: {
           throw new Error(`ccl-skills merge authorization blocked this operation.\n${merge.message ?? "OpenCode hook runtime unavailable."}`)
         }
         enforce(merge, "ccl-skills merge authorization")
+        // Advisory only: it never blocks, so its context is appended rather than
+        // enforced. Mirrors hooks/remind-unverified-cli-flag.sh under Claude Code.
+        const flagNote = additionalContext(runHook(hooksRoot, "remind-unverified-cli-flag.sh", hookPayload, directory, 10_000))
+        if (flagNote) prependTaskContext(args, [flagNote])
       }
 
       if (tool === "task" || tool === "agent") {

package/dist/assets/marketplace/plugins/ccl-skills/skills/app-cross-platform-dev/SKILL.md

@@ -21,11 +21,11 @@ Use this skill for mobile app and cross-platform client engineering. It covers F
 
 ## Core Workflow
 
-Before editing app code, native project files, platform configs, styles, assets, or tests, complete enough analysis and planning for the change to be reviewable. Scale the plan to risk: a simple low-risk single-screen change can use a short inline plan; multi-platform, user-visible, API-visible, native-capability, release/store, bug-fix, branch/MR, unclear-risk, or high-risk work needs explicit task split, design checkpoint, target-device matrix, acceptance checks, verification commands, rollback or stop conditions, and named handoffs to design, testing, backend, release, or diagnosis skills before edits.
+Before editing app code, native project files, platform configs, styles, assets, or tests, complete enough analysis and planning for the change to be reviewable. Scale the plan to risk: a simple low-risk single-screen change can use a short inline plan; multi-platform, API-visible, native-capability, release/store, bug-fix, branch/MR, unclear-risk, or high-risk work needs explicit task split, target-device matrix, acceptance checks, verification commands, rollback or stop conditions, and named handoffs to testing, backend, release, or diagnosis skills before edits. Runtime-visible work additionally consumes the canonical UI/UX delivery contract's Design brief and Test selection Phase 0 before the first implementation edit.
 
 Repo-local agent contracts (`AGENTS.md` at the repo root and in source directories) are part of the delivery contract: when a change moves a stable boundary, generated surface, workflow, or directory-local rule, update the nearest contract in the same MR and keep coverage in sync per `product-rd-workflow`'s spec / repo-contract sync gate.
 
-When checking a cross-platform app against team standards, split conformance into deterministic and agent review evidence. Deterministic checks cover build flavors/schemes, package locks, generated API/IDL client usage, environment/lane config, unit/widget/instrumented/E2E commands, CI gates, signing/release config, and request/trace identifiers in central clients. Agent review checks cover screen/module boundaries, platform abstraction leakage, native bridge contracts, finite-value mapping, device evidence quality, and whether tests prove the shipped runtime paths rather than only mocked widgets. For the per-substack deterministic executor list (each analyzer is its own toolchain with thin defaults — `dart analyze`+`flutter_lints` with `analyzer>errors:` severity escalation, detekt `coroutines`/`exceptions` inactive rules, SwiftLint opt-in safety rules, RN typed-ESLint) and the shipped client conformance checkers, see `testing-strategy/references/fitness-functions.md` §4.1.3 (client language-basics; spec 006). Layering/dependency-direction has no out-of-box rule on any substack — express it as import-ban config (Konsist/ArchUnit/custom_lint/dep-cruiser).
+When checking a cross-platform app against team standards, split conformance into deterministic and agent review evidence. Deterministic checks cover build flavors/schemes, package locks, generated API/IDL client usage, environment/lane config, unit/widget/instrumented/E2E commands, CI gates, signing/release config, and request/trace identifiers in central clients. Agent review checks cover screen/module boundaries, platform abstraction leakage, native bridge contracts, finite-value mapping, device evidence quality, and whether tests prove the shipped runtime paths rather than only mocked widgets. For the per-substack deterministic executor list (each analyzer ships thin defaults) and the shipped client conformance checkers, see `testing-strategy/references/fitness-functions.md` §4.1.3 (spec 006). Layering/dependency-direction has no out-of-box rule on any substack — express it as import-ban config (Konsist/ArchUnit/custom_lint/dep-cruiser).
 
 1. Resolve the target app shape.
    - Flutter shared app, React Native app, native Android, native iOS, or mixed native plus shared module.
@@ -37,8 +37,8 @@ When checking a cross-platform app against team standards, split conformance int
    - Identify shared behavior versus platform-specific behavior; list which platforms must be changed and verified.
    - Read local wrappers first: Flutter/Gradle/Xcode scripts, package managers, CI jobs, test targets, flavors/schemes, and generated files.
    - If a design exists, map each visible state and interaction to code ownership before implementing.
-   - For any visible UI change, map the design checkpoint to code ownership: aesthetic hierarchy/density, interaction flow, behavioral feedback, user psychology, safe-area/keyboard/orientation adaptation, and device screenshot acceptance. Also record `product-ui-ux-design`'s implementation-owner checkpoint before the first edit — its field list (design/stack/test owners, entry-rule evidence, rendered/device evidence status) and copy-only path are authoritative there; load the named owner skills rather than only naming them, and treat a completion claim without `captured/verified` rendered evidence as incomplete — an explicitly accepted gap closes the slice only as `pre-runtime-test ready` / handoff, never as complete/done.
-   - For UI/UX redesign slices meeting `product-ui-ux-design`'s page-slice trigger conditions — that gate's trigger list is authoritative and must be checked, not paraphrased, whenever a screen/surface change could be a redesign, restyle, new-style declaration, structural/visual-system change, continuation, or redesigned-surface reference — apply its cross-stack page-slice gate before framework mechanics: RED-first focused assertion, IA regrouping by user intent/consequence, behavior-contract preservation, state matrix, rendered evidence, and the design verdict (`accepted` / `rejected` / `pending`; missing = `pending`, and `design-rejected` blocks complete/MR-ready/normal/draft MR per the **Rejected-surface rule**). Translate examples from other stacks into the target app runtime instead of copying Flutter-, Android-, iOS-, or Web-specific commands as the method itself.
+   - For every visible UI change, load `../product-ui-ux-design/references/delivery-contract.md` and consume either its full Design brief + Phase 0 or its valid low-risk copy-only record + lightweight Phase 0 before coding. The lightweight path checks semantics, accessible name, localization, rendered extent, and target render without inventing unrelated matrices; risk-bearing copy uses the full path. For full slices, map structure, state/adaptation matrices, behavior and criteria to shared/platform owners; record build target, device, safe area, keyboard, orientation, text scale, input/lifecycle, and preserved behavior. For a native WebView, this skill owns the container/bridge member while `web-react-dev` or the actual web-content owner supplies a separate content member; neither render closes the other layer.
+   - Before the first implementation edit, add the canonical `client_entry` defined there: local rule identifier or short quote and implementation decision, target surface/runtime, planned run/capture command, and behavior that must remain unchanged.
 
 3. Define the client boundary before coding.
    - Screens, routes, tabs, navigation stack, deep links, and back behavior.
@@ -138,6 +138,7 @@ When checking a cross-platform app against team standards, split conformance int
 
 7. Verify on rendered surfaces.
    - Run the repo's formatter, analyzer/linter, typecheck/build, and focused tests.
+   - Test-code authoring: pick the matching § from the decision table in `testing-strategy/references/test-code-authoring-patterns.md`; smell lint: `testing-strategy/references/fitness-functions.md` §4.1.4.
    - **TC traceability**: Flutter/Dart tests link via `tcTest(['TC-XX-NNN'], 'desc', () { ... })` wrapper (registers at registration time, so `skip:` / `skipIf:` etc. still register correctly). Helper from `test-artifact-management/references/tc_helpers/tc.dart`, installed under `test/tc.dart`. Native Android/iOS use the language-appropriate wrapper convention (write a small helper that appends to `test/results/tc-map.jsonl`). See `test-artifact-management/references/tc-marker-conventions.md`. Before adding tests, `grep -rn 'tcTest.*"TC-[A-Z]' test/` plus the sidecar to check for existing coverage — extend rather than duplicate. When a TC is marked 废弃, grep both source and sidecar for that TC ID; follow deprecation cascade in `testing-strategy`. Tests without any `tcTest(...)` / equivalent helper call: prompt user only when the underlying code is also removed.
    - **废弃级联：业务代码是否仍在用** — 每端原生 + 跨端各有套路：
      1. Flutter / Dart：`grep -rEn "import ['\"]package:<pkg>/<file>|import ['\"]\.+/<file>" lib/`；运行 `dart analyze` 看 unused-import warning；路由表 `MaterialApp.routes` / GoRouter 配置内未注册的页面可删
@@ -145,12 +146,13 @@ When checking a cross-platform app against team standards, split conformance int
      3. iOS（Swift/ObjC）：`grep -rn "import <module>\|<ClassName>" ios/`；Xcode 的 dead-code-stripping 报告；Storyboard / XIB 引用 grep `.storyboard` 与 `.xib`
      4. 边界：跨端项目（KMM / 桥接代码）每层独立判，删一层不代表另一层也死；反射 / runtime 注解（Android）/ Objective-C runtime（iOS）grep 抓不到，需运行时验证
    - Inspect the screen in a real device, emulator, simulator, preview, or captured screenshot for any visible UI change.
-   - For UI/UX redesign evidence, include the target device/form factor, safe-area, keyboard, orientation, dynamic type/text scale, loading/empty/error/final states, and a screenshot or equivalent rendered artifact; mark each dimension covered or `N/A` with a one-line reason. `N/A` is valid only when the reason names a verifiable structural fact, explains why that fact makes the dimension unreachable or unchanged for this slice, and includes a checkable pointer such as a file path, config key, or commit that resolves at review time. Also record the design verdict (`accepted` / `rejected` / `pending`) from a user or named independent design-owner review per `product-ui-ux-design`'s page-slice gate; a missing or absent verdict counts as `pending` and blocks complete/MR-ready exactly like a missing dimension — the screenshot alone is never acceptance. Persist evidence artifacts where reviewers can access them using sanitized/test accounts and redacting tokens, PII, credentials, private paths, and raw personal data; remove temporary smoke files or scripts before commit unless the repo intentionally owns them.
+   - For UI/UX redesign evidence, include the target device/form factor, safe-area, keyboard, orientation, dynamic type/text scale, loading/empty/error/final states, and a screenshot or equivalent rendered artifact; mark each dimension covered or `N/A` with a one-line reason. `N/A` is valid only when the reason names a verifiable structural fact, explains why that fact makes the dimension unreachable or unchanged for this slice, and includes a checkable pointer such as a file path, config key, or commit that resolves at review time. Persist evidence artifacts where reviewers can access them using sanitized/test accounts and redacting tokens, PII, credentials, private paths, and raw personal data; remove temporary smoke files or scripts before commit unless the repo intentionally owns them.
+   - Return the complete canonical client-record member defined in `../product-ui-ux-design/references/delivery-contract.md` for testing Phase 1 and the design verdict. The member includes its applied rule/decision, affected files/components, preserved behavior, exact command, immutable candidate binding, producer member/version actually exercised, artifacts, tested build/device targets, dimensions/states/input and lifecycle modes, criterion-mapped observations, coverage boundary, and gaps. A screenshot proves only the captured host/member states; it cannot close an unbound producer member. `testing-strategy` records aggregate sufficiency before the design owner records the candidate-bound verdict.
    - In approval-sensitive runtimes, do not create a new one-off smoke file for every screenshot or slice. Prefer a repo-owned smoke harness, existing integration test, debug route, fixture flag, deep link, or already-created slice harness; if a temporary harness is genuinely unavoidable, reuse one stable harness for the whole batch, mutate it minimally, and explicitly delete it before commit (a throwaway harness is evidence scaffolding, not shippable code; verify it is gone in the pre-commit diff) unless the repo intentionally owns it. Repeated edit-approval prompts from throwaway helper files are an execution defect, not normal evidence collection.
    - Capture Android evidence as approval-friendly single commands. In environments where command-prefix approval is used, do not combine `adb` with shell pipes, `>`, `>>`, command substitution, `&&`, or local filtering in the same command; those forms are split or de-scoped by the approval layer and can re-trigger prompts even when `adb` itself is approved. Use sanitized/test fixture screens, then run three standalone commands: `adb -s <serial> shell screencap -p "/sdcard/<artifact>.png"`, `adb -s <serial> pull "/sdcard/<artifact>.png" "<repo-evidence-path>/"`, and `adb -s <serial> shell rm "/sdcard/<artifact>.png"` in cleanup even when pull fails or the run aborts. Generate `<artifact>` from a safe basename alphabet (no spaces, globs, or path separators) and quote the `/sdcard` path in every command so `rm` targets exactly the file you created, and create the destination with `mkdir -p <repo-evidence-path>` before pulling. Never write credential, PII, account, or otherwise sensitive real-user screens to `/sdcard`; redact or fixture first. If the environment explicitly pre-approves shell redirection for `adb`, `adb -s <serial> exec-out screencap -p > <repo-evidence-path>/<artifact>.png` is acceptable and avoids device-side storage, but the transcript must record that redirection is approved for that command shape. Either way, validate the captured file is a non-empty valid PNG before relying on it: a failed pull, or an empty/zero-byte `exec-out` stream, means there is no host artifact — retry rather than counting it as evidence.
-   - A mobile screenshot that proves the app rendered is not automatically design acceptance evidence. If the design owner or page-slice review rejects the captured surface for weak hierarchy, blank-feeling composition, generic patched layout, clipped safe-area/keyboard behavior, or mismatch with the design checkpoint, route back to `product-ui-ux-design`'s **Rejected-surface rule** and re-capture after redesign; the app implementation waits on that design verdict instead of self-adjudicating taste. A technically successful but visually failed smoke leaves the slice `design-rejected` — blocking complete, MR-ready, and any normal or draft MR until the re-rendered surface is accepted, not only the completion claim.
+   - A missing or absent design verdict remains `pending` and blocks the canonical contract's `complete`, MR-ready, merge-ready, and normal MR/handoff readiness states; a mobile screenshot proves only that the app rendered and is never design acceptance. If a hierarchy, composition, behavior, safe-area/keyboard, or brief criterion fails, return that failure instead of self-adjudicating taste; the design owner applies `delivery-contract.md`'s rejected-candidate path and requires fresh runtime evidence for the revised candidate.
    - For platform enablement, verify each newly added platform with a real platform build and an install/run smoke on the relevant emulator or simulator. Adding the host project or passing one platform does not complete the slice; record the platform targets, commands, and screenshot or runtime evidence.
-   - For mobile runtime changes, device/emulator/simulator smoke is a completion gate when lower layers cannot prove the behavior. This includes changes to native capabilities, WebView/native bridge callbacks, foreground/background recovery, orientation/safe-area/keyboard behavior, storage/session restore, route/deep-link behavior, upload/media flows, permissions, and rendered loading/error/final states. If the runner is missing, first attempt normal setup; if still unavailable, stop at `pre-runtime-test ready` or `blocked` and name the owner, attempted commands, residual risk, and next unblock action. `pre-runtime-test ready` is handoff-only, not merge-ready, release-ready, or complete.
+   - For mobile runtime changes, device/emulator/simulator smoke is a completion gate when lower layers cannot prove the behavior. This includes changes to native capabilities, WebView/native bridge callbacks, foreground/background recovery, orientation/safe-area/keyboard behavior, storage/session restore, route/deep-link behavior, upload/media flows, permissions, and rendered loading/error/final states. If the runner is missing, first attempt normal setup; if still unavailable, stop at `pre-runtime-test-ready` or `blocked` and name the owner, attempted commands, residual risk, and next unblock action. `pre-runtime-test-ready` is handoff-only, not merge-ready, release-ready, or complete.
    - For emulator readiness scripts, do not trust process launch or boot log text alone. Confirm the runner sees the target device, then verify direct device state such as `adb devices -l`, `adb -s <serial> get-state`, and platform boot readiness before calling Android ready; keep the serial in the output so later E2E commands target the same device.
    - If the app or app-hosted H5 CI only builds or deploys packages, treat that as structural release evidence, not functional proof. Interaction, permission, lifecycle, upload/media, and recovery changes still need focused assertions plus rendered device or host-container smoke.
    - Check accessibility labels, dynamic type/text scale, focus order, screen reader reachability, contrast, and touch targets.
@@ -174,7 +176,7 @@ When checking a cross-platform app against team standards, split conformance int
 - Do not treat a mobile API client as done until empty response, invalid JSON, non-2xx envelope, auth expiry, network failure, cancellation, and backend error message extraction are covered at the client or screen boundary when relevant.
 - Do not scatter backend enum/string literals through app screens, deep links, native bridge payload handling, storage, analytics, or tests. Centralize finite-value parsing, display labels, defaults, and unknown-value behavior at the API/client-domain boundary, and keep raw literals only in clearly named boundary conversion tests that cover every known external value plus unknown/default behavior. Migrate existing non-boundary test raw literals for that value in the same pull request or mark each remaining use with `finite-value-debt: <task-ref> <owner> <deadline> <reason>`, even when the current slice does not introduce a new mapper.
 - Do not debug app failures from code inspection alone when a runnable reproduction, trace, screenshot, or device log can be collected.
-- Do not claim a mobile client fix is complete without naming the platform targets that were verified. If required device/emulator/simulator smoke is unavailable after remediation, the status is `pre-runtime-test ready` or `blocked`, not complete.
+- Do not claim a mobile client fix is complete without naming the platform targets that were verified. If required device/emulator/simulator smoke is unavailable after remediation, the status is `pre-runtime-test-ready` or `blocked`, not complete.
 
 ## Reference Loading
 

package/dist/assets/marketplace/plugins/ccl-skills/skills/app-cross-platform-dev/references/mobile-quality-release.md

@@ -74,4 +74,4 @@ When the mobile app must talk to internal-CA / enterprise-CA / self-signed hosts
 - **Debug-only instrumentation must be structurally excluded from every real-user build, and the exclusion verified on the exact shipped artifact — a runtime flag is not the guard.** The class is broad: debug bridges, in-app state/inspection servers, dev overlays/menus, network inspectors, remote WebView debugging, verbose token/PII logging, mock-auth or auth-bypass hooks, and any QA state-export or runtime-introspection surface — including ones with no visible UI that are still reachable via deep link, push action, JS bridge message, or custom URL scheme. Any of these is an attack surface and data-exposure risk (an in-app state server can bind a port and dump app state on a real user's device) if it reaches a build that can touch real users, real auth, or real PII. **Scope by distribution channel + data sensitivity, not a single `isProduction`/`isDebug` enum**: the gate covers App Store / Play production AND TestFlight, enterprise / ad-hoc, dogfood, Play internal/closed testing, and staged rollout — all carry real users (same channel-not-enum boundary as **TLS Trust And Certificate Pinning** above).
   - **Exclude at the dependency/target level, per real-user variant — not just a runtime flag, and not just the variant named `release`.** An `if (isDebug)` check still compiles the code — and any bound port/server — into the binary; even `kDebugMode` / `__DEV__` only strip the Dart/JS call path while a native plugin/module/platform-channel stays linked. The primary guarantee is that the debug dependency/target is absent from the release classpath / target membership / build flavor of *every variant that reaches real users*, verified per variant: iOS `#if DEBUG` plus Debug-only target membership — CocoaPods can scope a pod to Debug configurations (`:configurations => ['Debug']`), but SwiftPM has no build-configuration-scoped *package dependency*, so a debug package must be confined to a debug-only target/scheme and left unlinked by every real-user target rather than gated by a `Package.swift` condition; also confirm no real-user scheme (TestFlight / enterprise / staging) inherits `DEBUG` in `SWIFT_ACTIVE_COMPILATION_CONDITIONS` / `GCC_PREPROCESSOR_DEFINITIONS`, or `#if DEBUG` code compiles straight into it; Android a `debugImplementation` / debug source-set dependency, NOT `implementation` plus a runtime check (a manifest `ContentProvider`/initializer or reflection keep-rule runs it anyway) — and note a `debug` / `qaDebug` buildType shipped to dogfood/internal testing IS a real-user build that includes those deps, so real-user channels must use release-class variants with debug deps excluded; Flutter/RN remove the package from the release flavor at the platform level (a native plugin autolinks/registers into the binary via podspec/Gradle/manifest unless excluded from the release target, even when the Dart/JS guard is stripped).
   - **Verify on the exact final signed/packaged upload artifact per channel and variant, and treat a symbol/string grep as a backstop, not proof.** A single `nm -j` / `strings` / dexdump / grep is defeated by R8 / Hermes / LTO renaming (`DevInspector` → `a.b.C`), dynamic loading (`dlopen`, Android dynamic feature, RN/Flutter OTA bundle, remote WebView JS), and non-code surfaces (debug assets, URL schemes, manifest providers/services, plist keys, debug entitlements). *Discover* the inventory from the dependency graph, manifest/plist, entitlements, and route/deep-link/bridge registries — not a remembered list, since an unlisted transitive SDK initializer or debug bridge handler is exactly the gap — then for each assert absence across binary, dex/native libs, assets/resources, manifest/plist, entitlements (`get-task-allow` is debug-only; Local Network / ATS / cleartext exceptions are security-sensitive plist/capability config that need production justification, not necessarily debug), and the OTA/dynamic-load channels reachable by that release (a passing artifact digest does NOT bind a debug bundle pushed later via CodePush/Expo/remote WebView JS, so real-user OTA/remote channels must not serve debug payloads). Run it on the post-signing artifact you actually upload (record its digest), across every shipped platform / scheme / flavor / extension, never on an intermediate `assembleRelease`. (`__DEV__` / `kDebugMode` elimination is also minifier-dependent and has silently regressed historically, so the source guard alone is never proof.)
-  - **Make it a release-blocking evidence row, not MR prose** (otherwise the gate is decorative — a team ships from local Xcode/Fastlane, self-marks "checked", or never adds the CI job). The row is machine-generated, tied to the uploaded artifact digest + variant, and verified by someone other than the author; it records the digest, distribution channel, variant matrix, and check-command output, and the release/upload lane fails closed on a missing row. **Risk acceptance cannot waive structural exclusion** of debug-only instrumentation in any real-user / real-auth / real-PII build: an exception may only reclassify the channel as non-real-user / no-real-data, or apply to a production-intended diagnostic that ships its own auth + redaction controls (at which point it is no longer debug-only instrumentation) — otherwise the release stays blocked, an unbounded "accepted" is not a valid disposition. Guidance cannot force a given repo's pipeline to fail closed — that mechanical enforcement is the release-pipeline owner's job (route to `platform-release-engineering`); absent the row the status is not release-ready, the same way missing device smoke leaves a slice `pre-runtime-test ready`. A manual removal/teardown flow is a convenience path for a one-off exit, never the mechanism that keeps debug code out of real-user builds.
+  - **Make it a release-blocking evidence row, not MR prose** (otherwise the gate is decorative — a team ships from local Xcode/Fastlane, self-marks "checked", or never adds the CI job). The row is machine-generated, tied to the uploaded artifact digest + variant, and verified by someone other than the author; it records the digest, distribution channel, variant matrix, and check-command output, and the release/upload lane fails closed on a missing row. **Risk acceptance cannot waive structural exclusion** of debug-only instrumentation in any real-user / real-auth / real-PII build: an exception may only reclassify the channel as non-real-user / no-real-data, or apply to a production-intended diagnostic that ships its own auth + redaction controls (at which point it is no longer debug-only instrumentation) — otherwise the release stays blocked, an unbounded "accepted" is not a valid disposition. Guidance cannot force a given repo's pipeline to fail closed — that mechanical enforcement is the release-pipeline owner's job (route to `platform-release-engineering`); absent the row the status is not release-ready, the same way missing device smoke leaves a slice `pre-runtime-test-ready`. A manual removal/teardown flow is a convenience path for a one-off exit, never the mechanism that keeps debug code out of real-user builds.