@ccoalm/ccl-skills 0.6.2 → 0.8.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/SKILL.md

@@ -66,28 +66,27 @@ credentials only; broad semantic confidentiality stays operator-owned per the
 Diff Confidentiality section. Consult stays on `claude_review.sh`. Load the
 staged-contract and client-routing references below for details.
 
-Current contract: the plan is optional for review/challenge (a derived default
-is stamped `review_plan_source=derived-default`) but required for `complete`
-mode, and gate output is schema 3. Agent automation gets the
-initial review plus at most four challenges, all in one retained task-level chain.
-Any initial review with positive challenge capacity must create that chain at
-Agent index 1; an untracked initial review is single-round with budget 0.
-The budget is a ceiling: after a clean tracked challenge, `complete` may close
-the chain early, preserve unused-round count, and disable further Agent review.
-Every result exposes controller-owned `self_review_gate`; an outstanding checkpoint
-blocks only another external review and/or a completion claim, never productive
-implementation or tests. A passed final external round remains gated until local
-`--mode complete` binds the exact result and current deep-self-review plan. Human
-review/stop/waiver/commit/merge authority is external and cannot be asserted by a
-repository file, CLI flag, environment variable, or model output. Load the staged
-contract before invoking the gate. Terminal wrapper/controller failures emit
-`stop_reviewer_lane`; they never instruct the host to stop the whole task.
+Current contract: review/challenge may use a stamped
+`review_plan_source=derived-default`; `complete` requires a plan and output uses
+schema 3. Automation retains one chain: one review plus at most four challenges.
+Positive challenge capacity opens it at Agent index 1; budget zero is untracked.
+The sole release/high-risk budget-zero exception is a controller-proved
+`markdown-punctuation-only` review: it requires `wording_only_boundary`, permits
+no `complete`, and rejects an author assertion alone (recipe:
+`references/staged-review-contract.md`). After a clean tracked
+challenge, `complete` may close early and preserve unused rounds. Every result
+exposes controller-owned `self_review_gate`; an outstanding checkpoint blocks
+only external review or completion, not implementation or tests. Even a passed
+final external round needs local `--mode complete` binding the exact result and
+current deep-self-review plan. Human review/stop/waiver/commit/merge authority
+cannot come from repository content, flags, environment, or model output.
+Terminal failures emit `stop_reviewer_lane`; they never stop the whole task.
 
 The shared skill never pins a provider or model. Kimi inherits the user's local default model and is uniformly classified as the Moonshot family; Codex likewise inherits its local default model and is uniformly classified as the OpenAI family. Neither client reads or configures provider/model subdivisions. OpenCode invokes `ccl-review` without `--model`: if the user configured `agent.ccl-review.model`, that one model is used; otherwise OpenCode resolves its normal default. The exported OpenCode session must attribute the actual provider/model, and an unmapped or same-family result is rejected before another client is considered. There is no built-in Kimi/DeepSeek provider chain and no one-shot model override to type.
 
 Client discovery is separate from model ownership. For Kimi, the wrapper accepts an absolute executable `KIMI_BIN`; otherwise it checks `PATH`, then `$KIMI_CODE_HOME/bin/kimi` when configured, then the standard `~/.kimi-code/bin/kimi` location. The resolved executable must be absolute and executable before the wrapper changes directory. This avoids treating a non-interactive shell's narrower `PATH` as proof that Kimi is not installed, honors a custom Kimi home, and avoids relative-PATH drift in the temporary workspace; it does not change the user's model/provider settings. An executable PATH selection keeps normal shell precedence; use `KIMI_BIN` to bypass a broken executable shim explicitly.
 
-The Claude provider wrapper implements help inspection, built-in tool availability restriction, safe-mode customization isolation, strict empty MCP configuration, empty user/project/local setting sources, CLAUDE.md and auto-memory disabling, repository directory scoping with `--add-dir`, consult dirty-worktree fail-closed checks, prompt-only consult for pasted evidence, temp prompt file permissions and cleanup, Python subprocess capture without putting diff content on argv, structured JSON parsing, schema validation, timeout handling, auth false-negative classification, and the two-invocation cap. Runs without selected owner skills disable skills/commands. Owner-aware runs load the already-installed CCL skill plugin through `--plugin-dir` and explicitly invoke each selected skill; they do not manufacture a selected-only plugin or claim that unselected installed skills are unavailable. Claude's own built-in identifiers and all skills present in the controller-supplied registry may remain visible in stream init; only selected owners are frozen-hash verified and counted as explicit invocation. The parser rejects entries outside that registered surface or duplicate identifiers and keeps tools/MCP isolated. For review/challenge it also accepts the orchestrator's frozen `--diff-file` and emits stable `reason_code`, `fallback_eligible`, and `next_action` fields on every inconclusive path. Every mode captures Claude with structured stream JSON and adds `--json-schema` when the CLI advertises it; `parse_review_json.py` unwraps the result event's structured payload and rejects any envelope whose `is_error`, `subtype`, `api_error_status`, or `permission_denials` fields signal a non-clean run. `classify_envelope.py` reads those same structured fields to classify auth/quota/permission/error failures, so raw-text matching on the CLI's prose is only a fallback for the case where no JSON envelope was produced. On an auth false negative the wrapper returns `auth_path_unavailable`; a host rerun of the same gate adds `--host-remediation-attempted`. `--timeout` controls each formal invocation and must be an integer of at least 5 seconds; values above 600 are clamped to 600. The wrapper does not make a separate behavior-probe request. The formal invocation's own stream-init must declare exactly the expected tool set: packet-only modes allow only Claude's internal `StructuredOutput` tool when schema output is enabled, while repository consult additionally allows `Read,Grep,Glob`. Unexpected tool use, MCP inheritance, or schema drift fails closed. `--allowedTools` is a permission auto-approval rule, not an availability restriction, and is never used as the sandbox. The wrapper deliberately never runs `claude auth status` through command substitution, because that path can itself report a false logged-out state on this machine.
+The Claude provider wrapper implements help inspection, built-in tool availability restriction, safe-mode customization isolation, strict empty MCP configuration, empty user/project/local setting sources, CLAUDE.md and auto-memory disabling, repository directory scoping with `--add-dir`, consult dirty-worktree fail-closed checks, prompt-only consult for pasted evidence, temp prompt file permissions and cleanup, Python subprocess capture without putting diff content on argv, structured JSON parsing, schema validation, timeout handling, auth false-negative classification, and the two-invocation cap. Runs without selected owner skills disable skills/commands. Owner-aware runs load the already-installed CCL skill plugin through `--plugin-dir` and explicitly invoke each selected skill; they do not manufacture a selected-only plugin or claim that unselected installed skills are unavailable. Claude's own built-in identifiers and all skills present in the controller-supplied registry may remain visible in stream init; only selected owners are frozen-hash verified and counted as explicit invocation. The parser rejects entries outside that registered surface or duplicate identifiers and keeps tools/MCP isolated. For review/challenge it also accepts the orchestrator's frozen `--diff-file` and emits stable `reason_code`, `fallback_eligible`, and `next_action` fields on every inconclusive path. Every mode captures Claude with structured stream JSON and adds `--json-schema` when the CLI advertises it; `parse_review_json.py` unwraps the result event's structured payload and rejects any envelope whose `is_error`, `subtype`, `api_error_status`, or `permission_denials` fields signal a non-clean run. `classify_envelope.py` reads those same structured fields to classify auth/quota/permission/error failures, so raw-text matching on the CLI's prose is only a fallback for the case where no JSON envelope was produced. On an auth false negative the wrapper returns `auth_path_unavailable`; a host rerun of the same gate adds `--host-remediation-attempted`. `--timeout` controls each formal invocation and must be an integer of at least 5 seconds; values above 1200 are clamped to 1200. The wrapper does not make a separate behavior-probe request. The formal invocation's own stream-init must declare exactly the expected tool set: packet-only modes allow only Claude's internal `StructuredOutput` tool when schema output is enabled, while repository consult additionally allows `Read,Grep,Glob`. Unexpected tool use, MCP inheritance, or schema drift fails closed. `--allowedTools` is a permission auto-approval rule, not an availability restriction, and is never used as the sandbox. The wrapper deliberately never runs `claude auth status` through command substitution, because that path can itself report a false logged-out state on this machine.
 
 Owner-aware Claude init must declare the `ccl-skills` plugin. Current public
 init output does not enumerate selected plugin skills or commands, so the wrapper

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/client-routing.md

@@ -345,7 +345,7 @@ line echoes the packet-specific receipt and the remaining text matches the
 review contract. Pre-inference setup and the capability probe are charged
 against the controller-granted lane budget, and the probe itself is capped at
 60 seconds. MCP review receives
-the remaining budget up to the wrapper's existing 600-second ceiling; inline
+the remaining budget up to the wrapper's 1200-second ceiling; inline
 review is additionally capped at 120 seconds because its bounded prompt remains
 visible in process argv. Both
 use a one-second forced-kill grace; a deadline timeout may cascade, while an

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/staged-review-contract.md

@@ -7,7 +7,8 @@ The controller has three modes:
 - `complete`: a local deep-self-review checkpoint that calls no reviewer.
 
 Explore/build may configure `challenge_budget=0..4`; release/high-risk requires
-at least one challenge. The initial review consumes Agent round 1, so total
+at least one challenge unless the exact candidate qualifies for the
+proof-bound wording-only single-review exception below. The initial review consumes Agent round 1, so total
 Agent-autonomous external review is at most five rounds. Human-requested review
 is outside this budget and must be attributed by the consuming trusted platform.
 The budget is a ceiling, not a quota: after a clean tracked challenge, local
@@ -29,6 +30,48 @@ safety; build adds failure paths, tests, and compatibility; release adds rollout
 and operations. High-risk input raises depth to release and adds
 `high_risk_boundary`.
 
+The serialized plan is at most 32,000 bytes and `intent` is 8..4,000
+characters. Those are validation limits, not permission for a caller to slice a
+longer value into shape: the gate can validate only the final value it receives
+and cannot detect that a caller discarded the newest scope transition first.
+Call `scripts/update_review_plan_intent.py` to mutate an existing plan. It checks
+an optional expected SHA-256, opens bounded inputs without following links,
+writes atomically, preserves ordinary POSIX permission bits, rejects duplicate
+JSON object keys before mutation, and leaves the plan byte-identical on
+validation or overflow failure. When the plan producer first
+chooses the stable core, it persists one reserved evidence row with
+`id=review-plan-intent-stable-core-v1` and result
+`chars=<character-count>;sha256=<UTF-8-SHA-256>`. On overflow, pass that exact
+core and the latest transition as separate files: the helper requires both the
+character count and digest to match the persisted identity, requires latest to
+be absent from the current intent, and joins them with one fixed blank line.
+Before replacing the visible intent, it archives the exact removed suffix in a
+reserved, ordered base64 evidence group. That group's manifest binds the prior
+intent character count and SHA-256, core length, suffix byte count and SHA-256,
+encoding, and part count; if the plan or evidence-row cap cannot hold the group,
+compaction fails without changing the file. These rows preserve bytes but do not
+classify their meaning. A matching arbitrary prefix is therefore insufficient. Existing plans without
+the reserved row remain appendable but cannot compact until their producer has
+explicitly established the identity; the helper returns
+`intent_core_identity_missing` instead of guessing. The identity proves the
+recorded text boundary, not semantic correctness or protection from a caller
+that rewrites the whole plan outside the helper. Keep semantic dispositions in
+ordinary evidence rows and ordered prior-review results; the byte archive is a
+loss-prevention carrier, not a substitute. Never use prefix/tail truncation as
+compaction. One final line ending is treated as a file delimiter; other outer
+whitespace is rejected.
+
+The expected digest is a stale-at-open guard, not a lock: callers serialize
+writers and provide a trusted, stable parent directory for the read-check-replace
+interval. Plans are caller-owned, singly linked regular files; ACLs, extended
+attributes, ownership, and special mode bits are outside this replacement
+contract. A post-rename directory-sync failure reports
+`plan_committed_durability_unknown` with the new digest: re-read before deciding
+whether to retry, because the target has already changed. A stdout pipe that
+closes before the success receipt is delivered likewise reports
+`plan_committed_receipt_lost` on stderr with a nonzero exit: the update is
+committed, only the receipt was lost, so re-read the plan instead of retrying.
+
 Each self-review row may name a direct sibling skill. Omission selects the
 `code-review` baseline. The controller also derives owners deterministically
 from changed `skills/<name>/` paths, test paths, and supported source extensions.
@@ -97,6 +140,145 @@ or MCP servers make the plugin ineligible for this bounded review lane.
 Wrappers keep an explicit selected-owner count instead of testing empty Bash
 arrays under `set -u`, preserving the no-owner lane on Bash 3.2.
 
+## Base-derived packet input boundary
+
+`--base` freezes the tracked diff plus every non-ignored untracked path in
+scope. Exact-candidate binding means the controller never skips an untracked
+path or replaces its contents with a placeholder. An untracked path containing
+a Unicode control or line-separator character, symlink, hardlink, other
+non-regular file, NUL-bearing file, non-UTF-8 file, or file over 200,000 bytes
+makes the whole lane fail before provider execution with
+`reason_code=invalid_input`. The same result applies when rendered untracked
+content or the combined tracked-plus-untracked packet exceeds 200,000 bytes.
+
+Move an out-of-scope path outside the candidate or add a correct ignore rule;
+commit an in-scope path when Git should represent it; or compose complete
+`--diff-file` partitions when the candidate must be split. Never omit a path
+and report the remaining packet as the whole candidate.
+
+## Proof-bound wording-only single review
+
+The wording-only exception is one untracked `review` with
+`challenge_budget=0`; it is not a chain, challenge, or `complete` checkpoint.
+Supply `--wording-only-proof-file` to bind the exception to the exact packet.
+Without that proof, an explore/build budget-zero review remains an ordinary
+single review and cannot be recorded as the wording-only exception;
+release/high-risk budget zero fails before inference.
+
+At release depth, including depth raised by a high-risk tag, only a
+controller-proved `markdown-punctuation-only` check may use this exception.
+`markdown-token-replacement` remains available for explore/build budget-zero
+review, but it cannot waive the release/high-risk challenge: byte-exact token
+replacement does not prove that the old and new tokens have the same meaning.
+
+The proof is a single-link regular UTF-8 JSON file of at most 16,000 bytes:
+
+```json
+{"schema_version":1,"candidate_sha256":"<packet-sha256>","check":{"kind":"markdown-punctuation-only"}}
+```
+
+The other fixed check is
+`markdown-token-replacement`, whose `check` also contains `old_token`,
+`new_token`, and integer `expected_count` (1..100). The controller never trusts
+a caller-supplied pass result. It reparses the frozen packet and derives the
+status, files, changed-line count, replacement count, and scope SHA-256.
+
+The accepted packet is deliberately narrow: a canonical full-context unified
+Git diff, LF-terminated, at most 200,000 bytes, changing existing regular
+Markdown files inside exactly one existing non-linked skill package. Every
+file's first hunk starts at line 1 so frontmatter is inspectable. Adds,
+deletes, renames, multi-skill changes, frontmatter or `description` edits,
+non-regular Git modes, custom/compact packets, extra context outside the diff,
+and files without a final newline fail closed. `markdown-punctuation-only`
+accepts only one-for-one plain-prose line replacements whose non-punctuation
+characters remain identical; numeric tokens must additionally survive
+byte-for-byte (deleting the dot in `5.5` is a threshold change, not
+punctuation), and a question mark may not be added or removed (a statement
+turned into a question is a meaning change). Lines must start at column zero
+and contain prose; line adds/deletes, Markdown headings, lists, block quotes,
+links, tables, inline code, fenced or indented code, and raw HTML `pre`/`code`
+containers fail closed. `markdown-token-replacement` requires every changed
+line pair to differ only by the named whole-token replacement, with the exact
+total count, and rejects packets whose changed lines touch a Markdown or HTML
+code container.
+
+This recipe produces the exact packet and proof without a second parser or a
+pretend verifier command. Set `WORDING_KIND=markdown-punctuation-only`, or set
+`WORDING_KIND=markdown-token-replacement` plus `WORDING_OLD`, `WORDING_NEW`, and
+`WORDING_COUNT`:
+
+```bash
+: "${CODE_REVIEW_SKILL_DIR:?set the installed code-review skill directory}"
+: "${REPO_ROOT:?set the absolute repository root}"
+: "${REVIEW_BASE:?set the exact base ref}"
+: "${SKILL_NAME:?set the one existing skill package name}"
+: "${REVIEW_STAGE:?set explore, build, or release}"
+: "${IMPLEMENTER_FAMILY:?set the implementer model family}"
+: "${REVIEW_PLAN_FILE:?set the absolute review-plan JSON path}"
+: "${REVIEW_EVIDENCE_DIR:?set an existing durable private evidence directory}"
+: "${WORDING_KIND:?set one supported wording-only check kind}"
+
+umask 077
+WORDING_RUN_DIR="$(mktemp -d "$REVIEW_EVIDENCE_DIR/wording-review.XXXXXX")" || exit 1
+WORDING_DIFF="$WORDING_RUN_DIR/candidate.diff"
+WORDING_PROOF="$WORDING_RUN_DIR/proof.json"
+WORDING_RESULT="$WORDING_RUN_DIR/review.json"
+
+git -C "$REPO_ROOT" diff --no-color --no-ext-diff --no-textconv --full-index \
+  --src-prefix=a/ --dst-prefix=b/ --unified=1000000 \
+  "$REVIEW_BASE" -- "skills/$SKILL_NAME" >"$WORDING_DIFF" || exit 1
+
+python3 - "$WORDING_DIFF" "$WORDING_PROOF" "$WORDING_KIND" \
+  "${WORDING_OLD:-}" "${WORDING_NEW:-}" "${WORDING_COUNT:-0}" <<'PY'
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+diff_path, proof_path = map(Path, sys.argv[1:3])
+kind, old, new, count = sys.argv[3:]
+check = {"kind": kind}
+if kind == "markdown-token-replacement":
+    check.update(old_token=old, new_token=new, expected_count=int(count))
+elif kind != "markdown-punctuation-only":
+    raise SystemExit("unsupported WORDING_KIND")
+payload = {
+    "schema_version": 1,
+    "candidate_sha256": hashlib.sha256(diff_path.read_bytes()).hexdigest(),
+    "check": check,
+}
+proof_path.write_text(
+    json.dumps(payload, ensure_ascii=False, separators=(",", ":")) + "\n",
+    encoding="utf-8",
+)
+PY
+
+WORDING_RISK_ARGS=()
+for tag in ${REVIEW_RISK_TAGS:-}; do WORDING_RISK_ARGS+=(--risk-tag "$tag"); done
+if ! bash "$CODE_REVIEW_SKILL_DIR/scripts/review_gate.sh" \
+  --mode review --stage "$REVIEW_STAGE" --challenge-budget 0 \
+  --cwd "$REPO_ROOT" --diff-file "$WORDING_DIFF" \
+  --review-plan-file "$REVIEW_PLAN_FILE" \
+  --wording-only-proof-file "$WORDING_PROOF" \
+  ${WORDING_RISK_ARGS[@]+"${WORDING_RISK_ARGS[@]}"} \
+  --implementer-family "$IMPLEMENTER_FAMILY" >"$WORDING_RESULT"; then
+  cat "$WORDING_RESULT" >&2
+  exit 1
+fi
+cat "$WORDING_RESULT"
+```
+
+A valid result carries `wording_only_proof_sha256`, controller-derived
+`wording_only_scope.status=passed`, and a reviewed
+`wording_only_boundary` concern. That concern independently confirms the edit
+changes no trigger, scope, routing, validation, acceptance, rule, threshold,
+boundary, frontmatter, description, or other meaning. If it is missing,
+inconclusive, or reports a possible semantic change, the wording-only exception
+does not apply: use the normal challenge and behavioral-evidence path. Any
+candidate edit regenerates the packet and proof and requires a new review.
+Keep the diff, proof, and result together; a digest whose source artifact was
+deleted is not independently auditable evidence.
+
 ## Agent review chain
 
 Multi-round Agent automation supplies `review_chain_id`, a contiguous
@@ -110,11 +292,13 @@ index 1; an untracked initial review is single-round and therefore uses budget 0
 The chain binds task scope, candidate identity per round, result hashes, mode,
 status, challenge focus, controller, and selected owners. The opaque
 `review_scope_sha256` always hashes normalized intent, acceptance, stage/depth,
-risk tags, and challenge budget; chain identity is validated separately. Every
-result also carries the canonical `review_scope` object that digest is taken
-over — intent and acceptance appear only as `intent_sha256` /
-`acceptance_sha256`, never as raw plan text, because results are logged and
-archived independently of the plan. A prior result is accepted only when its
+risk tags, challenge budget, and the wording-only proof/scope digests (both
+`null` outside that exception); chain identity is validated separately. This
+prevents deleting or nulling the top-level wording-only fields from reclassifying
+that receipt as a normal completion input. Every result also carries the
+canonical `review_scope` object that digest is taken over — intent and
+acceptance appear only as `intent_sha256` / `acceptance_sha256`, never as raw
+plan text, because results are logged and archived independently of the plan. A prior result is accepted only when its
 recorded `review_scope` reproduces its own `review_scope_sha256` and that digest
 matches the current scope, so copying a digest onto a differently-scoped result
 no longer passes. This binding proves internal consistency, not authority: prior
@@ -180,7 +364,11 @@ Budget exhaustion likewise stops only automatic reviewer calls. Continue local
 fixes, self-review, tests, and independent work; park only decision-dependent
 work. Enter `awaiting_human` only when no independent runnable work remains.
 
-The current result envelope is schema 3. The controller bounds cumulative reviewer-lane execution with `--total-timeout`
+The current result envelope is schema 3. The generic per-invocation `--timeout`
+keeps its 600-second default and accepts 5..1200 seconds; direct wrappers clamp
+higher decimal values, including values beyond shell integer range, to 1200.
+Wrapper-internal sub-mode limits such as Kimi inline mode's 120-second cap stay
+separate. The controller bounds cumulative reviewer-lane execution with `--total-timeout`
 (default 2400 seconds, accepted range 5..3600). Setup time reduces the budget,
 and git preflight subprocesses share its deadline; direct filesystem reads
 remain subject to the host's outer timeout. Each client receives the smaller of the requested per-invocation

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/references/timeout-auth-and-capabilities.md

@@ -38,13 +38,13 @@ cannot observe or authenticate it. Hosts that need mechanical enforcement must
 provide their own trusted execution adapter; this repository preserves the
 contract and evidence shape without claiming that enforcement.
 
-The wrapper default timeout is 600 seconds per formal invocation, matching the
-accepted maximum. Measured single-lane costs on this repository's own review
+The wrapper default timeout remains 600 seconds per formal invocation; the
+generic accepted maximum is 1200 seconds. Measured single-lane costs on this repository's own review
 diffs were roughly 89, 247, and 419 seconds, so a smaller default silently
 converts a working reviewer into an inconclusive timeout; because a timeout is
 cascade-eligible, spending wall-clock is recoverable while a premature timeout
 quietly loses that lane's verdict. Lower it explicitly with `--timeout` when a
-fast bound matters more than lane coverage. It makes no separate model behavior-probe request. Challenge makes one invocation; review and consult may make up to two only through their existing bounded result-recovery paths. The wrapper rejects timeout values below 5 seconds and clamps values above 600 seconds to 600 seconds. The bound is per invocation, not per wrapper run: an outer timeout must cover `timeout` for challenge and up to `2 * timeout` for review or consult, and must never kill the wrapper and then treat the killed output as success. With defaults, allow about ten minutes for challenge and up to twenty minutes for review or consult. If the command is still running but silent, poll the same execution handle again.
+fast bound matters more than lane coverage. It makes no separate model behavior-probe request. Challenge makes one invocation; review and consult may make up to two only through their existing bounded result-recovery paths. The wrapper rejects timeout values below 5 seconds and normalizes every larger decimal, including values beyond shell integer range, to at most 1200 seconds. Wrapper-internal sub-mode limits remain separate; Kimi inline review still caps argv-exposed work at 120 seconds. The bound is per invocation, not per wrapper run: an outer timeout must cover `timeout` for challenge and up to `2 * timeout` for review or consult, and must never kill the wrapper and then treat the killed output as success. With defaults, allow about ten minutes for challenge and up to twenty minutes for review or consult. If the command is still running but silent, poll the same execution handle again.
 
 The controller separately enforces a cumulative reviewer-lane budget.
 `--total-timeout` defaults to 2400 seconds and accepts 5 to 3600. Its clock

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/claude_review.sh

@@ -230,13 +230,22 @@ PY_DIFF
   diff_stat="Frozen review packet: $(printf '%s' "$diff_body" | wc -c | tr -d '[:space:]') bytes"
 fi
 
-if ! [[ "$timeout_s" =~ ^[1-9][0-9]*$ ]] || [ "$timeout_s" -lt 5 ]; then
+script_dir="$(cd "$(dirname "$0")" && pwd -P)"
+[ -f "$script_dir/normalize_review_timeout.sh" ] \
+  && [ -r "$script_dir/normalize_review_timeout.sh" ] \
+  && [ ! -L "$script_dir/normalize_review_timeout.sh" ] || {
+    emit_inconclusive_payload "Claude review helper missing: normalize_review_timeout.sh" local_tool_failure false stop_reviewer_lane
+    exit 2
+  }
+# shellcheck source=normalize_review_timeout.sh
+. "$script_dir/normalize_review_timeout.sh"
+requested_timeout_s="$timeout_s"
+if ! timeout_s="$(normalize_review_timeout "$timeout_s")"; then
   emit_inconclusive_payload "--timeout must be an integer of at least 5 seconds" invalid_input false stop_reviewer_lane
   exit 2
 fi
-if [ "$timeout_s" -gt 600 ]; then
-  printf 'claude_review.sh: clamping --timeout %s to 600 seconds\n' "$timeout_s" >&2
-  timeout_s=600
+if [ "$timeout_s" != "$requested_timeout_s" ]; then
+  printf 'claude_review.sh: clamping --timeout %s to 1200 seconds\n' "$requested_timeout_s" >&2
 fi
 wrapper_started=$SECONDS
 if [ "$mode" = "consult" ] && [ -z "${extra//[[:space:]]/}" ]; then
@@ -266,7 +275,6 @@ if [ -z "$repo_root" ]; then
   exit 2
 fi
 
-script_dir="$(cd "$(dirname "$0")" && pwd -P)"
 harness_root="$(cd "$script_dir/.." && pwd -P)"
 repo_root_real="$(cd "$repo_root" && pwd -P)"
 harness_root_real="$harness_root"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/codex_review.sh

@@ -52,15 +52,21 @@ while [ "$#" -gt 0 ]; do
 done
 
 case "$MODE" in review|challenge) ;; *) die_inconclusive bad_mode ;; esac
-[[ "$TIMEOUT" =~ ^[1-9][0-9]*$ ]] && [ "$TIMEOUT" -ge 5 ] || die_inconclusive invalid_timeout invalid_input false
-[ "$TIMEOUT" -le 600 ] || TIMEOUT=600
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+[ -f "$SCRIPT_DIR/normalize_review_timeout.sh" ] \
+  && [ -r "$SCRIPT_DIR/normalize_review_timeout.sh" ] \
+  && [ ! -L "$SCRIPT_DIR/normalize_review_timeout.sh" ] \
+  || die_inconclusive timeout_normalizer_missing local_tool_failure false
+# shellcheck source=normalize_review_timeout.sh
+. "$SCRIPT_DIR/normalize_review_timeout.sh"
+TIMEOUT="$(normalize_review_timeout "$TIMEOUT")" \
+  || die_inconclusive invalid_timeout invalid_input false
 [ -n "$IMPL_FAMILY" ] || die_inconclusive implementer_family_required
 [ -f "$DIFF_FILE" ] && [ -r "$DIFF_FILE" ] && [ ! -L "$DIFF_FILE" ] || die_inconclusive invalid_diff_file
 if [ -n "$REVIEW_PROFILE_FILE" ]; then
   [ -f "$REVIEW_PROFILE_FILE" ] && [ -r "$REVIEW_PROFILE_FILE" ] && [ ! -L "$REVIEW_PROFILE_FILE" ] \
     || die_inconclusive invalid_review_profile_file
 fi
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 PARSER="$SCRIPT_DIR/parse_cli_review.py"
 TIMEOUT_CLASSIFIER="$SCRIPT_DIR/classify_timeout_exit.sh"
 SKILL_VERIFIER="$SCRIPT_DIR/verify_native_skill_binding.py"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/kimi_review.sh

@@ -60,10 +60,17 @@ while [ "$#" -gt 0 ]; do
 done
 
 case "$MODE" in review|challenge) ;; *) die_inconclusive bad_mode ;; esac
-[[ "$TIMEOUT" =~ ^[1-9][0-9]*$ ]] && [ "$TIMEOUT" -ge 5 ] || die_inconclusive invalid_timeout invalid_input false
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+[ -f "$SCRIPT_DIR/normalize_review_timeout.sh" ] \
+  && [ -r "$SCRIPT_DIR/normalize_review_timeout.sh" ] \
+  && [ ! -L "$SCRIPT_DIR/normalize_review_timeout.sh" ] \
+  || die_inconclusive timeout_normalizer_missing local_tool_failure false
+# shellcheck source=normalize_review_timeout.sh
+. "$SCRIPT_DIR/normalize_review_timeout.sh"
 # Keep every invocation, including inline argv exposure, inside the controller's
 # documented direct-client ceiling.
-[ "$TIMEOUT" -le 600 ] || TIMEOUT=600
+TIMEOUT="$(normalize_review_timeout "$TIMEOUT")" \
+  || die_inconclusive invalid_timeout invalid_input false
 lane_budget_started=$SECONDS
 [ "$REVIEW_SKILL_COUNT" -eq 0 ] || for review_skill in "${REVIEW_SKILLS[@]}"; do
   # The controller and binding verifier use the same package-name grammar.
@@ -86,7 +93,6 @@ if [ -n "$REVIEW_PROFILE_FILE" ]; then
     || die_inconclusive invalid_review_profile_file
 fi
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 PARSER="$SCRIPT_DIR/parse_cli_review.py"
 PACKET_MCP_SERVER="$SCRIPT_DIR/kimi_packet_mcp.py"
 TIMEOUT_CLASSIFIER="$SCRIPT_DIR/classify_timeout_exit.sh"

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/normalize_review_timeout.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Print the normalized per-invocation timeout. The input is compared by digit
+# count before any arithmetic so an arbitrarily long decimal cannot overflow
+# Bash's integer parser.
+normalize_review_timeout() {
+  local value="${1:-}" digits
+
+  case "$value" in
+    ""|0*|*[!0-9]*) return 2 ;;
+    1|2|3|4) return 2 ;;
+  esac
+
+  digits=${#value}
+  if [ "$digits" -gt 4 ] || {
+    [ "$digits" -eq 4 ] && [ "$value" -gt 1200 ]
+  }; then
+    printf '%s\n' 1200
+  else
+    printf '%s\n' "$value"
+  fi
+}

package/dist/assets/marketplace/plugins/ccl-skills/skills/code-review/scripts/opencode_review.sh

@@ -168,8 +168,15 @@ command -v jq >/dev/null 2>&1 || die_inconclusive "jq_not_installed" local_tool_
 command -v timeout >/dev/null 2>&1 || die_inconclusive "timeout_not_installed" local_tool_failure false
 [ -n "$IMPL_FAMILY" ] || die_inconclusive "implementer_family_required"
 case "$MODE" in review|challenge) ;; *) die_inconclusive "bad_mode";; esac
-[[ "$TIMEOUT" =~ ^[1-9][0-9]*$ ]] && [ "$TIMEOUT" -ge 5 ] || die_inconclusive "invalid_timeout" invalid_input false
-if [ "$TIMEOUT" -gt 600 ]; then TIMEOUT=600; fi
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
+[ -f "$SCRIPT_DIR/normalize_review_timeout.sh" ] \
+  && [ -r "$SCRIPT_DIR/normalize_review_timeout.sh" ] \
+  && [ ! -L "$SCRIPT_DIR/normalize_review_timeout.sh" ] \
+  || die_inconclusive "timeout_normalizer_missing" local_tool_failure false
+# shellcheck source=normalize_review_timeout.sh
+. "$SCRIPT_DIR/normalize_review_timeout.sh"
+TIMEOUT="$(normalize_review_timeout "$TIMEOUT")" \
+  || die_inconclusive "invalid_timeout" invalid_input false
 if [ "$REVIEW_SKILL_COUNT" -gt 0 ]; then
   for review_skill in "${REVIEW_SKILLS[@]}"; do
     # The controller and skill-package verifier already require this exact name
@@ -213,7 +220,6 @@ if [ -n "$DIFF_FILE" ]; then
   [ "$diff_link_count" -le 1 ] || die_inconclusive "diff_file_hardlink_rejected" invalid_input false
 fi
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 PARSER="$SCRIPT_DIR/parse_opencode_review.py"
 SKILL_VERIFIER="$SCRIPT_DIR/verify_native_skill_binding.py"
 [ -f "$PARSER" ] || die_inconclusive "parser_missing"