appstore-precheck 1.12.0 → 1.12.1

package/CHANGELOG.md

@@ -5,6 +5,61 @@ All notable changes to this project are documented here. Versioning follows
 
 ## [Unreleased]
 
+## [1.12.1] - 2026-07-08
+
+Quality patch from a full fresh-eyes review (three independent review passes over the
+scanner core, the tooling shell, and the docs). No new checks; every change either removes
+a false-RED path, fixes a real bug, or hardens the release surface.
+
+### Fixed (scanner accuracy — false-RED cluster)
+- **3.1.2 Restore Purchases** no longer misses StoreKit 2 paywalls: the match is
+  case-insensitive and recognizes `AppStore.sync()` (a capitalized `Button("Restore
+  Purchases")` used to force a false RED).
+- **3.1.2 Terms/Privacy links** match human-readable labels ("Terms of Use", "Privacy
+  Policy") and nonstandard URL paths (`/legal/tos`, `/eula`, `datenschutz`, `gizlilik`),
+  case-insensitively.
+- **Remote-configured paywalls** (RevenueCatUI `PaywallView`, `presentPaywall`,
+  `paywallFooter`, AdaptyUI): missing Restore/Terms/Privacy in app source now downgrades
+  to a verify-in-dashboard WARN instead of a hard FAIL — the SDK renders those controls
+  from the vendor dashboard.
+- **5.1.1 FileTimestamp Required Reason** check is anchored to real filesystem APIs;
+  plain `creationDate` / `modificationDate` model properties no longer false-FAIL.
+
+### Fixed (coverage and correctness)
+- **Objective-C blind spot closed**: all code-level greps now share one include-set
+  (`*.swift`, `*.m`, `*.mm`, `*.h`). Camera/mic/photo purpose-string FAILs, ATT/tracking
+  signals, SIWA, analytics and the other code checks now fire on ObjC sources too.
+- **`--dir` is authoritative**: `scan.sh --dir <path>` (new flag) scans exactly that
+  directory instead of snapping to the enclosing git toplevel; the npx CLI passes it
+  through and the GitHub Action uses it, fixing monorepo-subdir scans and SARIF paths
+  (SARIF upload now also sets `checkout_path`).
+- **Rule 42 suppressible**: `.precheck-ignore` accepted only rules 1–41; the bound is now
+  derived from the catalog, so `screenshot-dimensions` (and any future rule) can be
+  suppressed.
+- **Verdict thresholds deduplicated** into `scripts/thresholds.sh`, shared by `verdict.sh`
+  and the JSON renderer so the two can never diverge.
+- **CLI**: a signal-killed scanner now exits 70 instead of masquerading as success.
+
+### Added
+- Fixtures + assertions for every fix above (`storekit2-paywall-app`,
+  `revenuecat-paywall-app`, `objc-camera-app`, monorepo `--dir` case, rule-42 suppression),
+  all labelled in the synthetic scorecard corpus.
+- **`tests/test-pack.sh`**: packs the real npm tarball and runs the CLI from the extracted
+  layout — a `files`-array regression can no longer ship silently.
+
+### Changed (docs and CI hardening)
+- README: CI example pins `@v1` (was stale `@v1.5.0`), "How it works" gains the opt-in
+  Phase 6 row and the screenshot-vision mention, new Troubleshooting section, Windows/exit-code
+  notes; coverage table reflects ObjC support.
+- SKILL.md: Phase 6's Maestro MCP tools added to `allowed-tools`; Phase 2 gains an explicit
+  skip-without-credentials instruction; scanner paths phrased skill-relative; the Phase 4
+  summary separates the "+5 vision checks" from the "of 28" count; upload-guard hook note
+  scoped to plugin installs. `simulator-dynamic-review.md` now names the real Maestro MCP
+  tools (`list_devices`, `run`, `inspect_screen`, `take_screenshot`).
+- Workflows: least-privilege `permissions:` blocks everywhere; all third-party actions
+  pinned to commit SHAs (also in `action.yml`).
+- MAINTENANCE.md: stale "41 vectors" corrected; docs index expanded.
+
 ## [1.12.0] - 2026-07-02
 
 Roadmap #5 (final roadmap item): an **optional, opt-in local dynamic simulator tier** —

package/README.md

@@ -142,13 +142,14 @@ static scan already flagged a guideline, the deep check adds semantic context th
 ### Supported app types
 
 Every check that reads store metadata, the privacy manifest, screenshots, or the export-compliance
-key works on **any iOS app**. The code-level checks read Swift source, so their coverage depends on
+key works on **any iOS app**. The code-level checks read Swift and Objective-C(++) source
+(`.swift`, `.m`, `.mm`, `.h`), so their coverage depends on
 how the app is built:
 
 | App type | Coverage |
 |----------|----------|
 | 🟢 **Native Swift / SwiftUI** | **Full.** All 42 vectors apply. |
-| 🟡 **React Native / Flutter** | Metadata, privacy manifest, screenshots, and export compliance apply in full. The Swift-source checks (ATT, paywall links, private API, SDK detection, navigation) **under-detect rather than misfire**: that logic lives in JS/Dart, so they stay quiet instead of blocking. |
+| 🟡 **React Native / Flutter** | Metadata, privacy manifest, screenshots, and export compliance apply in full. The native-source checks (ATT, paywall links, private API, SDK detection, navigation) **under-detect rather than misfire**: that logic lives in JS/Dart, so they stay quiet instead of blocking. |
 
 ## Quick start
 
@@ -237,6 +238,26 @@ npx appstore-precheck            # scans the current directory, prints the verdi
 npx appstore-precheck --fail-on YELLOW
 ```
 
+**Homebrew** — same CLI, installed on PATH:
+
+```bash
+brew install berkayturk/tap/appstore-precheck
+appstore-precheck --dir path/to/your-ios-app
+```
+
+**fastlane** — gate a lane on the verdict with the
+[`appstore_precheck` plugin](https://github.com/berkayturk/fastlane-plugin-appstore_precheck)
+([RubyGems](https://rubygems.org/gems/fastlane-plugin-appstore_precheck)):
+
+```ruby
+# fastlane add_plugin appstore_precheck
+lane :beta do
+  appstore_precheck              # fails the lane on a RED verdict
+  build_app
+  upload_to_testflight
+end
+```
+
 **Standalone Bash** — same static scan, run by hand or in CI:
 
 ```bash
@@ -255,7 +276,7 @@ Drop the static scan into a workflow with the bundled composite action. It fails
 job on a RED verdict; set `fail-on: YELLOW` to be stricter:
 
 ```yaml
-- uses: berkayturk/appstore-precheck@v1.5.0
+- uses: berkayturk/appstore-precheck@v1
   with:
     working-directory: .   # optional, default: . (repo root)
     fail-on: RED           # optional, default: RED (RED | YELLOW)
@@ -295,8 +316,9 @@ nothing is auto-fixed.
 | **1** | **Static scan**: `scan.sh` over the 42 vectors above. |
 | **2** | **`fastlane precheck`**: Apple's own metadata rule engine. |
 | **3** | **Pierre commentary**: explains **every** FAIL and WARN from Phases 0–2 in 2–3 sentences each. |
-| **4** | **Pierre deep review**: 28 semantic checks (22 Tier A + 6 Tier B v1 heuristic). Advisory only. |
+| **4** | **Pierre deep review**: 28 semantic checks (22 Tier A + 6 Tier B v1 heuristic), plus 5 screenshot-vision checks when screenshots are present. Advisory only. |
 | **5** | **Verdict**: GREEN / YELLOW / RED from Phases 0–2 counts, plus `.precheck-pass` token the upload guard gates on. |
+| **6** | *(opt-in, agent mode)* **Local dynamic simulator tier**: launch/paywall/permission smoke checks on a local simulator via Maestro + `xcrun simctl`. Advisory; never changes the verdict. |
 
 ## Demo
 
@@ -350,6 +372,19 @@ and [Phase 2 `fastlane precheck`](examples/fastlane-precheck.md) results.
 | 🟡 **YELLOW** | 0 FAIL, 5+ WARN | not written | blocked; needs confirmation |
 | 🔴 **RED** | ≥1 FAIL | removed | blocked; shows the FAIL list |
 
+### Badge — Prechecked by Pierre
+
+Shipped a GREEN? Put Pierre in your README:
+
+[![Prechecked by Pierre](https://img.shields.io/badge/prechecked_by-Pierre_🟢-2E7D32?labelColor=24292e)](https://github.com/berkayturk/appstore-precheck)
+
+```markdown
+[![Prechecked by Pierre](https://img.shields.io/badge/prechecked_by-Pierre_🟢-2E7D32?labelColor=24292e)](https://github.com/berkayturk/appstore-precheck)
+```
+
+The badge is self-declared (the scan is local and read-only, so there is nothing to verify
+server-side) — it says "this project runs `appstore-precheck` before submitting", nothing more.
+
 ## Measured accuracy
 
 [`docs/scorecard.md`](docs/scorecard.md) is generated by `scripts/scorecard.sh` and tracks two
@@ -431,6 +466,8 @@ App Store apps (DuckDuckGo, Pocket Casts, Wikipedia).
 `bash`, `git`, `grep`, `find` are all the static scan, `npx appstore-precheck`, and the GitHub
 Action need, and they run with **zero credentials and no network**. `jq` (config + String Catalog
 checks) and `python3` (exact Unicode length counts) are optional and sharpen a few checks.
+On Windows, run the CLI under WSL or Git Bash. CLI exit codes: `0` ok, `1` verdict at or past
+`--fail-on`, `64` bad usage, `70` environment error (`bash` or the bundled scanner missing).
 
 Only the **optional Phase 2** (`fastlane precheck`) needs `fastlane` and an
 [App Store Connect API key](https://developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-for-app-store-connect-api).
@@ -439,6 +476,26 @@ Everything else works without one.
 **Secrets**: the ASC API key is read from your environment at runtime and deleted immediately after
 `fastlane precheck`. Never commit it; `.gitignore` blocks `*asc-key*.json` and `.env`.
 
+## Troubleshooting
+
+- **Wrong source directory detected** (`PASS: layout — ios='…'` names the wrong folder): set
+  `.iosSourceDir` in `.appstore-precheck.json` (copy
+  [`config.example.json`](skills/appstore-precheck/config.example.json)). In a monorepo, pass
+  `--dir path/to/app` — an explicit `--dir` is authoritative and never snaps to the git root.
+- **Unexpected YELLOW**: YELLOW means 5+ WARNs, no FAILs. Advisory checks (background modes,
+  tracking SDKs, screenshot sizes) can pile up on legitimate apps — review each WARN, then
+  suppress the accepted ones via [`.precheck-ignore`](#suppressing-findings-precheck-ignore)
+  so real signals stay visible.
+- **Paywall FAILs on a remote-configured paywall** (RevenueCat dashboard paywalls and similar):
+  the scanner downgrades these to a verify-in-dashboard WARN when it sees `RevenueCatUI` /
+  `presentPaywall`. If your setup isn't detected, check the dashboard paywall manually and
+  suppress with `.precheck-ignore`.
+- **`fastlane precheck` auth errors** (Phase 2): confirm the three `ASC_KEY_*` env vars are set
+  and the API key has App Manager access. Phase 2 is optional — skipping it only skips Apple's
+  metadata linter, the static verdict is unaffected.
+- **`jq` or `python3` missing**: the scan still runs; config-file overrides, String Catalog
+  checks, and exact Unicode length counts degrade gracefully (noted in the output).
+
 ## Uninstall
 
 ```bash

package/bin/cli.js

@@ -91,7 +91,11 @@ function main() {
     fail(`not a directory: ${opts.dir}`, 64);
   }
 
-  const scanArgs = opts.format === 'text' ? [SCAN] : [SCAN, '--format', opts.format];
+  // --dir is passed through explicitly: scan.sh treats it as authoritative,
+  // so a monorepo subdirectory is scanned as requested instead of snapping to
+  // the enclosing git toplevel.
+  const scanArgs = [SCAN, '--dir', opts.dir];
+  if (opts.format !== 'text') scanArgs.push('--format', opts.format);
   const scan = spawnSync('bash', scanArgs, {
     cwd: opts.dir,
     encoding: 'utf8',
@@ -101,6 +105,7 @@ function main() {
     fail('bash is required to run the scanner (install bash, or use WSL / Git Bash on Windows)', 70);
   }
   if (scan.error) fail(`failed to run the scanner: ${scan.error.message}`, 70);
+  if (scan.signal) fail(`scanner was killed by signal ${scan.signal}`, 70);
 
   const scanOut = scan.stdout || '';
   process.stdout.write(scanOut);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appstore-precheck",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "description": "Read-only iOS App Store pre-submission check, packaged as a portable Agent Skill with native Claude Code, Cursor, and Codex plugins, plus an npx CLI.",
   "license": "MIT",
   "author": "Berkay Turk (https://github.com/berkayturk)",
@@ -25,7 +25,7 @@
   "scripts": {
     "test": "bash tests/all.sh",
     "check-versions": "bash scripts/check-versions.sh",
-    "lint": "node --check bin/cli.js && bash -n skills/appstore-precheck/scripts/scan.sh && bash -n skills/appstore-precheck/scripts/verdict.sh && bash -n skills/appstore-precheck/scripts/phase2-precheck.sh && bash -n skills/appstore-precheck/scripts/findings.sh && bash -n skills/appstore-precheck/scripts/suppress.sh && bash -n hooks/fastlane-guard.sh && bash -n install.sh && bash -n tests/run.sh && bash -n tests/all.sh && bash -n tests/test-verdict.sh && bash -n tests/test-guard.sh && bash -n tests/test-config.sh && bash -n tests/test-install.sh && bash -n tests/test-phase2.sh && bash -n tests/test-cli.sh && bash -n tests/test-findings.sh && bash -n tests/test-format-json.sh && bash -n tests/test-suppress.sh && bash -n tests/test-scorecard.sh && bash -n scripts/scorecard.sh && bash -n scripts/scorecard-real.sh"
+    "lint": "node --check bin/cli.js && bash -n skills/appstore-precheck/scripts/scan.sh && bash -n skills/appstore-precheck/scripts/verdict.sh && bash -n skills/appstore-precheck/scripts/phase2-precheck.sh && bash -n skills/appstore-precheck/scripts/findings.sh && bash -n skills/appstore-precheck/scripts/suppress.sh && bash -n hooks/fastlane-guard.sh && bash -n install.sh && bash -n tests/run.sh && bash -n tests/all.sh && bash -n tests/test-verdict.sh && bash -n tests/test-guard.sh && bash -n tests/test-config.sh && bash -n tests/test-install.sh && bash -n tests/test-phase2.sh && bash -n tests/test-cli.sh && bash -n tests/test-findings.sh && bash -n tests/test-format-json.sh && bash -n tests/test-suppress.sh && bash -n tests/test-scorecard.sh && bash -n scripts/scorecard.sh && bash -n scripts/scorecard-real.sh && bash -n scripts/update-brew-formula.sh && bash -n tests/test-pack.sh"
   },
   "keywords": ["ios", "app-store", "fastlane", "agent-skill", "claude-code", "precheck"]
 }

package/skills/appstore-precheck/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: appstore-precheck
-description: Read-only pre-submission check for an iOS app before App Store review. Scans Swift code, fastlane metadata, screenshots, PrivacyInfo.xcprivacy, and the paywall for 42 rejection vectors, wraps Apple's official `fastlane precheck`, watches for live App Store Review Guideline drift, has Pierre explain every FAIL and WARN, then runs 22 semantic deep-review checks (Tier A) plus 6 heuristic checks (Tier B v1) — 28 total. Emits a GREEN/YELLOW/RED verdict and a `.precheck-pass` token an upload guard can gate on. Use when preparing an iOS App Store submission (before Archive, before "Submit for Review", before TestFlight, or before any `fastlane deliver/pilot/release`), or when the user mentions App Store rejection, app review, or fastlane upload.
+description: Read-only pre-submission check for an iOS app before App Store review. Scans Swift and Objective-C code, fastlane metadata, screenshots, PrivacyInfo.xcprivacy, and the paywall for 42 rejection vectors, wraps Apple's official `fastlane precheck`, watches for live App Store Review Guideline drift, has Pierre explain every FAIL and WARN, then runs 22 semantic deep-review checks (Tier A) plus 6 heuristic checks (Tier B v1) — 28 total. Emits a GREEN/YELLOW/RED verdict and a `.precheck-pass` token an upload guard can gate on. Use when preparing an iOS App Store submission (before Archive, before "Submit for Review", before TestFlight, or before any `fastlane deliver/pilot/release`), or when the user mentions App Store rejection, app review, or fastlane upload.
 license: MIT
 metadata:
   author: Berkay Turk
-  version: 1.12.0
-allowed-tools: Bash Read Grep Glob WebFetch
+  version: 1.12.1
+allowed-tools: Bash Read Grep Glob WebFetch mcp__maestro__list_devices mcp__maestro__run mcp__maestro__inspect_screen mcp__maestro__take_screenshot mcp__maestro__cheat_sheet
 ---
 
 # App Store Precheck
@@ -112,7 +112,13 @@ check(s). It is non-blocking and never runs in the offline user scan; the finger
 
 ### Phase 1: Static scan
 
+Run the bundled scanner from the app repo root. `scripts/` here is relative to THIS skill's own
+directory (wherever the skill is installed — a plugin dir, `.claude/skills/`, `.agents/skills/`,
+or a clone of the source repo):
+
 ```bash
+bash <skill-dir>/scripts/scan.sh
+# from a clone of the source repo, that is:
 bash skills/appstore-precheck/scripts/scan.sh
 ```
 
@@ -151,7 +157,9 @@ output is unchanged.
 ### Phase 2: Apple's official `fastlane precheck`
 
 Requires `bundleId` in config (or pass `app_identifier` directly) and App Store Connect API
-credentials. **Never commit the key.** The bundled wrapper builds the ASC API key JSON from your
+credentials. **This phase is optional: if no ASC credentials are available, skip it, note the
+skip in the report, and continue to Phase 3 — do not stall waiting for credentials.**
+**Never commit the key.** The bundled wrapper builds the ASC API key JSON from your
 environment, runs precheck, and deletes the key on exit (use `--dry-run` to preview the command
 with no credentials and no network):
 
@@ -305,6 +313,8 @@ narrative; verdict.sh just pins the threshold arithmetic. `REVIEW-FINDING` lines
 3. Present **Phase 3 commentary** — Pierre's 2–3 sentence explanation for every FAIL and WARN.
 4. Present **Phase 4 deep review** — summary count (`REVIEW-FINDING` vs `REVIEW-PASS` of 28), then
    every `REVIEW-FINDING` with Pierre explanation; list `REVIEW-PASS` lines compactly or omit if all 28 passed.
+   The 5 screenshot-vision checks (S1–S5) emit the same `REVIEW-*` prefixes but count as a
+   **separate "+5 vision checks" sub-block** in the summary, never inside the "of 28" denominator.
 5. Present the **machine-faithful** scan output: each `FAIL:`/`WARN:` line verbatim, then for each
    FAIL a `file:line` reference and a suggested fix (one line each, surgical, not paraphrased).
 6. State the verdict and token action (example one-liners — each goes in its own language block, not inline):
@@ -360,5 +370,7 @@ Follow [`references/simulator-dynamic-review.md`](references/simulator-dynamic-r
 ## Optional: upload guard hook
 
 `hooks/fastlane-guard.sh` blocks `fastlane deliver/pilot/release` unless a fresh `.precheck-pass`
-token exists. In Claude Code it auto-wires via `hooks/hooks.json`. In other environments, wire it
+token exists. In Claude Code it auto-wires via `hooks/hooks.json` **when installed as a plugin**
+(the hook path uses `${CLAUDE_PLUGIN_ROOT}`; an `install.sh`-vendored copy gets no automatic
+hook). In other environments, wire it
 as a pre-command check yourself, or treat the token as a manual go/no-go signal.

package/skills/appstore-precheck/references/methodology.md

@@ -13,6 +13,7 @@ whole file to run the skill.
 - [Verdict thresholds](#verdict-thresholds)
 - [SARIF output](#sarif-output---format-sarif)
 - [Real App Store outcomes](#real-app-store-outcomes-corpusoutcomes)
+- [Optional local dynamic simulator tier](#optional-local-dynamic-simulator-tier)
 - [Pre-submit manual checklist](#pre-submit-manual-checklist)
 
 ---

package/skills/appstore-precheck/references/pierre-deep-review.md

@@ -149,7 +149,7 @@ REVIEW-PASS: <guideline> — not applicable (<reason>)
 3. Flag screenshots showing features absent from the build or metadata.
 4. For the full structured screenshot vision review (placeholder/empty-state, text overflow,
    wrong device frame, misleading marketing, metadata mismatch), follow
-   `references/screenshot-vision-review.md`.
+   `screenshot-vision-review.md` (sibling file in this same `references/` directory).
 
 ### 9 — 2.3.6 Pricing language
 
@@ -271,6 +271,6 @@ After Phase 4, include in the final report:
 
 1. Trilingual verdict block (from scan counts only).
 2. Phase 3 commentary (every scan FAIL/WARN).
-3. Phase 4 summary table: 28 checks → count of `REVIEW-FINDING` vs `REVIEW-PASS` (note Tier B items 4, 5, 7, 10, 15, 28 if any fired).
+3. Phase 4 summary table: 28 checks → count of `REVIEW-FINDING` vs `REVIEW-PASS` (note Tier B items 4, 5, 7, 10, 15, 28 if any fired). The 5 screenshot-vision checks (S1–S5) report as a separate "+5 vision checks" sub-block, outside the "of 28" count.
 4. Phase 4 detail: every `REVIEW-FINDING` with Pierre explanation; optionally list `REVIEW-PASS` lines compactly.
 5. Verbatim Phase 1 scan output + verdict/token action.

package/skills/appstore-precheck/references/simulator-dynamic-review.md

@@ -49,17 +49,27 @@ reporter, or real-device QA.
 
 ## Per-check procedure
 
+The Maestro MCP tools are: `mcp__maestro__list_devices` (pick a booted simulator's `device_id`),
+`mcp__maestro__run` (execute a declarative YAML flow — `launchApp`, `tapOn`, `assertVisible`, …),
+`mcp__maestro__inspect_screen` (view hierarchy), `mcp__maestro__take_screenshot`, and
+`mcp__maestro__cheat_sheet` (YAML command reference). Every local tool needs a `device_id` from
+`list_devices` first. `xcrun simctl` is the fallback when Maestro is unavailable.
+
 ### D1 — Launch without crash
-1. `mcp__maestro__start_device` (or `xcrun simctl boot`) a disposable simulator; `launch_app` the supplied app/bundle id.
+1. `mcp__maestro__list_devices` for a booted disposable simulator (boot one with
+   `xcrun simctl boot` if needed); then `mcp__maestro__run` a flow that declares the `appId` and
+   starts with `launchApp` (fallback: `xcrun simctl launch`).
 2. Observe for a short window; if the app process disappears or a crash alert shows, `DYNAMIC-FINDING`.
-3. `take_screenshot` at launch as evidence.
+3. `mcp__maestro__take_screenshot` at launch as evidence.
 
 ### D2 — Core screen reachable
-1. After launch, inspect the first real screen (`inspect_view_hierarchy` / `take_screenshot`).
+1. After launch, inspect the first real screen (`mcp__maestro__inspect_screen` /
+   `mcp__maestro__take_screenshot`).
 2. Flag if stuck on a splash, blank, or an error/"something went wrong" state.
 
 ### D3 — Paywall renders
-1. If a paywall exists (per the static scan / app structure), navigate to it (`tap_on` / a flow).
+1. If a paywall exists (per the static scan / app structure), navigate to it with a
+   `mcp__maestro__run` flow (`tapOn` steps; check `mcp__maestro__cheat_sheet` for selector syntax).
 2. Confirm price + trial/auto-renew/cancel terms are visibly rendered; screenshot. Not applicable if no paywall.
 
 ### D4 — Permission prompt vs purpose string

package/skills/appstore-precheck/scripts/findings.sh

@@ -72,15 +72,19 @@ _record_suppressed() {
 # (RED >=1 FAIL; YELLOW >=5 WARN; else GREEN), counting non-suppressed findings only.
 render_json() {
   local buf="${FINDINGS_TMP:-/dev/null}"
+  # Thresholds live in thresholds.sh (shared with verdict.sh).
+  # shellcheck source=thresholds.sh
+  . "$(dirname "${BASH_SOURCE[0]}")/thresholds.sh"
   [[ -s "$buf" ]] || { printf '%s\n' '{"findings":[]}' | jq \
      --arg v "$PRECHECK_VERSION" '{tool:"appstore-precheck",version:$v,verdict:"GREEN",summary:{fail:0,warn:0,pass:0,suppressed:0},findings:[]}'; return 0; }
-  jq -s --arg v "$PRECHECK_VERSION" '
+  jq -s --arg v "$PRECHECK_VERSION" \
+     --argjson fmin "$RED_FAIL_MIN" --argjson wmin "$YELLOW_WARN_MIN" '
     (map(select(.suppressed==false))) as $live
     | ($live|map(select(.severity=="FAIL"))|length) as $f
     | ($live|map(select(.severity=="WARN"))|length) as $w
     | ($live|map(select(.severity=="PASS"))|length) as $p
     | (map(select(.suppressed==true))|length) as $s
-    | (if $f>=1 then "RED" elif $w>=5 then "YELLOW" else "GREEN" end) as $verdict
+    | (if $f>=$fmin then "RED" elif $w>=$wmin then "YELLOW" else "GREEN" end) as $verdict
     | {tool:"appstore-precheck", version:$v, verdict:$verdict,
        summary:{fail:$f, warn:$w, pass:$p, suppressed:$s},
        findings: .}' "$buf"

package/skills/appstore-precheck/scripts/scan.sh

@@ -9,34 +9,49 @@
 
 set -u
 
-ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || ROOT="$(pwd)"
-cd "$ROOT" || { echo "FAIL: repo-root — could not enter repository root"; exit 0; }
+# Resolve the script dir to an absolute path BEFORE any cd, so the sibling
+# sources below cannot break when an explicit --dir moves us elsewhere.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-source "$(dirname "${BASH_SOURCE[0]}")/findings.sh"
-source "$(dirname "${BASH_SOURCE[0]}")/suppress.sh"
-source "$(dirname "${BASH_SOURCE[0]}")/project-model.sh"
-source "$(dirname "${BASH_SOURCE[0]}")/image-dims.sh"
-source "$(dirname "${BASH_SOURCE[0]}")/sarif.sh"
-FINDINGS_TMP="$(mktemp)"; export FINDINGS_TMP
-trap 'rm -f "$FINDINGS_TMP"' EXIT
 FORMAT="text"
-# The envelope `version` is the appstore-precheck TOOL's own version (from this
-# skill's SKILL.md), never the scanned repo's — $ROOT above is the SCANNED app's
-# git root, so reading its package.json here would leak the wrong version.
-PRECHECK_VERSION="$(grep -m1 -E '^[[:space:]]*version:' "$(dirname "${BASH_SOURCE[0]}")/../SKILL.md" 2>/dev/null | sed -E 's/.*version:[[:space:]]*//; s/[[:space:]]*$//')"
-[[ -z "$PRECHECK_VERSION" ]] && PRECHECK_VERSION="dev"
-
+SCAN_DIR=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --format)
       if [[ $# -lt 2 ]]; then echo "scan.sh: --format needs a value (text|json|sarif)" >&2; exit 64; fi
       FORMAT="$2"; shift 2 ;;
     --format=*) FORMAT="${1#*=}"; shift ;;
+    --dir)
+      if [[ $# -lt 2 ]]; then echo "scan.sh: --dir needs a path" >&2; exit 64; fi
+      SCAN_DIR="$2"; shift 2 ;;
+    --dir=*) SCAN_DIR="${1#*=}"; shift ;;
     *) shift ;;
   esac
 done
 [[ "$FORMAT" == json || "$FORMAT" == text || "$FORMAT" == sarif ]] || { echo "scan.sh: --format must be text|json|sarif" >&2; exit 64; }
 
+# An explicit --dir is authoritative: scan exactly that directory. Without it,
+# snap to the enclosing git toplevel (monorepo subdirs need --dir to opt out).
+if [[ -n "$SCAN_DIR" ]]; then
+  ROOT="$(cd "$SCAN_DIR" 2>/dev/null && pwd)" || { echo "scan.sh: --dir is not a directory: $SCAN_DIR" >&2; exit 64; }
+else
+  ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || ROOT="$(pwd)"
+fi
+cd "$ROOT" || { echo "FAIL: repo-root — could not enter repository root"; exit 0; }
+
+source "$SCRIPT_DIR/findings.sh"
+source "$SCRIPT_DIR/suppress.sh"
+source "$SCRIPT_DIR/project-model.sh"
+source "$SCRIPT_DIR/image-dims.sh"
+source "$SCRIPT_DIR/sarif.sh"
+FINDINGS_TMP="$(mktemp)"; export FINDINGS_TMP
+trap 'rm -f "$FINDINGS_TMP"' EXIT
+# The envelope `version` is the appstore-precheck TOOL's own version (from this
+# skill's SKILL.md), never the scanned repo's — $ROOT above is the SCANNED app's
+# git root, so reading its package.json here would leak the wrong version.
+PRECHECK_VERSION="$(grep -m1 -E '^[[:space:]]*version:' "$SCRIPT_DIR/../SKILL.md" 2>/dev/null | sed -E 's/.*version:[[:space:]]*//; s/[[:space:]]*$//')"
+[[ -z "$PRECHECK_VERSION" ]] && PRECHECK_VERSION="dev"
+
 CONFIG="${APPSTORE_PRECHECK_CONFIG:-.appstore-precheck.json}"
 have_jq() { command -v jq >/dev/null 2>&1; }
 
@@ -84,6 +99,11 @@ GREP_PRUNE=( --exclude-dir=.git --exclude-dir=Pods --exclude-dir=Carthage
             --exclude-dir=.claude --exclude-dir=worktrees
             --exclude-dir=node_modules --exclude-dir=vendor )
 
+# One shared source include-set: Swift plus Objective-C(++). Every code-level
+# grep uses this set — scanning *.swift only silently passes real rejection
+# vectors (missing purpose strings, tracking SDKs) living in .m/.h files.
+SRC_INC=( --include='*.swift' --include='*.m' --include='*.mm' --include='*.h' )
+
 # Load .precheck-ignore path exclusions (Task 2 suppress.sh) and extend both
 # prune sets so a suppressed path is skipped by detection AND grep passes.
 load_precheck_ignore "$ROOT"
@@ -217,7 +237,7 @@ echo "PASS: layout — ios='${IOS_DIR:-?}' metadata='${META_DIR:-?}' xcstrings='
 set_rule "privacy-manifest-parity"
 check_required_reason_api() {
   local cat="$1" pattern="$2" hits declared
-  hits=$(grep -rEl "$pattern" "$IOS_DIR" --include="*.swift" 2>/dev/null | head -3)
+  hits=$(grep -rEl "$pattern" "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -3)
   declared=$(grep -c "NSPrivacyAccessedAPICategory${cat}" "$PRIVACY_FILE" 2>/dev/null)
   if [[ -n "$hits" && "${declared:-0}" -eq 0 ]]; then
     fail "5.1.1 Required Reason API — '$cat' used in code (e.g. $(echo "$hits" | head -1)) but not declared in PrivacyInfo.xcprivacy" "$PRIVACY_FILE"
@@ -233,7 +253,9 @@ elif [[ -z "$PRIVACY_FILE" ]]; then
   fail "5.1.1 Required Reason API — PrivacyInfo.xcprivacy not found (required since May 2024 for apps using Required Reason APIs)" "$INFO_PLIST"
 else
   check_required_reason_api "UserDefaults"   'UserDefaults|@AppStorage'
-  check_required_reason_api "FileTimestamp"  'attributesOfItem|creationDate|modificationDate|\.fileCreationDate|\.fileModificationDate'
+  # Anchored to real filesystem APIs: bare `creationDate` / `modificationDate`
+  # are ubiquitous model/Core-Data property names and false-FAIL on them.
+  check_required_reason_api "FileTimestamp"  'attributesOfItem|fileCreationDate|fileModificationDate|creationDateKey|contentModificationDateKey|contentModificationDate'
   check_required_reason_api "SystemBootTime" 'systemUptime|mach_absolute_time|CACurrentMediaTime\(\)'
   check_required_reason_api "DiskSpace"      'volumeAvailableCapacity|volumeTotalCapacity'
   check_required_reason_api "ActiveKeyboard" 'activeInputModes|UITextInputMode'
@@ -255,7 +277,7 @@ else
     "Contacts:NSContactsUsageDescription" \
     "HealthKit:NSHealthShareUsageDescription"; do
     framework="${fw%%:*}"; needed_key="${fw##*:}"
-    if grep -rqE "import ($framework)|($framework)\." "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+    if grep -rqE "import ($framework)|($framework)\." "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
       if ! grep -qE "$needed_key" "$INFO_PLIST" 2>/dev/null; then
         fail "5.1.1 framework '${framework%%|*}' imported but Info.plist is missing '${needed_key%%|*}'" "$INFO_PLIST"
       fi
@@ -267,7 +289,7 @@ else
   # AVAudioPlayer/AVPlayer, and Photos/PhotosUI's PhotosPicker/PHPickerViewController
   # run out-of-process and need no Info.plist key at all).
   # Camera: purpose string required only when a capture API is actually used.
-  if grep -rqE 'AVCaptureDevice|AVCaptureSession|UIImagePickerController' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+  if grep -rqE 'AVCaptureDevice|AVCaptureSession|UIImagePickerController' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
     grep -qE 'NSCameraUsageDescription' "$INFO_PLIST" 2>/dev/null || \
       fail "5.1.1 camera capture API used but Info.plist is missing 'NSCameraUsageDescription'" "$INFO_PLIST"
   fi
@@ -275,15 +297,15 @@ else
   # separately from the camera check above: a bare AVCaptureDevice only
   # implies microphone use when it is audio-typed (`.audio` device/media
   # type), not for a video-only capture device.
-  if grep -rqE 'AVAudioRecorder|installTap\(|AVAudioEngine\(|AVAudioSession[^;]*\.(playAndRecord|record)|AVCaptureDevice[^;)]*\.audio|for:[[:space:]]*\.audio' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+  if grep -rqE 'AVAudioRecorder|installTap\(|AVAudioEngine\(|AVAudioSession[^;]*\.(playAndRecord|record)|AVCaptureDevice[^;)]*\.audio|for:[[:space:]]*\.audio' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
     grep -qE 'NSMicrophoneUsageDescription' "$INFO_PLIST" 2>/dev/null || \
       fail "5.1.1 microphone/recording API used but Info.plist is missing 'NSMicrophoneUsageDescription'" "$INFO_PLIST"
   fi
   # Photo library READ: PhotosPicker/PHPicker need no key; only true read/fetch APIs do.
-  if grep -rqE 'PHAsset\b|PHFetchResult|PHImageManager|fetchAssets|PHAssetCollection' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+  if grep -rqE 'PHAsset\b|PHFetchResult|PHImageManager|fetchAssets|PHAssetCollection' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
     grep -qE 'NSPhotoLibraryUsageDescription' "$INFO_PLIST" 2>/dev/null || \
       fail "5.1.1 Photos read API used but Info.plist is missing 'NSPhotoLibraryUsageDescription'" "$INFO_PLIST"
-  elif grep -rqE 'PHAssetCreationRequest|UIImageWriteToSavedPhotosAlbum|performChanges' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+  elif grep -rqE 'PHAssetCreationRequest|UIImageWriteToSavedPhotosAlbum|performChanges' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
     # Add-only save: covered by the add-only key.
     grep -qE 'NSPhotoLibraryAddUsageDescription' "$INFO_PLIST" 2>/dev/null || \
       fail "5.1.1 Photos add-only API used but Info.plist is missing 'NSPhotoLibraryAddUsageDescription'" "$INFO_PLIST"
@@ -297,8 +319,8 @@ fi
 # when the ATT framework IS imported; §16 fires when a tracking SDK is present but
 # the ATT prompt is NOT. Computed once here so the two checks never contradict.
 set_rule "att-usage"
-tracking_sdk=$(grep -rlE 'advertisingIdentifier|ASIdentifierManager|GADMobileAds|GoogleMobileAds|AppLovinSDK|ALSdk|AppsFlyerLib|import Adjust|Adjust\.|FBAudienceNetwork|BranchSDK|IronSource' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
-att_used=$(grep -rlE 'AppTrackingTransparency|ATTrackingManager' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+tracking_sdk=$(grep -rlE 'advertisingIdentifier|ASIdentifierManager|GADMobileAds|GoogleMobileAds|AppLovinSDK|ALSdk|AppsFlyerLib|import Adjust|Adjust\.|FBAudienceNetwork|BranchSDK|IronSource' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
+att_used=$(grep -rlE 'AppTrackingTransparency|ATTrackingManager' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
 if [[ -n "$att_used" ]]; then
   if grep -q "NSUserTrackingUsageDescription" "$INFO_PLIST" 2>/dev/null; then
     pass "5.1.2 ATT — used + NSUserTrackingUsageDescription present"
@@ -437,7 +459,7 @@ fi
 # In-app purchase gate — only run 3.1.2 checks if IAP signals exist
 # ===================================================================
 iap_detected=""
-grep -rqE 'SKPaymentQueue|SKProduct|SKMutablePayment|Product\.products|Product\(for:|Product\(id:|\.purchase\(|Transaction\.currentEntitlements|Transaction\.updates|RevenueCat|Purchases\.(shared|configure|logIn|getProducts)|Adapty|Glassfy|import Qonversion' "$IOS_DIR" --include="*.swift" 2>/dev/null && iap_detected=1
+grep -rqE 'SKPaymentQueue|SKProduct|SKMutablePayment|Product\.products|Product\(for:|Product\(id:|\.purchase\(|Transaction\.currentEntitlements|Transaction\.updates|RevenueCat|Purchases\.(shared|configure|logIn|getProducts)|Adapty|Glassfy|import Qonversion' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null && iap_detected=1
 [[ -n "$SUB_VIEW" ]] && iap_detected=1
 
 if [[ -z "$iap_detected" ]]; then
@@ -483,21 +505,28 @@ else
   # representative file in messages.
   set_rule "subscription-links-restore"
   if (( ${#PAYWALL_FILES[@]} > 0 )); then
-    if grep -qE 'restore|restorePurchases' "${PAYWALL_FILES[@]}"; then
-      pass "3.1.2 Restore Purchases — present in $(basename "$SUB_VIEW")"
-    else
-      fail "3.1.2 Restore Purchases — not found in the paywall views (e.g. $SUB_VIEW) (required by Apple)"
-    fi
-    if grep -qE 'terms_of_use|termsURL|termsOfUse|subscription_terms|EULA|/terms' "${PAYWALL_FILES[@]}"; then
-      pass "3.1.2 Terms of Use (EULA) link — present"
-    else
-      fail "3.1.2 Terms of Use (EULA) link — not found in the paywall views (e.g. $SUB_VIEW)"
-    fi
-    if grep -qE 'privacy_policy|privacyURL|privacyPolicy|subscription_privacy|/privacy' "${PAYWALL_FILES[@]}"; then
-      pass "3.1.2 Privacy Policy link — present"
-    else
-      fail "3.1.2 Privacy Policy link — not found in the paywall views (e.g. $SUB_VIEW)"
-    fi
+    # Remote-configured paywalls (RevenueCatUI's PaywallView, presentPaywall,
+    # paywallFooter, AdaptyUI) render Restore/Terms/Privacy from the vendor
+    # dashboard, so those controls never appear in app source. A hard FAIL here
+    # would false-RED a compliant app; downgrade the missing-link findings to
+    # verify-in-dashboard WARNs when that signal is present.
+    remote_paywall=""
+    grep -rqE 'RevenueCatUI|presentPaywall|paywallFooter|AdaptyUI' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null && remote_paywall=1
+    # paywall_req <label> <pattern> [pass-suffix]: PASS when the pattern is in
+    # any paywall view, WARN when a remote paywall likely renders it, else FAIL.
+    paywall_req() {
+      local label="$1" pattern="$2" pass_suffix="${3:-— present}"
+      if grep -qiE "$pattern" "${PAYWALL_FILES[@]}"; then
+        pass "3.1.2 $label $pass_suffix"
+      elif [[ -n "$remote_paywall" ]]; then
+        warn "3.1.2 $label — not in app source, but a remote-configured paywall (RevenueCatUI / presentPaywall) was detected; verify the dashboard-configured paywall shows it before submitting"
+      else
+        fail "3.1.2 $label — not found in the paywall views (e.g. $SUB_VIEW)"
+      fi
+    }
+    paywall_req "Restore Purchases" 'restore|AppStore\.sync' "— present in $(basename "$SUB_VIEW")"
+    paywall_req "Terms of Use (EULA) link" 'terms[ _]?of[ _]?(use|service)|termsURL|subscription_terms|EULA|/terms|/tos\b|/eula'
+    paywall_req "Privacy Policy link" 'privacy[ _]?policy|privacyURL|subscription_privacy|/privacy|datenschutz|gizlilik'
   else
     warn "3.1.2 IAP detected but no paywall/subscription view found — set .paywallGlobs so required-link checks can run"
   fi
@@ -508,7 +537,7 @@ fi
 # ===================================================================
 set_rule "private-api"
 banned_api='UIWebView|setSelectionIndicatorImage|_UIBackdropView|NSURLConnection[^a-zA-Z]|UIAlertView[^Q]|UIActionSheet[^Q]'
-banned_hits=$(grep -rEnI "$banned_api" "$IOS_DIR" --include="*.swift" --include="*.m" --include="*.h" 2>/dev/null | head -5)
+banned_hits=$(grep -rEnI "$banned_api" "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -5)
 if [[ -n "$banned_hits" ]]; then
   pa_first="$(printf '%s\n' "$banned_hits" | head -1)"   # "path:line:match"
   pa_file="${pa_first%%:*}"
@@ -547,9 +576,9 @@ fi
 # ===================================================================
 set_rule "siwa-parity"
 if [[ -n "$IOS_DIR" ]]; then
-  social_login=$(grep -rlE 'GIDSignIn|import GoogleSignIn|FBSDKLoginKit|FBSDKLoginManager|FacebookLogin|import Auth0|LineSDK|VKSdkAuthorization' "$IOS_DIR" --include='*.swift' 2>/dev/null | head -1)
+  social_login=$(grep -rlE 'GIDSignIn|import GoogleSignIn|FBSDKLoginKit|FBSDKLoginManager|FacebookLogin|import Auth0|LineSDK|VKSdkAuthorization' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   if [[ -n "$social_login" ]]; then
-    if grep -rqE 'ASAuthorizationAppleID|SignInWithAppleButton|AppleIDProvider' "$IOS_DIR" --include='*.swift' 2>/dev/null; then
+    if grep -rqE 'ASAuthorizationAppleID|SignInWithAppleButton|AppleIDProvider' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
       pass "4.8 Sign in with Apple — present alongside third-party login"
     else
       warn "4.8 Sign in with Apple — third-party social login detected (e.g. $(basename "$social_login")) but no Sign in with Apple found; Apple requires an equivalent option (4.8). Some account systems are exempt — verify."
@@ -562,7 +591,7 @@ fi
 # ===================================================================
 set_rule "external-purchase-link"
 ext_purchase=""
-grep -rqE 'ExternalPurchase|ExternalPurchaseLink|ExternalPurchaseCustomLink' "${IOS_DIR:-.}" --include='*.swift' 2>/dev/null && ext_purchase=1
+grep -rqE 'ExternalPurchase|ExternalPurchaseLink|ExternalPurchaseCustomLink' "${IOS_DIR:-.}" "${SRC_INC[@]}" 2>/dev/null && ext_purchase=1
 grep -rqE 'external-purchase' "${IOS_DIR:-.}" --include='*.entitlements' 2>/dev/null && ext_purchase=1
 if [[ -n "$ext_purchase" ]]; then
   warn "3.1.1(a) External purchase link detected — ensure the External Purchase entitlement, eligible storefronts, the required disclosure sheet, and App Store Connect reporting are in place (3.1.1(a))."
@@ -637,7 +666,7 @@ fi
 # incomplete. Soft "verify" wording (a crash-only Sentry may genuinely collect
 # nothing), so WARN, never FAIL.
 set_rule "analytics-privacyinfo-mismatch"
-analytics_sdk=$(grep -rlE 'FirebaseAnalytics|import Firebase|import Amplitude|Amplitude\(|import Mixpanel|Mixpanel\.|import Sentry|SentrySDK|import Segment|SEGAnalytics|Analytics\.shared\(|import Bugsnag|Bugsnag\.|AppCenterAnalytics|import Datadog|DatadogCore' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+analytics_sdk=$(grep -rlE 'FirebaseAnalytics|import Firebase|import Amplitude|Amplitude\(|import Mixpanel|Mixpanel\.|import Sentry|SentrySDK|import Segment|SEGAnalytics|Analytics\.shared\(|import Bugsnag|Bugsnag\.|AppCenterAnalytics|import Datadog|DatadogCore' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
 if [[ -n "$analytics_sdk" ]]; then
   declared_data=""
   if [[ -n "$PRIVACY_FILE" && -f "$PRIVACY_FILE" ]]; then
@@ -680,7 +709,7 @@ fi
 # content. We can't tell digital from physical statically, so this is advisory.
 set_rule "thirdparty-payment-sdk"
 if [[ -n "$IOS_DIR" ]]; then
-  payment_sdk=$(grep -rlE 'import Stripe|StripePaymentSheet|StripeApplePay|import Braintree|BTPaymentFlow|import PayPal|PayPalCheckout|PayPalNativeCheckout|import Square|SquareInAppPayments|import Adyen|AdyenComponents|RazorpaySDK|import Paddle' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  payment_sdk=$(grep -rlE 'import Stripe|StripePaymentSheet|StripeApplePay|import Braintree|BTPaymentFlow|import PayPal|PayPalCheckout|PayPalNativeCheckout|import Square|SquareInAppPayments|import Adyen|AdyenComponents|RazorpaySDK|import Paddle' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   if [[ -n "$payment_sdk" ]]; then
     warn "3.1.1 Third-party payment SDK — '$(basename "$payment_sdk")' detected; selling digital content/functionality must use in-app purchase, not an external processor (3.1.1). Allowed only for physical goods/services — verify your offering."
   fi
@@ -694,9 +723,9 @@ fi
 # warn when no report/block/moderation affordance is found anywhere in the source.
 set_rule "ugc-no-moderation"
 if [[ -n "$IOS_DIR" ]]; then
-  ugc_signal=$(grep -rlE 'userGeneratedContent|\bUGC\b|StreamChat|MessageKit|SendbirdSDK|PubNub|postComment|submitComment|createPost|publishPost|uploadUserPhoto|uploadVideo' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  ugc_signal=$(grep -rlE 'userGeneratedContent|\bUGC\b|StreamChat|MessageKit|SendbirdSDK|PubNub|postComment|submitComment|createPost|publishPost|uploadUserPhoto|uploadVideo' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   if [[ -n "$ugc_signal" ]]; then
-    if grep -rqiE 'report(Content|User|Abuse|Post|Comment|Message|Reason|ed)|block(ed)?User|unblockUser|moderat(e|ion|or)|flag(Content|Post|User|Comment|Message)|content.?filter' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+    if grep -rqiE 'report(Content|User|Abuse|Post|Comment|Message|Reason|ed)|block(ed)?User|unblockUser|moderat(e|ion|or)|flag(Content|Post|User|Comment|Message)|content.?filter' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
       pass "1.2 UGC — user-generated content with report/block/moderation affordances present"
     else
       warn "1.2 UGC — user-generated content detected (e.g. $(basename "$ugc_signal")) but no report/block/moderation mechanism found; UGC apps must offer content filtering, a report mechanism, user blocking, and published contact info (1.2)"
@@ -728,7 +757,7 @@ fi
 # auto-renew copy or a one-time PassKit payment with recurring Apple Pay. We don't
 # try to detect the disclosure text (too noisy) — we flag it for manual verify.
 set_rule "applepay-recurring-disclosure"
-if [[ -n "$IOS_DIR" ]] && grep -rqE 'PKRecurringPaymentRequest' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+if [[ -n "$IOS_DIR" ]] && grep -rqE 'PKRecurringPaymentRequest' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
   warn "4.9 Apple Pay — recurring Apple Pay (PKRecurringPaymentRequest) detected; verify you disclose the renewal term, what's provided, the charges, and how to cancel before purchase (4.9)"
 fi
 
@@ -739,9 +768,9 @@ fi
 # use the system SKStoreReviewController / requestReview API.
 set_rule "custom-review-prompt"
 if [[ -n "$IOS_DIR" ]]; then
-  review_link=$(grep -rlE 'write-review|action=write-review|itms-apps[^"]*review' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  review_link=$(grep -rlE 'write-review|action=write-review|itms-apps[^"]*review' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   if [[ -n "$review_link" ]]; then
-    if grep -rqE 'requestReview|SKStoreReviewController|\.requestReview' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+    if grep -rqE 'requestReview|SKStoreReviewController|\.requestReview' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
       pass "5.6.1 App reviews — uses the system requestReview API alongside the review link"
     else
       warn "5.6.1 App reviews — a direct App Store review link/prompt was found (e.g. $(basename "$review_link")) but no system requestReview (SKStoreReviewController) call; Apple disallows custom review prompts (5.6.1)"
@@ -805,8 +834,8 @@ fi
 # Personal health information must not be stored in iCloud, and HealthKit data
 # may not be used for advertising/marketing.
 set_rule "health-icloud-sync"
-if [[ -n "$IOS_DIR" ]] && grep -rqE 'import HealthKit|HKHealthStore' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
-  if grep -rqE 'import CloudKit|CKRecord|CKContainer|NSUbiquitousKeyValueStore|NSUbiquitousContainer' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+if [[ -n "$IOS_DIR" ]] && grep -rqE 'import HealthKit|HKHealthStore' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
+  if grep -rqE 'import CloudKit|CKRecord|CKContainer|NSUbiquitousKeyValueStore|NSUbiquitousContainer' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
     warn "5.1.3 Health data — HealthKit and iCloud/CloudKit are both used; personal health information must not be stored in iCloud (5.1.3). Verify HealthKit data is not synced to iCloud."
   else
     pass "5.1.3 Health data — HealthKit used without an obvious iCloud sync path"
@@ -820,7 +849,7 @@ fi
 # on-screen before use, and may not sell/share data.
 set_rule "vpn-networkextension"
 if [[ -n "$IOS_DIR" ]]; then
-  vpn_use=$(grep -rlE 'NEVPNManager|NETunnelProviderManager|NEPacketTunnelProvider|NEVPNProtocol' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  vpn_use=$(grep -rlE 'NEVPNManager|NETunnelProviderManager|NEPacketTunnelProvider|NEVPNProtocol' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   if [[ -n "$vpn_use" ]]; then
     warn "5.4 VPN — NetworkExtension/NEVPNManager usage detected (e.g. $(basename "$vpn_use")); VPN apps must be offered by an organization account, disclose data collection on-screen before use, and not sell/share data (5.4). Verify compliance."
   fi
@@ -835,7 +864,7 @@ fi
 # the reviewer-prep notes. Social-only logins are not gated here (too noisy).
 set_rule "demo-account"
 if [[ -n "$IOS_DIR" ]]; then
-  auth_signal=$(grep -rlE 'SecureField' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  auth_signal=$(grep -rlE 'SecureField' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   [[ -z "$auth_signal" ]] && auth_signal=$(find "$IOS_DIR" "${PRUNE[@]}" \( -name '*Login*View*.swift' -o -name '*SignIn*View*.swift' \) 2>/dev/null | head -1)
   if [[ -n "$auth_signal" ]]; then
     demo_present=""
@@ -862,7 +891,7 @@ fi
 # JS-bundle OTA for React Native (CodePush) is allowed, so we do NOT flag it.
 set_rule "executable-code-download"
 if [[ -n "$IOS_DIR" ]]; then
-  hotcode=$(grep -rlE 'import JSPatch|JSPatch\.|[Jj][Ss][Pp]atch|import Rollout|Rollout\.|rollout\.io|DynamicCocoa|import SwiftPatch' "$IOS_DIR" --include="*.swift" --include="*.m" --include="*.h" 2>/dev/null | head -1)
+  hotcode=$(grep -rlE 'import JSPatch|JSPatch\.|[Jj][Ss][Pp]atch|import Rollout|Rollout\.|rollout\.io|DynamicCocoa|import SwiftPatch' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   if [[ -n "$hotcode" ]]; then
     warn "2.5.2 Executable code — a hot-patch / remote-code framework was detected (e.g. $(basename "$hotcode")); apps may not download or run code that changes features (JSPatch/Rollout-style native hot-patching). Allowed JS-bundle OTA (e.g. React Native CodePush) is fine — verify this is not native hot-patching (2.5.2)"
   fi
@@ -882,13 +911,13 @@ if [[ -f "$INFO_PLIST" && -n "$IOS_DIR" ]]; then
     while IFS= read -r m; do
       [[ -z "$m" ]] && continue
       case "$m" in
-        location) grep -rqE 'CLLocationManager|CoreLocation' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused location" ;;
-        audio) grep -rqE 'AVAudioSession|AVPlayer|AVAudioPlayer|AVQueuePlayer|AVAudioEngine|AVKit|VideoPlayer|AVPlayerViewController|MPMusicPlayerController|MPNowPlayingInfoCenter' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused audio" ;;
-        voip) grep -rqE 'PushKit|PKPushRegistry|CallKit|CXProvider' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused voip" ;;
-        fetch) grep -rqE 'BGAppRefreshTask|BGTaskScheduler|BackgroundTasks|setMinimumBackgroundFetchInterval|performFetchWithCompletionHandler' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused fetch" ;;
-        processing) grep -rqE 'BGProcessingTask|BGTaskScheduler|BackgroundTasks' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused processing" ;;
-        bluetooth-central|bluetooth-peripheral) grep -rqE 'CoreBluetooth|CBCentralManager|CBPeripheralManager' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused $m" ;;
-        remote-notification) grep -rqE 'didReceiveRemoteNotification|UNUserNotificationCenter|registerForRemoteNotifications' "$IOS_DIR" --include="*.swift" 2>/dev/null || unused="$unused remote-notification" ;;
+        location) grep -rqE 'CLLocationManager|CoreLocation' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null || unused="$unused location" ;;
+        audio) grep -rqE 'AVAudioSession|AVPlayer|AVAudioPlayer|AVQueuePlayer|AVAudioEngine|AVKit|VideoPlayer|AVPlayerViewController|MPMusicPlayerController|MPNowPlayingInfoCenter' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null || unused="$unused audio" ;;
+        voip) grep -rqE 'PushKit|PKPushRegistry|CallKit|CXProvider' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null || unused="$unused voip" ;;
+        fetch) grep -rqE 'BGAppRefreshTask|BGTaskScheduler|BackgroundTasks|setMinimumBackgroundFetchInterval|performFetchWithCompletionHandler' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null || unused="$unused fetch" ;;
+        processing) grep -rqE 'BGProcessingTask|BGTaskScheduler|BackgroundTasks' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null || unused="$unused processing" ;;
+        bluetooth-central|bluetooth-peripheral) grep -rqE 'CoreBluetooth|CBCentralManager|CBPeripheralManager' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null || unused="$unused $m" ;;
+        remote-notification) grep -rqE 'didReceiveRemoteNotification|UNUserNotificationCenter|registerForRemoteNotifications' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null || unused="$unused remote-notification" ;;
       esac
     done <<< "$modes"
     if [[ -n "$unused" ]]; then
@@ -904,7 +933,7 @@ fi
 # ===================================================================
 set_rule "crypto-wallet-mining"
 if [[ -n "$IOS_DIR" ]]; then
-  crypto_sdk=$(grep -rlE 'import Web3|web3swift|Web3Swift|WalletConnect|TrustWalletCore|CoinbaseWalletSDK|SolanaSwift|CryptoMining|coinhive|MoneroMiner' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  crypto_sdk=$(grep -rlE 'import Web3|web3swift|Web3Swift|WalletConnect|TrustWalletCore|CoinbaseWalletSDK|SolanaSwift|CryptoMining|coinhive|MoneroMiner' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   if [[ -n "$crypto_sdk" ]]; then
     warn "3.1.5(a) Cryptocurrency — a crypto wallet/exchange/mining signal was detected (e.g. $(basename "$crypto_sdk")); wallets & exchanges have entity and licensing requirements, and on-device mining is not permitted (3.1.5(a)). Verify eligibility."
   fi
@@ -918,7 +947,7 @@ fi
 # files. WARN (verify) — this is the most false-positive-prone of the batch.
 set_rule "webview-wrapper"
 if [[ -n "$IOS_DIR" ]]; then
-  if grep -rqE 'WKWebView' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+  if grep -rqE 'WKWebView' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
     swift_n=$(find "$IOS_DIR" "${PRUNE[@]}" -name '*.swift' 2>/dev/null | wc -l | tr -d ' ')
     if (( swift_n > 0 && swift_n <= 4 )); then
       warn "4.2.3 Minimum functionality — the app appears to be a WKWebView wrapper with only $swift_n Swift file(s); a thin wrapper around a website is rejected under 4.2.3. Add native value, or verify this is a real app rather than a repackaged site."
@@ -931,7 +960,7 @@ fi
 # ===================================================================
 set_rule "remote-desktop"
 if [[ -n "$IOS_DIR" ]]; then
-  remote_desktop=$(grep -rlE 'import libvncclient|LibVNC|VNCClient|RDPSession|RDPKit|RemoteDesktopClient|import FreeRDP|JumpDesktop' "$IOS_DIR" --include="*.swift" --include="*.m" 2>/dev/null | head -1)
+  remote_desktop=$(grep -rlE 'import libvncclient|LibVNC|VNCClient|RDPSession|RDPKit|RemoteDesktopClient|import FreeRDP|JumpDesktop' "$IOS_DIR" "${SRC_INC[@]}" --include="*.m" 2>/dev/null | head -1)
   if [[ -n "$remote_desktop" ]]; then
     warn "4.2.7 Remote desktop — a remote-desktop/mirroring signal was detected (e.g. $(basename "$remote_desktop")); host-mirroring apps must only show/control the owner's host, display host content (not App Store content), and be free or use IAP (4.2.7). Verify."
   fi
@@ -954,9 +983,9 @@ fi
 # for an in-app deletion path. Deletion via a web page is missed → WARN, not FAIL.
 set_rule "account-no-delete"
 if [[ -n "$IOS_DIR" ]]; then
-  signup=$(grep -rlE 'createUser|signUp|signup|createAccount|registerUser|registerNewUser|Auth\.auth\(\)\.createUser' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  signup=$(grep -rlE 'createUser|signUp|signup|createAccount|registerUser|registerNewUser|Auth\.auth\(\)\.createUser' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   if [[ -n "$signup" ]]; then
-    if grep -rqiE 'delete.?account|account.?deletion|closeAccount|deleteUser|removeAccount|deleteMyAccount' "$IOS_DIR" --include="*.swift" 2>/dev/null; then
+    if grep -rqiE 'delete.?account|account.?deletion|closeAccount|deleteUser|removeAccount|deleteMyAccount' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null; then
       pass "5.1.1(v) Account deletion — account creation present and an in-app account-deletion path was found"
     else
       warn "5.1.1(v) Account deletion — account creation was detected (e.g. $(basename "$signup")) but no in-app account-deletion path found; apps that support account creation must let users delete their account from within the app (5.1.1(v))"
@@ -1001,7 +1030,7 @@ fi
 # ===================================================================
 set_rule "mdm"
 if [[ -n "$IOS_DIR" ]]; then
-  mdm_sig=$(grep -rlE 'import DeviceManagement|MDMConfiguration|ManagedAppConfiguration|com\.apple\.mdm' "$IOS_DIR" --include="*.swift" 2>/dev/null | head -1)
+  mdm_sig=$(grep -rlE 'import DeviceManagement|MDMConfiguration|ManagedAppConfiguration|com\.apple\.mdm' "$IOS_DIR" "${SRC_INC[@]}" 2>/dev/null | head -1)
   [[ -z "$mdm_sig" ]] && mdm_sig=$(grep -rlE 'com\.apple\.configuration\.managed' --include='*.plist' "${GREP_PRUNE[@]}" . 2>/dev/null | pick_shallowest)
   if [[ -n "$mdm_sig" ]]; then
     warn "5.5 MDM — a Mobile Device Management signal was detected (e.g. $(basename "$mdm_sig")); MDM apps require a commercial enterprise/education entity, may request the MDM capability only for that purpose, and must not sell or use the data for other ends (5.5). Verify eligibility."

package/skills/appstore-precheck/scripts/suppress.sh

@@ -8,11 +8,12 @@ _SUPP_PATHS=""        # path globs excluded from scanning, one per line (trailin
 _SUPP_REASON=""       # set by is_suppressed on a hit
 
 # _is_catalog_rule <token> -> 0 if token is a known rule slug.
+# The bound is derived from the catalog itself (rule_slug returns "" past the
+# last rule), so a newly added rule can never be silently unsuppressable again.
 _is_catalog_rule() {
   local n s
   n=1
-  while [[ $n -le 41 ]]; do
-    s="$(rule_slug "$n")"
+  while s="$(rule_slug "$n")" && [[ -n "$s" ]]; do
     [[ "$s" == "$1" ]] && return 0
     n=$((n + 1))
   done

package/skills/appstore-precheck/scripts/thresholds.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# thresholds.sh — the single source of truth for the verdict thresholds.
+# Sourced by verdict.sh and findings.sh so the two renderers can never diverge.
+#
+#   RED    >= RED_FAIL_MIN FAILs
+#   YELLOW >= YELLOW_WARN_MIN WARNs (and no FAIL)
+#   GREEN  otherwise
+
+# shellcheck disable=SC2034  # consumed by the sourcing scripts, not here
+RED_FAIL_MIN=1
+# shellcheck disable=SC2034
+YELLOW_WARN_MIN=5

package/skills/appstore-precheck/scripts/verdict.sh

@@ -47,9 +47,13 @@ fails=$(count '^FAIL:')
 warns=$(count '^WARN:')
 passes=$(count '^PASS:')
 
-if (( fails >= 1 )); then
+# Thresholds live in thresholds.sh (shared with findings.sh's JSON renderer).
+# shellcheck source=thresholds.sh
+. "$(dirname "${BASH_SOURCE[0]}")/thresholds.sh"
+
+if (( fails >= RED_FAIL_MIN )); then
   verdict="RED";    token="remove"; code=1
-elif (( warns >= 5 )); then
+elif (( warns >= YELLOW_WARN_MIN )); then
   verdict="YELLOW"; token="hold";   code=2
 else
   verdict="GREEN";  token="write";  code=0