fix(plugins): resolve residual audit findings across 6 plugins

Fixes surfaced by /audit plugins --adversarial and its follow-up residual-critical/non-critical passes, plus a routing-links checker bug found while validating this commit.

- Fix unrehydrated shell-variable and sentinel-newline bugs across cc_develop, cc_foundry, cc_oss, cc_research, codemap-py — fresh-shell state loss between separate Bash tool calls (CODEX_AVAILABLE, RANGE, SCAN_STATE_FILE and others)
- Harden symlink-unsafe temp-file writes in codemap-py (resolve_index_env.py, parse_deprecate_args.py, setup_scan_env.sh) via O_NOFOLLOW / mktemp+atomic-rename instead of plain redirect
- Add containment guard to codemap-py's locate_scan_query.py Tier-3 cache glob, mirroring the existing Tier-2 guard
- Wire Glob-based file resolution into codemap-py's debrief-coding Step 2 (previously referenced shell vars unresolvable across tool calls and unreadable by the Read tool)
- Fix cross-plugin path-resolution bug in cc_foundry's check_routing_links.py: relative_to() against an absolute plugins_dir always raised ValueError, silently falling back to the source plugin instead of the referenced target plugin
- Fix resolve_skill_subdir.py tier-precedence bug so --local correctly overrides CLAUDE_PLUGIN_ROOT instead of being a silent no-op
- Various smaller fixes: BSD-incompatible grep -oP, sentinel project-scoping collision, stale .js hook references, cicd-steward unmarked write, Confidence block format, orphan-risk markers
- Bump versions: cc_develop 0.18.3, cc_foundry 0.38.4, cc_oss 0.24.3, cc_research 0.12.6, codemap-py 0.28.4 (.claude-plugin + .codex-plugin), codex-rig 0.4.2

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

Author: Borda

plugins/cc_develop/.claude-plugin/plugin.json

@@ -7,5 +7,5 @@
   "license": "Apache-2.0",
   "name": "develop",
   "repository": "https://github.com/Borda/AI-Rig",
-  "version": "0.18.2"
+  "version": "0.18.3"
 }

plugins/cc_develop/README.md

@@ -377,6 +377,7 @@ ______________________________________________________________________
 
 | Flag                   | Description                                                                                                                                                                                                                                     |
 | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `--issue <N>`          | Force issue mode — fetch GitHub issue `<N>` instead of inferring mode from a bare numeric argument. Value form only; `--issue=123` is not supported by design (mode-detect matches the bare token).                                             |
 | `--repo <owner/repo>`  | Route issue fetch to upstream repo. Use when working in fork and issue on original repo (e.g. `--repo owner/my-project`).                                                                                                                       |
 | `--team`               | Spawn 2-3 `foundry:sw-engineer` teammates, each investigating distinct root-cause hypothesis independently. Use when root cause unclear after initial analysis, or failure spans 3+ modules                                                     |
 | `--worktree`           | Run the investigation in an isolated git worktree (base: HEAD) so reproduction attempts never touch main sources. Diagnosis file is written to the **main tree** so `/develop:fix` can read it.                                                 |
@@ -646,7 +647,7 @@ claude plugin install foundry@borda-ai-rig
 
 ### A question is blocked with "develop:review report gate"
 
-`enforce-review-header.js` denied an `AskUserQuestion` call because `.reports/review/<timestamp>/review-report.md` does not exist — the review reached agent launch but never consolidated its findings into a report. Finish the consolidation step and print the report `---` header; the question then goes through. The gate deactivates two hours after a run starts, so an aborted review never blocks later questions permanently.
+`enforce-review-header.js` denied an `AskUserQuestion` call because `.reports/review/<timestamp>/review-report.md` does not exist — the review reached agent launch but never consolidated its findings into a report. Finish the consolidation step and print the report `---` header; the question then goes through. The gate deactivates two hours after a run starts, so an aborted review never blocks later questions permanently. When no review is actually in flight and an aborted run simply left its sentinel behind, there is no need to wait out that window: the denial message names the sentinel file, so `rm -f`-ing that path and re-issuing the question clears the block immediately.
 
 ### Demo gate passes (exit 0) when it should fail
 

plugins/cc_develop/bin/dev_parse_args.py

@@ -459,11 +459,11 @@ def write_skill_files(skill: str, arguments: str, tmp_dir: Path | None = None) -
 
     for spec, legacy in entries:
         value = values[spec.var]
-        (target_dir / _per_skill_filename(skill, spec)).write_text(value)
+        (target_dir / _per_skill_filename(skill, spec)).write_text(f"{value}\n")
         if legacy is not None:
-            (target_dir / f"{legacy}-{_csid()}").write_text(value)
+            (target_dir / f"{legacy}-{_csid()}").write_text(f"{value}\n")
     # Write CLEAN_ARGS (flags stripped) to a per-skill file so callers avoid eval
-    (target_dir / f"dev-{skill}-clean-args-{_csid()}").write_text(_clean)
+    (target_dir / f"dev-{skill}-clean-args-{_csid()}").write_text(f"{_clean}\n")
     return values
 
 

plugins/cc_develop/bin/dev_run_dir.py

@@ -4,8 +4,8 @@
 With ``--sentinel <name>``, also touches ``<sentinel-dir>/<name>-<ts>``.
 Sentinel name is sanitized to ``[a-zA-Z0-9_-]+`` to prevent path traversal.
 
-Sentinel dir mirrors JS getSentinelDir(): ``/tmp`` on POSIX,
-``tempfile.gettempdir()`` on Windows — matches commit-guard.js and task-log.js.
+Sentinel dir honors ``$TMPDIR`` when set, else ``tempfile.gettempdir()`` — the Python
+equivalent of the shell ``${TMPDIR:-/tmp}`` idiom callers use to poll the sentinel.
 
 Usage:
     python dev_run_dir.py [--sentinel <name>]
@@ -21,6 +21,7 @@
 from __future__ import annotations
 
 import argparse
+import os
 import re
 import sys
 import tempfile
@@ -31,12 +32,14 @@
 
 
 def _sentinel_dir() -> Path:
-    """Return ``/tmp`` on POSIX or ``tempfile.gettempdir()`` on Windows.
+    """Return ``$TMPDIR`` when set, else ``tempfile.gettempdir()``.
 
-    Mirrors JS ``getSentinelDir()`` so sentinel paths match hook expectations
-    on all platforms while preserving the existing ``/tmp`` path on POSIX.
+    Matches the shell ``${TMPDIR:-/tmp}`` idiom used by callers that poll this sentinel,
+    so both sides resolve to the same directory on every platform. ``os.environ`` is read
+    first because ``tempfile.gettempdir()`` caches its result on first call and would not
+    observe a later ``TMPDIR`` change.
     """
-    return Path(tempfile.gettempdir()) if sys.platform == "win32" else Path("/tmp")
+    return Path(os.environ.get("TMPDIR") or tempfile.gettempdir())
 
 
 def main(argv: list[str] | None = None) -> int:
@@ -67,7 +70,16 @@ def main(argv: list[str] | None = None) -> int:
     if args.sentinel:
         sentinel_name = _SAFE_NAME_RE.sub("", args.sentinel)
         if sentinel_name:
-            (_sentinel_dir() / f"{sentinel_name}-{ts}").touch()
+            sentinel_path = _sentinel_dir() / f"{sentinel_name}-{ts}"
+            # O_NOFOLLOW refuses a pre-planted symlink in the world-writable temp dir;
+            # getattr keeps this working on native Windows, where the flag is absent.
+            flags = os.O_CREAT | os.O_WRONLY | getattr(os, "O_NOFOLLOW", 0)
+            try:
+                fd = os.open(sentinel_path, flags, 0o600)
+            except OSError:
+                pass  # sentinel skipped — never abort the caller's always-exit-0 contract
+            else:
+                os.close(fd)
 
     sys.stdout.write(run_dir.as_posix() + "\n")
     return 0

plugins/cc_develop/bin/setup_worktree.py

@@ -7,8 +7,8 @@
 With ``--sentinel <name>``, also touches ``<sentinel-dir>/<name>-<ts>``.
 Sentinel name is sanitized to ``[a-zA-Z0-9_-]+`` to prevent path traversal.
 
-Sentinel dir mirrors JS getSentinelDir(): ``/tmp`` on POSIX,
-``tempfile.gettempdir()`` on Windows.
+Sentinel dir honors ``$TMPDIR`` when set, else ``tempfile.gettempdir()`` — the Python
+equivalent of the shell ``${TMPDIR:-/tmp}`` idiom callers use to poll the sentinel.
 
 ``--sentinel`` and its name are parsed by a direct ``argv`` check rather than argparse's
 matcher so that the legacy always-exit-0 contract is preserved — a missing name, an unknown
@@ -29,6 +29,7 @@
 from __future__ import annotations
 
 import argparse
+import os
 import re
 import sys
 import tempfile
@@ -39,12 +40,14 @@
 
 
 def _sentinel_dir() -> Path:
-    """Return ``/tmp`` on POSIX or ``tempfile.gettempdir()`` on Windows.
+    """Return ``$TMPDIR`` when set, else ``tempfile.gettempdir()``.
 
-    Mirrors JS ``getSentinelDir()`` so sentinel paths match hook expectations
-    on all platforms while preserving the existing ``/tmp`` path on POSIX.
+    Matches the shell ``${TMPDIR:-/tmp}`` idiom used by callers that poll this sentinel,
+    so both sides resolve to the same directory on every platform. ``os.environ`` is read
+    first because ``tempfile.gettempdir()`` caches its result on first call and would not
+    observe a later ``TMPDIR`` change.
     """
-    return Path(tempfile.gettempdir()) if sys.platform == "win32" else Path("/tmp")
+    return Path(os.environ.get("TMPDIR") or tempfile.gettempdir())
 
 
 def main(argv: list[str] | None = None) -> int:
@@ -80,7 +83,16 @@ def main(argv: list[str] | None = None) -> int:
     if len(args) >= 2 and args[0] == "--sentinel" and args[1]:
         sentinel_name = _SAFE_NAME_RE.sub("", args[1])
         if sentinel_name:
-            (_sentinel_dir() / f"{sentinel_name}-{ts}").touch()
+            sentinel_path = _sentinel_dir() / f"{sentinel_name}-{ts}"
+            # O_NOFOLLOW refuses a pre-planted symlink in the world-writable temp dir;
+            # getattr keeps this working on native Windows, where the flag is absent.
+            flags = os.O_CREAT | os.O_WRONLY | getattr(os, "O_NOFOLLOW", 0)
+            try:
+                fd = os.open(sentinel_path, flags, 0o600)
+            except OSError:
+                pass  # sentinel skipped — never abort the caller's always-exit-0 contract
+            else:
+                os.close(fd)
 
     sys.stdout.write(f"{ts}\n{run_dir.as_posix()}\n")
     return 0

plugins/cc_develop/hooks/enforce-review-header.js

@@ -154,7 +154,9 @@ function denyReason(sentinelPath, now) {
     "(print report header) have not completed. Go back: spawn the consolidator agent and let it write " +
     `${REPORT_FILENAME}, then Read that file and print its \`---\` header block to the terminal. Call ` +
     "AskUserQuestion only after that header has actually appeared in your response. If the consolidator " +
-    "genuinely cannot run, report that failure and stop instead of asking the user."
+    "genuinely cannot run, report that failure and stop instead of asking the user. If no develop:review is " +
+    "actually in flight (an aborted run left this sentinel behind), clear it with: " +
+    `\`rm -f ${sentinelPath}\` — then re-issue the question.`
   );
 }
 

plugins/cc_develop/rules/quality-gates.md

@@ -6,11 +6,13 @@ paths:
 
 ## Confidence Block (required on all analysis tasks)
 
+<!-- policy-sibling: plugins/cc_oss/rules/quality-gates.md, plugins/cc_foundry/rules/quality-gates.md, plugins/cc_research/rules/quality-gates.md -->
+
 Every analysis agent **must** end with:
 
 ```markdown
 ## Confidence
-**Score**: 0.N — [high ≥0.9 | moderate 0.8–0.9 | low <0.8 ⚠]
+**Score**: 0.N — [high ≥0.9 | moderate 0.85–0.9 | low <0.85 ⚠]
 **Gaps**:
 - [specific limitation]
                           ← blank line required; Refinements is a peer field, not a sub-bullet
@@ -22,7 +24,7 @@ Every analysis agent **must** end with:
 
 - Omit **Refinements** if 0 passes — omit **Gaps** bullets if none, keep **Gaps** header
 - **Score**, **Gaps**, **Refinements** = peer top-level fields — never nest Refinements under Gaps; blank line before **Refinements** required
-- Score < 0.8 → ⚠ on score line AND next line: "orchestrator may re-run with the specific gap addressed"
+- Score < 0.85 → ⚠ on score line AND next line: "orchestrator may re-run with the specific gap addressed"
 - Gaps = primary signal — surface implicit limitations for re-run decisions
 
 ## Internal Quality Loop (analysis tasks only)

plugins/cc_develop/skills/_shared/runner-detection.md

@@ -3,23 +3,39 @@
 Detect test runner once at skill start:
 
 ```bash
+export CSID="${CLAUDE_CODE_SESSION_ID:-$PPID}"
 if [ -f "uv.lock" ] || grep -q '\[tool\.uv\]' pyproject.toml 2>/dev/null; then TEST_CMD="uv run pytest"
 elif [ -f "poetry.lock" ] || grep -q '\[tool\.poetry\]' pyproject.toml 2>/dev/null; then TEST_CMD="poetry run pytest"
 elif [ -f "tox.ini" ]; then TEST_CMD="tox -q"  # avoids hard-coded py3 env name
 elif [ -f "Makefile" ] && grep -q '^test:' Makefile 2>/dev/null; then TEST_CMD="make test"
 else TEST_CMD="python -m pytest"; fi
+echo "$TEST_CMD" > "${TMPDIR:-/tmp}/dev-test-cmd-${CSID}"
 ```
 
 Use `$TEST_CMD` for full suite runs.
 
 ```bash
 # tox/make reject --tb and ::node selectors — derive unwrapped PYTEST_CMD
+export CSID="${CLAUDE_CODE_SESSION_ID:-$PPID}"
+IFS= read -r TEST_CMD < "${TMPDIR:-/tmp}/dev-test-cmd-${CSID}" 2>/dev/null || TEST_CMD="python -m pytest"
 case "$TEST_CMD" in
     tox*|"make test")
         if command -v uv >/dev/null 2>&1; then PYTEST_CMD="uv run pytest"
         else PYTEST_CMD="python -m pytest"; fi ;;
     *) PYTEST_CMD="$TEST_CMD" ;;
 esac
+echo "$PYTEST_CMD" > "${TMPDIR:-/tmp}/dev-pytest-cmd-${CSID}"
+echo "TEST_CMD=$TEST_CMD PYTEST_CMD=$PYTEST_CMD"
 ```
 
 Use `$PYTEST_CMD` for single test file/node with pytest-specific flags (`--tb`, `::test_name`); `$TEST_CMD` for full suite.
+
+**Both values are persisted, and every later block must re-read them** — bash state is lost between Bash() calls, so a bare `$PYTEST_CMD` in a later block expands to the empty string and the command silently becomes `--tb=... -v` → `command not found` → exit 127, which downstream exit-code checks misread as a genuine test failure. Read back with:
+
+```bash
+export CSID="${CLAUDE_CODE_SESSION_ID:-$PPID}"
+IFS= read -r PYTEST_CMD < "${TMPDIR:-/tmp}/dev-pytest-cmd-${CSID}" 2>/dev/null || PYTEST_CMD=""
+IFS= read -r TEST_CMD   < "${TMPDIR:-/tmp}/dev-test-cmd-${CSID}"   2>/dev/null || TEST_CMD=""
+```
+
+Guard on emptiness before running — never let an unresolved command reach the shell.