fix: harden skill trigger phrasing and guard source-only bypass

- Standardize skill dependency triggers to use **立即执行：** / **Immediately execute:** format for writing-plans, executing-plans, and subagent-driven-development in both zh and en SKILL.md
- Move ARGUMENTS/Language constraints to post-load section per Skill trigger phrasing rules
- Prevent COMET_GUARD_SOURCE_ONLY=1 from silently bypassing guard validations when script is executed directly (exit 1 instead of exit 0)

Author: benym

CHANGELOG.md

@@ -355,29 +355,6 @@ All notable changes to @rpamis/comet will be documented in this file.
 - Added Superpowers coverage for valid `skills` CLI agent mappings and multi-agent argument formatting
 - Smoke-tested project and global initialization outputs for all 28 supported platforms in isolated temporary directories
 
-## What's Changed [0.3.6] - 2026-06-02
-
-### Added
-
-- **Plan-ready build pause state**: Added `build_pause` as a dedicated build-phase pause marker so Comet can stop after plan generation without confusing the pause with the actual execution method.
-- **Plan-ready pause design**: Added a design record for the model-switching pause workflow, covering recovery behavior, stale pause handling, and plan-missing remediation.
-- **Auto transition config**: Added `auto_transition` so teams can keep phase state updates while disabling automatic invocation of the next Comet skill.
-
-### Changed
-
-- **Build recovery routing**: `/comet` and `/comet-build` now recognize `build_pause: plan-ready`, resume without regenerating the plan, and route stale pause states back to the correct build action.
-- **Workflow output language**: OpenSpec and Superpowers prompts now carry the triggering request language into generated artifacts and workflow feedback.
-- **Executing-plans review gate**: `comet-build` now requires loading `requesting-code-review` before build-to-verify guard execution when `build_mode: executing-plans`.
-
-### Fixed
-
-- **Init skip-all behavior**: `comet init` bulk skip/overwrite choices now affect only components that already exist, preventing skip-all from skipping uninstalled components.
-- **Bash runner recovery**: Shell runner handling is more resilient across platform-specific Bash detection and argument formatting cases.
-
-### Tests
-
-- **Plan-ready and auto-transition coverage**: Added regression coverage for `build_pause`, `auto_transition` defaults/configuration, manual transition messaging, output-language propagation, executing-plans review requirements, and init skip-all existing-component behavior.
-
 ## What's Changed [0.2.6] - 2026-05-23
 
 ### Added

assets/skills-zh/comet-build/SKILL.md

@@ -38,8 +38,7 @@ fi
 
 你是实施计划专家。基于以下输入创建实施计划：
 
-1. 使用 Skill 工具加载 Superpowers `writing-plans` 技能
-   - ARGUMENTS 必须包含：`Language: 使用触发本次工作流的用户请求语言输出`
+1. **立即执行：** 使用 Skill 工具加载 Superpowers `writing-plans` 技能。禁止跳过此步骤。技能加载后，ARGUMENTS 必须包含：`Language: 使用触发本次工作流的用户请求语言输出`
 2. 读取 Design Doc（`docs/superpowers/specs/` 下的技术设计文档）
 3. 读取 `openspec/changes/<name>/tasks.md`（任务边界）
 4. 按技能指引创建计划
@@ -189,10 +188,8 @@ git commit -m "chore: add implementation plan"
 
 **执行计划**：必须按 `build_mode` 的真实运行位置处理。
 
-加载 `subagent-driven-development` 或 `executing-plans` 时，ARGUMENTS 必须包含与 Step 1 相同的 Language 约束。
-
-- `build_mode: executing-plans`：在主窗口使用 Skill 工具加载 Superpowers `executing-plans` 技能并按计划执行。若该技能不可用，停止流程并提示安装或启用对应技能，不要用普通对话替代该步骤。
-- `build_mode: subagent-driven-development`：主窗口只负责协调，不得把 `subagent-driven-development` 当作当前主窗口的执行技能直接运行；必须使用已确认的当前平台真实后台 subagent / Task / multi-agent 调度能力，把下一个未完成任务派发到后台 subagent。派发每个 subagent 时，必须在 prompt 中明确要求：任务完成并通过验证后，立即勾选 `docs/superpowers/plans/<plan-file>.md` 中对应的计划任务；若该计划任务映射到 `openspec/changes/<name>/tasks.md` 中的任务，也同步将该 OpenSpec 任务从 `- [ ]` 改为 `- [x]`；若 plan 新增了 OpenSpec 中没有的一步，只勾选 plan 中对应任务即可。不得只更新内置 Todo 或对话内 checklist。后台 subagent 需要自行加载 Superpowers `subagent-driven-development` 相关执行流程，并按其指引完成实现、检查和提交。
+- `build_mode: executing-plans`：**立即执行：** 使用 Skill 工具加载 Superpowers `executing-plans` 技能。禁止跳过此步骤。若该技能不可用，停止流程并提示安装或启用对应技能，不要用普通对话替代该步骤。技能加载后，ARGUMENTS 必须包含与 Step 1 相同的 Language 约束：`Language: 使用触发本次工作流的用户请求语言输出`。按计划执行。
+- `build_mode: subagent-driven-development`：主窗口只负责协调，不得把 `subagent-driven-development` 当作当前主窗口的执行技能直接运行；必须使用已确认的当前平台真实后台 subagent / Task / multi-agent 调度能力，把下一个未完成任务派发到后台 subagent。派发每个 subagent 时，必须在 prompt 中明确要求：技能加载后 ARGUMENTS 必须包含与 Step 1 相同的 Language 约束：`Language: 使用触发本次工作流的用户请求语言输出`；任务完成并通过验证后，立即勾选 `docs/superpowers/plans/<plan-file>.md` 中对应的计划任务；若该计划任务映射到 `openspec/changes/<name>/tasks.md` 中的任务，也同步将该 OpenSpec 任务从 `- [ ]` 改为 `- [x]`；若 plan 新增了 OpenSpec 中没有的一步，只勾选 plan 中对应任务即可。不得只更新内置 Todo 或对话内 checklist。后台 subagent 需要自行加载 Superpowers `subagent-driven-development` 相关执行流程，并按其指引完成实现、检查和提交。
 - 如果当前平台没有真实后台 subagent / Task / multi-agent 调度能力，必须暂停并等待用户选择改用主窗口执行。用户选择改用主窗口执行后，必须先运行 `"$COMET_BASH" "$COMET_STATE" set <name> build_mode executing-plans`，再按 `build_mode: executing-plans` 分支加载 Superpowers `executing-plans` 技能。用户未明确选择前，不得继续执行任务。
 
 执行开始后，按所选分支完成：

assets/skills/comet-build/SKILL.md

@@ -38,8 +38,7 @@ Create the implementation plan through a subagent, avoiding planning skill occup
 
 You are an implementation planning expert. Create an implementation plan based on the following inputs:
 
-1. Use the Skill tool to load the Superpowers `writing-plans` skill
-   - ARGUMENTS must include: `Language: Use the language of the user request that triggered this workflow`
+1. **Immediately execute:** Use the Skill tool to load the Superpowers `writing-plans` skill. Skipping this step is prohibited. After the skill loads, ARGUMENTS must include: `Language: Use the language of the user request that triggered this workflow`
 2. Read the Design Doc (technical design document under `docs/superpowers/specs/`)
 3. Read `openspec/changes/<name>/tasks.md` (task boundaries)
 4. Follow the skill's guidance to create the plan
@@ -189,10 +188,8 @@ git commit -m "chore: add implementation plan"
 
 **Execute plan**: Must handle execution according to the actual runtime of `build_mode`.
 
-When loading `subagent-driven-development` or `executing-plans`, ARGUMENTS must include the same Language constraint as Step 1.
-
-- `build_mode: executing-plans`: Use the Skill tool in the main window to load the Superpowers `executing-plans` skill and execute according to plan. If the skill is unavailable, stop the process and prompt to install or enable the corresponding skill; do not substitute with normal conversation.
-- `build_mode: subagent-driven-development`: The main window only coordinates; must not run `subagent-driven-development` as the main window execution skill directly. Must use the confirmed real background subagent / Task / multi-agent dispatch capability to dispatch the next unchecked task to a background subagent. When dispatching each subagent, the prompt must explicitly require: after the task is complete and validated, immediately check off the corresponding plan task in `docs/superpowers/plans/<plan-file>.md`; if that plan task maps to an item in `openspec/changes/<name>/tasks.md`, also change that OpenSpec task from `- [ ]` to `- [x]`; if the plan added a step that does not exist in OpenSpec, only the corresponding plan task needs to be checked off. Do not only update the built-in Todo or an in-chat checklist. The background subagent loads the Superpowers `subagent-driven-development` execution flow on its own and follows its guidance for implementation, review, and commit.
+- `build_mode: executing-plans`: **Immediately execute:** Use the Skill tool to load the Superpowers `executing-plans` skill. Skipping this step is prohibited. If the skill is unavailable, stop the process and prompt to install or enable the corresponding skill; do not substitute with normal conversation. After the skill loads, ARGUMENTS must include the same Language constraint as Step 1: `Language: Use the language of the user request that triggered this workflow`. Execute according to plan.
+- `build_mode: subagent-driven-development`: The main window only coordinates; must not run `subagent-driven-development` as the main window execution skill directly. Must use the confirmed real background subagent / Task / multi-agent dispatch capability to dispatch the next unchecked task to a background subagent. When dispatching each subagent, the prompt must explicitly require: after the skill loads, ARGUMENTS must include the same Language constraint as Step 1: `Language: Use the language of the user request that triggered this workflow`; after the task is complete and validated, immediately check off the corresponding plan task in `docs/superpowers/plans/<plan-file>.md`; if that plan task maps to an item in `openspec/changes/<name>/tasks.md`, also change that OpenSpec task from `- [ ]` to `- [x]`; if the plan added a step that does not exist in OpenSpec, only the corresponding plan task needs to be checked off. Do not only update the built-in Todo or an in-chat checklist. The background subagent loads the Superpowers `subagent-driven-development` execution flow on its own and follows its guidance for implementation, review, and commit.
 - If the current platform has no real background subagent / Task / multi-agent dispatch capability, must pause and wait for the user to choose main window execution instead. After the user chooses, must run `"$COMET_BASH" "$COMET_STATE" set <name> build_mode executing-plans`, then follow the `build_mode: executing-plans` branch to load the Superpowers `executing-plans` skill. Must not continue executing tasks before the user explicitly chooses.
 
 After execution begins, follow the chosen branch to completion:

assets/skills/comet/scripts/comet-guard.sh

@@ -709,7 +709,7 @@ apply_state_update() {
 # --- Main ---
 
 if [ "${COMET_GUARD_SOURCE_ONLY:-0}" = "1" ]; then
-  return 0 2>/dev/null || exit 0
+  return 0 2>/dev/null || { red "ERROR: COMET_GUARD_SOURCE_ONLY=1 is only for sourcing, not direct execution" >&2; exit 1; }
 fi
 
 case "$PHASE" in

test/ts/skills.test.ts

@@ -440,11 +440,15 @@ describe('skills', () => {
       expect(zhHotfix).toContain('自动衔接下一阶段');
       expect(zhHotfix).toContain('"$COMET_BASH" "$COMET_STATE" next <name>');
       expect(zhHotfix).toContain('`NEXT: auto`');
-      expect(zhHotfix).toContain('`phase: build` 返回 `comet-hotfix`，`verify` 返回 `comet-verify`，`archive` 返回 `comet-archive`');
+      expect(zhHotfix).toContain(
+        '`phase: build` 返回 `comet-hotfix`，`verify` 返回 `comet-verify`，`archive` 返回 `comet-archive`',
+      );
       expect(zhTweak).toContain('自动衔接下一阶段');
       expect(zhTweak).toContain('"$COMET_BASH" "$COMET_STATE" next <name>');
       expect(zhTweak).toContain('`NEXT: auto`');
-      expect(zhTweak).toContain('`phase: build` 返回 `comet-tweak`，`verify` 返回 `comet-verify`，`archive` 返回 `comet-archive`');
+      expect(zhTweak).toContain(
+        '`phase: build` 返回 `comet-tweak`，`verify` 返回 `comet-verify`，`archive` 返回 `comet-archive`',
+      );
     });
   });
 
@@ -701,11 +705,15 @@ describe('skills', () => {
       expect(enHotfix).toContain('Automatic Handoff to Next Phase');
       expect(enHotfix).toContain('"$COMET_BASH" "$COMET_STATE" next <name>');
       expect(enHotfix).toContain('`NEXT: auto`');
-      expect(enHotfix).toContain('`phase: build` returns `comet-hotfix`, `verify` returns `comet-verify`, `archive` returns `comet-archive`');
+      expect(enHotfix).toContain(
+        '`phase: build` returns `comet-hotfix`, `verify` returns `comet-verify`, `archive` returns `comet-archive`',
+      );
       expect(enTweak).toContain('Automatic Handoff to Next Phase');
       expect(enTweak).toContain('"$COMET_BASH" "$COMET_STATE" next <name>');
       expect(enTweak).toContain('`NEXT: auto`');
-      expect(enTweak).toContain('`phase: build` returns `comet-tweak`, `verify` returns `comet-verify`, `archive` returns `comet-archive`');
+      expect(enTweak).toContain(
+        '`phase: build` returns `comet-tweak`, `verify` returns `comet-verify`, `archive` returns `comet-archive`',
+      );
     });
   });