Optional-skill scripts can run inside the backend process, where a child
that inherits fd 0 can end the TUI/desktop JSON-RPC session with stdin EOF
(#14036). Add optional-skills/ to the guard's context dirs.
SKIP_DIRS used to match any part of the absolute path, so a context dir
named optional-skills (and any subdir named scripts, skills, gateway, cron
or hermes_cli) was never scanned. Match only "tests", relative to each
context dir.
The wider scan flags three calls; they now pass stdin=subprocess.DEVNULL:
comfyui auto_fix_deps.run_cmd, unbroker crypto.ensure_identity and
ast-grep cmd_install (its installers do not read stdin). Touching those
lines makes the code-health ratchet treat their missing timeout as new:
age-keygen gets timeout=30; the comfyui node/model installs and the
ast-grep installer download for as long as the network needs, so they
carry a reviewed HX006 allow comment instead.
6f4a16e1a8