feat(harness-ops): mask control-claude-code captures and launch changed plugins #11390

Parent

Refs #8651. Evidence-verification plan: Brief and acceptance criteria at #11364 (comment); Design and Plan comments are on #11364.

Depends on

• feat(app-control): add the control-skill Mask contract and publishable set #11387
• feat(harness-ops): let control-claude-code run unattended on sessions it launches #11386

Outcome

control-claude-code masks account, usage and cwd text in its screenshots and recordings, writes <file>.txt sidecars, and launches one session per changed plugin.

Demo: run the driver test; the fixture buffer holding user@example.com is absent from the masked buffer and the sidecar.

Plan (phase S4b)

Satisfies: AC8, AC1
Size Medium. Depends on: S3 (#11387), S4a (#11386). Plugin: harness-ops. Design: T3, Contracts C2.

• First work item: verify tui-test buffer access for masked rendering (Load-bearing assumption row 4).
• SKILL.md ## Mask: account/email/org lines, usage/limit lines, cwd, with an as-of Claude Code version and recheck trigger, plus a fixture from a real captured screen; values: for the signed-in email/org. maxEntryPoints (judgment: 6) in config. One Launch per changed plugin (single pluginDir per plugins/harness-ops/skills/control-claude-code/driver/driver.mjs:96-100), with a test. Run /app-control:map refresh on the control skill so sources cover hook scripts, skill reference//scripts/, and agents. Driver screenshot/record apply masks and write <file>.txt sidecars; Launch takes plugin dirs from <changed files>.
• Sanity Check: driver.test.mjs case feeds a fixture buffer holding user@example.com and asserts the masked buffer passed to the renderer and the sidecar both lack it; /app-control:map check plugins/harness-ops/skills/control-claude-code reports no missing ## Mask.

Design excerpt

• harness-ops / control-claude-code (owns Claude Code knowledge): drops Attended runs only.,
  adds ## Mask, credentials.ci, maxCaptures, masked rendering plus text sidecars in the driver,
  Ready accepting the named CI credential's key source, plugin dir from changed files.

components:
  schemas:
    MaskSection:             # C2, control skill hub "## Mask" (markdown, shown as data)
      oneOf:
        - type: array        # lines "- <label> | <regex>"
          items: {type: object, required: [label, pattern], properties: {label: {type: string}, pattern: {type: string}}}
        - type: string       # "none: <reason>"

Acceptance criteria

Brief criteria this slice satisfies:

• AC8: A passing PR carries one comment linking redacted evidence; account and usage lines never appear in uploaded captures.
• AC1: A PR whose diff changes something visible in the interface gets screenshots or video captured and judged against its acceptance criteria before merge.

Done when:

• Sanity Check passes: driver.test.mjs case feeds a fixture buffer holding user@example.com and asserts the masked buffer passed to the renderer and the sidecar both lack it; /app-control:map check plugins/harness-ops/skills/control-claude-code reports no missing ## Mask.
• The tui-test buffer-access check (first work item) is recorded in the PR body, with the fallback used if it fails
• maxEntryPoints (6) is in config and enforced
• The plugin's version and CHANGELOG are bumped per the repository's release convention
• ci-status is green on the PR head

Held for owner decision

Dependencies only; no scope is carved out of this slice. It builds on S3's masking contract (#11387) and S4a (#11386).

🤖 Generated with Claude Code

https://claude.ai/code/session_01UJUn7KoThXoYQoxfvdCVi7