fix: restore scheduled workflow health

[thymikee]

Summary

• Repair both conformance schedules after the Maestro package move: their workflow commands now target the maintained package paths.
• Make Android settings permission reset a real reset for runtime permissions by clearing user-set and user-fixed after revocation, so the next request can show the platform prompt.
• Remove hidden Expo native-tab badges instead of rendering zero/error badge content invisibly; hidden children still become part of the native accessibility label.

Root causes

• The Maestro refactor moved the conformance sources, but two scheduled workflow references remained under scripts/maestro-conformance.
• Android pm revoke alone retains denial flags that suppress subsequent permission prompts.
• Expo Router stringifies hidden badge children into native tab accessibility labels, changing Catalog to an inexact selector.

Existing PR cross-check

• PR fix(test): repair Android replay fixtures against live device reality #1538 includes an Android fixture selector for the badge-label symptom. This PR fixes the app cause and deliberately does not adopt that selector workaround.
• The branch was rebased onto current main, which already includes the dedicated replay-slug ReDoS remediation. All overlapping replay-slug commits/files were removed from this PR.

Validation

• Exact rebased-head Android evidence: microphone deny → reset → test-app request displayed the native Allow Agent Device Tester to record audio? dialog, reported as source: permission.
• Exact rebuilt iOS evidence: the snapshot exposes an exact Catalog button; click label="Catalog" reaches catalog-title.
• Focused Android settings and replay tests: 24 passed.
• Maestro conformance passed with both repaired workflow paths exercised directly.

No user-facing documentation or skills changed: the public command surface is unchanged.

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	1.92 MB	1.92 MB	+98 B
JS gzip	615.5 kB	615.5 kB	+26 B
npm tarball	733.6 kB	733.6 kB	+19 B
npm unpacked	2.57 MB	2.57 MB	+98 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	30.6 ms	30.2 ms	-0.4 ms
CLI --help	62.0 ms	61.6 ms	-0.4 ms

Top changed chunks: no changes in the largest emitted chunks.

[thymikee]

Blocking at 00a6b31: the ReDoS remains. Splitting the alternation leaves /-+$/, whose start is unanchored; on normalized input x + '-'.repeat(n) + x, it retries the hyphen run from every position before $ fails (measured 10k/20k/40k at 33/131/510 ms). CodeQL’s two HIGH annotations are genuine, not infrastructure. The new ---Replay Suite--- tests are non-protective because they pass with the vulnerable implementation. Replace separator trimming with a provably linear shared boundary helper, add an adversarial non-terminal hyphen regression that fails this head, and rerun CodeQL. Output/API compatibility otherwise looks preserved; iOS was merely pending and separate.

[thymikee]

Blocking at b8fc6f3: the scheduled-health fixes themselves target the confirmed missing Maestro paths and preserve the differential/regeneration guards, and the Android reset reaches the failing microphone route. But this PR still carries the replay-slug ReDoS implementation while #1546 is open as the dedicated, broader remediation for the same two sites plus alert #29. The overlap will conflict and leaves ownership ambiguous.

Please either drop the ReDoS commits/files here and let #1546 own the sweep, or explicitly supersede/close #1546 and make this PR the full remediation. After that, attach exact-head Android denial → reset → native-prompt evidence (or a successful manual Replay Nightly dispatch); current green PR CI does not execute scheduled workflows.

[thymikee]

Addressed the blocking feedback in da129e3:

• Rebased onto current main; the dedicated replay-slug ReDoS remediation is already present there, so this PR now drops every overlapping replay-slug file/test and no longer competes with fix: clear the polynomial-redos class across main #1546.
• Verified the exact rebased head on Android emulator emulator-5554 (SDK 36): microphone deny → settings permission reset microphone → test-app request opened the native Allow Agent Device Tester to record audio? dialog, reported as source: permission.
• Focused Android settings plus replay tests: 24 passed.

The branch now contains only the five scheduled-workflow fixes.

[thymikee]

Re-reviewed at da129e3: clean. The rebase removes every replay-slug/ReDoS overlap; the remaining five-file diff keeps the scheduled Maestro guards while correcting their maintained-package paths, makes Android reset clear the denial flags required for a re-prompt, and removes hidden native-tab badge text. The exact-head emulator evidence covers microphone deny → reset → the native permission prompt, and the iOS selector repair remains sound.

CI is still running and merge state is currently unstable. No further code changes requested; once the exact-head checks complete green, this is ready for human review.

[thymikee]

Rebased again onto b9509fe (the latest .ad codec extraction). The scheduled conformance workflow fixes remain correctly targeted at packages/maestro; the extracted packages/ad-script does not own those conformance fixtures. Verified on the rebased head: 46 Maestro conformance checks, 68 packages/ad-script tests, 15 Android settings tests, and test-app typecheck all pass.

[thymikee]

Re-reviewed rebased head 1aabd44: clean. The net PR remains exactly the prior five-file scheduled-health diff; each PR-owned blob is byte-identical to the already reviewed head, and the merged codec extraction introduces no replay or package-boundary regression. The prior Android permission-prompt and iOS exact-Catalog evidence therefore remains applicable.

Exact-head CI is running with no confirmed failure. No further code changes requested; this remains ready for human review pending the normal check completion.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-01 19:16 UTC