2.2.0

2.2.0 (Codex support) is on main but hasn't been tagged. A release-readiness review turned up three blockers and a set of smaller fixes, all in this PR. Once it merges, main can be tagged 2.2.0.

Blockers

• ./install.sh --help was broken — a regression in 2.2.0. The usage heredoc was unquoted, so bash ran `.claude/skills` and the other backticked paths as commands. The output had four errors and read "Claude Code uses and .". CI missed it because --severity=warning hides SC2006.
• 2.1.0 users had no upgrade path. The README now has an "Upgrading from 2.1.0" section, and the CHANGELOG entry is rewritten. Both cover three things:
  • the marketplace rename from draz-flutter to flutter-craft-skills, which installs everything twice if both marketplaces are added
  • the .claude/commands/flutter-adapt.md a vendored 2.1.0 install left behind
  • .agents/ winning over .claude/ when a project has both profiles
• flutter-adapt could start without being asked. As a command it only ran when typed. As a skill with Write in its tools, an agent could run it on its own. It is now explicit-only on both hosts: disable-model-invocation: true for Claude Code, and agents/openai.yaml with allow_implicit_invocation: false for Codex.

Fixes

• install.sh
  • --project, --personal and --all-personal are mutually exclusive. Combining them used to silently drop one.
  • --project with no path gives a clean error instead of unbound variable.
  • Paths containing spaces work.
  • __pycache__ folders are no longer copied into installed skills.
  • It prints the right invocation for a vendored install (/flutter-adapt).
  • It warns about the stale 2.1.0 command, and --force removes it. Only files containing that command's own text are touched.
• check.sh
  • --profile with a path that doesn't exist exits 2. It used to apply the defaults and could exit 0.
  • When both .agents/ and .claude/ profiles exist, the report notes that the .claude/ one was ignored.
• compare.py exits 2 instead of 1 when Pillow or numpy is missing. A 1 means "the screen differs", so an agent would start changing widget code.
• Skill text
  • state-management told provider users to check mounted on a ChangeNotifier, which has no such property.
  • It claimed every stack deduplicates equal states; setState and ChangeNotifier don't.
  • Its Riverpod refresh() example set state right after an await, breaking its own rule 2.
  • review-gate listed a check the script doesn't run.
  • The architecture description still said "Cubit or Bloc" and "feature-first".
  • .claude/skills was called "legacy" even though it is the installer's default.
  • The Claude Code invocation for vendored installs is now shown as /flutter-adapt.
• validate.py now fails the build when:
  • the Claude and Codex manifests, or the marketplace entries, disagree on description, keywords, homepage, license or author (flutter-code-quality's already disagreed)
  • the top CHANGELOG entry isn't the version in the manifests
  • a skill links to another skill's file that install.sh can't rewrite for vendored installs
  • a plugin ships a commands/ file
• CI
  • actions/checkout and actions/setup-python move to v7.
  • Flutter is pinned to 3.41.9 and ruff to 0.16.5.
  • shellcheck runs at default severity over all four shell scripts, now including test_check_sh.sh.
  • .ruff_cache/ is added to .gitignore.

Verification (local)

Check	Result
python3 scripts/validate.py	12 skills, 0 warnings
bash scripts/test_check_sh.sh	64/64 (4 new)
bash scripts/test_install_sh.sh	112/112 (26 fail against the old installer)
python3 scripts/test_compare.py	21/21 (1 new)
shellcheck, default severity, all four scripts	clean
ruff check scripts plugins (0.16.5)	clean
claude plugin validate on the repo and both plugins	passes

The v7 action versions and the pinned Flutter version are only tested by this PR's CI run. A Codex install has not been smoke-tested; the Codex CLI isn't installed on the machine this was prepared on.

Deliberately not included

These change the gate's result on projects that pass today, so under this repo's versioning rule they wait for 3.0.0:

• region-coded locales (ar_EG) quietly turning the RTL check into a warning
• untracked files and apps in a repo subdirectory not getting diff-scoped
• case-sensitive credential matching
• compare.py counting ignored pixels in its denominator
• blocking on the asset check

The review-gate doc now describes the two scope limits in the meantime.