What is lidguard-release-validation?

A reference for validating and releasing LidGuard, including builds, tests, publishing, package creation, and local installation checks. LidGuard is a utility for managing local AI coding-agent sessions.

Use it when checking release readiness, validating Windows, Linux, or macOS builds, packaging the .NET tool, publishing it to NuGet, or running an installation smoke test.

It documents known validation limits and failure-handling rules, such as retrying transient Windows file-lock failures and avoiding concurrent builds in one worktree.

How airtaxi/LidGuard configures Codex

Reuse

Borrowing it

Nothing to install: this file belongs to airtaxi/LidGuard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/airtaxi/LidGuard/master/.codex/skills/lidguard-release-validation/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/airtaxi/LidGuard

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/airtaxi/lidguard/lidguard-release-validation/github.svg)](https://agentmods.dev/skills/airtaxi/lidguard/lidguard-release-validation)

Your own site

<a href="https://agentmods.dev/skills/airtaxi/lidguard/lidguard-release-validation"><img src="https://agentmods.dev/badge/skills/airtaxi/lidguard/lidguard-release-validation/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/airtaxi/lidguard/lidguard-release-validation"><img src="https://agentmods.dev/badge/skills/airtaxi/lidguard/lidguard-release-validation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 50 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,884 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00050	$0.01884
Opus 5	$0.00025	$0.00942
Sonnet 5	$0.00010	$0.00377
Haiku 4.5	$0.00005	$0.00188

Measured 11d ago against content hash 731327b954f7, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade B, and why

lidguard-release-validation scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- Validate `linux-permission status|check|install|remove` on non-root and root paths, including busctl `CanSuspend` / `CanHibernate`, managed marker refusal for unmanaged polkit files, sudo failure paths, and removal saf

.codex/skills/lidguard-release-validation/SKILL.md · 88 lines

How it starts

The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.

LidGuard Release Validation

Build Validation Note

Local build, test, publish, pack, and reinstall validation commands can fail once because of transient Windows Defender file-lock interference.
Retry the same validation command before taking any broader recovery action; when this specific issue is the cause, a retry is typically enough.
Do not bring down any build server just because the first validation attempt failed with this known Defender issue.
When validating multiple Runtime Identifiers locally from the same worktree, run the commands sequentially rather than in parallel. Concurrent dotnet build or restore activity against the same project can race on shared obj artifacts and produce false-negative reference or restore failures that disappear on a clean sequential rerun.

Current Validation Scope

Current manual runtime validation has only covered Windows with Codex.
Windows, Linux, and macOS RID compile validation can catch platform compilation regressions, but it is not a substitute for runtime behavior validation on each target OS.
Linux systemd/logind runtime behavior, macOS runtime behavior, Claude Code hooks, GitHub Copilot CLI hooks, OpenCode hooks, Provider MCP flows, and cross-provider concurrent-session behavior still need real environment validation before being treated as verified.

Missing Work

The Windows, Linux, and macOS CLI hook receiving path is implemented for Codex, Claude Code, GitHub Copilot CLI, and OpenCode. Remaining work is now focused on lifecycle polish and automated regression coverage.

Implement immediate runtime shutdown after the last session stops once the remaining post-stop cleanup work is complete.
Validate Linux behavior on a real systemd/logind laptop: systemd-inhibit lifecycle, handle-lid-switch inhibition, systemctl suspend / systemctl hibernate, closed-lid plus monitor-count suspend eligibility, /proc/acpi/button/lid lid-state reads, /sys/class/drm monitor detection, /sys/class/thermal temperature aggregation, Emergency Hibernation, and suspend history logging.
Validate linux-permission status|check|install|remove on non-root and root paths, including busctl CanSuspend / CanHibernate, managed marker refusal for unmanaged polkit files, sudo failure paths, and removal safety.
Validate Linux post-stop sound behavior with no player installed, pw-play, paplay, aplay, missing desktop sound-theme assets, .wav paths, and pactl volume override capture/apply/restore failure paths.
Validate macOS behavior on a real MacBook: caffeinate lifecycle, pmset disablesleep backup/restore, pmset sleepnow, temporary hibernatemode 25 hibernate with deferred recovery restore, closed-lid plus monitor-count suspend eligibility, ioreg lid-state reads, system_profiler monitor detection, best-effort Apple Silicon IOHIDEventSystemClient and powermetrics temperature aggregation, Emergency Hibernation, and suspend history logging.
Validate macos-permission status|check|install|remove on non-root and root paths, including managed marker refusal for unmanaged sudoers files, visudo validation, non-interactive sudo failure paths, and removal safety.
Validate macOS post-stop sound behavior with missing afplay, SystemSounds mapping, .wav paths, and osascript volume override capture/apply/restore failure paths.
Add automated regression tests or verification scripts for the already manually verified provider behavior, Windows behavior, Linux systemd/logind behavior, and macOS behavior: latest Codex hook behavior, Claude Code hook stdout behavior, GitHub Copilot CLI hook output behavior, OpenCode plugin and MCP config behavior, GitHub Copilot CLI user-level ~/.copilot/hooks/ loading and inline ~/.copilot/settings.json hook composition, GitHub Copilot CLI session id stability, PowerReadACValueIndex/PowerReadDCValueIndex read/write behavior under normal user permissions, Linux inhibitor lifecycle, Linux polkit rule management, macOS parser/permission management, and Group Policy or MDM blocked power setting fallback messages.
Add direct Codex soft-lock support only if Codex later exposes a notification or machine-readable pending-state hook surface.

Read the full file on GitHub · 88 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

agents/openai.yaml 124 B

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 88 lines · 50 tokens per session scan B 731327b954f7

Subscribe to this mod's changes

lidguard-release-validation is a skill published in the GitHub repository airtaxi/LidGuard (11 stars, last pushed 3d ago), licensed MIT. It adds 50 tokens to every session and 1,884 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Git and workflow Releases Testing caffeinate hibernate lid-close mcp nativeaot power-management

codew-release-qa-sweep

Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.

Hmbown/CodeWhale · 31 tokens

verify-and-ship

Run all quality checks (tests, lint, typecheck), fix failures, update the changelog, commit, push, and create/update the pull request or merge request.

cyrusagents/cyrus · 39 tokens

ship-workflow

Automated release pipeline: merges main, runs tests, pre-landing review, version bump, changelog, bisectable commits, and PR creation. Triggers on: "ship it", "release this", "prepare for release", "open a PR", "push and PR", "land this", "/ship-workflow".

Mathews-Tom/armory · 71 tokens

LidGuard: Skill for Codex