fix(agent-sec-core): override loongshield exit 0 on error + actionable ErrManifestMissing

src/agent-sec-core/agent-sec-cli/src/agent_sec_cli/asset_verify/errors.py

@@ -21,7 +21,10 @@ class ErrManifestMissing(SkillVerifyError):
 
     def __init__(self, skill_name: str) -> None:
         super().__init__(
-            f"ERR_MANIFEST_MISSING: Missing .skill-meta/Manifest.json in '{skill_name}'"
+            f"ERR_MANIFEST_MISSING: Missing .skill-meta/Manifest.json in '{skill_name}'.\n"
+            f"  Cause: the skill directory has not been signed, or the manifest was deleted.\n"
+            f"  Please run `agent-sec-cli sign-skill --skill {skill_name}` to create it,\n"
+            f"  or use `agent-sec-cli verify --help` for usage details."
         )
 
 

src/agent-sec-core/agent-sec-cli/src/agent_sec_cli/security_middleware/backends/hardening.py

@@ -165,10 +165,23 @@ def execute(
         data["returncode"] = proc.returncode
         self._parse_output(clean_output, data)
 
+        # loongshield may return exit 0 even when it encounters errors
+        # (e.g. missing config file, ENFORCE-ERROR on reinforce without root).
+        # Detect such conditions in the parsed output and override the exit
+        # code so the CLI surface reports failure to callers.
+        has_output_errors = bool(data.get("failures")) or bool(
+            data.get("fixed_items")
+        )
+        has_error_lines = bool(re.search(r"\[ERROR", clean_output))
+
+        effective_exit = proc.returncode
+        if effective_exit == 0 and (has_output_errors or has_error_lines):
+            effective_exit = 1
+
         return ActionResult(
-            success=(proc.returncode == 0),
+            success=(effective_exit == 0),
             stdout=clean_output,
-            exit_code=proc.returncode,
+            exit_code=effective_exit,
             data=data,
         )