@clipboard-health/ai-rules 2.20.11 → 2.20.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clipboard-health/ai-rules",
-  "version": "2.20.11",
+  "version": "2.20.13",
   "description": "Pre-built AI agent rules for consistent coding standards.",
   "keywords": [
     "ai",

package/skills/babysit-pr/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: babysit-pr
-description: "Watch a PR through CI and review feedback: commit/push, wait for CI, auto-fix high-confidence failures, reply to active review threads, and summarize parsed automated review-body comments with sentinel-tagged comments. Runs one pass against the current branch's PR; pass a PR number or URL to `gh pr checkout` that PR first. Use when the user says 'babysit my PR', 'babysit PR 482', 'watch my PR', 'keep my PR moving', or 'respond to comments'."
+description: "Watch a PR through CI and review feedback: commit/push, wait for CI, auto-fix high-confidence failures, reply to active review threads, address top-level Conversation-tab comments, and summarize automated review-body content with sentinel-tagged comments. Runs one pass against the current branch's PR; pass a PR number or URL to `gh pr checkout` that PR first. Use when the user says 'babysit my PR', 'babysit PR 482', 'watch my PR', 'keep my PR moving', or 'respond to comments'."
 argument-hint: "[pr-number-or-url]"
 ---
 
@@ -25,17 +25,17 @@ This skill always runs exactly one pass. It never waits or repeats internally. F
 
 ## Sentinels
 
-The skill uses two HTML-comment sentinels.
+The skill uses two sentinels. Each is a visible footer line wrapped in `<sub>` (a 🤖 mark plus the token in `<code>`).
 
-**Addressed sentinel**: `<!-- babysit-pr:addressed v1 core@3.4.1 -->`. The `core@<X.Y.Z>` suffix records which plugin version produced the reply. Appended on its own line at the end of every reply the skill posts (both thread replies and the review-body summary). This is how the skill knows, on re-runs, which threads and automated review-body comments it already handled. Dedupe matches by the version-agnostic prefix `<!-- babysit-pr:addressed v1` followed by a single space, so pre-versioning sentinels left by earlier plugin versions are still recognized. Grep `babysit-pr:addressed v1` (without `-->`) to find sentinels regardless of version; grep `babysit-pr:addressed v1 core@3.4.1` to find ones from a specific version.
+**Addressed sentinel**: `<sub>🤖 <code>babysit-pr:addressed v1 core@3.4.1</code></sub>`. Appended on its own line at the end of every reply the skill posts (both thread replies and the review-body summary); this is how re-runs know which threads and review-body comments are already handled. Dedupe matches the version-agnostic substring `babysit-pr:addressed v1` followed by a space (also matches legacy `<!-- babysit-pr:addressed v1 ... -->` sentinels). Grep `babysit-pr:addressed v1` for any version; add `core@3.4.1` for a specific one.
 
-**Follow-up sentinel**: `<!-- babysit-pr:followup v1 core@3.4.1 -->`. Attached to replies that defer an out-of-scope comment as a tracked follow-up (see the Scope subsection and the Defer verdict in step 6). Grep `babysit-pr:followup` across PR conversation JSON to enumerate deferred items. This sentinel is additive — the post-reply scripts still append the `addressed` sentinel at the end, so a deferred thread is correctly machine-classified as addressed (the skill _has_ handled it — by deferring). Human reviewers and future sweeps distinguish deferred from resolved by looking for the follow-up sentinel.
+**Follow-up sentinel**: `<sub>🤖 <code>babysit-pr:followup v1 core@3.4.1</code></sub>`. Attached to replies that defer an out-of-scope comment as a tracked follow-up (see the Scope subsection and the Defer verdict in step 6). Grep `babysit-pr:followup` across PR conversation JSON to enumerate deferred items. This sentinel is additive — the post-reply scripts still append the `addressed` sentinel at the end, so a deferred thread is correctly machine-classified as addressed (the skill _has_ handled it — by deferring). Human reviewers and future sweeps distinguish deferred from resolved by looking for the follow-up sentinel.
 
 **Sentinel recency rules.** The script emits a per-thread `activityState` with three values:
 
 - **`active`** — no sentinel yet, OR at least one human commented after the last sentinel. Always handle this thread.
 - **`uncertain`** — a sentinel exists AND one or more bot comments appeared after it. The thread carries a `postSentinelBotComments` array listing EVERY such comment. You MUST read every entry in that array (not just the most recent — a later ack must not hide an earlier actionable finding), then decide:
-  - **Every** post-sentinel bot comment is a non-actionable acknowledgement (`"Thanks, resolved"`, `"LGTM"`, `"Learnings added"`, etc.) → mark the thread **Skip-reply**; do not post a new reply. (See step 6 — Skip-reply is a distinct classification from the `addressed` activityState value.)
+  - **Every** post-sentinel bot comment is a non-actionable acknowledgement (`"Thanks, resolved"`, `"LGTM"`, `"Learnings added"`, etc.) → mark the thread **Skip-reply**; do not post a new reply. (See step 6a — Skip-reply is a distinct classification from the `addressed` activityState value.)
   - **Any** post-sentinel bot comment carries new actionable content (new nit, new finding, corrected diagnosis) → treat as **active**; reply again AND mention in the final summary that you reactivated an "uncertain" thread and why.
   - If you cannot confidently classify every entry → default to **active** and flag it. Silence is the failure mode we are trying to avoid.
 - **`addressed`** — the sentinel is the newest relevant activity on the thread. Skip it.
@@ -44,7 +44,7 @@ The skill uses two HTML-comment sentinels.
 
 The bot detection exists ONLY to downgrade the default for post-sentinel bot activity from `"active"` to `"uncertain"`. It NEVER suppresses bot comments or marks a thread `"addressed"` on its own — review-bot content would be lost if it did.
 
-For automated review-body comments, the script emits a stable `fingerprint` per comment (sha256 of file + line + title + body, no timestamp). This includes CodeRabbit's Nitpick comments, Minor comments, and Outside diff range comments sections, plus Mendral `Needs attention` review bodies that include a file/line anchor. Before posting a summary, search existing PR issue-comments for a prior babysit-pr sentinel comment that already contains those fingerprints; if every current fingerprint is already present in a prior sentinel comment, skip posting.
+For automated review bodies, the script emits a stable `fingerprint` per review (sha256 of the whole normalized body — collapsed whitespace, no timestamp, no author). It covers every review from a known automated reviewer (CodeRabbit, Mendral, Dependabot, etc.); the agent reads each body directly and extracts findings as part of its scope/verdict assessment, instead of relying on a fragile pre-parser. For top-level Conversation-tab comments, the script emits the same kind of `fingerprint` per comment. Dedupe happens against the `priorBabysitSentinels` array returned in the same JSON document: if a current `reviewBodyComments[].fingerprint` or `activeIssueComments[].fingerprint` already appears in any prior sentinel body, skip posting / treat it as addressed.
 
 ## One iteration
 
@@ -135,12 +135,16 @@ The output JSON has:
 - `threads`: every unresolved review thread, with `threadId`, `replyToCommentDatabaseId`, `comments[]`, `lastBabysitSentinelAt`, `lastHumanCommentAt`, `lastBotCommentAt`, `postSentinelBotComments[]`, `postSentinelHumanComments[]`, and `activityState` (`"active"` / `"uncertain"` / `"addressed"`).
 - `activeThreads`: threads where `activityState != "addressed"` — these need attention this iteration (active AND uncertain).
 - `uncertainThreads`: just the uncertain subset. For each, read EVERY entry in `postSentinelBotComments` before deciding.
-- `nitpickComments`: parsed automated review-body comments, each with a stable `fingerprint`. The field name is retained for compatibility; it includes CodeRabbit Nitpick, Minor, and Outside diff range comments, plus Mendral `Needs attention` review bodies that include a file/line anchor.
-- `totalActiveThreads`, `totalUncertainThreads`, `totalNitpicks`, `totalUnresolvedComments` for quick checks.
+- `reviewBodyComments`: every review from a known automated reviewer (CodeRabbit, Mendral, Dependabot, etc.), with the raw body and a stable per-review `fingerprint`. The agent reads each body directly to extract findings.
+- `issueComments`: every top-level Conversation-tab comment, each with `isBabysitSentinel`, `isKnownBot`, and a per-comment `fingerprint`.
+- `activeIssueComments`: the subset of `issueComments` that are NOT babysit-pr sentinels, NOT from a known bot, and whose `fingerprint` is NOT already listed in any prior babysit-pr summary. These are the human Conversation-tab comments still needing a reply.
+- `priorBabysitSentinels`: prior babysit-pr summary comments posted as PR issue-comments. The script does the dedupe lookup for `activeIssueComments` automatically; the agent uses this array for `reviewBodyComments` dedupe.
+- `truncated`: array naming any GraphQL connection that hit GitHub's 100-item cap (`reviewThreads`, `thread-comments`, `reviews`, `issueComments`). Non-empty means some comments may not be in this JSON — surface this in the final summary.
+- `totalActiveThreads`, `totalUncertainThreads`, `totalActiveIssueComments`, `totalReviewBodyComments`, `totalUnresolvedComments` for quick checks.
 
 ### Scope
 
-This PR's review-feedback scope is strict by default. Steps 6 (threads) and 7 (automated review-body comments) classify each comment as in-scope or out-of-scope using this rule before choosing a verdict. Step 5 (CI) uses the broader CI-scope rule in that step, not this one — CI can legitimately fail on unchanged lines because the PR changed a contract or dependency path.
+This PR's review-feedback scope is strict by default. Steps 6a (threads), 6b (top-level conversation comments), and 7 (automated review bodies) classify each comment as in-scope or out-of-scope using this rule before choosing a verdict. Step 5 (CI) uses the broader CI-scope rule in that step, not this one — CI can legitimately fail on unchanged lines because the PR changed a contract or dependency path.
 
 Build the changed-line set from `gh pr diff` once per iteration. Count changed diff lines on both sides: added lines in the new version, removed lines in the old version, and modified code represented by adjacent remove/add pairs. Do not count diff context lines. A reviewer comment or automated review-body comment is **in scope** when its anchor falls on a changed diff line on either side of the hunk. Deleted-line comments like "why remove this?" or "please add this back" are in scope by definition. For a range like `12-14`, any overlap with a changed diff line is in scope.
 
@@ -170,7 +174,7 @@ Default posture: focus on in-scope feedback. For out-of-scope feedback, apply th
 
 Run `bash scripts/fetchFailedLogs.sh` to stream failed output for every failing check on the PR. The first line is either:
 
-- `# babysit-pr: no failing checks` → skip to step 6.
+- `# babysit-pr: no failing checks` → skip to step 6a.
 - `# babysit-pr: failing checks` → followed by one delimited block per failing job or external check:
   - `# --- run=<id> job=<id> ---` blocks carry the job's `--log-failed` output (GitHub Actions).
   - `# --- external check: <name> (<url>) ---` blocks carry no logs — the check isn't a GitHub Actions run (CircleCI, Nx Cloud, semgrep, CodeRabbit, Devin, etc.). Treat these like "External checks with no inspectable logs" in the diagnosis-only list below: stop and report, don't guess a fix.
@@ -195,7 +199,7 @@ Read the logs and diagnose: **build/type errors first** (they cause cascading te
 
 Scope check for CI: scope is the PR's changed files plus failures directly caused by those changes in the PR's execution path. Use `gh pr diff --name-only` as the first signal — this is PR-authoritative and works even if the local base ref is missing or stale (e.g., in fresh clones or CI sandboxes). Allow fixes outside changed files only when the logs and code make causality clear (e.g., the PR renamed a symbol that a sibling test references). CI failures outside that surface are out of scope — report the diagnosis, don't apply speculative fixes. CI fixes are never Deferred as follow-ups: CI needs to pass on this PR.
 
-### 6. Assess active review threads
+### 6a. Assess active review threads
 
 For every thread in `activeThreads` (this includes both `"active"` and `"uncertain"`):
 
@@ -215,19 +219,29 @@ For every thread in `activeThreads` (this includes both `"active"` and `"uncerta
     - Does not meet the bar → **Defer** (new verdict). Record a one-line rationale and, if relevant, a pointer to where the concern lives.
     - Disagree and Already-fixed can still apply to out-of-scope comments (e.g., reviewer asks for a refactor that's already landed on main, or misreads the code).
 
-### 7. Assess automated review-body comments
+### 6b. Assess top-level Conversation-tab comments
 
-For every parsed automated review-body comment in `nitpickComments`:
+For every entry in `activeIssueComments` — humans commenting on the PR Conversation tab without anchoring to a file/line:
 
-- Check whether its `fingerprint` already appears in a prior babysit-pr sentinel comment on the PR. If yes, skip.
-- **Classify scope** (in / out) using the Scope subsection. For ranges like `12-14`, any overlap with changed diff lines on either side of the hunk is in scope; no overlap is out of scope unless one of the explicit escape-hatch signals applies.
-- Pick a verdict:
+- Apply the **Scope** subsection's rules. A top-level comment is in scope when the reviewer explicitly ties it to a changed file/line, behavior the PR introduced, or a contract the PR altered. Otherwise out of scope by default.
+- Pick a verdict the same way as a thread: Agree / Disagree / Already fixed (in-scope), or Agree-meets-bar / Defer (out-of-scope). Apply fixes for Agree verdicts.
+- Replies are NOT posted as individual top-level comments — that would clutter the conversation. Instead, every issue-comment verdict goes into the **same step-9 PR-level summary** as the review-body findings, under its own `## Conversation-tab comments` heading. Per-comment fingerprints join the fenced fingerprint block so future runs dedupe.
+- If `activeIssueComments` is empty AND `reviewBodyComments` is empty (or all dedupe), skip the PR-level summary comment entirely in step 9.
+
+### 7. Assess automated review bodies
+
+For every entry in `reviewBodyComments`:
+
+- Dedupe first: if its `fingerprint` already appears in any `priorBabysitSentinels[].body`, skip — already covered.
+- Otherwise, READ THE BODY IN FULL. Automated reviewers (CodeRabbit, Mendral, etc.) pack findings into nested `<details>/<blockquote>` HTML with file paths, line ranges, and titles inline. Identify each individual finding the body contains.
+- For each finding, **classify scope** (in / out) using the Scope subsection. For ranges like `12-14`, any overlap with changed diff lines on either side of the hunk is in scope; no overlap is out of scope unless one of the explicit escape-hatch signals applies.
+- Pick a verdict per finding:
   - In-scope → Agree / Disagree / Already fixed (as with threads). If Agree, apply the fix.
-  - Out-of-scope → apply the out-of-scope fix bar. Meets the bar → Agree and apply the fix, noting in the summary that it was fixed despite being out of scope. Does not meet the bar → **Defer**. A Deferred automated review-body comment does not get its own top-level comment; it goes into the summary under the **Deferred (out of scope)** heading (see step 9).
+  - Out-of-scope → apply the out-of-scope fix bar. Meets the bar → Agree and apply the fix, noting in the summary that it was fixed despite being out of scope. Does not meet the bar → **Defer**. A Deferred finding does not get its own top-level comment; it goes into the summary under the **Deferred (out of scope)** heading (see step 9).
 
-Deferred review-body fingerprints still go into the fenced fingerprint block at the end of the summary alongside addressed ones, so future runs dedupe correctly — the comment is handled, just handled by deferring.
+The whole-body `fingerprint` (not per-finding) goes in the fenced fingerprint block at the end of the summary. If the review body later changes (new findings, edits), the fingerprint changes and the next pass will post the summary again — slightly noisier but never silently drops a new finding. Trivial whitespace/version-tag changes are absorbed by body normalization before hashing, so identical content doesn't churn.
 
-If no automated review-body comments remain after filtering, skip ONLY the top-level review-body summary comment in step 9. Still post thread replies for every non-Skip-reply thread from step 6.
+If `reviewBodyComments` is empty (or all entries dedupe), skip ONLY the review-body section of the summary in step 9. Still post thread replies for every non-Skip-reply thread from step 6a and handle issue comments per step 6b.
 
 ### 8. Commit and push (if any edits)
 
@@ -253,7 +267,7 @@ Capture the `url=` line for the reply templates in step 9.
 
 ### 9. Post replies
 
-For every thread assessed in step 6 that was NOT marked **Skip-reply** (i.e., one of Agree / Disagree / Already fixed / Defer):
+For every thread assessed in step 6a that was NOT marked **Skip-reply** (i.e., one of Agree / Disagree / Already fixed / Defer):
 
 ```bash
 bash scripts/postSentinelReply.sh "$THREAD_ID" "$BODY"
@@ -266,24 +280,25 @@ Body templates (the script appends the `addressed` sentinel if missing):
 - **Agree**: `Addressed in <commit-url>. <one-line what-changed>.`
 - **Disagree**: `Leaving current behavior. <reasoning>.`
 - **Already fixed**: `Already handled by <commit-url-or-file:line>. <brief pointer>.`
-- **Defer**: `Out of scope for this PR; this looks like follow-up work rather than something introduced or required by this change. <one-line rationale or pointer if useful>.\n\n<!-- babysit-pr:followup v1 core@3.4.1 -->`
+- **Defer**: `Out of scope for this PR; this looks like follow-up work rather than something introduced or required by this change. <one-line rationale or pointer if useful>.\n\n<sub>🤖 <code>babysit-pr:followup v1 core@3.4.1</code></sub>`
 
 For Defer replies, include the follow-up sentinel on its own line as shown. The script will append the `addressed` sentinel after it on its own line, so the final body ends with the follow-up sentinel followed by a blank line followed by the `addressed` sentinel — `grep babysit-pr:followup` finds the deferral and `grep babysit-pr:addressed` still marks the thread handled for dedupe.
 
 The script uses the `addPullRequestReviewThreadReply` GraphQL mutation. It does NOT resolve the thread.
 
-If any automated review-body comments were assessed in step 7, post ONE top-level PR comment summarizing all of them:
+If any automated review bodies were assessed in step 7 OR any active issue comments were assessed in step 6b, post ONE top-level PR comment summarizing all of them:
 
 ```bash
 bash scripts/postSentinelPrComment.sh "$PR_NUMBER" "$BODY"
 ```
 
-The review-body summary should:
+The PR-level summary should:
 
-- Group verdicts under **Agree / Disagree / Already fixed / Deferred (out of scope)** headings. Omit a heading if its list is empty.
-- Under **Deferred (out of scope)**, list each deferred review-body comment as a bullet, followed on its own line by `<!-- babysit-pr:followup v1 core@3.4.1 -->` so grep catches them individually.
+- Group by source. Use `## Review-body findings` for step-7 work and `## Conversation-tab comments` for step-6b work. Omit a section if its list is empty.
+- Inside each section, group verdicts under **Agree / Disagree / Already fixed / Deferred (out of scope)** subheadings. Omit a subheading if its list is empty.
+- Under **Deferred (out of scope)**, list each deferred item as a bullet, followed on its own line by `<sub>🤖 <code>babysit-pr:followup v1 core@3.4.1</code></sub>` so grep catches them individually.
 - Include the commit URL for fixes.
-- Include every current review-body comment's `fingerprint` — addressed and deferred — in a fenced block at the end (one per line, before the sentinel) so future runs can dedupe. Deferred comments count as handled for dedupe purposes.
+- End with a fenced fingerprint block listing every current fingerprint — addressed and deferred — one per line. Include both `reviewBodyComments[].fingerprint` (whole-body, one per automated review) and `activeIssueComments[].fingerprint` (per Conversation-tab comment). Future runs dedupe by matching these against `priorBabysitSentinels`.
 
 ### 10. Summarize
 
@@ -293,8 +308,10 @@ Report:
 - Merge conflict status if relevant (resolved or aborted with reason).
 - CI checks fixed / still failing / skipped-with-diagnosis.
 - Review threads replied to, grouped by verdict (including any Defer count: "X threads deferred as follow-ups").
-- Review-body comments summarized (or skipped because already covered), including the Deferred count: "Y review-body comments deferred as follow-ups".
+- Conversation-tab comments addressed, grouped by verdict (e.g. "Z conversation comments deferred as follow-ups").
+- Review-body findings summarized (or skipped because already covered), including the Deferred count: "Y review-body findings deferred as follow-ups".
 - Threads left active because of bot-acknowledgement uncertainty (flag by thread URL).
+- If `truncated` is non-empty: explicitly call out which connection hit GitHub's 100-item GraphQL cap (e.g. "`truncated: ['thread-comments']` — at least one review thread has more than 100 comments; this pass may have missed the tail. Investigate before relying on it for completeness.").
 - The stop condition triggered for this pass (clean / progressing / stuck).
 
 When the report mentions any deferrals, include a one-liner the user can run later to enumerate them, e.g.:
@@ -309,7 +326,7 @@ Do not rely only on `gh pr view --json comments,reviews` — that view can miss
 
 After the single pass completes, pick exactly one outcome:
 
-- **Exit clean** — all CI checks passed AND every thread in `activeThreads` was either marked Skip-reply during step 6's inspection or has already received a fresh sentinel reply in this pass (Agree / Disagree / Already-fixed / **Defer** all count — a Defer reply is a sentinel reply), AND every current review-body fingerprint is covered by an existing sentinel comment (deferred review-body comments count; they're in the summary's fingerprint block). Do not use raw `totalActiveThreads` from the script output — it is pre-inspection and will stay non-zero for Skip-reply cases. A PR with Deferred threads is still clean from babysit's perspective: the skill has done what it can without widening scope. Report success and stop.
+- **Exit clean** — all CI checks passed AND every thread in `activeThreads` was either marked Skip-reply during step 6a's inspection or has already received a fresh sentinel reply in this pass (Agree / Disagree / Already-fixed / **Defer** all count — a Defer reply is a sentinel reply), AND every entry in `activeIssueComments` is covered by this pass's PR-level summary, AND every current review-body fingerprint is covered by an existing sentinel comment (deferred review-body and conversation-comment fingerprints count; they're in the summary's fenced block). Do not use raw `totalActiveThreads` / `totalActiveIssueComments` from the script output — they're pre-inspection and will stay non-zero for Skip-reply or post-summary cases. A PR with Deferred items is still clean from babysit's perspective: the skill has done what it can without widening scope. Report success and stop.
 - **Exit progressing** — pass made commits, posted new replies, or both, and the PR is not yet clean (CI is still pending, a new CI run was triggered by this pass's commits, or more work remains). There is real work still in flight that another run would pick up. Report what was done and what is pending, and tell the user to re-run `/babysit-pr` once CI settles, or to wrap the call with `/loop <cadence> /babysit-pr` (or a shell `while true; do ...; done`) for automatic re-runs.
 - **Exit stuck** — pass made no commits and posted no new replies, and the PR is still not clean. Nothing actionable happened this pass. Use this whenever progress is blocked on something outside the skill's scope, including:
   - Merge conflict in step 2 that exceeded the high-confidence resolution bar.
@@ -338,7 +355,7 @@ User: `babysit my PR`
 - No PR arg → operate on the current branch.
 - Preflight OK, PR #482 found.
 - `gh pr checks --watch` times out at 600s — two checks still pending.
-- `unresolvedPrComments.sh` returns 0 active threads, 0 review-body comments.
+- `unresolvedPrComments.sh` returns 0 active threads, 0 review-body comments, 0 active issue comments.
 - No commits, no replies posted, CI state unchanged vs. start.
 - Outcome: **stuck**. Report: "CI still running after 10 min; no comments to address. Re-run `/babysit-pr` once CI settles, or wrap with `/loop 2m /babysit-pr`."
 
@@ -349,24 +366,25 @@ User: `babysit PR 482`
 - Preflight OK. Input parser matches the explicit-token rule and captures `482`.
 - `gh pr checkout 482` switches the worktree to PR #482's head branch (say, `feat/xyz`).
 - Step 2's `gh pr view` confirms PR #482 on the now-current branch; the new-PR fallback does not fire.
-- Remainder proceeds as a normal single pass (CI watch, thread / nitpick assessment, replies).
+- Remainder proceeds as a normal single pass (CI watch, thread / conversation-comment / review-body assessment, replies).
 - Report final state on exit.
 
-### Example 3: out-of-scope nitpick gets deferred
+### Example 3: out-of-scope review-body finding gets deferred
 
 User: `babysit my PR`
 
 - Preflight OK, PR #612 found, CI green.
-- `unresolvedPrComments.sh` returns 1 active thread and 2 review-body comments:
+- `unresolvedPrComments.sh` returns 1 active thread, 1 active issue comment, and 1 CodeRabbit review body containing two findings:
   - Thread on `src/users.ts:82` (unchanged, not touched by diff) — reviewer: "while you're here, this helper could be memoized".
-  - Nitpick on `src/orders.ts:45-47` — anchor overlaps a changed line; CodeRabbit says the error message should use backticks. In scope.
-  - Nitpick on `src/unrelated.ts:10` — file not touched by the PR. Out of scope, no escape-hatch signal.
+  - Active issue comment from a teammate on the Conversation tab: "general nit — can you rename the new module to `payments-core`?". Touches a changed file (`src/payments/index.ts`).
+  - CodeRabbit review body — agent reads it and identifies two findings: (a) on `src/orders.ts:45-47`, anchor overlaps a changed line, error message should use backticks (in scope); (b) on `src/unrelated.ts:10`, file not touched by the PR (out of scope, no escape-hatch signal).
 - Scope classification:
-  - Thread is on an unchanged line; reviewer doesn't tie it to this PR's changes; doesn't meet the fix bar (not a crash, not a bug, not trivial). → **Defer**.
-  - First nitpick is in-scope → **Agree**, apply backtick fix.
-  - Second nitpick is out-of-scope, not a correctness bug, not a one-liner → **Defer** (goes under the Deferred (out of scope) heading in the summary).
-- Commit `f00dbabe` for the in-scope review-body fix. Post Defer reply on the thread with the `babysit-pr:followup v1` sentinel above the `addressed` sentinel. Post the review-body summary with Agree (1) and Deferred (out of scope) (1) headings; both fingerprints listed in the fenced block.
-- Summary reports: "1 thread deferred as follow-up, 1 review-body comment deferred as follow-up" plus the `gh api graphql ... | grep babysit-pr:followup` one-liner.
+  - Thread is on an unchanged line; reviewer doesn't tie it to this PR's changes; doesn't meet the fix bar. → **Defer**.
+  - Conversation-tab comment ties to a changed file and is a trivial rename. → **Agree**, apply rename.
+  - Finding (a) is in-scope → **Agree**, apply backtick fix.
+  - Finding (b) is out-of-scope, not a correctness bug, not a one-liner → **Defer**.
+- Commit `f00dbabe` covers the rename and the backtick fix. Post Defer reply on the thread with the `babysit-pr:followup v1` sentinel above the `addressed` sentinel. Post one PR-level summary with `## Review-body findings` (Agree 1, Deferred 1) and `## Conversation-tab comments` (Agree 1); the fenced block lists the CodeRabbit review body's whole-body fingerprint AND the conversation comment's per-comment fingerprint.
+- Summary reports: "1 thread deferred as follow-up, 1 review-body finding deferred as follow-up, 0 conversation comments deferred" plus the `gh api graphql ... | grep babysit-pr:followup` one-liner.
 - **Exit clean** — Defer replies count as fresh sentinel replies; all fingerprints are covered.
 
 ## Input

package/skills/babysit-pr/scripts/_sentinel.sh

@@ -2,13 +2,20 @@
 # _sentinel.sh — shared SENTINEL constants + append helper.
 # Sourced by unresolvedPrComments.sh, postSentinelReply.sh, postSentinelPrComment.sh.
 #
-# SENTINEL_PREFIX is the version-agnostic substring used for matching/dedupe so
-# pre-versioning sentinels (`<!-- babysit-pr:addressed v1 -->`) are still
-# recognized alongside versioned ones. SENTINEL is the literal emitted on new
-# replies; the `core@X.Y.Z` suffix records which plugin version produced it.
+# SENTINEL is the literal emitted on new replies: a visible footer (robot mark +
+# token in `<code>`, wrapped in `<sub>`). SENTINEL_PREFIX is the wrapper-free
+# substring used for matching/dedupe, so it matches both this footer and legacy
+# `<!-- babysit-pr:addressed v1 ... -->` sentinels. The `core@X.Y.Z` suffix is
+# substituted at build time by embedPluginVersion.mts.
 
-SENTINEL_PREFIX='<!-- babysit-pr:addressed v1 '
-SENTINEL='<!-- babysit-pr:addressed v1 core@3.4.1 -->'
+SENTINEL_PREFIX='babysit-pr:addressed v1 '
+SENTINEL='<sub>🤖 <code>babysit-pr:addressed v1 core@3.4.1</code></sub>'
+
+# Bot author allowlist (JSON array literal). Used by unresolvedPrComments.sh
+# as a fallback when GraphQL's `author.__typename == "Bot"` misses a GitHub
+# App that posts via a User-type service account. Single source of truth so
+# adding a new bot is a one-line edit.
+BOTS_JSON='["coderabbitai","coderabbitai[bot]","mendral-app","mendral-app[bot]","dependabot","dependabot[bot]","github-actions","github-actions[bot]","github-advanced-security","github-advanced-security[bot]","renovate","renovate[bot]","renovate-bot","pre-commit-ci","pre-commit-ci[bot]","codecov","codecov[bot]","sonarcloud","sonarcloud[bot]"]'
 
 # Echo $1 with SENTINEL appended on its own trailing paragraph, unless the
 # body already contains any version of the sentinel (matched via SENTINEL_PREFIX).

package/skills/babysit-pr/scripts/unresolvedPrComments.sh

@@ -1,16 +1,30 @@
 #!/usr/bin/env bash
-# unresolvedPrComments.sh — Fetch review threads + review-body comments for babysit-pr.
-# Extended from plugins/core/skills/unresolved-pr-comments/scripts/unresolvedPrComments.sh.
-# Adds: thread IDs, per-thread sentinel recency state, stable review-body fingerprints.
+# unresolvedPrComments.sh — Fetch review data for babysit-pr.
+#
+# Returns one JSON document with:
+#   - threads / activeThreads / uncertainThreads — review threads with
+#     sentinel-recency state (active / uncertain / addressed).
+#   - reviewBodyComments — raw bodies of every review from known automated
+#     reviewers (CodeRabbit, Mendral, etc.), each with a stable fingerprint.
+#     The agent reads bodies directly; we no longer pre-parse findings.
+#   - issueComments — every top-level PR conversation comment, tagged with
+#     isBabysitSentinel and isKnownBot flags.
+#   - activeIssueComments — non-sentinel, non-bot issue comments whose
+#     per-comment fingerprint is NOT already listed in any prior babysit-pr
+#     summary. These are the human Conversation-tab comments needing a reply.
+#   - priorBabysitSentinels — issue comments whose body contains the
+#     babysit-pr sentinel prefix. Used for review-body + issue-comment dedupe.
+#   - truncated — array naming any GraphQL connection that hit GitHub's
+#     100-item cap (reviewThreads, thread-comments, reviews, issueComments).
+#     Agent must surface this in the final summary.
 #
 # Usage: bash unresolvedPrComments.sh [pr-number]
-# Compatible with macOS bash 3.2. Requires: gh, jq (>= 1.5), perl with Digest::SHA.
+# Compatible with macOS bash 3.2. Requires: gh, jq (>= 1.5),
+# and one of shasum / sha256sum for fingerprinting.
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-# shellcheck source=parseNitpicks.sh
-source "${SCRIPT_DIR}/parseNitpicks.sh"
 # shellcheck source=_sentinel.sh
 source "${SCRIPT_DIR}/_sentinel.sh"
 
@@ -21,6 +35,14 @@ output_error() {
   exit 1
 }
 
+if command -v shasum >/dev/null 2>&1; then
+  SHA256_CMD="shasum -a 256"
+elif command -v sha256sum >/dev/null 2>&1; then
+  SHA256_CMD="sha256sum"
+else
+  SHA256_CMD=""
+fi
+
 validate_prerequisites() {
   if ! command -v jq >/dev/null 2>&1; then
     printf '{"error":"jq not found. Install from https://stedolan.github.io/jq"}\n' >&3
@@ -29,11 +51,8 @@ validate_prerequisites() {
   if ! command -v gh >/dev/null 2>&1; then
     output_error "gh CLI not found. Install from https://cli.github.com"
   fi
-  if ! command -v perl >/dev/null 2>&1; then
-    output_error "perl not found."
-  fi
-  if ! perl -MDigest::SHA -e1 >/dev/null 2>&1; then
-    output_error "Perl Digest::SHA module not found (should be in core Perl since 5.9.3)."
+  if [ -z "$SHA256_CMD" ]; then
+    output_error "Neither shasum nor sha256sum found on PATH."
   fi
   if ! gh api user --jq '.login' >/dev/null 2>&1; then
     output_error "Not authenticated with GitHub. Run: gh auth login"
@@ -77,7 +96,9 @@ get_repo_info() {
   fi
 }
 
-# Pagination limits: 100 review threads, 20 comments per thread, 100 reviews.
+# Each connection caps at GitHub's 100-item maximum. hasNextPage is checked
+# after the fetch and surfaced via the top-level `truncated` array — real
+# cursor pagination is a follow-up if the warning ever fires in practice.
 GRAPHQL_QUERY='
 query($owner: String!, $repo: String!, $pr: Int!) {
   repository(owner: $owner, name: $repo) {
@@ -85,10 +106,12 @@ query($owner: String!, $repo: String!, $pr: Int!) {
       title
       url
       reviewThreads(first: 100) {
+        pageInfo { hasNextPage }
         nodes {
           id
           isResolved
-          comments(first: 20) {
+          comments(first: 100) {
+            pageInfo { hasNextPage }
             nodes {
               id
               databaseId
@@ -106,12 +129,24 @@ query($owner: String!, $repo: String!, $pr: Int!) {
         }
       }
       reviews(first: 100) {
+        pageInfo { hasNextPage }
         nodes {
           body
-          author { login }
+          author { login __typename }
           createdAt
         }
       }
+      comments(first: 100) {
+        pageInfo { hasNextPage }
+        nodes {
+          id
+          databaseId
+          body
+          createdAt
+          url
+          author { login __typename }
+        }
+      }
     }
   }
 }'
@@ -141,6 +176,49 @@ is_code_scanning_alert_fixed() {
   [ "$state" = "fixed" ]
 }
 
+# Normalize a body for stable hashing: collapse all runs of whitespace
+# (including newlines) to a single space, then trim. Trivial whitespace
+# reshuffles by a bot do not churn the fingerprint.
+normalize_body() {
+  printf '%s' "$1" | tr -s '[:space:]' ' ' | sed -E 's/^ //; s/ $//'
+}
+
+# Echo first 16 hex chars of sha256(normalize(body)).
+fingerprint_body() {
+  local normalized
+  normalized="$(normalize_body "$1")"
+  printf '%s' "$normalized" | $SHA256_CMD | cut -c1-16
+}
+
+# Take a JSON array of {body, ...extra} and emit the same array with a
+# `fingerprint` field added to each entry. Three jq spawns total regardless
+# of N: one to stream bodies as base64, one to assemble the fingerprint
+# array, one to zip them back onto the originals.
+add_fingerprints() {
+  local input_json="$1"
+  local count
+  count="$(printf '%s' "$input_json" | jq 'length')"
+  if [ "$count" = "0" ]; then
+    printf '[]'
+    return
+  fi
+
+  local fps=()
+  local line
+  while IFS= read -r line; do
+    [ -z "$line" ] && continue
+    local body
+    body="$(printf '%s' "$line" | base64 -d)"
+    fps+=("$(fingerprint_body "$body")")
+  done < <(printf '%s' "$input_json" | jq -r '.[] | .body // "" | @base64')
+
+  local fps_json
+  fps_json="$(printf '%s\n' "${fps[@]}" | jq -Rs 'split("\n") | map(select(. != ""))')"
+  printf '%s' "$input_json" | jq --argjson fps "$fps_json" '
+    [., $fps] | transpose | map(.[0] + { fingerprint: (.[1] // "") })
+  '
+}
+
 main() {
   validate_prerequisites
 
@@ -165,40 +243,23 @@ main() {
   title="$(printf '%s' "$response" | jq -r '.data.repository.pullRequest.title')"
   url="$(printf '%s' "$response" | jq -r '.data.repository.pullRequest.url')"
 
-  # Build threads with sentinel recency state.
-  #
   # Bot detection combines TWO signals (union, not intersection):
-  #   1. GraphQL `author.__typename == "Bot"` — catches every bot GitHub marks as such,
-  #      including bots not on our allowlist. This is the primary signal.
-  #   2. Login allowlist — catches GitHub Apps/Actions that post via a User-type service
-  #      account rather than a Bot account.
-  # An unknown bot whose login we don't recognize but which is type=Bot still gets
-  # classified correctly; we never fall back to treating it as a human.
-  #
+  #   1. GraphQL `author.__typename == "Bot"` — catches every bot GitHub marks
+  #      as such. Primary signal.
+  #   2. Login allowlist BOTS_JSON (sourced from _sentinel.sh) — catches
+  #      GitHub Apps/Actions that post via a User-type service account.
+
   # Per-thread emitted fields:
   #   - threadId, replyToCommentDatabaseId, comments[], isResolved, file, line
-  #   - lastBabysitSentinelAt:     max createdAt of OUR sentinel replies (null if none)
+  #   - lastBabysitSentinelAt:     max createdAt of OUR sentinel replies
   #   - lastHumanCommentAt:        max createdAt of non-sentinel, non-bot comments
   #   - lastBotCommentAt:          max createdAt of non-sentinel bot comments
-  #   - postSentinelBotComments:   ARRAY of every bot comment after lastBabysitSentinelAt
-  #                                (the agent inspects ALL of them; a later ack must not hide
-  #                                an earlier actionable bot comment)
-  #   - postSentinelHumanComments: ARRAY of every human comment after lastBabysitSentinelAt
-  #   - activityState: tri-state, one of:
-  #       "active"     — needs a reply (no sentinel yet, OR a human commented after our sentinel)
-  #       "uncertain"  — sentinel exists, but a bot posted after it; agent MUST inspect every
-  #                      entry in postSentinelBotComments and treat as active unless EVERY one
-  #                      is confidently a non-actionable acknowledgement
-  #       "addressed"  — our sentinel is the newest relevant activity on this thread
-  local bots_json='["coderabbitai","coderabbitai[bot]","mendral-app","mendral-app[bot]","dependabot","dependabot[bot]","github-actions","github-actions[bot]","github-advanced-security","github-advanced-security[bot]","renovate","renovate[bot]","renovate-bot","pre-commit-ci","pre-commit-ci[bot]","codecov","codecov[bot]","sonarcloud","sonarcloud[bot]"]'
+  #   - postSentinelBotComments:   ARRAY of every bot comment after the sentinel
+  #   - postSentinelHumanComments: ARRAY of every human comment after the sentinel
+  #   - activityState: "active" / "uncertain" / "addressed"
   local threads_json
-  threads_json="$(printf '%s' "$response" | jq --arg sentinel_prefix "$SENTINEL_PREFIX" --argjson bots "$bots_json" '
-    # Exact login equality via IN($bots[]) — do NOT use `inside($bots)`, which
-    # does substring matching for strings and would classify login "code" as a
-    # bot because it appears inside "codecov".
+  threads_json="$(printf '%s' "$response" | jq --arg sentinel_prefix "$SENTINEL_PREFIX" --argjson bots "$BOTS_JSON" '
     def is_bot: ((.author.__typename // "") == "Bot") or ((.author.login // "") | IN($bots[]));
-    # Match by version-agnostic prefix so pre-versioning sentinels left on
-    # older PRs (`<!-- babysit-pr:addressed v1 -->`) still dedupe correctly.
     def is_sentinel: ((.body // "") | contains($sentinel_prefix));
     [
       .data.repository.pullRequest.reviewThreads.nodes[]
@@ -211,6 +272,7 @@ main() {
           replyToCommentDatabaseId: ($comments[0].databaseId // null),
           file: ($comments[0].path // null),
           line: ($comments[0].line // $comments[0].originalLine // null),
+          commentsTruncated: ($t.comments.pageInfo.hasNextPage // false),
           comments: [
             $comments[] | {
               id,
@@ -285,8 +347,7 @@ main() {
     ]
   ')"
 
-  # Flattened unresolved_comments — retained for backward compat with the prose summary.
-  # Includes comments from "active" AND "uncertain" threads so the agent never misses new feedback.
+  # Flattened unresolved_comments — retained for backward compat.
   local all_unresolved
   all_unresolved="$(printf '%s' "$threads_json" | jq '[
     .[]
@@ -303,11 +364,6 @@ main() {
   ]')"
 
   # Filter out fixed code-scanning alerts from github-advanced-security.
-  # Two-pass: collect unique alert numbers, query each once, then drop matching
-  # comments in a single jq pass. Avoids the O(N²) rebuild and duplicate gh api
-  # calls the naive per-comment loop would incur.
-  # github-advanced-security posts under either login depending on account type
-  # (app vs direct) — both forms match below.
   local security_alerts
   security_alerts="$(printf '%s' "$all_unresolved" | jq -r '
     .[]
@@ -326,10 +382,6 @@ main() {
   if [ -z "$fixed_alerts" ]; then
     unresolved_comments="$all_unresolved"
   else
-    # capture() on a non-matching string produces ZERO outputs (not null, not an
-    # error). Without the `// null` guard below, `as $n` would bind to nothing
-    # and the map entry would silently collapse to empty — dropping
-    # github-advanced-security comments that reference no code-scanning URL.
     unresolved_comments="$(printf '%s' "$all_unresolved" | jq --arg fixed "$fixed_alerts" '
       ($fixed | split(" ") | map(select(length > 0))) as $fixedSet
       | map(
@@ -342,53 +394,135 @@ main() {
     ')"
   fi
 
-  # Automated review-body comments. The legacy function/field names stay for
-  # compatibility with callers that already consume nitpickComments.
-  local reviews_json
-  reviews_json="$(printf '%s' "$response" | jq '[.data.repository.pullRequest.reviews.nodes[]]')"
-  local nitpick_comments
-  nitpick_comments="$(extract_nitpick_comments "$reviews_json")"
+  # Raw review-body comments from known bots. The agent reads each body itself
+  # and extracts findings; no pre-parsing.
+  local raw_review_body_comments
+  raw_review_body_comments="$(printf '%s' "$response" | jq --argjson bots "$BOTS_JSON" '
+    def is_bot_author: ((.author.__typename // "") == "Bot") or ((.author.login // "") | IN($bots[]));
+    [
+      .data.repository.pullRequest.reviews.nodes[]
+      | select((.body // "") != "")
+      | select(is_bot_author)
+      | {
+          author: (.author.login // "deleted-user"),
+          authorType: (.author.__typename // null),
+          createdAt: .createdAt,
+          body: .body
+        }
+    ]
+  ')"
+  local review_body_comments
+  review_body_comments="$(add_fingerprints "$raw_review_body_comments")"
+
+  # All issue comments (top-level Conversation-tab comments).
+  local raw_issue_comments
+  raw_issue_comments="$(printf '%s' "$response" | jq --arg sentinel_prefix "$SENTINEL_PREFIX" --argjson bots "$BOTS_JSON" '
+    def is_sentinel_body: ((.body // "") | contains($sentinel_prefix));
+    def is_bot_author: ((.author.__typename // "") == "Bot") or ((.author.login // "") | IN($bots[]));
+    [
+      .data.repository.pullRequest.comments.nodes[]
+      | {
+          id,
+          databaseId,
+          author: (.author.login // "deleted-user"),
+          authorType: (.author.__typename // null),
+          body,
+          createdAt,
+          url,
+          isBabysitSentinel: is_sentinel_body,
+          isKnownBot: is_bot_author
+        }
+    ]
+  ')"
+  local issue_comments
+  issue_comments="$(add_fingerprints "$raw_issue_comments")"
 
-  # Active threads: anything NOT yet addressed. Includes "uncertain" — agent must inspect.
+  # priorBabysitSentinels: issue comments containing the sentinel prefix.
+  local prior_sentinels
+  prior_sentinels="$(printf '%s' "$issue_comments" | jq '[.[] | select(.isBabysitSentinel)]')"
+
+  # Concatenate prior sentinel bodies into one blob — used as a haystack for
+  # fingerprint dedupe (both review-body and issue-comment fingerprints land
+  # in the fenced block at the end of a babysit-pr summary).
+  local prior_sentinel_blob
+  prior_sentinel_blob="$(printf '%s' "$prior_sentinels" | jq -r '[.[].body] | join("\n")')"
+
+  # activeIssueComments: non-sentinel, non-bot comments whose fingerprint is
+  # NOT already listed in any prior babysit-pr summary.
+  local active_issue_comments
+  active_issue_comments="$(printf '%s' "$issue_comments" | jq --arg blob "$prior_sentinel_blob" '
+    [.[]
+      | select(.isBabysitSentinel | not)
+      | select(.isKnownBot | not)
+      | select($blob | contains(.fingerprint) | not)
+    ]
+  ')"
+
+  # Active threads: anything NOT yet addressed.
   local active_threads total_active_threads uncertain_threads total_uncertain_threads
   active_threads="$(printf '%s' "$threads_json" | jq '[.[] | select(.activityState != "addressed")]')"
   total_active_threads="$(printf '%s' "$active_threads" | jq 'length')"
   uncertain_threads="$(printf '%s' "$threads_json" | jq '[.[] | select(.activityState == "uncertain")]')"
   total_uncertain_threads="$(printf '%s' "$uncertain_threads" | jq 'length')"
 
-  local total_unresolved total_nitpicks
+  local total_unresolved total_review_body_comments total_active_issue_comments
   total_unresolved="$(printf '%s' "$unresolved_comments" | jq 'length')"
-  total_nitpicks="$(printf '%s' "$nitpick_comments" | jq 'length')"
+  total_review_body_comments="$(printf '%s' "$review_body_comments" | jq 'length')"
+  total_active_issue_comments="$(printf '%s' "$active_issue_comments" | jq 'length')"
+
+  # Truncation: which connections hit GitHub's 100-item GraphQL cap?
+  local truncated
+  truncated="$(jq -n \
+    --argjson response "$response" \
+    --argjson threads "$threads_json" \
+    '
+    [
+      (if $response.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage then "reviewThreads" else empty end),
+      (if [$threads[] | select(.commentsTruncated)] | length > 0 then "thread-comments" else empty end),
+      (if $response.data.repository.pullRequest.reviews.pageInfo.hasNextPage then "reviews" else empty end),
+      (if $response.data.repository.pullRequest.comments.pageInfo.hasNextPage then "issueComments" else empty end)
+    ]
+  ')"
 
   jq -n \
+    --argjson activeIssueComments "$active_issue_comments" \
     --argjson activeThreads "$active_threads" \
-    --argjson nitpickComments "$nitpick_comments" \
+    --argjson issueComments "$issue_comments" \
     --arg owner "$owner" \
     --argjson prNumber "$pr_number" \
+    --argjson priorBabysitSentinels "$prior_sentinels" \
     --arg repo "$repo" \
+    --argjson reviewBodyComments "$review_body_comments" \
     --arg sentinel "$SENTINEL" \
     --arg title "$title" \
     --argjson threads "$threads_json" \
+    --argjson totalActiveIssueComments "$total_active_issue_comments" \
     --argjson totalActiveThreads "$total_active_threads" \
-    --argjson totalNitpicks "$total_nitpicks" \
+    --argjson totalReviewBodyComments "$total_review_body_comments" \
     --argjson totalUncertainThreads "$total_uncertain_threads" \
     --argjson totalUnresolvedComments "$total_unresolved" \
+    --argjson truncated "$truncated" \
     --argjson uncertainThreads "$uncertain_threads" \
     --argjson unresolvedComments "$unresolved_comments" \
     --arg url "$url" \
     '{
+      activeIssueComments: $activeIssueComments,
       activeThreads: $activeThreads,
-      nitpickComments: $nitpickComments,
+      issueComments: $issueComments,
       owner: $owner,
       prNumber: $prNumber,
+      priorBabysitSentinels: $priorBabysitSentinels,
       repo: $repo,
+      reviewBodyComments: $reviewBodyComments,
       sentinel: $sentinel,
       threads: $threads,
       title: $title,
+      totalActiveIssueComments: $totalActiveIssueComments,
       totalActiveThreads: $totalActiveThreads,
-      totalNitpicks: $totalNitpicks,
+      totalReviewBodyComments: $totalReviewBodyComments,
       totalUncertainThreads: $totalUncertainThreads,
       totalUnresolvedComments: $totalUnresolvedComments,
+      truncated: $truncated,
       uncertainThreads: $uncertainThreads,
       unresolvedComments: $unresolvedComments,
       url: $url

package/skills/commit-push-pr/SKILL.md

@@ -45,6 +45,6 @@ Script paths in this procedure are written as `scripts/...`, relative to this SK
 4. Push the branch to origin.
 5. Look up the current agent session ID by running this skill's bundled script: `bash scripts/find-session-id.sh '<phrase>'`. Pass a distinctive verbatim chunk (≥10 words) from the most recent user message; see the script header for quoting constraints. If the script prints `codex <id>`, use `Agent session: codex resume <id>`. If it prints `claude-code <id>`, use `Agent session: claude --resume <id>`. If empty, there is no session footer line.
 6. Check for an existing PR with `gh pr view`.
-   - No PR: create with `gh pr create`. Title = commit subject. Description = the PR body shape above, followed by the session footer line if known and `<!-- commit-push-pr:created v1 core@3.4.1 -->`.
-   - PR exists: refresh the body via `gh pr edit --body` so (a) the new commit's changes are reflected in the prose while existing `## Summary`, `## Validation`, and `## Notes` sections are preserved unless clearly stale, (b) any known session footer line is appended if missing, never removing or rewriting existing `Agent session: ...` or `Agent session ID: ...` lines, and (c) any existing `<!-- commit-push-pr:created v1 ... -->` line is preserved verbatim, appending `<!-- commit-push-pr:created v1 core@3.4.1 -->` if absent. Then report the URL.
+   - No PR: create with `gh pr create`. Title = commit subject. Description = the PR body shape above, followed by the session footer line if known and the agent footer `<sub>🤖 <code>commit-push-pr:created v1 core@3.4.1</code></sub>` on its own line.
+   - PR exists: refresh the body via `gh pr edit --body` so (a) the new commit's changes are reflected in the prose while existing `## Summary`, `## Validation`, and `## Notes` sections are preserved unless clearly stale, (b) any known session footer line is appended if missing, never removing or rewriting existing `Agent session: ...` or `Agent session ID: ...` lines, and (c) any existing footer carrying the substring `commit-push-pr:created v1` is preserved verbatim, appending `<sub>🤖 <code>commit-push-pr:created v1 core@3.4.1</code></sub>` only if absent. Then report the URL.
 7. End with one short text response: branch name and the full PR URL (e.g., `https://github.com/clipboardhealth/core-utils/pull/123`). Never use shorthand like `repo#123` — always output the complete URL.

package/skills/babysit-pr/scripts/parseNitpicks.sh

@@ -1,272 +0,0 @@
-#!/usr/bin/env bash
-# parseNitpicks.sh — Parse bot review-body comments from PR review bodies.
-#
-# Each emitted comment includes a stable `fingerprint` field (sha256 of file +
-# normalized line range + title + body), so reposted reviews dedupe to the same
-# fingerprint. Source review timestamps are kept as `createdAt` metadata but
-# NOT included in the fingerprint.
-#
-# Sourced by unresolvedPrComments.sh. Requires: perl with Digest::SHA + Encode.
-
-extract_nitpick_comments() {
-  local reviews_json="$1"
-
-  printf '%s' "$reviews_json" | perl -e '
-use strict;
-use warnings;
-use JSON::PP;
-use Digest::SHA qw(sha256_hex);
-use Encode qw(encode_utf8);
-
-local $/;
-my $reviews_json = <STDIN>;
-my $reviews = decode_json($reviews_json);
-
-my @comments = (
-  extract_coderabbit_comments($reviews),
-  extract_mendral_comments($reviews),
-);
-print encode_json(\@comments);
-
-sub extract_coderabbit_comments {
-  my ($reviews) = @_;
-
-  my $latest_review;
-  my $latest_time = "";
-  for my $review (@$reviews) {
-    my $author = $review->{author}{login} // "";
-    my $body = $review->{body} // "";
-    next unless $author eq "coderabbitai" && has_supported_sections($body);
-    my $created = $review->{createdAt} // "";
-    if ($created gt $latest_time) {
-      $latest_time = $created;
-      $latest_review = $review;
-    }
-  }
-
-  return () unless $latest_review;
-
-  my $body = $latest_review->{body};
-  my $author = $latest_review->{author}{login} // "deleted-user";
-  my $created_at = $latest_review->{createdAt} // "";
-
-  my @sections = extract_review_body_comment_sections($body);
-  return () unless @sections;
-
-  my @comments;
-  for my $section (@sections) {
-    my $section_content = $section->{content};
-    my $category = $section->{category};
-
-    while ($section_content =~ /<details>\s*<summary>([^<]+?)\s+\(\d+\)<\/summary>\s*<blockquote>([\s\S]*?)<\/blockquote>\s*<\/details>/g) {
-      my $raw_file_name = trim($1);
-      my $file_content = $2;
-
-      # Category prefix is optional. CodeRabbit emits 0–N `_…_` tags
-      # separated by `|` (e.g. `_⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_`
-      # or just `_💤 Low value_` on lower-confidence findings). The previous
-      # regex required exactly two tags and silently dropped one-tag and
-      # three-tag variants.
-      while ($file_content =~ /`(\d+(?:-\d+)?)`:\s*(?:_[^_]+_(?:\s*\|\s*_[^_]+_)*\s*)?\*\*([^*]+)\*\*\s*([\s\S]*?)(?=---|\n`\d|<\/blockquote>|$)/g) {
-        my $line_range = $1;
-        my $title = trim($2);
-        my $clean_body = clean_comment_body(trim($3));
-        my $file_name = normalize_file_name($raw_file_name, $line_range);
-
-        push @comments, review_body_comment(
-          $author,
-          $created_at,
-          $file_name,
-          $line_range,
-          $title,
-          $clean_body,
-          $category,
-        );
-      }
-    }
-  }
-
-  return @comments;
-}
-
-sub extract_mendral_comments {
-  my ($reviews) = @_;
-
-  my $latest_review;
-  my $latest_time = "";
-  for my $review (@$reviews) {
-    my $author = $review->{author}{login} // "";
-    my $body = $review->{body} // "";
-    next unless ($author eq "mendral-app" || $author eq "mendral-app[bot]") && is_actionable_mendral_review($body);
-    my $created = $review->{createdAt} // "";
-    if ($created gt $latest_time) {
-      $latest_time = $created;
-      $latest_review = $review;
-    }
-  }
-
-  return () unless $latest_review;
-
-  my $body = $latest_review->{body} // "";
-  my $title = mendral_title($body);
-  return () unless $title;
-
-  my $clean_body = clean_mendral_body($body);
-  return () unless $clean_body ne "";
-
-  my ($file_name, $line_range) = extract_first_file_line_reference($clean_body);
-  return () unless $file_name && $line_range;
-
-  return review_body_comment(
-    $latest_review->{author}{login} // "deleted-user",
-    $latest_review->{createdAt} // "",
-    $file_name,
-    $line_range,
-    $title,
-    $clean_body,
-    "mendral",
-  );
-}
-
-sub review_body_comment {
-  my ($author, $created_at, $file_name, $line_range, $title, $clean_body, $category) = @_;
-
-  # Fingerprint: file + normalized line + title + body (NO timestamp,
-  # NO author, NO category — reposted reviews must dedupe to the same
-  # fingerprint even if a review bot relabels the section).
-  my $fingerprint_input = join("\n", $file_name, $line_range, $title, $clean_body);
-  my $fingerprint = substr(sha256_hex(encode_utf8($fingerprint_input)), 0, 16);
-
-  return {
-    author      => $author,
-    body        => "$title\n\n$clean_body",
-    category    => $category,
-    createdAt   => $created_at,
-    file        => $file_name,
-    fingerprint => $fingerprint,
-    line        => $line_range,
-    title       => $title,
-  };
-}
-
-sub has_supported_sections {
-  my ($text) = @_;
-  $text = strip_markdown_blockquote_prefixes($text);
-  return $text =~ /<summary>\s*[^<]*(?:Nitpick comments|Minor comments|Outside diff range comments)\s*\(\d+\)<\/summary>\s*<blockquote>/i;
-}
-
-sub is_actionable_mendral_review {
-  my ($text) = @_;
-  my $title = mendral_title($text);
-  return defined $title && $title =~ /^(?:needs attention|changes requested|needs changes)$/i;
-}
-
-sub mendral_title {
-  my ($text) = @_;
-  $text = strip_markdown_blockquote_prefixes($text);
-  return $1 if $text =~ /^\s*\*\*([^*]+)\*\*/m;
-  return undef;
-}
-
-sub clean_mendral_body {
-  my ($text) = @_;
-  $text = strip_markdown_blockquote_prefixes($text);
-  $text =~ s/^\s*\*\*[^*]+\*\*\s*//;
-  $text =~ s/<details>[\s\S]*$//;
-  $text =~ s/<sub>[\s\S]*?<\/sub>//g;
-  $text =~ s/<!--[\s\S]*?-->//g;
-  return trim($text);
-}
-
-sub extract_first_file_line_reference {
-  my ($text) = @_;
-  $text =~ s/\x{2013}|\x{2014}/-/g;
-
-  if ($text =~ /`([^`\n]+\/[^`\n]+\.[A-Za-z0-9]+)`[^\n]{0,120}?\blines?\s+(\d+(?:\s*(?:-|to)\s*\d+)?)/i) {
-    return ($1, normalize_line_range($2));
-  }
-
-  return (undef, undef);
-}
-
-sub normalize_line_range {
-  my ($line_range) = @_;
-  $line_range = trim($line_range);
-  return "$1-$2" if $line_range =~ /^(\d+)\s*(?:-|to)\s*(\d+)$/i;
-  return $line_range;
-}
-
-sub extract_review_body_comment_sections {
-  my ($text) = @_;
-  $text = strip_markdown_blockquote_prefixes($text);
-
-  my @sections;
-  while ($text =~ /<summary>\s*[^<]*(Nitpick comments|Minor comments|Outside diff range comments)\s*\(\d+\)<\/summary>\s*<blockquote>/ig) {
-    my $category = section_category($1);
-    my $content_start = $+[0];
-    my $after = substr($text, $content_start);
-
-    my $depth = 1;
-    my @tags;
-    while ($after =~ /(<blockquote>|<\/blockquote>)/gi) {
-      my $tag = $1;
-      my $pos = $-[0];
-      my $is_open = ($tag =~ /^<blockquote>/i) ? 1 : 0;
-      push @tags, [$pos, $is_open];
-    }
-    for my $tag (@tags) {
-      $depth += $tag->[1] ? 1 : -1;
-      if ($depth == 0) {
-        push @sections, {
-          category => $category,
-          content  => substr($after, 0, $tag->[0]),
-        };
-        last;
-      }
-    }
-  }
-  return @sections;
-}
-
-sub section_category {
-  my ($label) = @_;
-  return "nitpick" if $label =~ /Nitpick comments/i;
-  return "minor" if $label =~ /Minor comments/i;
-  return "outside-diff" if $label =~ /Outside diff range comments/i;
-  return "unknown";
-}
-
-sub normalize_file_name {
-  my ($file_name, $line_range) = @_;
-  my $suffix = "-" . $line_range;
-  $file_name =~ s/\Q$suffix\E$//;
-  return $file_name;
-}
-
-sub strip_markdown_blockquote_prefixes {
-  my ($text) = @_;
-  $text =~ s/^[ \t]*>[ \t]?//mg;
-  return $text;
-}
-
-sub clean_comment_body {
-  my ($text) = @_;
-  my $prev = "";
-  while ($text ne $prev) {
-    $prev = $text;
-    $text =~ s/<details>(?:(?!<details>)[\s\S])*?<\/details>//g;
-  }
-  # Do NOT HTML-escape angle brackets: the nitpick body is posted back to GitHub
-  # as Markdown via `gh api`, where `&lt;`/`&gt;` would render literally and
-  # corrupt generic-type expressions or HTML snippets from the original review.
-  return trim($text);
-}
-
-sub trim {
-  my ($s) = @_;
-  $s =~ s/^\s+//;
-  $s =~ s/\s+$//;
-  return $s;
-}
-'
-}