@iceinvein/agent-skills 0.1.30 → 0.1.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iceinvein/agent-skills",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "Install agent skills into AI coding tools",
   "author": "iceinvein",
   "license": "MIT",

package/skills/index.json

@@ -197,7 +197,7 @@
     "name": "magpie",
     "description": "Interactive PR review pipeline. Runs five parallel specialist subagents (security, bugs, performance, code-smells, architecture), dedupes findings, applies a critic rubric, peer-reviews via codex exec, and serves an interactive HTML report for selecting findings to post via gh. Bundles a Bun CLI installed onto PATH via the skill's postinstall step. Use when the user asks to review a GitHub pull request.",
     "type": "prompt",
-    "version": "0.4.0"
+    "version": "0.5.0"
   },
   {
     "name": "module-secret-auditor",

package/skills/magpie/SKILL.md

@@ -83,13 +83,29 @@ Write findings to $RUN_DIR/findings/<focus>.json before returning. The file MUST
   "title": string,                   // one line
   "description": string,             // 2-4 short labelled paragraphs (see below). Cite code with file:line.
   "suggestion": {                    // OPTIONAL; omit the key entirely if not applicable. NOT "recommendation"
-    "body": string,
+    "body": string,                  // LITERAL replacement source code for lines startLine..endLine. NOT prose. See rules below.
     "startLine": number,
     "endLine": number
   },
   "domain": "<focus>"                // literal focus id, copied verbatim
 }
 
+**Enum values are exact strings, not free-form prose.** Every value above between `"..."` and `|` markers is a literal token. Copy them verbatim. Specifically:
+
+- `severity`, `risk.impact`, `risk.confidence` use category names (e.g. `high`, `low`), not sentences.
+- `risk.likelihood` describes frequency, not impact. Valid values are exactly `likely`, `possible`, `edge-case`, `unknown`. NEVER use `high`/`medium`/`low` here (those are likelihood-as-impact and will be auto-corrected, but pick the right axis).
+- `risk.action` is the disposition tag, not the recommendation text. Valid values are exactly `must-fix`, `should-fix`, `consider`, `optional`. The recommendation prose belongs in `description` under `Suggested direction:`, never in `risk.action`.
+
+Bad (will be silently coerced, do not rely on this):
+```
+"risk": { "impact": "blocker", "likelihood": "high", "confidence": "very high", "action": "Fix this immediately before merging." }
+```
+
+Good:
+```
+"risk": { "impact": "critical", "likelihood": "likely", "confidence": "high", "action": "must-fix" }
+```
+
 `description` MUST be a sequence of short labelled paragraphs separated by blank lines, using these exact prefixes when they apply:
 
 - `Observation: <one idea, what the diff actually does and where>`
@@ -99,6 +115,13 @@ Write findings to $RUN_DIR/findings/<focus>.json before returning. The file MUST
 
 One idea per paragraph. Do not collapse them into a single wall of text. Do not invent extra labels. If a section doesn't apply, omit it. The interactive report and the GitHub comment both parse these labels and render them as section headers, so missing labels degrade the output.
 
+**`suggestion.body` rules.** When present, `body` MUST be the literal source code that should replace lines `startLine..endLine` verbatim. It is fenced as `` ```suggestion `` on GitHub and rendered as a one-click "Apply" button; the bytes you write here get committed as-is to the PR. Therefore:
+
+- Write code only. No leading "Strip the delimiter...", "Add a check that...", or other prose. The prose explanation belongs in `description` under `Suggested direction:`.
+- Match the file's existing indentation and language exactly. Include only the lines being replaced; do not include unchanged surrounding context.
+- If you cannot produce an exact, copy-pasteable replacement (you don't know the surrounding code, the fix spans multiple files, or the change is conceptual), OMIT the `suggestion` key entirely. A prose `Suggested direction:` in `description` is the right channel for that.
+- Wrapping the code in a `` ``` `` fence inside `body` is tolerated (the poster hoists the inner code out), but bare code is preferred.
+
 If you have no findings, write []. Return as your final tool result a single line: `<focus>: <N> findings (<blocker>/<high>/<medium>/<low>)`. Do not include other prose.
 ```
 

package/skills/magpie/bun.lock

@@ -4,18 +4,109 @@
   "workspaces": {
     "": {
       "name": "magpie",
+      "dependencies": {
+        "shiki": "^1.24.0",
+      },
       "devDependencies": {
         "@types/bun": "^1.2.0",
       },
     },
   },
   "packages": {
+    "@shikijs/core": ["@shikijs/core@1.29.2", "", { "dependencies": { "@shikijs/engine-javascript": "1.29.2", "@shikijs/engine-oniguruma": "1.29.2", "@shikijs/types": "1.29.2", "@shikijs/vscode-textmate": "^10.0.1", "@types/hast": "^3.0.4", "hast-util-to-html": "^9.0.4" } }, "sha512-vju0lY9r27jJfOY4Z7+Rt/nIOjzJpZ3y+nYpqtUZInVoXQ/TJZcfGnNOGnKjFdVZb8qexiCuSlZRKcGfhhTTZQ=="],
+
+    "@shikijs/engine-javascript": ["@shikijs/engine-javascript@1.29.2", "", { "dependencies": { "@shikijs/types": "1.29.2", "@shikijs/vscode-textmate": "^10.0.1", "oniguruma-to-es": "^2.2.0" } }, "sha512-iNEZv4IrLYPv64Q6k7EPpOCE/nuvGiKl7zxdq0WFuRPF5PAE9PRo2JGq/d8crLusM59BRemJ4eOqrFrC4wiQ+A=="],
+
+    "@shikijs/engine-oniguruma": ["@shikijs/engine-oniguruma@1.29.2", "", { "dependencies": { "@shikijs/types": "1.29.2", "@shikijs/vscode-textmate": "^10.0.1" } }, "sha512-7iiOx3SG8+g1MnlzZVDYiaeHe7Ez2Kf2HrJzdmGwkRisT7r4rak0e655AcM/tF9JG/kg5fMNYlLLKglbN7gBqA=="],
+
+    "@shikijs/langs": ["@shikijs/langs@1.29.2", "", { "dependencies": { "@shikijs/types": "1.29.2" } }, "sha512-FIBA7N3LZ+223U7cJDUYd5shmciFQlYkFXlkKVaHsCPgfVLiO+e12FmQE6Tf9vuyEsFe3dIl8qGWKXgEHL9wmQ=="],
+
+    "@shikijs/themes": ["@shikijs/themes@1.29.2", "", { "dependencies": { "@shikijs/types": "1.29.2" } }, "sha512-i9TNZlsq4uoyqSbluIcZkmPL9Bfi3djVxRnofUHwvx/h6SRW3cwgBC5SML7vsDcWyukY0eCzVN980rqP6qNl9g=="],
+
+    "@shikijs/types": ["@shikijs/types@1.29.2", "", { "dependencies": { "@shikijs/vscode-textmate": "^10.0.1", "@types/hast": "^3.0.4" } }, "sha512-VJjK0eIijTZf0QSTODEXCqinjBn0joAHQ+aPSBzrv4O2d/QSbsMw+ZeSRx03kV34Hy7NzUvV/7NqfYGRLrASmw=="],
+
+    "@shikijs/vscode-textmate": ["@shikijs/vscode-textmate@10.0.2", "", {}, "sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg=="],
+
     "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
 
+    "@types/hast": ["@types/hast@3.0.4", "", { "dependencies": { "@types/unist": "*" } }, "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ=="],
+
+    "@types/mdast": ["@types/mdast@4.0.4", "", { "dependencies": { "@types/unist": "*" } }, "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA=="],
+
     "@types/node": ["@types/node@25.7.0", "", { "dependencies": { "undici-types": "~7.21.0" } }, "sha512-z+pdZyxE+RTQE9AcboAZCb4otwcrvgHD+GlBpPgn0emDVt0ohrTMhAwlr2Wd9nZ+nihhYFxO2pThz3C5qSu2Eg=="],
 
+    "@types/unist": ["@types/unist@3.0.3", "", {}, "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q=="],
+
+    "@ungap/structured-clone": ["@ungap/structured-clone@1.3.1", "", {}, "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ=="],
+
     "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
 
+    "ccount": ["ccount@2.0.1", "", {}, "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg=="],
+
+    "character-entities-html4": ["character-entities-html4@2.1.0", "", {}, "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA=="],
+
+    "character-entities-legacy": ["character-entities-legacy@3.0.0", "", {}, "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ=="],
+
+    "comma-separated-tokens": ["comma-separated-tokens@2.0.3", "", {}, "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg=="],
+
+    "dequal": ["dequal@2.0.3", "", {}, "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA=="],
+
+    "devlop": ["devlop@1.1.0", "", { "dependencies": { "dequal": "^2.0.0" } }, "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA=="],
+
+    "emoji-regex-xs": ["emoji-regex-xs@1.0.0", "", {}, "sha512-LRlerrMYoIDrT6jgpeZ2YYl/L8EulRTt5hQcYjy5AInh7HWXKimpqx68aknBFpGL2+/IcogTcaydJEgaTmOpDg=="],
+
+    "hast-util-to-html": ["hast-util-to-html@9.0.5", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/unist": "^3.0.0", "ccount": "^2.0.0", "comma-separated-tokens": "^2.0.0", "hast-util-whitespace": "^3.0.0", "html-void-elements": "^3.0.0", "mdast-util-to-hast": "^13.0.0", "property-information": "^7.0.0", "space-separated-tokens": "^2.0.0", "stringify-entities": "^4.0.0", "zwitch": "^2.0.4" } }, "sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw=="],
+
+    "hast-util-whitespace": ["hast-util-whitespace@3.0.0", "", { "dependencies": { "@types/hast": "^3.0.0" } }, "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw=="],
+
+    "html-void-elements": ["html-void-elements@3.0.0", "", {}, "sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg=="],
+
+    "mdast-util-to-hast": ["mdast-util-to-hast@13.2.1", "", { "dependencies": { "@types/hast": "^3.0.0", "@types/mdast": "^4.0.0", "@ungap/structured-clone": "^1.0.0", "devlop": "^1.0.0", "micromark-util-sanitize-uri": "^2.0.0", "trim-lines": "^3.0.0", "unist-util-position": "^5.0.0", "unist-util-visit": "^5.0.0", "vfile": "^6.0.0" } }, "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA=="],
+
+    "micromark-util-character": ["micromark-util-character@2.1.1", "", { "dependencies": { "micromark-util-symbol": "^2.0.0", "micromark-util-types": "^2.0.0" } }, "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q=="],
+
+    "micromark-util-encode": ["micromark-util-encode@2.0.1", "", {}, "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw=="],
+
+    "micromark-util-sanitize-uri": ["micromark-util-sanitize-uri@2.0.1", "", { "dependencies": { "micromark-util-character": "^2.0.0", "micromark-util-encode": "^2.0.0", "micromark-util-symbol": "^2.0.0" } }, "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ=="],
+
+    "micromark-util-symbol": ["micromark-util-symbol@2.0.1", "", {}, "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q=="],
+
+    "micromark-util-types": ["micromark-util-types@2.0.2", "", {}, "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA=="],
+
+    "oniguruma-to-es": ["oniguruma-to-es@2.3.0", "", { "dependencies": { "emoji-regex-xs": "^1.0.0", "regex": "^5.1.1", "regex-recursion": "^5.1.1" } }, "sha512-bwALDxriqfKGfUufKGGepCzu9x7nJQuoRoAFp4AnwehhC2crqrDIAP/uN2qdlsAvSMpeRC3+Yzhqc7hLmle5+g=="],
+
+    "property-information": ["property-information@7.1.0", "", {}, "sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ=="],
+
+    "regex": ["regex@5.1.1", "", { "dependencies": { "regex-utilities": "^2.3.0" } }, "sha512-dN5I359AVGPnwzJm2jN1k0W9LPZ+ePvoOeVMMfqIMFz53sSwXkxaJoxr50ptnsC771lK95BnTrVSZxq0b9yCGw=="],
+
+    "regex-recursion": ["regex-recursion@5.1.1", "", { "dependencies": { "regex": "^5.1.1", "regex-utilities": "^2.3.0" } }, "sha512-ae7SBCbzVNrIjgSbh7wMznPcQel1DNlDtzensnFxpiNpXt1U2ju/bHugH422r+4LAVS1FpW1YCwilmnNsjum9w=="],
+
+    "regex-utilities": ["regex-utilities@2.3.0", "", {}, "sha512-8VhliFJAWRaUiVvREIiW2NXXTmHs4vMNnSzuJVhscgmGav3g9VDxLrQndI3dZZVVdp0ZO/5v0xmX516/7M9cng=="],
+
+    "shiki": ["shiki@1.29.2", "", { "dependencies": { "@shikijs/core": "1.29.2", "@shikijs/engine-javascript": "1.29.2", "@shikijs/engine-oniguruma": "1.29.2", "@shikijs/langs": "1.29.2", "@shikijs/themes": "1.29.2", "@shikijs/types": "1.29.2", "@shikijs/vscode-textmate": "^10.0.1", "@types/hast": "^3.0.4" } }, "sha512-njXuliz/cP+67jU2hukkxCNuH1yUi4QfdZZY+sMr5PPrIyXSu5iTb/qYC4BiWWB0vZ+7TbdvYUCeL23zpwCfbg=="],
+
+    "space-separated-tokens": ["space-separated-tokens@2.0.2", "", {}, "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q=="],
+
+    "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
+
+    "trim-lines": ["trim-lines@3.0.1", "", {}, "sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg=="],
+
     "undici-types": ["undici-types@7.21.0", "", {}, "sha512-w9IMgQrz4O0YN1LtB7K5P63vhlIOvC7opSmouCJ+ZywlPAlO9gIkJ+otk6LvGpAs2wg4econaCz3TvQ9xPoyuQ=="],
+
+    "unist-util-is": ["unist-util-is@6.0.1", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g=="],
+
+    "unist-util-position": ["unist-util-position@5.0.0", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA=="],
+
+    "unist-util-stringify-position": ["unist-util-stringify-position@4.0.0", "", { "dependencies": { "@types/unist": "^3.0.0" } }, "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ=="],
+
+    "unist-util-visit": ["unist-util-visit@5.1.0", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0", "unist-util-visit-parents": "^6.0.0" } }, "sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg=="],
+
+    "unist-util-visit-parents": ["unist-util-visit-parents@6.0.2", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-is": "^6.0.0" } }, "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ=="],
+
+    "vfile": ["vfile@6.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "vfile-message": "^4.0.0" } }, "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q=="],
+
+    "vfile-message": ["vfile-message@4.0.3", "", { "dependencies": { "@types/unist": "^3.0.0", "unist-util-stringify-position": "^4.0.0" } }, "sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw=="],
+
+    "zwitch": ["zwitch@2.0.4", "", {}, "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A=="],
   }
 }

package/skills/magpie/package.json

@@ -9,6 +9,9 @@
     "lint:fix": "biome check --write .",
     "typecheck": "test -z \"$(find bin scripts -name '*.ts' -print -quit 2>/dev/null)\" || tsc --noEmit"
   },
+  "dependencies": {
+    "shiki": "^1.24.0"
+  },
   "devDependencies": {
     "@types/bun": "^1.2.0"
   }

package/skills/magpie/scripts/__tests__/highlight.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  getHighlighter,
+  highlightCodeBlock,
+  highlightDiffSide,
+  languageFromPath,
+} from '../highlight.ts'
+
+describe('languageFromPath', () => {
+  test('maps known extensions to languages', () => {
+    expect(languageFromPath('src/foo.ts')).toBe('typescript')
+    expect(languageFromPath('src/foo.tsx')).toBe('tsx')
+    expect(languageFromPath('a/b/c.py')).toBe('python')
+    expect(languageFromPath('main.go')).toBe('go')
+    expect(languageFromPath('lib.rs')).toBe('rust')
+    expect(languageFromPath('App.java')).toBe('java')
+    expect(languageFromPath('app.rb')).toBe('ruby')
+    expect(languageFromPath('run.sh')).toBe('bash')
+    expect(languageFromPath('data.json')).toBe('json')
+    expect(languageFromPath('ci.yml')).toBe('yaml')
+    expect(languageFromPath('readme.md')).toBe('markdown')
+    expect(languageFromPath('page.html')).toBe('html')
+    expect(languageFromPath('styles.css')).toBe('css')
+    expect(languageFromPath('schema.sql')).toBe('sql')
+  })
+
+  test('falls back to plaintext for unknown/empty', () => {
+    expect(languageFromPath('LICENSE')).toBe('plaintext')
+    expect(languageFromPath('file.xyz')).toBe('plaintext')
+    expect(languageFromPath('')).toBe('plaintext')
+  })
+
+  test('is case-insensitive on extension', () => {
+    expect(languageFromPath('FOO.TS')).toBe('typescript')
+  })
+})
+
+describe('highlightCodeBlock', () => {
+  test('wraps output in shiki pre/code', async () => {
+    const hl = await getHighlighter()
+    const html = highlightCodeBlock(hl, 'const x = 1', 'typescript')
+    expect(html).toContain('<pre')
+    expect(html).toContain('class="shiki')
+    expect(html).toContain('<code>')
+    expect(html).toContain('<span class="line">')
+  })
+
+  test('falls back to plaintext for unregistered langs without throwing', async () => {
+    const hl = await getHighlighter()
+    const html = highlightCodeBlock(hl, 'hello world', 'klingon')
+    expect(html).toContain('<pre')
+    expect(html).toContain('hello world')
+  })
+
+  test('emits dual-theme CSS variables for prefers-color-scheme', async () => {
+    const hl = await getHighlighter()
+    const html = highlightCodeBlock(hl, 'const x = 1', 'typescript')
+    expect(html).toMatch(/--shiki-dark/)
+  })
+})
+
+describe('highlightDiffSide', () => {
+  test('returns one entry per source line', async () => {
+    const hl = await getHighlighter()
+    const code = 'const a = 1\nconst b = 2\nconst c = 3'
+    const lines = highlightDiffSide(hl, code, 'typescript')
+    expect(lines.length).toBe(3)
+  })
+
+  test('handles multi-line template literal without losing lines', async () => {
+    const hl = await getHighlighter()
+    const code = 'const x = `line1\nline2\nline3`\nconst y = 2'
+    const lines = highlightDiffSide(hl, code, 'typescript')
+    expect(lines.length).toBe(4)
+    expect(lines[0]).toContain('line1')
+    expect(lines[1]).toContain('line2')
+    expect(lines[2]).toContain('line3')
+    expect(lines[3]).toContain('y')
+  })
+
+  test('returns empty array for empty input', async () => {
+    const hl = await getHighlighter()
+    expect(highlightDiffSide(hl, '', 'typescript')).toEqual([])
+  })
+
+  test('plaintext fallback still splits per line', async () => {
+    const hl = await getHighlighter()
+    const lines = highlightDiffSide(hl, 'a\nb\nc', 'plaintext')
+    expect(lines.length).toBe(3)
+  })
+})

package/skills/magpie/scripts/__tests__/post-cmd.test.ts

@@ -109,6 +109,61 @@ test('formatPostBody omits the suggestion block when no suggestion is set', () =
   expect(body).not.toContain('```suggestion')
 })
 
+test('formatInlineBody extracts an embedded fenced code block out of the suggestion body', () => {
+  const body = formatInlineBody({
+    ...findingA,
+    line: 12,
+    suggestion: {
+      body: 'Switch to the inference profile and widen IAM:\n\n```hcl\nstatement {\n  effect = "Allow"\n}\n```\n\nAt minimum, log the failure.',
+      startLine: 12,
+      endLine: 12,
+    },
+  } as never)
+  // Prose appears as ordinary markdown, not inside the suggestion fence.
+  expect(body).toContain('Switch to the inference profile and widen IAM:')
+  expect(body).toContain('At minimum, log the failure.')
+  // The suggestion body contains only the extracted code, not the prose.
+  expect(body).toContain('```suggestion\nstatement {\n  effect = "Allow"\n}\n```')
+  // The hidden finding marker stays inside an HTML comment, not a code block.
+  const markerIdx = body.indexOf('<!-- magpie:finding')
+  expect(markerIdx).toBeGreaterThan(-1)
+  // After the marker the body must be balanced; no dangling open fence above it.
+  const beforeMarker = body.slice(0, markerIdx)
+  const fenceCount = (beforeMarker.match(/```/g) ?? []).length
+  expect(fenceCount % 2).toBe(0)
+})
+
+test('formatInlineBody handles a fenced suggestion that contains no surrounding prose', () => {
+  const body = formatInlineBody({
+    ...findingA,
+    line: 12,
+    suggestion: {
+      body: '```ts\nconst safe = true;\n```',
+      startLine: 12,
+      endLine: 12,
+    },
+  } as never)
+  expect(body).toContain('```suggestion\nconst safe = true;\n```')
+  // No stray, unterminated fence above the magpie marker.
+  const markerIdx = body.indexOf('<!-- magpie:finding')
+  const beforeMarker = body.slice(0, markerIdx)
+  expect((beforeMarker.match(/```/g) ?? []).length % 2).toBe(0)
+})
+
+test('buildSuggestion uses a longer outer fence when the code body contains triple backticks', () => {
+  const body = formatInlineBody({
+    ...findingA,
+    line: 12,
+    suggestion: {
+      body: 'const md = "```inline```"',
+      startLine: 12,
+      endLine: 12,
+    },
+  } as never)
+  // 3 backticks in body → outer fence must be at least 4 to avoid premature close.
+  expect(body).toContain('````suggestion\nconst md = "```inline```"\n````')
+})
+
 test('runPost rejects when pr.json is missing', async () => {
   const outcome = await runPost({ runDir, findingIds: ['anything'] })
   expect(outcome.ok).toBe(false)

package/skills/magpie/scripts/__tests__/render-annotation.test.ts

@@ -1,4 +1,6 @@
-import { describe, expect, test } from 'bun:test'
+import { beforeAll, describe, expect, test } from 'bun:test'
+import type { Highlighter } from 'shiki'
+import { getHighlighter } from '../highlight.ts'
 import { renderAnnotation } from '../render-annotation.ts'
 import type { ReviewFinding } from '../types.ts'
 
@@ -14,54 +16,171 @@ const finding: ReviewFinding = {
   suggestion: { body: 'await lock.acquire()', startLine: 42, endLine: 42 },
 }
 
+let hl: Highlighter
+beforeAll(async () => {
+  hl = await getHighlighter()
+})
+
 describe('renderAnnotation', () => {
   test('emits a div with data-finding-id and severity class', () => {
-    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    const html = renderAnnotation(finding, {
+      checked: false,
+      posted: false,
+      asCard: false,
+      highlighter: hl,
+    })
     expect(html).toContain(`data-finding-id="f-1"`)
     expect(html).toContain('annot')
     expect(html).toContain('data-severity="high"')
   })
 
   test('renders severity label, domain chip, and title', () => {
-    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    const html = renderAnnotation(finding, {
+      checked: false,
+      posted: false,
+      asCard: false,
+      highlighter: hl,
+    })
     expect(html).toContain('HIGH')
     expect(html).toContain('Bugs')
     expect(html).toContain('Race in cache.refresh()')
   })
 
   test('renders parsed description sections', () => {
-    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    const html = renderAnnotation(finding, {
+      checked: false,
+      posted: false,
+      asCard: false,
+      highlighter: hl,
+    })
     expect(html).toContain('Observation')
     expect(html).toContain('two refreshes overlap')
     expect(html).toContain('Why it matters')
   })
 
   test('renders the suggestion code block when present', () => {
-    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    const html = renderAnnotation(finding, {
+      checked: false,
+      posted: false,
+      asCard: false,
+      highlighter: hl,
+    })
     expect(html).toContain('<pre')
-    expect(html).toContain('await lock.acquire()')
+    // Shiki tokenizes identifiers into separate spans; check for a known token
+    expect(html).toContain('acquire')
   })
 
   test('renders risk dimensions footer', () => {
-    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: false })
+    const html = renderAnnotation(finding, {
+      checked: false,
+      posted: false,
+      asCard: false,
+      highlighter: hl,
+    })
     expect(html).toContain('Impact: <span class="tag">high</span>')
     expect(html).toContain('Likelihood: <span class="tag">likely</span>')
   })
 
   test('marks posted findings and disables checkbox', () => {
-    const html = renderAnnotation(finding, { checked: true, posted: true, asCard: false })
+    const html = renderAnnotation(finding, {
+      checked: true,
+      posted: true,
+      asCard: false,
+      highlighter: hl,
+    })
     expect(html).toContain('data-posted="true"')
     expect(html).toContain('checked disabled')
   })
 
   test('marks suggestion-only findings with data-suggestion="true"', () => {
     const suggestion: ReviewFinding = { ...finding, risk: { ...finding.risk, action: 'optional' } }
-    const html = renderAnnotation(suggestion, { checked: false, posted: false, asCard: false })
+    const html = renderAnnotation(suggestion, {
+      checked: false,
+      posted: false,
+      asCard: false,
+      highlighter: hl,
+    })
     expect(html).toContain('data-suggestion="true"')
   })
 
   test('asCard=true wraps in .issue-card', () => {
-    const html = renderAnnotation(finding, { checked: false, posted: false, asCard: true })
+    const html = renderAnnotation(finding, {
+      checked: false,
+      posted: false,
+      asCard: true,
+      highlighter: hl,
+    })
     expect(html).toContain('class="issue-card')
   })
+
+  test('renders backtick spans in description as <code class="inline-code">', () => {
+    const f: ReviewFinding = {
+      id: 'f-2',
+      file: 'a.ts',
+      line: 1,
+      severity: 'high',
+      title: 't',
+      description: 'Observation: `scheduler.ts` wires `.finally(...)` only; no `.catch(...)`.',
+      risk: { impact: 'high', likelihood: 'likely', confidence: 'high', action: 'must-fix' },
+      domain: 'bugs',
+    }
+    const html = renderAnnotation(f, {
+      highlighter: hl,
+      checked: false,
+      posted: false,
+      asCard: true,
+    })
+    expect(html).toContain('<code class="inline-code">scheduler.ts</code>')
+    expect(html).toContain('<code class="inline-code">.finally(...)</code>')
+    expect(html).toContain('<code class="inline-code">.catch(...)</code>')
+    expect(html).not.toContain('<scheduler.ts')
+  })
+
+  test('escapes HTML inside backtick spans', () => {
+    const f: ReviewFinding = {
+      id: 'f-3',
+      file: 'a.ts',
+      line: 1,
+      severity: 'low',
+      title: 't',
+      description: 'Observation: `<Foo & Bar>` should not break out.',
+      risk: { impact: 'low', likelihood: 'edge-case', confidence: 'low', action: 'consider' },
+      domain: 'code-smells',
+    }
+    const html = renderAnnotation(f, {
+      highlighter: hl,
+      checked: false,
+      posted: false,
+      asCard: true,
+    })
+    expect(html).toContain('<code class="inline-code">&lt;Foo &amp; Bar&gt;</code>')
+  })
+
+  test('renders suggestion body with shiki highlighting', () => {
+    const f: ReviewFinding = {
+      id: 'f-1',
+      file: 'scheduler.ts',
+      line: 12,
+      severity: 'high',
+      title: 'unhandled rejection',
+      description: 'Observation: scheduler drops errors.',
+      risk: { impact: 'high', likelihood: 'possible', confidence: 'high', action: 'should-fix' },
+      domain: 'bugs',
+      suggestion: {
+        body: 'const x: number = 1\nconsole.log(x)',
+        startLine: 1,
+        endLine: 2,
+      },
+    }
+    const html = renderAnnotation(f, {
+      highlighter: hl,
+      checked: false,
+      posted: false,
+      asCard: true,
+    })
+    expect(html).toContain('class="suggestion shiki')
+    expect(html).toContain('<span class="line">')
+    // Shiki tokenizes identifiers separately, so check for the token text
+    expect(html).toContain('console')
+  })
 })