@iceinvein/agent-skills 0.23.12 → 0.23.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iceinvein/agent-skills",
-  "version": "0.23.12",
+  "version": "0.23.13",
   "description": "Install agent skills into AI coding tools",
   "author": "iceinvein",
   "license": "MIT",

package/skills/index.json

@@ -227,7 +227,7 @@
     "name": "magpie",
     "description": "Interactive PR review pipeline. Runs five parallel specialist subagents (security, bugs, performance, code-smells, architecture) plus a once-per-PR checks pass that finds tests and controls able to pass without proving their purpose, drops findings whose quoted evidence is not in the code, dedupes, runs critic subagents that re-check each finding against the worktree and set its risk label, peer-reviews via codex exec (falling back to a Claude second opinion when codex is unavailable), and serves an interactive HTML report for selecting or dismissing findings to post via gh, recording the outcome per finding as labels. Bundles a Bun CLI put on PATH by the skill's postinstall step under a bunx install, or by the plugin's bin/ under a Claude Code plugin install. Use when the user asks to review a GitHub pull request. Local mode (setup --local) runs the same pipeline on the current branch's diff from its merge base, uncommitted and untracked work included, against the caller's live tree, with no server or posting, and hands the ranked findings back in the terminal for an implementing or orchestrating agent to address. Splits oversized diffs into budgeted shards and rebuilds the diff from the local clone when gh pr diff refuses it.",
     "type": "prompt",
-    "version": "0.16.0"
+    "version": "0.16.1"
   },
   {
     "name": "migrate",

package/skills/magpie/SKILL.md

@@ -203,7 +203,7 @@ If codex returns non-zero on a batch, do not abort: record `{stage: peer-review,
 
 ### 7b. Proof
 
-Append `{stage: proof, status: running}` and re-render progress. `magpie proof-prompt "$RUN_DIR"` fills `references/proof.md` for up to 8 serious findings, printing `<prompt path>\t<output path>` each. On a PR run with any printed, first install `$WORKTREE`'s dependencies once with the repo's frozen-lockfile command (`npm ci`, `uv sync --frozen`, ...); on failure log `{stage: proof-deps, status: skipped, error}` and go on. Dispatch the prompts as stage 6 does its batches, then `magpie proof-apply "$RUN_DIR"`: it drops disproved findings to `proof-dropped.json`, marks the rest and logs `done`. On a non-zero exit, delete only the `proof-<id>.json` files or leftovers stderr names, then re-dispatch or re-apply.
+Append `{stage: proof, status: running}` and re-render progress. `magpie proof-prompt "$RUN_DIR"` fills `references/proof.md` for up to 8 must-fix or should-fix findings, printing `<prompt path>\t<output path>` each. On a PR run with any printed, first install `$WORKTREE`'s dependencies once with the repo's frozen-lockfile command (`npm ci`, `uv sync --frozen`, ...); on failure log `{stage: proof-deps, status: skipped, error}` and go on. Dispatch the prompts as stage 6 does its batches, then `magpie proof-apply "$RUN_DIR"`: it drops disproved findings to `proof-dropped.json`, marks the rest and logs `done`. On a non-zero exit, delete only the `proof-<id>.json` files or leftovers stderr names, then re-dispatch or re-apply.
 
 ### 8. Report
 

package/skills/magpie/bin/magpie.ts

@@ -22,8 +22,8 @@ Subcommands:
   critic-apply <run-dir> [--design-cap N]
                              Apply critic verdicts, write findings.kept.json (no cap on
                              code-smells + architecture keeps unless --design-cap is given)
-  proof-prompt <run-dir>     Write one proof prompt per serious finding, print prompt and
-                             output paths
+  proof-prompt <run-dir>     Write one proof prompt per must-fix or should-fix finding, print
+                             prompt and output paths
   proof-apply <run-dir>      Fold proof results into findings.final.json, drop the disproved
   shard <run-dir> [--budget N] [--max-files N]
                              Re-split diff.patch into budgeted shards (and the

package/skills/magpie/references/proof.md

@@ -1,8 +1,8 @@
 # Proof prompt
 
 Stage 7b of the walkthrough does not read this file by hand. `magpie proof-prompt
-"$RUN_DIR"` picks the findings worth proving from `findings.final.json` (impact
-critical or high, action must-fix or should-fix, at most 8, highest score first),
+"$RUN_DIR"` picks the findings worth proving from `findings.final.json` (action
+must-fix or should-fix, at most 8, highest score first),
 takes the fenced `magpie-proof` block below, fills its four placeholders, and writes
 one prompt file per finding:
 
@@ -56,7 +56,10 @@ Diff: <<DIFF_PATH>>
    real dependency never would proves nothing.
 4. Run only that file, with colour off (`--no-color`, `CI=1`), and in a way that does
    not compile or type-check the whole project: other provers' half-written files sit
-   beside yours. Read the output.
+   beside yours. Read the output. Anything you save outside the test file, such as the
+   run's output, goes in a directory of your own from `mktemp -d`, never a scratchpad or
+   temp path another session shares: other provers write there too, and their output
+   is not your result.
 5. Copy the test's full source and the last 40 lines of output (at most) into your
    result. Then, whatever the outcome, `not-proven` included, delete the test file and
    anything its run created (snapshots, fixtures). Change no other file in the working

package/skills/magpie/scripts/__tests__/history.test.ts

@@ -202,3 +202,31 @@ test('history with only leads carries the leads heading and no repeats preamble'
     ].join('\n'),
   )
 })
+
+test('already-raised leaves out comments from github-actions, which posts CI output', () => {
+  const out = renderAlreadyRaised({
+    activity: {
+      checks: [],
+      threads: [],
+      comments: [
+        { author: 'github-actions', body: '<h2>Coverage Report</h2>', magpie: false },
+        { author: 'coderabbitai', body: 'This retry never backs off.', magpie: false },
+      ],
+    },
+    previous: null,
+  })
+  expect(out).toBe('PR comments:\n- coderabbitai: This retry never backs off.')
+})
+
+test('already-raised is (none) when the only comments are CI output', () => {
+  expect(
+    renderAlreadyRaised({
+      activity: {
+        checks: [],
+        threads: [],
+        comments: [{ author: 'github-actions', body: '<h2>Coverage Report</h2>', magpie: false }],
+      },
+      previous: null,
+    }),
+  ).toBe('(none)')
+})

package/skills/magpie/scripts/__tests__/proof.test.ts

@@ -44,17 +44,24 @@ const REPRO = {
   output: 'expected 1, received undefined',
 }
 
-test('only high or critical findings marked must-fix or should-fix are selected', () => {
+test('findings marked must-fix or should-fix are selected whatever their impact', () => {
   const selected = selectForProof(
     [
       finding('high-should', HIGH_SHOULD),
       finding('medium-should', MEDIUM_SHOULD),
+      finding('low-should', { ...HIGH_SHOULD, impact: 'low' }),
       finding('high-consider', HIGH_CONSIDER),
+      finding('high-optional', { ...HIGH_SHOULD, action: 'optional' }),
       finding('critical-must', CRITICAL_MUST),
     ],
     8,
   )
-  expect(selected.map((f) => f.id)).toEqual(['critical-must', 'high-should'])
+  expect(selected.map((f) => f.id)).toEqual([
+    'critical-must',
+    'high-should',
+    'medium-should',
+    'low-should',
+  ])
 })
 
 test('selection keeps the highest-scoring findings when there are more than the cap', () => {

package/skills/magpie/scripts/__tests__/skill-lint.test.ts

@@ -114,6 +114,15 @@ test('references/proof.md carries every placeholder proof-prompt fills', async (
   }
 })
 
+test("references/proof.md keeps each prover's scratch output in a directory of its own", async () => {
+  // On PR 254 a prover picked up another prover's run output from the session
+  // scratchpad every subagent shares, and nearly reported it as its own.
+  const text = await readFile(ref('proof.md'), 'utf8')
+  const block = text.match(/^(`{3,4})magpie-proof\n([\s\S]*?)\n\1[ \t]*$/m)?.[2] ?? ''
+  expect(block).toContain('mktemp -d')
+  expect(block).toMatch(/never a scratchpad or\s+temp path another session shares/)
+})
+
 test('references/proof.md asks for the result shape proof-apply accepts', async () => {
   const text = await readFile(ref('proof.md'), 'utf8')
   const block = text.match(/^(`{3,4})magpie-proof\n([\s\S]*?)\n\1[ \t]*$/m)?.[2] ?? ''

package/skills/magpie/scripts/history.ts

@@ -42,6 +42,12 @@ function joinSections(sections: string[][]): string {
     .join('\n\n')
 }
 
+// The account GitHub Actions posts as: coverage tables, deploy previews and other
+// CI output, which reaches the review as checks. Review bots post as their own
+// apps, and what they raise still counts. gh prints the login without `[bot]`,
+// the REST API with it.
+const CI_AUTHORS = new Set(['github-actions', 'github-actions[bot]'])
+
 function raisedSections(input: Pick<History, 'activity' | 'previous'>): string[][] {
   const threads = (input.activity?.threads ?? [])
     .filter((t) => !t.resolved)
@@ -50,9 +56,9 @@ function raisedSections(input: Pick<History, 'activity' | 'previous'>): string[]
       const outdated = t.outdated ? ' [outdated]' : ''
       return `- ${location(t.file, t.line)} (${who})${outdated}: ${flatten(t.body)}`
     })
-  const comments = (input.activity?.comments ?? []).map(
-    (c) => `- ${c.magpie ? 'magpie, earlier run' : c.author}: ${flatten(c.body)}`,
-  )
+  const comments = (input.activity?.comments ?? [])
+    .filter((c) => !CI_AUTHORS.has(c.author))
+    .map((c) => `- ${c.magpie ? 'magpie, earlier run' : c.author}: ${flatten(c.body)}`)
   const dismissed = (input.previous?.findings ?? []).flatMap((f) =>
     f.label === 'dismissed' ? [`- ${location(f.file, f.line)} [${f.reason}]: ${f.title}`] : [],
   )

package/skills/magpie/scripts/proof.ts

@@ -33,10 +33,10 @@ export type ProofDropped = {
 }
 
 export function selectForProof(findings: ReviewFinding[], cap: number): ReviewFinding[] {
+  // Action, not impact: the critic keeps a confirmed defect at should-fix even when
+  // it rates the impact low, and a real PR left nothing high to prove.
   const eligible = findings.filter(
-    (f) =>
-      (f.risk.impact === 'critical' || f.risk.impact === 'high') &&
-      (f.risk.action === 'must-fix' || f.risk.action === 'should-fix'),
+    (f) => f.risk.action === 'must-fix' || f.risk.action === 'should-fix',
   )
   // Scored from risk here, not read from `score`: the peer reviewer may have
   // changed risk or added findings after dedupe set it.

package/skills/magpie/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "magpie",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Interactive PR review pipeline. Runs five parallel specialist subagents (security, bugs, performance, code-smells, architecture) plus a once-per-PR checks pass that finds tests and controls able to pass without proving their purpose, drops findings whose quoted evidence is not in the code, dedupes, runs critic subagents that re-check each finding against the worktree and set its risk label, peer-reviews via codex exec (falling back to a Claude second opinion when codex is unavailable), and serves an interactive HTML report for selecting or dismissing findings to post via gh, recording the outcome per finding as labels. Bundles a Bun CLI put on PATH by the skill's postinstall step under a bunx install, or by the plugin's bin/ under a Claude Code plugin install. Use when the user asks to review a GitHub pull request. Local mode (setup --local) runs the same pipeline on the current branch's diff from its merge base, uncommitted and untracked work included, against the caller's live tree, with no server or posting, and hands the ranked findings back in the terminal for an implementing or orchestrating agent to address. Splits oversized diffs into budgeted shards and rebuilds the diff from the local clone when gh pr diff refuses it.",
   "author": "iceinvein",
   "type": "prompt",