@iceinvein/agent-skills 0.23.9 → 0.23.13

package/skills/magpie/scripts/setup-cmd.ts

@@ -1,10 +1,13 @@
 import { appendFile, mkdir, realpath, rm, stat, writeFile } from 'node:fs/promises'
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { fetchPr } from './gh.ts'
-import { buildIncrementalContext, findPreviousRun } from './incremental.ts'
+import { resolvePrHead } from './git-diff.ts'
+import { buildIncrementalContext, changedFilesSince, findPreviousRun } from './incremental.ts'
 import { diffSha256, localBranchDiff, localBranchMeta } from './local-diff.ts'
 import { filterDiff, loadPathFilterConfig } from './path-filter.ts'
+import { fetchPrActivity } from './pr-activity.ts'
 import { type Deps, defaultDeps, preflight, renderInstallHint } from './preflight.ts'
+import { readPreviousFindings, writePreviousFindings } from './previous-findings.ts'
 import { shardDiff } from './shard.ts'
 import { writeTarget } from './target.ts'
 import { detectMissingTests } from './tests-check.ts'
@@ -93,6 +96,13 @@ export async function runSetup(input: RunSetupInput): Promise<number> {
     await cleanup(runDir)
     return diffExit
   }
+  if (input.mode === 'pr') {
+    const activityExit = await writePrActivity(runDir, deps, repoPath, input.prNumber)
+    if (activityExit !== 0) {
+      await cleanup(runDir)
+      return activityExit
+    }
+  }
 
   await applyPathFilter(runDir, repoPath)
 
@@ -113,15 +123,35 @@ export async function runSetup(input: RunSetupInput): Promise<number> {
     return 0
   }
 
-  await detectIncrementalReview(runDir, input.prNumber)
+  const prJson = (await Bun.file(join(runDir, 'pr.json')).json()) as { headRefOid: string }
+  const head = await resolvePrHead({
+    gitBin: deps.git,
+    repoPath,
+    prNumber: input.prNumber,
+    headRefOid: prJson.headRefOid,
+  })
+  if (!head.ok) {
+    await logLine(runDir, { stage: 'worktree', status: 'error', error: head.error })
+    process.stderr.write(`magpie: ${head.error}\n`)
+    await cleanup(runDir)
+    return 5
+  }
 
-  const prJson = (await Bun.file(join(runDir, 'pr.json')).json()) as { headRefName: string }
-  const branch = prJson.headRefName
+  let previous: { runId: string; runDir: string } | null
+  try {
+    previous = await detectIncrementalReview(runDir, deps.git, repoPath, input.prNumber)
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    await logLine(runDir, { stage: 'incremental', status: 'error', error: message })
+    process.stderr.write(`magpie: ${message}\n`)
+    await cleanup(runDir)
+    return 4
+  }
 
   const wt = await createWorktree({
     gitBin: deps.git,
     repoPath,
-    branch,
+    branch: head.sha,
     runDir: runDir,
   })
   if (!wt.ok) {
@@ -146,10 +176,90 @@ export async function runSetup(input: RunSetupInput): Promise<number> {
     await cleanup(runDir)
     return 5
   }
+  if (previous) {
+    try {
+      await carryPreviousFindings(runDir, previous, wt.worktreePath)
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      await logLine(runDir, { stage: 'previous-findings', status: 'error', error: message })
+      process.stderr.write(`magpie: ${message}\n`)
+      const removed = await removeWorktree({
+        gitBin: deps.git,
+        repoPath,
+        worktreePath: wt.worktreePath,
+      })
+      if (!removed.ok) process.stderr.write(`magpie: ${removed.error}\n`)
+      await cleanup(runDir)
+      return 5
+    }
+  }
   await logLine(runDir, { stage: 'setup', status: 'done', worktree: wt.worktreePath })
   return 0
 }
 
+async function writePrActivity(
+  runDir: string,
+  deps: Deps,
+  repoPath: string,
+  prNumber: number,
+): Promise<number> {
+  const fail = async (error: string): Promise<number> => {
+    await logLine(runDir, { stage: 'pr-activity', status: 'error', error })
+    process.stderr.write(`magpie: ${error}\n`)
+    return 4
+  }
+  const prJson = (await Bun.file(join(runDir, 'pr.json')).json()) as { url?: unknown }
+  if (typeof prJson.url !== 'string') return fail('pr.json has no url')
+  let result: Awaited<ReturnType<typeof fetchPrActivity>>
+  try {
+    result = await fetchPrActivity({
+      ghBin: deps.gh,
+      prNumber,
+      prUrl: prJson.url,
+      runDir,
+      cwd: repoPath,
+    })
+  } catch (err) {
+    return fail(err instanceof Error ? err.message : String(err))
+  }
+  if (!result.ok) return fail(result.error)
+  await logLine(runDir, {
+    stage: 'pr-activity',
+    status: 'done',
+    checks: result.activity.checks.length,
+    threads: result.activity.threads.length,
+    comments: result.activity.comments.length,
+  })
+  return 0
+}
+
+async function carryPreviousFindings(
+  runDir: string,
+  previous: { runId: string; runDir: string },
+  worktree: string,
+): Promise<void> {
+  const carried = await readPreviousFindings({
+    runDir: previous.runDir,
+    runId: previous.runId,
+    worktree,
+  })
+  if (!carried) {
+    await logLine(runDir, {
+      stage: 'previous-findings',
+      status: 'none',
+      previousRunId: previous.runId,
+    })
+    return
+  }
+  await writePreviousFindings(runDir, carried)
+  await logLine(runDir, {
+    stage: 'previous-findings',
+    status: 'done',
+    previousRunId: previous.runId,
+    findings: carried.findings.length,
+  })
+}
+
 /** realpath of the nearest existing ancestor, with the not-yet-created tail re-appended. */
 async function realpathAllowingMissing(path: string): Promise<string> {
   const absolute = resolve(path)
@@ -309,6 +419,8 @@ async function cleanup(runDir: string): Promise<void> {
     'excluded-files.json',
     'shards',
     'incremental.json',
+    'pr-activity.json',
+    'previous-findings.json',
     'findings',
     'screen',
     'state',
@@ -340,25 +452,44 @@ async function runTestsCheck(runDir: string): Promise<void> {
   await logLine(runDir, { stage: 'tests-check', status: 'done', findings: findings.length })
 }
 
-async function detectIncrementalReview(runDir: string, prNumber: number): Promise<void> {
-  const previous = await findPreviousRun(prNumber, runDir)
+/** The previous run, for setup to carry its findings forward once the worktree exists. */
+async function detectIncrementalReview(
+  runDir: string,
+  gitBin: string,
+  repoPath: string,
+  prNumber: number,
+): Promise<{ runId: string; runDir: string } | null> {
+  const currentPr = (await Bun.file(join(runDir, 'pr.json')).json()) as Record<string, unknown>
+  if (typeof currentPr.url !== 'string') throw new Error('pr.json has no url')
+  const previous = await findPreviousRun(prNumber, currentPr.url, runDir)
   if (!previous) {
     await logLine(runDir, { stage: 'incremental', status: 'first-run' })
-    return
+    return null
   }
-  const currentPr = (await Bun.file(join(runDir, 'pr.json')).json()) as Record<string, unknown>
   const context = buildIncrementalContext(currentPr, previous)
   if (!context) {
     await logLine(runDir, { stage: 'incremental', status: 'missing-sha' })
-    return
+    return previous
   }
-  await writeFile(join(runDir, 'incremental.json'), `${JSON.stringify(context, null, 2)}\n`)
+  const changedSincePrevious = context.sameSha
+    ? []
+    : await changedFilesSince({
+        gitBin,
+        repoPath,
+        fromSha: context.previousSha,
+        toSha: context.currentSha,
+      })
+  await writeFile(
+    join(runDir, 'incremental.json'),
+    `${JSON.stringify({ ...context, changedSincePrevious }, null, 2)}\n`,
+  )
   await logLine(runDir, {
     stage: 'incremental',
     status: 'done',
     previousRunId: context.previousRunId,
     sameSha: context.sameSha,
   })
+  return previous
 }
 
 async function applyPathFilter(runDir: string, repoPath: string): Promise<void> {

package/skills/magpie/scripts/shard-coverage.ts

@@ -0,0 +1,53 @@
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import type { ShardManifest } from './shard.ts'
+
+/** The shards stage 4 skipped at the gate, from the run's last `shard-coverage` entry. */
+export type ShardCoverage = { skipped: Array<{ id: number; files: string[] }> }
+
+function isMissingFile(err: unknown): boolean {
+  return (err as NodeJS.ErrnoException)?.code === 'ENOENT'
+}
+
+/** Null when no shard was skipped, which is every run that did not answer the gate that way. */
+export async function readShardCoverage(runDir: string): Promise<ShardCoverage | null> {
+  let log: string
+  try {
+    log = await readFile(join(runDir, 'log.jsonl'), 'utf8')
+  } catch (err) {
+    if (isMissingFile(err)) return null
+    throw err
+  }
+  let skippedIds: number[] | null = null
+  for (const line of log.split('\n').filter(Boolean)) {
+    let entry: Record<string, unknown>
+    try {
+      entry = JSON.parse(line)
+    } catch {
+      continue
+    }
+    if (entry.stage !== 'shard-coverage' || entry.status !== 'partial') continue
+    if (!Array.isArray(entry.skipped) || !entry.skipped.every((id) => Number.isInteger(id))) {
+      throw new Error(`${join(runDir, 'log.jsonl')}: shard-coverage skipped must be shard ids`)
+    }
+    skippedIds = entry.skipped as number[]
+  }
+  if (skippedIds === null || skippedIds.length === 0) return null
+  const manifestPath = join(runDir, 'shards', 'manifest.json')
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8')) as ShardManifest
+  return {
+    skipped: skippedIds.map((id) => {
+      const shard = manifest.shards.find((s) => s.id === id)
+      if (!shard) {
+        throw new Error(`${manifestPath}: shard ${id} was skipped but is not in the manifest`)
+      }
+      return { id, files: shard.files }
+    }),
+  }
+}
+
+export function describeUnreviewed(coverage: ShardCoverage): string {
+  const ids = coverage.skipped.map((s) => s.id)
+  const files = coverage.skipped.reduce((n, s) => n + s.files.length, 0)
+  return `Not reviewed: ${ids.length === 1 ? 'shard' : 'shards'} ${ids.join(', ')} (${files} ${files === 1 ? 'file' : 'files'})`
+}

package/skills/magpie/scripts/status-cmd.ts

@@ -12,6 +12,7 @@ export const ORDER = [
   'dedupe',
   'critic',
   'peer-review',
+  'proof',
   'report',
   'post',
 ] as const
@@ -24,6 +25,7 @@ export const LOCAL_ORDER = [
   'dedupe',
   'critic',
   'peer-review',
+  'proof',
   'handoff',
 ] as const
 

package/skills/magpie/scripts/types.ts

@@ -42,6 +42,19 @@ export type MergedFromEntry = {
   title: string
 }
 
+export type Repro = {
+  /** Where the prover wrote the repro, relative to the worktree. It is deleted after the run. */
+  path: string
+  command: string
+  source: string
+  output: string
+}
+
+/** A disproved finding is dropped, so a kept finding carries only these two. */
+export type Proof =
+  | { status: 'reproduced'; reason: string; repro: Repro }
+  | { status: 'not-proven'; reason: string }
+
 export type ReviewFinding = {
   id: string
   file: string
@@ -62,6 +75,8 @@ export type ReviewFinding = {
   onChangedLine?: boolean | null
   /** Verbatim code the reviewer quoted as grounds for the finding. */
   evidence?: string
+  /** Set by the proof stage on the findings it tried to reproduce. */
+  proof?: Proof
 }
 
 const IMPACT_SYNONYMS: Record<string, Impact> = {
@@ -262,6 +277,29 @@ export function looksLikeProse(body: string): boolean {
   return false
 }
 
+export function isRepro(raw: unknown): raw is Repro {
+  if (!raw || typeof raw !== 'object') return false
+  const r = raw as Record<string, unknown>
+  return [r.path, r.command, r.source, r.output].every((v) => typeof v === 'string' && v !== '')
+}
+
+function parseProof(raw: unknown): Proof {
+  if (!raw || typeof raw !== 'object') throw new Error('Finding.proof must be an object')
+  const p = raw as Record<string, unknown>
+  if (typeof p.reason !== 'string' || p.reason === '') {
+    throw new Error('Finding.proof.reason must be a non-empty string')
+  }
+  if (p.status === 'not-proven') return { status: 'not-proven', reason: p.reason }
+  if (p.status !== 'reproduced') {
+    throw new Error('Finding.proof.status must be reproduced or not-proven')
+  }
+  if (!isRepro(p.repro)) {
+    throw new Error('Finding.proof.repro needs path, command, source and output')
+  }
+  const { path, command, source, output } = p.repro
+  return { status: 'reproduced', reason: p.reason, repro: { path, command, source, output } }
+}
+
 export function parseFinding(raw: unknown): ReviewFinding {
   if (!raw || typeof raw !== 'object') {
     throw new Error(`Finding must be an object, got ${typeof raw}`)
@@ -306,6 +344,7 @@ export function parseFinding(raw: unknown): ReviewFinding {
       ? { onChangedLine: r.onChangedLine as boolean | null }
       : {}),
     ...(typeof r.evidence === 'string' && r.evidence.length > 0 ? { evidence: r.evidence } : {}),
+    ...(r.proof !== undefined ? { proof: parseProof(r.proof) } : {}),
   }
 }
 

package/skills/magpie/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "magpie",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "description": "Interactive PR review pipeline. Runs five parallel specialist subagents (security, bugs, performance, code-smells, architecture) plus a once-per-PR checks pass that finds tests and controls able to pass without proving their purpose, drops findings whose quoted evidence is not in the code, dedupes, runs critic subagents that re-check each finding against the worktree and set its risk label, peer-reviews via codex exec (falling back to a Claude second opinion when codex is unavailable), and serves an interactive HTML report for selecting or dismissing findings to post via gh, recording the outcome per finding as labels. Bundles a Bun CLI put on PATH by the skill's postinstall step under a bunx install, or by the plugin's bin/ under a Claude Code plugin install. Use when the user asks to review a GitHub pull request. Local mode (setup --local) runs the same pipeline on the current branch's diff from its merge base, uncommitted and untracked work included, against the caller's live tree, with no server or posting, and hands the ranked findings back in the terminal for an implementing or orchestrating agent to address. Splits oversized diffs into budgeted shards and rebuilds the diff from the local clone when gh pr diff refuses it.",
   "author": "iceinvein",
   "type": "prompt",

package/skills/magpie/templates/styles.css

@@ -1785,3 +1785,33 @@ code.inline-code {
   color: var(--accent);
   text-decoration: none;
 }
+
+.proof-chip {
+  font-family: var(--font-mono);
+  font-size: 10px;
+  font-weight: 700;
+  padding: 2px 6px;
+  border-radius: 999px;
+  flex-shrink: 0;
+}
+
+.proof-chip.reproduced {
+  background: var(--badge-posted-bg);
+  color: var(--badge-posted-ink);
+}
+
+.proof-chip.not-proven {
+  background: var(--card-inset);
+  color: var(--ink-muted);
+}
+
+pre.repro {
+  font-family: var(--font-mono);
+  font-size: 12px;
+  background: var(--card-inset);
+  border-radius: var(--radius-sm);
+  padding: 6px 8px;
+  margin: 4px 0 0;
+  white-space: pre-wrap;
+  overflow-x: auto;
+}

package/skills/sluice/scripts/status.sh

@@ -862,11 +862,13 @@ write_state() {
 # their own task at the same moment. A flip reads the whole file, edits it with
 # jq and writes it back, so unserialised the later write is built on a snapshot
 # taken before the earlier one landed and drops that row without saying so.
-# mkdir is the atomic primitive every platform this runs on has; flock is Linux
-# only. Reads do not take it: write_state installs through a rename, so a reader
-# sees either the whole old file or the whole new one.
+# The lock is a file created with bash's noclobber, which bash opens itself with
+# O_CREAT|O_EXCL, so exactly one racer gets it on every platform. Not mkdir:
+# Ubuntu 26.04's uutils mkdir reports success to several callers racing on one
+# path. flock is Linux only. Reads do not take the lock: write_state installs
+# through a rename, so a reader sees either the whole old file or the whole new one.
 #
-# The holder's pid goes inside the directory so a killed run cannot wedge every
+# The holder's pid is the file's content so a killed run cannot wedge every
 # later one. A lock whose holder is gone is broken rather than waited out, and
 # one whose holder is alive is waited on for a bounded time and then reported,
 # because a command that hangs in a status bar is worse than one that fails.
@@ -874,18 +876,36 @@ write_state() {
 LOCKS_TAKEN=()
 release_lock() {
 	local l
-	for l in "${LOCKS_TAKEN[@]+"${LOCKS_TAKEN[@]}"}"; do rm -rf "$l"; done
+	for l in "${LOCKS_TAKEN[@]+"${LOCKS_TAKEN[@]}"}"; do rm -f "$l"; done
 	LOCKS_TAKEN=()
 }
 
+# Every waiter reads the holder's pid while it holds, so when it exits they all
+# see it dead at once. Each removing the lock on that stale read would remove
+# the lock the next command had just taken, leaving two writers. Breaking
+# is serialised instead, and the pid is read again once its process is known
+# dead: the holder may have released and a new command taken the lock between
+# the first read and the check. A dead holder cannot remove its own lock,
+# so the same pid on the second read means the lock is still the stale one.
+# A file read empty is a holder between creating it and writing its pid, alive.
+break_stale_lock() { # <lock path>
+	local lock="$1" holder broke=1
+	(set -o noclobber; : >"$lock.break") 2>/dev/null || return 1
+	holder="$(cat "$lock" 2>/dev/null)"
+	if [ -n "$holder" ] && ! kill -0 "$holder" 2>/dev/null \
+		&& [ "$(cat "$lock" 2>/dev/null)" = "$holder" ]; then
+		rm -f "$lock"
+		broke=0
+	fi
+	rm -f "$lock.break"
+	return "$broke"
+}
+
 take_lock() { # [<lock path>, default the run's own]
-	local lock="${1:-$LOCK}" waited=0 holder
-	while ! mkdir "$lock" 2>/dev/null; do
-		holder="$(cat "$lock/pid" 2>/dev/null)"
-		if [ -n "$holder" ] && ! kill -0 "$holder" 2>/dev/null; then
-			rm -rf "$lock"
-			continue
-		fi
+	local lock="${1:-$LOCK}" waited=0
+	# $$ in the subshell is still this command's pid.
+	while ! (set -o noclobber; printf '%s\n' "$$" >"$lock") 2>/dev/null; do
+		break_stale_lock "$lock" && continue
 		if [ "$waited" -ge 100 ]; then
 			err "another sluice command has held $lock for 10s; remove it if nothing is running"
 			exit 1
@@ -893,7 +913,6 @@ take_lock() { # [<lock path>, default the run's own]
 		sleep 0.1
 		waited=$((waited + 1))
 	done
-	printf '%s\n' "$$" >"$lock/pid" 2>/dev/null || true
 	LOCKS_TAKEN+=("$lock")
 	trap release_lock EXIT INT TERM
 }

package/skills/sluice/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "sluice",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "description": "Routes work by change shape into four channels (bypass, fast, main, deep) and applies only the rules each channel needs, so a one-line fix does not pay the cost of a multi-subsystem build. Carries nine rules as one-liners in the router and the full treatment in references read only on friction. Deep runs read the repo before designing, map the spec's intent to its decisions, and check spec against intent and plan against spec with a fresh reader, with plan.sh validate enforcing that every decision is covered. Checks the finished plan with plan.sh validate rather than trusting it to memory, seeds the run state from it, keeps a deep run's task breakdown in .sluice/run.json so a statusline segment, one status command and a SessionStart hook can answer where the run is (the hook prints a live run at every session start, compaction included), lists every live deep run and routed fast or main session on the machine in one board.sh view (drawn once, watched, or as JSON), and closes each run with a ledger read out of the session transcript: elapsed, tools, tokens, and what each dispatched agent cost where the transcript recorded it. Two Stop hooks hold a handback: one refuses a tree that moved since its last recorded check, the other refuses a changed existing test not proven to fail on the session's starting code (or recorded with a reason). Claude Code only; stands down where the superpowers pipeline governs the repo.",
   "author": "iceinvein",
   "type": "prompt",