@iceinvein/agent-skills 0.23.9 → 0.23.13

package/skills/magpie/evals/quality/replay-full.ts

@@ -5,7 +5,7 @@
 // again, capped by --max-cost-usd.
 
 import { existsSync } from 'node:fs'
-import { mkdir, mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { detectMissingTests } from '../../scripts/tests-check.ts'
@@ -46,6 +46,7 @@ export type ReplayDiagnostics = {
   criticDropped: unknown | null
   evidenceDropped: unknown | null
   thresholdDropped: unknown | null
+  impactBytes: number | null
 }
 
 async function readJsonIfPresent(path: string): Promise<unknown | null> {
@@ -92,6 +93,9 @@ export async function replayDiagnostics(runDir: string): Promise<ReplayDiagnosti
     criticDropped: await readJsonIfPresent(join(runDir, 'critic-dropped.json')),
     evidenceDropped: await readJsonIfPresent(join(runDir, 'evidence-dropped.json')),
     thresholdDropped: await readJsonIfPresent(join(runDir, 'threshold-dropped.json')),
+    impactBytes: existsSync(join(runDir, 'impact.md'))
+      ? (await stat(join(runDir, 'impact.md'))).size
+      : null,
   }
 }
 
@@ -149,7 +153,7 @@ export function replaySummary(input: {
   )
 }
 
-async function exec(
+export async function exec(
   cmd: string[],
   options: { cwd?: string; stdinText?: string; claudeLabel?: string } = {},
 ): Promise<string> {

package/skills/magpie/fixtures/fake-gh-with-lockfile.sh

@@ -1,13 +1,37 @@
 #!/usr/bin/env bash
+# The activity fetch asks pr view for different fields than setup's first call.
+case "$*" in
+  *statusCheckRollup*)
+    cat <<'JSON'
+{
+  "statusCheckRollup": [
+    { "__typename": "CheckRun", "name": "build", "status": "COMPLETED", "conclusion": "FAILURE", "detailsUrl": "https://ci.example/1" }
+  ],
+  "comments": [
+    { "author": { "login": "alice" }, "body": "Does this retry past three attempts?" }
+  ],
+  "reviews": []
+}
+JSON
+    exit 0
+    ;;
+esac
 case "$1 $2" in
   "pr view")
-    cat <<'JSON'
+    # setup runs gh in the repo, so the PR head is read from it: a fake-pr-head file
+    # in the git dir for a head the clone does not have yet, a fake-pr-head tag,
+    # else feature-x, else a SHA no clone has.
+    head=$(cat "$(git rev-parse --git-dir)/fake-pr-head" 2>/dev/null ||
+      git rev-parse --verify -q 'refs/tags/fake-pr-head^{commit}' ||
+      git rev-parse --verify -q 'refs/heads/feature-x' ||
+      echo deadbeefdeadbeefdeadbeefdeadbeefdeadbeef)
+    cat <<JSON
 {
   "number": 1234,
   "title": "Fake PR",
   "headRefName": "feature-x",
   "baseRefName": "main",
-  "headRefOid": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+  "headRefOid": "$head",
   "baseRefOid": "cafebabecafebabecafebabecafebabecafebabe",
   "author": { "login": "octocat" },
   "body": "Fake body",
@@ -18,6 +42,17 @@ case "$1 $2" in
     { "path": "dist/x.js", "additions": 1, "deletions": 0, "changeType": "modified" }
   ]
 }
+JSON
+    ;;
+  "api graphql")
+    cat <<'JSON'
+{ "data": { "repository": { "pullRequest": { "reviewThreads": {
+  "pageInfo": { "hasNextPage": false, "endCursor": null },
+  "nodes": [
+    { "path": "src/a.ts", "line": 1, "originalLine": 1, "isResolved": false, "isOutdated": false,
+      "comments": { "totalCount": 1, "nodes": [ { "author": { "login": "dave" }, "body": "Why 2?" } ] } }
+  ]
+} } } } }
 JSON
     ;;
   "pr diff")

package/skills/magpie/fixtures/fake-gh.sh

@@ -1,13 +1,49 @@
 #!/usr/bin/env bash
+# The activity fetch asks pr view for different fields than setup's first call.
+case "$*" in
+  # cleanup asks each saved PR ref's state: 1234 is open, 9 closed, 5 in a state
+  # gh never reports, 404 errors, and any other PR is merged.
+  *"--json state"*)
+    case "$3" in
+      1234) echo '{"state":"OPEN"}' ;;
+      9) echo '{"state":"CLOSED"}' ;;
+      5) echo '{"state":"WEIRD"}' ;;
+      404) echo 'GraphQL: Could not resolve to a PullRequest' >&2; exit 1 ;;
+      *) echo '{"state":"MERGED"}' ;;
+    esac
+    exit 0
+    ;;
+  *statusCheckRollup*)
+    cat <<'JSON'
+{
+  "statusCheckRollup": [
+    { "__typename": "CheckRun", "name": "build", "status": "COMPLETED", "conclusion": "FAILURE", "detailsUrl": "https://ci.example/1" }
+  ],
+  "comments": [
+    { "author": { "login": "alice" }, "body": "Does this retry past three attempts?" }
+  ],
+  "reviews": []
+}
+JSON
+    exit 0
+    ;;
+esac
 case "$1 $2" in
   "pr view")
-    cat <<'JSON'
+    # setup runs gh in the repo, so the PR head is read from it: a fake-pr-head file
+    # in the git dir for a head the clone does not have yet, a fake-pr-head tag,
+    # else feature-x, else a SHA no clone has.
+    head=$(cat "$(git rev-parse --git-dir)/fake-pr-head" 2>/dev/null ||
+      git rev-parse --verify -q 'refs/tags/fake-pr-head^{commit}' ||
+      git rev-parse --verify -q 'refs/heads/feature-x' ||
+      echo deadbeefdeadbeefdeadbeefdeadbeefdeadbeef)
+    cat <<JSON
 {
   "number": 1234,
   "title": "Fake PR",
   "headRefName": "feature-x",
   "baseRefName": "main",
-  "headRefOid": "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+  "headRefOid": "$head",
   "baseRefOid": "cafebabecafebabecafebabecafebabecafebabe",
   "author": { "login": "octocat" },
   "body": "Fake body",
@@ -35,6 +71,17 @@ case "$1 $2" in
     }
   ]
 }
+JSON
+    ;;
+  "api graphql")
+    cat <<'JSON'
+{ "data": { "repository": { "pullRequest": { "reviewThreads": {
+  "pageInfo": { "hasNextPage": false, "endCursor": null },
+  "nodes": [
+    { "path": "src/a.ts", "line": 1, "originalLine": 1, "isResolved": false, "isOutdated": false,
+      "comments": { "totalCount": 1, "nodes": [ { "author": { "login": "dave" }, "body": "Why 2?" } ] } }
+  ]
+} } } } }
 JSON
     ;;
   "pr diff")

package/skills/magpie/references/critic.md

@@ -1,7 +1,7 @@
 # Critic prompt
 
 Stage 6 of the walkthrough does not read this file by hand. `magpie critic-prompt
-"$RUN_DIR"` takes the fenced `magpie-critic` block below, fills its six placeholders
+"$RUN_DIR"` takes the fenced `magpie-critic` block below, fills its seven placeholders
 from the run directory, and writes one prompt file per batch of candidates:
 
 - `<<CANDIDATES>>`: the batch's candidates from `findings.deduped.json`, with `id`,
@@ -11,6 +11,9 @@ from the run directory, and writes one prompt file per batch of candidates:
   in this batch (a group always rides in one batch).
 - `<<REVIEW_RULES>>`: `brief.json`'s `reviewRules`, one `- <rule> (<source>)` line each,
   or `(none)`.
+- `<<ALREADY_RAISED>>`: from `pr-activity.json` and `previous-findings.json`, the PR's
+  unresolved review threads, its top-level comments, and the findings a reviewer
+  dismissed in an earlier magpie run on this PR, or `(none)`.
 - `<<WORKTREE>>`, `<<DIFF_PATH>>`: the run's worktree and `diff.patch`.
 - `<<OUTPUT_PATH>>`: where this batch's verdicts go, `critic.json` or `critic-<k>.json`.
 
@@ -18,7 +21,7 @@ Each prompt file is the entire task of one `general-purpose` subagent. `magpie
 critic-apply "$RUN_DIR"` then reads every output file, rejects the set if any verdict
 is malformed, and writes `findings.kept.json` and `critic-dropped.json`. The output
 contract in the block is exactly what critic-apply accepts; change one only with the
-other. All six placeholders must stay in the block, or critic-prompt exits 1.
+other. All seven placeholders must stay in the block, or critic-prompt exits 1.
 
 ````magpie-critic
 You are a senior code reviewer auditing candidate review findings that other agents
@@ -53,7 +56,7 @@ Treat every candidate as a claim to verify, not a conclusion to grade. For each
 
 ## When to drop
 
-Drop a candidate only when the code refutes it, and say how in `reason`:
+Drop a candidate only for one of these reasons, and say which in `reason`:
 - The code does not do what the description says, or an existing guard already
   prevents it (name the guard's file:line).
 - The path it describes cannot be reached: no caller passes the value, or the
@@ -68,6 +71,11 @@ Drop a candidate only when the code refutes it, and say how in `reason`:
   assertion that can no longer fail, cleanup that leaks into other tests) is a
   correctness finding, not maintainability: judge it like any other defect.
 - It asks for something a repository review rule below forbids.
+- It repeats an entry under "Already raised" below: an open review thread or PR
+  comment that makes the same point, or a finding the reviewer dismissed in an earlier
+  run. Name who raised it, or the dismissal reason, in `reason`. A candidate that adds
+  something material the earlier entry lacks (a second path, a worse consequence, the
+  fix the thread asked for) is not a repeat: judge it on its own.
 
 None of these is a refutation, so none is a reason to drop:
 - The same mistake already exists elsewhere in the codebase. A pre-existing instance
@@ -101,7 +109,7 @@ about. Downgrade rather than drop when:
   request body, a file name) is not an unlikely precondition.
 
 Downgrade only for a reason on this list, and name it in `reason`. Everything else you
-keep is at full weight. Drop only what the code refutes.
+keep is at full weight. Drop only for a reason under "When to drop".
 
 ## Repository review rules
 
@@ -111,6 +119,14 @@ it; a candidate that asks for something one of these rules forbids should be dro
 
 <<REVIEW_RULES>>
 
+## Already raised
+
+What was already said on this pull request before this review, and what the reviewer
+dismissed in an earlier magpie run on it. A candidate that repeats one of these is
+dropped, as above.
+
+<<ALREADY_RAISED>>
+
 ## Merge candidates
 
 Each group below lists candidate ids anchored close together in one file by more than

package/skills/magpie/references/proof.md

@@ -0,0 +1,102 @@
+# Proof prompt
+
+Stage 7b of the walkthrough does not read this file by hand. `magpie proof-prompt
+"$RUN_DIR"` picks the findings worth proving from `findings.final.json` (action
+must-fix or should-fix, at most 8, highest score first),
+takes the fenced `magpie-proof` block below, fills its four placeholders, and writes
+one prompt file per finding:
+
+- `<<FINDING>>`: the finding's `id`, `file`, `line`, `risk`, `domain`, `title`,
+  `description` and `evidence`, as JSON.
+- `<<WORKTREE>>`, `<<DIFF_PATH>>`: the run's worktree and `diff.patch`. In local mode
+  the worktree is the caller's own repo.
+- `<<OUTPUT_PATH>>`: where this finding's result goes, `proof-<id>.json`.
+
+Each prompt file is the entire task of one `general-purpose` subagent. `magpie
+proof-apply "$RUN_DIR"` then reads every result, rejects the set if any is missing or
+malformed, drops the disproved findings to `proof-dropped.json`, and marks the rest in
+`findings.final.json`. The output contract in the block is exactly what proof-apply
+accepts; change one only with the other. All four placeholders must stay in the
+block, or proof-prompt exits 1.
+
+````magpie-proof
+You are proving or disproving one finding from a code review of a change, by writing a
+test that runs it. A finding that a failing test reproduces is shown to the author with
+the test; a finding the test shows to be wrong is removed. Getting this right matters
+more than getting a result: when you cannot run a fair test, say so.
+
+Time matters here: do not spend time that can be avoided, and the earlier a correct
+result is obtained, the better.
+
+Working directory: <<WORKTREE>>
+Diff: <<DIFF_PATH>>
+
+## The finding
+
+```json
+<<FINDING>>
+```
+
+## How to prove it
+
+1. Read the code at `file` and `line`, and the diff, until you can say exactly which
+   input or sequence of calls shows the defect the description claims.
+2. Find the repository's own test runner from its manifests (`package.json`,
+   `pyproject.toml`, `Cargo.toml`, `go.mod`, ...) and its `CLAUDE.md` or `AGENTS.md`.
+   Use it as the repository's existing tests do. Install nothing: dependencies were
+   installed before you started, and if the runner still cannot run, stop with
+   `not-proven`.
+3. Write one test file whose name contains `magpie-proof-<id>` (the finding's id), or
+   `MagpieProof<id>` where a file name must be an identifier, where the runner
+   discovers it, next to the existing tests for that code. The test asserts the
+   correct behaviour, so it fails while the defect is present. Take the expected value
+   from the finding's description, the diff's intent or the existing tests, never from
+   what you assume the code should do. Call the real code on the path the finding
+   describes. Mock only what the existing tests mock; a mock that returns what the
+   real dependency never would proves nothing.
+4. Run only that file, with colour off (`--no-color`, `CI=1`), and in a way that does
+   not compile or type-check the whole project: other provers' half-written files sit
+   beside yours. Read the output. Anything you save outside the test file, such as the
+   run's output, goes in a directory of your own from `mktemp -d`, never a scratchpad or
+   temp path another session shares: other provers write there too, and their output
+   is not your result.
+5. Copy the test's full source and the last 40 lines of output (at most) into your
+   result. Then, whatever the outcome, `not-proven` included, delete the test file and
+   anything its run created (snapshots, fixtures). Change no other file in the working
+   directory: it may be the author's own checkout, and other provers are running in it
+   at the same time.
+
+## Which outcome
+
+- `"reproduced"`: the test ran and failed on the assertion, with the wrong behaviour
+  the finding describes.
+- `"disproved"`: the test ran, exercised the path the finding describes, and passed,
+  so the code behaves correctly there. Say in `reason` what stops the defect (a guard,
+  a caller that never passes the value), with its file:line.
+- `"not-proven"`: anything else. The defect needs what a test here cannot set up (a
+  live service, real concurrency, a browser, a security boundary outside the process),
+  the runner cannot run, or the test failed for a reason other than the assertion (an
+  import error, a missing fixture, a type error). A test that fails for the wrong
+  reason is not a reproduction and a test that never reached the path is not a
+  disproof: fix it, or report `not-proven` and say why.
+
+## Output contract
+
+Write one JSON object to <<OUTPUT_PATH>> with the Write tool:
+
+```
+{
+  "id": string,              // the finding's id, verbatim
+  "outcome": "reproduced" | "disproved" | "not-proven",
+  "reason": string,          // one sentence, under 25 words
+  "repro": {                 // REQUIRED with "reproduced" and "disproved"; omit with "not-proven"
+    "path": string,          // the test file you wrote, relative to the working directory
+    "command": string,       // the exact command that ran it
+    "source": string,        // the test file's full source
+    "output": string         // the last 40 lines of output, at most
+  }
+}
+```
+
+Then reply with one line: `proof <id>: <outcome>`.
+````

package/skills/magpie/references/scout.md

@@ -29,7 +29,12 @@ Diff: <<RUN_DIR>>/diff.patch
 2. `diff.patch` for what the change actually does. This is the evidence.
 3. The worktree for surrounding context on any file the diff changes but does not
    explain.
-4. The repository's written conventions, for the review rules. At the worktree root:
+4. `<<RUN_DIR>>/pr-activity.json`, when it exists, for what has happened on the PR so
+   far: `checks` (CI results), `threads` (review threads with file, line and whether
+   they are resolved) and `comments`. A failing check, or an unresolved question from a
+   human reviewer that bears on the diff, is a watch item. Leave out what magpie itself
+   posted (`magpie: true`) and anything already resolved.
+5. The repository's written conventions, for the review rules. At the worktree root:
    `CLAUDE.md`, `AGENTS.md`, `CONTRIBUTING*`, `.github/copilot-instructions.md`, and
    every file under `.cursor/rules/`. Then `CLAUDE.md` and `AGENTS.md` in each
    directory the diff touches. Skip any that do not exist.

package/skills/magpie/references/specialists.md

@@ -1,7 +1,7 @@
 # Specialist prompts
 
 Stage 4 of the walkthrough dispatches five subagents per shard from this file. Build
-each prompt from up to five parts, in this order, and send it as the agent's entire
+each prompt from up to six parts, in this order, and send it as the agent's entire
 task. Each part is a fenced block or the named section it points at; the prose around
 them is instruction to you, not text for the specialist.
 
@@ -68,14 +68,24 @@ review rule is a convention the maintainers wrote down: a change that breaks one
 finding in your domain when the rule bears on it, citing the rule's source.
 ```
 
-Replace every `<RUN_DIR>`, `<WORKTREE>` and `<TARGET>` with the real values before
-sending. `<WORKTREE>` is what `magpie target "$RUN_DIR"` prints. `<TARGET>` is `PR #<n>`,
+6. What is already on the PR: the stdout of `magpie history "<RUN_DIR>"`, verbatim,
+   when it prints anything. It lists the PR's open review threads and comments, the
+   findings a reviewer dismissed in an earlier magpie run, failing CI checks, and on a
+   re-review the files changed since the last one. Run it once per run; every
+   specialist gets the same text. It prints nothing on a local run or a first review
+   of a quiet PR, and then the part is left out.
+
+Replace every `<RUN_DIR>`, `<WORKTREE>`, `<TARGET>` and `<focus>` with the real values
+before sending. `<focus>` is the focus id exactly as in the block's tag (`security`,
+`bugs`, `performance`, `code-smells`, `architecture`): a subagent left to fill it in names
+the file after its own reading of the focus (a bugs specialist wrote
+`correctness.shard-4.json`), which nothing reads. `<WORKTREE>` is what `magpie target "$RUN_DIR"` prints. `<TARGET>` is `PR #<n>`,
 or on a local run `local branch <branch> against <baseRef>` (`detached HEAD
 against <baseRef>` when HEAD has no branch). The subagent has no shell variables from
 your session, so an unexpanded path means it writes its findings where nothing will
-read them. Leave `<focus>` as written; the contract tells the subagent to substitute it.
+read them.
 
-Parts 1, 2, and 3 go every time. The contract is what makes the output parseable by
+Parts 1, 2, and 3 go every time; 4, 5 and 6 only when their source exists. The contract is what makes the output parseable by
 `magpie dedupe`, and the focus blocks are what keep the five reviews from collapsing
 into the same generic pass. Do not paraphrase, summarise, or trim either one.
 
@@ -398,8 +408,6 @@ For each potential smell:
 
 Do not flag formatting, naming, or stylistic preference unless it is evidence of a deeper maintainability problem. Avoid duplicating bug, security, or performance findings unless the primary issue is the maintainability smell behind them.
 
-Report at most 3 findings for the scope your run header names, strongest first. If you have more candidates, keep the three whose breaking change is nearest and most concrete and drop the rest.
-
 Use the JSON schema defined in the orchestrator's `## Output Contract` block; do not invent fields.
 ```
 
@@ -464,8 +472,6 @@ Boundary with Security: flag validation gaps as design/contract issues (where va
 
 Focus on design decisions introduced or materially worsened by this PR that affect the long-term health of the codebase. Don't flag things that are "technically impure" but work well in practice.
 
-Report at most 3 findings for the scope your run header names, strongest first. If you have more candidates, keep the three whose breaking change is nearest and most concrete and drop the rest.
-
 Use the JSON schema defined in the orchestrator's `## Output Contract` block; do not invent fields.
 ```
 

package/skills/magpie/scripts/__tests__/cleanup-cmd.test.ts

@@ -47,7 +47,7 @@ afterEach(async () => {
 })
 
 test('cleanup removes worktree and archives run dir', async () => {
-  const exit = await runCleanup({ runDir, repoPath: repo, gitBin: 'git' })
+  const exit = await runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: FAKE_GH })
   expect(exit).toBe(0)
   const original = await Bun.file(join(runDir, 'worktree', 'a.txt')).exists()
   expect(original).toBe(false)
@@ -65,7 +65,7 @@ test('cleanup prints a view-later hint line with the archived id', async () => {
     return true
   }) as typeof process.stdout.write
   try {
-    await runCleanup({ runDir, repoPath: repo, gitBin: 'git' })
+    await runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: FAKE_GH })
   } finally {
     process.stdout.write = origWrite
   }
@@ -85,7 +85,7 @@ test('cleanup of a local run prints the archive path but no view-later hint', as
     return true
   }) as typeof process.stdout.write
   try {
-    await runCleanup({ runDir, repoPath: repo, gitBin: 'git' })
+    await runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: FAKE_GH })
   } finally {
     process.stdout.write = origWrite
   }
@@ -98,7 +98,9 @@ test('cleanup with a malformed target.json rejects before archiving or writing l
   await writeFile(join(runDir, 'log.jsonl'), '')
   await writeFile(join(runDir, 'findings.final.json'), '[]')
   await writeFile(join(runDir, 'target.json'), '{not json')
-  await expect(runCleanup({ runDir, repoPath: repo, gitBin: 'git' })).rejects.toThrow('target.json')
+  await expect(
+    runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: FAKE_GH }),
+  ).rejects.toThrow('target.json')
   const entries = await readdir(dirname(runDir))
   expect(entries.some((e) => e.startsWith(`${basename(runDir)}.archived-`))).toBe(false)
   expect(await Bun.file(join(runDir, 'labels.json')).exists()).toBe(false)
@@ -169,7 +171,7 @@ test('cleanup leaves labels.json in the archived dir when findings.final.json ex
     join(runDir, 'state', 'events'),
     `${JSON.stringify({ type: 'dismiss', findingId: 'sec-1', reason: 'wrong', timestamp: 1 })}\n`,
   )
-  const exit = await runCleanup({ runDir, repoPath: repo, gitBin: 'git' })
+  const exit = await runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: FAKE_GH })
   expect(exit).toBe(0)
   const parent = dirname(runDir)
   const archived = (await readdir(parent)).find((e) =>
@@ -183,7 +185,7 @@ test('cleanup leaves labels.json in the archived dir when findings.final.json ex
 
 test('runCleanup logs kill outcome to log.jsonl', async () => {
   await writeFile(join(runDir, 'log.jsonl'), '')
-  const exit = await runCleanup({ runDir, repoPath: repo, gitBin: 'git' })
+  const exit = await runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: FAKE_GH })
   expect(exit).toBe(0)
   const parent = dirname(runDir)
   const entries = await readdir(parent)
@@ -222,7 +224,12 @@ test('cleanup after a local setup archives the run and leaves the repo as it was
     })
     expect(setupExit).toBe(0)
 
-    const exit = await runCleanup({ runDir: localRun, repoPath: localRepo, gitBin: 'git' })
+    const exit = await runCleanup({
+      runDir: localRun,
+      repoPath: localRepo,
+      gitBin: 'git',
+      ghBin: FAKE_GH,
+    })
     expect(exit).toBe(0)
 
     const parent = dirname(localRun)
@@ -245,3 +252,92 @@ test('cleanup after a local setup archives the run and leaves the repo as it was
     await rm(localRun, { recursive: true, force: true })
   }
 })
+
+async function refExists(ref: string): Promise<boolean> {
+  const proc = Bun.spawn(['git', 'rev-parse', '--verify', '-q', ref], { cwd: repo, stdout: 'pipe' })
+  return (await proc.exited) === 0
+}
+
+test('cleanup of a PR run deletes saved refs of merged or closed PRs and keeps open ones', async () => {
+  await sh(repo, 'git', 'update-ref', 'refs/magpie/pr-1234', 'HEAD')
+  await sh(repo, 'git', 'update-ref', 'refs/magpie/pr-7', 'HEAD')
+
+  const exit = await runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: FAKE_GH })
+
+  expect(exit).toBe(0)
+  expect(await refExists('refs/magpie/pr-1234')).toBe(true)
+  expect(await refExists('refs/magpie/pr-7')).toBe(false)
+})
+
+test('cleanup of a local run leaves saved PR refs alone', async () => {
+  await sh(repo, 'git', 'worktree', 'remove', '--force', join(runDir, 'worktree'))
+  await writeFile(join(runDir, 'target.json'), JSON.stringify({ mode: 'local', root: repo }))
+  await sh(repo, 'git', 'update-ref', 'refs/magpie/pr-7', 'HEAD')
+
+  await runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: FAKE_GH })
+
+  expect(await refExists('refs/magpie/pr-7')).toBe(true)
+})
+
+test('cleanup still archives the run and keeps the refs when gh cannot say a PR state', async () => {
+  await sh(repo, 'git', 'update-ref', 'refs/magpie/pr-7', 'HEAD')
+  const err: string[] = []
+  const origWrite = process.stderr.write.bind(process.stderr)
+  process.stderr.write = ((s: string) => {
+    err.push(s)
+    return true
+  }) as typeof process.stderr.write
+  let exit: number
+  try {
+    exit = await runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: '/usr/bin/false' })
+  } finally {
+    process.stderr.write = origWrite
+  }
+
+  expect(exit).toBe(0)
+  expect(await refExists('refs/magpie/pr-7')).toBe(true)
+  expect(err.join('')).toContain(
+    'magpie: warning: could not prune refs/magpie: gh pr view 7 exit 1',
+  )
+  const entries = await readdir(dirname(runDir))
+  expect(entries.some((e) => e.startsWith(`${basename(runDir)}.archived-`))).toBe(true)
+})
+
+test('cleanup prunes the other refs when gh cannot answer for one, and names the one it skipped', async () => {
+  for (const n of [404, 5, 7, 9, 1234]) {
+    await sh(repo, 'git', 'update-ref', `refs/magpie/pr-${n}`, 'HEAD')
+  }
+  const err: string[] = []
+  const origWrite = process.stderr.write.bind(process.stderr)
+  process.stderr.write = ((s: string) => {
+    err.push(s)
+    return true
+  }) as typeof process.stderr.write
+  let exit: number
+  try {
+    exit = await runCleanup({ runDir, repoPath: repo, gitBin: 'git', ghBin: FAKE_GH })
+  } finally {
+    process.stderr.write = origWrite
+  }
+
+  expect(exit).toBe(0)
+  expect(await refExists('refs/magpie/pr-7')).toBe(false)
+  expect(await refExists('refs/magpie/pr-9')).toBe(false)
+  expect(await refExists('refs/magpie/pr-1234')).toBe(true)
+  expect(await refExists('refs/magpie/pr-404')).toBe(true)
+  expect(await refExists('refs/magpie/pr-5')).toBe(true)
+  expect(err.join('')).toBe(
+    'magpie: warning: could not prune refs/magpie: gh pr view 404 exit 1: GraphQL: Could not resolve to a PullRequest; gh pr view 5: unexpected state "WEIRD"\n',
+  )
+  const archived = (await readdir(dirname(runDir))).find((e) =>
+    e.startsWith(`${basename(runDir)}.archived-`),
+  ) as string
+  const log = await readFile(join(dirname(runDir), archived, 'log.jsonl'), 'utf8')
+  const entry = log
+    .split('\n')
+    .filter(Boolean)
+    .map((l) => JSON.parse(l) as Record<string, unknown>)
+    .find((e) => e.status === 'prune-refs')
+  expect(entry?.deleted).toEqual(['refs/magpie/pr-7', 'refs/magpie/pr-9'])
+  expect(entry?.failed).toEqual(['refs/magpie/pr-404', 'refs/magpie/pr-5'])
+})

package/skills/magpie/scripts/__tests__/cli.test.ts

@@ -374,3 +374,72 @@ test('shard with a custom --budget and --max-files reaches shardDiff with those
     await rm(runDir, { recursive: true, force: true })
   }
 })
+
+test('history prints the already-on-this-PR section for a run with PR activity', async () => {
+  const runDir = await mkdtemp(join(tmpdir(), 'magpie-cli-history-'))
+  try {
+    await writeFile(
+      join(runDir, 'pr-activity.json'),
+      JSON.stringify({
+        checks: [],
+        threads: [],
+        comments: [{ author: 'alice', body: 'Why three retries?', magpie: false }],
+      }),
+    )
+    const proc = Bun.spawn(['bun', CLI, 'history', runDir], { stdout: 'pipe', stderr: 'pipe' })
+    const exit = await proc.exited
+    const stdout = await new Response(proc.stdout).text()
+    expect(exit).toBe(0)
+    expect(stdout.startsWith('## Already on this PR\n')).toBe(true)
+    expect(stdout).toContain('PR comments:\n- alice: Why three retries?\n')
+  } finally {
+    await rm(runDir, { recursive: true, force: true })
+  }
+})
+
+test('history prints nothing for a run with no history', async () => {
+  const runDir = await mkdtemp(join(tmpdir(), 'magpie-cli-history-'))
+  try {
+    const proc = Bun.spawn(['bun', CLI, 'history', runDir], { stdout: 'pipe', stderr: 'pipe' })
+    const exit = await proc.exited
+    expect(exit).toBe(0)
+    expect(await new Response(proc.stdout).text()).toBe('')
+  } finally {
+    await rm(runDir, { recursive: true, force: true })
+  }
+})
+
+test('proof-prompt fills the bundled prover prompt for a serious finding', async () => {
+  const runDir = await mkdtemp(join(tmpdir(), 'magpie-cli-proof-'))
+  try {
+    await writeFile(join(runDir, 'log.jsonl'), '')
+    await writeFile(join(runDir, 'target.json'), JSON.stringify({ mode: 'pr', root: '/wt' }))
+    await writeFile(
+      join(runDir, 'findings.final.json'),
+      JSON.stringify([
+        {
+          id: 'bugs-1',
+          file: 'src/a.ts',
+          line: 3,
+          title: 'Cache never evicts',
+          description: 'Observation: x',
+          domain: 'bugs',
+          risk: { impact: 'high', likelihood: 'likely', confidence: 'medium', action: 'must-fix' },
+        },
+      ]),
+    )
+    const proc = Bun.spawn(['bun', CLI, 'proof-prompt', runDir], { stdout: 'pipe', stderr: 'pipe' })
+    const exit = await proc.exited
+    const stdout = await new Response(proc.stdout).text()
+    expect(exit).toBe(0)
+    const promptPath = join(runDir, 'proof-prompt-bugs-1.md')
+    expect(stdout).toBe(`${promptPath}\t${join(runDir, 'proof-bugs-1.json')}\n`)
+    const prompt = await readFile(promptPath, 'utf8')
+    expect(prompt).toContain('"title": "Cache never evicts"')
+    expect(prompt).toContain('/wt')
+    expect(prompt).toContain(join(runDir, 'proof-bugs-1.json'))
+    expect(prompt).not.toContain('<<')
+  } finally {
+    await rm(runDir, { recursive: true, force: true })
+  }
+})