@integrity-labs/agt-cli 0.28.838 → 0.28.840

package/dist/assets/review/SKILL.md

@@ -0,0 +1,198 @@
+---
+name: pr-review
+description: Review a GitHub pull request's diff and write the findings to a JSON artefact. Use when asked to review a PR, or when a card asks you to review a repo's pull request. Produces the artefact only — it never posts to GitHub.
+---
+
+# Reviewing a pull request
+
+You are a Ninjafy agent (Ninjafy and Augmented Team are one platform, so you
+answer to the old name too). This skill is how you review a pull request.
+
+**You write a file. You post nothing.** Posting is a separate, gated step that
+reads the file this skill produces. Producing the artefact and publishing it are
+deliberately different actions, so a review can be made and read before anybody
+decides it should appear on the PR.
+
+You do **not** need a checkout. Everything below comes from the GitHub API via
+`gh`, which is already on your PATH and already authenticated.
+
+---
+
+## 1. Resolve the PR
+
+You need the repository as `owner/name` and the PR number. If you were given
+only a URL, read them off it.
+
+```bash
+gh api repos/OWNER/NAME/pulls/NUMBER
+```
+
+From the response take `number`, `title`, `state`, `head.sha` and `base.sha`.
+
+- **`state` is not `open`** — say so and stop. Reviewing a closed chapter helps
+  nobody.
+- **The call fails** — say so and stop. Do not review from memory of the repo.
+
+`head.sha` is the commit you are reviewing. Every later step is pinned to it,
+and it is part of the artefact's filename, because a review of one commit says
+nothing about another.
+
+## 2. Get the diff — from the API, not from a working tree
+
+```bash
+gh api repos/OWNER/NAME/pulls/NUMBER/files --paginate --slurp
+```
+
+Each entry has `filename`, `status`, `patch` (a unified diff hunk) and the
+change counts. Read the patches; that is the change.
+
+**Use this endpoint and no other.** The step that posts findings anchors each
+one to a line it computes from *these same patches* — the right-hand side of
+each hunk, which is the only place GitHub accepts an inline comment. A line
+number taken from anywhere else (a local `git diff`, a whole-file read, a
+`compare` against a different base) can be perfectly correct about the code and
+still unanchorable, and an unanchorable finding is quietly demoted out of the
+place a reader would look for it.
+
+Some entries have **no `patch`** — a binary file, or one too large for GitHub to
+render. Do not guess at their contents. Either fetch the file if you need it, or
+leave it unreviewed and say which files you skipped.
+
+### Then check the PR has not moved under you
+
+This endpoint returns the diff **as it is now**, not the diff at the `head.sha`
+you read in step 1. If someone pushed while you were reading, you now hold one
+commit's diff about to be filed under another commit's name.
+
+So read the head again and compare:
+
+```bash
+gh api repos/OWNER/NAME/pulls/NUMBER --jq .head.sha
+```
+
+- **Same as step 1** — carry on.
+- **Different** — start again from step 1 against the new head. If it moves a
+  second time, stop and write an `incomplete` artefact saying the PR is moving
+  faster than you can read it.
+
+Do not simply relabel what you already read with the newer sha. That is the
+failure this check exists to prevent, not a way around it: the artefact would be
+a review of code nobody can see any more, indistinguishable from a review of the
+code that is there.
+
+## 3. Load the repo's own rules
+
+```bash
+gh api repos/OWNER/NAME/contents/CLAUDE.md?ref=HEAD_SHA --jq .content
+```
+
+```bash
+gh api repos/OWNER/NAME/contents/docs/reference/review-rules.md?ref=HEAD_SHA --jq .content
+```
+
+Both are base64; decode them. Both may 404, which is fine and normal — most
+repos have neither.
+
+Where `review-rules.md` exists it **outranks your priors**: a rule saying "this
+is deliberate here, do not flag it" exists because a reviewer already raised
+that exact thing and a human said no. Where it does not exist, review anyway and
+say so in your summary — a repo without one gets a generic review, which is
+worth having and worth labelling as such.
+
+Pin both reads to `HEAD_SHA`. Reading the default branch's rules against a
+branch's code compares the change to something it was never written against.
+
+## 4. Review
+
+Prioritise, in this order:
+
+1. **Correctness.** Does it do what it claims? What input makes it wrong?
+
+2. **Claims that outrun the code.** A comment, commit message or PR body
+   asserting a guard, a threshold or a behaviour the code does not implement.
+   These are worse than a missing guard, because they stop the next person
+   looking. Read what the change *says about itself*, and check it.
+
+3. **Silent failure.** A path where something goes wrong and nothing reports it:
+   a swallowed error, a fallback that renders a failed measurement as a
+   plausible normal value, an empty result indistinguishable from "nothing to
+   report". Ask of every failure branch: *if this fired right now, how would
+   anyone know?*
+
+4. **Tests that cannot fail.** A test that looks correct and is structurally
+   incapable of failing reports coverage it does not provide, and CI will never
+   reveal it, because CI only ever runs it green.
+
+5. **Security visible in the diff** — a new unauthenticated path, a secret on a
+   command line or in an environment variable, an unparameterised query, a taint
+   flow from request input to a sink.
+
+**Do not spend the review on formatting, naming, or suggesting more cases for
+behaviour already covered.** A review that is 80% nits gets skimmed, and then
+the one real finding in it gets skimmed too.
+
+## 5. Say which of the three outcomes you reached
+
+They are different states and reporting them identically is the failure this
+skill exists to find in other people's code:
+
+- You reviewed the diff and **found nothing**. A legitimate, useful result.
+- You reviewed the diff and **found things**.
+- You **could not finish** — the diff was too large to hold, a file had no
+  patch and you needed it, an API call failed. Say that. Never present a partial
+  read as a clean one.
+
+## 6. Write the artefact
+
+One file per PR head, under `.smithers/review/` relative to your working
+directory (create it if absent):
+
+```text
+.smithers/review/<pr>-<first 12 chars of head sha>.code.json
+```
+
+```json
+{
+  "pr": 1234,
+  "head": "abc123def456",
+  "reviewedAt": "2026-09-07T00:00:00Z",
+  "rulesFile": "docs/reference/review-rules.md",
+  "status": "reviewed",
+  "findings": [
+    {
+      "file": "packages/api/src/routes/thing.ts",
+      "line": 42,
+      "severity": "major",
+      "category": "correctness",
+      "summary": "one sentence stating the defect",
+      "why": "the failing case, concretely: these inputs produce this wrong output"
+    }
+  ]
+}
+```
+
+**`severity` is `major` or `minor`. Nothing else.** Not `high`, not `critical`,
+not `P1`. The step that posts these filters by severity, and it compares within
+a known vocabulary: a token it does not recognise is kept rather than dropped,
+so an invented level does not vanish — but it does defeat the filter, silently,
+while the filter carries on printing as though it were working. `P1`/`P2`/`P3`
+belong to the separate security review and are not yours to emit here.
+
+`category` is one of `correctness`, `claim`, `silent-failure`, `test`,
+`security`.
+
+**`status` is `reviewed` or `incomplete`.** `incomplete` takes a `reason`. An
+empty `findings` array on an `incomplete` review must never be read as clean,
+and the posting step refuses to post from one at all — which is the whole point
+of the field. Use it rather than shrinking the review to fit.
+
+`line` is a right-hand line number from the patches you read in step 2. Omit it
+if the finding is about the change as a whole rather than one line.
+
+## 7. Report, and stop
+
+Print counts by severity and category, the artefact path, and whether a rules
+file was found. Then **stop**.
+
+Do not post the findings. Do not open a review. Do not comment on the PR. If you
+were asked to review, you have done what was asked.

package/dist/assets/review/post-review-findings.mjs

@@ -103,7 +103,11 @@ export function buildBody(f, id) {
     '',
     f.why ?? f.attack ?? '',
     '',
-    '<sub>Posted by `/s:code-review`. This reviewer never submits a blocking verdict.',
+    // NOT `/s:code-review`. That is an operator slash command in a Claude Code
+    // plugin the managed fleet never installs, so from the moment the `pr-review`
+    // skill became a second producer the footer named a thing most readers of it
+    // cannot run — a claim outrunning the code, on every comment this bot posts.
+    '<sub>Posted by the Obi Wan reviewer. This reviewer never submits a blocking verdict.',
     'Reply if this is deliberate and it becomes a rule in `docs/reference/review-rules.md`.</sub>',
     marker(id),
   ].join('\n');

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-MZNTGZA7.js";
+} from "../chunk-24AILXID.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.838" : "dev";
+var cliVersion = true ? "0.28.840" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.838" : "dev";
+var cliVersion2 = true ? "0.28.840" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-MZNTGZA7.js → chunk-24AILXID.js}

@@ -6566,7 +6566,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.838" : "dev";
+var agtCliVersion = true ? "0.28.840" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10924,4 +10924,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-MZNTGZA7.js.map
+//# sourceMappingURL=chunk-24AILXID.js.map

package/dist/lib/manager-worker.js

@@ -60,7 +60,7 @@ import {
   safeWriteJsonAtomic,
   setConfigHash,
   tripClass
-} from "../chunk-MZNTGZA7.js";
+} from "../chunk-24AILXID.js";
 import {
   getProjectDir as getProjectDir2,
   getReadyTasks,
@@ -2286,6 +2286,8 @@ var ASSET_FILES = [
   [AUTH_FILENAME, 420]
 ];
 var REVIEW_ASSET_DIRNAME = "review";
+var SKILL_FILENAME = "SKILL.md";
+var REVIEW_SKILL_ID = "pr-review";
 function resolveBundledReviewAssetDir() {
   const moduleDir = dirname5(fileURLToPath(import.meta.url));
   const candidates = [
@@ -2322,6 +2324,19 @@ function provisionReviewPoster(codeName, sourceDir = resolveBundledReviewAssetDi
     chmodSync(dest, mode);
   }
 }
+function provisionReviewSkill(codeName, sourceDir = resolveBundledReviewAssetDir()) {
+  const src = join8(sourceDir, SKILL_FILENAME);
+  if (!existsSync2(src)) {
+    throw new Error(`[review-poster] bundled asset missing: ${src}`);
+  }
+  const adapter = getFramework("claude-code");
+  if (!adapter.installSkillFiles) {
+    throw new Error("[review-poster] claude-code adapter exposes no installSkillFiles");
+  }
+  adapter.installSkillFiles(codeName, REVIEW_SKILL_ID, [
+    { relativePath: SKILL_FILENAME, content: readFileSync8(src, "utf-8") }
+  ]);
+}
 
 // src/lib/id-keyed-migration.ts
 import { existsSync as existsSync3, lstatSync, readlinkSync, renameSync as renameSync2 } from "fs";
@@ -9598,6 +9613,15 @@ function decideSenderPolicyForward(evt, policy) {
 
 // ../../packages/core/dist/channels/governance/slack-peer-classifier.js
 var CODE_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+function findThirdPartyGrant(msg, cfg) {
+  return cfg.third_party_bots?.find((b) => {
+    if (msg.user && b.bot_user_id === msg.user)
+      return true;
+    if (!msg.bot_id)
+      return false;
+    return b.bot_id === msg.bot_id || b.bot_user_id === msg.bot_id;
+  });
+}
 function classifyPeerMessage(msg, cfg, self) {
   if (!msg.bot_id)
     return { kind: "human" };
@@ -9607,6 +9631,18 @@ function classifyPeerMessage(msg, cfg, self) {
   if (cfg.peer_disabled_mode === "all") {
     return { kind: "drop", reason: "peer_disabled_all" };
   }
+  if (!cfg.peers.some((p) => p.bot_user_id === msg.user)) {
+    const grant = findThirdPartyGrant(msg, cfg);
+    if (grant) {
+      if (cfg.peer_disabled_mode === "cross_team_only") {
+        return { kind: "drop", reason: "peer_disabled_cross_team" };
+      }
+      if (grant.channel_ids.includes(msg.channel)) {
+        return { kind: "bot-ingress", bot: grant };
+      }
+      return { kind: "drop", reason: "third_party_channel_not_allowlisted" };
+    }
+  }
   if (cfg.peer_agent_mode === "off") {
     return { kind: "drop", reason: "mode_off" };
   }
@@ -9619,22 +9655,6 @@ function classifyPeerMessage(msg, cfg, self) {
   }
   const peer = cfg.peers.find((p) => p.bot_user_id === msg.user);
   if (!peer) {
-    const thirdParty = cfg.third_party_bots?.find((b) => {
-      if (msg.user && b.bot_user_id === msg.user)
-        return true;
-      if (!msg.bot_id)
-        return false;
-      return b.bot_id === msg.bot_id || b.bot_user_id === msg.bot_id;
-    });
-    if (thirdParty) {
-      if (cfg.peer_disabled_mode === "cross_team_only") {
-        return { kind: "drop", reason: "peer_disabled_cross_team" };
-      }
-      if (thirdParty.channel_ids.includes(msg.channel)) {
-        return { kind: "bot-ingress", bot: thirdParty };
-      }
-      return { kind: "drop", reason: "third_party_channel_not_allowlisted" };
-    }
     return { kind: "drop", reason: "unknown_peer" };
   }
   if (peer.gate_path === null) {
@@ -13669,7 +13689,7 @@ var agentRestartTimezoneInputs = /* @__PURE__ */ new Map();
 var lastVersionCheckAt = 0;
 var VERSION_CHECK_INTERVAL_MS = 5 * 60 * 1e3;
 var lastResponsivenessProbeAt = 0;
-var agtCliVersion = true ? "0.28.838" : "dev";
+var agtCliVersion = true ? "0.28.840" : "dev";
 function resolveBrewPath(execFileSync2) {
   try {
     const out = execFileSync2("which", ["brew"], { timeout: 5e3 }).toString().trim();
@@ -19526,6 +19546,11 @@ async function ensurePersistentSession(agent, tasks, boardItems, refreshData) {
   } catch (err) {
     log(`[persistent-session] Failed to provision review poster for '${codeName}': ${err.message}`);
   }
+  try {
+    provisionReviewSkill(codeName);
+  } catch (err) {
+    log(`[persistent-session] Failed to provision review skill for '${codeName}': ${err.message}`);
+  }
   if (!isSessionHealthy(codeName)) {
     if (agentState.persistentSessionAgents.has(codeName)) {
       const ctx = getLastFailureContext(codeName);