npm - @muggleai/works - Versions diffs - 4.11.4 → 4.12.0 - Mend

@muggleai/works 4.11.4 → 4.12.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (96) hide show

package/dist/plugin/skills/muggle-pr-followup/output-templates/escalation.md ADDED Viewed

@@ -0,0 +1,32 @@
+# Escalation messages
+Emitted by `/muggle-do` in address-reviews mode. One per invocation, at most. Anchored here so wording stays consistent.
+## Ambiguous escalation
+```
+**Review-followup escalation — <owner>/<repo>#<n>**
+I can't act on <count> review(s) without your input. Listed below; reply on GitHub by submitting a new review with clearer direction, or tell me here which way to go.
+Review #<id> from <login>:
+> <body or "(no body)">
+Comments:
+- <file>:<line> — <body>
+- ...
+[Repeat per ambiguous review in the batch.]
+```
+## Design-adjustment escalation
+```
+**Design-adjustment needed — <owner>/<repo>#<n>**
+While addressing review #<id>, the cycle surfaced a conflict with the current design:
+  <one-paragraph description of the conflict>
+This is beyond a routine code change. Confirm the design intent (reply here, or update the requirements doc) before I retry.
+```

package/dist/plugin/skills/muggle-pr-followup/output-templates/help.md ADDED Viewed

@@ -0,0 +1,17 @@
+# Help output
+For `/muggle:muggle-pr-followup` with no args, or with `help` / `?`:
+```
+muggle-pr-followup — watcher loop for PR review follow-ups
+Active loops:
+  <slug> → <owner>/<repo>#<n> (cursor @ review #<id>, <N> cycles)
+  ...
+  (or "no active loops")
+Usage:
+  /muggle:muggle-pr-followup <pr-url>            → bootstrap a new loop
+  /muggle:muggle-pr-followup <slug> <pr-number>  → run one tick (called by /loop)
+  /muggle:muggle-pr-followup <pr-number>         → run one tick (slug inferred from on-disk state)
+```

package/dist/plugin/skills/muggle-pr-followup/output-templates/inline-reply.md ADDED Viewed

@@ -0,0 +1,17 @@
+# Per-comment inline reply
+Posted via `gh api .../comments/<comment-id>/replies` per cycle, one per line comment.
+```
+Addressed in <short-sha>: <one-line summary of the change made for THIS comment>.
+```
+`<short-sha>` is the first 7 chars of the new SHA. The body must contain that substring — the resolve-reminder stage greps for it to classify threads as addressed-by-loop.
+## Top-level fallback (review-body-only)
+When an actionable review has a non-empty body but zero line comments, GitHub has no `/replies` endpoint for the body. Post a top-level PR comment instead, at most once per such review:
+```
+Re: review #<review_id> — addressed in <short-sha>: <one-line summary>.
+```

package/dist/plugin/skills/muggle-pr-followup/output-templates/resolve-reminder.md ADDED Viewed

@@ -0,0 +1,12 @@
+# Resolve-reminder top-level PR comment
+Posted via `gh pr comment` after the resolve-reminder stage scans threads. Only when at least one addressed-by-loop thread exists.
+```
+I addressed these threads in <short-sha> — mark them resolved when satisfied:
+- #<thread-id-1>
+- #<thread-id-2>
+- ...
+```
+If `addressed_by_loop == 0`, no comment is posted (silent).

package/dist/plugin/skills/muggle-pr-followup/output-templates/watcher-log.md ADDED Viewed

@@ -0,0 +1,21 @@
+# Watcher tick log lines
+The watcher does **not** print to the user during normal operation. It only appends to `followup.log`. All user-facing escalations come from `/muggle-do`.
+## Idle tick
+```
+<ISO-8601> tick pr=<n> reviews_seen=0 idle
+```
+## Dispatching tick
+```
+<ISO-8601> tick pr=<n> reviews_seen=<count> dispatched=<id1>,<id2>,...
+```
+## Terminal tick
+```
+<ISO-8601> tick pr=<n> terminal=<merged|closed> result.md written
+```

package/dist/plugin/skills/muggle-pr-followup/output-templates.md ADDED Viewed

@@ -0,0 +1,14 @@
+# Output templates
+All user-facing message text used by the watcher, bootstrap, and `/muggle-do` in address-reviews mode. Each template group is its own file — load only what the current step emits.
+## Index
+| Group | Use case |
+| :---- | :------- |
+| [`bootstrap`](output-templates/bootstrap.md) | Bootstrap success summary + all bootstrap aborts. |
+| [`watcher-log`](output-templates/watcher-log.md) | The three `followup.log` line shapes (idle, dispatching, terminal). |
+| [`escalation`](output-templates/escalation.md) | `/muggle-do` terminal escalation messages (ambiguous, design-adjustment). |
+| [`inline-reply`](output-templates/inline-reply.md) | Per-comment inline reply + top-level fallback for body-only reviews. |
+| [`resolve-reminder`](output-templates/resolve-reminder.md) | Top-level PR comment for the resolve-reminder stage. |
+| [`help`](output-templates/help.md) | Skill help output (no args / `help` / `?`). |

package/dist/plugin/skills/muggle-pr-followup/state-schemas.md ADDED Viewed

@@ -0,0 +1,104 @@
+# Session State Schemas
+Canonical shapes for the JSON files in a PR-follow-up session slot. The slot path is `.muggle-do/sessions/<slug>/` (the caller's session dir; `muggle-do` is the current and only caller).
+All files are atomic writes — the caller rewrites the whole file each time, never mutates in place. Use a temp file + rename if the platform supports it.
+## `prs.json`
+A list of one entry. (Historical: the file is an array for forward-compat with the original session-wide model. Today, each PR has its own session slot, so the array always has exactly one entry.)
+```json
+[
+  {
+    "repo": "<owner>/<repo>",
+    "number": <int>,
+    "url": "https://github.com/<owner>/<repo>/pull/<number>",
+    "head_sha": "<40-char-hex-sha>",
+    "state": "open" | "merged" | "closed"
+  }
+]
+```
+- `state` is the **observed** state from the last `gh pr view`. The watcher refreshes it each tick.
+- Terminal states (`merged`, `closed`) are sticky — once set, the watcher writes `result.md` and exits without rescheduling.
+## `last_seen.json`
+Keyed by `"<owner>/<repo>#<n>"`. One key per PR in the slot.
+```json
+{
+  "<owner>/<repo>#<n>": {
+    "reviewId": <int>,
+    "last_pushed_sha": "<sha-or-null>",
+    "idle_tick_count": <int>,
+    "cycles_completed": <int>,
+    "escalated_review_ids": [<int>, ...],
+    "pushed_shas": ["<sha>", ...]
+  }
+}
+```
+- `reviewId`: the cursor. The watcher fetches reviews with `id > reviewId`. Bootstrap pins this to the highest existing submitted review id (or `0` if none).
+- `last_pushed_sha`: most recent SHA `/muggle-do` pushed in this PR's life; `null` until the first push.
+- `idle_tick_count`: incremented each tick that sees zero new reviews. Reset to 0 on any tick that dispatches `/muggle-do`. Diagnostic only — does not gate behavior.
+- `cycles_completed`: incremented each time `/muggle-do` completes an address-reviews invocation (regardless of actionable/ambiguous/mixed).
+- `escalated_review_ids`: review ids classified as ambiguous by `/muggle-do`. The watcher excludes these from future review fetches so the same ambiguous review is never re-dispatched.
+- `pushed_shas`: every SHA `/muggle-do` has pushed for this PR. Append-only. Used by the resolve-reminder stage to recognize threads addressed by the loop.
+## `state.md`
+Free-form markdown. No required schema beyond a few well-known fields the caller-agnostic code reads:
+```markdown
+# Session — <slug>
+**PR:** <url>
+**Slug:** <slug>
+**Loop user:** <github-login>          ← cached from `gh api user`
+**Created:** <ISO-8601>
+**Bootstrapped from URL:** <yes | no>
+...free-form notes added by /muggle-do and bootstrap...
+```
+The watcher does **not** read or write `state.md`. Only bootstrap, `/muggle-do`, and the caller's stages touch it.
+## `followup.log`
+Append-only line-per-tick log. One line per watcher tick, plus one line per `/muggle-do` invocation. Format is loose, but each line starts with an ISO-8601 timestamp:
+```
+2026-05-20T12:34:56Z tick pr=154 reviews_seen=0 idle
+2026-05-20T12:35:56Z tick pr=154 reviews_seen=1 dispatched=4295962800
+2026-05-20T12:36:14Z muggle-do cycle review_ids=[4295962800] outcome=pushed head_sha=abc1234
+```
+Used for forensics only — never read back by skills.
+## `result.md`
+Written exactly once when the PR's watcher exits terminally (PR merged or closed). Free-form markdown summarizing the PR's life under this loop:
+```markdown
+# Result — <slug>
+**PR:** <url>
+**Final state:** merged | closed
+**Cycles completed:** <int>
+**Pushed SHAs:** <comma-separated list>
+**Escalated review ids:** <comma-separated list or "none">
+## Timeline
+- <ISO-8601> bootstrap (cursor pinned at <reviewId>)
+- <ISO-8601> review <id> from <login> — actionable, pushed <sha>
+- <ISO-8601> review <id> from <login> — ambiguous, escalated
+- ...
+- <ISO-8601> PR <merged|closed> — watcher terminal
+```
+## Not in the slot
+`cycle.json` and `requirements.md` are not seeded or read. `/muggle-do` reads reviews off GitHub each invocation.

package/dist/plugin/skills/muggle-test-regenerate-missing/SKILL.md CHANGED Viewed

@@ -180,15 +180,15 @@ Bulk regen does not run replays, so the section B (replay) router does not apply
 ### Step 8 — Open the Dashboard
-Open the Muggle AI dashboard so the user can watch progress visually:
+Open the Muggle AI dashboard so the user can watch progress visually. Point them at the **scripts** page (where DRAFT → GENERATING → ACTIVE transitions are visible), not `/runs` (which is for replay batches and shows nothing for a regen):
 ```bash
-open "https://www.muggle-ai.com/muggleTestV0/dashboard/projects/{projectId}/runs"
+open "https://www.muggle-ai.com/muggleTestV0/dashboard/projects/{projectId}/scripts"
 ```
 Tell them:
-> "I've opened the project's runs page. Generation jobs typically take a few minutes each — they'll appear here as they progress. Your test cases will move into `ACTIVE` status as scripts complete."
+> "I've opened the project's scripts page. Generation jobs typically take a few minutes each — your test cases will move from `DRAFT` through `GENERATING` to `ACTIVE` as scripts complete."
 ### Step 9 (optional) — Poll Status

package/dist/release-manifest.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
-  "release": "4.11.4",
-  "buildId": "run-37-1",
-  "commitSha": "36a1f8499178f2361b5a683ddd5420de28558c23",
-  "buildTime": "2026-05-20T22:12:49Z",
+  "release": "4.12.0",
+  "buildId": "run-38-1",
+  "commitSha": "8a01015dc5a95c7b5a34e982132e8ca4a1c0d9f1",
+  "buildTime": "2026-05-21T18:38:53Z",
   "serviceName": "muggle-ai-works-mcp"
 }

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
     "name": "@muggleai/works",
     "mcpName": "io.github.multiplex-ai/muggle",
-    "version": "4.11.4",
+    "version": "4.12.0",
     "description": "Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.",
     "type": "module",
     "main": "dist/index.js",
@@ -41,14 +41,14 @@
         "test:watch": "vitest"
     },
     "muggleConfig": {
-        "electronAppVersion": "1.0.88",
+        "electronAppVersion": "1.0.90",
         "downloadBaseUrl": "https://github.com/multiplex-ai/muggle-ai-works/releases/download",
         "runtimeTargetDefault": "production",
         "checksums": {
-            "darwin-arm64": "dbcefc10f2cdeabe8be74490354ed83f600eb18d8f411b3f1dec266e5eb2e95b",
-            "darwin-x64": "ac4430824e18d15476ed91a6bbe81d0880239b758006cbf721d8e7d58a0c3676",
-            "win32-x64": "16119743fb344990f2b67fa2a9844a50a46d70f6fbf3f72435b5ce1d7a635cd9",
-            "linux-x64": "4e43f3946c80918f972a4c587a5f83873ccaeb5338f6eb8b5296022ba096f059"
+            "darwin-arm64": "13fc830ede44af479761302e3477c4f2516be142885445c8c5baf574041a7069",
+            "darwin-x64": "02007eb996d2fa2cf5be6546b6a1a01de769f1b12c7e3b2af1e93eb1b4deda0e",
+            "win32-x64": "5ea49f43ce6c432eac42dd10179873c78067ff1fc1328d8f664ce2c81da38f49",
+            "linux-x64": "f92c350bde46c95fb35ceab8c1c115352663a53d44d210ea98316fe1a92cf41e"
         }
     },
     "dependencies": {

package/plugin/.claude-plugin/plugin.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "name": "muggle",
   "description": "Run real-browser end-to-end (E2E) acceptance tests on your web app from any AI coding agent. Generate test scripts from plain English, replay them on localhost, capture screenshots, and validate user flows like signup, checkout, and dashboards. Works across Claude Code, Cursor, Codex, and Windsurf.",
-  "version": "4.11.4",
+  "version": "4.12.0",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/plugin/.cursor-plugin/plugin.json CHANGED Viewed

@@ -2,7 +2,7 @@
   "name": "muggle",
   "displayName": "Muggle AI",
   "description": "Ship quality products with AI-powered end-to-end (E2E) acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.",
-  "version": "4.11.4",
+  "version": "4.12.0",
   "author": {
     "name": "Muggle AI",
     "email": "support@muggle-ai.com"

package/plugin/scripts/ensure-electron-app.sh CHANGED Viewed

@@ -3,10 +3,35 @@
 set -euo pipefail
 # Ensure the Electron browser test runner is installed/up to date (silent, best-effort).
-if command -v muggle >/dev/null 2>&1; then
-  muggle setup >/dev/null 2>&1 || true
-else
-  npx -y @muggleai/works setup >/dev/null 2>&1 || true
+#
+# Bounded + cached: this script runs from a SessionStart hook on every Claude
+# session, so a hung `muggle setup` (e.g. one blocked by host security policy
+# on Windows) must not leak a ~100 MB orphan per session start. We cap the
+# attempt with `timeout` and skip the call entirely if we already checked
+# within the last day.
+ensure_marker_dir="${HOME}/.cache/muggle"
+ensure_marker="${ensure_marker_dir}/electron-app-checked"
+ensure_ttl=$((24 * 60 * 60))
+ensure_now=$(date +%s)
+ensure_last=0
+if [ -f "${ensure_marker}" ]; then
+    ensure_last=$(stat -f %m "${ensure_marker}" 2>/dev/null || stat -c %Y "${ensure_marker}" 2>/dev/null || echo 0)
+fi
+if [ $((ensure_now - ensure_last)) -ge "${ensure_ttl}" ]; then
+    if command -v timeout >/dev/null 2>&1; then
+        ensure_timeout="timeout -k 5 60"
+    else
+        ensure_timeout=""
+    fi
+    if command -v muggle >/dev/null 2>&1; then
+        ${ensure_timeout} muggle setup >/dev/null 2>&1 || true
+    else
+        ${ensure_timeout} npx -y @muggleai/works setup >/dev/null 2>&1 || true
+    fi
+    mkdir -p "${ensure_marker_dir}" 2>/dev/null || true
+    touch "${ensure_marker}" 2>/dev/null || true
 fi
 # --- Context injection ---

package/plugin/skills/_shared/github-cli-recipes/line-comments-for-review.md ADDED Viewed

@@ -0,0 +1,8 @@
+# Line comments for a specific review
+For per-comment reply routing in `/muggle-do`.
+```bash
+gh api repos/<owner>/<repo>/pulls/<n>/comments --paginate \
+  --jq '[.[] | select(.pull_request_review_id == <review-id>)]'
+```

package/plugin/skills/_shared/github-cli-recipes/loop-user-identity.md ADDED Viewed

@@ -0,0 +1,9 @@
+# Identify the loop user
+The GitHub identity that owns the authenticated `gh` token. Resolve-reminder thread classification and reply attribution need this.
+```bash
+gh api user --jq '.login'
+```
+Cache in `state.md` under `Loop user:`; re-resolve only when missing.

package/plugin/skills/_shared/github-cli-recipes/pr-edit.md ADDED Viewed

@@ -0,0 +1,8 @@
+# Refresh the PR title or body
+For `open-prs/update.md` when E2E state flips (passing↔failing) or validation strategy changes.
+```bash
+gh pr edit <pr-number> --repo <owner>/<repo> --title "<new-title>"
+gh pr edit <pr-number> --repo <owner>/<repo> --body-file <file>
+```

package/plugin/skills/_shared/github-cli-recipes/pr-metadata.md ADDED Viewed

@@ -0,0 +1,12 @@
+# PR metadata snapshot
+Fetch the fields the watcher and bootstrap need in one call.
+```bash
+gh pr view <pr-number> --repo <owner>/<repo> \
+  --json url,number,headRefOid,headRefName,baseRefName,state,mergedAt,closedAt,body,title,author
+```
+- `state` is one of `OPEN`, `MERGED`, `CLOSED`.
+- `headRefOid` is the current head SHA — store as `head_sha` in `prs.json`.
+- `headRefName` is the branch — must match the working tree's branch in bootstrap.

package/plugin/skills/_shared/github-cli-recipes/push-to-branch.md ADDED Viewed

@@ -0,0 +1,10 @@
+# Push to the PR branch
+After the address-reviews cycle's work.
+```bash
+git -C <repo-path> push origin <head-ref-name>
+git -C <repo-path> rev-parse HEAD
+```
+Append the new SHA to `last_seen.pushed_shas[]` so resolve-reminder can recognize it.

package/plugin/skills/_shared/github-cli-recipes/reply-line-comment.md ADDED Viewed

@@ -0,0 +1,10 @@
+# Reply to a line comment (threaded)
+Used by `/muggle-do` per-comment inline replies.
+```bash
+gh api --method POST \
+  -H "Accept: application/vnd.github+json" \
+  repos/<owner>/<repo>/pulls/<n>/comments/<comment-id>/replies \
+  -f body="<reply-text>"
+```

package/plugin/skills/_shared/github-cli-recipes/submitted-reviews.md ADDED Viewed

@@ -0,0 +1,15 @@
+# Submitted reviews past a cursor
+For the watcher's poll and the address-reviews fetch.
+```bash
+gh api repos/<owner>/<repo>/pulls/<n>/reviews --paginate
+```
+Filter client-side:
+- `submitted_at != null` (skip PENDING drafts)
+- `id > last_seen.reviewId`
+- `id` not in `last_seen.escalated_review_ids`
+- `user.login` in the resolved allow-list
+- `state` in `{CHANGES_REQUESTED, COMMENTED}`, OR `APPROVED` with a non-empty body or at least one line comment

package/plugin/skills/_shared/github-cli-recipes/top-level-comment.md ADDED Viewed

@@ -0,0 +1,7 @@
+# Top-level PR comment
+For the resolve-reminder stage and any non-threaded notice.
+```bash
+gh pr comment <pr-number> --repo <owner>/<repo> --body "<text>"
+```

package/plugin/skills/_shared/github-cli-recipes/unresolved-threads.md ADDED Viewed

@@ -0,0 +1,33 @@
+# Unresolved comment threads
+For the resolve-reminder stage. GraphQL only — REST does not expose `isResolved`.
+```bash
+gh api graphql -F owner=<owner> -F name=<repo> -F number=<n> -f query='
+query($owner: String!, $name: String!, $number: Int!) {
+  repository(owner: $owner, name: $name) {
+    pullRequest(number: $number) {
+      reviewThreads(first: 100) {
+        nodes {
+          id
+          isResolved
+          comments(first: 100) {
+            nodes {
+              databaseId
+              author { login }
+              body
+              createdAt
+            }
+          }
+        }
+      }
+    }
+  }
+}'
+```
+Filter client-side to `isResolved == false`. Classify each thread by inspecting its comments:
+- **Addressed by loop** — at least one comment authored by the loop user citing a SHA in `last_seen.pushed_shas[]`.
+- **Addressed by human** — at least one comment authored by a non-loop user after the original, and no addressed-by-loop signal.
+- **Not addressed** — otherwise.

package/plugin/skills/_shared/github-cli-recipes/verify-working-tree.md ADDED Viewed

@@ -0,0 +1,17 @@
+# Verify the working tree matches the PR
+Bootstrap's environment check.
+```bash
+git rev-parse --show-toplevel        # cwd is a git working tree
+git remote get-url origin            # remote matches <owner>/<repo>
+git rev-parse --abbrev-ref HEAD      # current branch matches PR's headRefName
+```
+Accept any remote URL form for `<owner>/<repo>` (with or without trailing `.git`):
+- `https://github.com/<owner>/<repo>`
+- `git@github.com:<owner>/<repo>`
+- `ssh://git@github.com/<owner>/<repo>`
+Any mismatch → bootstrap aborts using the wrong-checkout template in [`../../muggle-pr-followup/output-templates/bootstrap.md`](../../muggle-pr-followup/output-templates/bootstrap.md).

package/plugin/skills/_shared/github-cli-recipes.md ADDED Viewed

@@ -0,0 +1,20 @@
+# GitHub CLI Recipes
+Reusable `gh` / `git` snippets used by `muggle-pr-followup` (watcher + bootstrap) and `/muggle-do` (address-reviews + open-prs). Each recipe is one file — load only what you need.
+Skills assume a working `gh auth status`. Auth errors surface verbatim from `gh`.
+## Index
+| Recipe | Use case |
+| :----- | :------- |
+| [`pr-metadata`](github-cli-recipes/pr-metadata.md) | Snapshot PR state, head SHA, branch — watcher + bootstrap. |
+| [`submitted-reviews`](github-cli-recipes/submitted-reviews.md) | Fetch reviews past a cursor — watcher's poll. |
+| [`line-comments-for-review`](github-cli-recipes/line-comments-for-review.md) | Pull a review's line comments — `/muggle-do` per-comment routing. |
+| [`unresolved-threads`](github-cli-recipes/unresolved-threads.md) | GraphQL fetch of unresolved comment threads — resolve-reminder. |
+| [`reply-line-comment`](github-cli-recipes/reply-line-comment.md) | POST a threaded reply on a line comment. |
+| [`top-level-comment`](github-cli-recipes/top-level-comment.md) | POST a top-level PR comment — resolve-reminder + overflow. |
+| [`push-to-branch`](github-cli-recipes/push-to-branch.md) | Push + capture new SHA after address-reviews work. |
+| [`verify-working-tree`](github-cli-recipes/verify-working-tree.md) | Three checks bootstrap runs before seeding state. |
+| [`pr-edit`](github-cli-recipes/pr-edit.md) | Refresh title or body when address-reviews mode flips state. |
+| [`loop-user-identity`](github-cli-recipes/loop-user-identity.md) | Resolve the GitHub login of the loop user. |

package/plugin/skills/_shared/pr-followup-helpers/allow-list.md ADDED Viewed

@@ -0,0 +1,53 @@
+# Reviewer allow-list
+The address-reviews flow only acts on reviews submitted by users in the **allow-list** = (requested reviewers ∪ CODEOWNERS) − bots − PR author. Re-resolve every invocation — never cache across cycles.
+## Step 1: requested reviewers
+```bash
+gh pr view <number> --repo <owner>/<repo> --json reviewRequests,author
+```
+`reviewRequests` is an array of `{ login? , slug? }`. User reviewers have `login`; team reviewers have `slug` (and `name`). Expand teams to member logins:
+```bash
+gh api orgs/<org>/teams/<slug>/members --jq '.[].login'
+```
+Record `prAuthor = author.login` for the exclusion step.
+## Step 2: CODEOWNERS
+Look for the file in this order — first hit wins:
+1. `.github/CODEOWNERS`
+2. `CODEOWNERS`
+3. `docs/CODEOWNERS`
+Read from the PR's **head branch** (not master) — a PR that adds CODEOWNERS should be informational while open, load-bearing once merged:
+```bash
+gh api repos/<owner>/<repo>/contents/.github/CODEOWNERS?ref=<head_sha> --jq '.content' | base64 -d
+```
+Parse line-by-line:
+- Skip blank lines and lines starting with `#`.
+- Each line is `<pattern> <owner1> <owner2> ...`.
+- Owners are either `@user` or `@org/team`. Strip the leading `@`.
+- Collect the union of all owners across all lines (don't match patterns against changed files — repo-level membership is enough).
+Expand `@org/team` to member logins via the orgs/teams/members endpoint.
+If no CODEOWNERS file exists in any location, the CODEOWNERS contribution is empty. Don't fail.
+## Step 3: filter
+Allow-list = (requested reviewers ∪ CODEOWNERS) − `{prAuthor}` − bot logins.
+Bot logins:
+- Ends with `[bot]` (e.g. `dependabot[bot]`)
+- Exact match: `dependabot`, `github-actions`, `renovate`, `mergify`
+A comment author not in the allow-list is silently ignored — do not reply, do not address.

package/plugin/skills/_shared/pr-followup-helpers/classify.md ADDED Viewed

@@ -0,0 +1,48 @@
+# Classify
+Classify the **review as a unit** — but reply per line comment (threaded), not per review.
+| Class | Signal | Action |
+| :---- | :----- | :----- |
+| **actionable** | Review names at least one concrete change or asks an answerable question. Soft phrasing counts when there's a concrete referent. | Treat as amended requirements; run **one** implementation cycle for the whole review; reply **threaded per line comment** referencing the new SHA (top-level only when the review is body-only). |
+| **ambiguous** | No actionable signal — pure vibes, contradictory, or depends on knowledge the loop can't access. | Escalate once with two interpretations; pause the PR. |
+Default to **actionable**. CI catches wrong attempts; reviewers correct on the next round. Escalation is a round-trip with an absent user — reserve it.
+Reply shape (all replies for one review reference the same SHA):
+- **threaded** (default): `Done in <sha> — <attribution>. (Review #<review_id>, cycle <status>.)`
+- **top-level** (fallback, body-only reviews): `Re: review #<review_id> — addressed in <sha>, cycle <status>.`
+- **ambiguous**: no bot reply.
+## Worked examples — Actionable
+| Review (summarized) | Why actionable |
+| :------------------ | :------------- |
+| 3 comments: "rename `fooBar` to `foo_bar`", "use `const` here", "fix this typo" | Three concrete edits |
+| 1 comment: "could the procedure be simpler?" | Soft-phrased but the intent is clear — simplify |
+| Review body: "Two things: extract validation into a helper, add a null check before the lookup." + 0 line comments | Two concrete directives in the body |
+| 4 comments: "why this approach?", "is this called from X?", "does this need to handle empty array?", "what's the perf here?" | All questions, each answerable |
+| 1 comment: "rewrite this module — the architecture doesn't match the spec" | Substantive rebuild, but direction is clear |
+| 1 comment: "I'd lean toward the bar.ts pattern" | Concrete referent (bar.ts) — apply that pattern |
+## Worked examples — Ambiguous
+| Review (summarized) | Why ambiguous |
+| :------------------ | :------------ |
+| 1 comment: "👀" / "hmm" / ":thinking:" | No signal at all |
+| 1 comment: "this is wrong" with no target or direction | Asserts a problem but doesn't propose a fix |
+| 2 comments: "use X" + "but actually don't use X" | Self-contradicting |
+| 1 comment: "we discussed this offline — please address" | References context the loop doesn't have |
+| 1 comment: "won't this break the prod migration we did last week?" | Implicit change request gated on knowledge the loop can't access |
+| Mixed: 2 concrete directives + 1 "rethink the whole approach" | The "rethink" subverts the others; escalate to confirm scope |
+Escalate per the caller's procedure (add the review id to the cursor's escalated set, emit one terminal message, pause the PR).
+## Borderline rule
+If you can paraphrase the review's intent as **"do X"** (X concrete) → actionable. Pick the best interpretation; dispatch.
+If you can only paraphrase as **"the reviewer is dissatisfied but I can't tell with what"** → ambiguous.
+Mixed ("3 concrete + 1 dissatisfaction") usually splits: action the concrete; ask about the dissatisfaction in the reply summary. Pure ambiguity means *nothing* in the review is actionable.