@olegkoval/agent-skills 1.26.0 → 1.28.0

package/packages/software-development/lekker-review/references/output-format.md

@@ -0,0 +1,232 @@
+# Output format (Step 4)
+
+## Step 4 — Format Output
+
+Output is **one unified markdown document** — detailed enough to stand on its
+own, clean enough to paste directly into GitHub. No ANSI split, no stripped
+copy-paste block. Every finding includes location, the bad code, the reason,
+and the fix — all in standard GitHub markdown.
+
+Output the review as a markdown response (not via printf). No ANSI escapes.
+
+---
+
+### Output format
+
+```
+## Review — [PR #<PR_NUMBER> — <title>](<PR_URL>)
+
+**Author:** <author> · **Branch:** `<headRefName>` → `<baseRefName>`
+**Size:** +<additions>/-<deletions> across <changedFiles> files
+**Head:** `<headRefOid short sha>`
+**Linear:** [<ticket-id>](<linear-url>) — <ticket title>
+**Findings:** <X Critical / Y Important / Z Observations / W Idiomatic>
+**Proofs:** <M proven / N attempted> *(include only when N > 0)*
+**CI:** <✅ All passing | ⚠️ N failing: check-name | ⏳ Pending | N/A>
+**Depth:** <⚡ scan | 🔍 medium | 🔬 deep>
+
+---
+
+*(If PR_TITLE_ISSUE = true, insert this block here — before the Summary. Omit entirely if PR_TITLE_ISSUE = false.)*
+
+> ⛔ **CANNOT MERGE — PR title missing Linear ticket prefix**
+>
+> The PR title must start with the Linear ticket(s) in square brackets.
+> Recommended title prefix: **`<RECOMMENDED_PREFIX>`**
+>
+> How to fix: edit the PR title on GitHub to start with `<RECOMMENDED_PREFIX> <rest of current title>`.
+
+---
+
+## 🔁 Since last review
+
+*(Re-review mode only — include when PREV_SHA was found. Omit entirely on first review.)*
+
+Reviewed delta: `<PREV_SHA short>..<head short>`
+
+- ✅ Fixed: <prior finding title> (`file:line`)
+- ⚠️ Still open: <prior finding title> (`file:line`) — <one line on current state>
+
+---
+
+### Summary
+
+A substantive 2–3 paragraph narrative — NOT a one-line recap. A reader who
+hasn't seen the ticket or the diff should finish the Summary understanding
+*why this work exists* and *what it buys the business/team*, before any finding.
+Cover, in roughly this order:
+
+- **The problem / goal — why this PR exists.** What was broken, missing, or
+  needed? Pull this from the Linear ticket (the AC_LIST and ticket summary),
+  not just the diff. State the user-facing or business outcome the change is
+  reaching for ("RSL can create P21 contacts automatically from Shopify instead
+  of hand-keying them", "unblocks the PUT/update flow that depends on the
+  metafield being populated").
+- **What it does — the mechanism, in plain terms.** The shape of the solution:
+  the key entry points, the data flow, the gating/safety mechanisms, and how the
+  pieces fit. Name the design choices and *why each one was made* — kill switch
+  (so it can ship dark and be flipped per-environment), idempotency gate (so
+  re-deliveries don't duplicate), validation (so bad payloads fail fast and
+  non-retryably), stacking/deferral (so concurrency lands in a reviewable second
+  PR). The reader should learn the rationale, not just the inventory.
+- **Risk level + recommendation.** Land on the overall risk and what you advise:
+  ship as-is, ship after the Important fixes, or hold. If the headline risk is a
+  single finding, name it here in one sentence and point forward to it.
+
+Lead with the goal and the mechanism; keep the risk framing honest. This section
+sets the altitude for everything below — a risky PR should read as risky. Do NOT
+editorialize about what the PR does *well*: no praise, no "the win", no
+"cleanly/nicely implemented", no complimenting the design. State what it does and
+what the risks are — nothing about how good it is.
+
+---
+
+**Verdict: <✅ LGTM — ship it | ⚠️ LGTM with changes | 🚫 Needs work>**
+
+---
+
+## 🔥 Production Signals
+
+*(Include only when SENTRY_SIGNALS has entries. Omit section entirely if empty.)*
+
+- [<issue title>](<sentry-url>) — <N> events / <M> users (7d) · first seen <date>
+  Files: <relevant files from stack trace>
+  Note: <does this PR fix, worsen, or not affect this error?>
+
+---
+
+## 🚨 Critical — must fix before merge
+
+### #1 — <short label>
+
+**File:** `<path/to/file.ts>:<line>` · **Risk:** <one sentence — what breaks and when>
+
+**Current code:**
+\```ts
+<the actual bad lines from the diff, verbatim>
+\```
+
+**Why it's wrong:** <explanation — what the code does vs what it should do.
+Include the concrete failure: "lookup always returns undefined because the key
+is triple-wrapped", "crashes with TypeError on Node 20 because Map.groupBy
+does not exist", etc. If the author might not believe it, include a short
+proof inline.>
+
+**Fix:**
+\```ts
+<corrected version — exact drop-in replacement or minimal diff>
+\```
+
+**Proof — ran in the worktree:** *(include only when the finding carries a `proof` with `proven: true`)*
+\```
+<redOutput, verbatim>
+\```
+*Test asserts the correct behavior and fails because of this bug. It flips green when fixed.*
+
+---
+
+### #N — <label>
+...
+
+*(None.)* ← only if section is empty
+
+---
+
+## ⚠️ Important — should fix
+
+(same per-finding format, continuing the numbering sequence)
+
+*(None.)* ← only if section is empty
+
+---
+
+## 📝 Observations
+
+- <note — tradeoff, risk to watch, or design question worth raising>
+
+*(Omit section entirely if empty.)*
+
+## 🧪 Test Quality
+
+**Coverage verdict:** <✅ Well tested | ⚠️ Partially tested | ❌ Under-tested | N/A — no logic changes>
+
+<One paragraph: overall assessment — what is tested, what is missing, and
+whether the test suite would catch a regressing change to this code.>
+
+**Gaps:**
+- `test-file:line` — <gap or weakness>
+- `test-file:line` — <implementation-coupled test: IO mocked to reach logic,
+  call-shape spy, component mocked for its props, query hook mocked, or an
+  implementation-detail assertion>
+  → **Fix:** <no-mock refactor — usually "extract a pure function over plain
+  data and test that" or "inject a simple fake and assert the output">
+
+*(Omit if no mocking issues. Do not flag legitimate mocks — error paths,
+pinned non-determinism, un-runnable dependencies.)*
+
+**Mutation-slip risk:** <paragraph — which mutation classes would go undetected,
+if any. "No obvious gaps found." if clean.>
+
+*(Omit section entirely if no test changes and no business logic changes.)*
+
+---
+
+## 💡 Idiomatic & Consistency
+
+- **<deviation>** (`<file>:<line>`) — <the idiomatic alternative in one line>.
+  Precedent: `<file>:<line>` where the established pattern already lives.
+
+*(Non-blocking suggestions — do NOT affect the verdict. Omit section entirely
+if empty.)*
+
+---
+
+## 💰 Review Cost
+
+```
+Depth:            <⚡ scan | 🔍 medium | 🔬 deep>
+Diff size:        ~<N> lines (~<N> tokens)
+Agents run:       <N total> — <breakdown, e.g. "5 reviewers (sonnet) + 6 verifiers (sonnet) + 2 provers (sonnet) + 1 critic (sonnet)">
+Verify skipped:   <N> hard-rule finding(s) exempt from adversarial verification (omit the line when 0)
+Context sources:  <the subset of issue-tracker / chat / docs / framework-docs / monitoring / CI / prior-review-memory actually used>
+
+Output tokens:    <N>   ← ACTUAL workflow spend, from the workflow's outputTokens return value
+Turn total:       <N>   ← whole-turn shared pool (turnTokensTotal), main loop included
+Input tokens:     ~<N>  ← estimated: diff tokens × agent passes + context files + prompt files
+
+Cost: ~$<X.XX>  (output actual, input estimated; blended across model tiers below)
+```
+
+Per-MTok pricing (input/output) — verified 2026-07-07 from the claude-api reference; re-check there if models changed:
+- claude-fable-5: $10 / $50
+- claude-opus-4-8: $5 / $25
+- claude-sonnet-4-6 / claude-sonnet-5: $3 / $15
+- claude-haiku-4-5: $1 / $5
+
+Reviewer agents, verifiers, provers, and the critic all run on sonnet; triage and housekeeping on haiku. Only the main loop (context gathering + this synthesis) runs on the session model — use the session model's actual ID for that tier.
+
+---
+
+### Finding format rules
+
+- **File + Risk** on one line — the reader knows instantly what breaks and why
+  it matters before reading the proof.
+- **Current code** block: verbatim lines from the diff, enough context to find
+  the spot (3–10 lines). Never paraphrase — paste the actual code.
+- **Why it's wrong**: lead with the failure mode ("this always returns false
+  because…"), then the mechanism. Keep to 3–6 sentences. If a comparison or
+  counter-example makes it clearer, include it.
+- **Fix** block: show the corrected version as a drop-in replacement. When the
+  fix is architectural (extract helper, add index), describe it concisely then
+  show a minimal skeleton if useful. If the fix touches consumers outside the
+  changed file, call that out explicitly — never show a partial fix that looks
+  self-contained but silently breaks callers.
+- Blank line between findings. No double blank lines.
+- No trailing whitespace, no HTML tags, no ANSI escapes.
+- **Proof counter-evidence rule**: when `proof.attempted` is true but `proven`
+  is false because the code behaved correctly for the tested input, the
+  synthesis MUST treat that as counter-evidence — either downgrade the finding
+  or state in the finding body why the proof attempt doesn't exonerate it
+  (e.g. the tested input wasn't the one that actually breaks). A finding whose
+  proof came back green cannot silently stay Critical. When `attempted` is
+  false, say nothing — untestable is not evidence either way.

package/packages/software-development/lekker-review/scripts/changed-files.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+# changed-files.sh -- lekker-review helper
+# Determines the base ref for the branch checked out in WORKTREE_PATH and
+# prints, one path per line on stdout, the files this branch has changed
+# relative to that base. Prints the base ref actually used to stderr,
+# prefixed "base-ref: ", so callers can capture it separately from the file
+# list.
+#
+# Usage: changed-files.sh WORKTREE_PATH [--include-uncommitted]
+#   --include-uncommitted: also union in the worktree's uncommitted (working
+#   tree + staged) changes -- what a fix agent just wrote, even if it wasn't
+#   part of the original PR diff.
+#
+# Never fails: if no base ref can be resolved (or merge-base fails), prints
+# NOTHING to stdout, "base-ref: unknown" to stderr, and exits 0. Callers
+# should treat empty stdout as "could not scope -- fall back to repo-wide".
+
+set -uo pipefail
+
+WORKTREE_PATH="${1:?WORKTREE_PATH required}"
+INCLUDE_UNCOMMITTED=false
+[[ "${2:-}" == "--include-uncommitted" ]] && INCLUDE_UNCOMMITTED=true
+
+# ---------------------------------------------------------------------------
+# 1. Resolve a base ref: origin's default branch first, then a fixed
+#    fallback order.
+# ---------------------------------------------------------------------------
+BASE_REF=""
+
+SYM_REF="$(git -C "$WORKTREE_PATH" symbolic-ref refs/remotes/origin/HEAD 2>/dev/null || true)"
+if [[ -n "$SYM_REF" ]]; then
+    candidate="origin/${SYM_REF#refs/remotes/origin/}"
+    if git -C "$WORKTREE_PATH" rev-parse --verify --quiet "$candidate" >/dev/null 2>&1; then
+        BASE_REF="$candidate"
+    fi
+fi
+
+if [[ -z "$BASE_REF" ]]; then
+    for candidate in origin/staging origin/main origin/master; do
+        if git -C "$WORKTREE_PATH" rev-parse --verify --quiet "$candidate" >/dev/null 2>&1; then
+            BASE_REF="$candidate"
+            break
+        fi
+    done
+fi
+
+if [[ -z "$BASE_REF" ]]; then
+    printf 'base-ref: unknown\n' >&2
+    exit 0
+fi
+
+# ---------------------------------------------------------------------------
+# 2. Merge-base + diff.
+# ---------------------------------------------------------------------------
+MERGE_BASE="$(git -C "$WORKTREE_PATH" merge-base HEAD "$BASE_REF" 2>/dev/null || true)"
+if [[ -z "$MERGE_BASE" ]]; then
+    printf 'base-ref: unknown\n' >&2
+    exit 0
+fi
+
+printf 'base-ref: %s\n' "$BASE_REF" >&2
+
+CHANGED_TMP="/tmp/lekker-changed-files-tmp-$$.txt"
+git -C "$WORKTREE_PATH" diff --name-only "$MERGE_BASE" HEAD > "$CHANGED_TMP" 2>/dev/null || true
+
+if [[ "$INCLUDE_UNCOMMITTED" == "true" ]]; then
+    git -C "$WORKTREE_PATH" diff --name-only HEAD >> "$CHANGED_TMP" 2>/dev/null || true
+    git -C "$WORKTREE_PATH" diff --name-only --cached >> "$CHANGED_TMP" 2>/dev/null || true
+    # Untracked-but-not-ignored files too: a fix agent that creates a new file
+    # (extracted helper, new test) and does not stage it is invisible to both
+    # diffs above, so its type/lint errors would escape attribution entirely.
+    git -C "$WORKTREE_PATH" ls-files --others --exclude-standard >> "$CHANGED_TMP" 2>/dev/null || true
+    sort -u "$CHANGED_TMP" -o "$CHANGED_TMP" 2>/dev/null || true
+fi
+
+cat "$CHANGED_TMP"
+rm -f "$CHANGED_TMP"

package/packages/software-development/lekker-review/scripts/setup-worktree.sh

@@ -0,0 +1,337 @@
+#!/bin/bash
+# setup-worktree.sh -- lekker-review helper
+# Usage: setup-worktree.sh REPO_SLUG PR_BRANCH OUT_JSON [PREV_SHA]
+# Emits a JSON result file at OUT_JSON and prints "OK <OUT_JSON>" on success.
+
+set -euo pipefail
+
+REPO_SLUG="${1:?REPO_SLUG required}"
+PR_BRANCH="${2:?PR_BRANCH required}"
+OUT_JSON="${3:?OUT_JSON required}"
+PREV_SHA="${4:-}"
+
+CACHE_DIR="$HOME/.cache/lekker-review"
+CACHE_FILE="$CACHE_DIR/repo-map.tsv"
+NOTES=""
+WORKTREE_PATH="/tmp/lekker-review-$$"
+
+mkdir -p "$CACHE_DIR"
+
+# ---------------------------------------------------------------------------
+# Helper: normalise a remote URL to an org/repo comparable key.
+# Strips protocol, host, and trailing .git so "github.com/org/repo" ->
+# "org/repo".
+# ---------------------------------------------------------------------------
+normalize_url() {
+    local url
+    url="$1"
+    url="${url%.git}"
+    # Strip https://host/ prefix
+    url="${url#*://*/}"
+    # For SCP-style git@host:org/repo - strip up to and including ':'
+    url="${url#*:}"
+    printf '%s' "$url"
+}
+
+SLUG_NORM="$(normalize_url "https://github.com/${REPO_SLUG}.git")"
+
+REPO_ROOT=""
+
+# ---------------------------------------------------------------------------
+# 1a. Try the cache
+# ---------------------------------------------------------------------------
+if [[ -f "$CACHE_FILE" ]]; then
+    while IFS=$'\t' read -r cached_slug cached_path; do
+        [[ "$cached_slug" == "$REPO_SLUG" ]] || continue
+        if [[ -d "$cached_path" ]]; then
+            local_url="$(git -C "$cached_path" remote get-url origin 2>/dev/null || true)"
+            local_norm="$(normalize_url "$local_url")"
+            if [[ "$local_norm" == "$SLUG_NORM" ]]; then
+                REPO_ROOT="$cached_path"
+            fi
+        fi
+        break
+    done < "$CACHE_FILE"
+fi
+
+# ---------------------------------------------------------------------------
+# 1b. Try $PWD
+# ---------------------------------------------------------------------------
+if [[ -z "$REPO_ROOT" ]] && git -C "$PWD" remote get-url origin >/dev/null 2>&1; then
+    pwd_url="$(git -C "$PWD" remote get-url origin 2>/dev/null || true)"
+    pwd_norm="$(normalize_url "$pwd_url")"
+    if [[ "$pwd_norm" == "$SLUG_NORM" ]]; then
+        REPO_ROOT="$PWD"
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# 1c. Scan ~/Work (maxdepth 4)
+# ---------------------------------------------------------------------------
+if [[ -z "$REPO_ROOT" ]]; then
+    while IFS= read -r git_dir; do
+        candidate="${git_dir%/.git}"
+        [[ -d "$candidate" ]] || continue
+        cand_url="$(git -C "$candidate" remote get-url origin 2>/dev/null || true)"
+        [[ -n "$cand_url" ]] || continue
+        cand_norm="$(normalize_url "$cand_url")"
+        if [[ "$cand_norm" == "$SLUG_NORM" ]]; then
+            REPO_ROOT="$candidate"
+            break
+        fi
+    done < <(find "$HOME/Work" -maxdepth 4 -name ".git" -type d 2>/dev/null)
+fi
+
+# ---------------------------------------------------------------------------
+# 1d. Shallow clone as last resort (not cached)
+# ---------------------------------------------------------------------------
+if [[ -z "$REPO_ROOT" ]]; then
+    CLONE_DIR="/tmp/lekker-clone-$$"
+    git clone --depth=100 "https://github.com/${REPO_SLUG}.git" "$CLONE_DIR"
+    REPO_ROOT="$CLONE_DIR"
+    NOTES="${NOTES}cloned-shallow;"
+else
+    # Refresh cache entry: remove stale line and append fresh one
+    if [[ -f "$CACHE_FILE" ]]; then
+        grep -v "^${REPO_SLUG}	" "$CACHE_FILE" > "${CACHE_FILE}.tmp" 2>/dev/null || true
+        mv "${CACHE_FILE}.tmp" "$CACHE_FILE"
+    fi
+    printf '%s\t%s\n' "$REPO_SLUG" "$REPO_ROOT" >> "$CACHE_FILE"
+fi
+
+# ---------------------------------------------------------------------------
+# 2. Fetch + worktree
+# ---------------------------------------------------------------------------
+git -C "$REPO_ROOT" fetch origin "$PR_BRANCH" 2>/dev/null || true
+
+if ! git -C "$REPO_ROOT" worktree add "$WORKTREE_PATH" "origin/$PR_BRANCH" 2>/dev/null; then
+    if ! git -C "$REPO_ROOT" worktree add "$WORKTREE_PATH" FETCH_HEAD 2>/dev/null; then
+        printf 'ERROR: could not create worktree at %s\n' "$WORKTREE_PATH" >&2
+        exit 1
+    fi
+    NOTES="${NOTES}worktree-used-FETCH_HEAD;"
+fi
+
+# ---------------------------------------------------------------------------
+# 3. node_modules symlink
+# ---------------------------------------------------------------------------
+NM_LINKED=false
+if [[ -d "$REPO_ROOT/node_modules" ]]; then
+    ln -s "$REPO_ROOT/node_modules" "$WORKTREE_PATH/node_modules"
+    NM_LINKED=true
+else
+    NOTES="${NOTES}no-node_modules-static-checks-skipped;"
+fi
+
+# ---------------------------------------------------------------------------
+# 3b. Determine changed files (to scope tsc/eslint to this PR's diff instead
+#     of the whole repo -- see scripts/changed-files.sh).
+# ---------------------------------------------------------------------------
+CHANGED_FILES_FILE="/tmp/lekker-changed-$$.txt"
+BASE_REF_NOTE="$("$(dirname "$0")/changed-files.sh" "$WORKTREE_PATH" 2>&1 >"$CHANGED_FILES_FILE" | sed -n 's/^base-ref: //p')" || true
+
+# A blank line here would make `grep -F -f` match EVERY tsc error line, turning
+# the repo's standing type debt into "errors this PR introduced". Strip them.
+if [[ -f "$CHANGED_FILES_FILE" ]]; then
+    grep -v '^[[:space:]]*$' "$CHANGED_FILES_FILE" > "${CHANGED_FILES_FILE}.clean" 2>/dev/null || true
+    mv "${CHANGED_FILES_FILE}.clean" "$CHANGED_FILES_FILE" 2>/dev/null || true
+fi
+
+BASE_REF_VAL="null"
+if [[ -n "$BASE_REF_NOTE" ]] && [[ "$BASE_REF_NOTE" != "unknown" ]]; then
+    BASE_REF_VAL="$BASE_REF_NOTE"
+else
+    NOTES="${NOTES}static-checks-repo-wide-no-base-ref;"
+fi
+
+# Lintable, still-on-disk changed files (a deleted file must not go to eslint).
+ESLINT_TARGETS=()
+if [[ -s "$CHANGED_FILES_FILE" ]]; then
+    while IFS= read -r cf; do
+        [[ -z "$cf" ]] && continue
+        case "$cf" in
+            *.ts|*.tsx|*.js|*.jsx|*.mjs|*.cjs) ;;
+            *) continue ;;
+        esac
+        [[ -f "$WORKTREE_PATH/$cf" ]] || continue
+        ESLINT_TARGETS+=("$cf")
+    done < "$CHANGED_FILES_FILE"
+fi
+
+# ---------------------------------------------------------------------------
+# 4. Concurrent tsc + eslint (never fail the script)
+# ---------------------------------------------------------------------------
+TSC_TAIL_FILE="/tmp/lekker-tsc-$$.txt"
+TSC_FULL_FILE="/tmp/lekker-tsc-full-$$.txt"
+TSC_CHANGED_FILE="/tmp/lekker-tsc-changed-$$.txt"
+TSC_COUNT_FILE="/tmp/lekker-tsc-count-$$.txt"
+ESLINT_TAIL_FILE="/tmp/lekker-eslint-$$.txt"
+ESLINT_SCOPE_FILE="/tmp/lekker-eslint-scope-$$.txt"
+printf '' > "$TSC_TAIL_FILE"
+printf '' > "$TSC_CHANGED_FILE"
+printf '0' > "$TSC_COUNT_FILE"
+printf '' > "$ESLINT_TAIL_FILE"
+printf 'skipped' > "$ESLINT_SCOPE_FILE"
+
+run_tsc() {
+    # tsc needs the whole program to resolve types, so it always runs
+    # repo-wide; only the reported OUTPUT is split by changed-file scope.
+    if [[ -f "$WORKTREE_PATH/tsconfig.json" ]] && [[ "$NM_LINKED" == "true" ]]; then
+        (cd "$WORKTREE_PATH" && npx tsc --noEmit) > "$TSC_FULL_FILE" 2>&1 || true
+        tail -40 "$TSC_FULL_FILE" >> "$TSC_TAIL_FILE" || true
+        grep -c 'error TS' "$TSC_FULL_FILE" > "$TSC_COUNT_FILE" 2>/dev/null || printf '0' > "$TSC_COUNT_FILE"
+        if [[ -s "$CHANGED_FILES_FILE" ]]; then
+            grep -F -f "$CHANGED_FILES_FILE" "$TSC_FULL_FILE" 2>/dev/null | tail -40 > "$TSC_CHANGED_FILE" || true
+        fi
+        rm -f "$TSC_FULL_FILE"
+    else
+        printf 'skipped\n' > "$TSC_TAIL_FILE"
+        printf '0' > "$TSC_COUNT_FILE"
+    fi
+}
+
+run_eslint() {
+    local has_config
+    has_config=false
+    if [[ "$NM_LINKED" == "true" ]]; then
+        (cd "$WORKTREE_PATH" && compgen -G '.eslintrc*' >/dev/null 2>&1) && has_config=true
+        if [[ "$has_config" == "false" ]]; then
+            (cd "$WORKTREE_PATH" && compgen -G 'eslint.config*' >/dev/null 2>&1) && has_config=true
+        fi
+        if [[ "$has_config" == "true" ]]; then
+            if [[ -s "$CHANGED_FILES_FILE" ]]; then
+                if [[ ${#ESLINT_TARGETS[@]} -gt 0 ]]; then
+                    # Default (stylish) formatter: ESLint 9 removed the bundled "compact" formatter
+                    (cd "$WORKTREE_PATH" && npx eslint --max-warnings=0 "${ESLINT_TARGETS[@]}" 2>&1 | tail -40 >> "$ESLINT_TAIL_FILE") || true
+                    printf 'changed-files' > "$ESLINT_SCOPE_FILE"
+                else
+                    printf 'no-changed-lintable-files\n' > "$ESLINT_TAIL_FILE"
+                    printf 'none' > "$ESLINT_SCOPE_FILE"
+                fi
+            else
+                # Base ref could not be resolved -- fall back to the old repo-wide run.
+                (cd "$WORKTREE_PATH" && npx eslint . --max-warnings=0 2>&1 | tail -40 >> "$ESLINT_TAIL_FILE") || true
+                printf 'full-fallback' > "$ESLINT_SCOPE_FILE"
+            fi
+        else
+            printf 'no-eslint-config\n' > "$ESLINT_TAIL_FILE"
+            printf 'no-eslint-config' > "$ESLINT_SCOPE_FILE"
+        fi
+    else
+        printf 'skipped\n' > "$ESLINT_TAIL_FILE"
+        printf 'skipped' > "$ESLINT_SCOPE_FILE"
+    fi
+}
+
+run_tsc &
+TSC_PID=$!
+run_eslint &
+ESLINT_PID=$!
+wait "$TSC_PID" || true
+wait "$ESLINT_PID" || true
+
+# ---------------------------------------------------------------------------
+# 5. Collect PROJECT_RULES from CLAUDE.md files (depth <= 3, skip node_modules)
+# ---------------------------------------------------------------------------
+PROJECT_RULES_FILE="/tmp/lekker-rules-$$.txt"
+printf '' > "$PROJECT_RULES_FILE"
+
+while IFS= read -r claude_md; do
+    printf '=== %s ===\n' "$claude_md" >> "$PROJECT_RULES_FILE"
+    cat "$claude_md" >> "$PROJECT_RULES_FILE"
+    printf '\n' >> "$PROJECT_RULES_FILE"
+done < <(find "$WORKTREE_PATH" -maxdepth 3 -name 'CLAUDE.md' \
+    -not -path '*/node_modules/*' 2>/dev/null)
+
+# ---------------------------------------------------------------------------
+# 6. HEAD SHA
+# ---------------------------------------------------------------------------
+HEAD_SHA="$(git -C "$WORKTREE_PATH" rev-parse HEAD)"
+HEAD_SHA_SHORT="$(git -C "$WORKTREE_PATH" rev-parse --short HEAD)"
+
+# ---------------------------------------------------------------------------
+# 7. Delta diff (PREV_SHA)
+# ---------------------------------------------------------------------------
+DELTA_FILE_VAL="null"
+if [[ -n "$PREV_SHA" ]]; then
+    if git -C "$WORKTREE_PATH" cat-file -e "$PREV_SHA" 2>/dev/null; then
+        DELTA_FILE_PATH="/tmp/lekker-delta-$$.diff"
+        git -C "$WORKTREE_PATH" diff "${PREV_SHA}..HEAD" > "$DELTA_FILE_PATH"
+        DELTA_FILE_VAL="$DELTA_FILE_PATH"
+    else
+        NOTES="${NOTES}prev-sha-not-found-full-review;"
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# 8. Emit JSON via python3 (safe escaping via json.dump)
+#    All values passed as argv to avoid any shell-escaping in the heredoc.
+# ---------------------------------------------------------------------------
+python3 - \
+    "$WORKTREE_PATH" \
+    "$REPO_ROOT" \
+    "$HEAD_SHA" \
+    "$HEAD_SHA_SHORT" \
+    "$TSC_TAIL_FILE" \
+    "$ESLINT_TAIL_FILE" \
+    "$PROJECT_RULES_FILE" \
+    "$DELTA_FILE_VAL" \
+    "$NOTES" \
+    "$CHANGED_FILES_FILE" \
+    "$BASE_REF_VAL" \
+    "$ESLINT_SCOPE_FILE" \
+    "$TSC_CHANGED_FILE" \
+    "$TSC_COUNT_FILE" \
+    "$OUT_JSON" <<'PYEOF'
+import json, sys, os
+
+(worktree_path, repo_root, head_sha, head_sha_short,
+ tsc_file, eslint_file, rules_file, delta_file, notes,
+ changed_files_file, base_ref_val, eslint_scope_file,
+ tsc_changed_file, tsc_count_file,
+ out_json) = sys.argv[1:16]
+
+def read_file(path):
+    if not os.path.exists(path):
+        return ""
+    with open(path, "r", errors="replace") as f:
+        return f.read()
+
+changed_files = [l for l in read_file(changed_files_file).splitlines() if l.strip()]
+
+eslint_scope = read_file(eslint_scope_file).strip() or "skipped"
+
+try:
+    tsc_error_count = int(read_file(tsc_count_file).strip() or "0")
+except ValueError:
+    tsc_error_count = 0
+
+data = {
+    "worktreePath":   worktree_path,
+    "repoRoot":       repo_root,
+    "headSha":        head_sha,
+    "headShaShort":   head_sha_short,
+    "tscTail":        read_file(tsc_file),
+    "eslintTail":     read_file(eslint_file),
+    "projectRules":   read_file(rules_file),
+    "deltaFile":      None if delta_file == "null" else delta_file,
+    "notes":          notes,
+    "changedFiles":   changed_files,
+    "baseRef":        None if base_ref_val == "null" else base_ref_val,
+    "eslintScope":    eslint_scope,
+    "tscChangedTail": read_file(tsc_changed_file),
+    "tscErrorCount":  tsc_error_count,
+}
+
+for p in (tsc_file, eslint_file, rules_file, changed_files_file,
+          eslint_scope_file, tsc_changed_file, tsc_count_file):
+    try:
+        os.remove(p)
+    except OSError:
+        pass
+
+with open(out_json, "w") as f:
+    json.dump(data, f, indent=2)
+
+print("OK " + out_json)
+PYEOF