@olegkoval/agent-skills 1.52.0 → 1.53.0

package/plugins/olko-github-pr/skills/lekker-review/SKILL.md

@@ -45,7 +45,7 @@ metadata:
     - multi-agent
     - workflow
     - quality
-argument-hint: "<github-pr-url | repo pr-number | repo pr-title | branch [ref]> [scan|medium|deep] [--post] [--fix] [--base <ref>]"
+argument-hint: "<github-pr-url | repo pr-number | repo pr-title | branch [ref]> [scan|medium|deep|deps] [--post] [--fix] [--base <ref>]"
 ---
 
 # Lekker Review
@@ -244,11 +244,17 @@ Then:
 `LOCAL_BRANCH` is `main`, `master`, `develop`, `staging`, or `production`, stop
 and say so.
 
-**Depth:** explicit keyword `scan`, `medium`, or `deep` wins. If absent, get
-the diff stat - in `pr` mode from
-`gh pr view <PR_NUMBER> --repo <REPO_SLUG> --json additions,deletions,changedFiles`,
-in `branch` mode from `git diff --shortstat <MERGE_BASE> HEAD` plus
-`git diff --name-only <MERGE_BASE> HEAD | wc -l` - and apply AUTO-DEPTH:
+**Depth:** explicit keyword `scan`, `medium`, `deep` or `deps` wins. If absent,
+get the per-file stat - in `pr` mode from
+`gh pr view <PR_NUMBER> --repo <REPO_SLUG> --json additions,deletions,changedFiles,files,baseRefName,state,mergeCommit`
+(keep `baseRefName` as `BASE_BRANCH` and `changedFiles` as `EXPECTED_FILES` for
+Track A; when `state` is `MERGED`, keep `mergeCommit.oid` as `MERGE_COMMIT`), in `branch` mode from `git diff --numstat <MERGE_BASE> HEAD` - and
+apply AUTO-DEPTH. Lockfiles (`package-lock.json`, `npm-shrinkwrap.json`,
+`yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `bun.lockb`) do NOT count toward
+additions+deletions: a regenerated lockfile is thousands of lines nobody reads.
+- `deps` (candidate) if every changed file is a lockfile or a `package.json`.
+  Confirmed after Track A by `scripts/deps-only.mjs` (see "Confirm deps depth");
+  until then run Track B as for `scan`.
 - `scan` if additions+deletions < 150 AND changedFiles <= 5
 - `deep` if additions+deletions > 800 OR changedFiles > 25 OR diff touches
   `migrations/` or `*.sql`
@@ -271,7 +277,8 @@ still needs explicit confirmation (Step 4).
 
 **`--base <ref>` flag (branch mode only):** overrides base-ref detection. Passed
 through to the scripts as `LEKKER_BASE_REF`. Ignored in `pr` mode, where the
-base comes from the PR.
+base comes from the PR: Track A passes `LEKKER_BASE_REF=origin/<BASE_BRANCH>`
+itself, so the script fetches the base and diffs against its current tip.
 
 **`--no-fix` flag:** parse and store as `FIX_MODE=false`, and do not offer fixes
 in Step 4. Use it for a read-only pre-push look.
@@ -287,8 +294,8 @@ to `workflow` for `HOST=claude` and `codex` for `HOST=codex`. Reject an explicit
 engine that does not exist on the current host (`workflow` requires Claude's
 Workflow tool; `codex` requires Codex native collaboration). `revmux` is
 allowed only at depth `medium` or `deep` - revmux's
-scripts reject `scan` (see Depth gate). If depth resolves to `scan` (explicit
-or auto), force `ENGINE` back to the current host's native engine regardless of
+scripts reject `scan` (see Depth gate). If depth resolves to `scan` or `deps`
+(explicit or auto), force `ENGINE` back to the current host's native engine regardless of
 the flag and note `engine forced to <workflow|codex> - revmux needs
 medium/deep` in the review header.
 
@@ -309,19 +316,19 @@ page for this PR.
 
 ## Depth gate
 
-| Step                        | scan                  | medium              | deep                       |
-|-----------------------------|-----------------------|---------------------|----------------------------|
-| Context: issue-tracker/CI/diff/existing-reviews | always | always | always |
-| Context: chat/docs/framework-docs/monitoring/prior-review-memory (optional, MCP-dependent) | skip | included | included + broader recall |
-| Worktree + static checks    | skip (WORKTREE_PATH=null) unless `--fix` | included | included          |
-| Review agents               | 2 triage (haiku)      | 5 specialists (sonnet) | 5 specialists (sonnet)  |
-| Per-finding verification    | Criticals + Importants | Criticals + Importants | Criticals + Importants |
-| Completeness critic         | skip                  | skip                | included                   |
-| Proof-of-bug (failing test per Critical or composed-boundary Important) | skip     | included (max 5)    | included (max 5)           |
-| Living review artifact      | included              | included            | included                   |
-| Housekeeping (optional memory/notes writeback) | skip | included            | included                   |
-| `--post`                    | supported             | supported           | supported                  |
-| `--fix` / fix offer         | supported (forces worktree) | supported     | supported                  |
+| Step                        | 📦 deps               | scan                  | medium              | deep                       |
+|-----------------------------|-----------------------|-----------------------|---------------------|----------------------------|
+| Context: issue-tracker/CI/diff/existing-reviews | always | always | always | always |
+| Context: chat/docs/framework-docs/monitoring/prior-review-memory (optional, MCP-dependent) | skip | skip | included | included + broader recall |
+| Worktree + static checks    | included (`npm ci` per changed lockfile) | skip (WORKTREE_PATH=null) unless `--fix` | included | included          |
+| Review agents               | 1 deps checklist      | 2 triage (haiku)      | 5 specialists (sonnet) | 5 specialists (sonnet)  |
+| Per-finding verification    | none                  | Criticals + Importants | Criticals + Importants | Criticals + Importants |
+| Completeness critic         | skip                  | skip                  | skip                | included                   |
+| Proof-of-bug (failing test per Critical or composed-boundary Important) | skip | skip | included (max 5)    | included (max 5)           |
+| Living review artifact      | included              | included              | included            | included                   |
+| Housekeeping (optional memory/notes writeback) | skip | skip                | included            | included                   |
+| `--post`                    | supported             | supported             | supported           | supported                  |
+| `--fix` / fix offer         | supported             | supported (forces worktree) | supported     | supported                  |
 
 For scan: note `⚡ scan - worktree unavailable, static checks skipped` in the
 review header. When `--fix` forced the worktree at scan depth, drop that note
@@ -350,7 +357,19 @@ Fire both tracks in the same turn.
 Run via Bash with `run_in_background`:
 
 ```bash
-# MODE=pr - checks out origin/<PR_BRANCH>, fetching if needed
+# MODE=pr - fetches origin/<PR_BRANCH> AND origin/<BASE_BRANCH>, then checks out
+# the PR branch. Without the base fetch the merge-base is whatever this clone
+# last saw, and the file list widens (65 files instead of 9 on one PR).
+# LEKKER_EXPECTED_FILES lets the script report a list that still disagrees.
+LEKKER_BASE_REF=origin/<BASE_BRANCH> LEKKER_EXPECTED_FILES=<EXPECTED_FILES> \
+${SKILL_ROOT}/scripts/setup-worktree.sh \
+  <REPO_SLUG> <PR_BRANCH> <scratchpad>/worktree.json [PREV_SHA]
+
+# MODE=pr, PR already MERGED - the head is inside the base branch now, so
+# merge-base(head, origin/<BASE_BRANCH>) is the head and the diff is empty.
+# Diff against the base as it was just before the merge instead.
+LEKKER_BASE_BRANCH=<BASE_BRANCH> LEKKER_BASE_REF=<MERGE_COMMIT>^1 \
+LEKKER_EXPECTED_FILES=<EXPECTED_FILES> \
 ${SKILL_ROOT}/scripts/setup-worktree.sh \
   <REPO_SLUG> <PR_BRANCH> <scratchpad>/worktree.json [PREV_SHA]
 ```
@@ -368,7 +387,32 @@ ${SKILL_ROOT}/scripts/setup-worktree.sh \
 On completion, read `worktree.json`. Keys emitted:
 `worktreePath`, `repoRoot`, `headSha`, `headShaShort`, `tscTail`,
 `tscChangedTail`, `tscErrorCount`, `eslintTail`, `eslintScope`, `changedFiles`,
-`baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`.
+`baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`, `depsInstall`.
+
+`notes` containing `changed-files-mismatch:<got>-vs-<expected>` means the
+merge-base still disagrees with the PR. Use the `files` list from `gh pr view`
+as the changed-file list for the review header and agents, and say so in the
+header; the static-check scoping is the script's best effort.
+
+`depsInstall` is non-empty when the diff changed a lockfile: one row per
+lockfile dir, `{dir, status: ok|failed|timeout, tail?}`. The script ran
+`npm ci --ignore-scripts` there instead of symlinking the repo's
+`node_modules`, which holds the pre-PR dependency tree. A row that is not `ok`
+is evidence for the review (a lockfile `npm ci` rejects fails the deploy too),
+not a reason to stop. Set `LEKKER_NO_INSTALL=1` to skip the install. Lockfile
+dirs using yarn, pnpm or bun are not installed (note `deps-install-unsupported`).
+
+**Confirm deps depth** (only when Step 0 picked the `deps` candidate):
+
+```bash
+node ${SKILL_ROOT}/scripts/deps-only.mjs \
+  <worktreePath> <mergeBase> <changedFiles...> > <scratchpad>/deps-report.json
+```
+
+`kind: "deps"` confirms it; pass the report as `depsReport` in CONTEXT_FILE.
+`kind: "mixed"` (a `scripts`, `name` or other non-dependency key changed, or a
+`package.json` was added) means re-apply AUTO-DEPTH without the `deps` rule, and
+fetch the Track B sources the new depth includes before Step 2.
 
 `mergeBase` is the commit the file list was scoped against. Branch mode
 generates its diff from that exact sha (below), so the diff the agents read and
@@ -468,7 +512,10 @@ Write `<scratchpad>/context.json` with keys:
   "deltaFile":       "<worktree.json deltaFile, or null>",
   "houseRulesFile":  "${SKILL_ROOT}/references/house-rules.md",
   "reviewTarget":    "<TARGET_LABEL, e.g. 'PR #412' or 'branch feat/offline-orders'>",
-  "prePush":         "<true in MODE=branch, false in MODE=pr>"
+  "prePush":         "<true in MODE=branch, false in MODE=pr>",
+  "depsReport":      "<deps-report.json contents at depth deps, else null>",
+  "depsInstall":     "<worktree.json depsInstall>",
+  "prBody":          "<PR body at depth deps, else omit>"
 }
 ```
 
@@ -538,7 +585,7 @@ that only when a specific run needs a smaller footprint.
 
 The workflow runs three phases:
 
-- **Review:** scan uses `[triage-quality, triage-logic]` on `haiku`; medium/deep
+- **Review:** deps uses the single `deps` checklist agent; scan uses `[triage-quality, triage-logic]` on `haiku`; medium/deep
   use 5 specialists (quality, implementation, simplification, conventions,
   test-quality) on `sonnet`. Agents receive DIFF_FILE + CONTEXT_FILE by path.
   All five run concurrently: the stage is self-limiting at one agent per
@@ -551,8 +598,9 @@ The workflow runs three phases:
   description/badCode/fix of the set - a Critical is never demoted by an
   Observation someone else filed at the same line - and records every
   contributing dimension in `agreedBy`.
-- **Verify:** every Critical and Important is checked at every depth because it
-  can affect the verdict. Hard-rule findings (`rule` set) use the verifier's
+- **Verify:** every Critical and Important is checked at scan, medium and deep because it
+  can affect the verdict. The `deps` depth verifies nothing: its findings are advisory
+  checklist facts (audit delta, install result) with nothing for a verifier to refute. Hard-rule findings (`rule` set) use the verifier's
   diff-anchor and rule-applicability checks instead of runtime challenges.
   Each verifier runs the five-challenge adversarial refutation from
   `references/agents/verifier.md` against one finding, returns
@@ -727,6 +775,23 @@ codebase. Never on taste alone. These land in their own section, not in
 Critical/Important. A finding without a cited precedent from the codebase is
 dropped.
 
+**Validate line numbers first.** When there is a worktree, write the workflow's
+`findings` to `<scratchpad>/findings.json` and run
+
+```bash
+node ${SKILL_ROOT}/scripts/validate-lines.mjs \
+  <scratchpad>/findings.json <worktreePath>
+```
+
+It checks each `line` against the file at HEAD using the finding's `badCode`:
+kept when it is within 3 lines, re-anchored on a unique match
+(`lineRemapped: true`), or set to `null` when the code is not in the file
+(a `pr.diff` line number cited as a file line). Use the rewritten file from
+here on. A `null` line is a PR-level finding: cite the file without a line, and
+never post it as an inline comment. With no worktree (scan), skip this and do
+not claim the lines were checked. Print the summary counts only when something
+was remapped or nulled.
+
 **Pick the closer** (skip when `FUN=false`): once the verdict is decided, run
 the picker ONCE and keep its JSON as `CLOSER` for the rest of the run, so the
 terminal, saved file, artifact and GitHub body all show the same joke:
@@ -826,7 +891,10 @@ post.
 ## Step 3.5 - Living review artifact (skip when ARTIFACT=false)
 
 Immediately after printing the review, follow `references/artifact-page.md`.
-Claude publishes through Artifact. Codex uses a publish-capable artifact tool
+On Claude, the renderer subagent only writes the HTML and returns its path; the
+main loop fetches the closer image into a base64 `data:` URI file
+(`CLOSER_DATAURI_FILE`), reads the HTML, checks its `<title>` and that it has no
+external `<img>`, and publishes it through Artifact. Codex uses a publish-capable artifact tool
 when one is already available; otherwise it writes or updates the stable local
 self-contained HTML path defined there. The page is the living version of the
 review: verdict header, since-last-review timeline, findings with proof panels.

package/plugins/olko-github-pr/skills/lekker-review/references/agents/deps.md

@@ -0,0 +1,54 @@
+# deps - lekker-review agent prompt
+You will receive in your task message: REPO_SLUG, PR_NUMBER, PR_URL, DIFF_FILE, CONTEXT_FILE (JSON), WORKTREE_PATH.
+Your findings are returned via the StructuredOutput schema enforced by the caller.
+
+This PR changes only lockfiles and the dependency keys of `package.json`
+(`depsReport` in CONTEXT_FILE says which keys, per file). You are the ONLY
+reviewer, so cover the whole checklist. Skip lockfile churn line by line: a
+regenerated lockfile is not reviewable by eye, and the install and audit below
+are the evidence for it.
+
+Inputs from CONTEXT_FILE:
+- `depsReport`: `{ packageJsons: [{ file, depKeysChanged }], lockDirs }`.
+- `depsInstall`: per lockfile dir, `{ dir, status: ok|failed|timeout, tail? }`
+  from `npm ci --ignore-scripts` in the worktree. Empty means none ran.
+- `prBody`, `ciStatus`, `existingReviews` (skip anything already raised).
+
+Checklist, in order:
+
+1. **Reason per change.** Every added or raised version, and every new
+   `overrides`/`resolutions` entry, has a stated reason: an advisory id
+   (GHSA/CVE), a Dependabot alert, or a line in the PR body. No reason ->
+   `observation`.
+2. **Overrides that force a major.** For each override, read the dependant's
+   own declared range (`WORKTREE_PATH/<dir>/node_modules/<dependant>/package.json`
+   or `npm ls <pkg>` in that dir). An override pinning a major the dependant does
+   not declare -> `observation` asking for a removal ticket, naming the
+   condition that lets it go (dependant upgrade).
+3. **Runtime compatibility.** A new major that drops a Node version: compare
+   with `engines.node` and with the runtime image (`Dockerfile` `FROM`, CI
+   `node-version`). An actual mismatch -> `important`.
+4. **Install.** Any `depsInstall` row not `ok` -> `important`, quoting the tail.
+   A lockfile that `npm ci` rejects will fail the deploy too.
+5. **Audit delta.** In each `lockDirs` dir run
+   `npm audit --omit=dev --json` in WORKTREE_PATH (head), and compare with the
+   advisories the PR body says it fixes. A high/critical advisory still present
+   that the PR claims to fix -> `important`. One introduced by the bump ->
+   `important`. Pre-existing ones with no fix -> one `observation`, not one per
+   advisory. If `npm audit` cannot run (no network), say so in that observation;
+   never report it as clean.
+   Read the whole `prBody` first: when it already names the residual advisories
+   or says the audit check stays red, say that in the observation and ask for
+   nothing; never request a note the author already wrote.
+6. **Runtime vs dev.** Note which bumps reach production (`dependencies`) and
+   which are dev-only; a runtime major bump with no test or changelog note in
+   the PR body -> `observation`.
+
+Rules:
+- `file` + `line`: anchor on the `package.json` line of the dependency or
+  override (1-based line in the file at HEAD), never on a lockfile line.
+- `badCode`: that `package.json` line verbatim. `fix`: the concrete change or
+  the ticket to open.
+- No Critical findings: a dependency bump that breaks something shows up as a
+  failed install, a failed check or an advisory, which are `important`.
+- Do not re-review lockfile integrity hashes or resolved URLs.

package/plugins/olko-github-pr/skills/lekker-review/references/artifact-page.md

@@ -38,6 +38,25 @@ All of the following are already in hand after Step 3 of SKILL.md:
 
 ### Claude Code
 
+The subagent RENDERS; the main loop PUBLISHES. Leaf agents run without the
+Artifact tool (a renderer can write the page and then be unable to publish
+it), so never ask the subagent to publish.
+
+**Closer image (main loop, before launching):** when `CLOSER` is set, fetch its
+image so the page can show it inline. The page CSP blocks external images but
+not `data:` URIs.
+
+```bash
+# xkcd: the strip image (`img`); gif: the gif itself (`url`). Cap 500 KB, 10 s.
+curl -sfL --max-time 10 --max-filesize 512000 -o <scratchpad>/closer-img <image url> \
+  && [ "$(wc -c < <scratchpad>/closer-img)" -le 512000 ] \
+  && echo "data:<image/png or image/gif>;base64,$(base64 < <scratchpad>/closer-img | tr -d '\n')" \
+     > <scratchpad>/closer-datauri.txt
+```
+
+Pass `CLOSER_DATAURI_FILE=<scratchpad>/closer-datauri.txt` when that file
+exists; otherwise omit it and the card stays link-only.
+
 Launch exactly ONE `general-purpose` agent, `model: sonnet`, in the
 background. Do not block printing the review on it (see Hard rules).
 
@@ -53,17 +72,12 @@ Read the findings at <findings.json path> and the saved review at
 Write ONE self-contained HTML file to the session scratchpad:
 review-pr-<PR_NUMBER>-<repo-short>.html
 
-Follow the page specification below exactly. Then publish it with the
-Artifact tool using:
-  - favicon: "🥩"   (keep this IDENTICAL on every republish)
-  - title: "Review: <repo-short> #<PR_NUMBER>"
-  - description: <one sentence, e.g. "Living code review for PR #<N> --
-    findings update as commits land">
-  - url: <PREV_ARTIFACT_TARGET>   (include ONLY when the target is a validated
-    http or https URL, so the SAME published artifact updates in place; omit
-    the `url` parameter for null or local-path targets)
+Follow the page specification below exactly. The <title> is
+"Review: <repo-short> #<PR_NUMBER>". CLOSER=<closer JSON, or empty>.
+CLOSER_DATAURI_FILE=<path, or empty>. Do NOT publish the page and do not look
+for an Artifact tool: the caller publishes it.
 
-Return ONLY the resulting artifact URL as your final text. No other output.
+Return ONLY the absolute path of the HTML file as your final text.
 
 --- PAGE SPECIFICATION ---
 <paste Step 3 verbatim here>
@@ -157,8 +171,11 @@ Hard requirements for the HTML page:
   kept concise (verdict + gaps + cost table; no need to reproduce every
   sentence).
 - **Closer footer** (when the caller passes `CLOSER`): a small last card with
-  the closer's title (or `alt`) as a link to its `url`. Link only, no `<img>`:
-  the CSP blocks external images. Skip the card when `CLOSER` is empty.
+  the closer's title (or `alt`) as a link to its `url`. When
+  `CLOSER_DATAURI_FILE` is set, read it and render
+  `<img src="<its contents>" alt="<title or alt>">` above the link, at
+  `max-width:100%; height:auto`. Never point `<img>` at an external URL: the
+  CSP blocks it. Skip the card when `CLOSER` is empty.
 - **Layout:** every code block (`badCode`, `fix`, `redOutput`, `testCode`)
   horizontally scrollable within its own container; the page body itself must
   never scroll horizontally. Keep total page weight sane -- plain `<pre>`
@@ -170,7 +187,15 @@ Hard requirements for the HTML page:
 
 ## Step 4 -- Record the artifact target (fresh post-condition)
 
-When the renderer completes:
+When the renderer completes (Claude Code: the subagent returns the HTML path):
+
+1. Read the HTML file in full (the Artifact tool publishes only files that were
+   read), and check that it has a `<title>` and no external `<img src="http`.
+2. Publish with the Artifact tool: `file_path` = that path, `description` = one
+   sentence ("Living code review for PR #<N>; findings update as commits
+   land"), and `url: <PREV_ARTIFACT_TARGET>` ONLY when it is a validated `http`
+   or `https` URL, so the same artifact updates in place. On a first publish
+   add `icon: "review"`; omit `icon` on a republish so the page keeps its icon.
 
 **On success (URL or stable local HTML path returned):**
 1. Append or refresh a `**Artifact:** <target>` line in the saved review file's
@@ -203,5 +228,5 @@ When the renderer completes:
 - Never include secrets or tokens from context. The page contains only what
   the saved review file already contains -- nothing pulled fresh from
   scratchpad context that isn't already in the review.
-- Favicon stays `🥩` forever for this artifact -- never change it on
+- Set the artifact icon only on the first publish; never change it on
   republish.

package/plugins/olko-github-pr/skills/lekker-review/references/codex-workflow.md

@@ -60,6 +60,7 @@ unavailable; do not infer what it meant from prose.
 
 Select dimensions exactly as the Claude workflow does:
 
+- deps: `deps` (single checklist agent; no verifier, no prover)
 - scan: `triage-quality`, `triage-logic`
 - medium/deep: `quality`, `implementation`, `simplification`, `conventions`,
   `test-quality`

package/plugins/olko-github-pr/skills/lekker-review/references/github-post.md

@@ -30,7 +30,9 @@ Rules:
   review programmatically.
 - Include one comment entry for every Critical and Important finding whose
   `file:line` falls within the diff hunks of this PR (see Step 2 for how to
-  determine commentability).
+  determine commentability). A finding with `line: null` (set by
+  `scripts/validate-lines.mjs` when its quoted code is not in the file) is
+  never an inline comment: list it in the review body instead.
 - **Keep every comment body to 2-4 sentences and under ~700 characters**
   (excluding any suggestion block). Inline comments are read one at a time in a
   narrow column; a long one does not get read, so length actively costs you the

package/plugins/olko-github-pr/skills/lekker-review/references/output-format.md

@@ -23,7 +23,7 @@ Output the review as a markdown response (not via printf). No ANSI escapes.
 **Findings:** <X Critical / Y Important / Z Observations / W Idiomatic>
 **Proofs:** <M proven / N attempted> *(include only when N > 0)*
 **CI:** <✅ All passing | ⚠️ N failing: check-name | ⏳ Pending | N/A>
-**Depth:** <⚡ scan | 🔍 medium | 🔬 deep>
+**Depth:** <📦 deps | ⚡ scan | 🔍 medium | 🔬 deep>
 **Engine:** <workflow | codex | revmux>
 
 ---
@@ -215,7 +215,7 @@ if empty.)*
 ## 💰 Review Cost
 
 ```
-Depth:            <⚡ scan | 🔍 medium | 🔬 deep>
+Depth:            <📦 deps | ⚡ scan | 🔍 medium | 🔬 deep>
 Diff size:        ~<N> lines (~<N> tokens)
 Agents run:       <N total>: <breakdown, e.g. "5 reviewers (sonnet) + 6 verifiers (sonnet) + 2 provers (sonnet) + 1 critic (sonnet)">
 Rule checks:      <N> hard-rule finding(s) validated with rule-specific checks (omit the line when 0)
@@ -228,16 +228,17 @@ Input tokens:     ~<N>  ← estimated: diff tokens × agent passes + context fil
 Cost: ~$<X.XX>  (output actual, input estimated; blended across model tiers below)
 ```
 
-Per-MTok pricing (input/output), verified 2026-07-07 from the claude-api reference; re-check there if models changed. The Claude 5.5 rows and fable-5-1 are not yet on that sheet: they reuse the predecessor-tier rates and must be re-checked:
-- claude-fable-5-1: $10 / $50 (unverified, as claude-fable-5)
-- claude-opus-5-5: $15 / $75 (unverified; copied from the opus-5 rate in pricing.json, not checked)
-- claude-sonnet-5-5: $3 / $15 (unverified)
-- claude-haiku-5-5: $1 / $5 (unverified)
-- claude-fable-5: $10 / $50
-- claude-opus-4-8: $5 / $25
-- claude-sonnet-4-6 / claude-sonnet-5: $3 / $15
+Per-MTok pricing (input/output) - verified 2026-10-15 from the claude-api reference (`shared/models.md`); re-check there if models changed:
+- claude-fable-5-1 / claude-fable-5: $10 / $50
+- claude-opus-5-5: $4 / $20
+- claude-opus-5 / claude-opus-4-8: $5 / $25
+- claude-sonnet-5-5 / claude-sonnet-5: $2 / $10
+- claude-sonnet-4-6: $3 / $15
+- claude-haiku-5-5: $0.10 / $0.50 (prompt <=100K tokens; $0.50 / $2.50 above)
 - claude-haiku-4-5: $1 / $5
 
+The main-loop line uses the session model's rate from this list. When the session model is not listed, say so in the cost block rather than leaving the main loop out silently.
+
 Reviewer agents, verifiers, provers, and the critic all run on sonnet; triage and housekeeping on haiku. Only the main loop (context gathering + this synthesis) runs on the session model: use the session model's actual ID for that tier.
 
 For the Codex engine, use the model and usage metadata actually exposed by the

package/plugins/olko-github-pr/skills/lekker-review/references/pricing.json

@@ -1,13 +1,14 @@
 {
-  "note": "USD per million tokens, keyed by revmux's actual_model. revmux runs `claude --print` under subscription (Max plan) auth, so nothing here is a real API bill; this is an API-list-price ESTIMATE for the cost block only. Where a model exposes separate input/output prices, usd = tokens/1e6 * output price (output-only, not blended), because revmux reports a single combined `tokens` figure per agent with no input/output split to weight a blend. verified:false entries are not confirmed against a current price sheet (no local claude-api pricing doc found on this machine as of 2026-09-09) and must be checked before this cost block is trusted for a real decision. The claude-*-5-5 and claude-fable-5-1 rows carry the prices of their predecessor tier (fable: $10/$50 as listed in output-format.md; opus/sonnet/haiku: the 5-family rates above) until a price sheet confirms the new models.",
-  "claude-fable-5-1": { "input": 10, "output": 50, "blended": 30, "verified": false },
-  "claude-opus-5-5":  { "input": 15,  "output": 75,  "blended": 45,  "verified": false },
-  "claude-sonnet-5-5": { "input": 3,  "output": 15,  "blended": 9,   "verified": false },
-  "claude-haiku-5-5": { "input": 1,  "output": 5,  "blended": 3,   "verified": false },
-  "claude-opus-5":   { "input": 15,  "output": 75,  "blended": 45,  "verified": false },
-  "claude-sonnet-5": { "input": 3,   "output": 15,  "blended": 9,   "verified": false },
-  "claude-haiku-4-5-20251001": { "input": 1, "output": 5, "blended": 3, "verified": false },
-  "opus":   { "input": 15, "output": 75, "blended": 45, "verified": false },
-  "sonnet": { "input": 3,  "output": 15, "blended": 9,  "verified": false },
-  "haiku":  { "input": 1,  "output": 5,  "blended": 3,  "verified": false }
+  "note": "USD per million tokens, keyed by revmux's actual_model. revmux runs `claude --print` under subscription (Max plan) auth, so nothing here is a real API bill; this is an API-list-price ESTIMATE for the cost block only. Where a model exposes separate input/output prices, usd = tokens/1e6 * output price (output-only, not blended), because revmux reports a single combined `tokens` figure per agent with no input/output split to weight a blend. Rates verified 2026-10-15 against the claude-api skill reference (shared/models.md, shared/model-migration.md). Haiku 5.5 has two rate cards; the entry is the <=100K-prompt card. The bare tier aliases (opus/sonnet/haiku) follow the current model of each tier. Re-check there when a model changes.",
+  "claude-fable-5-1": { "input": 10,  "output": 50,  "blended": 30,  "verified": "2026-10-15" },
+  "claude-fable-5":   { "input": 10,  "output": 50,  "blended": 30,  "verified": "2026-10-15" },
+  "claude-opus-5-5":  { "input": 4,   "output": 20,  "blended": 12,  "verified": "2026-10-15" },
+  "claude-opus-5":    { "input": 5,   "output": 25,  "blended": 15,  "verified": "2026-10-15" },
+  "claude-sonnet-5-5": { "input": 2,  "output": 10,  "blended": 6,   "verified": "2026-10-15" },
+  "claude-sonnet-5":  { "input": 2,   "output": 10,  "blended": 6,   "verified": "2026-10-15" },
+  "claude-haiku-5-5": { "input": 0.1, "output": 0.5, "blended": 0.3, "verified": "2026-10-15" },
+  "claude-haiku-4-5-20251001": { "input": 1, "output": 5, "blended": 3, "verified": "2026-10-15" },
+  "opus":   { "input": 4,   "output": 20,  "blended": 12,  "verified": "2026-10-15" },
+  "sonnet": { "input": 2,   "output": 10,  "blended": 6,   "verified": "2026-10-15" },
+  "haiku":  { "input": 0.1, "output": 0.5, "blended": 0.3, "verified": "2026-10-15" }
 }

package/plugins/olko-github-pr/skills/lekker-review/scripts/deps-only.mjs

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+// Decides whether a PR is a pure dependency change: every changed file is a
+// lockfile or a package.json, and each package.json differs only in its
+// dependency keys. Such a PR gets the one-agent `deps` depth; anything else is
+// `mixed` and falls back to the normal depth rules.
+//
+//   node deps-only.mjs <worktreePath> <mergeBase> <changed file>...
+//
+// Prints JSON: { kind: "deps"|"mixed", packageJsons, lockDirs, otherFiles }.
+// Exit 0 in both cases; exit 2 only on bad arguments.
+import { execFileSync } from 'node:child_process'
+import { realpathSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { basename, dirname } from 'node:path'
+
+export const LOCKFILES = new Set([
+  'package-lock.json', 'npm-shrinkwrap.json', 'yarn.lock', 'pnpm-lock.yaml', 'bun.lock', 'bun.lockb',
+])
+// `engines` is here because a dependency bump that needs a newer runtime
+// raises it in the same PR; the deps agent checks it against the runtime image.
+export const DEP_KEYS = new Set([
+  'dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies',
+  'overrides', 'resolutions', 'engines',
+])
+
+function changedKeys(before, after) {
+  const keys = new Set([...Object.keys(before), ...Object.keys(after)])
+  return [...keys].filter(k => JSON.stringify(before[k]) !== JSON.stringify(after[k])).sort()
+}
+
+// readAt(rev, path) returns the file text at that revision, or null when the
+// file does not exist there. Injected so the selftest can drive it with fixtures.
+export function classify(files, readAt, base = 'BASE', head = 'HEAD') {
+  const packageJsons = []
+  const lockDirs = []
+  const otherFiles = []
+  for (const file of files) {
+    const name = basename(file)
+    if (LOCKFILES.has(name)) {
+      lockDirs.push(dirname(file))
+      continue
+    }
+    if (name !== 'package.json') {
+      otherFiles.push(file)
+      continue
+    }
+    let before, after
+    try {
+      const b = readAt(base, file), a = readAt(head, file)
+      if (b == null || a == null) throw new Error('missing on one side')
+      before = JSON.parse(b)
+      after = JSON.parse(a)
+      if (!before || !after || typeof before !== 'object' || typeof after !== 'object') throw new Error('not an object')
+    } catch {
+      // Added, deleted or unparseable: a new or removed workspace is not a bump.
+      packageJsons.push({ file, depKeysChanged: [], otherKeysChanged: ['<added, removed or unparseable>'] })
+      continue
+    }
+    const keys = changedKeys(before, after)
+    packageJsons.push({
+      file,
+      depKeysChanged: keys.filter(k => DEP_KEYS.has(k)),
+      otherKeysChanged: keys.filter(k => !DEP_KEYS.has(k)),
+    })
+  }
+  const pure = otherFiles.length === 0
+    && packageJsons.every(p => p.otherKeysChanged.length === 0)
+    && (lockDirs.length > 0 || packageJsons.length > 0)
+  return { kind: pure ? 'deps' : 'mixed', packageJsons, lockDirs: [...new Set(lockDirs)].sort(), otherFiles }
+}
+
+function gitReader(worktree) {
+  return (rev, path) => {
+    try {
+      return execFileSync('git', ['-C', worktree, 'show', `${rev}:${path}`], {
+        encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024,
+      })
+    } catch {
+      return null
+    }
+  }
+}
+
+function isMain() {
+  try { return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url)) } catch { return false }
+}
+
+if (isMain()) {
+  const [worktree, mergeBase, ...files] = process.argv.slice(2)
+  if (!worktree || !mergeBase || files.length === 0) {
+    console.error('usage: deps-only.mjs <worktreePath> <mergeBase> <changed file>...')
+    process.exit(2)
+  }
+  console.log(JSON.stringify(classify(files, gitReader(worktree), mergeBase, 'HEAD'), null, 2))
+}