@olegkoval/agent-skills 1.62.1 → 1.64.0

package/adapters/claude/olko-github-pr/skills/lekker-review/SKILL.md

@@ -775,7 +775,7 @@ The workflow runs three phases:
   carries `proof: {attempted: false, reason: "no runnable test runner: ..."}`.
 
 Findings have schema:
-`{file, line, severity, title, description, badCode, fix, rule?, precedent?, agreedBy?, verificationStatus?, verifierReasoning?, proof?}`
+`{file, line, severity, title, description, badCode, fix, bugClass, otherInstances, rule?, precedent?, agreedBy?, verificationStatus?, verifierReasoning?, proof?}`
 `badCode` and `fix` are schema-required: an empty string is allowed only on
 `observation` / `idiomatic` findings.
 
@@ -1325,6 +1325,16 @@ is not failure, the review may find things the bots never would. `0 bot
 comment(s)` is ambiguous (nothing found, or the bots have not run yet); never
 turn it into a 100% claim. Store: `~/.cache/lekker-review/bot-precision.jsonl`.
 
+**Eval harness.** `evals/manifest.json` lists PRs with a known outcome (`expect:
+"buggy"` with `knownBug: "file:line description"`, or `"clean"`). Run lekker on
+each, save the `findings` arrays as `{"<repo>#<pr>": [...]}`, then
+`node "${SKILL_ROOT}/scripts/eval-runner.mjs" --manifest "${SKILL_ROOT}/evals/manifest.json" --results <results.json>`
+prints recall on buggy PRs and the false-positive count (critical or important
+findings) on clean ones. The shipped manifest holds two placeholders; choosing
+real PRs is a human job. A hit is location-only (same file, within 10 lines),
+so a nearby finding about a different problem still counts; read recall as an
+upper bound.
+
 If you maintain a persistent notes/memory system across reviews, launch ONE
 background Agent with `model: 'haiku'`, passing the review file path +
 repo-short-name + PR author login, instructed to follow

package/adapters/claude/olko-github-pr/skills/lekker-review/evals/manifest.json

@@ -0,0 +1,16 @@
+{
+  "note": "PLACEHOLDERS ONLY. Replace with real PRs chosen by a human: known-buggy PRs with the bug located, and clean PRs that merged without follow-up fixes.",
+  "prs": [
+    {
+      "repo": "example-org/example-repo",
+      "pr": 1,
+      "expect": "buggy",
+      "knownBug": "src/orders/sync.ts:42 off-by-one drops the last line item"
+    },
+    {
+      "repo": "example-org/example-repo",
+      "pr": 2,
+      "expect": "clean"
+    }
+  ]
+}

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/fixer.md

@@ -74,6 +74,14 @@ outcome; a half-applied fix that breaks callers is the worst outcome.
 
 ---
 
+## Same-class instances
+
+A finding with `instanceOf` is another occurrence of a bug class already
+reported elsewhere. Treat it like any finding: confirm the pattern is really
+there at that spot, apply the same fix adapted to local names and types, and
+skip it (with the reason) when the code differs enough that the fix does not
+carry over. Its `title` is its own join key.
+
 ## Multiple findings in one file
 
 Apply them in file order, top to bottom, re-reading after each edit so later

package/adapters/claude/olko-github-pr/skills/lekker-review/references/artifact-page.md

@@ -18,7 +18,8 @@ without creating a new artifact identity.
 All of the following are already in hand after Step 3 of SKILL.md:
 
 - `findings.json` path (scratchpad) -- each finding carries: `file`, `line`,
-  `severity`, `title`, `description`, `badCode`, `fix`, `rule?`, `precedent?`,
+  `severity`, `title`, `description`, `badCode`, `fix`, `bugClass`,
+  `otherInstances`, `rule?`, `precedent?`,
   `agreedBy?`, `verifierReasoning?`, `proof?` (proof = `{attempted, proven,
   outcome, reason, testCode?, testCommand?, redOutput?}`).
 - The saved review file path: `~/code-reviews/YYYY-MM-DD-pr-N-repo.md`.
@@ -154,7 +155,10 @@ Hard requirements for the HTML page:
 - **Findings**, grouped Critical → Important → Observations → Idiomatic. Each
   finding is an expandable `<details>` block:
   - summary row: severity dot + title + `file:line`
-  - body: description, `badCode` in a `<pre>`, `fix` in a `<pre>`, a small
+  - body: description, `badCode` in a `<pre>`, `fix` in a `<pre>`, a
+    "Bug class: `bugClass`" line followed by "Also at:" and each
+    `otherInstances` entry as a `file:line` chip (omit "Also at:" when the
+    list is empty), a small
     hard-rule chip (e.g. "TS-1 · hard rule") when `rule` is set, `agreedBy`
     chips when 2+ dimensions agreed, `verifierReasoning` as a muted footnote.
 - **Proof block:** when `proof.proven === true`, render a visually distinct

package/adapters/claude/olko-github-pr/skills/lekker-review/references/codex-workflow.md

@@ -43,12 +43,17 @@ path. The file is an object with a required `findings` array. Each finding is:
   "description": "failure mode and reachability",
   "badCode": "verbatim changed code",
   "fix": "minimal correction",
+  "bugClass": "kebab-case-defect-class",
+  "otherInstances": ["other/file.ts:17"],
   "rule": "optional house-rule tag",
   "precedent": "required for idiomatic findings"
 }
 ```
 
 `badCode` and `fix` may be empty only for Observation or Idiomatic findings.
+`bugClass` and `otherInstances` are required: after the first hit, search the
+whole diff for the same pattern and list every other place as a
+repository-relative `file:line` (empty array when there is none).
 Implementation additionally returns `acCoverage`. Test-quality additionally
 returns `coverageVerdict`, `mutationSlip`, and `mockSmells`.
 
@@ -95,6 +100,8 @@ findings before spending verifier agents:
 - candidates must name the same file;
 - their anchor lines must fit within a 30-line total span;
 - normalized title-token Jaccard similarity must be at least 0.4;
+- findings whose `bugClass` values differ never merge; merged findings union
+  their `otherInstances`;
 - keep the highest severity and longest `description`, `badCode`, `fix`, and
   `precedent` values;
 - union contributing dimensions into `agreedBy`;
@@ -202,8 +209,13 @@ to measurements the host actually exposes.
 Follow `references/fix-mode.md` for selection, preconditions, verification,
 commit, landing/push confirmation, and cleanup. Replace only its Workflow call:
 
-1. Group eligible findings by primary file. Resolve cross-file dependencies
-   before spawning; overlapping groups must be combined.
+1. Expand `otherInstances` first, as `fix-workflow.js` does: each entry that is
+   a validated repository-relative path (rules in item 5) naming a file changed
+   in the diff becomes a sibling finding with `instanceOf` set to the source
+   title, unless the same bug class already claims that `file:line`. Drop every
+   other entry and report it. Then group primary and sibling findings by
+   normalized file. Resolve cross-file dependencies before spawning;
+   overlapping groups must be combined.
 2. Spawn one `worker` fixer per disjoint group. Assign exact file ownership and
    state that other agents share the worktree; it must preserve their changes.
    The fixer reads `<SKILL_ROOT>/references/agents/fixer.md`, edits only its

package/adapters/claude/olko-github-pr/skills/lekker-review/references/fix-mode.md

@@ -101,6 +101,13 @@ downgrades a `good` verdict that arrives without verified evidence. Pass the ACs
 even when they look irrelevant to the finding: the finding's own rationale may
 be the thing that contradicts them.
 
+A finding may carry `bugClass` and `otherInstances` (`file:line` list). The
+workflow expands each other instance into a sibling finding (`instanceOf` set)
+in its own file's group, so one pass fixes the whole class. An instance outside
+the diff's changed files, in a generated file (Step 2 rule), or with an absolute
+or `..` path, is dropped. Report siblings in
+the Step 8 table under their own title.
+
 Pass `findings` as a real JSON array, not a stringified one. The workflow groups
 by file (one agent per file, so no two agents ever edit the same file), applies
 the fix, then runs a read-only fix-verifier over the actual `git diff`. A
@@ -115,8 +122,12 @@ the whole turn's pool. Report the former on the `Fix agents:` cost line.
 
 If Claude's Workflow tool is unavailable, fall back to one Agent per file group
 with `<SKILL_ROOT>/references/agents/fixer.md`, then one read-only Agent per
-group with `<SKILL_ROOT>/references/agents/fix-verifier.md`. Same rules, same
-verdict handling. State the fallback in the report.
+group with `<SKILL_ROOT>/references/agents/fix-verifier.md`. Expand
+`otherInstances` into sibling findings before grouping, with the same rules as
+the workflow: only repository-relative paths (no leading `/`, drive letter,
+backslash or `..`) that name a file changed in the diff, normalized so
+`./src/a.ts` and `src/a.ts` form one group. Same rules, same verdict handling.
+State the fallback in the report.
 
 ---
 

package/adapters/claude/olko-github-pr/skills/lekker-review/references/output-format.md

@@ -118,6 +118,8 @@ proof inline.>
 <corrected version: exact drop-in replacement or minimal diff>
 \```
 
+**Bug class:** `<bugClass>` *(always shown)* · **Also at:** `<file:line>`, `<file:line>` *(from `otherInstances`; omit the clause when the list is empty)*
+
 **Proof (ran in the worktree):** *(include only when the finding carries a `proof` with `proven: true`)*
 \```
 <redOutput, verbatim>

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+// Score lekker findings against a manifest of PRs with known outcomes.
+//
+// Usage:
+//   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
+//
+// manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description" }] }
+// results.json:  { "<repo>#<pr>": [ <finding>, ... ] }  the findings of one lekker run per PR
+//                (the `findings` array the workflow returns). A PR missing from results is
+//                reported as unscored, never as zero findings.
+//
+// A buggy PR is HIT when some finding is on the knownBug file within LINE_WINDOW lines
+// of the knownBug line. Known limitation: the match is by location only, so a
+// same-file finding near the line counts even if it describes a different problem;
+// judging "same bug" needs an LLM or a description match and is not attempted. Recall = hits / scored buggy PRs. On a clean PR every
+// verdict-affecting finding (critical or important) is a false positive.
+
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export const LINE_WINDOW = 10;
+const BLOCKING = new Set(['critical', 'important']);
+
+export function parseKnownBug(text) {
+  // The file is everything before the last ":<digits>" that is followed by whitespace
+  // or the end, so paths containing spaces parse.
+  const m = /^(.+):(\d+)(?=\s|$)/.exec(String(text || '').trim());
+  if (!m) return null;
+  const line = Number(m[2]);
+  return line >= 1 ? { file: m[1], line } : null;
+}
+
+export function isHit(findings, knownBug) {
+  const spot = parseKnownBug(knownBug);
+  if (!spot) return false;
+  return findings.some((f) => f.file === spot.file
+    && Number.isInteger(f.line) && f.line > 0
+    && Math.abs(f.line - spot.line) <= LINE_WINDOW);
+}
+
+export function validateManifest(manifest) {
+  const prs = manifest && Array.isArray(manifest.prs) ? manifest.prs : null;
+  if (!prs) throw new Error('manifest needs a "prs" array');
+  const seen = new Set();
+  prs.forEach((e, i) => {
+    if (!e.repo || !Number.isInteger(e.pr)) throw new Error(`prs[${i}]: repo and integer pr are required`);
+    if (e.expect !== 'buggy' && e.expect !== 'clean') throw new Error(`prs[${i}]: expect must be "buggy" or "clean"`);
+    const key = `${e.repo}#${e.pr}`;
+    if (seen.has(key)) throw new Error(`prs[${i}]: duplicate entry ${key}`);
+    seen.add(key);
+    if (e.expect === 'buggy' && !parseKnownBug(e.knownBug)) {
+      throw new Error(`prs[${i}]: a buggy entry needs knownBug starting with "file:line" (line >= 1)`);
+    }
+  });
+  return prs;
+}
+
+export function score(manifest, results) {
+  const rows = validateManifest(manifest).map((e) => {
+    const key = `${e.repo}#${e.pr}`;
+    const findings = results[key];
+    if (!Array.isArray(findings)) return { key, expect: e.expect, scored: false };
+    if (e.expect === 'buggy') return { key, expect: 'buggy', scored: true, hit: isHit(findings, e.knownBug) };
+    return {
+      key, expect: 'clean', scored: true,
+      falsePositives: findings.filter((f) => BLOCKING.has(f.severity)).length,
+    };
+  });
+  const buggy = rows.filter((r) => r.expect === 'buggy' && r.scored);
+  const clean = rows.filter((r) => r.expect === 'clean' && r.scored);
+  return {
+    recall: buggy.length === 0 ? null : buggy.filter((r) => r.hit).length / buggy.length,
+    buggyScored: buggy.length,
+    falsePositives: clean.reduce((n, r) => n + r.falsePositives, 0),
+    cleanScored: clean.length,
+    unscored: rows.filter((r) => !r.scored).map((r) => r.key),
+    rows,
+  };
+}
+
+function main(argv) {
+  const flag = (n) => { const i = argv.indexOf('--' + n); return i === -1 ? null : argv[i + 1]; };
+  if (!flag('manifest') || !flag('results')) {
+    console.error('usage: eval-runner.mjs --manifest <manifest.json> --results <results.json> [--json]');
+    process.exit(2);
+  }
+  const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
+  if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
+  const pct = out.recall === null ? 'n/a' : `${Math.round(out.recall * 100)}%`;
+  console.log(`recall ${pct} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/revmux-adapter.mjs

@@ -97,6 +97,13 @@ function extractRule(title) {
   return m && HARD_RULES.has(m[1]) ? m[1] : undefined
 }
 
+// revmux reports one location per finding and no class, so the class is derived
+// from the rule tag or title and no other instances are claimed.
+function bugClassOf(rule, title) {
+  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
+  return words.slice(0, 6).join('-') || 'unclassified'
+}
+
 function mapSeverity(f) {
   if (f.severity === 'critical') return 'critical'
   if (f.severity === 'major') return 'important'
@@ -131,6 +138,8 @@ for (const f of report.findings || []) {
     description: f.body,
     badCode,
     fix: f.fix,
+    bugClass: bugClassOf(rule, f.title),
+    otherInstances: [],
     confidence: f.confidence,
     rule,
     dimension: f.lenses || [],
@@ -171,6 +180,8 @@ for (const pe of report.pre_existing || []) {
     description: `Pre-existing: ${pe.body}`,
     badCode: extractBadCode(pe.body),
     fix: '',
+    bugClass: bugClassOf(null, pe.title),
+    otherInstances: [],
     dimension: pe.lenses || [],
   })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/SKILL.md

@@ -774,7 +774,7 @@ The workflow runs three phases:
   carries `proof: {attempted: false, reason: "no runnable test runner: ..."}`.
 
 Findings have schema:
-`{file, line, severity, title, description, badCode, fix, rule?, precedent?, agreedBy?, verificationStatus?, verifierReasoning?, proof?}`
+`{file, line, severity, title, description, badCode, fix, bugClass, otherInstances, rule?, precedent?, agreedBy?, verificationStatus?, verifierReasoning?, proof?}`
 `badCode` and `fix` are schema-required: an empty string is allowed only on
 `observation` / `idiomatic` findings.
 
@@ -1324,6 +1324,16 @@ is not failure, the review may find things the bots never would. `0 bot
 comment(s)` is ambiguous (nothing found, or the bots have not run yet); never
 turn it into a 100% claim. Store: `~/.cache/lekker-review/bot-precision.jsonl`.
 
+**Eval harness.** `evals/manifest.json` lists PRs with a known outcome (`expect:
+"buggy"` with `knownBug: "file:line description"`, or `"clean"`). Run lekker on
+each, save the `findings` arrays as `{"<repo>#<pr>": [...]}`, then
+`node "${SKILL_ROOT}/scripts/eval-runner.mjs" --manifest "${SKILL_ROOT}/evals/manifest.json" --results <results.json>`
+prints recall on buggy PRs and the false-positive count (critical or important
+findings) on clean ones. The shipped manifest holds two placeholders; choosing
+real PRs is a human job. A hit is location-only (same file, within 10 lines),
+so a nearby finding about a different problem still counts; read recall as an
+upper bound.
+
 If you maintain a persistent notes/memory system across reviews, launch ONE
 background Agent with `model: 'haiku'`, passing the review file path +
 repo-short-name + PR author login, instructed to follow

package/plugins/olko-github-pr/skills/lekker-review/evals/manifest.json

@@ -0,0 +1,16 @@
+{
+  "note": "PLACEHOLDERS ONLY. Replace with real PRs chosen by a human: known-buggy PRs with the bug located, and clean PRs that merged without follow-up fixes.",
+  "prs": [
+    {
+      "repo": "example-org/example-repo",
+      "pr": 1,
+      "expect": "buggy",
+      "knownBug": "src/orders/sync.ts:42 off-by-one drops the last line item"
+    },
+    {
+      "repo": "example-org/example-repo",
+      "pr": 2,
+      "expect": "clean"
+    }
+  ]
+}

package/plugins/olko-github-pr/skills/lekker-review/fix-workflow.js

@@ -97,19 +97,124 @@ let retryCount = 0
 // same file concurrently.
 // ---------------------------------------------------------------------------
 
-const byFile = new Map()
-for (const f of findings) {
-  if (!byFile.has(f.file)) {
-    byFile.set(f.file, [])
+// Paths come from model output, so they are untrusted. Accept only a lexically
+// normalized repository-relative path; './src/a.ts' and 'src/a.ts' must land in
+// one file group, or two fixers edit the same file concurrently.
+function safeRelativePath(raw) {
+  const text = String(raw == null ? '' : raw)
+  if (!text || /[\\\u0000-\u001f]/.test(text) || text.startsWith('/') || /^[A-Za-z]:/.test(text)) {
+    return null
   }
-  byFile.get(f.file).push(f)
+  const parts = text.split('/').filter(function(part) { return part !== '' && part !== '.' })
+  if (parts.length === 0 || parts.includes('..')) {
+    return null
+  }
+  return parts.join('/')
 }
 
-const groups = Array.from(byFile.entries()).map(function(entry) {
-  return { file: entry[0], findings: entry[1] }
-})
+function changedFilesFromDiff(diffText) {
+  const files = new Set()
+  for (const match of String(diffText || '').matchAll(/^\+\+\+ b\/(.+)$/gm)) {
+    const file = safeRelativePath(match[1])
+    if (file) {
+      files.add(file)
+    }
+  }
+  return files
+}
+
+// A finding names its bug class and the other places the same pattern occurs.
+// Each other instance becomes a sibling finding in ITS file's group, so the whole
+// class is fixed in one pass and the one-agent-per-file rule still holds.
+function parseInstance(ref) {
+  const at = String(ref).lastIndexOf(':')
+  const line = Number(String(ref).slice(at + 1))
+  const file = at > 0 ? safeRelativePath(String(ref).slice(0, at)) : null
+  return file && Number.isInteger(line) && line > 0 ? { file, line } : null
+}
+
+// Step 2 of fix-mode.md skips generated primaries before the workflow runs, but
+// siblings are created here, after that filter, so the same rule applies again.
+function isGeneratedPath(file) {
+  return /(^|\/)generated\//.test(file)
+    || /\.snap$/.test(file)
+    || /(^|\/)(package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?)$/.test(file)
+}
+
+function classKey(f, file, line) {
+  return (f.bugClass || f.title) + '|' + file + ':' + line
+}
+
+// A sibling must point at a file the diff changed: an instance outside the diff
+// would let a fixer edit, and commit, unrelated code.
+function expandInstances(list, changedFiles) {
+  const taken = new Set(list.map(function(f) { return classKey(f, f.file, f.line) }))
+  const siblings = []
+  for (const f of list) {
+    for (const ref of (Array.isArray(f.otherInstances) ? f.otherInstances : [])) {
+      const spot = parseInstance(ref)
+      if (!spot || !changedFiles.has(spot.file) || isGeneratedPath(spot.file) || taken.has(classKey(f, spot.file, spot.line))) {
+        continue
+      }
+      taken.add(classKey(f, spot.file, spot.line))
+      siblings.push(Object.assign({}, f, {
+        file: spot.file,
+        line: spot.line,
+        title: f.title + ' (same bug class at ' + spot.file + ':' + spot.line + ')',
+        description: 'Same bug class' + (f.bugClass ? ' "' + f.bugClass + '"' : '') + ' as '
+          + f.file + ':' + f.line + '. ' + f.description,
+        otherInstances: [],
+        instanceOf: f.title,
+      }))
+    }
+  }
+  return list.concat(siblings)
+}
+
+function groupFindings(list, changedFiles) {
+  const primaries = list
+    .map(function(f) { return Object.assign({}, f, { file: safeRelativePath(f.file) }) })
+    .filter(function(f) { return f.file })
+  const all = expandInstances(primaries, changedFiles)
+  const byFile = new Map()
+  for (const f of all) {
+    if (!byFile.has(f.file)) {
+      byFile.set(f.file, [])
+    }
+    byFile.get(f.file).push(f)
+  }
+  return {
+    all,
+    rejected: list.length - primaries.length,
+    groups: Array.from(byFile.entries()).map(function(entry) {
+      return { file: entry[0], findings: entry[1] }
+    }),
+  }
+}
+
+function readChangedFiles() {
+  if (!diffFile) {
+    return new Set()
+  }
+  try {
+    return changedFilesFromDiff(readFileSync(diffFile, 'utf8'))
+  } catch (_) {
+    return new Set()
+  }
+}
+
+const changedFiles = readChangedFiles()
+if (changedFiles.size === 0) {
+  log('no changed-file list from diffFile; same-class instances are not expanded')
+}
+const grouped = groupFindings(findings, changedFiles)
+const allFindings = grouped.all
+const groups = grouped.groups
+if (grouped.rejected > 0) {
+  log(`rejected ${grouped.rejected} finding(s) with an absolute or traversing file path`)
+}
 
-log(`fixing ${findings.length} finding(s) across ${groups.length} file(s)`)
+log(`fixing ${allFindings.length} finding(s) (${findings.length} reported) across ${groups.length} file(s)`)
 
 // ---------------------------------------------------------------------------
 // Prompts
@@ -330,7 +435,7 @@ const groupsOut = results.filter(Boolean).map(function(state) {
   return {
     file:         state.file,
     findings:     state.findings.map(function(f) {
-      return { title: f.title, line: f.line, severity: f.severity }
+      return { title: f.title, line: f.line, severity: f.severity, instanceOf: f.instanceOf }
     }),
     results:      (state.fixResult && state.fixResult.results) || [],
     filesTouched: (state.fixResult && state.fixResult.filesTouched) || [],

package/plugins/olko-github-pr/skills/lekker-review/references/agents/fixer.md

@@ -74,6 +74,14 @@ outcome; a half-applied fix that breaks callers is the worst outcome.
 
 ---
 
+## Same-class instances
+
+A finding with `instanceOf` is another occurrence of a bug class already
+reported elsewhere. Treat it like any finding: confirm the pattern is really
+there at that spot, apply the same fix adapted to local names and types, and
+skip it (with the reason) when the code differs enough that the fix does not
+carry over. Its `title` is its own join key.
+
 ## Multiple findings in one file
 
 Apply them in file order, top to bottom, re-reading after each edit so later

package/plugins/olko-github-pr/skills/lekker-review/references/artifact-page.md

@@ -18,7 +18,8 @@ without creating a new artifact identity.
 All of the following are already in hand after Step 3 of SKILL.md:
 
 - `findings.json` path (scratchpad) -- each finding carries: `file`, `line`,
-  `severity`, `title`, `description`, `badCode`, `fix`, `rule?`, `precedent?`,
+  `severity`, `title`, `description`, `badCode`, `fix`, `bugClass`,
+  `otherInstances`, `rule?`, `precedent?`,
   `agreedBy?`, `verifierReasoning?`, `proof?` (proof = `{attempted, proven,
   outcome, reason, testCode?, testCommand?, redOutput?}`).
 - The saved review file path: `~/code-reviews/YYYY-MM-DD-pr-N-repo.md`.
@@ -154,7 +155,10 @@ Hard requirements for the HTML page:
 - **Findings**, grouped Critical → Important → Observations → Idiomatic. Each
   finding is an expandable `<details>` block:
   - summary row: severity dot + title + `file:line`
-  - body: description, `badCode` in a `<pre>`, `fix` in a `<pre>`, a small
+  - body: description, `badCode` in a `<pre>`, `fix` in a `<pre>`, a
+    "Bug class: `bugClass`" line followed by "Also at:" and each
+    `otherInstances` entry as a `file:line` chip (omit "Also at:" when the
+    list is empty), a small
     hard-rule chip (e.g. "TS-1 · hard rule") when `rule` is set, `agreedBy`
     chips when 2+ dimensions agreed, `verifierReasoning` as a muted footnote.
 - **Proof block:** when `proof.proven === true`, render a visually distinct

package/plugins/olko-github-pr/skills/lekker-review/references/codex-workflow.md

@@ -43,12 +43,17 @@ path. The file is an object with a required `findings` array. Each finding is:
   "description": "failure mode and reachability",
   "badCode": "verbatim changed code",
   "fix": "minimal correction",
+  "bugClass": "kebab-case-defect-class",
+  "otherInstances": ["other/file.ts:17"],
   "rule": "optional house-rule tag",
   "precedent": "required for idiomatic findings"
 }
 ```
 
 `badCode` and `fix` may be empty only for Observation or Idiomatic findings.
+`bugClass` and `otherInstances` are required: after the first hit, search the
+whole diff for the same pattern and list every other place as a
+repository-relative `file:line` (empty array when there is none).
 Implementation additionally returns `acCoverage`. Test-quality additionally
 returns `coverageVerdict`, `mutationSlip`, and `mockSmells`.
 
@@ -95,6 +100,8 @@ findings before spending verifier agents:
 - candidates must name the same file;
 - their anchor lines must fit within a 30-line total span;
 - normalized title-token Jaccard similarity must be at least 0.4;
+- findings whose `bugClass` values differ never merge; merged findings union
+  their `otherInstances`;
 - keep the highest severity and longest `description`, `badCode`, `fix`, and
   `precedent` values;
 - union contributing dimensions into `agreedBy`;
@@ -202,8 +209,13 @@ to measurements the host actually exposes.
 Follow `references/fix-mode.md` for selection, preconditions, verification,
 commit, landing/push confirmation, and cleanup. Replace only its Workflow call:
 
-1. Group eligible findings by primary file. Resolve cross-file dependencies
-   before spawning; overlapping groups must be combined.
+1. Expand `otherInstances` first, as `fix-workflow.js` does: each entry that is
+   a validated repository-relative path (rules in item 5) naming a file changed
+   in the diff becomes a sibling finding with `instanceOf` set to the source
+   title, unless the same bug class already claims that `file:line`. Drop every
+   other entry and report it. Then group primary and sibling findings by
+   normalized file. Resolve cross-file dependencies before spawning;
+   overlapping groups must be combined.
 2. Spawn one `worker` fixer per disjoint group. Assign exact file ownership and
    state that other agents share the worktree; it must preserve their changes.
    The fixer reads `<SKILL_ROOT>/references/agents/fixer.md`, edits only its

package/plugins/olko-github-pr/skills/lekker-review/references/fix-mode.md

@@ -101,6 +101,13 @@ downgrades a `good` verdict that arrives without verified evidence. Pass the ACs
 even when they look irrelevant to the finding: the finding's own rationale may
 be the thing that contradicts them.
 
+A finding may carry `bugClass` and `otherInstances` (`file:line` list). The
+workflow expands each other instance into a sibling finding (`instanceOf` set)
+in its own file's group, so one pass fixes the whole class. An instance outside
+the diff's changed files, in a generated file (Step 2 rule), or with an absolute
+or `..` path, is dropped. Report siblings in
+the Step 8 table under their own title.
+
 Pass `findings` as a real JSON array, not a stringified one. The workflow groups
 by file (one agent per file, so no two agents ever edit the same file), applies
 the fix, then runs a read-only fix-verifier over the actual `git diff`. A
@@ -115,8 +122,12 @@ the whole turn's pool. Report the former on the `Fix agents:` cost line.
 
 If Claude's Workflow tool is unavailable, fall back to one Agent per file group
 with `<SKILL_ROOT>/references/agents/fixer.md`, then one read-only Agent per
-group with `<SKILL_ROOT>/references/agents/fix-verifier.md`. Same rules, same
-verdict handling. State the fallback in the report.
+group with `<SKILL_ROOT>/references/agents/fix-verifier.md`. Expand
+`otherInstances` into sibling findings before grouping, with the same rules as
+the workflow: only repository-relative paths (no leading `/`, drive letter,
+backslash or `..`) that name a file changed in the diff, normalized so
+`./src/a.ts` and `src/a.ts` form one group. Same rules, same verdict handling.
+State the fallback in the report.
 
 ---
 

package/plugins/olko-github-pr/skills/lekker-review/references/output-format.md

@@ -118,6 +118,8 @@ proof inline.>
 <corrected version: exact drop-in replacement or minimal diff>
 \```
 
+**Bug class:** `<bugClass>` *(always shown)* · **Also at:** `<file:line>`, `<file:line>` *(from `otherInstances`; omit the clause when the list is empty)*
+
 **Proof (ran in the worktree):** *(include only when the finding carries a `proof` with `proven: true`)*
 \```
 <redOutput, verbatim>

package/plugins/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+// Score lekker findings against a manifest of PRs with known outcomes.
+//
+// Usage:
+//   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
+//
+// manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description" }] }
+// results.json:  { "<repo>#<pr>": [ <finding>, ... ] }  the findings of one lekker run per PR
+//                (the `findings` array the workflow returns). A PR missing from results is
+//                reported as unscored, never as zero findings.
+//
+// A buggy PR is HIT when some finding is on the knownBug file within LINE_WINDOW lines
+// of the knownBug line. Known limitation: the match is by location only, so a
+// same-file finding near the line counts even if it describes a different problem;
+// judging "same bug" needs an LLM or a description match and is not attempted. Recall = hits / scored buggy PRs. On a clean PR every
+// verdict-affecting finding (critical or important) is a false positive.
+
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export const LINE_WINDOW = 10;
+const BLOCKING = new Set(['critical', 'important']);
+
+export function parseKnownBug(text) {
+  // The file is everything before the last ":<digits>" that is followed by whitespace
+  // or the end, so paths containing spaces parse.
+  const m = /^(.+):(\d+)(?=\s|$)/.exec(String(text || '').trim());
+  if (!m) return null;
+  const line = Number(m[2]);
+  return line >= 1 ? { file: m[1], line } : null;
+}
+
+export function isHit(findings, knownBug) {
+  const spot = parseKnownBug(knownBug);
+  if (!spot) return false;
+  return findings.some((f) => f.file === spot.file
+    && Number.isInteger(f.line) && f.line > 0
+    && Math.abs(f.line - spot.line) <= LINE_WINDOW);
+}
+
+export function validateManifest(manifest) {
+  const prs = manifest && Array.isArray(manifest.prs) ? manifest.prs : null;
+  if (!prs) throw new Error('manifest needs a "prs" array');
+  const seen = new Set();
+  prs.forEach((e, i) => {
+    if (!e.repo || !Number.isInteger(e.pr)) throw new Error(`prs[${i}]: repo and integer pr are required`);
+    if (e.expect !== 'buggy' && e.expect !== 'clean') throw new Error(`prs[${i}]: expect must be "buggy" or "clean"`);
+    const key = `${e.repo}#${e.pr}`;
+    if (seen.has(key)) throw new Error(`prs[${i}]: duplicate entry ${key}`);
+    seen.add(key);
+    if (e.expect === 'buggy' && !parseKnownBug(e.knownBug)) {
+      throw new Error(`prs[${i}]: a buggy entry needs knownBug starting with "file:line" (line >= 1)`);
+    }
+  });
+  return prs;
+}
+
+export function score(manifest, results) {
+  const rows = validateManifest(manifest).map((e) => {
+    const key = `${e.repo}#${e.pr}`;
+    const findings = results[key];
+    if (!Array.isArray(findings)) return { key, expect: e.expect, scored: false };
+    if (e.expect === 'buggy') return { key, expect: 'buggy', scored: true, hit: isHit(findings, e.knownBug) };
+    return {
+      key, expect: 'clean', scored: true,
+      falsePositives: findings.filter((f) => BLOCKING.has(f.severity)).length,
+    };
+  });
+  const buggy = rows.filter((r) => r.expect === 'buggy' && r.scored);
+  const clean = rows.filter((r) => r.expect === 'clean' && r.scored);
+  return {
+    recall: buggy.length === 0 ? null : buggy.filter((r) => r.hit).length / buggy.length,
+    buggyScored: buggy.length,
+    falsePositives: clean.reduce((n, r) => n + r.falsePositives, 0),
+    cleanScored: clean.length,
+    unscored: rows.filter((r) => !r.scored).map((r) => r.key),
+    rows,
+  };
+}
+
+function main(argv) {
+  const flag = (n) => { const i = argv.indexOf('--' + n); return i === -1 ? null : argv[i + 1]; };
+  if (!flag('manifest') || !flag('results')) {
+    console.error('usage: eval-runner.mjs --manifest <manifest.json> --results <results.json> [--json]');
+    process.exit(2);
+  }
+  const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
+  if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
+  const pct = out.recall === null ? 'n/a' : `${Math.round(out.recall * 100)}%`;
+  console.log(`recall ${pct} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-github-pr/skills/lekker-review/scripts/revmux-adapter.mjs

@@ -97,6 +97,13 @@ function extractRule(title) {
   return m && HARD_RULES.has(m[1]) ? m[1] : undefined
 }
 
+// revmux reports one location per finding and no class, so the class is derived
+// from the rule tag or title and no other instances are claimed.
+function bugClassOf(rule, title) {
+  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
+  return words.slice(0, 6).join('-') || 'unclassified'
+}
+
 function mapSeverity(f) {
   if (f.severity === 'critical') return 'critical'
   if (f.severity === 'major') return 'important'
@@ -131,6 +138,8 @@ for (const f of report.findings || []) {
     description: f.body,
     badCode,
     fix: f.fix,
+    bugClass: bugClassOf(rule, f.title),
+    otherInstances: [],
     confidence: f.confidence,
     rule,
     dimension: f.lenses || [],
@@ -171,6 +180,8 @@ for (const pe of report.pre_existing || []) {
     description: `Pre-existing: ${pe.body}`,
     badCode: extractBadCode(pe.body),
     fix: '',
+    bugClass: bugClassOf(null, pe.title),
+    otherInstances: [],
     dimension: pe.lenses || [],
   })
 }

package/plugins/olko-github-pr/skills/lekker-review/workflow.js

@@ -23,11 +23,13 @@ const BOUNDARY_SCHEMA = {
   },
 }
 
+const INSTANCE_PATTERN_SOURCE = '^(?!/)(?!.*\\\\)(?![A-Za-z]:)(?!(?:.*/)?\\.\\.(?:/|:)).+:[1-9][0-9]*$'
+
 const FINDINGS_ARRAY_SCHEMA = {
   type: 'array',
   items: {
     type: 'object',
-    required: ['file', 'line', 'severity', 'title', 'description', 'badCode', 'fix'],
+    required: ['file', 'line', 'severity', 'title', 'description', 'badCode', 'fix', 'bugClass', 'otherInstances'],
     anyOf: [
       { properties: { severity: { enum: ['observation', 'idiomatic'] } } },
       { required: ['boundary'] },
@@ -43,6 +45,11 @@ const FINDINGS_ARRAY_SCHEMA = {
       precedent:   { type: 'string' },
       rule:        { type: 'string', minLength: 1, pattern: '\\S' },
       boundary:    BOUNDARY_SCHEMA,
+      // Short kebab-case slug naming the class of bug ("missing-null-check").
+      bugClass:    { type: 'string', minLength: 1, pattern: '^[a-z0-9]+(-[a-z0-9]+)*$' },
+      // Other places in the diff with the same pattern, as "file:line".
+      // Repository-relative only: no leading slash, drive letter or '..' segment.
+      otherInstances: { type: 'array', items: { type: 'string', pattern: INSTANCE_PATTERN_SOURCE } },
     },
   },
 }
@@ -155,6 +162,10 @@ function titleTokens(title) {
 }
 
 function sameIssue(a, b) {
+  // Merging two classes would send one class's instances to the other's fix.
+  if (a.bugClass && b.bugClass && a.bugClass !== b.bugClass) {
+    return false
+  }
   const ta = titleTokens(a.title)
   const tb = titleTokens(b.title)
   if (ta.length === 0 || tb.length === 0) {
@@ -166,6 +177,29 @@ function sameIssue(a, b) {
   return (shared / union) >= 0.4
 }
 
+const BUG_CLASS_INSTRUCTION = `BUG CLASS: give every finding a "bugClass" (short kebab-case slug for the`
+  + ` kind of defect, e.g. missing-null-check) and "otherInstances": after the first`
+  + ` hit, search the whole diff for the same pattern and list every other place as`
+  + ` "file:line" (empty array when there is none). Report the class, not just the first hit.`
+
+const BUG_CLASS_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/
+const INSTANCE_PATTERN = new RegExp(INSTANCE_PATTERN_SOURCE)
+
+function slugify(text) {
+  const words = String(text || '').toLowerCase().match(/[a-z0-9]+/g) || []
+  return words.slice(0, 6).join('-') || 'unclassified'
+}
+
+// Adapter findings skip the review schema, so the class fields are filled here:
+// fix mode and every renderer rely on them being present and well-formed.
+function withClassFields(f) {
+  return Object.assign({}, f, {
+    bugClass: BUG_CLASS_PATTERN.test(String(f.bugClass || '')) ? f.bugClass : slugify(f.rule || f.title),
+    otherInstances: (Array.isArray(f.otherInstances) ? f.otherInstances : [])
+      .filter(function(ref) { return typeof ref === 'string' && INSTANCE_PATTERN.test(ref) }),
+  })
+}
+
 function longest(a, b) {
   const sa = a || ''
   const sb = b || ''
@@ -195,6 +229,8 @@ function mergeFindings(a, b) {
   merged.badCode = longest(a.badCode, b.badCode)
   merged.fix = longest(a.fix, b.fix)
   merged.precedent = longest(a.precedent, b.precedent)
+  merged.bugClass = a.bugClass || b.bugClass
+  merged.otherInstances = Array.from(new Set((a.otherInstances || []).concat(b.otherInstances || [])))
 
   if (!merged.rule && b.rule) {
     merged.rule = b.rule
@@ -558,6 +594,8 @@ const budgetAtStart = budget.spent()
         + ` number of DIFF_FILE itself. Quote the code at that line verbatim in "badCode".`,
     ].join(' ')
 
+    prompt += ' ' + BUG_CLASS_INSTRUCTION
+
     // The deterministic lint pre-flight has already collected every rule the
     // repo's own eslint config fires on this diff, and those are exactly the
     // comments the bot reviewers bill for. An agent re-reporting them costs a
@@ -748,9 +786,7 @@ const budgetAtStart = budget.spent()
 
   if (ENGINE === 'revmux') {
     const adapterOutput = JSON.parse(readFileSync(findingsFile, 'utf8'))
-    finalFindings = (adapterOutput.findings || []).map(function(f) {
-      return Object.assign({}, f)
-    })
+    finalFindings = (adapterOutput.findings || []).map(withClassFields)
     droppedCount = adapterOutput.droppedCount || 0
     hardRuleCount = adapterOutput.hardRuleCount || 0
     agentCount = adapterOutput.agentCount || 0
@@ -847,6 +883,7 @@ const budgetAtStart = budget.spent()
               `Reason for re-examination: ${angle.reason}.`,
               `Apply the same diff-anchor and verification rules from ${promptDir}/verifier.md.`,
               `Return zero or one finding using DIFF_FILE=${diffFile} and WORKTREE_PATH=${wtDisplay}.`,
+              BUG_CLASS_INSTRUCTION,
             ].join(' '),
             {
               label:  `critic-reexamine:${angle.file}:${angle.line}`,

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.62.1",
+  "version": "1.64.0",
   "author": {
     "name": "Oleg Koval"
   },

package/scripts/build-adapters.sh

@@ -28,7 +28,7 @@ const writeJson = (p, value) => {
   writeFileSync(p, JSON.stringify(value, null, 2) + '\n')
 }
 const copyResources = (skill, destDir) => {
-  for (const d of ['scripts', 'references', 'templates']) {
+  for (const d of ['scripts', 'references', 'templates', 'evals']) {
     const src = join(root, skill.path, d)
     if (!existsSync(src)) continue
     const dest = join(destDir, d)