@pharaoh-so/mcp 0.3.45 → 0.3.46

package/commands/review.md

@@ -33,12 +33,13 @@ Before merging any branch. Before opening any PR. When reviewing changes that to
    [ -n "$TARGET" ] || for b in origin/main origin/master main master; do
      git rev-parse -q --verify "$b" >/dev/null && TARGET=$b && break
    done
-   git merge-base HEAD "$TARGET"                                                       # prints the base commit: $BASE below
+   BASE=$(git merge-base HEAD "$TARGET") && echo "base: $BASE"
    ```
-   If no base comes out, stop and ask which branch this merges into. An empty base makes every diff below come out empty, and the review would report no changes.
+   If no base comes out, stop and ask which branch this merges into. An empty base makes every diff below come out empty, and the review would report no changes. If your shell doesn't keep variables between commands, set `BASE` to the printed commit at the start of each one.
 
 3. Collect the full changeset from the base:
    ```bash
+   : "${BASE:?no base: ask which branch this merges into}"   # stops here rather than diff HEAD against itself
    git diff --name-only "$BASE"...HEAD   # all changed files
    git diff --stat "$BASE"...HEAD        # summary stats
    git log --oneline "$BASE"..HEAD       # all commits on this branch
@@ -256,7 +257,7 @@ If none of these triggers are met, **skip Phase 3** and proceed to Phase 4.
 ### Auto-block triggers (any of these = BLOCK)
 
 - Any CRITICAL security finding (injection, broken access control, tenant isolation violation, secret exposure)
-- Unreachable exports in an application (new public code that nothing calls). In a library, exports are the public API: check each new one is documented or tested instead. Without reachability data (no Pharaoh, no PR Guard), raise it under SHIP WITH CHANGES, not BLOCK
+- Unreachable exports in an application (new public code that nothing calls). In a library, exports are the public API: check each new one is documented or tested instead. Without graph reachability data, a search can't prove nothing calls it: raise it under SHIP WITH CHANGES, not BLOCK
 - New circular dependencies between modules
 - HIGH regression risk without corresponding test coverage
 - **A MUST-bullet in `docs/VISION.md` is violated by this change** (without VISION.md being updated in the same PR with user approval)
@@ -275,7 +276,7 @@ If none of these triggers are met, **skip Phase 3** and proceed to Phase 4.
 ### SHIP triggers
 
 - No CRITICAL or confirmed IMPORTANT findings
-- All new exports are reachable (applications) or documented and tested (libraries)
+- All new exports are reachable (applications) or documented or tested (libraries)
 - Regression risk is LOW or MEDIUM with adequate test coverage
 - Spec alignment is clean or intentionally divergent with documentation
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pharaoh-so/mcp",
   "mcpName": "so.pharaoh/pharaoh",
-  "version": "0.3.45",
+  "version": "0.3.46",
   "description": "MCP proxy for Pharaoh — maps codebases into queryable knowledge graphs for AI agents. Enables Claude Code in headless environments (VPS, SSH, CI) via device flow auth.",
   "type": "module",
   "main": "dist/index.js",

package/skills/review/SKILL.md

@@ -2,7 +2,7 @@
 name: review
 prompt-name: review-with-pharaoh
 description: "The definitive code review, for any codebase. Five-phase workflow: git context detection (worktree, branch, base, changed files), Pharaoh recon (architecture map, module context, blast radius in one call, with a fallback when the repo isn't mapped), parallel specialized agent dispatch (code quality, security against the project's own rules, error handling, test coverage, type design), adversarial review for security-sensitive changes, and a final synthesized verdict of SHIP / SHIP WITH CHANGES / BLOCK. Architecture-aware wherever Pharaoh maps the repo, always branch-aware."
-version: 0.4.1
+version: 0.4.2
 homepage: https://pharaoh.so
 user-invocable: true
 metadata: {"emoji": "☥", "tags": ["code-review", "pull-request", "architecture", "pharaoh", "multi-agent", "adversarial-review", "regression-risk", "spec-alignment"]}
@@ -39,12 +39,13 @@ Before merging any branch. Before opening any PR. When reviewing changes that to
    [ -n "$TARGET" ] || for b in origin/main origin/master main master; do
      git rev-parse -q --verify "$b" >/dev/null && TARGET=$b && break
    done
-   git merge-base HEAD "$TARGET"                                                       # prints the base commit: $BASE below
+   BASE=$(git merge-base HEAD "$TARGET") && echo "base: $BASE"
    ```
-   If no base comes out, stop and ask which branch this merges into. An empty base makes every diff below come out empty, and the review would report no changes.
+   If no base comes out, stop and ask which branch this merges into. An empty base makes every diff below come out empty, and the review would report no changes. If your shell doesn't keep variables between commands, set `BASE` to the printed commit at the start of each one.
 
 3. Collect the full changeset from the base:
    ```bash
+   : "${BASE:?no base: ask which branch this merges into}"   # stops here rather than diff HEAD against itself
    git diff --name-only "$BASE"...HEAD   # all changed files
    git diff --stat "$BASE"...HEAD        # summary stats
    git log --oneline "$BASE"..HEAD       # all commits on this branch
@@ -262,7 +263,7 @@ If none of these triggers are met, **skip Phase 3** and proceed to Phase 4.
 ### Auto-block triggers (any of these = BLOCK)
 
 - Any CRITICAL security finding (injection, broken access control, tenant isolation violation, secret exposure)
-- Unreachable exports in an application (new public code that nothing calls). In a library, exports are the public API: check each new one is documented or tested instead. Without reachability data (no Pharaoh, no PR Guard), raise it under SHIP WITH CHANGES, not BLOCK
+- Unreachable exports in an application (new public code that nothing calls). In a library, exports are the public API: check each new one is documented or tested instead. Without graph reachability data, a search can't prove nothing calls it: raise it under SHIP WITH CHANGES, not BLOCK
 - New circular dependencies between modules
 - HIGH regression risk without corresponding test coverage
 - **A MUST-bullet in `docs/VISION.md` is violated by this change** (without VISION.md being updated in the same PR with user approval)
@@ -281,7 +282,7 @@ If none of these triggers are met, **skip Phase 3** and proceed to Phase 4.
 ### SHIP triggers
 
 - No CRITICAL or confirmed IMPORTANT findings
-- All new exports are reachable (applications) or documented and tested (libraries)
+- All new exports are reachable (applications) or documented or tested (libraries)
 - Regression risk is LOW or MEDIUM with adequate test coverage
 - Spec alignment is clean or intentionally divergent with documentation