@prismer/runtime 2.2.55 → 2.2.63

package/built-in-skills/prismer-gif-search/scripts/tenor.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Bounded Tenor search/download; credential stays out of command arguments."""
+import argparse
+import json
+import os
+from pathlib import Path
+import struct
+import sys
+from urllib.parse import urlencode, urlparse
+from urllib.request import Request, build_opener, HTTPRedirectHandler
+
+MAX_GIF = 20 * 1024 * 1024
+
+
+def validate_media_url(url):
+    parsed = urlparse(url)
+    if parsed.scheme != 'https' or parsed.hostname not in ('media.tenor.com', 'c.tenor.com') or parsed.username or parsed.password or parsed.port not in (None, 443):
+        raise ValueError('Untrusted media URL')
+    return url
+
+
+def validate_gif(data):
+    if len(data) < 14 or data[:6] not in (b'GIF87a', b'GIF89a') or data[-1:] != b';':
+        raise ValueError('Invalid GIF payload')
+    width, height = struct.unpack('<HH', data[6:10])
+    if not width or not height or width * height > 40_000_000:
+        raise ValueError('GIF dimensions exceed limit')
+    return data
+
+
+class NoRedirect(HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise ValueError('Redirects are not accepted')
+
+
+def fetch(url, limit, mime):
+    # Do not include exception URLs in errors: search URLs contain the API key.
+    try:
+        with build_opener(NoRedirect()).open(Request(url, headers={'Accept': mime}), timeout=20) as response:
+            if response.status != 200 or response.headers.get_content_type() != mime:
+                raise ValueError('Unexpected HTTP response or MIME')
+            payload = response.read(limit + 1)
+            if len(payload) > limit:
+                raise ValueError('Response exceeds size limit')
+            return payload
+    except Exception:
+        raise ValueError('Tenor request failed (HTTP, MIME, timeout or size limit); credential redacted') from None
+
+
+def search(query, limit=5):
+    key = os.environ.get('TENOR_API_KEY')
+    if not key:
+        raise ValueError('TENOR_API_KEY is required')
+    if not query.strip() or len(query) > 1000 or not 1 <= limit <= 50:
+        raise ValueError('Invalid query or limit')
+    params = urlencode({'q': query, 'limit': limit, 'key': key, 'media_filter': 'gif,tinygif', 'contentfilter': 'high'})
+    data = json.loads(fetch('https://tenor.googleapis.com/v2/search?' + params, 2 * 1024 * 1024, 'application/json'))
+    if not isinstance(data, dict) or not isinstance(data.get('results'), list):
+        raise ValueError('Malformed Tenor result')
+    return data['results']
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('query')
+    parser.add_argument('--limit', type=int, default=5)
+    parser.add_argument('--output', help='Download first GIF to a new task-owned file')
+    args = parser.parse_args()
+    try:
+        results = search(args.query, args.limit)
+        if args.output:
+            if not results:
+                raise ValueError('No results; no file written')
+            url = validate_media_url(results[0]['media_formats']['gif']['url'])
+            payload = validate_gif(fetch(url, MAX_GIF, 'image/gif'))
+            with Path(args.output).open('xb') as target:
+                target.write(payload)
+        print(json.dumps(results, ensure_ascii=False))
+    except Exception:
+        print('GIF search/download failed; check configuration, response and new output path. No credentials logged.', file=sys.stderr)
+        sys.exit(1)

package/built-in-skills/prismer-github/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Nous Research
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/built-in-skills/prismer-github/NOTICE.md

@@ -0,0 +1,17 @@
+# Resource provenance
+
+## Engineering adaptation (2026-09-23)
+
+Source: https://github.com/NousResearch/hermes-agent/tree/1a1f4a59e252e1dc0137e7b2e7bcc8b0381d19c4/skills/software-development/github
+
+Upstream authors: Ben Barclay (benbarclay), Hermes Agent.
+Hermes MIT copyright (c) 2025 Nous Research is preserved in LICENSE.
+All bundled references/templates/scripts remain covered by that notice unless
+an additional license is explicitly supplied. External CLI binaries, services,
+accounts and downloaded assets are not redistributed by this skill and retain
+their own terms. No API keys or third-party runtime packages are bundled.
+
+Prismer modifications: unique discovery/ownership mapping where applicable,
+resource-path and authorization corrections, bounded helpers, honest readiness
+and verification states. See docs/bugfix223/implementation-engineering.md in the
+source repository for resource mapping, tests and remaining live acceptance.

package/built-in-skills/prismer-github/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: prismer-github
+scope: coding
+description: "GitHub via gh CLI: PRs, issues, reviews, repos, auth."
+version: 2.0.0
+author: Ben Barclay (benbarclay), Hermes Agent
+license: MIT
+platforms: [ linux, macos, windows ]
+metadata:
+  nativeReplaces: [ github ]
+  hermes:
+    tags: [ github, gh, git, pull-requests, issues, code-review, repos, auth, ci ]
+    category: software-development
+    related_skills: [ codebase-inspection, requesting-code-review ]
+  requiresExplicitGrant: true
+---
+
+## Prismer execution contract
+
+This is the uniquely named `prismer-github` skill, adapted from Hermes.
+Use the actual tools exposed by the executing host; examples using terminal,
+process, delegate_task, vision_analyze or browser_* are not tool registrations.
+Missing dependencies do not hide this skill. Report command startup, version,
+account/permissions and task-specific live verification separately. Use task-owned
+artifact paths and existing user authorization; do not change shared accounts,
+Runtime/provider configuration, global security settings or unrelated work.
+See NOTICE.md and LICENSE for resource provenance. Runtime availability and
+upstream-entry suppression are owned by the integration layer.
+
+
+# GitHub
+
+Work GitHub end to end with the `gh` CLI (REST fallback where noted): auth,
+issues, the PR lifecycle, issue-to-PR delivery, code review, and repo
+management. This skill consolidates six former skills; each workflow lives
+complete in its reference file — ALWAYS read the matching reference before
+starting that workflow, the body below only routes.
+
+## Routing
+
+| Task | Read first |
+|---|---|
+| Auth broken / new machine / token or SSH setup / gh login | `references/auth.md` |
+| Create, triage, label, assign, close issues | `references/issues.md` |
+| Branch, commit, open PR, watch CI, merge | `references/pr-workflow.md` |
+| Carry an ISSUE to a verified PR (full delivery loop) | `references/issue-to-pr.md` |
+| Review someone's PR: diffs, inline comments, verdict | `references/code-review.md` |
+| Clone/create/fork repos, remotes, releases | `references/repo-management.md` |
+
+Supporting assets: `scripts/gh-env.sh` + `scripts/git-credential-token.py`
+(auth helpers), `templates/` (PR bodies, bug report, feature request),
+`references/ci-troubleshooting.md`, `references/conventional-commits.md`,
+`references/github-api-cheatsheet.md`, `references/review-output-template.md`.
+
+## Core discipline (applies to every workflow)
+
+- Before use, resolve SKILL_ROOT to this installed directory and run
+  `python3 "$SKILL_ROOT/scripts/ensure-gh.py"`. Missing gh is automatically installed
+  within existing host permissions, then version and auth are checked separately.
+  Read `references/auth.md` for account and target repository permission gates.
+- Prefer `gh` over raw REST; drop to `gh api` only for endpoints the
+  porcelain lacks (the cheatsheet lists them).
+- Never report CI green without checking `gh pr checks` yourself; never
+  claim merged without verifying `state,mergedAt`.
+- Read full context before writing: `gh issue view --comments` /
+  `gh pr view --comments` — decisions live in threads, not titles.
+- Sweep for duplicates before creating anything:
+  `gh pr list --search` / `gh issue list --search`.
+
+## Verification
+
+- The workflow's own reference file defines done for that task.
+- Cross-cutting: every claim about remote state (CI, merge, release,
+  issue state) is backed by a fresh `gh` read, never memory.

package/built-in-skills/prismer-github/references/auth.md

@@ -0,0 +1,91 @@
+# GitHub Installation and Authentication
+
+Installation, authentication and repository authorization are three separate gates.
+The skill stays discoverable when gh is absent. Never ask users to manually install
+an ordinary missing tool when the host can install it within its existing permissions.
+
+## 1. Tool readiness
+
+Resolve SKILL_ROOT to this installed skill's absolute directory, not the repository cwd.
+Run `python3 "$SKILL_ROOT/scripts/ensure-gh.py"`. It checks an existing gh first,
+installs only if missing, verifies `gh --version`, then independently checks
+`gh auth status --hostname github.com`. Python 3.10+ is required for these helpers.
+
+Host choices: existing Homebrew on macOS/Linux, winget on Windows, otherwise official
+checksummed release binary on Linux/macOS into ~/.local/bin. No sudo, global account
+changes, shell startup edits or account login. Use the returned executable path
+when ~/.local/bin is not on PATH. Do not reinstall an existing but broken command
+silently. Install failures/offline/unsupported architectures are explicit blockers,
+not authentication failures. A git/curl fallback remains usable with suitable credentials.
+
+Official installation sources (verified 2026-09-23):
+- https://cli.github.com/
+- https://github.com/cli/cli/blob/trunk/docs/install_linux.md
+- https://github.com/cli/cli/releases
+
+`--check-only` disables installation. It still performs read-only auth checking
+when gh exists; this is not an offline-only mode.
+
+## 2. Independent identity and auth
+
+Use already-injected GH_TOKEN/GITHUB_TOKEN for github.com or the host-specific
+credential mechanism supplied by Runtime. Do not inspect another user's .env,
+auth.json or credential-store automatically. Do not print tokens, put them in
+remote URLs, write hosts.yml, change global git helpers or run setup-git.
+
+If authentication is missing, state that installation succeeded but authentication
+did not. For an explicitly authorized account-linking task, use the official
+`gh auth login --hostname HOST --web` device flow with the intended account.
+The user completes the browser step; never type approval blindly. In headless
+Runtime tasks request secure credential injection from the owner instead.
+Do not implement ad-hoc OAuth polling or plaintext keyring fallbacks.
+
+Prefer repository-scoped fine-grained tokens with the minimum permissions needed
+for the requested operation and an expiry. Classic repo/workflow scopes are broad;
+do not request them unless the actual API requires them.
+
+## 3. Target repository permission
+
+Verify the exact host and owner/repo. `gh api --hostname HOST user --jq .login`
+identifies the account; `gh repo view OWNER/REPO --json viewerPermission` checks
+the target repository. READ is not permission to push, merge, manage secrets or
+delete. API permission, org SSO and branch rules can further restrict an operation.
+Use explicit --repo/--hostname on remote commands when cwd is ambiguous.
+
+`git ls-remote` proves only read transport access, never push permission.
+SSH access is independent of REST auth. Reuse existing SSH keys/host aliases only
+for the named account. Key generation, key registration and SSH config edits
+require an account-management task; do not overwrite keys or disable host checking.
+
+## 4. Git/curl fallback
+
+`source "$SKILL_ROOT/scripts/gh-env.sh"` locates sibling helpers using BASH_SOURCE,
+parses origin strictly, and distinguishes gh/none/token-unverified. It does not
+install tools, source dotenv files or read shared credentials. Bash is required;
+on native Windows use ensure-gh.py and gh directly.
+
+For github.com only, injected GITHUB_TOKEN may be used by curl against
+https://api.github.com. Use --fail-with-body, a timeout, structured JSON and full
+pagination; do not send the token to origin URLs. For Enterprise, bind credentials
+to the explicitly verified host and its API root; do not reuse github.com tokens.
+Use stdin/config or a secure client if process arguments are observable by other
+tenants; never log Authorization headers.
+
+The retained git-credential-token.py parser supports explicit, user-authorized
+migration of a specified credential-store file. It requires an explicit file
+argument and writes the token to stdout: capture privately, never run it as a
+diagnostic or allow terminal output to be included in conversation evidence.
+
+## Troubleshooting and verification
+
+- Tool unavailable: report install/version result and usable fallback separately.
+- Authentication missing/expired: request scoped account linking or injection;
+  do not delete cached credentials globally.
+- 403: distinguish scope, org SSO, branch protection and repository membership.
+- Multiple accounts: select the exact host/account; do not overwrite hosts.yml.
+- Read succeeded but write failed: do not elevate scopes or retry mutation blindly.
+- Login timed out: stop, keep existing config, report a blocked auth step.
+- Delivery uncertain: read back the intended issue/PR/review before retrying.
+
+Never claim installation, login, repository access, a write, or CI success from
+another gate's result.

package/built-in-skills/prismer-github/references/ci-troubleshooting.md

@@ -0,0 +1,193 @@
+# CI Troubleshooting Quick Reference
+
+> Prismer scope: read auth.md first. All mutations below are examples for an
+> explicitly authorized target/action, never an automatic checklist. Preserve the
+> current dirty tree and long-lived branch; resolve the actual base branch and
+> do not switch, commit, push, publish, merge, delete branches or send reviews
+> unless requested. Use structured JSON for dynamic payloads, not shell string
+> interpolation. Public visibility requires explicit intent. Collection reads
+> must use scripts/github-api.py (complete Link pagination) or gh api --paginate;
+> porcelain list limits and single-page curl output are not a complete inventory.
+> Run shell pipelines with pipefail, record each exit status, and read back writes.
+
+Common CI failure patterns and how to diagnose them from the logs.
+
+## Reading CI Logs
+
+```bash
+# With gh
+gh run view <RUN_ID> --log-failed
+
+# With curl — download and extract
+curl --fail-with-body -sS --max-time 30 -L -H "Authorization: token $GITHUB_TOKEN" \
+  https://api.github.com/repos/$GH_OWNER/$GH_REPO/actions/runs/<RUN_ID>/logs \
+  -o ~/.hermes/cache/scratch/ci-logs.zip && unzip -o ~/.hermes/cache/scratch/ci-logs.zip -d ~/.hermes/cache/scratch/ci-logs
+```
+
+## Common Failure Patterns
+
+### Test Failures
+
+**Signatures in logs:**
+```
+FAILED tests/test_foo.py::test_bar - AssertionError
+E       assert 42 == 43
+ERROR tests/test_foo.py - ModuleNotFoundError
+```
+
+**Diagnosis:**
+1. Find the test file and line number from the traceback
+2. Use `read_file` to read the failing test
+3. Check if it's a logic error in the code or a stale test assertion
+4. Look for `ModuleNotFoundError` — usually a missing dependency in CI
+
+**Common fixes:**
+- Update assertion to match new expected behavior
+- Add missing dependency to requirements.txt / pyproject.toml
+- Fix flaky test (add retry, mock external service, fix race condition)
+
+---
+
+### Lint / Formatting Failures
+
+**Signatures in logs:**
+```
+src/auth.py:45:1: E302 expected 2 blank lines, got 1
+src/models.py:12:80: E501 line too long (95 > 88 characters)
+error: would reformat src/utils.py
+```
+
+**Diagnosis:**
+1. Read the specific file:line numbers mentioned
+2. Check which linter is complaining (flake8, ruff, black, isort, mypy)
+
+**Common fixes:**
+- Run the formatter locally: `black .`, `isort .`, `ruff check --fix .`
+- Fix the specific style violation by editing the file
+- If using `patch`, make sure to match existing indentation style
+
+---
+
+### Type Check Failures (mypy / pyright)
+
+**Signatures in logs:**
+```
+src/api.py:23: error: Argument 1 to "process" has incompatible type "str"; expected "int"
+src/models.py:45: error: Missing return statement
+```
+
+**Diagnosis:**
+1. Read the file at the mentioned line
+2. Check the function signature and what's being passed
+
+**Common fixes:**
+- Add type cast or conversion
+- Fix the function signature
+- Add `# type: ignore` comment as last resort (with explanation)
+
+---
+
+### Build / Compilation Failures
+
+**Signatures in logs:**
+```
+ModuleNotFoundError: No module named 'some_package'
+ERROR: Could not find a version that satisfies the requirement foo==1.2.3
+npm ERR! Could not resolve dependency
+```
+
+**Diagnosis:**
+1. Check requirements.txt / package.json for the missing or incompatible dependency
+2. Compare local vs CI Python/Node version
+
+**Common fixes:**
+- Add missing dependency to requirements file
+- Pin compatible version
+- Update lockfile (`pip freeze`, `npm install`)
+
+---
+
+### Permission / Auth Failures
+
+**Signatures in logs:**
+```
+fatal: could not read Username for 'https://github.com': No such device or address
+Error: Resource not accessible by integration
+403 Forbidden
+```
+
+**Diagnosis:**
+1. Check if the workflow needs special permissions (token scopes)
+2. Check if secrets are configured (missing `GITHUB_TOKEN` or custom secrets)
+
+**Common fixes:**
+- Add `permissions:` block to workflow YAML
+- Verify secrets exist: `gh secret list` or check repo settings
+- For fork PRs: some secrets aren't available by design
+
+---
+
+### Timeout Failures
+
+**Signatures in logs:**
+```
+Error: The operation was canceled.
+The job running on runner ... has exceeded the maximum execution time
+```
+
+**Diagnosis:**
+1. Check which step timed out
+2. Look for infinite loops, hung processes, or slow network calls
+
+**Common fixes:**
+- Add timeout to the specific step: `timeout-minutes: 10`
+- Fix the underlying performance issue
+- Split into parallel jobs
+
+---
+
+### Docker / Container Failures
+
+**Signatures in logs:**
+```
+docker: Error response from daemon
+failed to solve: ... not found
+COPY failed: file not found in build context
+```
+
+**Diagnosis:**
+1. Check Dockerfile for the failing step
+2. Verify the referenced files exist in the repo
+
+**Common fixes:**
+- Fix path in COPY/ADD command
+- Update base image tag
+- Add missing file to `.dockerignore` exclusion or remove from it
+
+---
+
+## Auto-Fix Decision Tree
+
+```
+CI Failed
+├── Test failure
+│   ├── Assertion mismatch → update test or fix logic
+│   └── Import/module error → add dependency
+├── Lint failure → run formatter, fix style
+├── Type error → fix types
+├── Build failure
+│   ├── Missing dep → add to requirements
+│   └── Version conflict → update pins
+├── Permission error → update workflow permissions (needs user)
+└── Timeout → investigate perf (may need user input)
+```
+
+## Re-running After Fix
+
+```bash
+git add <fixed_files> && git commit -m "fix: resolve CI failure" && git push
+
+# Then monitor
+gh pr checks --watch 2>/dev/null || \
+  echo "Poll with: curl --fail-with-body -sS --max-time 30 -H 'Authorization: token ...' https://api.github.com/repos/.../commits/$(git rev-parse HEAD)/status"
+```