claude-dev-env 1.92.1 → 1.93.0

package/skills/copilot-finding-triage/SKILL.md

@@ -0,0 +1,124 @@
+---
+name: copilot-finding-triage
+description: >-
+  Sorts each Copilot gate finding from a converge run into one of two tiers and
+  routes it: a self-healing finding is auto-fixed, pushed, and counted toward
+  convergence with no user page, while a code concern pages the user over ntfy
+  and holds the run behind a 45-minute gate. Triggers: 'copilot finding triage',
+  'user review gate', 'tier copilot findings', 'triage the copilot gate'.
+---
+
+# Copilot Finding Triage
+
+After a converge run's Copilot gate returns its findings, this skill sorts each
+one into a tier and acts on it. Findings scoped to style, type hints, or tests
+heal themselves inside the run. A logic, security, or behavior finding pages the user
+and holds the run until they answer or a 45-minute deadline passes.
+
+## When this applies
+
+Reach for this skill when a Copilot review on the round's HEAD returns findings
+inside one of these callers:
+
+- `autoconverge` — the single-run converge workflow, at its Copilot wait-gate.
+- `pr-converge` — the looping converge workflow, at each Copilot tick.
+- `copilot-review` — the standalone Copilot babysitter.
+
+Each caller already fetches the review and carries a fix-and-push flow. This
+skill decides, per finding, whether that flow runs on its own or waits behind
+the user gate.
+
+## The tier split
+
+Read the complete rubric in `reference/tier-rubric.md`. The short form:
+
+- **SELF-HEALING** — the fix cannot change what a production caller sees at
+  runtime. Style, type hints, misplaced or unused imports, magic-value
+  extraction, reshapes limited to tests, doc-versus-code mismatches, and
+  de-duplication.
+- **CODE CONCERN** — the fix changes observable production behavior or needs a
+  product decision. Logic or correctness defects, security, data handling,
+  error-handling semantics, and concurrency.
+
+A finding that straddles both tiers sorts to CODE CONCERN. Any doubt routes to
+the user gate.
+
+## Self-healing flow
+
+A self-healing finding never pages the user.
+
+1. Fix the finding through the caller's existing fix flow.
+2. Verify the fix.
+3. Commit and push on the caller's branch.
+4. Count the round toward convergence.
+
+## User gate protocol
+
+Run this protocol when one or more CODE CONCERN findings sit on the round's HEAD.
+
+### Step 1 — Page the user
+
+Run `scripts/notify_ntfy.py` with:
+
+- `--title` naming the PR.
+- `--message` summarizing each code-concern finding, one line each, as
+  `file:line — severity — one sentence`. Build the body from
+  `templates/notification.md`.
+- `--click-url` set to the Copilot review URL, so tapping the page opens the
+  review.
+
+The topic reads from the `NTFY_TOPIC` environment variable, and the server
+reads from `NTFY_SERVER` with a default of `https://ntfy.sh`. A missing topic
+fails loudly with a clear message. A failed page holds the gate open; it never
+counts as approval.
+
+### Step 2 — Hold and wait
+
+Arm `ScheduleWakeup` for a 45-minute deadline. Where `ScheduleWakeup` is absent,
+use `send_later`. The clock starts when the page reaches the user, which is the
+moment the script exits zero.
+
+- If the user answers, follow their direction.
+- If the deadline passes with no answer, run the caller's normal teardown and
+  report the un-reviewed findings in the final report.
+
+### Step 3 — Self-healing findings run in parallel
+
+Self-healing findings on the same HEAD do not wait for the gate. Fix, verify,
+commit, and push them through the caller's fix flow, and count the round toward
+convergence.
+
+## Gate checklist
+
+- [ ] Every finding on HEAD carries a tier.
+- [ ] Each self-healing finding is fixed, verified, and pushed.
+- [ ] Each code-concern finding appears as one line in the ntfy body.
+- [ ] The page carries the PR name, the per-finding summary, and the review URL.
+- [ ] `scripts/notify_ntfy.py` exited zero before the 45-minute clock started.
+- [ ] The wakeup is armed for 45 minutes from a delivered page.
+- [ ] A failed page kept the gate open rather than approving the round.
+
+## Files
+
+| Path | Role |
+|------|------|
+| `SKILL.md` | This hub: when it applies, the tier split, the gate protocol. |
+| `reference/tier-rubric.md` | The complete tier rubric and the behavior-safe test. |
+| `templates/notification.md` | The ntfy message body for a code-concern page. |
+| `scripts/notify_ntfy.py` | The ntfy publish CLI. |
+| `scripts/test_notify_ntfy.py` | Tests for the publish CLI. |
+
+## Gotchas
+
+- **A cloud MCP session refuses APPROVE reviews.** Any review this protocol posts
+  is event COMMENT. A cloud session cannot post an APPROVE event, so route
+  approvals through the user, never through a posted review.
+- **A failed page is not consent.** A failed ntfy POST holds the gate open. It
+  does not auto-approve the round. Read the script's non-zero exit as a page that
+  never reached the user, and keep the run held.
+- **Doubt sorts to CODE CONCERN.** When a finding could sit in either tier,
+  classify it as a code concern and page the user. The safe default never
+  auto-fixes a finding that might change runtime behavior.
+- **The 45-minute clock starts at page success.** The timer starts when the page
+  reaches the user, which is the moment `scripts/notify_ntfy.py` exits zero, not
+  the moment the finding is classified.

package/skills/copilot-finding-triage/reference/tier-rubric.md

@@ -0,0 +1,49 @@
+# Tier Rubric
+
+Every Copilot finding on the round's HEAD sorts into one of two tiers. The tier
+decides who acts: the run fixes a self-healing finding on its own, and the run
+pages the user for a code concern.
+
+## The two tiers
+
+| Tier | Who acts | Page the user | Counts toward convergence |
+|------|----------|---------------|---------------------------|
+| SELF-HEALING | The run auto-fixes | No | Yes |
+| CODE CONCERN | The user decides | Yes | Held until the user answers or the deadline passes |
+
+## The test that splits them
+
+A finding is SELF-HEALING when its fix cannot change what a production caller
+observes at runtime. A finding is a CODE CONCERN when its fix changes runtime
+behavior for a production caller or asks for a product decision.
+
+## SELF-HEALING findings
+
+The fix is safe because it leaves runtime behavior the same for every production
+caller.
+
+- Pure style: formatting, blank lines, naming.
+- Type hints.
+- Misplaced or unused imports.
+- Magic-value extraction to a named constant.
+- Test-only changes: a redundant or tautological test, a test reshape.
+- A description or doc that reads differently from the code it describes.
+- De-duplicating code that already runs the same way.
+
+## CODE CONCERN findings
+
+The fix changes what a production caller sees, or the call needs a person to
+weigh a tradeoff.
+
+- Logic or correctness defects.
+- Security issues.
+- Data-handling changes.
+- Error-handling semantics.
+- Concurrency.
+- Anything whose fix changes observable production behavior.
+
+## When a finding sits on the line
+
+A finding that touches both tiers sorts to CODE CONCERN. Any doubt about whether
+a fix stays behavior-safe routes the finding to the user gate. The safe default
+pages a person; it never auto-fixes a finding that might change runtime behavior.

package/skills/copilot-finding-triage/scripts/conftest.py

@@ -0,0 +1,8 @@
+"""Put the scripts directory on sys.path so tests import the script by name."""
+
+import sys
+from pathlib import Path
+
+_script_directory = str(Path(__file__).resolve().parent)
+if _script_directory not in sys.path:
+    sys.path.insert(0, _script_directory)

package/skills/copilot-finding-triage/scripts/copilot_finding_triage_constants/config/notify_ntfy_constants.py

@@ -0,0 +1,32 @@
+"""ntfy publish settings the notify_ntfy script reads.
+
+::
+
+    DEFAULT_SERVER_URL       "https://ntfy.sh"   server when NTFY_SERVER is unset
+    DEFAULT_PRIORITY_NAME    "high"              level when no priority is given
+    REQUEST_TIMEOUT_SECONDS  10                  the POST deadline in seconds
+
+Header names, the priority-level map, and the environment-variable names round
+out the set.
+"""
+
+TOPIC_ENVIRONMENT_VARIABLE_NAME = "NTFY_TOPIC"
+SERVER_ENVIRONMENT_VARIABLE_NAME = "NTFY_SERVER"
+DEFAULT_SERVER_URL = "https://ntfy.sh"
+REQUEST_TIMEOUT_SECONDS = 10
+URL_PATH_SEPARATOR = "/"
+MESSAGE_ENCODING = "utf-8"
+POST_METHOD_NAME = "POST"
+TITLE_HEADER_NAME = "Title"
+PRIORITY_HEADER_NAME = "Priority"
+CLICK_HEADER_NAME = "Click"
+CONTENT_TYPE_HEADER_NAME = "Content-Type"
+PLAIN_TEXT_CONTENT_TYPE = "text/plain"
+DEFAULT_PRIORITY_NAME = "high"
+ALL_PRIORITY_LEVELS_BY_NAME: dict[str, str] = {
+    "min": "1",
+    "low": "2",
+    "default": "3",
+    "high": "4",
+    "urgent": "5",
+}

package/skills/copilot-finding-triage/scripts/notify_ntfy.py

@@ -0,0 +1,192 @@
+"""Publish one ntfy notification for the Copilot gate.
+
+::
+
+    run:  notify_ntfy.py --title "PR 743" --message "..." --click-url "https://r"
+    ok:   topic set   -> POST to {server}/{topic}, exit 0
+    flag: topic unset -> readable error on stderr, exit 1
+
+The topic and the optional server override both read from the environment. A
+code-concern gate runs this to page the user, then holds the run until the
+deadline.
+
+Usage:
+    notify_ntfy.py --title "PR 743" --message "..." --click-url "https://..."
+    notify_ntfy.py --title "PR 743" --message "..." --click-url "..." --priority urgent
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+import urllib.error
+import urllib.request
+from collections.abc import Mapping
+
+from copilot_finding_triage_constants.config.notify_ntfy_constants import (
+    ALL_PRIORITY_LEVELS_BY_NAME,
+    CLICK_HEADER_NAME,
+    CONTENT_TYPE_HEADER_NAME,
+    DEFAULT_PRIORITY_NAME,
+    DEFAULT_SERVER_URL,
+    MESSAGE_ENCODING,
+    PLAIN_TEXT_CONTENT_TYPE,
+    POST_METHOD_NAME,
+    PRIORITY_HEADER_NAME,
+    REQUEST_TIMEOUT_SECONDS,
+    SERVER_ENVIRONMENT_VARIABLE_NAME,
+    TITLE_HEADER_NAME,
+    TOPIC_ENVIRONMENT_VARIABLE_NAME,
+    URL_PATH_SEPARATOR,
+)
+
+def parse_arguments(all_arguments: list[str]) -> argparse.Namespace:
+    """Parse the notify_ntfy command-line arguments.
+
+    Args:
+        all_arguments: The argument strings following the script name.
+
+    Returns:
+        The parsed namespace carrying title, message, click_url, and priority.
+    """
+    parser = argparse.ArgumentParser(description="Publish one ntfy notification.")
+    parser.add_argument("--title", required=True)
+    parser.add_argument("--message", required=True)
+    parser.add_argument("--click-url", required=True, dest="click_url")
+    parser.add_argument(
+        "--priority",
+        default=DEFAULT_PRIORITY_NAME,
+        choices=sorted(ALL_PRIORITY_LEVELS_BY_NAME),
+    )
+    return parser.parse_args(all_arguments)
+
+def resolve_topic(all_environment_variables: Mapping[str, str]) -> str:
+    """Return the ntfy topic from the environment, empty when unset.
+
+    Args:
+        all_environment_variables: The environment mapping to read the topic from.
+
+    Returns:
+        The topic string, or an empty string when the variable is unset.
+    """
+    return all_environment_variables.get(TOPIC_ENVIRONMENT_VARIABLE_NAME, "").strip()
+
+def resolve_server(all_environment_variables: Mapping[str, str]) -> str:
+    """Return the ntfy server URL from the environment.
+
+    Args:
+        all_environment_variables: The environment mapping to read the override from.
+
+    Returns:
+        The override server URL when set, otherwise the default server URL.
+    """
+    configured_server = all_environment_variables.get(
+        SERVER_ENVIRONMENT_VARIABLE_NAME, ""
+    ).strip()
+    return configured_server or DEFAULT_SERVER_URL
+
+def _build_headers(title: str, click_url: str, priority_name: str) -> dict[str, str]:
+    """Build the ntfy publish headers for one notification.
+
+    Args:
+        title: The notification title header.
+        click_url: The URL opened when the notification is tapped.
+        priority_name: The accepted priority name selecting the level header.
+
+    Returns:
+        The header mapping ntfy reads to render and route the notification.
+    """
+    return {
+        TITLE_HEADER_NAME: title,
+        PRIORITY_HEADER_NAME: ALL_PRIORITY_LEVELS_BY_NAME[priority_name],
+        CLICK_HEADER_NAME: click_url,
+        CONTENT_TYPE_HEADER_NAME: PLAIN_TEXT_CONTENT_TYPE,
+    }
+
+def build_request(
+    title: str,
+    message: str,
+    click_url: str,
+    priority_name: str,
+    topic: str,
+    server: str,
+) -> urllib.request.Request:
+    """Build the ntfy publish request for one notification.
+
+    Args:
+        title: The notification title header.
+        message: The notification body text.
+        click_url: The URL opened when the notification is tapped.
+        priority_name: The accepted priority name selecting the level header.
+        topic: The ntfy topic to publish to.
+        server: The ntfy server base URL.
+
+    Returns:
+        A POST request carrying the encoded body and the ntfy headers.
+    """
+    endpoint_url = f"{server}{URL_PATH_SEPARATOR}{topic}"
+    return urllib.request.Request(
+        endpoint_url,
+        data=message.encode(MESSAGE_ENCODING),
+        headers=_build_headers(title, click_url, priority_name),
+        method=POST_METHOD_NAME,
+    )
+
+def _send_notification(request: urllib.request.Request, timeout_seconds: int) -> None:
+    """Send the ntfy request, raising on any transport failure.
+
+    Args:
+        request: The publish request to send.
+        timeout_seconds: Seconds to wait before the POST times out.
+    """
+    with urllib.request.urlopen(request, timeout=timeout_seconds):
+        return None
+
+def _emit_error(message_text: str) -> None:
+    """Write one error line to standard error."""
+    sys.stderr.write(message_text + "\n")
+
+def _publish(
+    parsed_arguments: argparse.Namespace,
+    all_environment_variables: Mapping[str, str],
+) -> int:
+    """Publish the parsed notification, returning the process exit code."""
+    topic = resolve_topic(all_environment_variables)
+    if not topic:
+        _emit_error(
+            f"{TOPIC_ENVIRONMENT_VARIABLE_NAME} is unset; set it to the ntfy topic."
+        )
+        return 1
+    request = build_request(
+        parsed_arguments.title,
+        parsed_arguments.message,
+        parsed_arguments.click_url,
+        parsed_arguments.priority,
+        topic,
+        resolve_server(all_environment_variables),
+    )
+    try:
+        _send_notification(request, REQUEST_TIMEOUT_SECONDS)
+    except (urllib.error.URLError, OSError) as send_error:
+        _emit_error(f"ntfy publish failed: {send_error}")
+        return 1
+    return 0
+
+def main(
+    all_arguments: list[str],
+    all_environment_variables: Mapping[str, str],
+) -> int:
+    """Publish one ntfy notification from the command line.
+
+    Args:
+        all_arguments: The argument strings following the script name.
+        all_environment_variables: The environment mapping carrying topic and server.
+
+    Returns:
+        Zero on a delivered notification; one on a missing topic or failed send.
+    """
+    return _publish(parse_arguments(all_arguments), all_environment_variables)
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:], os.environ))

package/skills/copilot-finding-triage/scripts/test_notify_ntfy.py

@@ -0,0 +1,141 @@
+"""Tests for notify_ntfy — argument parsing, payload shape, and delivery."""
+
+import threading
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+from copilot_finding_triage_constants.config.notify_ntfy_constants import (
+    DEFAULT_PRIORITY_NAME,
+    DEFAULT_SERVER_URL,
+    SERVER_ENVIRONMENT_VARIABLE_NAME,
+    TOPIC_ENVIRONMENT_VARIABLE_NAME,
+)
+from notify_ntfy import (
+    build_request,
+    main,
+    parse_arguments,
+    resolve_server,
+    resolve_topic,
+)
+
+
+class TestParseArguments:
+    def test_reads_the_required_arguments(self) -> None:
+        parsed = parse_arguments(
+            ["--title", "PR 743", "--message", "one concern", "--click-url", "u"]
+        )
+        assert parsed.title == "PR 743"
+        assert parsed.message == "one concern"
+        assert parsed.click_url == "u"
+
+    def test_priority_defaults_to_high(self) -> None:
+        parsed = parse_arguments(["--title", "t", "--message", "m", "--click-url", "u"])
+        assert parsed.priority == DEFAULT_PRIORITY_NAME
+
+    def test_rejects_an_unknown_priority(self) -> None:
+        try:
+            parse_arguments(
+                [
+                    "--title",
+                    "t",
+                    "--message",
+                    "m",
+                    "--click-url",
+                    "u",
+                    "--priority",
+                    "x",
+                ]
+            )
+        except SystemExit as exit_error:
+            assert exit_error.code != 0
+            return
+        raise AssertionError("expected SystemExit for an unknown priority")
+
+
+class TestResolveEnvironment:
+    def test_topic_reads_from_the_environment(self) -> None:
+        assert resolve_topic({TOPIC_ENVIRONMENT_VARIABLE_NAME: "converge-743"}) == (
+            "converge-743"
+        )
+
+    def test_topic_is_empty_when_unset(self) -> None:
+        assert resolve_topic({}) == ""
+
+    def test_server_falls_back_to_the_default(self) -> None:
+        assert resolve_server({}) == DEFAULT_SERVER_URL
+
+    def test_server_override_wins(self) -> None:
+        override = {SERVER_ENVIRONMENT_VARIABLE_NAME: "https://ntfy.example.com"}
+        assert resolve_server(override) == "https://ntfy.example.com"
+
+
+class TestBuildRequest:
+    def test_builds_a_post_to_the_topic_endpoint(self) -> None:
+        request = build_request(
+            "PR 743", "body", "https://review", "high", "topic-a", DEFAULT_SERVER_URL
+        )
+        assert request.method == "POST"
+        assert request.full_url == "https://ntfy.sh/topic-a"
+
+    def test_carries_the_title_priority_and_click_headers(self) -> None:
+        request = build_request(
+            "PR 743", "body", "https://review", "urgent", "topic-a", DEFAULT_SERVER_URL
+        )
+        assert request.get_header("Title") == "PR 743"
+        assert request.get_header("Priority") == "5"
+        assert request.get_header("Click") == "https://review"
+
+    def test_encodes_the_message_as_the_body(self) -> None:
+        request = build_request(
+            "t", "the body text", "u", "high", "topic-a", DEFAULT_SERVER_URL
+        )
+        assert request.data == b"the body text"
+
+
+class _RecordingHandler(BaseHTTPRequestHandler):
+    received_path: str = ""
+    received_body: bytes = b""
+    received_title: str = ""
+
+    def do_POST(self) -> None:
+        content_length = int(self.headers.get("Content-Length", "0"))
+        _RecordingHandler.received_path = self.path
+        _RecordingHandler.received_body = self.rfile.read(content_length)
+        _RecordingHandler.received_title = self.headers.get("Title", "")
+        self.send_response(200)
+        self.end_headers()
+
+    def log_message(self, format_string: str, *format_arguments: object) -> None:
+        return None
+
+
+class TestMainDelivers:
+    def test_missing_topic_returns_one(self) -> None:
+        exit_code = main(["--title", "t", "--message", "m", "--click-url", "u"], {})
+        assert exit_code == 1
+
+    def test_posts_the_notification_to_a_local_server(self) -> None:
+        server = HTTPServer(("127.0.0.1", 0), _RecordingHandler)
+        server_thread = threading.Thread(target=server.handle_request)
+        server_thread.start()
+        server_port = server.server_address[1]
+        server_url = f"http://127.0.0.1:{server_port}"
+        exit_code = main(
+            [
+                "--title",
+                "PR 743",
+                "--message",
+                "one code concern",
+                "--click-url",
+                "https://review",
+            ],
+            {
+                TOPIC_ENVIRONMENT_VARIABLE_NAME: "converge-743",
+                SERVER_ENVIRONMENT_VARIABLE_NAME: server_url,
+            },
+        )
+        server_thread.join(timeout=5)
+        server.server_close()
+        assert exit_code == 0
+        assert _RecordingHandler.received_path == "/converge-743"
+        assert _RecordingHandler.received_body == b"one code concern"
+        assert _RecordingHandler.received_title == "PR 743"

package/skills/copilot-finding-triage/templates/notification.md

@@ -0,0 +1,34 @@
+# ntfy Message Body
+
+Fill this template, then pass the title as `--title` and the filled body as
+`--message` to `scripts/notify_ntfy.py`. Pass the review URL as `--click-url` so
+tapping the page opens the Copilot review.
+
+## Title line
+
+```
+Copilot code concern on PR {pr_number}: {short_pr_title}
+```
+
+## Body
+
+```
+{finding_count} code concern(s) need your call on PR {pr_number} ({head_sha}):
+
+- {file_1}:{line_1} — {severity_1} — {one_sentence_concern_1}
+- {file_2}:{line_2} — {severity_2} — {one_sentence_concern_2}
+
+Review: {review_url}
+Reply within 45 minutes or the run tears down and reports these findings unreviewed.
+```
+
+## Field notes
+
+- `{finding_count}` counts the CODE CONCERN findings on this HEAD, not the
+  self-healing ones.
+- Each bullet holds one finding: its `file:line`, its severity, and one sentence
+  naming the concern.
+- `{review_url}` is the same URL passed as `--click-url`, so the reader sees it
+  in the body and reaches it by tapping the message.
+- The 45-minute clock starts when the page reaches the user, which is the moment
+  `scripts/notify_ntfy.py` exits zero.

package/skills/copilot-review/SKILL.md

@@ -1,18 +1,20 @@
 ---
 name: copilot-review
 description: >-
-  Spawns a background subagent that babysits the GitHub Copilot reviewer on the current
-  PR: each ~6-min tick it fetches the latest copilot-pull-request-reviewer[bot] review,
-  fixes unaddressed findings against HEAD (commit, push, inline replies, thread
-  resolution), re-requests review, and exits on convergence. Triggers:
-  '/copilot-review', 'watch copilot', 'babysit copilot review', 'keep re-requesting
-  copilot'.
+  Spawns a background subagent that babysits the GitHub Copilot reviewer on the
+  current PR: each tick it fixes unaddressed findings against HEAD, re-requests
+  review, and exits on convergence. Triggers: '/copilot-review', 'watch
+  copilot', 'babysit copilot review', 'keep re-requesting copilot'.
 ---
 
 # Copilot Review
 
 Delegates Copilot babysitting to a background subagent so the main session stays free. The subagent loops internally and closes itself on convergence.
 
+## Transport check (before any GitHub step)
+
+Run `command -v gh`; when it succeeds, run `gh auth status`; once the PR scope is resolved, run `gh api repos/<owner>/<repo> --jq .permissions.push` and take `true` as the pass. When any check fails, run the `pr-loop-cloud-transport` skill first, route every `gh` operation in this skill through its substitution matrix, and carry the same routing into the subagent prompt so the spawned watcher inherits it.
+
 ## When this skill applies
 
 The user is on a PR branch, wants Copilot (the GitHub Copilot reviewer bot) to keep re-reviewing after each push, and wants findings auto-addressed between ticks — but does not want the main conversation consumed by polling.

package/skills/findbugs/SKILL.md

@@ -12,6 +12,10 @@ description: >-
 
 **Core principle:** A clean-room bug audit on the entire pull request. The audit agent receives the PR diff and nothing else — no chat history, no prior framing, no implicit "we already looked at this." Independence is the point.
 
+## Transport check (before any GitHub step)
+
+Run `command -v gh`; when it succeeds, run `gh auth status`; once the PR scope is resolved, run `gh api repos/<owner>/<repo> --jq .permissions.push` and take `true` as the pass. When any check fails, run the `pr-loop-cloud-transport` skill first and route every `gh` operation in this skill through its substitution matrix.
+
 ## When this skill applies
 
 User types `/findbugs` or asks for a bug audit on the current branch's PR. Typical moment: PR is up (draft or ready), and the user wants an independent second pair of eyes before merge or before requesting human review.

package/skills/fixbugs/SKILL.md

@@ -1,19 +1,20 @@
 ---
 name: fixbugs
 description: >-
-  Fixes the bugs surfaced by the most recent /findbugs invocation by handing
-  the findings to /agent-prompt, which authors a structured XML prompt and
-  spawns a background sonnet implementer (via /agent-prompt) to apply every fix in one
-  commit on the existing branch. Default scope: all severities. Optional
-  argument filters by severity (e.g. /fixbugs P0, /fixbugs P0+P1).
-  Triggers: '/fixbugs', 'fix all the bugs', 'apply the audit fixes',
-  'implement the findbugs results'.
+  Fixes the bugs from the latest /findbugs run by handing them to /agent-prompt,
+  which spawns a background agent to apply every fix in one commit. An optional
+  argument filters by severity (e.g. /fixbugs P0). Triggers: '/fixbugs', 'fix
+  all the bugs', 'apply the audit fixes', 'apply the findbugs results'.
 ---
 
 # Fixbugs
 
 **Core principle:** A thin bridge between `/findbugs` (read-only audit) and `/agent-prompt` (structured prompt authoring + spawn). /fixbugs recovers the prior findings, packages them as a goal, and hands off. It does not author prompts itself, does not spawn agents directly, and does not run audits.
 
+## Transport check (before any GitHub step)
+
+Run `command -v gh`; when it succeeds, run `gh auth status`; once the PR scope is resolved, run `gh api repos/<owner>/<repo> --jq .permissions.push` and take `true` as the pass. When any check fails, run the `pr-loop-cloud-transport` skill first, route every `gh` operation in this skill through its substitution matrix, and carry the same routing into the goal string handed to `/agent-prompt` so the spawned fix agent inherits it.
+
 ## When this skill applies
 
 Right after `/findbugs` returned findings on the current branch and the user wants the bugs fixed without further triage. Bare `/fixbugs` defaults to all severities (P0 + P1 + P2). Argument-filtered invocations (e.g. `/fixbugs P0`, `/fixbugs P0+P1`, `/fixbugs P0 P1`) narrow the target set.

package/skills/gotcha/CLAUDE.md

@@ -28,6 +28,6 @@ Each entry is a bullet under `## Gotchas`:
 
 | Skill location | Target repo |
 |---|---|
-| `packages/claude-dev-env/skills/<name>/` | `jl-cmd/claude-code-config` |
-| `~/.claude/skills/<name>/` | `jl-cmd/claude-code-config` |
+| `packages/claude-dev-env/skills/<name>/` | `jl-cmd/claude-dev-env` |
+| `~/.claude/skills/<name>/` | `jl-cmd/claude-dev-env` |
 | Project `.claude/skills/<name>/` | That project's repo |