claude-teammate 0.1.280 → 0.1.282

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-teammate",
-  "version": "0.1.280",
+  "version": "0.1.282",
   "description": "CLI bootstrapper for Claude Teammate.",
   "license": "MIT",
   "type": "module",

package/src/claude/stream.js

@@ -72,6 +72,16 @@ export function parseClaudeOutput(output) {
       return direct;
     }
 
+    // Skill-fix schema: { analysis, files, reason }
+    if ("analysis" in direct && Array.isArray(direct.files)) {
+      return direct;
+    }
+
+    // Skill-correction schema: { isCorrection, skillName, correctionSummary }
+    if ("isCorrection" in direct) {
+      return direct;
+    }
+
     if ("result" in direct && typeof direct.result === "string") {
       return JSON.parse(direct.result);
     }

package/src/claude.js

@@ -536,8 +536,10 @@ export async function runClaudeSkillCorrectionCheck({
     return await invokeClaudeTask(
       SKILL_CORRECTION_SCHEMA,
       SKILL_CORRECTION_SYSTEM,
-      `Previous bot response:\n<previous>\n${String(previousBotResponse || "").slice(0, 800)}\n</previous>\n\nUser message:\n<user>\n${humanMessage}\n</user>\n\nIs the user correcting specific output behavior from a skill?`,
+      `Previous bot response:\n<previous>\n${String(previousBotResponse || "").slice(0, 2500)}\n</previous>\n\nUser message:\n<user>\n${humanMessage}\n</user>\n\nIs the user correcting specific output behavior from a skill?`,
       {
+        model: "haiku",
+        effort: "low",
         runOpts: {
           cwd,
           timeout: timeoutMs || 30_000,
@@ -564,6 +566,7 @@ export function triggerSkillFeedbackFix({
   skillName,
   correctionSummary,
   projectRoot,
+  projectRoots,
   eventsRoot,
   logger,
   epicContext,
@@ -573,6 +576,7 @@ export function triggerSkillFeedbackFix({
     skillName,
     correctionSummary,
     projectRoot,
+    projectRoots,
     eventsRoot: eventsRoot || CLAUDE_TEAMMATE_ROOT,
     logger,
     invokeClaudeTask,

package/src/skills/detector.js

@@ -14,6 +14,14 @@ import { findSkillLocation } from "./locator.js";
  * Attribution: after a Skill is successfully loaded, it becomes the "active skill".
  * Any subsequent tool error is attributed to that skill until another Skill is loaded.
  */
+// After this many attributable (Bash + mcp__) tool results without a new skill
+// load, close the attribution window. Prevents errors from unrelated work done
+// long after the skill completed being wrongly attributed to it.
+const MAX_ATTRIBUTION_DEPTH = 20;
+// Cap the trail in inferSilentRecovery to prevent unbounded memory growth
+// in long tasks that call many tools under one active skill.
+const MAX_TRAIL_SIZE = 100;
+
 export function extractSkillFailures(streamLines) {
   const failures = [];
   // Dedup by (skill, errorType): a single skill can surface multiple distinct
@@ -21,6 +29,7 @@ export function extractSkillFailures(streamLines) {
   // we want each captured. Same errorType repeating is collapsed.
   const failedKeys = new Set();
   let activeSkillName = null; // most recently loaded skill
+  let activeSkillCallCount = 0; // attributable tool results since skill loaded
   const pendingSkill = new Map(); // toolUseId → skillName
   const pendingToolName = new Map(); // toolUseId → toolName (all tools)
 
@@ -66,9 +75,11 @@ export function extractSkillFailures(streamLines) {
           });
         }
         activeSkillName = null;
+        activeSkillCallCount = 0;
       } else {
         // Skill loaded successfully — set as active so subsequent errors are attributed to it
         activeSkillName = loadedSkillName;
+        activeSkillCallCount = 0;
       }
       continue;
     }
@@ -78,6 +89,14 @@ export function extractSkillFailures(streamLines) {
     // Edit/Grep/Glob/Task/etc.) are general-purpose and their failures are
     // typically caused by the user prompt, not by skill instructions.
     const attributable = toolName === "Bash" || (typeof toolName === "string" && toolName.startsWith("mcp__"));
+    // Count every attributable tool result and close the window once MAX_ATTRIBUTION_DEPTH
+    // is reached. Prevents errors from unrelated work done long after the skill completed
+    // from being wrongly attributed to it.
+    if (activeSkillName && attributable) {
+      if (++activeSkillCallCount > MAX_ATTRIBUTION_DEPTH) {
+        activeSkillName = null;
+      }
+    }
     const isMcpError = attributable && toolName !== "Bash" && event.is_error === true;
     const isBashError = toolName === "Bash" && looksLikeBashError(contentText);
     if (activeSkillName && (isMcpError || isBashError)) {
@@ -171,10 +190,15 @@ export function inferSilentRecovery(streamLines) {
 
     // Only attribute errors from Bash and mcp__ tools — consistent with extractSkillFailures.
     // Read/Write/Edit/Grep failures are caused by the user prompt, not skill instructions.
+    // Non-attributable tools are also excluded from the trail: including them triggers
+    // false-positive fallback detection whenever Claude calls Read/Write/Edit after an
+    // mcp__ error (normal diagnostic behavior, not a skill-caused fallback).
     const isAttributable = toolName === "Bash" || (typeof toolName === "string" && toolName.startsWith("mcp__"));
-    const isError =
-      isAttributable && (event.is_error === true || (toolName === "Bash" && looksLikeBashError(contentText)));
+    if (!isAttributable) continue;
+    const isError = event.is_error === true || (toolName === "Bash" && looksLikeBashError(contentText));
     trail.push({ name: toolName, isError, contentText });
+    // Evict oldest entries once trail grows past the cap so memory stays bounded.
+    if (trail.length > MAX_TRAIL_SIZE) trail.splice(0, trail.length - MAX_TRAIL_SIZE);
 
     // Retry pattern: same tool seen earlier with isError=true, now called again.
     if (trail.length >= 2) {
@@ -198,10 +222,16 @@ export function inferSilentRecovery(streamLines) {
       }
     }
 
-    // Fallback pattern: previous tool errored, this one is a different tool.
+    // Fallback pattern: previous tool errored and Claude switched to a different tool
+    // paradigm (mcp__ ↔ Bash). Limiting to paradigm shifts avoids false positives
+    // when a skill legitimately calls multiple distinct mcp__ tools in sequence and
+    // one returns a business-logic error before the next step runs.
     if (trail.length >= 2) {
       const prevEvent = trail[trail.length - 2];
-      if (prevEvent.isError && prevEvent.name !== toolName) {
+      const isMcp = (n) => typeof n === "string" && n.startsWith("mcp__");
+      const paradigmShift =
+        (isMcp(prevEvent.name) && toolName === "Bash") || (prevEvent.name === "Bash" && isMcp(toolName));
+      if (prevEvent.isError && paradigmShift) {
         const sig = `fallback::${prevEvent.name}->${toolName}`;
         const key = `${activeSkill}::${sig}`;
         if (!emitted.has(key)) {
@@ -239,8 +269,14 @@ export function inferSilentRecovery(streamLines) {
 export async function inferBypassedSkills(streamLines, projectRoot) {
   if (!projectRoot || !streamLines?.length) return [];
 
+  // Per-skill-window tracking: record which tools were called while each skill
+  // was active so that tools called by other skills or by non-skill code do not
+  // pollute the mandatory-ref check for a different skill.
+  const pendingSkill = new Map(); // toolUseId → skillName
+  const pendingToolName = new Map(); // toolUseId → toolName (all tools)
+  let activeSkill = null;
   const loadedSkills = new Set();
-  const calledToolNames = new Set();
+  const toolsCalledPerSkill = new Map(); // skillName → Set<toolName>
 
   for (const line of streamLines) {
     let event;
@@ -249,15 +285,44 @@ export async function inferBypassedSkills(streamLines, projectRoot) {
     } catch {
       continue;
     }
-    if (event.type !== "assistant") continue;
-    for (const block of event.message?.content || []) {
-      if (block.type !== "tool_use" || !block.name) continue;
-      if (block.name === "Skill") {
-        const skillName = block.input?.skill || block.input?.name || block.input?.skillName;
-        if (skillName) loadedSkills.add(skillName);
+
+    if (event.type === "assistant") {
+      for (const block of event.message?.content || []) {
+        if (block.type !== "tool_use" || !block.id) continue;
+        pendingToolName.set(block.id, block.name);
+        if (block.name === "Skill") {
+          const skillName = block.input?.skill || block.input?.name || block.input?.skillName;
+          if (skillName) pendingSkill.set(block.id, skillName);
+        }
+      }
+      continue;
+    }
+
+    if (event.type !== "tool_result" || !event.tool_use_id) continue;
+    const toolName = pendingToolName.get(event.tool_use_id);
+    pendingToolName.delete(event.tool_use_id);
+
+    const loadedSkillName = pendingSkill.get(event.tool_use_id);
+    if (loadedSkillName) {
+      pendingSkill.delete(event.tool_use_id);
+      const contentText = flattenContent(event.content);
+      if (event.is_error !== true && !isSkillNotFoundError(contentText)) {
+        activeSkill = loadedSkillName;
+        loadedSkills.add(loadedSkillName);
+        // Always reset on reload: cross-window accumulation causes false negatives
+        // where a mandatory tool called in window 1 masks a bypass in window 2.
+        toolsCalledPerSkill.set(loadedSkillName, new Set());
       } else {
-        calledToolNames.add(block.name);
+        activeSkill = null;
       }
+      continue;
+    }
+
+    // Track non-Skill tool calls at result time (not call time) so attribution
+    // reflects the skill active when the result arrived, not when the call was issued.
+    if (activeSkill && toolName && toolName !== "Skill") {
+      const set = toolsCalledPerSkill.get(activeSkill);
+      if (set) set.add(toolName);
     }
   }
 
@@ -266,7 +331,7 @@ export async function inferBypassedSkills(streamLines, projectRoot) {
   const bypassed = [];
   for (const skillName of loadedSkills) {
     const location = findSkillLocation(skillName, projectRoot);
-    if (!location) continue;
+    if (!location || location.type === "plugin-cache") continue;
     let skillMd;
     try {
       skillMd = await readFile(location.path, "utf8");
@@ -275,7 +340,8 @@ export async function inferBypassedSkills(streamLines, projectRoot) {
     }
     const mandatoryRefs = extractMandatoryMcpRefs(skillMd);
     if (mandatoryRefs.length === 0) continue;
-    const missing = mandatoryRefs.filter((t) => !calledToolNames.has(t));
+    const calledForThisSkill = toolsCalledPerSkill.get(skillName) || new Set();
+    const missing = mandatoryRefs.filter((t) => !calledForThisSkill.has(t));
     if (missing.length === 0) continue;
     // Partial bypass also counts: even if some mandatory tools were called,
     // missing any single one of them means the skill's contract was not met.
@@ -288,7 +354,7 @@ export async function inferBypassedSkills(streamLines, projectRoot) {
             ", "
           )}] (per MUST/MANDATORY/REQUIRED language in SKILL.md) but Claude called none of them. The tool is likely unavailable or the directive is unclear; either rewrite the skill to use available tools or relax the mandatory language.`
         : `Skill "${skillName}" mandates tools [${mandatoryRefs.join(", ")}] but Claude only called [${mandatoryRefs
-            .filter((t) => calledToolNames.has(t))
+            .filter((t) => calledForThisSkill.has(t))
             .join(", ")}] and skipped [${missing.join(
             ", "
           )}]. Either the missing tools are unavailable in this environment or the SKILL.md directive does not make their requirement clear enough — rewrite to remove the dependency or strengthen the instruction.`
@@ -302,7 +368,7 @@ function extractMandatoryMcpRefs(skillMd) {
   const mandatory = /\b(?:MUST|MANDATORY|REQUIRED|REQUIRE)\b/i;
   const mcpRef = /\bmcp__[a-zA-Z0-9_-]+__[a-zA-Z0-9_-]+/g;
   const lines = skillMd.split(/\r?\n/);
-  // Window: line with MUST + next 4 lines. Catches "MUST call:\n\n  mcp__..." patterns.
+  // Window: line with MUST + next 7 lines. Catches "MUST call:\n\n  mcp__..." patterns.
   for (let i = 0; i < lines.length; i++) {
     if (!mandatory.test(lines[i])) continue;
     const window = lines.slice(i, Math.min(i + 8, lines.length)).join("\n");
@@ -335,21 +401,22 @@ function isSkillNotFoundError(text) {
 // each pattern below corresponds to a real error indicator, not a generic word.
 function looksLikeBashError(text) {
   return (
-    // Python tracebacks and named exceptions
-    /\bSyntaxError\b/.test(text) ||
-    /\bNameError\b/.test(text) ||
-    /\bTypeError\b/.test(text) ||
-    /\bAttributeError\b/.test(text) ||
-    /\bImportError\b/.test(text) ||
-    /\bModuleNotFoundError\b/.test(text) ||
-    /\bValueError\b/.test(text) ||
-    /\bKeyError\b/.test(text) ||
-    /\bIndexError\b/.test(text) ||
-    /\bRuntimeError\b/.test(text) ||
-    /\bFileNotFoundError\b/.test(text) ||
-    /\bJSONDecodeError\b/.test(text) ||
-    /\bOSError\b/.test(text) ||
-    /\bAssertionError\b/.test(text) ||
+    // Python tracebacks and named exceptions — require ":" to avoid matching
+    // class names in test output, documentation, or log messages (e.g. "0 TypeError cases").
+    /\bSyntaxError:/.test(text) ||
+    /\bNameError:/.test(text) ||
+    /\bTypeError:/.test(text) ||
+    /\bAttributeError:/.test(text) ||
+    /\bImportError:/.test(text) ||
+    /\bModuleNotFoundError:/.test(text) ||
+    /\bValueError:/.test(text) ||
+    /\bKeyError:/.test(text) ||
+    /\bIndexError:/.test(text) ||
+    /\bRuntimeError:/.test(text) ||
+    /\bFileNotFoundError:/.test(text) ||
+    /\bJSONDecodeError:/.test(text) ||
+    /\bOSError:/.test(text) ||
+    /\bAssertionError:/.test(text) ||
     /\bTraceback \(most recent call last\)/.test(text) ||
     // Node.js / npm / build tool errors
     /\bnpm\s+ERR!/.test(text) ||
@@ -360,7 +427,7 @@ function looksLikeBashError(text) {
     /\bCannot find module\b/i.test(text) ||
     /\bis not recognized as an? (?:internal or external )?command\b/i.test(text) ||
     // POSIX shell + filesystem
-    /\bcommand not found\b/.test(text) ||
+    /:\s*command not found\b/.test(text) ||
     /\bNo such file or directory\b/.test(text) ||
     /\bpermission denied\b/i.test(text) ||
     /\[Errno\s+\d+\]/.test(text) ||

package/src/skills/fixer.js

@@ -1,9 +1,13 @@
-import { execFileSync } from "node:child_process";
-import { mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdir, mkdtemp, readdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import process from "node:process";
-import { parseRepoUrl } from "../forge/repo-host.js";
+import { promisify } from "node:util";
+import { buildGitEnvForRepoUrl, parseRepoUrl } from "../forge/repo-host.js";
+
+const execFileAsync = promisify(execFile);
 
 // Multi-file schema: each file in the skill directory can be fixed independently.
 // Backward-compat: single-file skills only need to return [{path:"SKILL.md", content}].
@@ -39,7 +43,7 @@ Rules:
 - Each file path must be relative to the skill directory (e.g. "SKILL.md", "scripts/run.py")
 - reason must be one sentence explaining the root cause`;
 
-const SKILL_FIX_TIMEOUT_MS = 60_000;
+const SKILL_FIX_TIMEOUT_MS = 90_000;
 
 // Per-repo serialization: one PR creation at a time per repo. Different repos
 // run in parallel. Keyed by absolute project root path. Worktree creation under
@@ -57,10 +61,24 @@ export async function readSkillFiles(skillDir, _subdir = "") {
   for (const entry of entries) {
     if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
     const relPath = _subdir ? `${_subdir}/${entry.name}` : entry.name;
-    if (entry.isFile()) {
-      const content = await readFile(path.join(skillDir, relPath), "utf8").catch(() => null);
+    const absPath = path.join(skillDir, relPath);
+    // Follow symlinks: entry.isFile()/isDirectory() return false for symlinks;
+    // resolve via stat() so symlinked scripts and subdirs are included.
+    let isFile = entry.isFile();
+    let isDir = entry.isDirectory();
+    if (entry.isSymbolicLink()) {
+      try {
+        const s = await stat(absPath);
+        isFile = s.isFile();
+        isDir = s.isDirectory();
+      } catch {
+        continue; // dangling symlink — skip
+      }
+    }
+    if (isFile) {
+      const content = await readFile(absPath, "utf8").catch(() => null);
       if (content !== null) files.push({ path: relPath, content });
-    } else if (entry.isDirectory() && !_subdir) {
+    } else if (isDir && !_subdir) {
       // one level of subdirectory traversal
       files.push(...(await readSkillFiles(skillDir, entry.name)));
     }
@@ -103,6 +121,7 @@ Produce fixed versions. Return all skill files in the files array (include unmod
 
   try {
     return await invokeClaudeTask(SKILL_FIX_SCHEMA, SKILL_FIX_SYSTEM, userPrompt, {
+      effort: "low",
       runOpts: {
         cwd: projectRoot,
         timeout: SKILL_FIX_TIMEOUT_MS,
@@ -132,9 +151,31 @@ Produce fixed versions. Return all skill files in the files array (include unmod
 export async function applySkillFix({ skillName, files, reason, location, projectRoot, logger }) {
   if (location.type === "global") {
     try {
-      await writeSkillFiles(files, location.dir);
-      logger?.info("skill-fix: patched global skill", { skill: skillName, files: files.length });
-      return { status: "patched", path: location.dir };
+      // No-op check: skip write if generated content matches what's already on disk.
+      const resolvedDir = path.resolve(location.dir);
+      let anyChanged = false;
+      for (const { path: relPath, content } of files) {
+        if (path.isAbsolute(relPath) || relPath.includes("..")) continue;
+        const absPath = path.resolve(path.join(location.dir, relPath));
+        if (!absPath.startsWith(resolvedDir + path.sep) && absPath !== resolvedDir) continue;
+        try {
+          const existing = await readFile(absPath, "utf8");
+          if (existing !== content) {
+            anyChanged = true;
+            break;
+          }
+        } catch {
+          anyChanged = true; // file doesn't exist yet
+          break;
+        }
+      }
+      if (!anyChanged) {
+        logger?.info("skill-fix: global skill already up to date, skipping", { skill: skillName });
+        return { status: "no-op" };
+      }
+      const written = await writeSkillFiles(files, location.dir);
+      logger?.info("skill-fix: patched global skill", { skill: skillName, files: written });
+      return { status: "patched", path: location.dir, filesWritten: written };
     } catch (err) {
       logger?.error("skill-fix: global patch failed", { skill: skillName, error: err?.message });
       return { status: "error", error: err?.message };
@@ -165,65 +206,89 @@ export async function applySkillFix({ skillName, files, reason, location, projec
  */
 async function writeSkillFiles(files, skillDir) {
   const resolvedDir = path.resolve(skillDir);
+  let written = 0;
   for (const { path: relPath, content } of files) {
     if (path.isAbsolute(relPath) || relPath.includes("..")) continue;
     const absPath = path.resolve(path.join(skillDir, relPath));
     if (!absPath.startsWith(resolvedDir + path.sep) && absPath !== resolvedDir) continue;
     await mkdir(path.dirname(absPath), { recursive: true });
     await writeFile(absPath, content, "utf8");
+    written++;
   }
+  return written;
 }
 
 function sanitizeBranchSegment(name) {
-  return name
+  const sanitized = name
     .replace(/[^a-z0-9-]/gi, "-")
     .replace(/-+/g, "-")
     .replace(/^-|-$/g, "")
     .toLowerCase();
+  // Short hash prevents collision when distinct skill names sanitize to the same string
+  // (e.g. "my-skill" and "my_skill" both become "my-skill" without the hash).
+  const hash = createHash("sha1").update(name).digest("hex").slice(0, 6);
+  return `${sanitized}-${hash}`;
 }
 
-function detectProvider(projectRoot) {
+async function detectProvider(projectRoot) {
   try {
-    const remoteUrl = execFileSync("git", ["remote", "get-url", "origin"], {
+    const { stdout } = await execFileAsync("git", ["remote", "get-url", "origin"], {
       cwd: projectRoot,
       encoding: "utf8",
       timeout: 5000
-    }).trim();
+    });
+    const remoteUrl = stdout.trim();
     const repo = parseRepoUrl(remoteUrl);
-    return { provider: repo.provider, repo };
+    return { provider: repo.provider, repo, remoteUrl };
   } catch {
-    return { provider: "github", repo: null };
+    return { provider: "github", repo: null, remoteUrl: null };
   }
 }
 
-function getDefaultBranch(projectRoot) {
+async function getDefaultBranch(projectRoot) {
   // First try: symbolic-ref (instant, works when origin/HEAD is configured).
   try {
-    return execFileSync("git", ["symbolic-ref", "refs/remotes/origin/HEAD", "--short"], {
+    const { stdout } = await execFileAsync("git", ["symbolic-ref", "refs/remotes/origin/HEAD", "--short"], {
       cwd: projectRoot,
       encoding: "utf8",
       timeout: 5000
-    })
-      .trim()
-      .replace(/^origin\//, "");
+    });
+    return stdout.trim().replace(/^origin\//, "");
   } catch {}
   // Second try: `git remote show origin` — requires network but always reports HEAD.
   // Used when the repo was cloned with --single-branch and origin/HEAD is unset.
   try {
-    const out = execFileSync("git", ["remote", "show", "origin"], {
+    const { stdout } = await execFileAsync("git", ["remote", "show", "origin"], {
       cwd: projectRoot,
       encoding: "utf8",
       timeout: 15000
     });
-    const match = out.match(/HEAD branch:\s*(\S+)/);
+    const match = stdout.match(/HEAD branch:\s*(\S+)/);
     if (match?.[1] && match[1] !== "(unknown)") return match[1];
   } catch {}
+  // Third try: scan existing remote-tracking refs for known default names.
+  // Local/no-network. Handles repos cloned with --single-branch where origin/HEAD
+  // is unset and git remote show fails.
+  try {
+    const { stdout } = await execFileAsync("git", ["branch", "-r", "--format=%(refname:short)"], {
+      cwd: projectRoot,
+      encoding: "utf8",
+      timeout: 5000
+    });
+    const refs = stdout
+      .trim()
+      .split(/\r?\n/)
+      .map((l) => l.trim());
+    for (const name of ["main", "master", "develop", "trunk"]) {
+      if (refs.includes(`origin/${name}`)) return name;
+    }
+  } catch {}
   return "main";
 }
 
 async function createSkillFixPR({ skillName, files, reason, location, projectRoot, logger }) {
   const branch = `fix/skill-${sanitizeBranchSegment(skillName)}`;
-  const { provider, repo } = detectProvider(projectRoot);
+  const { provider, repo, remoteUrl } = await detectProvider(projectRoot);
 
   // Fail fast for GitLab if token missing — without an MR API call we cannot
   // ship the fix upstream, and writing into the active working tree would
@@ -234,14 +299,35 @@ async function createSkillFixPR({ skillName, files, reason, location, projectRoo
     return { status: "error", error: msg };
   }
 
-  // Idempotency: skip if PR/MR already open
+  // Warn for GitHub if PAT is missing — git push will fall back to system
+  // credential helpers which may not be configured in containers / CI.
+  if (provider === "github" && !process.env.GITHUB_PAT) {
+    logger?.warn?.(
+      "skill-fix: GITHUB_PAT not set — git push will rely on system credential helper (may fail in CI/container)",
+      { skill: skillName }
+    );
+  }
+
+  // Build auth env so git fetch + push work in environments without a system
+  // credential helper (containers, CI). Mirrors how repo.js authenticates.
+  const gitAuthEnv = remoteUrl ? buildGitEnvForRepoUrl(remoteUrl) : undefined;
+
+  // Idempotency: skip if PR/MR already open.
+  // null = API unreachable; log and proceed rather than silently skipping (risk of
+  // duplicate is low; failing to fix would be worse than a duplicate PR).
   const existing = await findExistingPR({ branch, provider, repo, projectRoot });
-  if (existing) {
+  if (existing === true) {
     logger?.info?.("skill-fix: PR/MR already open, skipping", { skill: skillName, branch });
     return { status: "pr-exists" };
   }
+  if (existing === null) {
+    logger?.warn?.("skill-fix: could not check for existing PR/MR (API error), proceeding", {
+      skill: skillName,
+      branch
+    });
+  }
 
-  const defaultBranch = getDefaultBranch(projectRoot);
+  const defaultBranch = await getDefaultBranch(projectRoot);
   const safeReason = reason.slice(0, 250);
   const commitMsg = `fix(skill): auto-patch ${skillName}\n\n${safeReason}`;
   const prTitle = `fix(skill): auto-patch ${skillName}`;
@@ -255,18 +341,27 @@ async function createSkillFixPR({ skillName, files, reason, location, projectRoo
   try {
     // Pull latest default branch so the fix is based on current HEAD, not stale local state.
     try {
-      execFileSync("git", ["fetch", "origin", defaultBranch], { cwd: projectRoot, timeout: 60000 });
-    } catch {}
+      await execFileAsync("git", ["fetch", "origin", defaultBranch], {
+        cwd: projectRoot,
+        timeout: 60000,
+        ...(gitAuthEnv && { env: gitAuthEnv })
+      });
+    } catch (fetchErr) {
+      logger?.warn?.("skill-fix: fetch failed, proceeding with stale base — fix PR may conflict on merge", {
+        skill: skillName,
+        error: fetchErr?.message
+      });
+    }
 
     // Prune stale worktree registrations left by prior SIGKILL — otherwise
     // `git worktree add -B branch` fails if the branch is still "checked out"
     // at a now-deleted tmp path.
     try {
-      execFileSync("git", ["worktree", "prune"], { cwd: projectRoot, timeout: 10000 });
+      await execFileAsync("git", ["worktree", "prune"], { cwd: projectRoot, timeout: 10000 });
     } catch {}
 
     // -B: create or reset branch to point at origin/<defaultBranch>
-    execFileSync("git", ["worktree", "add", "-B", branch, worktreePath, `origin/${defaultBranch}`], {
+    await execFileAsync("git", ["worktree", "add", "-B", branch, worktreePath, `origin/${defaultBranch}`], {
       cwd: projectRoot,
       timeout: 15000
     });
@@ -281,34 +376,55 @@ async function createSkillFixPR({ skillName, files, reason, location, projectRoo
     await mkdir(worktreeSkillDir, { recursive: true });
     await writeSkillFiles(files, worktreeSkillDir);
 
-    execFileSync("git", ["add", skillRelDir], { cwd: worktreePath, timeout: 10000 });
+    await execFileAsync("git", ["add", skillRelDir], { cwd: worktreePath, timeout: 10000 });
 
     // No-op fix detection: nothing actually changed → skip empty commit/PR.
-    const diffStatus = execFileSync("git", ["diff", "--cached", "--name-only"], {
+    const { stdout: diffStatus } = await execFileAsync("git", ["diff", "--cached", "--name-only"], {
       cwd: worktreePath,
       encoding: "utf8",
       timeout: 10000
-    }).trim();
-    if (!diffStatus) {
+    });
+    if (!diffStatus.trim()) {
       logger?.info?.("skill-fix: no file changes after generation, skipping PR", { skill: skillName });
       return { status: "no-op" };
     }
 
-    execFileSync("git", ["commit", "-m", commitMsg], { cwd: worktreePath, timeout: 10000 });
+    const changedFileCount = diffStatus.trim().split("\n").filter(Boolean).length;
+    // Inject git identity so commit succeeds in containers where user.name/email are unset.
+    await execFileAsync(
+      "git",
+      [
+        "-c",
+        "user.email=skill-fixer@claude-teammate.local",
+        "-c",
+        "user.name=Claude Teammate",
+        "commit",
+        "-m",
+        commitMsg
+      ],
+      { cwd: worktreePath, timeout: 10000 }
+    );
     // --force-with-lease: safe retry after partial failure — only overwrites if remote matches expected
-    execFileSync("git", ["push", "--force-with-lease", "-u", "origin", branch], { cwd: worktreePath, timeout: 60000 });
+    await execFileAsync("git", ["push", "--force-with-lease", "-u", "origin", branch], {
+      cwd: worktreePath,
+      timeout: 60000,
+      ...(gitAuthEnv && { env: gitAuthEnv })
+    });
 
     const prUrl = await openPR({ branch, prTitle, safeReason, defaultBranch, provider, repo, projectRoot });
 
-    logger?.info?.("skill-fix: PR/MR created", { skill: skillName, pr: prUrl });
-    return { status: "pr-created", prUrl };
+    logger?.info?.("skill-fix: PR/MR created", { skill: skillName, pr: prUrl, filesWritten: changedFileCount });
+    return { status: "pr-created", prUrl, filesWritten: changedFileCount };
   } catch (err) {
     logger?.error?.("skill-fix: PR/MR creation failed", { skill: skillName, error: err?.message });
     return { status: "error", error: err?.message };
   } finally {
     if (worktreeAttached) {
       try {
-        execFileSync("git", ["worktree", "remove", "--force", worktreePath], { cwd: projectRoot, timeout: 10000 });
+        await execFileAsync("git", ["worktree", "remove", "--force", worktreePath], {
+          cwd: projectRoot,
+          timeout: 10000
+        });
       } catch {}
     }
     try {
@@ -317,6 +433,8 @@ async function createSkillFixPR({ skillName, files, reason, location, projectRoo
   }
 }
 
+// Returns true (PR exists), false (no PR), or null (API call failed — caller should proceed
+// with caution and log a warning rather than treating as "no PR").
 async function findExistingPR({ branch, provider, repo, projectRoot }) {
   try {
     if (provider === "gitlab" && repo) {
@@ -324,23 +442,27 @@ async function findExistingPR({ branch, provider, repo, projectRoot }) {
       if (!token) return false;
       const projectId = encodeURIComponent(repo.path);
       const url = `${repo.origin}/api/v4/projects/${projectId}/merge_requests?state=opened&source_branch=${encodeURIComponent(branch)}&per_page=1`;
-      const out = execFileSync("curl", ["-sf", "--max-time", "30", "-H", `PRIVATE-TOKEN: ${token}`, url], {
-        encoding: "utf8",
-        timeout: 35000
-      });
-      const parsed = JSON.parse(out);
+      const { stdout } = await execFileAsync(
+        "curl",
+        ["-sf", "--max-time", "30", "-H", `PRIVATE-TOKEN: ${token}`, url],
+        { encoding: "utf8", timeout: 35000 }
+      );
+      const parsed = JSON.parse(stdout);
       if (parsed?.message) throw new Error(`GitLab API error: ${parsed.message}`);
       return Array.isArray(parsed) && parsed.length > 0;
     }
     // GitHub
-    const out = execFileSync(
+    const { stdout } = await execFileAsync(
       "gh",
       ["pr", "list", "--head", branch, "--state", "open", "--json", "number", "--jq", "length"],
       { cwd: projectRoot, encoding: "utf8", timeout: 30000 }
-    ).trim();
+    );
+    const out = stdout.trim();
     return out !== "0" && out !== "";
   } catch {
-    return false;
+    // Return null so the caller can distinguish "no PR found" from "API unavailable".
+    // Callers must not silently treat this as "no PR" to avoid creating duplicates.
+    return null;
   }
 }
 
@@ -357,7 +479,7 @@ async function openPR({ branch, prTitle, safeReason, defaultBranch, provider, re
       description: safeReason,
       remove_source_branch: true
     });
-    const out = execFileSync(
+    const { stdout } = await execFileAsync(
       "curl",
       [
         "-sf",
@@ -375,13 +497,13 @@ async function openPR({ branch, prTitle, safeReason, defaultBranch, provider, re
       ],
       { encoding: "utf8", timeout: 35000 }
     );
-    const parsed = JSON.parse(out);
+    const parsed = JSON.parse(stdout);
     if (parsed?.message) throw new Error(`GitLab API error: ${parsed.message}`);
     return parsed.web_url || url;
   }
 
   // GitHub — `gh pr create` may print warnings before the URL; take the last non-empty line.
-  const ghOut = execFileSync(
+  const { stdout: ghOut } = await execFileAsync(
     "gh",
     ["pr", "create", "--title", prTitle, "--body", safeReason, "--base", defaultBranch],
     { cwd: projectRoot, encoding: "utf8", timeout: 30000 }

package/src/skills/index.js

@@ -1,10 +1,11 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
+import process from "node:process";
 import { extractSkillFailures, inferBypassedSkills, inferSilentRecovery } from "./detector.js";
 import { applySkillFix, generateSkillFix, readSkillFiles } from "./fixer.js";
-import { findSkillLocation } from "./locator.js";
+import { findSkillLocationInRoots } from "./locator.js";
 
-const SKILL_FIX_EVENTS_MAX = 50;
+const SKILL_FIX_EVENTS_MAX = parseInt(process.env.SKILL_FIX_EVENTS_MAX || "200", 10);
 
 // Module-level lock: prevents concurrent fix attempts for the same skill
 // (multiple tasks can detect the same failing skill simultaneously)
@@ -77,6 +78,13 @@ async function _detectAndFix({
   ];
   if (failures.length === 0) return;
 
+  if (!eventsRoot) {
+    logger?.warn?.(
+      "skill-fix: eventsRoot not provided — events will be written to projectRoot; pass eventsRoot to avoid writing skill-fixes.json into the cloned repo",
+      { projectRoot }
+    );
+  }
+
   await fixSkillsAsync(
     failures,
     projectRoot,
@@ -95,12 +103,19 @@ async function fixSkillsAsync(failures, projectRoot, eventsRoot, logger, invokeC
   // single fix run so the model sees the full failure picture.
   const grouped = new Map();
   for (const f of failures) {
-    if (!f?.skillName || f.skillName === "unknown") continue;
+    if (!f?.skillName || f.skillName === "unknown") {
+      logger?.warn?.(
+        "skill-fix: skill name resolved to 'unknown' — Skill tool input format may have changed; check block.input key names",
+        { failure: f }
+      );
+      continue;
+    }
     const existing = grouped.get(f.skillName);
     if (!existing) {
       grouped.set(f.skillName, { ...f });
     } else {
-      existing.errorContent = `${existing.errorContent}\n---\n[${f.errorType}]\n${f.errorContent || ""}`.slice(0, 1800);
+      const combined = `${existing.errorContent}\n---\n[${f.errorType}]\n${f.errorContent || ""}`;
+      existing.errorContent = combined.length > 1800 ? `${combined.slice(0, 1797)}…` : combined;
       // Keep the first errorType as the primary classification for telemetry,
       // but tag composite when more than one mode contributed.
       if (existing.errorType !== f.errorType && !existing.errorType.endsWith("+")) {
@@ -143,13 +158,17 @@ async function fixSkillsAsync(failures, projectRoot, eventsRoot, logger, invokeC
  * Haiku already classified it — this applies the fix using user correction as context.
  * Fire-and-forget safe: never throws.
  *
- * projectRoot: cloned repo path (skill lookup + git PR).
+ * projectRoot: primary cloned repo path (skill lookup + git PR).
+ * projectRoots: optional array of all cloned repo paths to search for the skill.
+ *               Handles multi-repo projects where a skill may live in any repo.
+ *               Falls back to [projectRoot] when omitted.
  * eventsRoot: claude-teammate root (event log destination).
  */
 export function scheduleSkillFixWithFeedback({
   skillName,
   correctionSummary,
   projectRoot,
+  projectRoots,
   eventsRoot,
   logger,
   invokeClaudeTask,
@@ -175,6 +194,7 @@ export function scheduleSkillFixWithFeedback({
     errorContent: `User correction: ${correctionSummary}`,
     errorType: "user-feedback",
     projectRoot,
+    projectRoots,
     eventsRoot: eventsRoot || projectRoot,
     logger,
     invokeClaudeTask,
@@ -190,18 +210,32 @@ async function fixSingleSkill({
   errorContent,
   errorType,
   projectRoot,
+  projectRoots,
   eventsRoot,
   logger,
   invokeClaudeTask,
   epicContext,
   issueKey
 }) {
-  const location = findSkillLocation(skillName, projectRoot);
+  // Search all provided repo roots so multi-repo projects can find skills in any repo.
+  const roots = Array.isArray(projectRoots) && projectRoots.length > 0 ? projectRoots : [projectRoot];
+  const location = findSkillLocationInRoots(skillName, roots);
   if (!location) {
-    logger?.info("skill-fix: skill file not found, skipping", { skill: skillName, projectRoot });
+    logger?.info("skill-fix: skill file not found in any project root, skipping", {
+      skill: skillName,
+      roots
+    });
     await appendSkillFixEvent(eventsRoot, { skill: skillName, errorType, status: "not-found" });
     return;
   }
+  if (location.type === "plugin-cache") {
+    logger?.info(
+      "skill-fix: plugin-cache skill is out of scope for auto-fix (owned by plugin author; update the plugin to fix)",
+      { skill: skillName }
+    );
+    await appendSkillFixEvent(eventsRoot, { skill: skillName, errorType, status: "scope-excluded" });
+    return;
+  }
 
   const skillFiles = await readSkillFiles(location.dir);
   if (skillFiles.length === 0) {
@@ -251,6 +285,15 @@ async function fixSingleSkill({
     return;
   }
 
+  // Ensure the model returned ALL files: if any input file is absent from the fix
+  // output, preserve its original content so we never silently drop skill files.
+  const returnedPaths = new Set(fix.files.map((f) => f.path));
+  for (const original of skillFiles) {
+    if (!returnedPaths.has(original.path)) {
+      fix.files.push({ path: original.path, content: original.content });
+    }
+  }
+
   const result = await applySkillFix({
     skillName,
     files: fix.files,
@@ -268,16 +311,16 @@ async function fixSingleSkill({
     status: result.status,
     prUrl: result.prUrl,
     error: result.error,
-    files: fix.files.length
+    files: result.filesWritten ?? fix.files.length
   });
 }
 
-// In-process mutex for skill-fixes.json. The file is read-modify-written, and
-// concurrent fixes (different skills, different repos) can interleave reads
-// and lose events. Serializing all writes through a single chained promise
-// inside this process eliminates the race for our single-worker deployment.
+// In-process mutex for skill-fixes.json, keyed per eventsRoot so different roots
+// don't serialize against each other (relevant in tests and future multi-tenant use).
+// The file is read-modify-written; chaining all writes through one promise per path
+// eliminates interleaved-read races within this process.
 // Multi-process deployments would need a file lock (flock); not applicable here.
-let _eventsWriteChain = Promise.resolve();
+const _eventsWriteChains = new Map();
 
 async function appendSkillFixEvent(eventsRoot, fields) {
   if (!eventsRoot) return;
@@ -297,9 +340,14 @@ async function appendSkillFixEvent(eventsRoot, fields) {
       // never throw — event logging is best-effort
     }
   };
-  // Chain after previous job; .catch keeps chain alive on rejection.
-  const next = _eventsWriteChain.then(job, job);
-  _eventsWriteChain = next.catch(() => {});
+  const prev = _eventsWriteChains.get(eventsRoot) || Promise.resolve();
+  const next = prev.then(job, job);
+  const queued = next.catch(() => {});
+  _eventsWriteChains.set(eventsRoot, queued);
+  // Remove key once settled so the Map doesn't grow unboundedly.
+  queued.finally(() => {
+    if (_eventsWriteChains.get(eventsRoot) === queued) _eventsWriteChains.delete(eventsRoot);
+  });
   return next;
 }
 

package/src/skills/locator.js

@@ -3,28 +3,33 @@ import { homedir } from "node:os";
 import path from "node:path";
 
 /**
- * Find where a skill's SKILL.md lives.
- * Returns { path, type: 'repo' | 'global' } or null.
+ * Find where a skill's SKILL.md lives, searching multiple project roots.
+ * Returns { path, type: 'repo' | 'global', dir } or null.
  *
  * Skill structure on disk: {root}/skills/{skillName}/SKILL.md
  *
  * Repo skills  → fix via PR.
  * Global skills → fix in-place, notify user.
+ * Plugin-cache → out of scope for auto-fix (owned by plugin authors).
+ *
+ * Checks all repo-level skill dirs first (in order), then global.
+ * This handles multi-repo projects where a skill may live in any cloned repo.
  */
-export function findSkillLocation(skillName, projectRoot) {
-  // Normalize: strip leading slash, plugin prefix ("plugin:skill" → "skill")
+export function findSkillLocationInRoots(skillName, projectRoots) {
   const raw = String(skillName || "")
     .replace(/^\//, "")
     .trim();
-  const base = raw.includes(":") ? raw.split(":").pop() : raw;
-  // Reject empty, dotfiles, or path traversal attempts
+  const isPluginPrefixed = raw.includes(":");
+  const base = isPluginPrefixed ? raw.split(":").pop() : raw;
   if (!base || base.startsWith(".") || base.includes("/") || base.includes("\\")) return null;
 
   const home = homedir();
+  const roots = Array.isArray(projectRoots) ? projectRoots.filter(Boolean) : [];
+
   // Only repo-level and user-level skill dirs are managed; plugin cache skills
   // are owned by their plugin authors and intentionally out of scope.
   const candidates = [
-    { root: path.join(projectRoot, ".claude", "skills"), type: "repo" },
+    ...roots.map((root) => ({ root: path.join(root, ".claude", "skills"), type: "repo" })),
     { root: path.join(home, ".claude", "skills"), type: "global" }
   ].map((c) => ({ ...c, path: path.join(c.root, base, "SKILL.md") }));
 
@@ -32,7 +37,17 @@ export function findSkillLocation(skillName, projectRoot) {
     const resolved = path.resolve(c.path);
     return resolved.startsWith(path.resolve(c.root)) && existsSync(c.path);
   });
-  if (!found) return null;
-  // dir: skill directory containing SKILL.md and any companion scripts
+  if (!found) {
+    // Plugin-namespaced skills (e.g. "caveman:caveman", "plugin:figma:figma-use") that are
+    // not overridden by a repo or global skill are owned by their plugin author and
+    // intentionally out of scope for auto-fix. Return a distinct marker so callers can
+    // log "scope-excluded" instead of the misleading "not-found".
+    return isPluginPrefixed ? { type: "plugin-cache", path: null, dir: null } : null;
+  }
   return { ...found, dir: path.dirname(found.path) };
 }
+
+/** Single-root convenience wrapper — backward-compatible. */
+export function findSkillLocation(skillName, projectRoot) {
+  return findSkillLocationInRoots(skillName, projectRoot ? [projectRoot] : []);
+}

package/src/worker/jira-issue-workflow.js

@@ -255,7 +255,9 @@ export async function processJiraIssue({
       botUser,
       jira,
       projectRoot,
-      eventsRoot: projectRoot,
+      // eventsRoot intentionally omitted — triggerSkillFeedbackFix defaults to
+      // CLAUDE_TEAMMATE_ROOT (the stable teammate process root), which is correct.
+      // Passing projectRoot here would write events into the cloned repo dir instead.
       liveRepos,
       issueMemory,
       issueMemoryRecord,
@@ -769,7 +771,9 @@ export async function maybeCheckSkillCorrection({
     .sort(compareCommentsNewestFirst)
     .find((c) => jira.isBotAuthor(c.author, botUser) && getCommentTimestamp(c) < humanTs);
 
-  const repoCwd = liveRepos?.find((r) => r?.local_path)?.local_path || projectRoot;
+  // Collect all repo local paths so the skill fixer can search every cloned repo.
+  const allRepoPaths = (liveRepos || []).map((r) => r?.local_path).filter(Boolean);
+  const repoCwd = allRepoPaths[0] || projectRoot;
 
   // Fire-and-forget by design: run-1 already produced the broken output, run-2
   // (next poll cycle) will pick up the fixed skill. We do not block the main
@@ -791,6 +795,7 @@ export async function maybeCheckSkillCorrection({
         skillName: result.skillName,
         correctionSummary: result.correctionSummary,
         projectRoot: repoCwd,
+        projectRoots: allRepoPaths.length > 0 ? allRepoPaths : undefined,
         eventsRoot,
         logger,
         epicContext,