Two doc nits from #981 review: (1) CLAUDE.md's 'Not auto-registered' paragraph used
'integrations/<name>/src/index.ts' in one sentence and 'integrations/<name>-mcp' two
sentences later — <name> meant two different things; align both to <name>-mcp.
(2) skills/pw/SKILL.md 'What's Included' listed '2 MCP servers ... integrations' with no
caveat, unlike README's equivalent line — add '(optional — not auto-registered)'.
dev landed a parallel #978 fix (deleted .mcp.json, added integrations/mcp-servers.example.json
opt-in template + README flow). Per maintainer decision, keep this PR's approach:
- README.md resolved to this branch's version (softened tagline/commands/heading + caveats).
- .mcp.json kept as empty {"mcpServers":{}} (servers not auto-registered).
- Restored dev's mcp-servers.example.json in full (a rename-merge artifact had gutted it to {}).
- Retains this PR's additive doc softening dev lacked: plugin.json + marketplace.json
descriptions, CLAUDE.md + testrail/browserstack/pw SKILL.md caveats.
All other dev changes merged cleanly.
Earlier commits added a caveat before 'Integrations Setup' but left three earlier
spots in the same README describing TestRail/BrowserStack as working out of the box:
the H1 tagline, the /pw:testrail + /pw:browserstack Commands-table rows, and the
'2 MCP Integrations' heading under What's Inside. Add pointers/caveats to each so a
reader skimming the top of the README gets the same 'optional, manually enabled'
signal. Per review feedback on #981.
The CLAUDE.md caveat said 'cd integrations/<name>' but the real directories are
integrations/testrail-mcp and integrations/browserstack-mcp (the -mcp suffix that the
removed .mcp.json used and that the other four touched docs already spell correctly).
Following it literally would cd into a nonexistent dir. Per review feedback on #981.
Marketplace listing said 'sync with TestRail, run on BrowserStack' which reads as
out-of-the-box capability; the integrations now require manual enablement. Reword to
'optional (manually enabled) TestRail/BrowserStack integrations' so the listing itself
doesn't oversell. Per review feedback on #981.
Addresses review feedback on #981: README.md, skills/pw/SKILL.md, and the
testrail/browserstack SKILL.md files still described the integrations as working
after just exporting env vars. Add a caveat to each that pw-testrail/pw-browserstack
are no longer auto-registered and that /pw:testrail // /pw:browserstack (and the
testrail_*/browserstack_* MCP tools) fail with 'tool not found' until the server is
enabled manually, pointing to the CLAUDE.md Integrations section.
The pw-testrail and pw-browserstack servers were declared in playwright-pro/.mcp.json
and launched via `npx tsx integrations/<name>/src/index.ts`, but the plugin ships no
node_modules and nothing installs @modelcontextprotocol/sdk. Both therefore failed to
connect for every user — permanent 'Failed to connect' lines in `claude mcp list` —
whether or not TestRail/BrowserStack was configured.
Empty the .mcp.json server map (no build systems per repo convention; the integration
TS sources stay in-tree) and document in CLAUDE.md that the two integrations are no
longer auto-registered plus how to enable them manually (npm install + user/project
MCP config).
The two MCP servers registered in .mcp.json could never start: their
@modelcontextprotocol/sdk dependency is declared but never installed
(the plugin ships no node_modules and nothing runs npm install), so every
user saw a permanent 'Failed to connect' pair in `claude mcp list`.
Per the reporter's option 4 + docs: the registrations move to
integrations/mcp-servers.example.json (no longer auto-loaded), and the
README's Integrations Setup section now documents the two-step opt-in
(npm install inside the integration folder, copy the example to .mcp.json).
The integrations themselves are unchanged and keep working for users who
enable them.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qgc6RYXWJPr5oW9DHU7zR4
Round-2 sweep after re-auditing all 15 reported issues against the merged dev:
- #885 generalized: the original fix only renamed self-improving-agent's
status/review, but three more plugins shipped skills whose bare names
shadow Claude Code built-ins. Renamed with the same convention:
playwright-pro init/review -> pw-init/pw-review, agenthub init/status ->
hub-init/hub-status, autoresearch-agent status/resume -> ar-status/
ar-resume. All command references (/pw: /hub: /ar:), docs, audit records,
harness manifests, and mirror trees/indexes updated; the flat mirror
namespace no longer collides on 'status'. New scripts/check_skill_names.py
gate (wired into ci-quality-gate.yml as blocking) fails CI on any future
bare reserved name; rule added to SKILL-AUTHORING-STANDARD.md.
- #969 follow-through: five more scripts print box-drawing characters that
cannot exist in cp1252 (api_scorecard, api_linter,
breaking_change_detector, humanizer_scorer, content_scorer) — same
guarded UTF-8 reconfigure applied; all smoke-tested under a forced
legacy encoding.
Verified: check_skill_names (incl. negative test), check_plugin_json,
check_paths, derive_counters, check_dual_publish, smoke_scripts (634/634),
0 broken mirror symlinks.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qgc6RYXWJPr5oW9DHU7zR4
- #954: strip non-spec source/attribution keys from all 39 plugin.json
manifests so Claude Code's validator accepts them; metadata preserved in
new .claude-plugin/authoring-notes.json sidecars; check_plugin_json.py now
hard-fails manifests carrying those keys and sanity-checks the sidecar;
CLAUDE.md ClawHub schema section updated to the new rule.
- #949: move the c-level-agents plugin out of c-level-advisor/ to a
top-level directory so the two marketplace sources no longer overlap;
updated marketplace.json source, homepage, descriptions, all
cross-references, docs, harness manifest, mirror-tree symlinks/indexes,
and rebased the moved files' relative links; domain counters trued up
(18 -> 19 domains).
- #933: replace dead links to the gitignored maintainer-local megaprompts/
tree with annotated plain-text references (44 files: SKILL.md, READMEs,
agents, commands).
- #931: DynamoDB on-demand pricing updated to post-Nov-2024 rates
($0.625/M writes, $0.125/M strongly consistent reads).
- #969: skill_security_auditor.py and the three dossier scripts reconfigure
stdout/stderr to UTF-8 (errors=replace) so legacy Windows codepages no
longer crash at print time; PYTHONUTF8=1 documented.
- #968: Windows Notes section in INSTALLATION.md + README pointer for the
core.symlinks mirror-tree checkout caveat.
- #924/#885 residuals: hook commands quote "${CLAUDE_PLUGIN_ROOT}" paths in
all plugin hooks.json/settings.json (space-safe roots); removed the stale
pre-rename status/review mirror symlinks and index entries left over from
the memory-status/memory-review rename.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qgc6RYXWJPr5oW9DHU7zR4
Clears every reference the new G7 lint flags, then makes it blocking so the
class cannot drift back. audit/engineering-agentic-2026-07 marked the
senior-ml-engineer half of this STILL-OPEN.
Deleted rather than updated:
- agent-designer/agent_evaluator.py's _define_cost_benchmarks() held
per-token prices for gpt-4, gpt-3.5-turbo and claude-3 at 2024 rates. The
result was assigned to self.cost_benchmarks and never read by anything, so
the method is gone. Cost analysis uses the cost_usd the caller supplies per
execution log, which is the only figure that can be accurate
Made model-agnostic, following the precedent already set by
senior-prompt-engineer/scripts/prompt_optimizer.py's --price-per-mtok:
- senior-ml-engineer SKILL.md and llm_integration_guide.md drop both 2024
price tables and the context-window table (which claimed GPT-4 = 8,192).
calculate_cost() takes rates as parameters; count_tokens() takes an
encoding name, since encodings outlive model IDs and
encoding_for_model() raises KeyError on anything unmapped
- OpenAIProvider loses its default model, so the caller must pass one
- llm-cost-optimizer's routing table names tiers, not models
Pinned to current IDs where an example genuinely needs one: SKILL_PIPELINE.md
(claude-opus-4-6 -> claude-opus-5), prompt-governance (claude-sonnet-4-5 ->
claude-sonnet-5), agent-designer README. Both dual-publish copies of the CAIO
pricing move together, so G4 stays green.
TEAM_STRUCTURE_GUIDE.md documented `prompt_optimizer.py --model gpt-4 --task
classification`. That contract no longer exists: there is no --task flag and
`prompt` is a required positional. Replaced with a runnable invocation.
Four references stay, with reasons in the allowlist: two litreview examples
where the retired model is the subject of the literature being reviewed, one
dated Computer Use citation, and the embedding benchmark already labelled a
2024 snapshot.
Assisted-by: Claude Code:claude-opus-5
- Replace subprocess.run(cmd, shell=True) with shlex.split(cmd, comments=True) +
shell=False. Recipe templates contain unquoted {placeholder} tokens clearly
meant for future parameter substitution; shell=True combined with any future
substitution logic is a straightforward shell command injection vector, since
none of the placeholder positions are quoted. Removing shell=True closes that
class of bug now, before substitution is added, instead of relying on future
contributors to remember to quote/escape interpolated values.
- Require an explicit --yes flag before executing a non-dry-run recipe. Several
recipes are irreversible (gws drive files emptyTrash, gws gmail
users.messages send, gws drive permissions create, ...); previously --run
alone (without --dry-run) executed them immediately with no confirmation
gate.
- convert.sh's SKILL.md finder now excludes .claude, .codex, .codex-plugin,
.gemini, .hermes, .vibe, and docs — these are generated/symlinked mirrors
for other tools, not source-of-truth skills. On platforms where git
materializes symlinks as plain text (e.g. Git Bash on Windows), the
mirrored files were being parsed as SKILL.md candidates and failing
frontmatter extraction, flooding the run with "Skipping invalid
frontmatter" warnings (#897).
- Renamed the self-improving-agent (si) plugin's `status` and `review`
skills to `memory-status` and `memory-review` so their bare `name:`
values no longer collide with Claude Code's built-in `/status` and
`/review` commands (#885). Updated all in-plugin references
(CLAUDE.md, README, agents, hooks, references, settings.json,
plugin.json) to the new `/si:memory-status` / `/si:memory-review`
invocations.
Fixes#897 (duplicate of #896), #885.
Adds a philosophy-grounded code-review skill: review through the lens of real
engineers' *documented, sourced* principles (Torvalds, Thompson, Carmack, Beck,
Brooks + Jobs, Cagan, Traynor), complementing engineering-team/adversarial-reviewer
(abstract roles) and code-reviewer (general quality).
Concept contributed by @YuhaoLin2005 in PR #866. Hardened for this repo's
conventions before merge:
- Consolidated to ONE location (engineering-team/skills/, auto-included via the
engineering-skills plugin's ./skills glob). Dropped the orphaned top-level
skills/ copy the original PR also added — no such plugin root exists in the tree.
- Added anti-fabrication discipline: cite the sourced principle (not an invented
verbatim quote), confidence levels on every attribution, drop a persona rather
than fabricate — mirrors productivity/andreessen's citation rule. LLMs hallucinate
quotes; attributing invented words to real living engineers is the core risk.
- Added references/persona_principles.md grounding every persona in a real,
citeable source with a confidence level (7+ sources incl. de Bono, Kahneman, Feynman).
- Removed the dangling /adversarial-review slash command reference and the
non-English trigger phrase; description passes skill_description_validator.
Counters trued up via scripts/derive_counters.py --check (passes):
350 skills, 717 references, 80 plugins.
Claude-Session: https://claude.ai/code/session_01Kmw1eZQoSMDr2diHbCcUkF
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: YuhaoLin2005 <278400118+YuhaoLin2005@users.noreply.github.com>
- incident_triage.py: --sample help text now documents the intentional
exit-2 SEV1 signal so &&-chained callers aren't surprised
- team_scaling_calculator.py: consolidate the split warn/load blocks into
the single if/else pattern the other five tools use
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
- health_score_calculator + pipeline_analyzer: warn on stderr when --sample
overrides a provided input (now consistent across all six tools)
- pmf_scorer: --sample checked before --input (matches the batch), with the
same override warning
- pipeline_analyzer: comment the intentionally stale D-3 fixture deal
- contrast_checker: user-facing --sample help text
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
- team_scaling_calculator.py: move sys import to the file-level import block
(was inline in the conditional); behavior unchanged
- incident_triage.py: warn on stderr when --sample overrides a provided
--input, matching team_scaling_calculator's convention
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Brings G9 JSON-output coverage from 19 to 25 tools (25/25 verified):
- business-growth: health_score_calculator (embedded 2-customer fixture),
pipeline_analyzer (embedded 4-deal pipeline fixture)
- c-level-advisor: pmf_scorer (--sample flag for its existing sample_data(),
suppressing the stdout notice that corrupted JSON piping),
team_scaling_calculator (--sample flag for its embedded defaults)
- engineering-team: incident_triage (embedded synthetic ransomware event),
contrast_checker (--sample as alias of the existing --demo)
Required-arg behavior unchanged when --sample is absent (still exits 2 with
a usage error). All gates green: G9 25/25, G8, dual-publish, path linter.
Together with the 5 #654-named tools, 4 JSON-honor fixes, and the pre-existing
sample-pattern tools, more than 20 tools now support the embedded-sample
convention — meeting #654's acceptance bar.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
- senior-prompt-engineer: rebuilt on the new-gen pattern; 2023-era cheatsheet
dropped; scripts made model-agnostic and rot-proof (user-supplied pricing,
no hardcoded model/cost tables); 5 workflows with executable exit-code
gates; zero stale model names remain
- senior-security: 445 -> 64 lines; owns only its unique STRIDE/DREAD value
with exact CLIs; 10-row lane table routes everything the v2.2 security
suite covers (all paths verified)
- engineering-team docs: all dead computer:/// links repointed to live
skills/ folders; all 14 stale .zip archives deleted (0 references remain;
folders are the canonical distribution)
- universal-scraping-architect: placeholder cs-scraping-architect agent and
cs-scrape command rewritten with verified CLIs, refusal gates, and the
empirically-confirmed validate_extraction.py exit-code contract
Gates at HEAD: check_paths 0 findings; check_dual_publish 0 drifted;
smoke 582/582; counters match; 78 manifests OK; compileall clean.
https://claude.ai/code/session_019AJddAL1NADWMXsy1qNPQF
- #805: insert missing skills/ segment in all per-skill install commands
across 5 domain READMEs (engineering-team, project-management,
marketing-skill, c-level-advisor, ra-qm-team); every path now resolves
to a real directory
- #806: pr-review-expert SKILL.md curl examples now pass Jira/Linear
credentials via stdin curl config (-K -) instead of argv, with a netrc
note, so tokens never reach the process list or shell history
- #807: implement the documented interfaces for the three senior-devops
scripts (terraform_scaffolder: aws/gcp/azure module skeletons with
optional terraform fmt/validate; pipeline_generator: GitHub Actions /
CircleCI configs with build,test,security,deploy stages and runtime
detection; deployment_manager: blue-green/rolling manifests + kubectl
runbooks with deploy/rollback/analyze subcommands); align SKILL.md
- #807: ci-cd-pipeline-builder stack_detector now detects Terraform and
Docker stacks and emits their lint/test/build commands; downstream
pipeline_generator gains a generic job for non-node/python/go stacks
- #748: sync-vibe-skills.py defaults to a flat layout one level below
~/.vibe/skills (the only depth Vibe discovers), with collision-safe
naming and a --nested flag for the legacy namespaced layout
- #785: new scripts/sync-codebuff-skills.py syncs all skills into
Codebuff's ~/.agents/skills using the same flat-layout machinery
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Phase 2 / Tier 1 of the post-#769 audit. Until now, the deterministic
analyzer (scripts/code_quality_checker.py) had language-specific smell
detectors only for C# and Java; C / C++ / Rust / Ruby / PHP / Dart all
fell through to generic checks. This PR brings C onto the same footing
as C# and Java -- the security delta is largest for memory-unsafe
languages, so C goes first per the audit ranking.
What's detected (CERT C + CWE catalogue patterns)
- Banned functions: gets, strcpy, strcat, sprintf, vsprintf
(CWE-242 / CWE-120 family -- no bounds check on any of them)
- Format-string vulnerability: printf(var) / syslog(var) where the
first arg is a bare identifier instead of a literal (CWE-134).
Suppressed when the first arg is a literal string.
- Unbounded scanf: %s without a width specifier (CWE-120).
Suppressed when a width is present (e.g. %31s).
- malloc/calloc/realloc result not NULL-checked within 5 lines
(CWE-690). Recognises if (p == NULL), if (NULL == p), if (!p),
if (p != NULL).
- free(p) without setting p = NULL on the next real line
(CWE-416 use-after-free guardrail). Low severity since some
style guides skip the zeroing convention.
- system() with a non-literal argument (CWE-78 command injection).
Suppressed when the argument is a string literal or NULL.
Implementation
- New function check_c_specific_smells() in code_quality_checker.py,
placed after check_java_specific_smells(). Reuses the existing
_strip_csharp_comments helper -- C, C#, and Java share // and /* */
comment syntax.
- Wired into analyze_file() via the existing dispatcher pattern:
`if language == "c": smells.extend(check_c_specific_smells(content))`.
Fixtures (regression-detection harness)
- assets/sample_c_smells.c -- 67 lines, every detector pattern
labelled inline with its CWE. Smells fixture produces 10 C-specific
detector hits (strcpy fires twice intentionally, once in each
function). Score: 4/100 (F).
- assets/sample_c_clean.c -- same surface area refactored per
rules/universal.md + languages/c.md. Zero C-specific hits.
Score: 100/100 (A).
- expected_outputs/sample_c_smells_quality.json and
expected_outputs/sample_c_clean_quality.json -- committed JSON
output mirrors the existing C# / Java regression-guard pattern.
Documentation
- engineering-team/skills/code-reviewer/README.md
- "Language-specific smell packs" line extended to enumerate the
6 C-pack patterns alongside the existing C# and Java packs.
- Bundled-fixtures table adds the 2 new C fixture rows.
- engineering-team/skills/code-reviewer/SKILL.md
- "Adding a New Language" step 5 reference: C# and Java -> C#,
Java, and C.
- "Regression Fixtures" paragraph reference: C# and Java -> C#,
Java, and C.
- docs/skills/engineering-team/code-reviewer.md mirrors the same
SKILL.md updates.
- CHANGELOG.md gets a new [Unreleased] section above the existing
code-reviewer entry, documenting the detector + fixtures.
Regression
- All 6 fixtures (C# / Java / C x smells / clean) pass byte-for-byte
against expected_outputs/*.json. No drift introduced in C# or Java
behaviour.
Not in this PR (Phase 2 audit, subsequent PRs)
- check_<name>_specific_smells for C++, Rust, Python, Kotlin, PHP,
Ruby, Dart, Go, Swift, TypeScript, JavaScript. C++ and Rust are
the next-highest-leverage targets (smart-pointer ownership,
unsafe block discipline). Same fixture + expected_outputs pattern
will apply to each.
https://claude.ai/code/session_01SnXMhpyuAwrws26Wy4fizz
Follow-up to PR #769 (6 new language files) and PR #772 (analyzer
wiring). Both PRs updated SKILL.md but left every derivative doc
surface stale. This PR closes the doc-sync gap.
Changed
- engineering-team/skills/code-reviewer/README.md
- Line 3 (one-liner): 9 -> 15 named languages, matching SKILL.md
- Line 90 (per-language guide list): 7 -> 13 file slugs
- docs/skills/engineering-team/code-reviewer.md (MkDocs page)
- Frontmatter description: 9 -> 15 languages
- File-tree block: 6 new languages/*.md rows
- Dispatch table: 6 new extension -> file rows
- --language valid-values comment: 8 -> 14 choices
Cross-platform mirrors
- .gemini/skills-index.json: regenerated via sync-gemini-skills.py
(diff is the single code-reviewer description; gemini script
discovered no other drift)
- .vibe/skills/claude-skills/skills-index.json: regenerated via
sync-vibe-skills.py with --target .vibe/skills (1 unrelated new
entry: workflow-builder; full regen was the path of least friction
for vibe)
- .hermes/skills/claude-skills/skills-index.json: hand-patched only
the code-reviewer entry. Full sync-hermes regeneration would have
bundled 33 new-skill entries (305 -> 338) accumulated from prior
PRs that never re-ran the script. That mirror-drift cleanup is a
separate concern -- left for its own PR.
- .codex/skills-index.json: was already current (the recurring
automated "chore: sync codex skills symlinks [automated]" commit
keeps it fresh between PRs).
CHANGELOG.md
- New [Unreleased] section above the existing Mistral Vibe block
documenting PR #769 (language coverage 7 -> 13), PR #772
(deterministic analyzer wiring), and this PR (doc sync).
Why hand-patched hermes (instead of script regen): the script
regenerates the entire index from current repo state, which surfaces
accumulated drift unrelated to code-reviewer (workflow-builder,
claude-coach, andreessen, handoff, business-operations, commercial,
compliance-os, research-ops -- 33 entries total). Bundling that with
a code-reviewer doc-sync PR would have muddied scope. Hand-patching
keeps this PR focused; a follow-up PR can sync-hermes properly.
https://claude.ai/code/session_01SnXMhpyuAwrws26Wy4fizz
PR #769 added language-rule files for C, C++, Rust, Ruby, PHP, and
Dart/Flutter, and updated SKILL.md's dispatch table + the --language
valid-values comment. But scripts/code_quality_checker.py was left
unchanged, so the deterministic analyzer silently skipped any file in
those 6 languages — the dispatch table promised coverage the script
didn't deliver.
Closes that gap by extending three structures in code_quality_checker.py:
- LANGUAGE_EXTENSIONS: 6 new entries matching SKILL.md exactly
(c declared before cpp so `.h` resolves to C per the dispatch table)
- find_functions patterns: language-aware function regexes
- find_classes patterns + nested method_patterns: type-defs and
method counting for class-like constructs (struct/enum/trait/union
for Rust; class/module for Ruby; class/interface/trait/enum for PHP;
class/mixin/enum/extension with Dart 3 modifier prefixes; struct for
C; class/struct for C++)
The function regexes for C and C++ require a trailing `{` so prototypes
and call sites aren't misclassified as definitions, and exclude
control-flow keywords (if/while/for/switch/return/sizeof) by negative
lookahead. This matches the discipline already used for the Java and C#
patterns (require modifier keywords).
Verification
- python3 scripts/code_quality_checker.py --help → all 14 languages
now appear as --language choices.
- Smoke-tested with a minimal sample per new language; each correctly
detects language, counts functions and classes, and produces a
quality score (no "Unsupported file type" errors).
- Regression: all 4 bundled fixtures (csharp/java × smells/clean)
still match their committed expected_outputs/*.json byte-for-byte.
Not in this PR (Phase 2 of the audit, separate PRs):
- Language-specific check_<name>_specific_smells detectors. Only C#
and Java have these today; the audit flagged C/C++/Rust as the
next-highest-leverage additions (memory safety, unsafe block
discipline, smart pointer ownership).
- Asset fixtures + expected_outputs JSON for the 6 new languages as
regression guards.
- Modernity / version-anchor sweep on the language markdown files.
https://claude.ai/code/session_01SnXMhpyuAwrws26Wy4fizz
PR #756 normalized most marketplace versions to 2.9.0, but 20 newer
plugins (added after the normalization pass) remained on their own
versions on both marketplace.json and their plugin.json. Bump them all
to 2.9.0 so the registry advertises one unified release version, with
marketplace.json and every plugin.json fully in sync (62/62 at 2.9.0).
https://claude.ai/code/session_01JGwZR83iSg59EAtpTSCBjH
Builds on @mitnick2012's universal+per-language restructure (PR #742).
- Add Java as a first-class deterministic language in code_quality_checker.py
(LANGUAGE_EXTENSIONS + function/class/method patterns + check_java_specific_smells),
so the documented `--language java` command works instead of erroring on an
invalid choice. Add Java debug + @SuppressWarnings signals to pr_analyzer.py.
- Add Java regression fixtures (sample_java_smells/clean.java) with committed
expected_outputs JSON, mirroring the existing C# fixtures.
- Delete references/{code_review_checklist,coding_standards,common_antipatterns}.md,
now duplicated by rules/universal.md + languages/*.md; repoint README and the
C# clean fixture header at the new structure.
- Document the optional analyzer-wiring + fixture steps in the "Adding a New
Language" guide and restore a Regression Fixtures section in SKILL.md.
https://claude.ai/code/session_01DjuELpoFdFbFscr3kAatni
- Extract commun languages rules in a separate rules/universal.md containing all cross-language rules in one place
- Move language-specific rules inline into each languages/*.md file,
organised into consistent sections: Security / Async / Resource
Management / Exception Handling / Performance / Idioms
- Add Java support: languages/java.md with full section coverage
- Every review now requires exactly 2 file reads: universal.md +
one language file
- Add "Adding a new language" guide to SKILL.md: one file to create,
nothing else changes
Addresses the Phase 3 quality_scorer roadmap items from the plugin audit:
adds the bundled fixtures, sample outputs, and quick-reference README that
the scorer expects, without diverging from the project's minimal-frontmatter
SKILL.md convention.
assets/:
- sample_csharp_smells.cs: a C# fixture with every pattern the skill
detects (async void, blocking on Task, swallowed Exception, undisposed
IDisposable, new HttpClient(), missing await, null-forgiving, hardcoded
connection string, unsafe, dynamic, #pragma warning disable,
[SuppressMessage], SQL concatenation), each smell labelled inline
- sample_csharp_clean.cs: the same code refactored per the standards in
references/coding_standards.md — verifies the analyzer produces 0 HIGH
smells on idiomatic code
expected_outputs/:
- sample_csharp_smells_quality.json: committed analyzer output for the
smells fixture (F/45, 3 HIGH smells)
- sample_csharp_clean_quality.json: committed analyzer output for the
clean fixture (A/98, 0 HIGH smells)
These act as a regression harness: diff the live output against the
committed JSON to detect any behaviour change in the analyzer.
scripts/code_quality_checker.py:
- Add _strip_csharp_comments() that removes // line and /* */ block
comments before running C#-specific regex detectors. Fixes false
positives where comment prose ("// FIX: await instead of .Result")
matched a detection pattern.
SKILL.md:
- New ## Examples section pointing at the fixtures + showing how to
reproduce the expected output with diff
- TOC updated to list "C# / .NET Review Notes" and "Examples"
README.md (new):
- Quick-reference card with how-to, 3 worked examples (one per script),
pointer to fixtures, pointer to references
Phase re-scores after this change:
- Structure: 86.4/GOOD → 91.3/EXCELLENT (+4.9)
- Quality: 54.8/D → 72.5/B- (+17.7)
- Scripts: 3/3 PASS (unchanged)
- Security: 0/0 (unchanged)
Bundle of low-medium-severity follow-ups that were deferred when PR #720
landed the 3 blocking bugs. None of these silently break correctness —
they're discoverability, consistency, and convention gaps.
Bugs / code-quality:
1. fullstack_decision_engine.py: asymmetric cadence matching
`inputs.cadence in target or target in inputs.cadence` produced
asymmetric results — "per-pr" matched "per-pr-with-gates" but not
vice versa. Profile cadences are intentional alternatives joined
by "-or-" (e.g. "weekly-or-on-demand" → {weekly, on-demand}); now
parsed explicitly with "-with-..." modifier suffixes stripped.
Verified:
cadence=per-pr → matches per-pr, per-pr-with-gates, daily-or-per-pr
cadence=daily → matches daily-or-per-pr (only)
cadence=on-demand → matches weekly-or-on-demand
2. fullstack_decision_engine.py: rename weight_total/weight_matched
to w_total/w_matched. Backend and frontend engines already use the
short form; this aligns the three files as a family.
3. sync-gemini-skills.py: 3-way name collision in dedup logic
The naive `if name in seen_names: name = parent-name` handled one
collision but not two. Three "status" skills under "skills" parent
dirs produced two entries both named "skills-status". Now suffixes
with -2, -3, ... so each entry has a unique index name. Eliminates
the duplicate-name ambiguity surfaced when checking PR #713.
Discoverability:
4. senior-fullstack/SKILL.md: surface fullstack_decision_engine.py in
the labeled "Tools" section at the top. Previously only mentioned
inline in the body (5 references buried in the Stack Decision Matrix
section); not findable when scanning the SKILL.md.
Conventions / v2.8.0 compliance:
5. commands/cs-{fullstack,backend,frontend}-review.md: add explicit
"## Forcing-question library" section header per the v2.8.0
convention. Each lists the 7 questions inline with a pointer to
the canonical reference file.
6. agents/engineering/cs-{fullstack,backend,frontend}-engineer.md:
alphabetize the specialist list in the description field (annotated
that workflow body order remains dependency-driven). Makes the
three agent descriptions consistent as a family.
7. agents/engineering/cs-{backend,frontend}-engineer.md: promote the
"Cross-agent invocation" content out of Workflow 3 into a dedicated
"## When invoked as fork target" section with an explicit question-
skip table per parent agent (cs-fullstack-engineer, cs-cto-advisor,
cs-vpe-advisor, cs-ciso-advisor for backend; cs-fullstack-engineer,
cs-content-creator, cs-product-manager for frontend). Closes the
cross-agent contract gap the bot flagged.
Not changed:
- CLAUDE.md plugin-schema section (already corrected in #715; bot's
"stale text" claim was incorrect — it was reading the cumulative diff)
- Workflow body specialist order (intentional dependency order; would
break the SLO-first → API → DB → migration → observability sequence)
Verification:
- All 3 decision engines: --sample → exit 0
- Cadence matching: 3 test cases pass cleanly
- check_plugin_json.py --all → 0 FAIL, 0 WARN, 69 OK
- sync-gemini-skills.py → 392 unique names (was 391 unique / 1 dupe)
Addresses claude[bot] code review findings on PR #718.
1. backend_decision_engine.py: scoped language-preference match
Previous code serialized the entire profile dict to JSON and ran a
substring search, so --language-preference=go false-matched against
"django", "mongo", etc. New approach tokenizes profile_name +
stack.language + stack.runtime on '-' and checks exact membership.
Verified:
- language=go → matches go-or-rust-microservice only
- language=python → matches django-monolith + fastapi-python only
- language=typescript → matches node-express only
2. frontend_decision_engine.py: removed dead pass-block kill check
`if team_size in 4..10 and read_write_ratio >= 50: pass` was a no-op
with an unclear intent comment. Removed.
3. frontend_decision_engine.py: wired up unused inp_target_ms field
The field was declared on Inputs, exposed via --inp-target-ms, and
threaded through main() but never consulted by any kill criterion.
Added a kill check that mirrors the existing LCP one:
"mobile-4g primary with INP target Xms: tighten to < 200ms"
(Web Vitals 'good' threshold for INP is 200ms; 'poor' is 500ms.)
Verification:
- backend_decision_engine.py --sample → exit 0
- frontend_decision_engine.py --sample → exit 0
- fullstack_decision_engine.py --sample → exit 0 (untouched)
Resolves#712 and #714.
Claude Code's plugin spec (code.claude.com/docs/en/plugins-reference) requires
"All paths must be relative to the plugin root and start with ./". CC 2.1.144+
rejects the bare "skills" form with `Validation errors: skills: Invalid input`,
breaking plugin installs from this repo.
Changes:
- 47 plugin.json manifests migrated from "skills": "skills" → ["./skills"]
(canonical post-CC 2.1.144 form, also accepts string "./skills")
- scripts/check_plugin_json.py rewritten to enforce the live spec:
* Hard-fails on non-"./"-prefixed strings (except the legacy "skills" literal)
* Hard-fails on empty strings/arrays and non-string array entries
* Emits WARN (non-fatal) on the legacy "skills" literal as a safety net
for copied templates — the WARN tolerance can be removed later
* Tested against all four canonical forms + 3 garbage forms
- CLAUDE.md §5 rewritten to document the live spec, including the historical
context of the v2.1.107 → v2.1.144 regression window that's now closed
- 15 stale broken symlinks under .gemini/skills/ removed (orphans from older
reorgs that the sync script didn't prune because its cleanup is disabled)
Verification:
- scripts/check_plugin_json.py --all → 0 FAIL, 0 WARN, exit 0 (69 files OK)
- pytest tests/ → 2103 passed
- find . -type l ! -exec test -e {} \; → 0 broken symlinks
- Live spec forms tested: ["./"], ["./skills"], "./skills", ["./a","./b"] all pass
- Garbage forms rejected: bare "./", empty array, non-string entries, plain strings
