Repository navigation
fix: correct drift found by the spec sync; setup welcome, Subversion layer, Codex hook - #1829
Merged
Merged
Conversation
A spec-sync pass over the commits since 03c15a6 found places where the docs, tables and comments no longer match the code: - Skill tables and counts: add setup-complete-upgrade and setup-privacy-llm to docs/modes.md, complete-upgrade to the setup README, submit-to-oss-scan to the security README; fix eval step lists and case counts in the skill-evals READMEs. - Adapters: Bitbucket and GitLab are `partial`, not `partial-read-only`; the Bitbucket capability row lists the writes the tool ships. - `<framework>` resolves to `.apache-magpie/` on a snapshot install, not `.apache-magpie/apache-magpie`; fixed at the source (init_skill.py) and in the skills and READMEs that copied it. - CVE record-publish: document the vendor-advisory precondition (exit 4) and that --allow-state replaces the REVIEW default. - Secure setup: bubblewrap 0.13.1, PREK_HOME required only with prek, run the gateway hook by hand with </dev/null. - Comments and docstrings: the gateway hook has no `if` filter any more, agent-guard's guard sources, the layers.py Subversion and no-VCS rule, the CI batch selector, and the SETUP_HOOKS fallback now matches the real /bin/bash -p wiring. - permission-audit documents --organization; a nested link and a wrong docs/setup/marketplaces.md reference are fixed. Generated-by: Claude Opus 5
…re-point the Codex hook Follow-ups to the same spec-sync pass, each a gap a recent change left: - The setup family is exempt from the shared pre-flight, so its welcome guide never showed. The `setup` skill now runs a welcome-only check (`setup_preflight.welcome due --skill setup`) before any sub-action; the exemption stays. The first-run eval case moves into its own `welcome-first-run` suite built from that step. - #1779 added a Subversion personal layer at `.svn/apache-magpie/`, but the pre-flight path was git-only, so a checker installed there was never found, and `setup config` stopped outside git. The path now includes `.svn/apache-magpie` and no longer errors outside git; `config` Step 0 handles git, Subversion and no-VCS working copies as `layers.py` does. A test runs the block's path in all three. - The root Codex plugin wired SessionStart to a `hooks/check-upgrade.sh` that has not existed since #1208; it now runs the magpie-setup script with `/bin/bash -p`, and check-family-plugins pins that wiring. - generate-cve-json's README documents its config file (lookup order, every key, an example), which its error messages already pointed at. - tools/hook-manager's README gains Operations and Configuration sections. Generated-by: Claude Opus 5
potiuk
enabled auto-merge (squash)
October 25, 2026 20:16
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This was referenced Oct 25, 2026
CodeQL flagged the `due` action's `from .core import …` as an import cycle: core already imports welcome for the pre-flight's welcome finding. `due_answer()` now builds the same JSON itself from `welcome_facts` and `sections.for_findings`, so welcome never imports core; the rendered eval fixtures confirm the output is unchanged. Generated-by: Claude Opus 5
potiuk
force-pushed
the
fix/post-sync-inconsistencies
branch
from
October 25, 2026 20:34
78d7e17 to
02ef375
Compare
potiuk
added a commit
that referenced
this pull request
Oct 25, 2026
Brings the specs up to main at cb51b53: the setup skill's own welcome-only check, the Subversion personal layer on the pre-flight path and in `setup config` Step 0, the re-pointed root Codex hook and the corrected SETUP_HOOKS fallback (dropping the two known gaps #1829 closed), and the generate-cve-json configuration docs. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 25, 2026
Brings the specs up to main at cb51b53: the setup skill's own welcome-only check, the Subversion personal layer on the pre-flight path and in `setup config` Step 0, the re-pointed root Codex hook and the corrected SETUP_HOOKS fallback (dropping the two known gaps #1829 closed), and the generate-cve-json configuration docs. Generated-by: Claude Opus 5
potiuk
added a commit
that referenced
this pull request
Oct 26, 2026
Codex never ran magpie-setup's session-start upgrade check. With no Codex manifest, Codex read the plugin's hooks/hooks.json, whose `$schema` and `modules` keys (Claude Code mods) its strict hooks-file schema rejects, so no hook loaded and every start logged a parse warning; magpie-utilities hit the same warning. The root .codex-plugin hook #1829 re-pointed lacked the inline `hooks` wrapper, so Codex ignored it, and no catalogue installs the root plugin. - magpie-setup and magpie-utilities get a complete .codex-plugin/plugin.json pointing at a clean hooks/codex-hooks.json; magpie-setup's runs check-upgrade.sh as `/bin/bash -p` on startup, magpie-utilities' is empty. - The root manifest's hook is removed. - check-family-plugins generates and pins both files and fails any Codex-catalogued plugin whose Codex-visible hooks file has keys other than `description` and `hooks`. - The session-hook tests cover the Codex wiring; the marketplace docs describe it and Codex's /hooks trust step; uninstall names Codex's real `plugin remove` verb. Checked live with codex 0.154.0's app-server `hooks/list`: the hook loads from codex-hooks.json with no warnings, untrusted until reviewed. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A spec-sync pass over the 88 commits since
03c15a6d1(spec PR: the companionsync-specs-20261025-195043) also turned up places where docs, counts, comments and wiring no longer match the code.This PR fixes them, in two commits.
Stale docs, counts and comments
setup-complete-upgradeandsetup-privacy-llmtodocs/modes.md,complete-upgradeto the setup README, andsubmit-to-oss-scanto the security README. Fixes the eval step lists and case counts in the skill-evals READMEs.partial, notpartial-read-only, and the Bitbucket capability row now lists the writes the tool ships.<framework>path. On a snapshot install<framework>is.apache-magpie/, not.apache-magpie/apache-magpie. Fixed at the source (init_skill.py) and in the 7 skills and 5 READMEs that copied it.vendor-advisoryprecondition (exit 4) and that--allow-statereplaces theREVIEWdefault.PREK_HOMEis required only when the project uses prek.</dev/null.iffilter.guard_dirs()actually reads.layers.pycopies describe the Subversion and no-VCS rule.SETUP_HOOKSfallback match the real code and wiring.--organizationis documented for permission-audit; a nested link and a wrongdocs/setup/marketplaces.mdreference are fixed.Gaps that needed a decision
setupskill now runs a welcome-only check before any sub-action (setup_preflight.welcome due --skill setup), and the exemption stays. The first-run eval case moves to a newwelcome-first-runsuite built from that step..svn/apache-magpie/(fix: ASF-wide CNA org id, never used for allocation; personal config in Subversion projects #1779) was never found, andsetup configstopped outside git. The path now includes.svn/apache-magpieand no longer errors outside git. Its cost: +50 tokens per skill that carries the block, recorded indocs/mode-economics.md.configStep 0 handles git, Subversion and no-VCS working copies the waylayers.pydoes. A test runs the block's path in all three.hooks/check-upgrade.shthat has not existed since feat: split install / config / adopt, and make per-family plugins installable everywhere #1208. It now runs the magpie-setup script with/bin/bash -p, andcheck-family-pluginschecks that wiring.tools/hook-managergets the Operations and Configuration sections the validator asked for.Checks
prek run --all-filespasses, except in the sandbox, where 4 tests fail for local reasons. The 3 vetted-ops tests write under a.git/**/apache-magpie/path the sandbox denies, and pass outside it.test_hook_manager_shim.py::test_a_linked_worktree_targets_the_main_checkoutmakes agit committhat picks up a globalcommit.gpgsignwith a hardware key. This branch doesn't touch it; it is a fragility already onmain.welcome-first-runeval cases render in print mode but were not run against a model.Generative AI disclosure: drafted with Claude Code (Claude Opus 5) and reviewed by the committer.
🤖 Generated with Claude Code