feat(code-tidying): dissolve-comments empty-arg scope fallback ladder (0.14.0) by kyle-sexton · Pull Request #3156 · melodic-software/claude-code-plugins

kyle-sexton · 2026-08-23T04:32:51Z

Summary

/code-tidying:dissolve-comments invoked with an empty argument dead-ended on a clean working tree (friendly no-op exit, no fallback). The empty argument now resolves down a scope ladder, and the three related findings from the issue — the .claude/ exclusion-wording divergence, the SSOT header check living only in Gotchas, and silent zero-in-scope exits — are fixed in the same pass. Ships as code-tidying 0.14.0.

Fix

Scope fallback ladder (skills/dissolve-comments/SKILL.md): empty argument resolves uncommitted diff → current branch's diff vs. the base/default branch → whole repository. Repo-wide widening is confirmed with the user in interactive sessions; non-interactive runs proceed deterministically but take any widened rung in safe mode (class-A deletions only, class-B as proposals), never full default mode.
Zero-in-scope runs report an exclusion tally (Workflow steps 1 and 4): total enumerated, 0 in scope, counts per drop reason (non-code, GLOBAL HARD path, exempt surface, SSOT copy) — a clean repo is now distinguishable from a misconfigured run.
.claude/ exclusion wording reconciled: tidy/reference/exclusions.md's GLOBAL HARD entry widened from enumerated globs (.claude/hooks/** et al.) to .claude/** in full, plus any script wired as a hook command in .claude/settings.json wherever it lives; dissolve-comments/reference/safety.md and tidy/SKILL.md's orientation summary now state the same list, so a literal reader of any surface reaches the same answer.
SSOT / materialized-copy header check promoted from a Gotchas bullet into Workflow step 1 (Scope), where it gates whether a file may be edited at all; the gotcha shrank to a pointer.
Frontmatter description, Purpose, "What this skill is NOT", README, and plugin.json description aligned minimally; version 0.13.2 → 0.14.0 with a matching CHANGELOG entry.

Verification

Plugin test suites pass: scripts/allowed-tools-pairing.test.sh (all checks), skills/audit-comment-residue/scripts/detect.test.sh (27/27), skills/tidy/scripts/open-pr-count.test.sh (9/9).
markdownlint-cli2 on all six changed markdown files: 0 issues; typos and editorconfig-checker on all seven changed files: clean; check-jsonschema validates plugin.json against the manifest schema.
Repo-wide grep confirmed no other surface still cites the old enumerated .claude/ glob list.
Branch merged current with main; the diff is confined to plugins/code-tidying/.

… (0.14.0) (#3117) A clean tree no longer dead-ends the empty-argument invocation: scope now resolves down a ladder (uncommitted diff -> branch diff vs. base -> whole repository), with interactive confirmation before repo-wide widening and a deterministic safe-mode default for non-interactive runs. Zero-in-scope resolutions report a per-reason exclusion tally instead of exiting silently. Reconciles the .claude/ exclusion wording (safety.md prose vs. exclusions.md globs) by widening the GLOBAL HARD entry to .claude/** plus any settings-wired hook script wherever it lives, and promotes the SSOT/materialized-copy header check from Gotchas into Workflow step 1 (Scope). Closes #3117 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGyDNAyN1Ld6KRrrEZvrJK

…egration-w4pxl1

claude · 2026-08-23T04:33:22Z

Claude finished @kyle-sexton's task in 38s —— View job

Security review — `/review:security-review`

Gather context (PR diff, changed files)
Apply skip gate / assess security-relevant surface
Perform security review of changed files
Post final findings

Skip gate hit: no security-relevant surface.

All seven changed files are Markdown documentation/instructions and one version-bump JSON field:

plugins/code-tidying/skills/dissolve-comments/SKILL.md, reference/safety.md
plugins/code-tidying/skills/tidy/SKILL.md, reference/exclusions.md
plugins/code-tidying/README.md, CHANGELOG.md
plugins/code-tidying/.claude-plugin/plugin.json (version 0.13.2 → 0.14.0 + description text only)

The change is a documentation pass on the dissolve-comments skill's scope-fallback behavior and exclusion wording — no scripts, no GitHub Actions workflow changes, no code that parses untrusted input, handles secrets/tokens, or executes commands. There is no logic, trust-boundary, or Actions-security surface for this lane to review.

No security issues found. Nothing further to report.

github-actions · 2026-08-23T04:34:28Z

Last security-reviewed head: 840f67a00a79786b03dea1b24208791c1a7d1641. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2c06e756ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

… both settings scopes (#3117) Two review findings on the scope-fallback change: the ladder now advances only when a rung does not exist (clean tree, no branch diff) — a rung that exists but yields no code files ends the run with the exclusion tally, so a docs-only branch never silently escalates to repo-wide scope; and the settings-wired hook-script exclusion now names both project settings scopes (.claude/settings.json and .claude/settings.local.json) across exclusions.md, safety.md, and tidy's orientation summary. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGyDNAyN1Ld6KRrrEZvrJK

claude · 2026-08-23T04:38:08Z

Claude finished @kyle-sexton's task in 52s —— View job

Security review — `/review:security-review`

Gather context (PR diff, changed files, prior review state)
Apply skip gate / assess security-relevant surface for new commits
Perform security review of changed files
Post final findings

Skip gate hit: no security-relevant surface.

The last security review on this PR covered head 2c06e756. Since then, one new commit landed — 2813ee5 ("address review — ladder advances on absence; cover both settings scopes"), which directly resolves the two Codex P1 findings from the prior review round (branch-diff rung no longer silently escalates to repo-wide scope when it yields no code files; the .claude/settings.local.json hook-wired-script gap is now covered alongside .claude/settings.json).

That commit only touches:

plugins/code-tidying/CHANGELOG.md
plugins/code-tidying/skills/dissolve-comments/SKILL.md
plugins/code-tidying/skills/dissolve-comments/reference/safety.md
plugins/code-tidying/skills/tidy/SKILL.md
plugins/code-tidying/skills/tidy/reference/exclusions.md

All five are Markdown prose (skill instructions/documentation consumed by an agent, not executable code). Confirmed the full PR diff (origin/main...HEAD) still spans only the same seven files as the original review — the six Markdown files above plus plugin.json's version bump (0.13.2 → 0.14.0, text field only). No scripts, no GitHub Actions workflow changes, no code parsing untrusted input, no secret/token handling, no logic or trust-boundary surface for this lane to review.

No security issues found. Nothing further to report.

…3117) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGyDNAyN1Ld6KRrrEZvrJK

…egration-w4pxl1 # Conflicts: # plugins/code-tidying/.claude-plugin/plugin.json # plugins/code-tidying/CHANGELOG.md

claude · 2026-08-23T04:50:34Z

Claude finished @kyle-sexton's task in 58s —— View job

Security review — `/review:security-review`

Gather context (PR diff, changed files, prior review state)
Apply skip gate / assess security-relevant surface for new commits
Perform security review of changed files
Post final findings

Skip gate hit: this head already has a successful security review that still applies.

The last review on this PR covered head 2c06e75 / 2813ee5. Since then the branch merged forward to 840f67a (merging in unrelated upstream commits 9a6c649 and 73dcbe0), but diffing 2813ee5..840f67a scoped to this PR's actual surfaces (dissolve-comments/, tidy/, README.md, plugin.json) shows zero changes — those files are byte-identical to what was already reviewed. The only files touched by the merge (docs/CATALOG.md, CHANGELOG.md) picked up unrelated upstream content (an audit-comment-residue 0.13.3 changelog entry, a docs-hygiene catalog description) that isn't part of this PR's diff against origin/main and carries no security surface.

Confirmed git diff origin/main...HEAD --stat still matches the same 8 files as the original review: six Markdown prose files (skill instructions/docs) plus plugin.json's version-bump field and CHANGELOG.md's prose additions. No scripts, no GitHub Actions workflow changes, no code parsing untrusted input, no secret/token handling, no logic or trust-boundary surface for this lane to review.

No security issues found. Nothing further to report.

claude · 2026-08-23T05:41:39Z

Claude finished @kyle-sexton's task in 3m 11s —— View job

Code review — `/review:code-review`

Gather context (PR diff, changed files)
Apply skip gate — no skip; PR is open, non-draft, has meaningful review surface
Review changed files against CLAUDE.md / REVIEW.md criteria
Post findings

No blocking or high-signal findings.

This is a documentation-only pass across 8 files in plugins/code-tidying/ (skill instructions, reference docs, README, CHANGELOG, plugin manifest, catalog). I read every changed file in full against origin/main and specifically re-verified the two P1 findings Codex raised on this PR's earlier commit (2c06e756), both addressed in 2813ee5:

Branch-diff rung silently escalating to repo-wide scope (dissolve-comments/SKILL.md) — confirmed fixed. Rung 2 (branch diff) and rung 3 (whole repo) are now mutually exclusive by branch (clean tree on a non-default branch vs. clean tree on the default branch), and the ladder text is explicit: "The ladder advances on absence, never on emptiness... A rung that exists but yields no code files after filtering ends the run with the exclusion tally... a docs-only branch reports its files as out of scope rather than silently escalating to repo-wide scope." A docs-only feature branch can no longer fall through to repo-wide scope.
.claude/settings.local.json-wired hook scripts unprotected — confirmed fixed consistently across all three surfaces that state the GLOBAL HARD list: tidy/reference/exclusions.md, dissolve-comments/reference/safety.md, and tidy/SKILL.md all now name both .claude/settings.json and .claude/settings.local.json for settings-wired hook commands "wherever it lives."

Other consistency checks that passed:

plugin.json's new description (0.14.0) matches docs/CATALOG.md's regenerated entry verbatim, as that file's own header requires.
CHANGELOG.md's [0.14.0] entries accurately describe the corresponding SKILL.md/reference changes — no drift between changelog claims and actual behavior text.
The interactive-confirmation vs. non-interactive-safe-mode split (only repo-wide widening prompts for a yes; any widened rung forces safe mode in non-interactive runs) is stated the same way in SKILL.md, README.md, and CHANGELOG.md.

No correctness, consistency, or maintainability issues rise to this lane's bar. Security scope is owned by the claude-security-review lane, which has already cleared this PR (no code/script surface — Markdown + one version field).

github-actions · 2026-08-23T05:45:18Z

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

#3156 landed the dissolve-comments scope-fallback ladder on main and took 0.14.0, so this branch's 0.13.4 no longer sits above the published version and both the manifest and the changelog collided. * plugin.json takes main's description verbatim — #3156 rewrote the dissolve-comments clause — with the version moved to 0.14.1. * CHANGELOG keeps main's 0.14.0 entry intact and re-headings this branch's entry as 0.14.1 above it. The entry text is unchanged: it documents the audit-comment-residue escape-decode fix, which is untouched by #3156. No code conflict this time; #3156 does not touch audit-comment-residue. Refs #3126, #3140, #3156 Co-Authored-By: Claude <noreply@anthropic.com>

…#3151) No related issue: follow-on to the limitation #3140 recorded at its own parse site. #3126 is already closed by that PR, and no issue tracks the residual escape-decode gap. ## Summary #3140 fixed the #3126 false negative by slicing the v1 porcelain record, and recorded the remaining limitation at the parse site: > Git's octal escapes for control and non-ASCII bytes are still not decoded by either, so such a path continues to miss. This PR closes that gap, in both parsers that carry it. **It is a follow-on to #3140, not a competing fix.** | Path | v1 renders as | v1 slice yields | |---|---|---| | `café.py` | `?? "caf\303\251.py"` | literal escape sequence — names nothing | | `tab<TAB>here.py` | `?? "tab\there.py"` | literal `\t` — names nothing | Both confirmed against git 2.55. The file is silently dropped, so the run reports a clean tree — the same false-negative class #3126 described. ## Fix Both porcelain parsers in this skill move to the NUL-delimited `--porcelain -z` form, which git documents as performing no quoting or backslash-escaping, so there is nothing left to decode. - **`detect.sh`** — the audit's target router. - **`SKILL.md`'s `Uncommitted code files:` preview** — the pre-computed context the model reads. #3140 deliberately brought this to parity and added a test that extracts and runs it, so leaving it behind would have reopened the divergence that test exists to prevent: the audit would find `café.py` while the preview listed nothing. Under `-z` a rename emits the **new** path first and the original as a following record — the reverse of v1's display order — and that second record is consumed and dropped. Rename handling is therefore structural, with no arrow matching, which also resolves the intent-to-add rename #3140 gated on the worktree status letter (` R dst\0src\0` → `dst`, verified against git 2.55). ## Verification - **53/53 pass**, including every one of #3140's checks. - Nothing vacuous, checked by reverting each piece: - `main`'s `detect.sh` → fails 2 of case 11's 5 assertions (`non-ASCII`, `tab-bearing`). The arrow assertion passes on `main` — #3140's `[RC]` gating already handles it, **not** claimed here. - `main`'s `SKILL.md` → fails 3 assertions, including #3140's own `SKILL.md preview covers every file detect.sh audits`. - The parity harness was itself masking the defect and is fixed here. It extracted only the awk program and hardcoded the porcelain invocation; feeding `-z` to a v1 program makes the v1 program look correct, because `-z` output carries no quoting for it to fail at decoding. It now reads the invocation from `SKILL.md` too, and `REPO13` gains a non-ASCII fixture. - `mawk 1.3.4` (the runner's default `awk`) confirmed to support `RS = "\0"` before relying on it. - Local gates green: typos, shell-portability (scripts and `SKILL.md`), skill-portability, skill-precompute-compose, changed-skills, leaf-names, count-claims, fixture-git-isolation, orphaned-fixtures, manifest-duplicate-keys, `bash -n`, changelog-parity in all three modes. - `ci-status` (the required aggregate check) reported **success** on head `65a7b2c`; head `d7b2b67` adds only a `main` merge plus the version rebase. ## Current state — read this before continuing Head is **`d7b2b67`**, version **`0.14.2`**. `main` published its own `0.14.0` (#3156) and `0.14.1` mid-review, so the version was rebased twice; the changelog keeps each published entry intact with this PR's entry above them. **One blocker remains, and it is not about the code.** The branch's commits are signed with a key that is not registered on the committing GitHub account, so they report `verified=false, reason=unknown_key`. That trips two ruleset rules: - `required_signatures` - `require_extra_approval_for_unattributed_changes` Everything else is satisfied: all four required checks green, all review threads resolved, no merge conflicts, and `required_approving_review_count` is **0** — so once the signature question is settled this PR needs no human approval. Two ways to settle it: 1. **Register the signing key** on the account (Settings → SSH and GPG keys → New SSH key, type *Signing Key*). No push needed; the existing commits become verified, and the commit history is preserved. 2. **Rebuild the branch through the GitHub API.** Commits created via the API are signed by GitHub and verify automatically — that is why every commit on `main` shows `committer=noreply@github.com, verified=true`. Since the repo is squash-merge only, collapsing this branch's commits loses nothing that would survive the merge anyway. ## Related - Refs #3140 — landed the v1 slice this builds on; its `0.13.3` entry and full test suite are preserved here. - Refs #3156 — bumped `code-tidying` to `0.14.0` mid-review. - Refs #3126 — the original bug, closed by #3140. Not reopened here. - Refs #3164 — `audit-noise` carries the same defect class. #3171 fixed its rename-split half; the octal-escape half is still open and tracked there. **Not fixed here** — separate plugin, separate version bump.

claude added 2 commits August 23, 2026 02:55

Merge remote-tracking branch 'origin/main' into claude/work-items-int…

2c06e75

…egration-w4pxl1

chatgpt-codex-connector Bot reviewed Aug 23, 2026

View reviewed changes

Comment thread plugins/code-tidying/skills/dissolve-comments/SKILL.md Outdated

Comment thread plugins/code-tidying/skills/tidy/reference/exclusions.md Outdated

claude added 2 commits August 23, 2026 04:48

docs: regenerate CATALOG.md for the code-tidying description change (#…

73dcbe0

…3117) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BGyDNAyN1Ld6KRrrEZvrJK

Merge remote-tracking branch 'origin/main' into claude/work-items-int…

840f67a

…egration-w4pxl1 # Conflicts: # plugins/code-tidying/.claude-plugin/plugin.json # plugins/code-tidying/CHANGELOG.md

kyle-sexton merged commit 79fc25d into main Aug 23, 2026
50 checks passed

kyle-sexton deleted the claude/work-items-integration-w4pxl1 branch August 23, 2026 05:45

claude Bot mentioned this pull request Aug 23, 2026

fix(code-tidying): read porcelain -z so escaped paths reach the audit #3151

Merged

Navigation Menu

Uh oh!

feat(code-tidying): dissolve-comments empty-arg scope fallback ladder (0.14.0) - #3156

feat(code-tidying): dissolve-comments empty-arg scope fallback ladder (0.14.0)#3156
kyle-sexton merged 5 commits into
mainfrom
claude/work-items-integration-w4pxl1

kyle-sexton commented Aug 23, 2026

Uh oh!

claude Bot commented Aug 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Aug 23, 2026 •

edited

Loading

Uh oh!

claude Bot commented Aug 23, 2026 •

edited

Loading

Uh oh!

claude Bot commented Aug 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

kyle-sexton commented Aug 23, 2026

Summary

Fix

Verification

Related

Uh oh!

claude Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security review — /review:security-review

Uh oh!

github-actions Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security review — /review:security-review

Uh oh!

claude Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security review — /review:security-review

Uh oh!

claude Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code review — /review:code-review

Uh oh!

github-actions Bot commented Aug 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

claude Bot commented Aug 23, 2026 •

edited

Loading

Security review — `/review:security-review`

github-actions Bot commented Aug 23, 2026 •

edited

Loading

claude Bot commented Aug 23, 2026 •

edited

Loading

Security review — `/review:security-review`

claude Bot commented Aug 23, 2026 •

edited

Loading

Security review — `/review:security-review`

claude Bot commented Aug 23, 2026 •

edited

Loading

Code review — `/review:code-review`