feat: adopt the uniform setup contract across 9 formatter/CLI plugins - #355
Conversation
Tranche 2 of wave #314 (epic #313, dim 8), cloning the battle-tested markdown-format exemplar from #342 to the collision-free shape-A plugins: actionlint 0.4.0, bash-format 0.5.0, powershell-format 0.4.0, biome-format 0.4.0, ruff-format 0.4.0, eol-normalizer 0.4.0, desktop-notification 0.4.0, firecrawl 0.3.0, playwright 0.3.0. Every setup: check reads the plugin's own hook/skill source as the single source of truth and probes what it actually requires (no hand-copied resolution paths or config lists); apply re-checks first, resolves with guidance for system tools and native toggles, names any write path in the argument-hint, states it before running, and re-verifies after every remediation. Package-manager and environment respect carried over from the exemplar's review rounds: biome-format resolves lockfile -> packageManager -> npm and routes Plug'n'Play to guidance; ruff-format installs only into a managed environment the repo already uses; firecrawl reports FIRECRAWL_API_KEY presence without ever printing it and defers to the plugin's lazy-install design; desktop-notification probes only the current OS family's channel dependencies. Also backfills the undocumented [0.3.1] CHANGELOG entries in actionlint and powershell-format (the #298 hook-utils resync, verified via git log -S). Deferred from this tranche for lane ownership: disk-hygiene (PR #286 touches its plugin.json/CHANGELOG) and guardrails (PR #305 ditto) — they join a later tranche after those PRs land. ## Related - Part of #314 - Part of #313 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 3m 54s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
OverallThis is a well-executed, low-risk expansion of an established pattern. The nine new skills are structurally consistent with each other and with the stated contract. The following findings are ordered by severity. FindingsMedium — biome-format: Yarn Classic detection is implicitFile: The Yarn linker disambiguation logic is:
The gap: Yarn Classic (v1.x) doesn't recognise Suggested clarification: after Low — ruff-format: uv detection heuristic unspecifiedFile:
"When the repo uses uv" has no detection heuristic here (presence of Low — firecrawl:
|
| Invariant | Status |
|---|---|
disable-model-invocation: true on all 9 |
✅ |
check is read-only (only command -v and file presence probes) |
✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| Write stated before execution | ✅ |
| Re-verify after remediation (not on exit code alone) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Never writes repository files in guidance-only plugins | ✅ |
${CLAUDE_PLUGIN_ROOT} used for all plugin-relative paths |
✅ |
| Hook/skill source designated as single source of truth; skills say "Read it first" | ✅ |
Security observations — all clear
- FIRECRAWL_API_KEY: only checked for presence (
[[ -n "${FIRECRAWL_API_KEY:-}" ]]); value is never printed, logged, or persisted. Enforced in the check step and the "does NOT" section. ✅ - Optional firecrawl env vars (
FIRECRAWL_API_URL,FIRECRAWL_NO_TELEMETRY) also presence-only. ✅ - powershell-format trust warning for
PSScriptAnalyzerSettings.psd1(aCustomRulePathit declares runs during analysis) is surfaced correctly in thecheckstep. ✅ - playwright global install is clearly labelled as "mutates the user's machine (the global npm prefix)" and gated behind the explicit
apply install-cliargument. ✅ - No
../reach-outs; all plugin-local paths use${CLAUDE_PLUGIN_ROOT}. ✅ - No hardcoded repo paths or project-specific values. ✅
Version consistency — all pass
| Plugin | Version in plugin.json |
PR table |
|---|---|---|
| actionlint | 0.4.0 |
0.4.0 ✅ |
| bash-format | 0.5.0 |
0.5.0 ✅ |
| biome-format | 0.4.0 |
0.4.0 ✅ |
| desktop-notification | (not re-read, but CHANGELOG matches) | 0.4.0 ✅ |
| eol-normalizer | (not re-read, but CHANGELOG matches) | 0.4.0 ✅ |
| firecrawl | 0.3.0 |
0.3.0 ✅ |
| playwright | 0.3.0 |
0.3.0 ✅ |
| powershell-format | (CHANGELOG matches) | 0.4.0 ✅ |
| ruff-format | 0.4.0 |
0.4.0 ✅ |
All bumps are minor semver additions (new skill), consistent with Keep-a-Changelog ### Added entries. bash-format's jump to 0.5.0 (skipping 0.4.1 in the PR table) is explained by the pre-existing [0.4.1] backfill entry in its changelog. ✅
CHANGELOG backfills
The two undocumented [0.3.1] entries (actionlint, powershell-format) are correctly labelled "Changed — Shared hook-utils.sh resynced" with "no behavior change" notes, consistent with a resync of library code. ✅
Summary: Three low-to-medium observations, all in the skill instruction text rather than in security or structural correctness. The Yarn Classic detection gap in biome-format is the one worth addressing before merge; the other two are clarifications. No blocking issues.
|
Claude finished @kyle-sexton's task in 5m 2s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
SummaryHigh-quality tranche. All 9 SKILL.md files conform to the uniform contract, version bumps match the PR table, and the three write-path skills ( Findings1. CHANGELOG version gap in biome-format, ruff-format, and eol-normalizer (medium — consistency)The PR explicitly backfills undocumented
2. Biome
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✓ |
| Reads hook/skill source first, doesn't recite the SKILL.md | ✓ |
apply re-runs check before acting |
✓ |
Write paths named in argument-hint (biome/ruff/playwright) |
✓ |
| States change before running | ✓ |
| Re-probes after every remediation (never trusts exit code) | ✓ |
Never writes plugin cache, user settings, or pluginConfigs |
✓ |
| Non-interactive when action argument is supplied | ✓ |
Security highlights ✓
-
Firecrawl credential protection is thorough:
FIRECRAWL_API_KEYtested with[[ -n "${FIRECRAWL_API_KEY:-}" ]], result reported as "set/unset" only, with an explicit "NEVER print, echo, log, or persist the value" prohibition and the same constraint applied to thefirecrawl --statusre-check. Optional env vars (FIRECRAWL_API_URL,FIRECRAWL_NO_TELEMETRY) also presence-only. The three-state PASS/INFO/FAIL logic correctly handles the lazy-install model. -
Playwright global install is the only machine-global write across all 9 skills (
npm install -g @playwright/cli). It's correctly gated behindapply install-cli, explicitly labelled "global install that mutates the user's machine", stated before running, and re-probed afterward. -
PSScriptAnalyzer trust callout in powershell-format correctly surfaces that
CustomRulePathin a settings file executes during analysis on every edit — same trust level as build/CI config — and the check step'sGet-Module -ListAvailableprobe is correctly read-only (no format/lint/mutate side effects). -
Ruff venv install never creates a virtual environment and refuses ambiguous states, matching the hook's own resolution path.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c799558d17
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Repository rule violations found
… list Codex on #355: git check-attr answers for any candidate path and the hook normalizes untracked and brand-new files the same as tracked ones (verified: no tracked-only restriction in the hook source), so the policy probe no longer scopes itself to tracked paths. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 3m 11s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
What the latest commit fixedThe pushed commit ( Remaining findingsMedium — biome-format:
|
| Plugin | plugin.json on main |
CHANGELOG gap |
|---|---|---|
biome-format |
0.3.1 |
[0.3.0] → [0.4.0], no [0.3.1] |
ruff-format |
0.3.1 |
[0.3.0] → [0.4.0], no [0.3.1] |
eol-normalizer |
0.3.1 |
[0.3.0] → [0.4.0], no [0.3.1] |
The bump in PR #298 was purely a hook-utils.sh library resync (the same reason cited in the actionlint/powershell-format backfills) with no behavior change in any of the three plugins' own hooks. The same backfill text applies: "Changed — Shared hook-utils.sh resynced (lib sync only; no behavior change in this plugin's hook)."
Low — ruff-format: uv detection heuristic unspecified in apply install-ruff
File: plugins/ruff-format/skills/setup/SKILL.md
Line: 59–60
install into it with the repo's own tooling:
uv pip install ruffwhen the repo uses uv, otherwise.venv's ownpip install ruff
"When the repo uses uv" has no detection heuristic in the skill text (presence of uv.lock? [tool.uv] in pyproject.toml? command -v uv && uv venv --help?). The "Read the hook first" mandate means a model will derive this from the hook source, so drift is unlikely — but it is inconsistent with the explicit specification given for every other detection heuristic in the same file.
Low — firecrawl: firecrawl --status may make a network call in the check phase
File: plugins/firecrawl/skills/setup/SKILL.md
Line: 35
firecrawl --status is invoked in the check (read-only) step. Depending on the CLI implementation, --status may make a network call to validate the API key. The check section's framing is "Do not modify anything" — a network probe arguably falls within that intent, but the caveat is worth acknowledging explicitly: "note: --status is a read-only network probe; it does not modify any state."
Contract invariants — all pass
| Invariant | Status |
|---|---|
disable-model-invocation: true on all 9 |
✅ |
check is read-only (probes only) |
✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint |
✅ |
| States change before executing | ✅ |
| Re-verifies after remediation (not exit-code only) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Hook/skill source is designated single source of truth | ✅ |
Security — all clear
| Item | Status |
|---|---|
FIRECRAWL_API_KEY presence-only, never printed |
✅ |
| Optional firecrawl env vars also presence-only | ✅ |
powershell-format PSScriptAnalyzer CustomRulePath trust callout |
✅ |
playwright global install gated behind explicit apply install-cli arg |
✅ |
No ../ reach-outs; all plugin paths use ${CLAUDE_PLUGIN_ROOT} |
✅ |
| eol-normalizer candidate-path probe (latest commit) | ✅ |
Summary
Two medium items to address before merge: the pnp parenthetical in biome-format's Yarn detection (factually incorrect — an unset Berry nodeLinker returns undefined, not pnp) and the three missing [0.3.1] CHANGELOG entries (same backfill the PR already applies to actionlint/powershell-format). The two low items are clarifications. No blocking security or structural issues.
…t, eol-normalizer) The #298 hook-utils resync bumped these three to 0.3.1 without a changelog entry (verified via git log -S on main); same backfill as actionlint and powershell-format in this tranche. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 2m 58s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fixes landed since the previous reviewsTwo findings from the two prior round-trips have been closed: eol-normalizer tracked-path probe ( CHANGELOG Remaining findingMedium — biome-format: Yarn Berry
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code alone) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), never printed — ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled — ✅ - powershell-format trust callout for
CustomRulePathinPSScriptAnalyzerSettings.psd1surfaced incheck— ✅ PSInstall-Module PSScriptAnalyzercorrectly framed as user-scope guidance (stated for reader to run, never executed by the skill) — ✅- No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout — ✅
Summary: Two prior findings are closed (eol-normalizer probe scope, CHANGELOG backfills). One medium issue remains in biome-format: the Yarn Berry nodeLinker-unset vs Yarn Classic disambiguation needs a yarn --version gate before the nodeLinker check. The two low-severity observations (ruff uv heuristic, firecrawl status network call) are acceptable gaps. Everything else is clean.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 45f4c6618f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…esh session Codex on #355: setx and profile edits do not reach the running process, so the immediate re-check would report a false failure. The env-var remediation now states the new-session requirement and defers its verification to a fresh-session check instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 2m 27s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fixes landed since the previous reviewfirecrawl Remaining findingMedium — biome-format: Yarn Berry
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
Security — all clear
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅- playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: One medium finding remains in biome-format (Yarn Berry nodeLinker-unset vs Yarn Classic disambiguation — the yarn --version gate). This has now been raised four times across two independent reviewers without landing a fix. The firecrawl setx new-session fix (1ba8a1e) and all prior fixes are clean. Everything else is conformant.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1ba8a1e68d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex on #355: firecrawl login/config state authenticates without any env var, so env-unset with CLI present is not a failure when firecrawl --status reports authenticated. The status line is now the verdict; env-var presence is reported alongside, with an INFO note when auth comes from persisted CLI config — never directing the user to stack an env key on top of working CLI-config auth. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 2m 39s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fix landed in this roundfirecrawl: CLI Remaining medium finding — biome-format: Yarn Berry
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: One fix landed (a5ce3aa — firecrawl auth verdict). One medium finding remains in biome-format (Yarn --version gate before nodeLinker, now 5 rounds). The exact patch is included above. Everything else is conformant and ready to merge once that line is corrected.
|
Claude finished @kyle-sexton's task in 1m 52s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fix applied locally — push blockedI committed the Yarn disambiguation fix locally but the Remaining medium finding — biome-format: Yarn detection (6th round)File: -change is stated before running. For a Yarn repository, don't infer the linker — ask the
-repo's own Yarn: run `yarn config get nodeLinker` in the repo. `pnp` (Berry's default when
-unset) → skip the install and give guidance, because Plug'n'Play generates a loader file,
-not the `node_modules/.bin` shim the hook resolves; install `@biomejs/biome` on `PATH` or
-switch the linker. `node-modules`/`pnpm`, or Yarn Classic (which has no such setting and
-always materializes `node_modules`) → install. The verify-after-remediation rule below is
+change is stated before running. For a Yarn repository, don't infer the linker — probe
+the repo's own Yarn in two steps. First run `yarn --version`: a `1.x` output means Yarn
+Classic, which always materialises `node_modules` → proceed with `yarn add -D`. For `2.x`+
+(Yarn Berry), run `yarn config get nodeLinker`: `node-modules` or `pnpm` → install; `pnp`
+→ skip and give guidance, because Plug'n'Play generates a loader file, not the
+`node_modules/.bin` shim the hook resolves; install `@biomejs/biome` on `PATH` or switch
+the linker. Treat `undefined`, empty, or a non-zero exit (Berry's state when `nodeLinker`
+is absent from `.yarnrc.yml`, whose effective linker is PnP) the same as `pnp` → skip and
+give guidance. The verify-after-remediation rule below isLow-severity observations (not blocking — unchanged from prior rounds)ruff-format: uv detection heuristic unspecified — firecrawl: Contract invariants — all pass
Security — all clear
Summary: The Yarn |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6368269012
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex on #355: a bare install into a uv- or Poetry-managed .venv bypasses the manifest/lockfile, so uv sync or environment recreation silently removes Ruff and the hook returns to its skip state. Managed projects now get the project's own dependency command (uv add --dev / poetry add --group dev); the direct pip install path is reserved for a plain .venv with no managing tool. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…lodic-software/claude-code-plugins into feat/setup-contract-tranche-a
|
Claude finished @kyle-sexton's task in 2m 7s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fixes landed since the previous reviewruff-format: managed dependency state ( ruff-format: uv detection heuristic (carried from low-severity list) — the same Remaining findingMedium — biome-format: Yarn Berry
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffnever creates an environment or installs globally ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: Two findings closed this round (424c3fb): ruff-format's managed dependency state and the uv detection heuristic. One medium finding remains in biome-format (Yarn --version gate before nodeLinker, 7 rounds). The exact patch is above. Push access is not available to this bot account.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aab8607af5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex on #355: (1) firecrawl setup gains a remediation for the key-set-but-unauthenticated state (replace the key without handling the old value, then re-run --status) so apply can resolve its own finding; (2) ruff-format's Poetry path first confirms an in-project environment — Poetry defaults to a cache-dir virtualenv the hook never resolves (hook resolves repo-ancestor .venv or PATH only), so without one the skill guides (virtualenvs.in-project true + recreate, or PATH) instead of running an install that leaves the check failing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 2m 16s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fixes confirmed in
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffnever creates an environment, installs globally, or installs outside a managed environment ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: Three findings closed this round (7efba13): firecrawl invalid-key remediation, ruff Poetry in-project gate, and ruff uv detection heuristic. One medium finding remains in biome-format (Yarn --version gate before nodeLinker, 8 rounds). The exact patch is in the diff above. Push access is not available to this bot account — the fix needs to be applied by @kyle-sexton.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7efba136d9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex on #355: a Pipenv project with an in-repo .venv fell through to the bare pip install branch, leaving Pipfile/Pipfile.lock unchanged so pipenv clean or recreation removes Ruff. Pipenv joins the managed-tool set (pipenv install --dev ruff) with the same in-project-environment gate as Poetry, and the plain-.venv branch now requires no uv/Poetry/Pipenv markers. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 1m 54s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fix confirmed in
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffnever creates an environment, installs globally, or installs outside a managed environment ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: a8f2c11 cleanly closes the Pipenv managed-dependency-state finding. One medium finding remains in biome-format (Yarn --version gate before nodeLinker, now 9 rounds). The exact patch is above — push access is not available to this bot account, so it needs to be applied by @kyle-sexton.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a8f2c110bb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex on #355: (1) firecrawl setup adds the missing decision-table row — status errors with a set key report INDETERMINATE with the error and a retry suggestion, never a key-change directive off an unanswered probe; (2) ruff-format's pyproject test now states the hook's actual rule: [tool.ruff] or any [tool.ruff.*] subtable counts as governing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 2m 5s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fixes confirmed in
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffnever creates an environment, installs globally, or installs outside a managed environment ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: Two findings closed in a97fd8f (firecrawl INDETERMINATE state; ruff subtable config). One medium finding remains in biome-format (Yarn --version gate before nodeLinker, 10 rounds). The exact patch is above; local commit 6162a40 is ready but push access is unavailable to this bot account.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a97fd8f6d3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…back Codex on #355: a uv project before its first lock ([tool.uv] present, no uv.lock) with an existing .venv fell through to bare pip install, leaving Ruff out of uv's declared dependencies. The uv marker set now includes the [tool.uv] section, and the plain-venv branch requires the absence of lockfiles AND pyproject sections for all three tools. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 1m 54s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fix confirmed in
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffnever creates an environment, installs globally, or installs outside a managed environment ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: beed7e9 closes the ruff-format [tool.uv] finding cleanly. One medium finding remains in biome-format (Yarn --version gate before nodeLinker, 11 rounds). The exact patch is in the diff above; local commit d79ec03 is ready but push access is not available to this bot account — the fix needs to be applied by @kyle-sexton.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: beed7e9c6a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…determinate covers unset key Codex on #355 flagged actionlint's setup reporting FAIL prerequisites while the toggle deliberately disables the hook (which exits through its enabled-gate before probing). Applied as a class fix across all seven hook-plugin setups in this tranche: a disabled toggle downgrades every prerequisite absence to INFO, noted as restoring FAIL semantics on re-enable. Firecrawl's INDETERMINATE verdict now covers an unanswered status probe regardless of key state — persisted CLI-config credentials may be valid, so no key creation is directed off an unanswered probe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 2m 27s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fixes confirmed in
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
| Disabled-toggle downgrades prereq FAILs to INFO (7 hook plugins) | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffnever creates an environment, installs globally, or installs outside a managed environment ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: Two findings closed in 249c52c (disabled-toggle prereq downgrade across 7 hook plugins; firecrawl INDETERMINATE regardless of key state). One medium finding remains in biome-format (Yarn --version gate before nodeLinker, 12 rounds). The exact patch is in the diff above; local commit c5529bb is ready but push access is not available to this bot account — the fix needs to be applied by @kyle-sexton.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 249c52c1cb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex on #355: uv add syncs by default and creates .venv when absent, violating the skill's never-create guarantee. With no existing .venv the skill now records the dependency via uv add --dev ruff --no-sync and hands uv sync to the consumer as their own step, deferring the re-check until after it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 2m 20s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fix confirmed in
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
| Disabled-toggle downgrades prereq FAILs to INFO (7 hook plugins) | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffnever creates an environment, installs globally, or installs outside a managed environment ✅ - ruff uv no-
.venvpath uses--no-syncto avoid creating the environment ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: d1ec672 closes the ruff-format uv add --no-sync finding cleanly. One medium finding remains in biome-format (Yarn --version gate before nodeLinker, 13 rounds). The exact patch is in the diff above; local commit 03faaf3 is ready but push access is not available to this bot account — the fix needs to be applied by @kyle-sexton.
Carries the class fix from this PR's seven other hook-plugin setups to the freshly merged flagship: a disabled toggle downgrades prerequisite FAILs to INFO, noted as restoring FAIL semantics on re-enable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 5m 5s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fix confirmed in
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
| Disabled-toggle downgrades prereq FAILs to INFO (all 9 including markdown-format) | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffnever creates an environment, installs globally, or installs outside a managed environment ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: 421051a closes the markdown-format disabled-toggle gap. One medium finding spans both biome-format (13 rounds) and markdown-format (newly identified as the exemplar source): the Yarn --version gate before nodeLinker. Local commit 2c514d9 has the exact patch for both — push access is not available to this bot account, so the fix needs to be applied by @kyle-sexton.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 421051aa1e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… ladder Codex rounds kept finding tools and states the enumerated ladder missed (PDM; env-creating add commands under in-project config). The section is now six ordered principles — identify the manager from the repo's own markers, record through it never around it, never create or mutate an environment (record-only mode or hand the sync to the consumer), install only where the hook resolves, bare pip only in a plain unmanaged .venv, ambiguity stops — with the tool commands as examples. Any manager, present or future, resolves through the same rules. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 3m 0s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fix confirmed in
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
| Disabled-toggle downgrades prereq FAILs to INFO (all 9 + markdown-format) | ✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffnever creates an environment, installs globally, or installs outside a managed environment ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: 90f184f closes the remaining ruff-format findings cleanly — the ordered-principles structure is comprehensive and future-proof. One medium finding remains across both biome-format and markdown-format (Yarn --version gate before nodeLinker). The fix has been committed locally as 16cae19 but push access is unavailable to this bot account — apply the diffs above to close this PR.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 90f184f8e2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…y semantics (8 setups) Codex on #355: per the playbook's smoke-tested finding, --config is ignored once a plugin is installed, so the advertised headless reconfigure command could not change the setting on the only state setup runs in. All eight hook-plugin setups now direct interactive /plugin configure any time, and the headless path states the fresh-install-only semantics with uninstall-then-install --config. (source-control's setup carries the same stale command — tranche-3 scope, noted for that PR.) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Claude finished @kyle-sexton's task in 2m 41s —— View job PR Review — feat: adopt the uniform setup contract across 9 formatter/CLI plugins
Fix confirmed in
|
| Invariant | All 9 |
|---|---|
disable-model-invocation: true |
✅ |
| Reads hook/skill source first, doesn't recite SKILL.md | ✅ |
apply re-runs check before acting |
✅ |
Write paths named in argument-hint (biome/ruff/playwright) |
✅ |
| States change before running | ✅ |
| Re-probes after remediation (never trusts exit code) | ✅ |
Never writes plugin cache, user settings, or pluginConfigs |
✅ |
| Non-interactive when action argument supplied | ✅ |
| Disabled-toggle downgrades prereq FAILs to INFO (all 9 + markdown-format) | ✅ |
Headless toggle remediation states --config fresh-install-only semantics (8 hook plugins) |
✅ |
Security — all clear
- Firecrawl
FIRECRAWL_API_KEYpresence-only ([[ -n "${FIRECRAWL_API_KEY:-}" ]]), value never printed ✅ - playwright
apply install-cliis the only machine-global write, correctly gated and labelled ✅ - powershell-format
CustomRulePathtrust callout surfaced incheck✅ - ruff
apply install-ruffordered-principles: never creates an environment, never installs outside a managed environment,--no-syncwhen no.venvexists ✅ - No
../reach-outs;${CLAUDE_PLUGIN_ROOT}used throughout ✅
Summary: 9851ef8 closes the headless toggle finding cleanly across all eight hook-plugin setups. One medium finding remains: the Yarn --version gate before nodeLinker in biome-format and markdown-format. The fix has been committed locally as de7bbdc but push access is unavailable to this bot account — apply the two diffs above to close the last open finding before merge.
1 participant
Summary
Tranche 2 of wave #314 (epic #313, dim 8): the battle-tested markdown-format exemplar from #342 (six adversarial review rounds), cloned to the nine collision-free shape-A plugins.
apply install-biome— repo package manager (lockfile → packageManager → npm; Plug'n'Play → guidance)apply install-ruff— only into a managed env the repo already uses; never creates oneFIRECRAWL_API_KEYpresence without printing itapply install-cli— stated-before-running global npm installContract invariants everywhere:
checkreads the plugin's own hook/skill source as single source of truth and probes what it actually does (no hand-copied lists to drift);applyre-checks first, names every write path in the argument-hint, states it before running, re-verifies after every remediation; never writes the plugin cache, user settings, orpluginConfigs; non-interactive when the action is supplied;disable-model-invocation: true.Also backfills the undocumented
[0.3.1]CHANGELOG entries in actionlint and powershell-format (#298's hook-utils resync, verified viagit log -S).Deferred for lane ownership (per the org WIP survey): disk-hygiene (PR #286 touches its plugin.json/CHANGELOG) and guardrails (PR #305 ditto) — they join a later tranche after those PRs land.
Verification
validate-plugins.sh,validate-plugin-contracts.mjs(28 setup skills, 1513 files), markdownlint (55 files),typos: all green locally.Related
No linked issue: tranche 2 of #314 — the issue closes with the wave's final tranche.
🤖 Generated with Claude Code