Skip to content

fix(engine): unblock Opus 5.5 deep tier — valid Sonnet 5 id, fresh CLI cache, honest chain errors (#1957) #1958

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
don-petry merged 6 commits into from
Sep 27, 2026
Merged

fix(engine): unblock Opus 5.5 deep tier — valid Sonnet 5 id, fresh CLI cache, honest chain errors (#1957) #1958

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6274c2c
fix(engine): unblock Opus 5.5 deep tier — valid Sonnet 5 id, fresh CL…
Sep 27, 2026
33d813a
fix(workflows): install the exact claude-code version the cache key w…
Sep 27, 2026
beddd2c
fix(engine): keep the chain hop log to redacted error fields only
Sep 27, 2026
d3f1bae
test: keep token-shaped literals out of the hop-log redaction test
Sep 27, 2026
b81747f
fix: honour job-pinned CLI versions; omit non-JSON stdout from the ho…
Sep 27, 2026
1ad231f
test: let teardown reach its unset lines in test_engine_error_class.bats
Sep 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 28 additions & 1 deletion .github/workflows/daily-pr-review-health.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,13 +42,40 @@ jobs:
with:
node-version: '20'

- name: Resolve claude-code version
# A literal "latest" cache key never changes, so the first CLI ever cached
# was reused indefinitely (2.1.138 outlived the Opus 5.5 launch — #1957).
# Resolve it to the concrete npm version so a new release misses the cache,
# and install exactly that version on a miss (never re-resolve "latest");
# a pinned vars.CLAUDE_CODE_VERSION passes through unchanged.
id: claude_code_version
env:
REQUESTED_VERSION: ${{ env.CLAUDE_CODE_VERSION || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
v="$REQUESTED_VERSION"
install="$v"
if [ "$v" = "latest" ]; then
v="$(npm view @anthropic-ai/claude-code version 2>/dev/null || true)"
Comment thread
don-petry marked this conversation as resolved.
if [ -n "$v" ]; then
install="$v"
else
v="latest-$(date -u +%G-w%V)"
echo "::warning::could not resolve the latest claude-code version; using weekly cache key $v"
fi
fi
echo "claude-code cache version: $v"
echo "version=$v" >> "$GITHUB_OUTPUT"
echo "install=$install" >> "$GITHUB_OUTPUT"

- name: Cache claude-code CLI
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.npm-global
key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
key: claude-code-${{ steps.claude_code_version.outputs.version }}-${{ runner.os }}

- name: Install Claude Code CLI
env:
CLAUDE_CODE_VERSION: ${{ steps.claude_code_version.outputs.install || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
mkdir -p "$HOME/.npm-global"
npm config set prefix "$HOME/.npm-global"
Expand Down
29 changes: 28 additions & 1 deletion .github/workflows/dependency-advisory.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,13 +53,40 @@ jobs:
with:
node-version: '20'

- name: Resolve claude-code version
# A literal "latest" cache key never changes, so the first CLI ever cached
# was reused indefinitely (2.1.138 outlived the Opus 5.5 launch — #1957).
# Resolve it to the concrete npm version so a new release misses the cache,
# and install exactly that version on a miss (never re-resolve "latest");
# a pinned vars.CLAUDE_CODE_VERSION passes through unchanged.
id: claude_code_version
env:
REQUESTED_VERSION: ${{ env.CLAUDE_CODE_VERSION || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
v="$REQUESTED_VERSION"
install="$v"
if [ "$v" = "latest" ]; then
v="$(npm view @anthropic-ai/claude-code version 2>/dev/null || true)"
if [ -n "$v" ]; then
install="$v"
else
v="latest-$(date -u +%G-w%V)"
echo "::warning::could not resolve the latest claude-code version; using weekly cache key $v"
fi
fi
echo "claude-code cache version: $v"
echo "version=$v" >> "$GITHUB_OUTPUT"
echo "install=$install" >> "$GITHUB_OUTPUT"

- name: Cache claude-code CLI
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.npm-global
key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
key: claude-code-${{ steps.claude_code_version.outputs.version }}-${{ runner.os }}

- name: Install Claude Code CLI
env:
CLAUDE_CODE_VERSION: ${{ steps.claude_code_version.outputs.install || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
mkdir -p "$HOME/.npm-global"
npm config set prefix "$HOME/.npm-global"
Expand Down
32 changes: 30 additions & 2 deletions .github/workflows/dev-lead-reusable.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,17 +320,43 @@ jobs:
run: bash .dev-lead/scripts/dev-lead-preflight.sh

# ── Install engine CLIs ───────────────────────────────────────────────
- name: Resolve claude-code version
# A literal "latest" cache key never changes, so the first CLI ever cached
# was reused indefinitely (2.1.138 outlived the Opus 5.5 launch — #1957).
# Resolve it to the concrete npm version so a new release misses the cache,
# and install exactly that version on a miss (never re-resolve "latest");
# a pinned vars.CLAUDE_CODE_VERSION passes through unchanged.
id: claude_code_version
if: env.INTENT_TYPE != 'skip' && env.INTENT_TYPE != 'enable-auto-merge'
env:
REQUESTED_VERSION: ${{ env.CLAUDE_CODE_VERSION || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
v="$REQUESTED_VERSION"
install="$v"
if [ "$v" = "latest" ]; then
v="$(npm view @anthropic-ai/claude-code version 2>/dev/null || true)"
if [ -n "$v" ]; then
install="$v"
else
v="latest-$(date -u +%G-w%V)"
echo "::warning::could not resolve the latest claude-code version; using weekly cache key $v"
fi
fi
echo "claude-code cache version: $v"
echo "version=$v" >> "$GITHUB_OUTPUT"
echo "install=$install" >> "$GITHUB_OUTPUT"

- name: Cache claude-code CLI
if: env.INTENT_TYPE != 'skip' && env.INTENT_TYPE != 'enable-auto-merge'
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.npm-global
key: claude-code-${{ vars.CLAUDE_CODE_VERSION || 'latest' }}-${{ runner.os }}
key: claude-code-${{ steps.claude_code_version.outputs.version }}-${{ runner.os }}

- name: Install engine CLIs
if: env.INTENT_TYPE != 'skip' && env.INTENT_TYPE != 'enable-auto-merge'
env:
CLAUDE_CODE_VERSION: ${{ vars.CLAUDE_CODE_VERSION || 'latest' }}
CLAUDE_CODE_VERSION: ${{ steps.claude_code_version.outputs.install || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
set -euo pipefail
mkdir -p "$HOME/.npm-global"
Expand All @@ -341,6 +367,8 @@ jobs:
if ! command -v claude >/dev/null 2>&1; then
npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}"
fi
# Log the CLI version in use, cached or fresh (#1957).
echo "claude-code version: $(claude --version 2>/dev/null || echo unavailable)"

case "$DEV_LEAD_ENGINE" in
claude)
Expand Down
29 changes: 28 additions & 1 deletion .github/workflows/docs-health-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,13 +43,40 @@ jobs:
with:
node-version: '20'

- name: Resolve claude-code version
# A literal "latest" cache key never changes, so the first CLI ever cached
# was reused indefinitely (2.1.138 outlived the Opus 5.5 launch — #1957).
# Resolve it to the concrete npm version so a new release misses the cache,
# and install exactly that version on a miss (never re-resolve "latest");
# a pinned vars.CLAUDE_CODE_VERSION passes through unchanged.
id: claude_code_version
env:
REQUESTED_VERSION: ${{ env.CLAUDE_CODE_VERSION || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
v="$REQUESTED_VERSION"
install="$v"
if [ "$v" = "latest" ]; then
v="$(npm view @anthropic-ai/claude-code version 2>/dev/null || true)"
if [ -n "$v" ]; then
install="$v"
else
v="latest-$(date -u +%G-w%V)"
echo "::warning::could not resolve the latest claude-code version; using weekly cache key $v"
fi
fi
echo "claude-code cache version: $v"
echo "version=$v" >> "$GITHUB_OUTPUT"
echo "install=$install" >> "$GITHUB_OUTPUT"

- name: Cache claude-code CLI
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.npm-global
key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
key: claude-code-${{ steps.claude_code_version.outputs.version }}-${{ runner.os }}

- name: Install Claude Code CLI
env:
CLAUDE_CODE_VERSION: ${{ steps.claude_code_version.outputs.install || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
mkdir -p "$HOME/.npm-global"
npm config set prefix "$HOME/.npm-global"
Expand Down
29 changes: 27 additions & 2 deletions .github/workflows/gh-aw-cross-org.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,15 +79,40 @@ jobs:
git -C target-repo config user.email "${BOT_USER}@users.noreply.github.com"
git -C target-repo config user.name "${BOT_USER}"

- name: Resolve claude-code version
# A literal "latest" cache key never changes, so the first CLI ever cached
# was reused indefinitely (2.1.138 outlived the Opus 5.5 launch — #1957).
# Resolve it to the concrete npm version so a new release misses the cache,
# and install exactly that version on a miss (never re-resolve "latest");
# a pinned vars.CLAUDE_CODE_VERSION passes through unchanged.
id: claude_code_version
env:
REQUESTED_VERSION: ${{ env.CLAUDE_CODE_VERSION || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
v="$REQUESTED_VERSION"
install="$v"
if [ "$v" = "latest" ]; then
v="$(npm view @anthropic-ai/claude-code version 2>/dev/null || true)"
if [ -n "$v" ]; then
install="$v"
else
v="latest-$(date -u +%G-w%V)"
echo "::warning::could not resolve the latest claude-code version; using weekly cache key $v"
fi
fi
echo "claude-code cache version: $v"
echo "version=$v" >> "$GITHUB_OUTPUT"
echo "install=$install" >> "$GITHUB_OUTPUT"

- name: Cache claude-code CLI
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.npm-global
key: claude-code-${{ vars.CLAUDE_CODE_VERSION || 'latest' }}-${{ runner.os }}
key: claude-code-${{ steps.claude_code_version.outputs.version }}-${{ runner.os }}

- name: Install engine CLIs
env:
CLAUDE_CODE_VERSION: ${{ vars.CLAUDE_CODE_VERSION || 'latest' }}
CLAUDE_CODE_VERSION: ${{ steps.claude_code_version.outputs.install || vars.CLAUDE_CODE_VERSION || 'latest' }}
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
GH_TOKEN: ${{ secrets.GH_PAT_DON_PETRY || secrets.GITHUB_TOKEN }}
run: |
Expand Down
33 changes: 31 additions & 2 deletions .github/workflows/pr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,11 +316,36 @@ jobs:
echo "::warning::could not resolve pr-review identity from manifest; using fallback BOT_USER=$BOT_USER"
fi

- name: Resolve claude-code version
# A literal "latest" cache key never changes, so the first CLI ever cached
# was reused indefinitely (2.1.138 outlived the Opus 5.5 launch — #1957).
# Resolve it to the concrete npm version so a new release misses the cache,
# and install exactly that version on a miss (never re-resolve "latest");
# a pinned vars.CLAUDE_CODE_VERSION passes through unchanged.
id: claude_code_version
env:
REQUESTED_VERSION: ${{ env.CLAUDE_CODE_VERSION || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
v="$REQUESTED_VERSION"
install="$v"
if [ "$v" = "latest" ]; then
v="$(npm view @anthropic-ai/claude-code version 2>/dev/null || true)"
if [ -n "$v" ]; then
install="$v"
else
v="latest-$(date -u +%G-w%V)"
echo "::warning::could not resolve the latest claude-code version; using weekly cache key $v"
fi
fi
echo "claude-code cache version: $v"
echo "version=$v" >> "$GITHUB_OUTPUT"
echo "install=$install" >> "$GITHUB_OUTPUT"

- name: Cache claude-code CLI
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.npm-global
key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
key: claude-code-${{ steps.claude_code_version.outputs.version }}-${{ runner.os }}

- name: Verify auth scopes
# Inlined from scripts/verify-auth-scopes.sh so this step is self-contained
Expand Down Expand Up @@ -392,6 +417,8 @@ jobs:
fi

- name: Install review engine CLIs
env:
CLAUDE_CODE_VERSION: ${{ steps.claude_code_version.outputs.install || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
set -euo pipefail

Expand Down Expand Up @@ -427,7 +454,9 @@ jobs:
echo "claude-code cache hit: $(claude --version)"
return 0
fi
npm_install_retry "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}"
npm_install_retry "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" || return 1
# Log the version actually in use on a fresh install too (#1957).
echo "claude-code installed: $(claude --version 2>/dev/null || echo unavailable)"
}

case "$REVIEW_ENGINE" in
Expand Down
29 changes: 28 additions & 1 deletion .github/workflows/readme-refresh.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,13 +45,40 @@ jobs:
with:
node-version: '20'

- name: Resolve claude-code version
# A literal "latest" cache key never changes, so the first CLI ever cached
# was reused indefinitely (2.1.138 outlived the Opus 5.5 launch — #1957).
# Resolve it to the concrete npm version so a new release misses the cache,
# and install exactly that version on a miss (never re-resolve "latest");
# a pinned vars.CLAUDE_CODE_VERSION passes through unchanged.
id: claude_code_version
env:
REQUESTED_VERSION: ${{ env.CLAUDE_CODE_VERSION || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
v="$REQUESTED_VERSION"
install="$v"
if [ "$v" = "latest" ]; then
v="$(npm view @anthropic-ai/claude-code version 2>/dev/null || true)"
if [ -n "$v" ]; then
install="$v"
else
v="latest-$(date -u +%G-w%V)"
echo "::warning::could not resolve the latest claude-code version; using weekly cache key $v"
fi
fi
echo "claude-code cache version: $v"
echo "version=$v" >> "$GITHUB_OUTPUT"
echo "install=$install" >> "$GITHUB_OUTPUT"

- name: Cache claude-code CLI
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.npm-global
key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
key: claude-code-${{ steps.claude_code_version.outputs.version }}-${{ runner.os }}

- name: Install Claude Code CLI
env:
CLAUDE_CODE_VERSION: ${{ steps.claude_code_version.outputs.install || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
mkdir -p "$HOME/.npm-global"
npm config set prefix "$HOME/.npm-global"
Expand Down
29 changes: 28 additions & 1 deletion .github/workflows/skill-eval-report.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,13 +118,40 @@ jobs:
with:
node-version: '20'

- name: Resolve claude-code version
# A literal "latest" cache key never changes, so the first CLI ever cached
# was reused indefinitely (2.1.138 outlived the Opus 5.5 launch — #1957).
# Resolve it to the concrete npm version so a new release misses the cache,
# and install exactly that version on a miss (never re-resolve "latest");
# a pinned vars.CLAUDE_CODE_VERSION passes through unchanged.
id: claude_code_version
env:
REQUESTED_VERSION: ${{ env.CLAUDE_CODE_VERSION || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
v="$REQUESTED_VERSION"
install="$v"
if [ "$v" = "latest" ]; then
v="$(npm view @anthropic-ai/claude-code version 2>/dev/null || true)"
if [ -n "$v" ]; then
install="$v"
else
v="latest-$(date -u +%G-w%V)"
echo "::warning::could not resolve the latest claude-code version; using weekly cache key $v"
fi
fi
echo "claude-code cache version: $v"
echo "version=$v" >> "$GITHUB_OUTPUT"
echo "install=$install" >> "$GITHUB_OUTPUT"

- name: Cache claude-code CLI
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ~/.npm-global
key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
key: claude-code-${{ steps.claude_code_version.outputs.version }}-${{ runner.os }}

- name: Install Claude Code CLI
env:
CLAUDE_CODE_VERSION: ${{ steps.claude_code_version.outputs.install || vars.CLAUDE_CODE_VERSION || 'latest' }}
run: |
mkdir -p "$HOME/.npm-global"
npm config set prefix "$HOME/.npm-global"
Expand Down
6 changes: 6 additions & 0 deletions .gitleaksignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,3 +39,9 @@ e27ed0f3d755e58b9d5ccc30e8eec835bb0ccb68:tests/test_miss_harvest.bats:github-pat
# these entries suppress those findings. Not a real credential.
b37877721cd419b963b86d970c26cc3383761e33:tests/dev-lead/unit/test_fewshot_assemble.bats:github-pat:33
b37877721cd419b963b86d970c26cc3383761e33:tests/dev-lead/unit/test_fewshot_assemble.bats:github-pat:85

# commit beddd2c (#1957 hop-log redaction test): a literal dummy ghp_ token fed
# through redact_secrets to prove it is scrubbed. The next commit assembles the
# token at runtime, so only this historical commit carries the literal.
beddd2cfaa173b620df231e9be476131100738e3:tests/dev-lead/unit/test_engine_error_class.bats:github-pat:179
beddd2cfaa173b620df231e9be476131100738e3:tests/dev-lead/unit/test_engine_error_class.bats:github-pat:186
2 changes: 1 addition & 1 deletion scripts/aw.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ for field in ("name", "trigger", "engine", "permissions"):

# Validate engine — warn on unknown but don't fail (new models can be added without a code change)
known_engines = {
"claude-sonnet-4-6", "claude-sonnet-5-0", "claude-haiku-4-5-20251001",
"claude-sonnet-4-6", "claude-sonnet-5", "claude-haiku-4-5-20251001",
"claude-opus-4-7", "claude-haiku-4-5",
}
engine = fm.get("engine", "")
Expand Down
Loading
Loading