From fbea2ed30a2b14d121b2736d0c34a39f12edc84f Mon Sep 17 00:00:00 2001 From: Yanir <67261194+Yanir-R@users.noreply.github.com> Date: Sat, 10 Oct 2026 14:58:50 +0000 Subject: [PATCH 1/2] Add the PR review config, fix the memory gate, list the reset hook (0.2.1) --- .claude-plugin/plugin.json | 2 +- .pr_agent.toml | 45 ++++++++++++++++++++++++++++++++++++++ CHANGELOG.md | 9 ++++++++ README.md | 1 + scripts/release-check.sh | 15 ++++++++++--- 5 files changed, 68 insertions(+), 4 deletions(-) create mode 100644 .pr_agent.toml diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index 94c8d9a..a26f3fc 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "catchup", - "version": "0.2.0", + "version": "0.2.1", "description": "Summarize the agent messages you have not read, in plain ASD-STE100-style English. Run /catchup, type \"brief me\", or press the Catch up button.", "license": "MIT", "author": { diff --git a/.pr_agent.toml b/.pr_agent.toml new file mode 100644 index 0000000..d39d690 --- /dev/null +++ b/.pr_agent.toml @@ -0,0 +1,45 @@ +# Settings for the automatic PR review (Qodo Merge / PR-Agent). +# Lean on purpose: one review and a few suggestions, no description rewrite, no labels. +# The rules below fit any Claude Code mod. A person reviews and merges; this is a second reader, not a gate. + +[config] +response_language = "en-US" + +[github_app] +pr_commands = ["/review", "/improve"] +handle_pr_actions = ["opened", "reopened", "ready_for_review"] +feedback_on_draft_pr = false + +[pr_reviewer] +num_max_findings = 5 +require_security_review = true +require_tests_review = true +require_estimate_effort_to_review = false +require_can_be_split_review = false +require_todo_scan = false +enable_review_labels_effort = false +enable_review_labels_security = false +extra_instructions = """ +This repository is a Claude Code mod (a plugin made of function hooks). Report only real problems, each with a file and a line. Check these: +1. Capabilities. List the capability calls the change adds (the validate report shows them on its calls line). Flag any call to the file, process, network, environment, settings, store, state or MCP capabilities, or to prompt submit or session send, unless the PR says why. The release gate fails on the first six. +2. Hooks. Flag a new hook on tool.call, tool.check, prompt.submit or session.append, because it sees every call or prompt. Each hook must be listed in the README. A hook that does not handle an event must return next(e). +3. The $ rules. Call $.noun.method(...) plainly. Pass $ only as a whole argument to a function declared at the top level of the same file, never to an imported function, and never inside the arguments of another $ call. Avoid generic names such as run that another function shadows. +4. State. A render hook must not write state. After any write to in-memory data, call $.ui.invalidate('ui.render'). New data must be cleared on /clear, /resume and /branch. +5. Privacy. Text from messages must not reach a file, the network, a log or a test. Secrets and emails are removed before a model call. Tests use made-up data only. +6. Output. A claim of success needs a proof and a source, or it is shown as not checked. Facts that code can read come from code, not from the model. +7. Compatibility. Do not rename the command, a setting or the plugin name. A phrase trigger must match the whole prompt. +8. Tests. A new rule needs a test that fails when the code is wrong. Flag a test that cannot fail. +9. Release. The version, CHANGELOG and README match the change (Semantic Versioning). +Do not comment on style or naming that the tests and the scan do not require. +""" + +[pr_code_suggestions] +num_code_suggestions_per_chunk = 3 +focus_only_on_problems = true +suggestions_score_threshold = 6 +extra_instructions = """ +Suggest only a change that fixes a bug, a privacy leak, a broken $ rule, or a missing test. Keep the code short and match the style around it. +""" + +[ignore] +glob = ['docs/media/**', '*.png', '*.gif', '*.mp4'] diff --git a/CHANGELOG.md b/CHANGELOG.md index 9a443f9..0098756 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,15 @@ All notable changes to this project are written here. The format follows ## [Unreleased] +## [0.2.1] - 2026-10-10 + +### Changed +- The README lists the hook that clears the summary after `/clear`, `/resume` and `/branch`. +- The release gate no longer writes the capability names out in one pattern, so a text scan does not read them as calls. + +### Added +- `.pr_agent.toml`: settings for an automatic pull request review, with a short checklist for a Claude Code mod. + ## [0.2.0] - 2026-10-10 ### Changed diff --git a/README.md b/README.md index c6bf2b8..e4edf33 100644 --- a/README.md +++ b/README.md @@ -130,6 +130,7 @@ DONE 1 ยท DECIDED 1 - `session.start`: registers the `/catchup` command. - `command.run`: opens the pane for `/catchup [N]`. - `prompt.submit`: when the whole prompt is a phrase such as `brief me`, it opens the pane and does not send the prompt to the agent. Any other prompt passes through unchanged. +- `classic.SessionStart`: after `/clear`, `/resume` or `/branch` (not after a compaction), it forgets the summary and the handled list. It changes nothing else. - `session.append`: counts new agent messages for the button. It changes nothing. - `ui.render`: draws the button and the pane, and reports which rows are on screen. diff --git a/scripts/release-check.sh b/scripts/release-check.sh index 340c265..0044137 100755 --- a/scripts/release-check.sh +++ b/scripts/release-check.sh @@ -11,12 +11,21 @@ printf '%s\n' "$report" # The README says the mod keeps the summary in memory only. The validator lists every capability the code # calls, so this ties that claim to a check: no state, no store, no file, no network, no process. printf '\n== memory only\n' +hit='' +for name in state store fs http process env; do + if printf '%s\n' "$report" | grep -F 'calls:' | grep -qF "\$.$name."; then + hit="$hit$name " + fi +done + if ! printf '%s\n' "$report" | grep -q 'calls:'; then echo "FAIL: the validate report has no 'calls:' line, so the check cannot run" failed=1 -elif printf '%s\n' "$report" | grep -E 'state (reads|writes)|declares state|calls:.*\$\.(state|store|fs|http|process|env)\.' >/dev/null; then - echo "FAIL: the mod uses state, the store, files, the network or a process. Update the README privacy text or remove it." - printf '%s\n' "$report" | grep -E 'state (reads|writes)|declares state|calls:' +elif printf '%s\n' "$report" | grep -qE 'state (reads|writes)|declares state'; then + echo "FAIL: the mod uses state. Update the README privacy text or remove it." + failed=1 +elif [ -n "$hit" ]; then + echo "FAIL: the mod calls these capabilities: $hit. Update the README privacy text or remove them." failed=1 else echo "ok: no state, store, file, network or process calls" From 8a181de6920cb0d872b88ff701765365c9281525 Mon Sep 17 00:00:00 2001 From: Yanir Rot Date: Sun, 18 Oct 2026 13:46:00 +0300 Subject: [PATCH 2/2] Drop .pr_agent.toml: nothing runs it Co-Authored-By: Claude Sonnet 5.5 --- .pr_agent.toml | 45 --------------------------------------------- CHANGELOG.md | 3 --- 2 files changed, 48 deletions(-) delete mode 100644 .pr_agent.toml diff --git a/.pr_agent.toml b/.pr_agent.toml deleted file mode 100644 index d39d690..0000000 --- a/.pr_agent.toml +++ /dev/null @@ -1,45 +0,0 @@ -# Settings for the automatic PR review (Qodo Merge / PR-Agent). -# Lean on purpose: one review and a few suggestions, no description rewrite, no labels. -# The rules below fit any Claude Code mod. A person reviews and merges; this is a second reader, not a gate. - -[config] -response_language = "en-US" - -[github_app] -pr_commands = ["/review", "/improve"] -handle_pr_actions = ["opened", "reopened", "ready_for_review"] -feedback_on_draft_pr = false - -[pr_reviewer] -num_max_findings = 5 -require_security_review = true -require_tests_review = true -require_estimate_effort_to_review = false -require_can_be_split_review = false -require_todo_scan = false -enable_review_labels_effort = false -enable_review_labels_security = false -extra_instructions = """ -This repository is a Claude Code mod (a plugin made of function hooks). Report only real problems, each with a file and a line. Check these: -1. Capabilities. List the capability calls the change adds (the validate report shows them on its calls line). Flag any call to the file, process, network, environment, settings, store, state or MCP capabilities, or to prompt submit or session send, unless the PR says why. The release gate fails on the first six. -2. Hooks. Flag a new hook on tool.call, tool.check, prompt.submit or session.append, because it sees every call or prompt. Each hook must be listed in the README. A hook that does not handle an event must return next(e). -3. The $ rules. Call $.noun.method(...) plainly. Pass $ only as a whole argument to a function declared at the top level of the same file, never to an imported function, and never inside the arguments of another $ call. Avoid generic names such as run that another function shadows. -4. State. A render hook must not write state. After any write to in-memory data, call $.ui.invalidate('ui.render'). New data must be cleared on /clear, /resume and /branch. -5. Privacy. Text from messages must not reach a file, the network, a log or a test. Secrets and emails are removed before a model call. Tests use made-up data only. -6. Output. A claim of success needs a proof and a source, or it is shown as not checked. Facts that code can read come from code, not from the model. -7. Compatibility. Do not rename the command, a setting or the plugin name. A phrase trigger must match the whole prompt. -8. Tests. A new rule needs a test that fails when the code is wrong. Flag a test that cannot fail. -9. Release. The version, CHANGELOG and README match the change (Semantic Versioning). -Do not comment on style or naming that the tests and the scan do not require. -""" - -[pr_code_suggestions] -num_code_suggestions_per_chunk = 3 -focus_only_on_problems = true -suggestions_score_threshold = 6 -extra_instructions = """ -Suggest only a change that fixes a bug, a privacy leak, a broken $ rule, or a missing test. Keep the code short and match the style around it. -""" - -[ignore] -glob = ['docs/media/**', '*.png', '*.gif', '*.mp4'] diff --git a/CHANGELOG.md b/CHANGELOG.md index 0098756..a85fb4e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,9 +12,6 @@ All notable changes to this project are written here. The format follows - The README lists the hook that clears the summary after `/clear`, `/resume` and `/branch`. - The release gate no longer writes the capability names out in one pattern, so a text scan does not read them as calls. -### Added -- `.pr_agent.toml`: settings for an automatic pull request review, with a short checklist for a Claude Code mod. - ## [0.2.0] - 2026-10-10 ### Changed