Skip to content

feat(agents): add focused hack-branches, hack-env and hack-diagnose plugin skills - #303

Merged
roodboi merged 94 commits into
nextfrom
wf/w08-b6
Oct 12, 2026
Merged

feat(agents): add focused hack-branches, hack-env and hack-diagnose plugin skills#303
roodboi merged 94 commits into
nextfrom
wf/w08-b6

Conversation

@roodboi

@roodboi roodboi commented Oct 12, 2026 •
edited by blacksmith-sh Bot
Loading

Copy link
Copy Markdown
Contributor

Implements W08 / HACK-1131: focused plugin skills rendered from canonical sections.

Final behavior

  • src/agents/focused-skills.ts composes hack-branches, hack-env and hack-diagnose from INSTRUCTION_SECTIONS ids. It holds no guidance prose of its own, only the routing descriptions. An unknown or repeated id throws a closed error that does not echo the id.
  • New canonical sections (branch-aliases, env-commands, env-safety, diagnose) have surfaces: []. They render only in the focused skills. The broad surfaces (docs snippet, standalone skill, rules, primer) change only in the content revision line.
  • hack-branches starts with branch-instances (--branch <name>), then hack branch add/list/open/remove. Linked worktrees appear only as an optional entry.
  • hack-env renders the canonical W13 env-composition section, which is the only place that states precedence. It then covers env list, env set --local, env exec and env apply, plus safety rules:
    • Secret values never go in argv or prompts. The user enters a secret at the hidden prompt of hack env set <key> --secret.
    • hack env get and hack env list --show-secrets print plaintext. Use them only when the user asks for the value.
    • Prefer hack env explain.
  • hack-diagnose gives the read-first order: ps --json, doctor --json, logs --json --no-follow --tail 200, env explain, then global status. It also includes the canonical operating rules, so doctor --fix runs only within the request. It ships references/error-codes.md through the W07 packaged-references registry.
  • Error-code registry: src/lib/cli-result.ts now exports HACK_ERROR_CODES as a const array. HackErrorCode is derived from it, so the type is unchanged. Meanings are keyed Record<HackErrorCode, …>, so adding a code without a row fails typecheck.
  • hack-cli routing:
    • The plugin hack-cli description sends branch, env and diagnosis intents to the focused skills.
    • The standalone hack setup render keeps its broad description, because those installs ship no focused skills. Its body is unchanged apart from the revision.
  • Base semantic conflict fix: on train/queue-preview, tests/skill-references.test.ts failed. The cause was W13's bare GitHub URL in env-composition, which breaks W07's offline link contract (external-outside-further-reading). The bullet now points to the env guide offline (docs/env.md in the Hack repository) instead.
  • No plugin manifest or MCP layout changes. The manifests already declare skills: ./skills/.
  • Docs and fingerprints:
    • Updated docs: docs/integrations.md, plugins/hack/README.md, docs/agent-guidance.md, and the capability-matrix skill list (regenerated with bun run docs:agent-client-capabilities).
    • Content revision is now 0201e6bfa037.
    • Appended fingerprints e620e980660f0443df7732fe (hack-cli-skill) and ea46c0d85989de79dba95fd4 (cursor-rules) to KNOWN_RENDER_FINGERPRINTS.

Validation

  • bun run generate:agent-plugins. Repository targets (.codex/skills/hack-cli, .cursor/rules/hack.mdc, examples/basic/AGENTS.md and CLAUDE.md) were re-rendered with their install functions and explicit project roots. No user or global sync was run.
  • bun test: 74 pass, 0 fail across tests/focused-skills.test.ts, tests/integration-ownership.test.ts, tests/agent-plugin-generation.test.ts, tests/skill-references.test.ts (this one failed on the base), tests/agent-instruction-source.test.ts, tests/pattern-catalogue.test.ts and tests/agent-client-capabilities.test.ts.
  • Also passing: onboarding-prompt, shared-agent-skill, hack-init-skill, setup, init-agent-integrations, cli-result, interactivity, cli-reference-docs, runtime-guidance, legacy-agent-artifacts, agent-onboard-command and env-command-matrix.
  • bun run --cwd packages/cli typecheck passes.
  • bun run --cwd packages/cli check: 0 errors. The 34 warnings are all in files this PR does not touch.
  • bun run typecheck and bun run check pass.
  • CLI surface unchanged, so no docs:cli-reference regeneration was needed.

tests/focused-skills.test.ts checks:

  • Every section id exists.
  • Sections render verbatim and in order, with no skill-local headings.
  • Focused-only sections stay out of the broad surfaces.
  • hack-branches starts with --branch and lists all four subcommands, with worktrees optional.
  • hack-env lists its commands, and precedence wording appears only in env-composition.
  • hack-env contains no secret-looking argv example.
  • hack-diagnose keeps the read-first order and mentions --fix only after the reads.
  • Every hack command and flag in the four plugin skill renders and in the error-code reference resolves in CLI_SPEC, using the W03 walker.
  • The error-code reference rows equal HACK_ERROR_CODES, both rendered and packaged.
  • Descriptions parse as YAML and match the routing sentence.
  • No trigger phrase is shared across all seven plugin skill descriptions.

Negative controls

  • A fake E_FAKE_CODE row fails parity (unexpected E_FAKE_CODE). A removed row and an unrendered registry entry fail as missing.
  • Copying a hack-env trigger into the hack-diagnose description fails the overlap test (hack-env -> hack-diagnose).
  • An unknown or duplicated section id fails composition with a closed message.
  • The walker rejects hack branch rename, hack env set --shared and hack logs --last.

Remaining gaps

  • Client loading not observed. No client has been seen loading the three new skills or using their trigger routing in a fresh session. The capability matrix keeps skill discovery untested for every client. Closing this needs an isolated client home on a host.
  • Routing quality not evaluated. The trigger-phrase test checks that phrases do not overlap. It does not prove that clients pick the intended skill; that still needs trigger evaluations.
  • Conflicting refusal hint (not changed here). The non-TTY refusal hint in hack env set (src/commands/env.ts) still suggests passing a value as an argument, which conflicts with the new secret-handling guidance. Changing CLI behavior is outside this unit.
  • Possible conflict with W09. W09 runs in parallel. Its manifest work may touch plugins/hack/README.md or the capability doc wording.

🤖 Generated with Claude Code

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.

roodboi and others added 30 commits October 11, 2026 21:28
@roodboi @claude
docs: add versioned agent-client capability matrix and policy controls
d111802 
Add a data-only matrix (src/agents/client-capabilities.ts) that classifies
packaging, skill discovery, hooks, plugin MCP, standalone MCP, rules and UI
for Codex, Claude Code, Cursor and standalone consumers. Each cell records
status, evidence class, evidence ref, observed client version, source SHA
and host label. The rendered reference doc carries companion-package layout
and model-policy ownership decisions.

Tests enforce that every cell is classified, verified cells cite an existing
fixture-strength test, manifest or listing evidence never verifies loading,
and manifest-declared components agree with the matrix. The plugin
generation test gains a negative-controlled scan of plugins/hack and
examples/basic for model, permission and output-style settings and
non-primer hooks, plus a skill inventory check against the generator and
docs/integrations.md, which now names all four shipped skills.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
fix(mcp): harden run argv and tool input contract
58c485a 
hack.project.run built `run <flags> <service> <cmd...>`, so hack's own
parser consumed child flags: `node --version` printed hack's version and
`--branch other` retargeted the instance. Run now emits
`run <flags> -- <service> <cmd...>` and every option value is fused as
`--opt=value` across all tools.

- Validate service, services, branch, profiles, logs service and open
  target against a compose-identifier pattern (no leading '-', no empty
  value; branches may also contain '/').
- tail, maxEvents, maxMs and timeoutMs are positive integers with hard
  ceilings (provisional F27 settings); effective limits are echoed in
  data.limits.
- Every tool carries annotations (readOnly for list/status/logs/open,
  destructive for down/run/init, openWorld false).
- Refusals return error{code, message} with existing codes (E_USAGE,
  E_PROJECT_NOT_FOUND) and spawned:false. A typed tools/call dispatcher
  validates before any handler runs, so refused calls leave no argv
  entry and no audit line.
- Children spawn with HACK_NO_INTERACTIVE=1 on a copy of the frozen
  session env.

Refs HACK-1133, HACK-1134

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
fix(env): harden legacy env key files and AES-GCM envelope parsing
c6c0db3 
Legacy project env key reads (checkout-local, shared common-dir and
inherited primary keys) now use the same lstat, O_NOFOLLOW, size-bound and
stable-descriptor discipline as the native reader, extracted into
src/lib/private-file.ts. Key priority is unchanged. A symlinked, dangling,
oversized or non-regular key file is refused with a fixed message.

New key files are created with open(O_CREAT|O_EXCL|O_NOFOLLOW|O_WRONLY,
0600), fchmod 0600 and fsync, so an existing entry or dangling symlink is
never followed or replaced. A concurrent creator's key is adopted.

Encryption (env add --secret and the legacy migration) refuses a git-tracked
selected or inherited key with a fixed, value-free message before any key
copy. Decryption with a tracked key stays allowed for v4 compatibility.

Legacy v1 values and the encrypted_file store now require canonical base64,
a 12-byte IV, a 16-byte tag (authTagLength pinned) and a bounded ciphertext;
all parse, tamper and wrong-key failures use fixed redacted errors. The
envelope format, key derivation and v1 decryptability are unchanged.

Refs HACK-1127

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi
Merge remote-tracking branch 'origin/next' into w14-rework
de862d7
@roodboi
Merge remote-tracking branch 'origin/next' into w06-rework
dc88c6b
@roodboi @claude
fix(agents): generate capability matrix doc and parse all guidance co…
ffeecce 
…nfig

Address verifier findings on the agent-client capability matrix:

- Move the matrix renderer into scripts/generate-agent-client-capabilities.ts
  and add `bun run docs:agent-client-capabilities` (with `--check`), which
  rewrites only the generated section. The test compares the committed
  section with the rendered one and covers marker failures with closed codes.
- Scope the model/permission policy scan to generated guidance surfaces
  (plugins/hack, .claude-plugin, .cursor-plugin, .agents through its skill
  symlinks, and the example agent configuration) instead of example compose
  files. Parse YAML and markdown frontmatter as YAML, fail closed on
  structured-config formats the scan cannot parse, and count a file as
  scanned only when it was parsed.
- Treat reasoning-effort keys (reasoning_effort, model_reasoning_effort,
  frontmatter `effort`, nested effort/reasoning keys) as forbidden model
  settings, with negative controls.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
fix(mcp): make typed refusals value-free and keep unknown-tool in-band
56bac3a 
Every pre-spawn refusal now comes from a closed catalogue (MCP_REFUSALS):
error {code, reason, message} uses an existing code, a closed reason and a
fixed message, and stderr repeats that message. Project names, ids, paths
and registry values are no longer echoed. Schema refusals name only keys
of the tool's own input schema.

An unknown tool name returns the SDK's in-band isError text result again
instead of a JSON-RPC -32602 protocol error, with a fixed message that
omits the requested name.

A canary test drives every refusal reason and the unknown-tool path and
asserts the canary never appears in the result, with no spawn or audit line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
chore: merge origin/next into wf/w15-w5-6
12e80af 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
test(env): pin AES-GCM IV, size and tag-length guards with discrimina…
cd76b26 
…ting tests

Seal authentic envelopes with 8- and 16-byte IVs and with ciphertext one
byte over each parser bound, so only the parser guards can refuse them, and
assert through a createDecipheriv spy that structural refusals happen before
any decipher and that successful opens pass authTagLength 16. Covers the
legacy project env, encrypted_file store and native env value parsers, with
at-bound 12-byte-IV controls.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
fix(init): stop writing repo-local agent files by default
bcf88ec 
Interactive `hack init` now prints a non-mutating note that points at the
optional Hack plugin and `hack agent onboard`. Repository-local export of
Cursor rules, Claude hooks, Codex skills, AGENTS.md/CLAUDE.md sections and
project MCP config is a separate opt-in whose confirm defaults to no and
whose target list starts empty. The decision moves out of project.ts into
src/agents/init-agent-integrations.ts.

Doctor and the agent-prime freshness inventory now treat absent optional
integrations as current. Doctor flags a path only when it exists and lacks
the current revision marker (AGENTS.md/CLAUDE.md only when they carry a
Hack-managed section). integration-sync counts only stale or errored
checks; user-owned docs without a Hack section are not drift; retired
legacy artifacts still are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
fix(env): resolve --env base and default the same way on every command
c005262 
config plan and config validate only treated the literal "base" as the
base selection, so `--env default` (and DEFAULT/none) reached the native
compiler as an overlay named "default" while env get, env list and the
runtime commands selected base layers.

Every CLI command that accepts --env now resolves it through one shared
resolver (src/cli/env-selection.ts): omitted keeps the configured default
overlay, base/default/none in any case select base layers, other names are
normalized, and a non-empty value with no usable name characters is refused
with the fixed "Invalid --env value." usage error instead of silently
selecting base. Authored native dispatch uses the same resolver, and
session workspace names stay env-base.

docs/env.md gains a command and delivery matrix with one row per CLI_SPEC
command that accepts --env; tests/env-command-matrix.test.ts keeps the rows
and selector flags in sync with CLI_SPEC. The canonical agent guidance gains
an env-composition section linking to the matrix; the content revision,
plugin bundle, repository examples and CLI reference are regenerated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
fix(agents): count corrupted and unreadable integrations as drift
6136946 
Address the W10 verifier findings so integration sync and doctor agree:

- checkAgentDocs marks a doc `unmanaged` only when it has neither the
  Hack start nor end marker. A doc with exactly one marker is a corrupted
  managed section and now reports a malformed-marker error, which sync
  counts as drift. Doctor treats the same doc as stale.
- Add readOptionalTextFile, which uses lstat before reading so callers
  can tell "absent" from "present but unreadable". The Cursor rules,
  Codex skill, shared skill, hack-init skill and agent-doc checks now
  report an unreadable existing file as `error` (drift) instead of
  `missing` (optional, current). Doctor uses the same helper.
- Add regression tests for start-only and end-only docs, plus mode-000
  Hack-owned files and docs in fixture HOME/project roots, for both
  sync and doctor.

Default `hack init` still writes no repository files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
test(env): pin the console logger backend for CLI refusal tests
9854d1b 
The env add --secret refusal tests asserted the refusal text on stderr, but
the default logger backend depends on the host: gum (stderr) when installed,
clack (stdout) otherwise. Hosted macOS runners have no gum, so the refusal
reached stdout and stderr was empty only in CI. Pin HACK_LOGGER=console in
the CLI helper, matching the other CLI-spawning tests, so the stderr
assertions hold on every host.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
test(mcp): assert closed ambiguous_project refusal in project-name suite
6e1ff63 
The project-name boundary suite still expected the old value-echoing
"Ambiguous project name/ID" stderr from MCP. Assert the closed
MCP_REFUSALS contract instead: exact code, reason and fixed message,
spawned: false, no argv, and none of the duplicated names, registry ids
or fixture root anywhere in the serialized result.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
chore(x01): temporary witness cost trace for hosted measurement
1f8b51e 
Temporary measurement only; reverted before the final commit. Writes closed
labels and durations per native command to a per-scenario JSONL file and
prints a summary in the docker-e2e job.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
perf(storage): coalesce witness helper work per native command
0911e6d 
A storage-bearing saved exec ran three full witness proofs (nine helper
carriers) and a warm up/restart seven. Within one command and one mutation
lease, an adjacent repeat with only read-only checks between it and the
previous proof now reuses that completed kernel proof instead of three new
helper carriers:

- saved exec: the pre-spawn check reuses the preparation proof; the proof
  after the process stays fresh (3 -> 2 proofs);
- up/restart without build, routing or file material: the first pre-spawn
  guard reuses the enrollment proof (warm 7 -> 6, cold seed path 6 -> 5).

Reuse requires the same lease authority, engine, generation and reference
and a byte-identical opening material binding to the one that opened and
closed the recorded proof. Every host check (anchors, expectation,
completion, binding, carrier artifact and lifetime) still runs; any
verification consumes the record first, so a failure or binding change
forces a fresh proof. Ordinary verification always proves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
chore(x01): revert temporary witness cost trace
eb9a678 
Reverts the hosted measurement commit (closed-label cost trace, phase-trace
routing, per-scenario summary step and artifact) now that the per-phase and
per-call attribution is recorded in the pull request.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
test(e2e): restore the networks scenario budget after witness coalescing
7b2ccfc 
The networks scenario took 3409 s on next with three proofs per storage exec
and ran 2275 s on the hosted engine with the coalesced proofs, so the 80 min
budget raise from the witness recovery change returns to 60 min. The budget
bounds a hung engine; no assertion or command deadline changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi
Merge remote-tracking branch 'origin/next' into wf/x03-witness-probes
fa7741c
@roodboi @claude
perf(storage): make witness engine and executable fences cheaper
37f093a 
Storage witness proofs keep every fence; three exact costs are cut:

- Engine-ID fences: for an explicit DOCKER_HOST=unix:///... selection, the
  first fence of a command under one exact binding (selection, docker
  executable, client config and socket identities) still uses `docker info`
  and must equal one direct GET /info on that socket; only then do later
  fences under that unchanged binding each make one fresh direct request
  instead of a CLI process that lists every client plugin. A refused
  admission keeps the CLI, a moved binding re-admits through the CLI, and an
  admitted direct failure refuses without fallback. Two exact back-to-back
  ID reads with nothing between them are collapsed (holder observation into
  carrier inspect; provision fence into the target observation).
- Recorded command executables: the content digest is cached for one command
  by canonical path and complete stat identity (dev, ino, size, mtime and
  ctime in ns, mode, uid); every identity check still runs, any change
  re-reads, and racily fresh files are never cached.
- Target observations: the witness's closing re-observation of a
  deferred-finish verify invocation is answered by the carrier's own closing
  observation of the same query when the rechecked material binding is
  unchanged and only reads ran between (one observation per proof).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
chore(x03): temporary witness probe trace for hosted measurement
6a4e118 
Temporary measurement only; reverted before the final commit. Re-applies the
X01 closed-label trace (reverting eb9a678) and adds point events for direct
engine-ID reads and admissions, cached executable digests, target observations
and reused closing observations, plus a shard 1 identity fence benchmark.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
fix(storage): keep closed probe cancellation for direct engine-ID fences
2b11ed3 
An admitted direct engine-ID read that fails because the caller cancelled or
its probe deadline expired now reports the CLI probe's existing closed
cancel/timeout classification; that probe refuses before spawning anything.
Every other admitted direct failure still refuses without CLI fallback.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
test(storage): pin witness fence counts and refusal controls
a777bc4 
- Per command on the synthetic engine: 81 of 86 engine-ID fences and 20 of 21
  target observations per proof, with every proof kept; an admitted explicit
  Unix selection uses one CLI fence per command.
- A changed daemon ID between two admitted fences refuses before any helper,
  workload or state change; a refused admission keeps every fence on the CLI.
- A target change right after the verify carrier's closing observation is
  refused by the next remaining observation.
- Admission, re-admission, no-fallback and cancellation controls on a real
  Unix server; executable digest reuse, replacement, same-size tamper, mode,
  racy-fresh and mid-command replacement controls.
- Reference docs describe the three cuts and their limits.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
chore(x03): revert temporary witness probe trace
994ddb8 
Measurement is complete; the hosted trace run was 38211327829.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
feat(agents): package offline skill references and the HACK-P pattern…
3edbd54 
… catalogue

Plugin skills can now ship references at skills/<skill>/references/*.md from
a typed registry (src/agents/skill-references.ts). The generator writes each
reference with a recomputable content revision, removes stale ones, and links
them from the plugin SKILL.md. Standalone hack-cli installs ship no
references, so their render (and ownership fingerprint) is unchanged.

The first reference is the hack-cli pattern catalogue, rendered from the typed
register of all twelve HACK-P cards with dispositions, owners, missing
contracts and value-free provenance. Tests check completeness, CLI_SPEC
command resolution, a banned-recipe scan outside negative-example blocks, and
an offline link contract over every packaged skill markdown file. External
URLs in hack-install and hack-remote move under "Further reading".

docs/agent-guidance.md records the reference contract and the promote/defer
decision for the lifecycle, cleanup, checks, sessions, hack-run and
hack-feedback skill candidates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
test(e2e): add agent-surface-freeze negative control for guidance writes
726cc27 
Seed an isolated HOME with sentinel Claude, Codex, Cursor and shared-skill
config (including stale hack-cli copies) and two fixtures with customized
AGENTS.md, CLAUDE.md, rules, skill copies, settings.local.json and .mcp.json.
Run init --auto, init --auto --with codex, agent prime, agent prime --check,
agent onboard, agent patterns, doctor --json, doctor --fix --no-interactive
and setup sync --check twice each with HOME and HACK_HOME overridden, and
require byte-identical hashes, no new client entries, git status changes only
under .hack/, and each command's expected exit code. An explicit
setup agents --agents-md is the positive control and must change exactly
AGENTS.md.

Docker is pointed at a missing socket and Mutagen at a stub so doctor --fix
stays free of Docker and network effects; the hackd it starts is stopped.
The scenario is registered in ALL_SCENARIOS and shard.ts places it in
exactly one docker-e2e shard via the default duration hint.

Refs: HACK-1124, HACK-1132, HACK-1155

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
ci: add gated Bun crash experiment and read-only crash census
9b971fa 
HACK-1211 needs a matched, bounded way to reproduce the intermittent Bun
crash and a repeatable record of crashes per hosted run. This adds the
instruments only; it changes no test, timeout, assertion or pin.

- bun-crash-experiment.yml runs only on workflow_dispatch or when the
  bun-crash-experiment label is added to a pull request. A labeled pull
  request runs the matched pair (1.3.9 baseline, 1.4.2 candidate) on its
  head; a dispatch runs one version at a chosen revision. It uses
  blacksmith-6vcpu-macos-15, contents: read, and timeout = budget + 15.
  The instrument comes from the workflow's commit, so older revisions
  can be measured.
- scripts/bun-crash-loop.ts alternates the native HTTPS owner test with
  the full bun test. It never starts an iteration whose estimate (its
  initial guess or longest observed run) ends past the budget, and
  records a run still going at the deadline as overrun, not a crash. It
  writes a closed summary and keeps logs plus bun*.ips reports for a
  7-day artifact. It never opens crash-report links.
- scripts/ci-bun-crash-census.ts reads every attempt's test job through
  the caller's gh, downloads only failed-job logs into an owned temp dir
  that it removes, and prints per-version counts and crashing ids only.
- Both use scripts/lib/bun-crash-classify.ts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
perf(storage): read engine identity directly for docker context selec…
1342871 
…tions

Storage-witness engine-ID admissions now resolve the Docker CLI's endpoint
selection the way the CLI does: a nonempty DOCKER_HOST, then DOCKER_CONTEXT,
then the client config's currentContext, then the default context at
unix:///var/run/docker.sock. A named context is read from its
contexts/meta/<sha256>/meta.json through a no-follow binding; only a plain
unix:/// docker endpoint with no TLS option, no unknown or duplicate field and
no entry at the context's TLS path is eligible. TLS material is checked for
absence by name and never opened. Missing, malformed, linked, TCP, SSH, TLS or
header-bearing contexts, and DOCKER_HOST with DOCKER_CONTEXT, keep the CLI.

Admission is unchanged: the first fence under a binding is the CLI read and
must equal one direct GET /info on the resolved socket. The binding now also
pins the context store entry and the absent TLS path, so a changed config,
context entry, socket or executable is admitted through the CLI again. The
ingress and VM-file observers, trusted without a CLI comparison, still accept
only an explicit Unix DOCKER_HOST.

Tests that run commands against a synthetic docker now pin an isolated client
config naming a missing context, so they never read the contributor's Docker
config or dial a real engine socket. A new opt-in test (HACK_TEST_DOCKER_CLI=1,
run on docker-e2e shard 4) runs the real Docker CLI against two fake Unix
engines for every selection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
chore(x04): temporary witness probe trace for hosted measurement
c2ecf9c 
Temporary measurement only; reverted before the final commit. Re-applies the
X03 closed-label trace (6a4e118) without its identity benchmark, labels each
engine-ID admission with its selection kind (host, default or context), counts
direct reads as trace leaves, and prints the runner's Docker client selection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
chore(x04): revert temporary witness probe trace
5cf9f0f 
Measurement is complete; the hosted trace run was 38225752202.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
roodboi and others added 7 commits October 12, 2026 10:10
@roodboi @claude
Merge branch 'next' into wf/c5-confighash-b7
0a26c64 
Re-parents onto next after the queued PRs squashed in; no content change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'next' into wf/c4-keydiag-b7
07413d0 
Re-parents onto next after the queued PRs squashed in; no content change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'next' into wf/c6-gum-dash-b7
6a043c0 
Re-parents onto next after the queued PRs squashed in; no content change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'next' into wf/y4-patterns-b6
13165f9 
Re-parents onto next after the queued PRs squashed in. next's tree equals train/queue-preview 77da332, which this branch already contains, so the branch tree is kept unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'next' into wf/y5-staleenv-b6
92c2ee1 
Re-parents onto next after the queued PRs squashed in. next's tree equals train/queue-preview 77da332, which this branch already contains, so the branch tree is kept unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'next' into wf/y3-envfile-b6
4243d60 
Re-parents onto next after the queued PRs squashed in. next's tree equals train/queue-preview 77da332, which this branch already contains, so the branch tree is kept unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'next' into wf/w08-b6
7425da0 
Re-parents onto next after the queued PRs squashed in. next's tree equals train/queue-preview 77da332, which this branch already contains, so the branch tree is kept unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi
roodboi changed the base branch from train/queue-preview to next October 12, 2026 14:10
roodboi and others added 12 commits October 12, 2026 10:10
@roodboi @claude
Merge branch 'next' into wf/y1-logs-b6
c044445 
Re-parents onto next after the queued PRs squashed in. next's tree equals train/queue-preview 77da332, which this branch already contains, so the branch tree is kept unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/y1-logs-b6' into wf/y2-mcptools-b6
6dadbe5 
Picks up the re-parent onto next; no content change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'next' into wf/c1-stdin-b7
ed7d2f4 
Re-parents onto next after the queued PRs squashed in. next's tree equals train/queue-preview 77da332, which this branch already contains, so the branch tree is kept unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/c6-gum-dash-b7' into wf/y3-envfile-b6
989fcea 
Stack PR #302 on PR #311.

Conflicted files: none. The two change sets are disjoint (#302:
env-file and secret-store hygiene; #311: src/ui/gum.ts with its tests
and fixture), so git merged them cleanly. No generated files changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/y3-envfile-b6' into wf/c4-keydiag-b7
c6055dd 
Conflicted files: none. Git auto-merged the only shared file:
- docs/env.md: kept both sides' text (the env key doctor notes from this
  branch and the private env file and encrypted_file store notes from
  wf/y3-envfile-b6).

No generated files changed: neither branch alters CLI options or rendered
agent guidance, so plugins, docs/reference/cli.md, integration-revision.ts
and KNOWN_RENDER_FINGERPRINTS needed no update.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/c4-keydiag-b7' into wf/y4-patterns-b6
6a754df 
Conflicted files: none. The merge applied cleanly; the two change sets
touch disjoint files.

Regenerated plugins (generate:agent-plugins) and docs/reference/cli.md
(docs:cli-reference) after the merge; both produced no changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/y4-patterns-b6' into wf/c5-confighash-b7
ef04f02 
Conflicted files: none. The merge was clean; the two change sets touch
disjoint files. Regenerated agent plugins and docs/reference/cli.md
produced no diff.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/c5-confighash-b7' into wf/y5-staleenv-b6
b0cde14 
Stack PR #301 on PR #307. The merge had no textual conflicts.
Git auto-merged docs/env.md, tests/e2e/run.ts and tests/e2e/shard.ts;
each keeps both sides (stale env warning plus env key/private file docs;
both exec-stale-env and compose-config-hash-drift scenarios and hints).
Regenerated plugins and docs/reference/cli.md produced no drift.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/y5-staleenv-b6' into wf/y1-logs-b6
5a258e6 
Conflicted files: none. The two change sets touch disjoint files, so git
merged them automatically. Generated surfaces (plugin bundle, CLI reference,
checked-in renders) were regenerated after the merge and showed no drift.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/y1-logs-b6' into wf/y2-mcptools-b6
642775e 
Conflicted files: none. The plain merge applied cleanly.

Regenerated surfaces (generate:agent-plugins, docs:cli-reference)
produced no changes, so integration-revision.ts and
KNOWN_RENDER_FINGERPRINTS are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/y2-mcptools-b6' into wf/c1-stdin-b7
2fa96a2 
Conflicted files: none. Git merged both sides cleanly; docs/env.md and
src/lib/project-env-config.ts were changed by both branches and
auto-merged with both sides' content kept.

Generated files: bun run generate:agent-plugins and
bun run docs:cli-reference produced no changes. The checked-in renders
(.codex/skills/hack-cli, .codex/skills/hack-init, .claude/skills/hack-init,
.cursor/rules/hack.mdc, examples/basic AGENTS.md and CLAUDE.md) are
byte-equal to their install/render functions run against a temp project
root. integration-revision.ts and KNOWN_RENDER_FINGERPRINTS keep the
wf/c1-stdin-b7 values; wf/y2-mcptools-b6 did not change guidance.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/c1-stdin-b7' into wf/w08-b6
30936fe 
Conflicted files and resolutions:

- docs/agent-guidance.md: kept both paragraphs; the pattern-example
  paragraph from wf/c1-stdin-b7 follows the catalogue checks, then the
  focused-skills paragraph from wf/w08-b6.
- src/agents/integration-ownership.ts: KNOWN_RENDER_FINGERPRINTS is the
  append-only union of both sides, plus the combined renders that
  tests/integration-ownership.test.ts requested (hack-cli-skill
  680a52ef6737d979ed2d384b, cursor-rules afa91b84e719bd416b9dfea3).
- src/agents/integration-revision.ts: set to 9f26e5752230, the value
  tests/agent-instruction-source.test.ts computes for the merged source.
- plugins/hack/rules/hack.mdc, plugins/hack/skills/hack-cli/SKILL.md:
  regenerated with bun run generate:agent-plugins.
- .codex/skills/hack-cli/SKILL.md, .cursor/rules/hack.mdc,
  examples/basic/AGENTS.md, examples/basic/CLAUDE.md: re-rendered through
  installCodexSkill, installCursorRules and upsertAgentDocs with explicit
  project roots; byte-equal to the renderers (hack-init skills unchanged).

src/agents/instruction-source.ts merged cleanly; docs/reference/cli.md
regenerates unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi
roodboi changed the base branch from next to wf/c1-stdin-b7 October 12, 2026 14:42
roodboi added a commit that referenced this pull request Oct 12, 2026
@roodboi @claude
Merge branch 'wf/w08-b6' into wf/w09-b6
94cdb85 
Stack PR #305 (skills-only hack plugin + opt-in hack-mcp) on PR #303
(focused hack-branches/hack-env/hack-diagnose plugin skills).

Conflicted files and resolution:
- src/agents/integration-revision.ts: set to 5c5c3c9fffea, the value
  tests/agent-instruction-source.test.ts computes for the merged sections.
- src/agents/integration-ownership.ts: KNOWN_RENDER_FINGERPRINTS is the
  append-only union of both sides, plus eba974f66328605864507beb
  (hack-cli-skill) and 270cd2b3fdcc325e04c76d43 (cursor-rules) that
  tests/integration-ownership.test.ts asked for after the merge.
- docs/agent-guidance.md: kept W08's focused-skills.ts and
  error-code-reference.ts rows; the generator row keeps W09's skills-only
  hack plus hack-mcp wording with W08's seven-skill count.
- docs/integrations.md: kept W09's plugin-first section and hack/hack-mcp
  table; the hack row lists W08's seven skills, W08's focused-skill routing
  sentence follows the table, and post-install verification uses W09's
  wording with "seven skills".
- plugins/hack/README.md (hand-written): kept W09's removal of the Codex
  "disable bundled MCP" TOML advice and its hack-mcp verification text,
  with W08's "seven plugin skills" count.
- plugins/hack/rules/hack.mdc, plugins/hack/skills/hack-cli/SKILL.md:
  regenerated with bun run generate:agent-plugins (focused skill renders
  also refreshed for the new revision).
- .codex/skills/hack-cli/SKILL.md, .cursor/rules/hack.mdc,
  examples/basic/AGENTS.md, examples/basic/CLAUDE.md: re-rendered through
  installCodexSkill, installCursorRules, installHackInitSkill and
  upsertAgentDocs with an explicit project root; byte-equal to renderers.
- docs/reference/agent-client-capabilities.md: regenerated with
  bun run docs:agent-client-capabilities.

docs/reference/cli.md was regenerated with bun run docs:cli-reference
(no change).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@blacksmith-sh

This comment has been minimized.

Sign in to view
roodboi and others added 2 commits October 12, 2026 12:05
@roodboi @claude
test(native): use a canonical overlay name in the env selection case
63e1d39 
#308 makes --env require a canonical overlay name instead of slugging input, so ' QA ' is now refused before any project work. Keep the native dispatch case on the documented path with ' qa ' (still exercises trimming); the refusal itself is covered by the env argument redaction tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi @claude
Merge branch 'wf/c1-stdin-b7' into wf/w08-b6
6ecf485 
Picks up the native env selection test update from #308.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Base automatically changed from wf/c1-stdin-b7 to next October 12, 2026 19:07
@roodboi @claude
Merge branch 'next' into wf/w08-b6
e41b424 
Re-parents onto next after the previous stacked PR squashed in; next's tree equals 63e1d39, which this branch already contains, so the branch tree is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi
roodboi marked this pull request as ready for review October 12, 2026 19:08
@roodboi
roodboi merged commit 326edbb into next Oct 12, 2026
24 of 30 checks passed
@roodboi
roodboi deleted the wf/w08-b6 branch October 12, 2026 19:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@roodboi