From 08b2179cd3070e3507de029b6f18c83cff9c4854 Mon Sep 17 00:00:00 2001 From: tend-agent <270458913+tend-agent@users.noreply.github.com> Date: Fri, 7 Aug 2026 08:18:41 +0000 Subject: [PATCH 1/3] fix(running-in-ci): key the --body exemption on shell hazards, not line count --- plugins/tend-ci-runner/skills/running-in-ci/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/tend-ci-runner/skills/running-in-ci/SKILL.md b/plugins/tend-ci-runner/skills/running-in-ci/SKILL.md index a8a4a201..72417921 100644 --- a/plugins/tend-ci-runner/skills/running-in-ci/SKILL.md +++ b/plugins/tend-ci-runner/skills/running-in-ci/SKILL.md @@ -425,7 +425,7 @@ If `EXISTING` is greater than 0, **do not post** — another run already handled ## Comment Formatting -**Compose bodies with the Write tool, then post with `--body-file`.** The composed file is reviewable before it ships, quoting and escaping are non-issues, and line wrapping is just file content. The bot writes to `/tmp/` constantly — one more file is cheap. For one-line bodies, `--body "…"` is fine. +**Compose bodies with the Write tool, then post with `--body-file`.** The composed file is reviewable before it ships, quoting and escaping are non-issues, and line wrapping is just file content. The bot writes to `/tmp/` constantly — one more file is cheap. `--body "…"` is fine only for a one-line body containing no backtick, `$`, `\`, or `!`. Inside double quotes bash runs a backticked span as a command and substitutes its output, so a markdown inline-code span is silently deleted from the posted comment: `` --body "`some-check` now passes" `` ships as ` now passes`. Inline code appears in nearly every body the bot writes, and single-quoting instead breaks on any apostrophe, so reach for `--body-file` whenever the text is anything but plain prose. ```bash # After writing /tmp/comment-body.md with the Write tool: From 1a6f06aca2d94397abc92af2968d25277a793d73 Mon Sep 17 00:00:00 2001 From: tend-agent <270458913+tend-agent@users.noreply.github.com> Date: Fri, 7 Aug 2026 08:35:30 +0000 Subject: [PATCH 2/3] fix(skills): move bundled --body recipes to --body-file; drop ! from the hazard list --- .../skills/review-reviewers/SKILL.md | 7 +++-- .../skills/running-in-ci/SKILL.md | 2 +- plugins/tend-ci-runner/skills/triage/SKILL.md | 27 +++++++++++++++---- plugins/tend-ci-runner/skills/weekly/SKILL.md | 9 ++++--- 4 files changed, 34 insertions(+), 11 deletions(-) diff --git a/plugins/tend-ci-runner/skills/review-reviewers/SKILL.md b/plugins/tend-ci-runner/skills/review-reviewers/SKILL.md index 764ddbb1..84529897 100644 --- a/plugins/tend-ci-runner/skills/review-reviewers/SKILL.md +++ b/plugins/tend-ci-runner/skills/review-reviewers/SKILL.md @@ -132,8 +132,11 @@ if [ -z "$GIST_ID" ]; then fi GIST_ID=$(basename "$GIST_URL") # First time this month for this target — announce the gist on the tracking issue - gh issue comment "$TRACKING_NUMBER" \ - --body "Evidence gist for \`$TARGET\`: $GIST_URL" + # printf, not an inline --body: the backticks are literal inside single + # quotes, so nothing needs escaping and bash can't run the span. + printf 'Evidence gist for `%s`: %s\n' "$TARGET" "$GIST_URL" \ + > /tmp/gist-announce.md + gh issue comment "$TRACKING_NUMBER" --body-file /tmp/gist-announce.md else GIST_URL="https://gist.github.com/$GIST_ID" fi diff --git a/plugins/tend-ci-runner/skills/running-in-ci/SKILL.md b/plugins/tend-ci-runner/skills/running-in-ci/SKILL.md index 72417921..47be359b 100644 --- a/plugins/tend-ci-runner/skills/running-in-ci/SKILL.md +++ b/plugins/tend-ci-runner/skills/running-in-ci/SKILL.md @@ -425,7 +425,7 @@ If `EXISTING` is greater than 0, **do not post** — another run already handled ## Comment Formatting -**Compose bodies with the Write tool, then post with `--body-file`.** The composed file is reviewable before it ships, quoting and escaping are non-issues, and line wrapping is just file content. The bot writes to `/tmp/` constantly — one more file is cheap. `--body "…"` is fine only for a one-line body containing no backtick, `$`, `\`, or `!`. Inside double quotes bash runs a backticked span as a command and substitutes its output, so a markdown inline-code span is silently deleted from the posted comment: `` --body "`some-check` now passes" `` ships as ` now passes`. Inline code appears in nearly every body the bot writes, and single-quoting instead breaks on any apostrophe, so reach for `--body-file` whenever the text is anything but plain prose. +**Compose bodies with the Write tool, then post with `--body-file`.** The composed file is reviewable before it ships, quoting and escaping are non-issues, and line wrapping is just file content. The bot writes to `/tmp/` constantly — one more file is cheap. `--body "…"` is fine only for a one-line body containing no backtick, `$`, or `\`. Inside double quotes bash runs a backticked span as a command and substitutes its output, so a markdown inline-code span is silently deleted from the posted comment: `` --body "`some-check` now passes" `` ships as ` now passes`. Inline code appears in nearly every body the bot writes, and single-quoting instead breaks on any apostrophe, so reach for `--body-file` whenever the text is anything but plain prose. ```bash # After writing /tmp/comment-body.md with the Write tool: diff --git a/plugins/tend-ci-runner/skills/triage/SKILL.md b/plugins/tend-ci-runner/skills/triage/SKILL.md index 3884e60b..ac511759 100644 --- a/plugins/tend-ci-runner/skills/triage/SKILL.md +++ b/plugins/tend-ci-runner/skills/triage/SKILL.md @@ -114,7 +114,11 @@ Step 3's duplicate check catches identical fixes. It misses the *same root cause Closes #$ARGUMENTS" git push -u origin fix/issue-$ARGUMENTS - gh pr create --title "fix: " --body "## Problem + ``` + Compose the body with the Write tool at `/tmp/pr-body.md` — the fill-ins below are freeform prose that routinely carries markdown inline code, which bash executes inside a double-quoted `--body`: + + ```markdown + ## Problem [What the issue reported and the root cause] ## Solution @@ -124,7 +128,11 @@ Step 3's duplicate check catches identical fixes. It misses the *same root cause [How the fix was verified — mention the reproduction test] --- - Closes #$ARGUMENTS — automated triage" + Closes # — automated triage + ``` + + ```bash + gh pr create --title "fix: " --body-file /tmp/pr-body.md ``` 4. Wait for CI per **CI Monitoring** in `/tend-ci-runner:running-in-ci`. @@ -137,11 +145,20 @@ git checkout -b repro/issue-$ARGUMENTS git add -A git commit -m "test: add reproduction for #$ARGUMENTS" git push -u origin repro/issue-$ARGUMENTS -gh pr create --title "test: reproduction for #$ARGUMENTS" --body "## Context -Adds a failing test that reproduces #$ARGUMENTS. The fix is not yet included — this PR captures the reproduction so a maintainer can investigate. +``` + +Compose the body with the Write tool at `/tmp/pr-body.md`: + +```markdown +## Context +Adds a failing test that reproduces #. The fix is not yet included — this PR captures the reproduction so a maintainer can investigate. --- -Automated triage for #$ARGUMENTS" +Automated triage for # +``` + +```bash +gh pr create --title "test: reproduction for #$ARGUMENTS" --body-file /tmp/pr-body.md ``` Note the PR number for the comment. diff --git a/plugins/tend-ci-runner/skills/weekly/SKILL.md b/plugins/tend-ci-runner/skills/weekly/SKILL.md index eb15003f..52acd624 100644 --- a/plugins/tend-ci-runner/skills/weekly/SKILL.md +++ b/plugins/tend-ci-runner/skills/weekly/SKILL.md @@ -34,9 +34,12 @@ If no dependency PRs are open, note "0 dependency PRs to process" and continue t if [ "$LAST_APPROVAL_SHA" = "$HEAD_SHA" ]; then echo "Already approved on this commit; skipping." else - # Compose a one-line review body naming the package, bump type, and what you - # checked — e.g. "ruff 0.13 → 0.14 (patch), CI green, no API changes". - gh pr review --approve --body "$REVIEW_BODY" + # Use the Write tool to compose /tmp/review-body.md — one line naming the + # package, bump type, and what you checked, e.g. "ruff 0.13 → 0.14 (patch), + # CI green, no API changes". Write it to a file rather than an inline + # --body: a package name written as inline code puts a backtick in a + # double-quoted argument, and bash runs the span as a command. + gh pr review --approve --body-file /tmp/review-body.md fi ``` 4. If CI is failing, comment with the failure summary and skip From 5146944e0db3813a37c8c7a5462682f4bb23be9d Mon Sep 17 00:00:00 2001 From: tend-agent <270458913+tend-agent@users.noreply.github.com> Date: Fri, 7 Aug 2026 08:42:38 +0000 Subject: [PATCH 3/3] fix(triage): keep $ARGUMENTS in the PR-body templates --- plugins/tend-ci-runner/skills/triage/SKILL.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/tend-ci-runner/skills/triage/SKILL.md b/plugins/tend-ci-runner/skills/triage/SKILL.md index ac511759..70249327 100644 --- a/plugins/tend-ci-runner/skills/triage/SKILL.md +++ b/plugins/tend-ci-runner/skills/triage/SKILL.md @@ -128,7 +128,7 @@ Step 3's duplicate check catches identical fixes. It misses the *same root cause [How the fix was verified — mention the reproduction test] --- - Closes # — automated triage + Closes #$ARGUMENTS — automated triage ``` ```bash @@ -151,10 +151,10 @@ Compose the body with the Write tool at `/tmp/pr-body.md`: ```markdown ## Context -Adds a failing test that reproduces #. The fix is not yet included — this PR captures the reproduction so a maintainer can investigate. +Adds a failing test that reproduces #$ARGUMENTS. The fix is not yet included — this PR captures the reproduction so a maintainer can investigate. --- -Automated triage for # +Automated triage for #$ARGUMENTS ``` ```bash