Skip to content

skills(running-tend): check the /code-review waiver scan when bumping claude_version #926

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tend-agent wants to merge 2 commits into from
+30 −1
Closed

skills(running-tend): check the /code-review waiver scan when bumping claude_version #926

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
970cf1b
skills(running-tend): check the /code-review waiver scan when bumping…
tend-agent Aug 9, 2026
1292a6e
skills(running-tend): anchor the waiver check on the bundled-skill na…
tend-agent Aug 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion .claude/skills/running-tend/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,36 @@ A stale `claude` binary resolves `--model opus`/`sonnet` to a superseded alias
target, so drift silently downgrades the model. Skim the claude-code CHANGELOG
between the two versions for anything touching the agent paths (first-run
onboarding, `--model` alias resolution, headless `-p` result events, Stop-hook
behavior) and note it in the PR.
behavior, slash-command or `Skill`-tool handling) and note it in the PR.

One of those paths has to be checked against the binary, not the CHANGELOG.
Every generated Claude prompt carries a bare `/code-review` token
(`code_review_notice` in `generator/src/tend/config.py`) to trip the `Skill`
tool's `disable-model-invocation` waiver, and the scan reading it lives in the
binary. `test_default_prompt_unlocks_code_review` pins only our side of that
contract, so if the scan moves, nothing fails — every run just loses its second
pass. Confirm both halves in the version being pinned and report them in the PR:

```bash
V=<version being pinned>
curl -fsSL "https://downloads.claude.ai/claude-code-releases/$V/linux-x64/claude" -o "/tmp/claude-$V"
# Scan regex: whitespace on both sides of a token built from the invoked
# skill's name, which the Skill tool passes in at runtime.
grep -aoE '\(\?<!\\\\S\)/\$\{[^}]+\}\(\?=\$\|\\\\s\)' "/tmp/claude-$V"
# Every binding of the name, with enough context to tell which is which.
grep -aoE '.{90}"code-review".{40}' "/tmp/claude-$V"
```

The second grep prints several hits and only one is the half that matters: the
bundled-skill name list, a run of `var` assignments with `dataviz` and
`code-walkthrough` as neighbors. A `CODE_REVIEW_WORKFLOW_NAME` hit names the
built-in code-review *workflow* instead — a skill-side rename need not move it,
so reading that one as the answer reports "still fine" on exactly the failure
this check exists to catch. Empty output from either grep means the shape
moved; read the surrounding code before concluding the waiver still fires. That
URL is the path the install actually takes — `claude.ai/install.sh` redirects
to the same release bucket — so a version resolving on npm but not there fails
the install.

`mitmproxy_version` pins the process that holds the real PAT and model
credential, so a security fix there matters here. Check anything security- or
Expand Down
Loading