-
Notifications
You must be signed in to change notification settings - Fork 221
feature: unified-shell-resolution (3/4) #1135
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
09f6b6d
19a3dbf
ac0ed1b
a68ac23
683b1e0
4dc9610
28847b3
0e63b22
83e7e38
fae94c7
f851635
b760a0d
bc28103
c08701f
9c3fd51
82d31f4
9a5e2ae
60c5c77
35cc3dc
0f627a9
fcc3f09
47e4687
b2eef0b
502e7df
bf2d780
f033ccc
14f7617
2335da1
1c9e578
57bbae1
065f8f6
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,304 @@ | ||
| --- | ||
| name: local-ci-precheck | ||
| description: Pre-push CI check skill that runs 7 local CI checks (invisible characters, translations, ESLint, TypeScript, knip, unit tests, webview visual) before git push. Prevents CI failures by catching errors locally in ~5 minutes instead of waiting for GitHub Actions. Use when about to git push in the Zoo Code project. | ||
| --- | ||
|
|
||
| # Local CI Pre-check Skill | ||
|
|
||
| ## When to Use This Skill | ||
|
|
||
| Use this skill when: | ||
|
|
||
| - Code mode or Light-Code mode is about to `git push` in the Zoo Code project | ||
| - You want to verify that all locally-runnable CI checks pass before pushing | ||
| - You want to catch lint errors, type errors, test failures, and dead code before CI | ||
|
|
||
| ## When NOT to Use This Skill | ||
|
|
||
| Do NOT use this skill when: | ||
|
|
||
| - The user explicitly passes `--skip-ci-check` | ||
| - Only non-source files changed (e.g., only `.md`, `.json` config files, `.yml` workflow files with no logic changes) | ||
| - Pushing to a branch that does not have CI enabled | ||
|
|
||
| ## Pre-conditions | ||
|
|
||
| Before running checks, verify: | ||
|
|
||
| 1. Node.js is installed (`node --version`) | ||
| 2. Dependencies are installed (`corepack pnpm install`) | ||
| 3. Working directory is the Zoo Code project root | ||
|
|
||
| ## Checks (Sequential, Fastest-First Order) | ||
|
|
||
| Run all 7 checks in order. **Stop at the first failure** and report. Each check includes Windows (PowerShell) and Linux/Mac (bash) commands. | ||
|
|
||
| --- | ||
|
|
||
| ### Check 1: Invisible Characters (~2s) | ||
|
|
||
| Detect zero-width characters, directional overrides, BOM, and soft hyphens that can cause subtle bugs. | ||
|
|
||
| **Windows (PowerShell):** | ||
| ```powershell | ||
| $patterns = '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}\x{FEFF}\x{00AD}]' | ||
| Get-ChildItem -Recurse -Include *.ts,*.tsx,*.js,*.mjs,*.cjs,*.cts,*.mts,*.sh,*.yml,*.yaml -Exclude node_modules,dist,out,coverage,.turbo,.vinxi -Path src,webview-ui,packages,apps,.github | | ||
| Select-String -Pattern $patterns | | ||
| ForEach-Object { Write-Host "FOUND: $($_.Filename):$($_.LineNumber): $($_.Line)" } | ||
| ``` | ||
|
|
||
| **Linux/Mac (bash):** | ||
| ```bash | ||
| grep -rnP '[\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}\x{FEFF}\x{00AD}]' \ | ||
| --include='*.ts' --include='*.tsx' --include='*.js' --include='*.mjs' \ | ||
| --include='*.cjs' --include='*.cts' --include='*.mts' --include='*.sh' \ | ||
| --include='*.yml' --include='*.yaml' \ | ||
| --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=out \ | ||
| --exclude-dir=coverage --exclude-dir=.turbo --exclude-dir=.vinxi \ | ||
| src webview-ui packages apps .github | ||
| ``` | ||
|
|
||
| **Pass criteria:** No output (exit code 0). | ||
|
|
||
| **Failure diagnosis:** | ||
| - If output appears, a file contains invisible Unicode characters | ||
| - The output shows `filename:line number: offending line` | ||
| - Open the file and remove the invisible character(s) | ||
| - Common culprits: copy-pasted text from web pages, accidental BOM from editors | ||
| - After removal, re-run Check 1 to confirm clean | ||
|
|
||
| --- | ||
|
|
||
| ### Check 2: Check Translations (~5s) | ||
|
|
||
| Verify all locale translation files are complete and no keys are missing. | ||
|
|
||
| **Windows (PowerShell):** | ||
| ```powershell | ||
| node scripts/find-missing-translations.js | ||
| ``` | ||
|
|
||
| **Linux/Mac (bash):** | ||
| ```bash | ||
| node scripts/find-missing-translations.js | ||
| ``` | ||
|
|
||
| **Pass criteria:** Exit code 0, no "missing" output. | ||
|
|
||
| **Failure diagnosis:** | ||
| - The script lists missing translation keys per locale | ||
| - Add the missing keys to each locale file under `src/i18n/locales/` and `webview-ui/src/i18n/locales/` | ||
| - Reference the English (`en`) file as the source of truth | ||
| - Use the `roo-translation` skill for translation guidelines | ||
| - After adding keys, re-run Check 2 to confirm | ||
|
|
||
| --- | ||
|
|
||
| ### Check 3: Lint ESLint (~30s) | ||
|
|
||
| Run ESLint with zero-warning tolerance and auto-prune stale suppressions. | ||
|
|
||
| **Windows (PowerShell):** | ||
| ```powershell | ||
| cd src; npx eslint --max-warnings=0 --prune-suppressions . | ||
| ``` | ||
|
|
||
| **Linux/Mac (bash):** | ||
| ```bash | ||
| cd src && npx eslint --max-warnings=0 --prune-suppressions . | ||
|
Comment on lines
+103
to
+108
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== file excerpt =="
sed -n '1,270p' .roo/skills/local-ci-precheck/SKILL.md | nl -ba
echo
echo "== package manager files =="
git ls-files | rg '(^|/)(package.json|pnpm-workspace.yaml|pnpm-lock.yaml|package-lock.json|yarn.lock|bun.lockb?)$' || true
echo
echo "== npx occurrences in file =="
rg -n 'npx ' .roo/skills/local-ci-precheck/SKILL.md || true
echo
echo "== check scripts/config references if any =="
rg -n 'no-only-tests|only-run|fail-closed|cache-only|lockfile|lock-file|pnpm exec|npx' .roo/skills/local-ci-precheck/SKILL.md || trueRepository: Zoo-Code-Org/Zoo-Code Length of output: 218 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== file excerpts =="
sed -n '1,270p' .roo/skills/local-ci-precheck/SKILL.md > /tmp/skill_excerpt.txt 2>/dev/null || true
python3 - <<'PY'
from pathlib import Path
p=Path('/tmp/skill_excerpt.txt')
if not p.exists():
print('MISSING_SKILL_FILE')
raise SystemExit
lines=p.read_text().splitlines()
for i,l in enumerate(lines, 1):
print(f'{i:5}: {l}')
PY
echo
echo "== package manager files =="
git ls-files | grep -E '(^|/)(package.json|pnpm-workspace.yaml|pnpm-lock.yaml|package-lock.json|yarn.lock|bun.lockb?)$' || true
echo
echo "== npx occurrences in file =="
grep -n 'npx ' .roo/skills/local-ci-precheck/SKILL.md || true
echo
echo "== package scripts / workspace config references =="
grep -En 'no-only-tests|only-run|fail-closed|cache-only|lockfile|lock-file|pnpm exec|npx|deps-check|vitest|tsc|eslint' .roo/skills/local-ci-precheck/SKILL.md || trueRepository: Zoo-Code-Org/Zoo-Code Length of output: 13668 Resolve all check commands from This skill requires Also applies to lines 124, 135-144, 219, 230, 235, and 243. 🧰 Tools🪛 SkillSpector (2.5.1)[warning] 103: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 108: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 124: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 135: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 136: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 137: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 142: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 143: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 144: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 219: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 230: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 235: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 243: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| ``` | ||
|
|
||
| **Pass criteria:** Exit code 0, no warnings or errors. | ||
|
|
||
| **Failure diagnosis:** | ||
|
|
||
| *Scenario A: "There are suppressions left that do not occur anymore"* | ||
| - The `eslint-suppressions.json` file has stale entries from rules that were fixed | ||
| - The `--prune-suppressions` flag auto-removes them on successful run | ||
| - If the prune itself fails, manually open `src/eslint-suppressions.json` and remove entries for rules/files that no longer produce warnings | ||
| - After cleanup: `git add src/eslint-suppressions.json` and commit the change | ||
|
|
||
| *Scenario B: ESLint rule violations* | ||
| - The output shows `filepath:line:col: error [rule-name] message` | ||
| - Open each file and fix the code according to the rule | ||
| - Run `npx eslint --max-warnings=0 --prune-suppressions .` again after each fix | ||
| - Common rules: `@typescript-eslint/no-unused-vars`, `no-console`, `prefer-const` | ||
|
|
||
| --- | ||
|
|
||
| ### Check 4: Check Types (~60s) | ||
|
|
||
| Run TypeScript type checking across all three project areas. | ||
|
|
||
| **Windows (PowerShell):** | ||
| ```powershell | ||
| cd src; npx tsc --noEmit | ||
| cd ..\webview-ui; npx tsc --noEmit | ||
| cd ..\packages\core; npx tsc --noEmit | ||
| ``` | ||
|
|
||
| **Linux/Mac (bash):** | ||
| ```bash | ||
| cd src && npx tsc --noEmit | ||
| cd ../webview-ui && npx tsc --noEmit | ||
| cd ../packages/core && npx tsc --noEmit | ||
| ``` | ||
|
|
||
| **Pass criteria:** Exit code 0 for all three directories, zero type errors. | ||
|
Comment on lines
+133
to
+147
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Stop Check 4 after the first failed type check. The Bash commands run independently without Run each command in a fail-fast shell block, or check the exit code after every PowerShell command. 🧰 Tools🪛 SkillSpector (2.5.1)[warning] 103: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 108: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 124: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 135: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 136: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 137: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 142: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 143: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 144: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 219: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 230: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 235: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 243: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) 🤖 Prompt for AI Agents |
||
|
|
||
| **Failure diagnosis:** | ||
| - The output shows `filepath(line,col): error TSxxxx: message` | ||
| - `TS2322`: Type mismatch — check the expected vs actual type | ||
| - `TS2339`: Property does not exist — check the type definition or add the property | ||
| - `TS2345`: Argument type mismatch — cast or adjust the argument | ||
| - `TS2531`: Object is possibly null — add null check | ||
| - After fixing, re-run the failing directory's `tsc --noEmit` to confirm | ||
| - If a new type is introduced, ensure it is exported from the correct module | ||
|
|
||
| --- | ||
|
|
||
| ### Check 5: Knip (~30s) | ||
|
|
||
| Detect unused code, unused dependencies, and unlisted dependencies. | ||
|
|
||
| **Windows (PowerShell):** | ||
| ```powershell | ||
| corepack pnpm knip | ||
| ``` | ||
|
|
||
| **Linux/Mac (bash):** | ||
| ```bash | ||
| corepack pnpm knip | ||
| ``` | ||
|
|
||
| **Pass criteria:** Exit code 0, no unused exports or unlisted dependencies reported. | ||
|
|
||
| **Failure diagnosis:** | ||
| - **Unused exports**: Remove the unused function/variable/type, or prefix with `_` if intentionally unused | ||
| - **Unused dependencies**: Remove from `package.json` with `corepack pnpm remove <package>` | ||
| - **Unlisted dependencies**: Add the missing package to the correct `package.json` | ||
| - **Unused files**: Verify the file is truly unused, then delete it | ||
| - After fixes, re-run `corepack pnpm knip` to confirm | ||
|
|
||
| --- | ||
|
|
||
| ### Check 6: Unit Tests (~120s) | ||
|
|
||
| Run all unit and integration tests with coverage. | ||
|
|
||
| **Windows (PowerShell):** | ||
| ```powershell | ||
| corepack pnpm turbo run test:coverage | ||
| ``` | ||
|
|
||
| **Linux/Mac (bash):** | ||
| ```bash | ||
| corepack pnpm turbo run test:coverage | ||
| ``` | ||
|
|
||
| **Alternative (run packages individually):** | ||
| ```powershell | ||
| # Non-core packages | ||
| corepack pnpm turbo run test:coverage --filter="!@roo-code/core" | ||
|
|
||
| # Core unit tests | ||
| corepack pnpm turbo run test:coverage:unit --filter="@roo-code/core" | ||
|
|
||
| # Core integration tests | ||
| corepack pnpm turbo run test:coverage:integration --filter="@roo-code/core" | ||
| ``` | ||
|
|
||
| **Pass criteria:** Exit code 0, all tests pass, no coverage regression below threshold. | ||
|
|
||
| **Failure diagnosis:** | ||
| - The output shows which test file and test case failed | ||
| - **Assertion failure**: Check the expected vs actual value in the test | ||
| - **Timeout**: The test may need more time or a mock may be missing | ||
| - **Import error**: A module may have been moved or renamed — update the import path | ||
| - Fix the failing test or the production code it tests | ||
| - Re-run only the failing package first: `cd <package> && npx vitest run` to iterate faster | ||
| - Once individual package passes, re-run full suite: `corepack pnpm turbo run test:coverage` | ||
|
|
||
| --- | ||
|
|
||
| ### Check 7: Webview Visual (~60s) | ||
|
|
||
| Run webview UI snapshot tests to catch visual regressions. | ||
|
|
||
| **Windows (PowerShell):** | ||
| ```powershell | ||
| cd webview-ui; npx vitest run | ||
| ``` | ||
|
|
||
| **Linux/Mac (bash):** | ||
| ```bash | ||
| cd webview-ui && npx vitest run | ||
| ``` | ||
|
|
||
| **Pass criteria:** Exit code 0, all snapshot tests pass. | ||
|
Comment on lines
+224
to
+238
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Run the webview visual suite for Check 7.
Use the workspace visual-test command on both platforms: Suggested replacement- cd webview-ui; npx vitest run
+ corepack pnpm --filter `@roo-code/vscode-webview` test:visualThe repository’s visual-regression workflow uses 🧰 Tools🪛 SkillSpector (2.5.1)[warning] 103: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 108: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 124: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 135: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 136: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 137: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 142: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 143: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 144: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 219: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 230: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 235: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 243: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) 🤖 Prompt for AI Agents |
||
|
|
||
| **Failure diagnosis:** | ||
| - **Snapshot mismatch**: If the visual change is intentional, update the snapshot: | ||
| ```bash | ||
| cd webview-ui && npx vitest run --update | ||
| ``` | ||
| Then review the diff in `webview-ui/src/__snapshots__/` and commit the updated snapshots | ||
| - **Unexpected layout shift**: Check CSS changes in webview-ui components | ||
| - **Missing snapshot baseline**: Run with `--update` to create initial snapshots | ||
| - If the difference is only font rendering (pixel-level), it may be a platform difference — verify the change looks correct visually | ||
|
|
||
| --- | ||
|
|
||
| ## Result Format | ||
|
|
||
| After all checks complete, output a summary table: | ||
|
|
||
| ``` | ||
| ## Local CI Pre-check Results | ||
|
|
||
| | # | Check Name | Status | Duration | Error Details | | ||
| |---|--------------------|--------|----------|---------------| | ||
| | 1 | Invisible Chars | ✅ PASS | 1.2s | — | | ||
| | 2 | Check Translations | ✅ PASS | 3.1s | — | | ||
| | 3 | Lint ESLint | ✅ PASS | 22.4s | — | | ||
| | 4 | Check Types | ❌ FAIL | 45.2s | TS2322 in src/utils.ts:42 | | ||
| | 5 | Knip | ⏭️ SKIP | — | Skipped due to Check 4 failure | | ||
| | 6 | Unit Tests | ⏭️ SKIP | — | Skipped due to Check 4 failure | | ||
| | 7 | Webview Visual | ⏭️ SKIP | — | Skipped due to Check 4 failure | | ||
|
|
||
| **Result: FAILED** — Fix Check 4 (Check Types) before pushing. | ||
|
Comment on lines
+256
to
+269
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win Add a language to the result-format code fence. Markdownlint reports MD040 for the untyped fence at Line 256. Use -```
+```markdown🧰 Tools🪛 markdownlint-cli2 (0.23.2)[warning] 256-256: Fenced code blocks should have a language specified (MD040, fenced-code-language) 🪛 SkillSpector (2.5.1)[warning] 103: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 108: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 124: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 135: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 136: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 137: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 142: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 143: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 144: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 219: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 230: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 235: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 243: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| ``` | ||
|
|
||
| **Rules:** | ||
| - If all 7 checks PASS → output `✅ All checks passed. Safe to push.` | ||
| - If any check FAILS → stop immediately, skip remaining checks, output the failure table | ||
| - Include the exact error message (first 3 lines) in the Error Details column | ||
| - Include the suggested fix below the table | ||
|
|
||
| --- | ||
|
|
||
| ## Skip Conditions | ||
|
|
||
| Skip the entire pre-check if ANY of the following is true: | ||
|
|
||
| 1. **Flag**: User passed `--skip-ci-check` in the push command | ||
| 2. **Non-source only**: `git diff --name-only HEAD` shows only files matching: | ||
| - `*.md` | ||
| - `*.json` (excluding `package.json` and `tsconfig.json`) | ||
| - `*.yml` / `*.yaml` (excluding workflow logic changes) | ||
| - `.github/` label/config changes | ||
| - `docs/` directory changes | ||
| - `.gitignore`, `.gitattributes` | ||
|
|
||
| When skipping, output: `⏭️ CI pre-check skipped (no source code changes or --skip-ci-check flag).` | ||
|
Comment on lines
+280
to
+293
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Base skip decisions on the commits being pushed.
The rule “excluding workflow logic changes” also cannot be evaluated from file names alone. Inspect the pushed diff and use the local/remote refs provided by the pre-push context before applying the whitelist. 🧰 Tools🪛 SkillSpector (2.5.1)[warning] 103: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 108: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 124: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 135: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 136: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 137: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 142: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 143: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 144: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 219: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 230: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 235: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) [warning] 243: [RP1] null: npx commands without a version suffix (e.g. Remediation: Pin the version: npx (MCP Rug Pull (RP1)) 🤖 Prompt for AI Agents |
||
|
|
||
| --- | ||
|
|
||
| ## Windows Environment Notes | ||
|
|
||
| 1. **Use `corepack pnpm`** instead of bare `pnpm` to avoid PowerShell execution policy errors (`pnpm.ps1 cannot be loaded`) | ||
| 2. **Use `Select-String`** instead of `grep` for pattern matching in PowerShell | ||
| 3. **Use `;`** as command separator in PowerShell (not `&&`) | ||
| 4. **Use `cd dir; command`** pattern — PowerShell `cd` does not chain with `&&` like bash | ||
| 5. **Path separators**: Use `\` in PowerShell commands, `/` in bash commands | ||
| 6. **Exit code checking**: PowerShell does not propagate exit codes the same way as bash — check `$LASTEXITCODE` after external commands if needed | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| { | ||
| "fixtures": [ | ||
| { | ||
| "match": { | ||
| "userMessage": "TERMINAL_LIFECYCLE_E2E" | ||
| }, | ||
| "response": { | ||
| "toolCalls": [ | ||
| { | ||
| "name": "execute_command", | ||
| "arguments": "{\"command\":\"echo lifecycle-first\"}", | ||
| "id": "call_terminal_lifecycle_001" | ||
|
Comment on lines
+4
to
+12
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win Constrain both prompt fixtures to the first turn. These fixtures seed flows that continue after a tool result, but neither match includes Proposed fix "match": {
+ "sequenceIndex": 0,
"userMessage": "TERMINAL_LIFECYCLE_E2E"
},
...
"match": {
+ "sequenceIndex": 0,
"userMessage": "TERMINAL_LIFECYCLE_CANCEL_E2E"
},As per coding guidelines, multi-turn fixtures must match turn 1 with Also applies to: 18-26 🤖 Prompt for AI AgentsSource: Coding guidelines |
||
| } | ||
| ] | ||
| } | ||
| }, | ||
| { | ||
| "match": { | ||
| "userMessage": "TERMINAL_LIFECYCLE_CANCEL_E2E" | ||
| }, | ||
| "response": { | ||
| "toolCalls": [ | ||
| { | ||
| "name": "execute_command", | ||
| "arguments": "{\"command\":\"sleep 30\"}", | ||
| "id": "call_terminal_lifecycle_cancel_001" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ] | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: Zoo-Code-Org/Zoo-Code
Length of output: 210
🏁 Script executed:
Repository: Zoo-Code-Org/Zoo-Code
Length of output: 4598
🏁 Script executed:
Repository: Zoo-Code-Org/Zoo-Code
Length of output: 1006
🏁 Script executed:
Repository: Zoo-Code-Org/Zoo-Code
Length of output: 1786
🏁 Script executed:
Repository: Zoo-Code-Org/Zoo-Code
Length of output: 768
🏁 Script executed:
Repository: Zoo-Code-Org/Zoo-Code
Length of output: 1837
🌐 Web query:
PowerShell Select-String exit code behavior when matches found💡 Result:
The Select-String cmdlet does not return an exit code [1][2]. It is a native PowerShell cmdlet, and its behavior is defined by the objects it outputs to the pipeline, not by process exit codes [1][3]. By default, Select-String returns MatchInfo objects when matches are found [1][4]. If no matches are found, it outputs nothing (null) [1][4]. When the -Quiet parameter is used, the cmdlet returns a Boolean value ($true if matches are found, or $null/false if no matches are found) [1][2][3]. Because Select-String does not set an exit code, you cannot check it using the standard $LASTEXITCODE variable (which is intended for external executable commands) [5]. To detect whether a match was found in a script, you should instead evaluate the output of the command directly [5][6]. For example: if (Select-String -Path "file.txt" -Pattern "pattern" -Quiet) { Write-Host "Match found" } else { Write-Host "No match found" } If you need to force an exit code in a script based on the results of Select-String, you must manually trigger it using the exit command [5]. # Example of manual exit code handling $result = Select-String -Path "file.txt" -Pattern "error" if ($result) { exit 1 } else { exit 0 }
Citations:
🌐 Web query:
grep -P PCRE Unicode code point \x{...} pattern example💡 Result:
In PCRE (Perl-Compatible Regular Expressions), such as those used by
grep -P, Unicode characters can be specified using the hexadecimal escape sequence \x{...} [1][2][3]. Syntax and Usage The \x{...} syntax allows you to specify a Unicode code point by its hexadecimal value [1][3]. The braces are necessary when specifying code points that require more than two hexadecimal digits, or simply for clarity [1][4][5]. Example To match a character by its specific Unicode code point, you can use the following pattern: grep -P '\x{3b1}' file.txt This command will search for the Greek letter "alpha" (U+03B1) in file.txt [3]. Key Requirements 1. Unicode Mode: For these patterns to work correctly with Unicode characters, the grep implementation must be operating in a mode that supports UTF/Unicode [4][6]. When usinggrep -P, it is often necessary to ensure your environment is set to a UTF-8 locale (e.g.,LC_ALL=en_US.UTF-8) [7][3]. 2. PCRE Library: The -P flag invokes the Perl-Compatible Regular Expression library. Ensure your version of grep supports the -P option [8][5][3]. 3. Range Matching: You can also use this syntax within character classes to match ranges of Unicode characters [3]: grep -P '[\x{3b1}-\x{3bb}]' file.txt This would match any Greek character between alpha (U+03B1) and lambda (U+03BB) [3]. Additional Notes - Braces are optional for simple hexadecimal values (e.g., \x61 is equivalent to 'a'), but \x{...} is the recommended, unambiguous way to handle arbitrary Unicode code points [1][2][3]. - For matching categories of characters (like letters, numbers, or symbols) rather than specific code points, consider using Unicode properties instead, such as \p{L} for any letter or \p{Greek} for Greek characters [9][3][10].Citations:
Make Check 1 portable and fail closed.
The PowerShell branch uses
\x{...}character classes, butSelect-Stringuses .NET regex syntax. Use\u....escapes there. Also ensure the Windows command exits non-zero when matches are found.The Bash branch depends on
grep -P, which can be unavailable in default macOS environments. Use a portable scanner that supports the required Unicode characters, such asrg.🧰 Tools
🪛 SkillSpector (2.5.1)
[warning] 103: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 108: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 124: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 135: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 136: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 137: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 142: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 143: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 144: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 219: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 230: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 235: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
[warning] 243: [RP1] null: npx commands without a version suffix (e.g.
@1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Remediation: Pin the version: npx
@scope/server@1.2.3(MCP Rug Pull (RP1))
🤖 Prompt for AI Agents