Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
690 commits
Select commit Hold shift + click to select a range
5d2c642
feat: agent skills management system
betterclever Mar 10, 2026
daf8937
Merge pull request #69 from ShipSecAI/feature/claude-code-agent
betterclever Mar 11, 2026
8b1efd1
Merge pull request #70 from ShipSecAI/feature/agent-skills-v2
betterclever Mar 11, 2026
b86768d
feat: add security findings MCP tools and enforce ai gateway-only cha...
betterclever Mar 11, 2026
7323072
fix: target studio environment domain
betterclever Mar 12, 2026
ea42a77
fix: resolve workflow timeout mismatch and stuck node state (ENG-241)
betterclever Mar 12, 2026
369a67d
fix: harden environment release bootstrap
betterclever Mar 12, 2026
4be7408
fix: keep shared activity proxy at 10min to protect tool call timeout
betterclever Mar 12, 2026
c47cfe1
fix: harden managed redis and postgres wiring
betterclever Mar 12, 2026
b11f4d5
fix: expose health endpoint without auth
betterclever Mar 13, 2026
5040c20
refactor: standardize on REDIS_URL
betterclever Mar 13, 2026
131deb3
ci: upgrade GitHub Actions to Node 24-compatible versions
betterclever Mar 13, 2026
1ef9bbe
chore: remove accidentally committed artifacts and update .gitignore
betterclever Mar 17, 2026
c98a8e7
fix: add missing react-icons dependency to frontend
betterclever Mar 17, 2026
64aa449
fix: replace removed SiAmazonwebservices with FaAws icon
betterclever Mar 17, 2026
1c0fafd
feat: add plugin support and onboarding bypass to Claude Code agent
betterclever Mar 18, 2026
35152a0
test: add Claude Code agent tests
betterclever Mar 18, 2026
074f847
feat: add enablePlugins multi-select to OpenCode agent
betterclever Mar 18, 2026
c8fa146
refactor: replace methodology injection with real oh-my-opencode plugin
betterclever Mar 18, 2026
b25698f
fix: simplify enablePlugins parameter descriptions
betterclever Mar 18, 2026
1b8c787
feat: migrate analytics from OpenSearch to ClickHouse (#76)
betterclever Mar 21, 2026
93a0f4f
feat: YAML workflow export + import both JSON and YAML
betterclever Mar 21, 2026
65b0875
feat: replace Docker stdio MCP with tool runtime runtime
betterclever Mar 21, 2026
780b62e
refactor: replace hand-rolled tool runtime clients with @shipsecai/to...
betterclever Mar 21, 2026
b86145e
fix: address Codex review findings
betterclever Mar 21, 2026
c5c23f8
feat: expose asset discovery, ASM, and connections as Studio MCP tools
betterclever Mar 22, 2026
9b7971f
feat: replace MCP gateway with tool runtime-backed component tool end...
betterclever Mar 25, 2026
16fc27e
feat: streamline AWS MCP discovery through tool runtime
betterclever Mar 27, 2026
5212c94
Make imported MCP groups hydrate and behave correctly in local dev
betterclever Mar 27, 2026
ea825aa
Tighten local MCP UX and AI routing defaults
betterclever Mar 27, 2026
366d597
Fix MCP group server normalization for embedded responses
betterclever Mar 27, 2026
cfc032e
Fix MCP local dev regressions and restore green typecheck
betterclever Mar 27, 2026
d9a5351
Align MCP local-dev fixes with current AI test expectations
betterclever Mar 27, 2026
8450dd7
Reduce CI install time for Bun validation
betterclever Mar 27, 2026
2249ebd
Fix MCP group discovery on runtime runtime
betterclever Mar 30, 2026
6c6b535
feat: Slack bot chat bridge — bidirectional thread sync
betterclever Mar 30, 2026
e4d0b09
fix: pass package-auth secrets to Docker builds and add environment t…
betterclever Apr 2, 2026
fcd394c
feat: disable Slack DM support, add environment Slack bot config
betterclever Apr 2, 2026
8c0ee47
feat: disable Slack DM support, add environment Slack bot config
betterclever Apr 2, 2026
4eb146a
feat(chat): expand system prompt and add provider cache hints
betterclever Apr 2, 2026
e3f61ab
feat(chat): integrate tool runtime for org MCP server access in chat
betterclever Apr 2, 2026
1cf3b1b
feat(chat): add task plan message part with live UI updates
betterclever Apr 2, 2026
e7a6d2c
fix: correctly wire NODE_AUTH_TOKEN for private package auth in Docke...
betterclever Apr 2, 2026
dd452ef
fix: bump bun to 1.3.10 in CI to fix node-pty native build
betterclever Apr 2, 2026
28d0a56
feat: Slack bot chat bridge + unified integrations page (#83)
betterclever Apr 2, 2026
299c5f5
feat: Slack bot foundation — schema, SDK migration, OAuth scopes
betterclever Mar 30, 2026
e11c2f1
fix: improve Slack reply rendering and stabilize ai gateway startup
betterclever Apr 2, 2026
e0e803d
fix: improve Slack reply rendering and stabilize ai gateway startup
betterclever Apr 2, 2026
5180089
fix: post Slack replies from finalized assistant text
betterclever Apr 3, 2026
ba35485
fix: post Slack replies from finalized assistant text
betterclever Apr 3, 2026
c66dfd6
fix: recover stale Slack chat sessions before signaling
betterclever Apr 3, 2026
decd168
fix: recover stale Slack chat sessions before signaling
betterclever Apr 3, 2026
87d58a4
fix: update Slack replies per turn instead of reposting
betterclever Apr 3, 2026
46055e6
fix: update Slack replies per turn instead of reposting
betterclever Apr 3, 2026
4881991
chore: align leftover Slack integration docs and config
betterclever Apr 3, 2026
10a63a1
feat: Slack bot foundation — schema, SDK migration, OAuth scopes
betterclever Mar 30, 2026
b87a0f3
fix: guard Slack turn sync against race and orphaned messages
betterclever Apr 5, 2026
43caf35
fix: clean up turnLocks map after each turn settles to prevent memory…
betterclever Apr 5, 2026
bbaf63d
feat: MCP server templates and GitHub MCP integration
betterclever Apr 5, 2026
9036dc2
fix: sync backend client with the regenerated OpenAPI contract
betterclever Apr 6, 2026
054d664
fix: prevent template imports from mutating shared rows
betterclever Apr 6, 2026
62215a3
chore: checkpoint github mcp import and tool runtime fixes
betterclever Apr 6, 2026
5e9a21a
feat: per-installation GitHub MCP model and curated library UI overhaul
betterclever Apr 6, 2026
498c232
feat: add Claude Code native plugin installation support
betterclever Mar 18, 2026
95cb9e0
fix: address PR review — qualify plugins with marketplace URL and rem...
betterclever Apr 6, 2026
57f6363
fix: remove unused imports after rebase (DEFAULT_GATEWAY_URL, getGate…
betterclever Apr 6, 2026
b408180
feat(chat): truncate stale tool outputs before LLM calls
betterclever Apr 2, 2026
6529bbf
fix(chat): fix update_task_plan schema and register tool runtime chat...
betterclever Apr 8, 2026
1990a6f
fix(chat): address PR review — tool runtime expiry, client leak, stal...
betterclever Apr 8, 2026
f04c53c
feat(chat): show active task plan fixed above chat input
betterclever Apr 8, 2026
5ff45e3
refactor: rename all ai gateway references to ai gateway across codebase
betterclever Apr 8, 2026
321a9e2
feat: add Jira jira integration with MCP server and workflow component
betterclever Apr 8, 2026
925883e
feat: add Jira connection form with backend endpoint and test-on-connect
betterclever Apr 8, 2026
ef8186a
chore: set default chat model to zai/glm-5-turbo
betterclever Apr 8, 2026
23ebb9e
chore: remove dead CHAT_AI env vars, set default model to glm-5-turbo
betterclever Apr 9, 2026
656d36a
feat: simplify Jira app setup flow
betterclever Apr 9, 2026
cd73da1
feat: serve Jira install URL from env var, not hardcoded
betterclever Apr 9, 2026
137dc1a
feat: replace Jira connection form with one-click install button
betterclever Apr 9, 2026
613cc23
fix: show disabled 'coming soon' button when Jira install URL not con...
betterclever Apr 9, 2026
a94b5fc
fix: hide setup instructions section for Jira (dialog handles it)
betterclever Apr 9, 2026
c20b81e
feat: zero-config Jira connection via jira GraphQL discovery
betterclever Apr 9, 2026
d6e80bf
fix: seamless Jira connection UX — guide users through install when a...
betterclever Apr 9, 2026
a55f46b
fix: Jira dialog sizing and .atlassian.net suffix input
betterclever Apr 9, 2026
36752a6
fix: polish Jira connection input group styling
betterclever Apr 9, 2026
7c627d9
fix: derive Jira install URL from FORGE_APP_ID when JIRA_FORGE_INSTAL...
betterclever Apr 9, 2026
6f45184
fix: only show install button when the Jira install URL is configured
betterclever Apr 9, 2026
9a403b4
feat: step-based Jira connection flow — check, install, verify
betterclever Apr 9, 2026
5aaff3d
fix: allow Jira template import without jira config payload
betterclever Apr 9, 2026
4d367bc
Merge pull request #92 from ShipSecAI/feat/jira-jira-integration
betterclever Apr 9, 2026
f9efe4e
fix(chat): prevent MCP session destruction on SSE close + detect inco...
betterclever Apr 9, 2026
29a63e5
feat(chat): add aggressive debugging logs for tool execution
betterclever Apr 10, 2026
abed93e
debug(chat): add responseMessage parts logging to diagnose tool call...
betterclever Apr 10, 2026
d3ac242
fix(chat): switch to ToolLoopAgent for proper tool execution loop
betterclever Apr 10, 2026
aa0cf46
fix(chat): switch to ToolLoopAgent for proper tool execution with Cla...
betterclever Apr 10, 2026
8fa653f
Route Vertex Claude chat through ai gateway's Anthropic endpoint
betterclever Apr 10, 2026
0ffdbaa
Merge pull request #91 from ShipSecAI/feat/ai gateway-migration
betterclever Apr 10, 2026
d5e2500
feat: add Cartography query MCP component
betterclever Apr 10, 2026
90bbe9d
feat: add neo4j-driver dependency
betterclever Apr 10, 2026
6d90b0f
feat: register Cartography components in worker
betterclever Apr 10, 2026
cd2b4d4
fix: use secret editor type for Neo4j password
betterclever Apr 10, 2026
5ebfd97
fix: use boolean editor type for bestEffort parameter
betterclever Apr 10, 2026
945bb06
Add versioned report templates with chat-authoring APIs
betterclever Apr 12, 2026
c10c73d
Expose report template previews in chat and runtime
betterclever Apr 12, 2026
3e4c24d
Stabilize chat streaming and add report-template E2E coverage
betterclever Apr 12, 2026
c3c3009
Align ai gateway helper tests with internal client path
betterclever Apr 12, 2026
c724950
Make Cartography and local multi-instance startup work from a clean m...
betterclever Apr 12, 2026
77e0a45
Keep graph asset sorting type-safe for pre-push verification
betterclever Apr 12, 2026
d7b2bfb
Enforce database migrations before release upgrades
betterclever Apr 12, 2026
67334bb
Verify bundled Drizzle migrations at release time
betterclever Apr 13, 2026
2af5d11
feat: add Cartography sync component
betterclever Apr 10, 2026
d491a62
Delete the retired AWS crawler after the Cartography cutover
betterclever Apr 13, 2026
6057085
Normalize runtime namespaces and reject placeholder GitHub app config
betterclever Apr 13, 2026
28fd0ef
Restore supported AWS parity in the Cartography sync scope
betterclever Apr 13, 2026
539af15
Prevent environment-only env aliases from breaking Kafka and release...
betterclever Apr 13, 2026
5d21560
Move Cartography to the official latest image and restore the missing…
betterclever Apr 13, 2026
f4c5a73
Run official Cartography sync through the ShipSec component runner
betterclever Apr 13, 2026
1bbf396
Keep Cartography runner log capture type-safe
betterclever Apr 13, 2026
96ea689
fix: let Cartography runner syncs succeed without output artifacts
betterclever Apr 13, 2026
9709357
Make cloud inventory indexing a visible system workflow with a manage...
betterclever Apr 13, 2026
a2541ab
Link cloud inventory syncs back to normal workflow runs in the UI
betterclever Apr 13, 2026
30b8030
Use the generic isolated volume abstraction for Cartography credentials
betterclever Apr 13, 2026
44e9bc5
Reconcile environment graph runtime and auth for Cartography workflow...
betterclever Apr 13, 2026
7b94a31
chore: add gcp foundation scrutiny review
betterclever Apr 15, 2026
1b72e31
feat(analytics): wire settings page to backend with TanStack Query hooks
betterclever Apr 15, 2026
1fae8ab
fix: use package import instead of relative path for backend-client t…
betterclever Apr 15, 2026
91a5321
feat(studio-mcp): add query_cloud_graph and get_cloud_graph_schema tools
betterclever Apr 15, 2026
a877b60
fix: use package import for backend-client in all query hooks
betterclever Apr 15, 2026
ee320c5
feat: replace node-pty with Bun native PTY (Bun.spawn terminal)
betterclever Apr 15, 2026
fa7b90e
chore: regenerate lockfile after removing node-pty
betterclever Apr 15, 2026
95bfd4f
feat: upgrade Temporal worker to Bun-native runner
betterclever Apr 15, 2026
651edc9
chore: upgrade @temporalio/* to 1.16.0 in backend
betterclever Apr 15, 2026
8916b53
ci: use ci runners scale set
betterclever Apr 15, 2026
279cf68
fix(usage): replace @ts-nocheck with TanStack Query hooks
betterclever Apr 15, 2026
0c2c0ad
feat(gcp): add backend GCP integration service and endpoints
betterclever Apr 16, 2026
eda6814
feat(gcp): add GCP support to asset discovery, cloud graph, and worke...
betterclever Apr 16, 2026
6ed82da
feat(gcp): add GCP provider to cloud accounts page and scan schedule …
betterclever Apr 16, 2026
7a40eec
feat(gcp): add GCP support to Prowler scan component
betterclever Apr 16, 2026
ff7c044
feat(gcp): switch to impersonation-based auth, remove serviceAccountJ…
betterclever Apr 16, 2026
f8f9cfc
docs(gcp): add customer-facing GCP integration setup documentation
betterclever Apr 16, 2026
489b593
feat(gcp): add GCP setup wizard and logo to frontend integration pages
betterclever Apr 16, 2026
c6be9d6
fix: keep Temporal workflow bundling sandbox-safe
betterclever Apr 16, 2026
dadf183
chore: scaffold GCP integration mission artifacts
betterclever Apr 15, 2026
1b08ef7
chore: remove .factory scaffolding artifacts
betterclever Apr 16, 2026
c3df19d
Make cloud scan workflows explicit per provider and keep kubeconfig s...
betterclever Apr 17, 2026
6409c5f
Keep runtime kubeconfig secret wiring compatible with workflow valida...
betterclever Apr 17, 2026
a80845f
Simplify cloud credential wiring and harden cloud sync identity seman…
betterclever Apr 18, 2026
1a658dc
chore: apply lint cleanup for cloud scan refactor
betterclever Apr 18, 2026
fe61645
Remove billing and discovery details that do not belong in the public…
betterclever Apr 20, 2026
dab0fb7
Restore typed template query surfaces on the curated public branch
betterclever Apr 20, 2026
632b2aa
Make the clean public branch compose with studio-cloud and infra
betterclever Apr 20, 2026
cc7c43b
Remove the private Hotplug package dependency from the public build path
betterclever Apr 21, 2026
38d8e2d
Tell one clean public story for self-hosted Studio and prune stale docs
betterclever Apr 21, 2026
c1fc320
Keep public GitHub Actions focused on CI and image publishing only
betterclever Apr 21, 2026
c07d2be
Restore the sanitized image-release workflow after history scrub
betterclever Apr 21, 2026
fe32b77
Stop shipping bundled runtime setup in the public tree
betterclever Apr 21, 2026
610a156
Align secondary contributor docs with the public repo boundary
betterclever Apr 21, 2026
16fe6a4
Remove remaining hosted preview metadata from public defaults
betterclever Apr 21, 2026
192caf4
Keep public AI routing single-tenant and remove extra gateway state f…
betterclever Apr 21, 2026
c42341f
Keep public Jira integration self-managed and simplify the public set…
betterclever Apr 21, 2026
c3ec154
Keep public history tooling free of hosted implementation vocabulary
betterclever Apr 21, 2026
7c0f89d
Remove the last hosted wording from the public tree
betterclever Apr 21, 2026
9446c09
Drop the stray nested npm lockfile from the public tree
betterclever Apr 21, 2026
e516d74
Remove the dead public Jira discovery path from the backend surface
betterclever Apr 21, 2026
ede263d
Force public-only composition during OpenAPI generation
betterclever Apr 21, 2026
86ed863
Delete the empty public billing schema stub
betterclever Apr 21, 2026
62ba6c4
Replace secret-like placeholders in public docs and env examples
betterclever Apr 21, 2026
464c08b
Make public analytics settings single-tenant instead of tier-gated
betterclever Apr 21, 2026
a15bd65
Let cloud pricing drive analytics retention without hardcoding tiers …
betterclever Apr 21, 2026
11885ad
Stop making the public repo own the pricing schema file
betterclever Apr 21, 2026
4085703
Stop making the public repo own the subscription tier column
betterclever Apr 21, 2026
8b0d398
Delete the dead analytics tier type stub
betterclever Apr 21, 2026
2150eca
Delete the empty unused site manifest asset
betterclever Apr 21, 2026
1eb343a
Stop naming the private repo directly in the public tree
betterclever Apr 21, 2026
b462239
Drop the private-only billing helper from the public frontend API
betterclever Apr 21, 2026
37d0ae8
Remove the workstation-specific path from the Docker output contract …
betterclever Apr 21, 2026
d9aa9de
Use product language instead of overlay language in public docs
betterclever Apr 21, 2026
98899f6
Prevent analytics retention rules from drifting between OSS and cloud
betterclever Apr 21, 2026
6ca1568
Keep analytics docs aligned with the public runtime boundary
betterclever Apr 21, 2026
76414eb
Stop shipping private billing and pricing schema in the public migrat…
betterclever Apr 21, 2026
6c73368
Lock the overlay-aware migration loader with regression tests
betterclever Apr 21, 2026
5b4f20e
Explain the repo-aware migration runner in contributor docs
betterclever Apr 21, 2026
f6f753f
Preserve base migration order before layering overlay migrations
betterclever Apr 21, 2026
a7d2c39
Drop local scratch artifacts and move test preload into the backend tree
betterclever Apr 21, 2026
185c525
Turn the docs tree into a real product manual instead of a repo scrap…
betterclever Apr 21, 2026
5b7d865
Make integration docs speak like product docs instead of internal gui…
betterclever Apr 21, 2026
cb383d2
State OSS and hosted behavior directly in the docs where the code alr…
betterclever Apr 21, 2026
dfe7ec2
Document GitHub as an App-first surface without PAT detours
betterclever Apr 21, 2026
8ebddda
Ship the basic CE credential routes while keeping workflows connectio…
betterclever Apr 22, 2026
c04763b
feat: restore a clean CE docker runtime path
betterclever Apr 22, 2026
9ae6190
fix: make the worker example env validate on a fresh machine
betterclever Apr 22, 2026
ba4c2e8
fix: remove the global pm2 requirement from the CE bootstrap
betterclever Apr 22, 2026
0e24998
fix: make just init independent of local git hook tooling
betterclever Apr 22, 2026
95d5b31
fix: drop the private hotplug image from the public CE stack
betterclever Apr 22, 2026
8fdb4d4
fix: run the PM2 source path through Bun on fresh machines
betterclever Apr 22, 2026
43c24a6
fix: launch the source worker through its Bun script
betterclever Apr 22, 2026
acc56b9
fix: run the source worker entrypoint directly with Bun
betterclever Apr 22, 2026
451c463
fix: let the full CE docker worker access the Docker socket
betterclever Apr 22, 2026
6a2f144
fix: fall back to openssl when Bun rejects GitHub app keys
betterclever Apr 22, 2026
86e97c3
fix: keep CE cloud connection setup usable without overlay envs
betterclever Apr 23, 2026
3e71e37
fix: make CE cartography ingest work on the public stack
betterclever Apr 23, 2026
51125b6
refactor: keep hosted auth out of the OSS repo
betterclever Apr 23, 2026
44014c7
refactor: decouple OSS auth selection from the cloud extension
betterclever Apr 23, 2026
76a8755
feat: bundle cloud frontend extensions through a stable runtime seam
betterclever Apr 23, 2026
d630499
fix: initialize analytics schema before CE apps
betterclever Apr 23, 2026
c33d4ec
fix: harden docker tool output handling
betterclever Apr 23, 2026
c5cd8fd
fix: redact docker runner env secrets
betterclever Apr 23, 2026
11c9c82
fix: align docker kafka topic instance
betterclever Apr 23, 2026
1d01ebc
fix: preserve api key owner auth context
betterclever Apr 24, 2026
c547f34
fix: include CE cloud keys in asset inventory
betterclever Apr 24, 2026
671bba9
fix: support gcp prowler findings output
betterclever Apr 24, 2026
efda995
fix: retry clickhouse schema init
betterclever Apr 27, 2026
1476ac9
feat: add shipsec north-star contracts
betterclever Apr 28, 2026
5bacd93
feat: add depth 3 ingestion normalizers
betterclever Apr 28, 2026
36f7f3e
feat: checkpoint ai findings and asm ingestion
betterclever Apr 29, 2026
35be25a
fix: preserve prowler compliance metadata
betterclever Apr 29, 2026
67bb268
feat: add security ingestion persistence
betterclever Apr 29, 2026
2a30ca3
Fix cloud asset sync ingestion
betterclever May 1, 2026
c978896
Add native Cloudflare Cartography sync
betterclever May 3, 2026
bc548b8
Add native Kubernetes Cartography sync
betterclever May 3, 2026
af2ea76
Add agentic code finding chains
betterclever May 8, 2026
daf4c5f
Fix mounted OpenCode review output capture
betterclever May 8, 2026
bd0c1bd
Expose Hotplug CLI to OpenCode agents
betterclever May 8, 2026
355910d
Add security finding chains to Studio MCP
betterclever May 8, 2026
97c3f61
Document AgentOS Pi runtime plan
betterclever May 9, 2026
74a2741
Document CISO product plan
betterclever May 9, 2026
2cbe04a
Stabilize durable security findings surface
betterclever May 9, 2026
b653c53
Add durable security finding links
betterclever May 9, 2026
503a68f
Add durable security threat stories
betterclever May 9, 2026
e1e2567
Add threat story analysis workflow
betterclever May 9, 2026
c5e47da
Add agent security wiki workflows
betterclever May 13, 2026
5ad9c85
Build Sentinel finding assessment loop
betterclever May 14, 2026
5852f84
Improve security wiki navigation and rendering
betterclever May 15, 2026
4c0c5be
Redesign product surfaces
betterclever May 16, 2026
3691e5b
fix: tighten OpenAPI schemas for security and templates
betterclever May 17, 2026
3271d85
feat: extend generated backend client wrappers
betterclever May 17, 2026
40cc697
refactor: migrate frontend API calls to backend client
betterclever May 17, 2026
d4c079e
chore: remove dead workflow component bloat
betterclever May 17, 2026
ed5f58e
refactor: consolidate repeated frontend scan flows
betterclever May 17, 2026
63a1ab6
refactor: collapse scan result page into scans panel
betterclever May 17, 2026
a251230
refactor: share trigger rule form page
betterclever May 17, 2026
d2fbc1d
refactor: share scheduled surface utilities
betterclever May 17, 2026
00f3e13
refactor: share scheduled surface filters
betterclever May 17, 2026
bfde2ec
refactor: trim chat prompt input surface
betterclever May 17, 2026
d96d56d
refactor: share cloud setup wizard chrome
betterclever May 17, 2026
22396be
refactor: share asset pagination controls
betterclever May 17, 2026
4425fbe
refactor: share execution graph restore logic
betterclever May 17, 2026
96e2c37
chore: remove unused frontend bloat
betterclever May 17, 2026
4ec25dd
chore: remove leftover unused frontend files
betterclever May 17, 2026
92a4cac
refactor: trim large frontend page bloat
betterclever May 17, 2026
5599779
test: align cloud scans empty state copy
betterclever May 17, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
190 changes: 0 additions & 190 deletions .ai/analytics-output-port-design.md

This file was deleted.

175 changes: 175 additions & 0 deletions .claude/skills/codex-review/SKILL.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,175 @@
---
name: codex-review
description: Send the current plan to OpenAI Codex CLI for iterative review. Claude and Codex go back-and-forth until Codex approves the plan.
user_invocable: true
---

# Codex Plan Review (Iterative)

Send the current implementation plan to OpenAI Codex for review. Claude revises the plan based on Codex's feedback and re-submits until Codex approves. Max 5 rounds.

---

## When to Invoke

- When the user runs `/codex-review` during or after plan mode
- When the user wants a second opinion on a plan from a different model

## Agent Instructions

When invoked, perform the following iterative review loop:

### Step 1: Generate Session ID

Generate a unique ID to avoid conflicts with other concurrent Claude Code sessions:

```bash
REVIEW_ID=$(uuidgen | tr '[:upper:]' '[:lower:]' | head -c 8)
```

Use this for all temp file paths: `/tmp/claude-plan-${REVIEW_ID}.md` and `/tmp/codex-review-${REVIEW_ID}.md`.

### Step 2: Capture the Plan

Write the current plan to the session-scoped temporary file. The plan is whatever implementation plan exists in the current conversation context (from plan mode, or a plan discussed in chat).

1. Write the full plan content to `/tmp/claude-plan-${REVIEW_ID}.md`
2. If there is no plan in the current context, ask the user what they want reviewed

### Step 3: Initial Review (Round 1)

Run Codex CLI in non-interactive mode to review the plan:

```bash
codex exec \
-m gpt-5.3-codex \
-s read-only \
-o /tmp/codex-review-${REVIEW_ID}.md \
"Review the implementation plan in /tmp/claude-plan-${REVIEW_ID}.md. Focus on:
1. Correctness - Will this plan achieve the stated goals?
2. Risks - What could go wrong? Edge cases? Data loss?
3. Missing steps - Is anything forgotten?
4. Alternatives - Is there a simpler or better approach?
5. Security - Any security concerns?

Be specific and actionable. If the plan is solid and ready to implement, end your review with exactly: VERDICT: APPROVED

If changes are needed, end with exactly: VERDICT: REVISE"
```

**Capture the Codex session ID** from the output line that says `session id: <uuid>`. Store this as `CODEX_SESSION_ID`. You MUST use this exact ID to resume in subsequent rounds (do NOT use `--last`, which would grab the wrong session if multiple reviews are running concurrently).

**Notes:**

- Use `-m gpt-5.3-codex` as the default model (configured in `~/.codex/config.toml`). If the user specifies a different model (e.g., `/codex-review o4-mini`), use that instead.
- Use `-s read-only` so Codex can read the codebase for context but cannot modify anything.
- Use `-o` to capture the output to a file for reliable reading.

### Step 4: Read Review & Check Verdict

1. Read `/tmp/codex-review-${REVIEW_ID}.md`
2. Present Codex's review to the user:

```
## Codex Review — Round N (model: gpt-5.3-codex)

[Codex's feedback here]
```

3. Check the verdict:
- If **VERDICT: APPROVED** → go to Step 7 (Done)
- If **VERDICT: REVISE** → go to Step 5 (Revise & Re-submit)
- If no clear verdict but feedback is all positive / no actionable items → treat as approved
- If max rounds (5) reached → go to Step 7 with a note that max rounds hit

### Step 5: Revise the Plan

Based on Codex's feedback:

1. **Revise the plan** — address each issue Codex raised. Update the plan content in the conversation context and rewrite `/tmp/claude-plan-${REVIEW_ID}.md` with the revised version.
2. **Briefly summarize** what you changed for the user:

```
### Revisions (Round N)
- [What was changed and why, one bullet per Codex issue addressed]
```

3. Inform the user what's happening: "Sending revised plan back to Codex for re-review..."

### Step 6: Re-submit to Codex (Rounds 2-5)

Resume the existing Codex session so it has full context of the prior review:

```bash
codex exec resume ${CODEX_SESSION_ID} \
"I've revised the plan based on your feedback. The updated plan is in /tmp/claude-plan-${REVIEW_ID}.md.

Here's what I changed:
[List the specific changes made]

Please re-review. If the plan is now solid and ready to implement, end with: VERDICT: APPROVED
If more changes are needed, end with: VERDICT: REVISE" 2>&1 | tail -80
```

**Note:** `codex exec resume` does NOT support `-o` flag. Capture output from stdout instead (pipe through `tail` to skip startup lines). Read the Codex response directly from the command output.

Then go back to **Step 4** (Read Review & Check Verdict).

**Important:** If `resume ${CODEX_SESSION_ID}` fails (e.g., session expired), fall back to a fresh `codex exec` call with context about the prior rounds included in the prompt.

### Step 7: Present Final Result

Once approved (or max rounds reached):

```
## Codex Review — Final (model: gpt-5.3-codex)

**Status:** ✅ Approved after N round(s)

[Final Codex feedback / approval message]

---
**The plan has been reviewed and approved by Codex. Ready for your approval to implement.**
```

If max rounds were reached without approval:

```
## Codex Review — Final (model: gpt-5.3-codex)

**Status:** ⚠️ Max rounds (5) reached — not fully approved

**Remaining concerns:**
[List unresolved issues from last review]

---
**Codex still has concerns. Review the remaining items and decide whether to proceed or continue refining.**
```

### Step 8: Cleanup

Remove the session-scoped temporary files:

```bash
rm -f /tmp/claude-plan-${REVIEW_ID}.md /tmp/codex-review-${REVIEW_ID}.md
```

## Loop Summary

```
Round 1: Claude sends plan → Codex reviews → REVISE?
Round 2: Claude revises → Codex re-reviews (resume session) → REVISE?
Round 3: Claude revises → Codex re-reviews (resume session) → APPROVED ✅
```

Max 5 rounds. Each round preserves Codex's conversation context via session resume.

## Rules

- Claude **actively revises the plan** based on Codex feedback between rounds — this is NOT just passing messages, Claude should make real improvements
- Default model is `gpt-5.3-codex`. Accept model override from the user's arguments (e.g., `/codex-review o4-mini`)
- Always use read-only sandbox mode — Codex should never write files
- Max 5 review rounds to prevent infinite loops
- Show the user each round's feedback and revisions so they can follow along
- If Codex CLI is not installed or fails, inform the user and suggest `npm install -g @openai/codex`
- If a revision contradicts the user's explicit requirements, skip that revision and note it for the user
Loading