Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

scripts/check_git_c_cwd.sh (1)

16-18: 🧹 Nitpick | 🔵 Trivial

Sed pattern may miss complex git invocations (known limitation).

The sed extraction assumes -C immediately follows git, so commands like git --no-pager -C path won't be parsed correctly. Since the script fails open (exits 0 when it can't parse), this just means some redundant git -C <cwd> commands may slip through rather than causing false blocks. Consider documenting this limitation in the comment or using a token-based parser if stricter enforcement is needed.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/check_git_c_cwd.sh` around lines 16 - 18, The sed extraction for
GIT_C_PATH (using the COMMAND variable and the sed pattern
's/.*git[[:space:]]+-C[[:space:]]+("([^"]+)"|([^[:space:]]+)).*/\2\3/') can miss
cases where options appear between git and -C (e.g., git --no-pager -C path);
either document this known limitation in a comment above the GIT_C_PATH
extraction or replace the fragile sed with a token-based parse of COMMAND that
scans tokens for "git" then for a later "-C" (handling quoted and unquoted
paths) and assigns the result to GIT_C_PATH; update the comment to mention the
behavior if parsing fails (script intentionally fails open) and reference
GIT_C_PATH and COMMAND so reviewers can find the code to modify.

.opencode/plugins/synthorg-hooks.ts (3)

134-151: ⚠️ Potential issue | 🟠 Major

Design system check should throw on failure, not just log.

The PostToolUse hook catches errors and only logs them (lines 146-150), making the design system validation advisory only. Per learnings: "Run the PostToolUse hook (scripts/check_web_design_system.py) on every Edit/Write to web/src/ files and fix all violations before proceeding." This should be mandatory enforcement.

🧱 Proposed fix to enforce design system rules

           if (
             (input.tool === "edit" || input.tool === "write") &&
             typeof output.args?.file_path === "string" &&
             output.args.file_path.includes("web/src/")
           ) {
-            try {
-              execSync(
-                `python scripts/check_web_design_system.py`,
-                { timeout: 10000, encoding: "utf-8" },
-              );
-            } catch (error: unknown) {
-              const err = error as { message?: string; stderr?: string };
-              // Log but don't block -- PostToolUse is advisory
-              console.error("Design system check failed for:", output.args.file_path, "-", err.message || err.stderr || "Unknown error");
-            }
+            execSync(
+              `python scripts/check_web_design_system.py`,
+              { timeout: 10000, encoding: "utf-8" },
+            );
+            // If execSync throws, the error propagates and blocks the operation
           }

Based on learnings: "Run the PostToolUse hook (scripts/check_web_design_system.py) on every Edit/Write to web/src/ files and fix all violations before proceeding".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/plugins/synthorg-hooks.ts around lines 134 - 151, The PostToolUse
handler after: async (input, output) => { ... } currently catches failures from
execSync(`python scripts/check_web_design_system.py`) and only logs them
(console.error), making the check advisory; change the catch to re-throw the
error (or throw a new Error with err.message/err.stderr and context including
output.args.file_path and script name) so the PostToolUse hook fails on
violations, ensuring edits/writes to paths matching
output.args.file_path.includes("web/src/") cannot proceed until the design
system script succeeds.

---

62-70: ⚠️ Potential issue | 🟠 Major

Pytest detection regex inconsistent with hookify rule.

The regex /(?:run\s+pytest|python\s+-m\s+pytest)\b/i only matches run pytest and python -m pytest, missing plain pytest invocations. Meanwhile, the hookify rule in .claude/hookify.enforce-parallel-tests.md uses (?:^|\s)(?:pytest|run\s+pytest|python\s+-m\s+pytest)\b which correctly includes bare pytest.

🐛 Proposed fix to align with hookify pattern

+            // Detect any pytest invocation
+            const isPytest = /(?:^|\s)(?:pytest|run\s+pytest|python\s+-m\s+pytest)\b/i.test(command);
+
             // enforce-parallel-tests: enforce -n 8 with pytest
-            if (
-              /(?:run\s+pytest|python\s+-m\s+pytest)\b/i.test(command) &&
-              !/-n 8/.test(command)
-            ) {
+            if (isPytest && !/-n 8/.test(command)) {
               throw new Error(
                 "Always use `-n 8` with pytest for parallel execution. Add `-n 8` to your pytest command. Never run tests sequentially or with `-n auto` (32 workers causes crashes and is slower due to contention).",
               );
             }
@@
             // no-local-coverage: block --cov flags locally
-            if (
-              /(?:run\s+pytest|python\s+-m\s+pytest)\b/i.test(command) &&
-              /--cov\b/.test(command)
-            ) {
+            if (isPytest && /--cov\b/.test(command)) {
               throw new Error(
                 "Do not run pytest with coverage locally -- CI handles it. Coverage adds 20-40% overhead. Remove `--cov`, `--cov-report`, and `--cov-fail-under` from your command.",
               );
             }

Also applies to: 79-87

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/plugins/synthorg-hooks.ts around lines 62 - 70, The
pytest-detection regex in the synthorg-hooks.ts hook currently only matches "run
pytest" and "python -m pytest" (/(:?run\s+pytest|python\s+-m\s+pytest)\b/i) and
should be expanded to include bare "pytest" to match the hookify rule; replace
that regex with something like
/(?:^|\s)(?:pytest|run\s+pytest|python\s+-m\s+pytest)\b/i in the pytest-checking
code path (the regex literal in the block that throws the "Always use `-n 8`
with pytest..." Error), and make the identical replacement in the other
occurrence noted (the second similar block around the other check).

---

23-44: 🧹 Nitpick | 🔵 Trivial

Shell command composition is fragile with embedded quotes.

The runHookScript function uses echo '${input.replace(...)}' | bash which can fail with JSON containing single quotes or special characters. The escape \\' doesn't properly handle all quote scenarios in shell context. Consider using spawnSync with the input option to pipe JSON directly to the script's stdin without shell interpolation.

♻️ Proposed fix using spawnSync

-import { execSync } from "child_process";
+import { execSync, spawnSync } from "child_process";

 function runHookScript(
   scriptPath: string,
   toolInput: Record<string, unknown>,
   timeoutMs: number = 10000,
 ): string | null {
-  try {
-    const input = JSON.stringify({ tool_input: toolInput });
-    const result = execSync(`echo '${input.replace(/'/g, "\\'")}' | bash ${scriptPath}`, {
-      timeout: timeoutMs,
-      encoding: "utf-8",
-      stdio: ["pipe", "pipe", "pipe"],
-    });
-    return result;
-  } catch (error: unknown) {
-    const err = error as { status?: number; stdout?: string };
-    if (err.status === 2) {
-      // Hook denied the action
-      return err.stdout ?? "Hook denied this action";
-    }
-    return null;
+  const input = JSON.stringify({ tool_input: toolInput });
+  const result = spawnSync("bash", [scriptPath], {
+    input,
+    timeout: timeoutMs,
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"],
+  });
+
+  if (result.status === 0) {
+    return result.stdout;
+  }
+  if (result.status === 2) {
+    return result.stdout || "Hook denied this action";
   }
+  return null;
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/plugins/synthorg-hooks.ts around lines 23 - 44, The runHookScript
function builds a fragile shell pipeline using execSync and echo which breaks on
embedded quotes; replace execSync(`echo ... | bash ${scriptPath}`) with a direct
child process invocation (spawnSync or execFileSync) that passes the JSON
stringified input to the script's stdin via the input option, keep timeoutMs,
encoding and stdio settings, and preserve the existing error handling logic for
exit status 2 by inspecting the child result.status and result.stdout (or
captured error) to return the hook denial message or null as before; update
references to execSync in runHookScript accordingly.

.opencode/plugins/memory.ts (1)

48-59: ⚠️ Potential issue | 🟠 Major

Quote frontmatter fields to prevent YAML injection.

name and description are user-provided and written directly into YAML frontmatter. Values containing colons, quotes, or newlines will produce invalid YAML, making saved memories unreadable.

🛡️ Proposed fix to escape YAML values

 function buildFrontmatter(entry: MemoryEntry): string {
+  // Escape values for safe YAML: wrap in quotes and escape internal quotes/newlines
+  const escapeYaml = (s: string): string =>
+    JSON.stringify(s); // JSON escaping is valid YAML for strings
+
   return [
     "---",
-    `name: ${entry.name}`,
-    `description: ${entry.description}`,
+    `name: ${escapeYaml(entry.name)}`,
+    `description: ${escapeYaml(entry.description)}`,
     `type: ${entry.type}`,
     "---",
     "",
     entry.content,
     "",
   ].join("\n");
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/plugins/memory.ts around lines 48 - 59, The buildFrontmatter
function is writing user-provided MemoryEntry.name and MemoryEntry.description
directly into YAML frontmatter, risking YAML injection; fix buildFrontmatter by
YAML-quoting and escaping those fields before embedding them: for both name and
description replace backslashes and double quotes with escaped versions, convert
literal newlines to "\n" (or otherwise escape them), then wrap the resulting
string in double quotes when inserting `name:` and `description:`; keep
entry.type as-is (or validate if user-provided) so the frontmatter always
produces valid YAML.

scripts/check_bash_no_write.sh (1)

12-12: ⚠️ Potential issue | 🟡 Minor

Consider fail-closed behavior for malformed JSON input.

The 2>/dev/null on jq silently converts parse failures to an empty string, allowing the script to exit 0 (allow). Malformed JSON inputs would bypass all write checks. If strict enforcement is desired, fail closed on parse errors.

🛡️ Proposed fix to fail-closed on parse errors

-COMMAND=$(jq -r '.tool_input.command // ""' 2>/dev/null)
+COMMAND=$(jq -r '.tool_input.command // ""') || {
+    echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Failed to parse tool input JSON"}}' >&2
+    exit 2
+}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/check_bash_no_write.sh` at line 12, The current assignment
COMMAND=$(jq -r '.tool_input.command // ""' 2>/dev/null) masks jq parse errors;
change it to let jq report failures and fail-closed: remove the "2>/dev/null" so
jq writes errors to stderr, then immediately check jq's exit status (or test
COMMAND) and if jq failed (non-zero) write an error message and exit 1;
reference the COMMAND variable and the jq invocation in
scripts/check_bash_no_write.sh so malformed JSON causes the script to exit
non-zero instead of silently allowing writes.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

.opencode/agents/design-token-audit.md (1)

54-59: ⚠️ Potential issue | 🟡 Minor

Align Storybook exclusions with the updated skip list.

Line 58 still excludes only .stories.tsx, but Line 22 already excludes both .stories.tsx and .stories.ts. This can reintroduce false positives for TS-only stories.

Suggested fix

- - Storybook `.stories.tsx` demo wrappers
+ - Storybook `.stories.tsx` / `.stories.ts` demo wrappers

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/agents/design-token-audit.md around lines 54 - 59, The Storybook
exclusion in the design-token-audit skip list only mentions ".stories.tsx" but
must match the earlier exclusion that includes both ".stories.tsx" and
".stories.ts"; update the Storybook exclusion bullet (the "Storybook
`.stories.tsx` demo wrappers" item) to include ".stories.ts" as well so TS-only
stories are also skipped and avoid reintroducing false positives.

.opencode/agents/pr-test-analyzer.md (1)

66-70: ⚠️ Potential issue | 🟡 Minor

Add the enforced 80% coverage gate to this agent spec.

Line 66-Line 70 defines severities but omits the hard CI threshold, so analysis can understate release-blocking coverage failures. Based on learnings: minimum 80% test coverage is enforced in CI for src/synthorg/**/*.py.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/agents/pr-test-analyzer.md around lines 66 - 70, Update the agent
spec to include the enforced CI coverage gate: add a rule stating that any files
under src/synthorg/**/*.py must maintain at least 80% test coverage and that
violations are treated as HIGH severity (release-blocking); modify the "Severity
Levels" section (the list containing HIGH/MEDIUM/LOW) to mention this 80%
threshold and link the path pattern src/synthorg/**/*.py to the HIGH category so
the analyzer flags coverage below 80% as a HIGH issue.

scripts/check_git_c_cwd.sh (1)

12-20: ⚠️ Potential issue | 🟠 Major

git -C blocking is bypassable due brittle parsing and non-canonical path comparison.

Line 12-Line 20 only handles git -C in a narrow token order, and Line 36 compares strings rather than resolved paths. git --no-pager -C . status (and similar forms) can evade the block despite targeting the current directory.

🐛 Proposed hardening patch

-if [[ -z "$COMMAND" ]] || ! echo "$COMMAND" | grep -qE 'git[[:space:]]+-C[[:space:]]+'; then
+if [[ -z "$COMMAND" ]] || ! echo "$COMMAND" | grep -qE '(^|[[:space:]])git([[:space:]]|$)'; then
     exit 0
 fi
 
-# Extract path after -C (handles quoted and unquoted)
-# Note: this simple sed may miss cases where options appear between git and -C
-# (e.g., git --no-pager -C path). For such cases, the script intentionally fails open.
-GIT_C_PATH=$(echo "$COMMAND" | sed -E 's/.*git[[:space:]]+-C[[:space:]]+("([^"]+)"|([^[:space:]]+)).*/\2\3/')
-GIT_C_PATH="${GIT_C_PATH//\"/}"
+# Extract -C argument robustly (supports flags before -C and quoted args)
+GIT_C_PATH="$(
+python - <<'PY'
+import os, shlex
+cmd = os.environ.get("COMMAND", "")
+try:
+    toks = shlex.split(cmd)
+except ValueError:
+    print("")
+    raise SystemExit(0)
+path = ""
+for i, t in enumerate(toks):
+    if t == "-C" and i + 1 < len(toks):
+        path = toks[i + 1]
+        break
+    if t.startswith("-C") and len(t) > 2:
+        path = t[2:]
+        break
+print(path)
+PY
+)"
+if [[ -z "$GIT_C_PATH" ]]; then
+    exit 0
+fi
 
 normalize() {
     local p="$1"
@@
-    echo "$p"
+    # Resolve relative paths like "." so equivalence checks are reliable
+    if [[ "$p" != /* ]]; then
+        p="$PWD/$p"
+    fi
+    p="$(cd "$p" 2>/dev/null && pwd -P || echo "$p")"
+    echo "${p%/}"
 }

Also applies to: 33-36

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/check_git_c_cwd.sh` around lines 12 - 20, The current check for git
-C is brittle because COMMAND parsing (variable COMMAND and GIT_C_PATH
extraction) only matches a narrow token order and then compares raw strings;
update the logic to robustly locate a -C token anywhere in the command argument
list by splitting COMMAND into tokens and scanning for the -C/--git-dir usage,
capture the subsequent token (respecting quoted args), then canonicalize the
extracted path and the repository cwd using realpath/readlink -f (or equivalent)
and compare resolved paths instead of raw strings; ensure you handle the case of
-C . and quoted paths and treat missing/invalid -C value as “no block” (fail
open) as before.

.claude/skills/aurelio-review-pr/SKILL.md (1)

166-166: ⚠️ Potential issue | 🟠 Major

Keep the subagent_type literal consistent here.

explore (type-design-analyzer) is the only row that is not one of the documented working values. If this literal is copied into a Task call, the type-design-analyzer path still fails with Unknown agent type and the type review never runs.

♻️ Proposed fix

-| **type-design-analyzer** | Diff contains `class` definitions, `BaseModel`, `TypedDict`, type aliases | `explore (type-design-analyzer)` |
+| **type-design-analyzer** | Diff contains `class` definitions, `BaseModel`, `TypedDict`, type aliases | `explore` |

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.claude/skills/aurelio-review-pr/SKILL.md at line 166, The table row uses
the nonstandard literal "explore (type-design-analyzer)" for subagent_type which
breaks agent lookup; update the value to the documented working literal (e.g.,
"type-design-analyzer") wherever "subagent_type" or that table row appears so
Task calls use the exact expected string; ensure any callers or tests
referencing "explore (type-design-analyzer)" are updated to the canonical
"type-design-analyzer" to restore the type review path.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

.opencode/commands/post-merge-cleanup.md (1)

1-7: ⚠️ Potential issue | 🟡 Minor

Add an H1 after the frontmatter.

Line 5 is still the first content line, so this file continues to trigger MD041.

🛠️ Minimal fix

 ---
 description: Post-merge branch cleanup
 ---
 
+# Post-merge Cleanup
+
 @.claude/skills/post-merge-cleanup/SKILL.md

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/commands/post-merge-cleanup.md around lines 1 - 7, The file has
YAML frontmatter but no top-level heading after it, causing MD041; add an H1
immediately after the closing '---' (before the existing content line
"@.claude/skills/post-merge-cleanup/SKILL.md") such as "# Post-merge branch
cleanup" so the first content line is a proper H1 and the linter warning is
resolved.

.opencode/commands/review-dep-pr.md (1)

1-7: ⚠️ Potential issue | 🟡 Minor

Add an H1 after the frontmatter.

Line 5 is still the first content line, so this file continues to trigger MD041.

🛠️ Minimal fix

 ---
 description: Review dependency update PRs
 ---
 
+# Review Dependency PR
+
 @.claude/skills/review-dep-pr/SKILL.md

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/commands/review-dep-pr.md around lines 1 - 7, Add a top-level H1
immediately after the YAML frontmatter so the file doesn't trigger MD041; e.g.,
insert a heading like "# Review dependency update PRs" on the first content line
after the frontmatter block (currently where "Arguments: $ARGUMENTS" appears) so
the document has an explicit H1 following the frontmatter.

.opencode/commands/research-link.md (1)

1-7: ⚠️ Potential issue | 🟡 Minor

Add an H1 after the frontmatter.

Line 5 is still the first content line, so this file continues to trigger MD041.

🛠️ Minimal fix

 ---
 description: Research any link, tool, or concept for this project
 ---
 
+# Research Link
+
 @.claude/skills/research-link/SKILL.md

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.opencode/commands/research-link.md around lines 1 - 7, The file's YAML
frontmatter ends but no H1 follows, causing MD041; add a top-level heading
immediately after the frontmatter (for example "# Research Link" or another
appropriate title) so the first content line is an H1; place it before the
existing reference line "@.claude/skills/research-link/SKILL.md" to ensure the
H1 is the first content element after the frontmatter.

scripts/check_git_c_cwd.sh (1)

16-48: ⚠️ Potential issue | 🟠 Major

The git -C detector is still bypassable.

Line 17 only matches git -C ..., so forms like git --no-pager -C "$PWD" status and git -c key=val -C "$PWD" status pass straight through. Then Line 24 uses plain word-splitting, so quoted paths and $PWD are treated as literal text instead of a single resolved path. The deny rule ends up covering only bare git -C /literal/path commands.

💡 Suggested direction

-# Not a git -C command -- no opinion
-if [[ -z "$COMMAND" ]] || ! echo "$COMMAND" | grep -qE 'git[[:space:]]+-C[[:space:]]+'; then
+if [[ -z "$COMMAND" ]]; then
     exit 0
 fi
 
-# Robust token-based parsing: split command into tokens, find -C, capture next token
-GIT_C_PATH=""
-in_git=false
-for token in $COMMAND; do
-    if [[ "$token" == "git" ]]; then
-        in_git=true
-    elif [[ "$in_git" == true ]]; then
-        if [[ "$token" == "-C" ]] || [[ "$token" == "--git-dir" ]]; then
-            continue
-        elif [[ "$token" == -* ]]; then
-            # Skip other git options
-            continue
-        else
-            # This is the path after -C
-            GIT_C_PATH="$token"
-            break
-        fi
-    fi
-done
-
-# Handle quoted paths
-GIT_C_PATH="${GIT_C_PATH//\"/}"
+GIT_C_PATH="$(
+python3 - "$COMMAND" <<'PY'
+import shlex, sys
+
+try:
+    tokens = shlex.split(sys.argv[1], posix=True)
+except ValueError:
+    print("")
+    raise SystemExit(0)
+
+in_git = False
+want_c_path = False
+for token in tokens:
+    if not in_git:
+        in_git = token == "git"
+        continue
+    if want_c_path:
+        print(token)
+        break
+    if token == "-C":
+        want_c_path = True
+PY
+)"
+
+case "$GIT_C_PATH" in
+  '$PWD'|'${PWD}'|'$(pwd)'|'`pwd`')
+    GIT_C_PATH="$PWD"
+    ;;
+esac

Run the following script to verify the bypasses. Expected: the flag-before--C commands should still be detected, and the quoted path should stay a single token. Actual with the current implementation: the regex gate returns False for the first two commands and naive splitting breaks the quoted path.

#!/bin/bash
set -euo pipefail

sed -n '16,48p' scripts/check_git_c_cwd.sh

python3 - <<'PY'
import re
import shlex

tests = [
    'git --no-pager -C "$PWD" status',
    'git -c color.ui=always -C "$PWD" status',
    'git -C "/tmp/my repo" status',
]

pattern = re.compile(r'git[ \t]+-C[ \t]+')

for command in tests:
    print(f"\nCOMMAND: {command}")
    print("regex_gate =", bool(pattern.search(command)))
    print("repo_word_split =", command.split())
    print("shlex_tokens =", shlex.split(command))
PY

scripts/check_bash_no_write.sh (1)

13-18: ⚠️ Potential issue | 🟠 Major

JSON parse failures result in fail-open behavior.

If stdin contains malformed JSON, jq exits non-zero with stderr suppressed by 2>/dev/null, causing the script to exit 0 (allow). This is fail-open, which could let malformed inputs bypass the hook. The past review comment indicated this was addressed, but the current code still shows the same pattern.

🛡️ Proposed fix for fail-closed on parse errors

 # Try to extract command from JSON stdin (OpenCode mode), or skip check if no stdin
-if ! COMMAND=$(jq -r '.tool_input.command // ""' 2>/dev/null); then
-    exit 0
+if ! COMMAND=$(jq -r '.tool_input.command // ""' 2>&1); then
+    echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Failed to parse tool input JSON"}}' >&2
+    exit 2
 fi

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/check_bash_no_write.sh` around lines 13 - 18, The script currently
treats jq parse failures as success (fail-open) because the error branch in "if
! COMMAND=$(jq -r '.tool_input.command // \"\"' 2>/dev/null); then exit 0 fi"
exits 0; change this to fail-closed by detecting jq errors and exiting non-zero
(e.g., exit 1) or printing an error before exit; ensure you still suppress jq
stderr if desired but do not swallow the failure—update the conditional around
the COMMAND assignment (the COMMAND variable and the jq invocation) so that a jq
failure causes the hook to abort with a non-zero exit status rather than
returning 0.

.claude/hookify.no-local-coverage.md (1)

8-8: ⚠️ Potential issue | 🟠 Major

Catch direct pytest invocations in this coverage rule.

Line 8 misses bare pytest, so commands like pytest tests/ --cov=synthorg bypass the block.

Proposed fix

-    pattern: (?:run\s+pytest|python\s+-m\s+pytest)\b
+    pattern: (?:^|\s)(?:pytest|run\s+pytest|python\s+-m\s+pytest)\b

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.claude/hookify.no-local-coverage.md at line 8, The current regex pattern
"(?:run\s+pytest|python\s+-m\s+pytest)\b" misses bare "pytest" invocations;
update the pattern used (the "pattern" value) to also match plain "pytest" —
e.g. replace with "(?:run\s+|python\s+-m\s+)?pytest\b" or
"(?:pytest|run\s+pytest|python\s+-m\s+pytest)\b" so commands like "pytest tests/
--cov=..." are caught.

.opencode/agents/code-reviewer.md (1)

17-17: ⚠️ Potential issue | 🟡 Minor

Fix markdownlint violations in headings and report fence.

Lines 17, 24, 30, 36, 43, and 49 need blank-line separation per MD022; Line 64 needs a fenced language and surrounding blank lines (MD031/MD040).

Proposed fix pattern

 ### 1. Correctness (HIGH)
+
 - Logic errors, off-by-one, wrong comparisons
 ...
 ## Report Format
 
 For each finding:
-```
+
+```text
 [SEVERITY] file:line -- Brief description
   Problem: What the code does wrong
   Fix: What it should do instead

Apply the same blank-line adjustment to each `###` subsection listed above.
</details>


Also applies to: 24-24, 30-30, 36-36, 43-43, 49-49, 64-64

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against the current code and only fix it if needed.

In @.opencode/agents/code-reviewer.md at line 17, Add required blank lines
around the Markdown headings and the report fence: insert a blank line before
and after each "###" subsection (e.g., the heading "### 1. Correctness (HIGH)"
and the other listed ### headings) to satisfy MD022, and convert the report
fence at the end (the triple-backtick block) to a fenced code block with
language "text" and ensure it has a blank line above and below (MD031/MD040)
using the proposed pattern; update the same changes for the other occurrences
referenced in the comment.

</details>

</blockquote></details>
<details>
<summary>.opencode/agents/type-design-analyzer.md (1)</summary><blockquote>

`65-70`: _⚠️ Potential issue_ | _🟡 Minor_

**Add a language identifier to the report-format code fence.**

Use a typed fence (e.g., ` ```text `) for the example block.

<details>
<summary>Suggested fix</summary>

```diff
-```
+```text
 [SEVERITY] file:line -- Category
   Type: The type/model in question
   Problem: What design issue exists
   Fix: Better type design approach

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against the current code and only fix it if needed.

In @.opencode/agents/type-design-analyzer.md around lines 65 - 70, Update the
example code fence for the report format to include a language identifier (e.g.,
change the plain fence totext) so the block is rendered as plain text;
locate the example block that currently shows the "[SEVERITY] file:line --
Category" template in the type/design analyzer doc (the triple-backtick fenced
example) and add the "text" language tag to the opening fence and keep the
matching closing fence.

</details>

</blockquote></details>
<details>
<summary>.opencode/commands/worktree.md (2)</summary><blockquote>

`11-13`: _⚠️ Potential issue_ | _🟠 Major_

**Avoid documenting a `cd`-prefixed launch command that hooks block.**

Line 12 still tells users to run `cd <path> && opencode-cli`, which conflicts with the no-cd-prefix rule introduced in this PR context.

<details>
<summary>Suggested fix</summary>

```diff
-Wherever the skill says `claude` as a command to run, use `opencode-cli` instead:
-- `cd <path> && claude` becomes `cd <path> && opencode-cli`
+Wherever the skill says `claude` as a command to run, use `opencode-cli` instead:
+- `cd <path> && claude` becomes `opencode-cli --cwd <path>`
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against the current code and only fix it if needed.

In @.opencode/commands/worktree.md around lines 11 - 13, The doc still instructs
using a cd-prefixed launch command; remove the "cd <path> &&" prefix everywhere
and replace instances of the old command name "claude" with "opencode-cli" (e.g.
change "cd <path> && opencode-cli" to just "opencode-cli"), and rename any
occurrences of the phrase "Claude Code prompts" to "OpenCode prompts" to match
the new naming and the no-cd-prefix rule.
```

</details>

---

`5-5`: _⚠️ Potential issue_ | _🟡 Minor_

**First heading should be H1 (MD041).**

Line 5 still starts with `##`; make it `#` to clear markdownlint.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against the current code and only fix it if needed.

In @.opencode/commands/worktree.md at line 5, The Markdown heading "OpenCode
Adapter (read this FIRST, before the skill below)" is using a level-2 heading
(##) and should be an H1 to satisfy MD041; update the heading token from "##
OpenCode Adapter (read this FIRST, before the skill below)" to a single "#" at
the start (i.e., "# OpenCode Adapter (read this FIRST, before the skill below)")
so the heading becomes H1.
```

</details>

</blockquote></details>
<details>
<summary>.claude/agents/tool-parity-checker.md (1)</summary><blockquote>

`34-50`: _⚠️ Potential issue_ | _🟠 Major_

**Parity checks are still too narrow and can miss real drift.**

Current logic only checks script references/file presence and requires an exact `"See CLAUDE.md"` phrase, but doesn’t ensure plugin registration in `opencode.json` and doesn’t trigger CLAUDE/AGENTS parity when `AGENTS.md` alone changes.

</blockquote></details>
<details>
<summary>.opencode/agents/silent-failure-hunter.md (1)</summary><blockquote>

`17-69`: _⚠️ Potential issue_ | _🟡 Minor_

**Fix markdown formatting issues flagged by linter.**

The markdown formatting issues from the previous review have not been addressed:
1. Missing blank lines after subsection headings (lines 17, 23, 28, 33, 38, 43)
2. Code block at line 64 missing language specifier and blank line before it



<details>
<summary>📝 Proposed fix</summary>

```diff
 ### 1. Silent Except Blocks (HIGH)
+
 - `except:` or `except Exception:` with only `pass`
...
 ### 2. Overly Broad Catches (HIGH)
+
 - `except Exception:` catching too wide when specific exceptions are known
...
 For each finding:
-```
+
+```text
 [SEVERITY] file:line -- Pattern type
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against the current code and only fix it if needed.

In @.opencode/agents/silent-failure-hunter.md around lines 17 - 69, Markdown
headings in .opencode/agents/silent-failure-hunter.md lack required blank lines
and the code block near the end is missing a language specifier and a preceding
blank line; fix by inserting a single blank line after each subsection heading
(e.g., after "### 1. Silent Except Blocks", "### 2. Overly Broad Catches", "###
3. Lost Error Context", "### 4. Suppressed Async Errors", "### 5. Conditional
Swallowing", "### 6. Logging Without Action") and ensure the code block
beginning with the report example has a blank line before the triple backticks
and a language tag (use "text") like ```text to satisfy the linter.

</details>

</blockquote></details>
<details>
<summary>AGENTS.md (2)</summary><blockquote>

`48-51`: _⚠️ Potential issue_ | _🟡 Minor_

**Agent roster count doesn't match the list.**

The section claims "21 review agents" but:
- Quality tier lists 8 agents
- Parallel tier lists 15 agents
- `frontend-reviewer` appears in both tiers (duplicate)

Total unique agents: 22 (or 23 entries). Update the count or deduplicate the list.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against the current code and only fix it if needed.

In `@AGENTS.md` around lines 48 - 51, The AGENTS.md roster count is incorrect: the
"Quality tier" and "Parallel tier" agent lists include a duplicate
("frontend-reviewer") and the stated "21 review agents" doesn't match the actual
unique agents; update AGENTS.md so the total count equals the number of unique
agent names, remove the duplicate "frontend-reviewer" from one tier (or
intentionally note it if it must appear in both), and adjust the header number
accordingly; verify the lists "Quality tier" and "Parallel tier" and the final
agent count are consistent.
```

</details>

---

`33-36`: _⚠️ Potential issue_ | _🟠 Major_

**Don't recommend PowerShell-specific syntax for shared skills.**

Shared skills in `.claude/skills/` should remain shell-neutral or bash-based. Recommending `Select-String` over `grep` creates drift between Claude Code and OpenCode. Translation to PowerShell should happen in `.opencode/commands` adapters, not in shared skill content.



<details>
<summary>📝 Proposed fix</summary>

```diff
-This project runs on Windows. OpenCode uses PowerShell, Claude Code uses bash. When writing shell commands in skills:
-- Use PowerShell-compatible syntax (e.g., `ls` not `ls -la`, `Select-String` not `grep`)
+This project runs on Windows. OpenCode uses PowerShell, Claude Code uses bash. When writing shell commands in shared skills (`.claude/skills/`):
+- Use POSIX/bash-compatible or shell-neutral commands; OpenCode adapters (`.opencode/commands/`) handle PowerShell translation
 - Git commands work the same in both shells
-- For bash-specific constructs (pipes, format strings), the model will self-correct to PowerShell equivalents
+- For bash-specific constructs, the model or adapter will translate to PowerShell equivalents
```
</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against the current code and only fix it if needed.

In `@AGENTS.md` around lines 33 - 36, The AGENTS.md guidance is pushing
PowerShell-specific syntax into shared skill guidance (e.g., recommending
Select-String instead of grep and advising PowerShell-compatible `ls` usage);
update the document to keep shared skill instructions shell-neutral or
bash-first by removing PowerShell-specific examples and replacing them with
neutral/baseline bash examples (use `ls -la`, `grep`, pipes/format strings) and
add a note that PowerShell translation must be handled in the OpenCode adapter
layer (.opencode/commands) while .claude/skills remain shell-neutral; ensure
references to "PowerShell-compatible syntax" and the Select-String example are
removed or replaced and explicitly call out .claude/skills as bash/shared and
.opencode/commands as the place for PowerShell conversions.
```

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🤖 Prompt for all review comments with AI agents</summary>

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.opencode/agents/api-contract-drift.md:

• Around line 17-52: Add a blank line after each subsection heading to satisfy
  markdownlint MD022: insert an empty line after the headings "### 1. Endpoint
  Consistency (HIGH)", "### 2. Type/Field Consistency (HIGH)", "### 3.
  Request/Response Shape (HIGH)", "### 4. Auth Contract (MEDIUM)", "### 5. Error
  Handling (MEDIUM)", and "### 6. Query Parameters (MEDIUM)" so each heading is
  followed by one blank line before the list content.
• Around line 69-75: Add a blank line immediately before the fenced code block
  that starts with the snippet "[SEVERITY] Backend: file:line <-> Frontend:
  file:line" and add a language specifier (use "text") after the opening backticks
  (i.e., change totext) so the block passes MD031 and MD040 checks; update
  the markdown in .opencode/agents/api-contract-drift.md accordingly.

In @.opencode/agents/async-concurrency-reviewer.md:

• Around line 17-72: Add missing blank lines after each heading (e.g., "### 1.
  Race Conditions (HIGH)", "### 2. Resource Leaks (HIGH)", "### 3. TaskGroup
  Patterns (MEDIUM)", "### 4. Blocking Calls in Async (HIGH)", "### 5.
  Cancellation Safety (HIGH)", "### 6. Event Loop Misuse (MEDIUM)", "### 7.
  Deadlocks (HIGH)") to satisfy MD022, and update the code fence shown at the end
  (the triple backticks block that contains the example report) to include a
  language identifier (use "text" or "markdown") and ensure there is a blank line
  before and after the fenced block to satisfy MD031 and MD040.

In @.opencode/agents/design-token-audit.md:

• Around line 1-9: The frontmatter in the design-token-audit agent spec is
  missing a model field; add a line like "model: glm-4.7:cloud" to the YAML
  frontmatter for consistency with other agent specs (or add a brief comment
  indicating you intentionally rely on the default model), ensuring it appears
  alongside existing keys such as description, mode, and permission so the parser
  and reviewers see the chosen model explicitly.

In @.opencode/agents/docs-consistency.md:

• Around line 21-56: Several Markdown headings in
  .opencode/agents/docs-consistency.md (for example the "### Design pages in
  docs/design/ (CRITICAL -- project source of truth)" heading and other
  third-level headings such as sections listing CLAUDE.md, README.md items) are
  immediately followed by list items and trigger MD022; add a single blank line
  after each heading to separate it from the subsequent list content. Update all
  headings that precede bullet/numbered lists (e.g., the Design pages, CLAUDE.md,
  and README.md section headings shown in the diff) so there's one blank line
  between the heading line and the first list item to satisfy MD022.

In @.opencode/agents/frontend-reviewer.md:

• Around line 17-77: Add missing blank lines after each heading (e.g., "### 1.
  React 19 Patterns", "### 2. Component Design", etc.) and update the example code
  fence at the end to include a language specifier (use ```text) and ensure there
  is a blank line before and after the fenced block; modify the markdown around
  the final example (the three-line severity example) to match the pattern used in
  go-reviewer.md so MD022, MD031 and MD040 are resolved.

In @.opencode/agents/go-conventions-enforcer.md:

• Line 4: Replace the model identifier string that currently includes the vendor
  prefix (the line containing "model: ollama-cloud/qwen3-coder-next:cloud") with
  the unprefixed official tag "qwen3-coder-next:cloud" so the value becomes
  "model: qwen3-coder-next:cloud".

In @.opencode/agents/issue-resolution-verifier.md:

• Around line 55-60: The fenced code block that currently begins with and contains the four lines "Requirement:..." etc. is unlabeled and causing MD040; update that fence to include a language identifier (e.g., change the opening fence totext or ```txt) so the block becomes a labeled code fence; locate
  the unlabeled fence in .opencode/agents/issue-resolution-verifier.md around the
  snippet starting with the triple backticks and modify only the opening fence to
  include the chosen language identifier.
• Line 4: The model identifier is incorrectly prefixed as
  "ollama-cloud/minimax-m2.5:cloud"; update the value used for the model spec (the
  "model:" entry) to the correct Ollama format "minimax-m2.5:cloud" by removing
  the "ollama-cloud/" prefix so the model line reads exactly "model:
  minimax-m2.5:cloud".

In @.opencode/agents/logging-audit.md:

• Around line 72-76: The fenced code block containing the sample log format
  starting with "[SEVERITY] file:line -- Violation type" is missing a language
  specifier; update that opening fence from "" to include a language tag (e.g., "text") so it reads "text" to ensure consistent syntax highlighting and
  linting for the block.

In @.opencode/agents/resilience-audit.md:

• Around line 75-76: Remove the duplicate "LOW" severity definition in the
  resilience-audit.md list: locate the two consecutive bullets starting with
  "LOW" (one reading "Soft rule violations, optimization opportunities" and
  the other "Optimization opportunities, minor pattern improvements") and
  consolidate them into a single, non-duplicated entry (either by keeping one and
  merging the descriptions or removing the redundant line) so the LOW severity
  appears only once.

In @.opencode/agents/type-design-analyzer.md:

• Around line 17-50: The markdown violates MD022 because each section heading
  (e.g., "1. Domain Modeling (HIGH)", "2. Invariant Enforcement (HIGH)", "3.
  Encapsulation (MEDIUM)", "4. Pydantic Model Quality (HIGH)", "5. Type Safety
  (MEDIUM)", "6. Inheritance Design (MEDIUM)") is not followed by a blank line;
  fix by inserting a single blank line immediately after each of these headings so
  that the subsequent list items start on a new paragraph line, ensuring MD022
  compliance.

In @.opencode/commands/analyse-logs.md:

• Around line 1-7: The file is missing a top-level heading after the YAML
  frontmatter which triggers MD041; add an H1 line immediately after the closing
  frontmatter marker (---) that reflects the page title (e.g., "Analyse Docker
  container logs") so the content begins with a proper H1 before the reference
  line '@.claude/skills/analyse-logs/SKILL.md' and the "Arguments: $ARGUMENTS"
  line.

In @.opencode/commands/aurelio-review-pr.md:

• Line 5: The first heading in the file is currently a level-2 heading ("##
  OpenCode Adapter (read this FIRST, before the skill below)"); change it to a
  level-1 heading by replacing the "##" with a single "#" so the line reads "#
  OpenCode Adapter (read this FIRST, before the skill below)" to satisfy MD041;
  ensure this is the first heading after the frontmatter and that no other H1s
  precede it.

In @.opencode/plugins/memory.ts:

• Around line 119-124: The code is casting the incoming type into
  MemoryEntry["type"] without validation; add a validation step (e.g.,
  isValidMemoryType or validateMemoryType) before constructing the entry to ensure
  type is one of "user" | "feedback" | "project" | "reference" and either
  reject/throw or map to a safe default if not; perform this check where the entry
  is created (the const entry: MemoryEntry = { name, description, type: type as
  MemoryEntry["type"], content }) and update callers to handle the validation
  error or fallback behavior.

In @.opencode/plugins/synthorg-hooks.ts:

• Around line 112-117: The catch block that currently checks for
  result.includes("block") is too fragile; update the catch in synthorg-hooks.ts
  (the try/catch around JSON.parse where the variable result is checked) to (1)
  capture the parse error (catch (err)) and log or propagate as needed, and (2)
  replace the brittle "block" substring check with the same "deny" detection used
  by the other hook logic — e.g., test for the explicit deny pattern used
  elsewhere (such as checking for '"deny"' or the exact deny token/pattern your
  hooks use) and only throw when that deny pattern is present; do not treat any
  occurrence of "block" as a block decision. Ensure you reference and use the same
  deny detection routine or string/pattern the other hook handlers use so behavior
  is consistent.
• Around line 40-43: runHookScript currently returns null on non-zero status
  which callers (they use "if (result)") treat the null as “allowed” and silently
  proceed; change runHookScript to return a discriminated object (e.g., { allowed:
  boolean, reason?: string } or { error: Error }) instead of null so callers can
  distinguish execution failure from "disallowed", and update all callers that
  invoked runHookScript (references: runHookScript, and scripts like
  check_bash_no_write.sh / check_git_c_cwd.sh) to first check for an "error" or
  execution-failed sentinel and throw or fail-closed, then check allowed and
  reason to decide further action.

In @AGENTS.md:

• Around line 19-21: Add a language specifier to the fenced code block
  containing "/.claude/projects//memory/" so markdownlint MD040 is
  satisfied; edit the fenced block in AGENTS.md (the block that currently shows
  "/.claude/projects//memory/") to start with text instead of
  and keep the same content and closing backticks.

In @scripts/check_bash_no_write.sh:

• Around line 52-55: The grep pattern in the echo/printf redirect check only
  matches filenames containing a dot, so commands like echo "data" > myfile slip
  past it; update the pattern used on COMMAND (the
  '\b(echo|printf)\b.>\s\S+.\S+' regex) to detect any non-whitespace target
  (e.g. '\b(echo|printf)\b.>\s\S+') or otherwise remove the “extension required”
  part, and ensure you still avoid false positives by accounting for
  append/descriptor redirects (handle '>>' and '>&' cases) and keep the deny(...)
  call intact so the deny function is triggered for bare filenames as well;
  alternatively, add a short comment documenting the overlap with the general
  redirect check for clarity if you choose not to change the regex.
• Around line 34-37: The heredoc detection regex only matches delimiters
  starting with letters/underscores and misses numeric or mixed-quoted delimiters;
  update the grep pattern used on COMMAND (the grep -qE call) to allow digits and
  optional surrounding quote characters so tokens like <<123 or <<-"'MIXED'" are
  caught. Replace the existing pattern (used in the if that calls deny) with one
  that accepts digits and optional repeated quote chars around the delimiter, e.g.
  use something like <<-?\s*\?['"][A-Za-z0-9_]+['"] in the grep -qE invocation
  so the check still matches heredoc forms while continuing to call deny "Do not
  use heredocs..." when found.

---

Duplicate comments:
In @.claude/hookify.no-local-coverage.md:

• Line 8: The current regex pattern "(?:run\s+pytest|python\s+-m\s+pytest)\b"
  misses bare "pytest" invocations; update the pattern used (the "pattern" value)
  to also match plain "pytest" — e.g. replace with
  "(?:run\s+|python\s+-m\s+)?pytest\b" or
  "(?:pytest|run\s+pytest|python\s+-m\s+pytest)\b" so commands like "pytest tests/
  --cov=..." are caught.

In @.opencode/agents/code-reviewer.md:

• Line 17: Add required blank lines around the Markdown headings and the report
  fence: insert a blank line before and after each "###" subsection (e.g., the
  heading "### 1. Correctness (HIGH)" and the other listed ### headings) to
  satisfy MD022, and convert the report fence at the end (the triple-backtick
  block) to a fenced code block with language "text" and ensure it has a blank
  line above and below (MD031/MD040) using the proposed pattern; update the same
  changes for the other occurrences referenced in the comment.

In @.opencode/agents/silent-failure-hunter.md:

• Around line 17-69: Markdown headings in
  .opencode/agents/silent-failure-hunter.md lack required blank lines and the code
  block near the end is missing a language specifier and a preceding blank line;
  fix by inserting a single blank line after each subsection heading (e.g., after
  "### 1. Silent Except Blocks", "### 2. Overly Broad Catches", "### 3. Lost Error
  Context", "### 4. Suppressed Async Errors", "### 5. Conditional Swallowing",
  "### 6. Logging Without Action") and ensure the code block beginning with the
  report example has a blank line before the triple backticks and a language tag
  (use "text") like ```text to satisfy the linter.

In @.opencode/agents/type-design-analyzer.md:

• Around line 65-70: Update the example code fence for the report format to
  include a language identifier (e.g., change the plain fence totext) so
  the block is rendered as plain text; locate the example block that currently
  shows the "[SEVERITY] file:line -- Category" template in the type/design
  analyzer doc (the triple-backtick fenced example) and add the "text" language
  tag to the opening fence and keep the matching closing fence.

In @.opencode/commands/post-merge-cleanup.md:

• Around line 1-7: The file has YAML frontmatter but no top-level heading after
  it, causing MD041; add an H1 immediately after the closing '---' (before the
  existing content line "@.claude/skills/post-merge-cleanup/SKILL.md") such as "#
  Post-merge branch cleanup" so the first content line is a proper H1 and the
  linter warning is resolved.

In @.opencode/commands/research-link.md:

• Around line 1-7: The file's YAML frontmatter ends but no H1 follows, causing
  MD041; add a top-level heading immediately after the frontmatter (for example "#
  Research Link" or another appropriate title) so the first content line is an H1;
  place it before the existing reference line
  "@.claude/skills/research-link/SKILL.md" to ensure the H1 is the first content
  element after the frontmatter.

In @.opencode/commands/review-dep-pr.md:

• Around line 1-7: Add a top-level H1 immediately after the YAML frontmatter so
  the file doesn't trigger MD041; e.g., insert a heading like "# Review dependency
  update PRs" on the first content line after the frontmatter block (currently
  where "Arguments: $ARGUMENTS" appears) so the document has an explicit H1
  following the frontmatter.

In @.opencode/commands/worktree.md:

• Around line 11-13: The doc still instructs using a cd-prefixed launch command;
  remove the "cd &&" prefix everywhere and replace instances of the old
  command name "claude" with "opencode-cli" (e.g. change "cd &&
  opencode-cli" to just "opencode-cli"), and rename any occurrences of the phrase
  "Claude Code prompts" to "OpenCode prompts" to match the new naming and the
  no-cd-prefix rule.
• Line 5: The Markdown heading "OpenCode Adapter (read this FIRST, before the
  skill below)" is using a level-2 heading (##) and should be an H1 to satisfy
  MD041; update the heading token from "## OpenCode Adapter (read this FIRST,
  before the skill below)" to a single "#" at the start (i.e., "# OpenCode Adapter
  (read this FIRST, before the skill below)") so the heading becomes H1.

In @AGENTS.md:

• Around line 48-51: The AGENTS.md roster count is incorrect: the "Quality tier"
  and "Parallel tier" agent lists include a duplicate ("frontend-reviewer") and
  the stated "21 review agents" doesn't match the actual unique agents; update
  AGENTS.md so the total count equals the number of unique agent names, remove the
  duplicate "frontend-reviewer" from one tier (or intentionally note it if it must
  appear in both), and adjust the header number accordingly; verify the lists
  "Quality tier" and "Parallel tier" and the final agent count are consistent.
• Around line 33-36: The AGENTS.md guidance is pushing PowerShell-specific
  syntax into shared skill guidance (e.g., recommending Select-String instead of
  grep and advising PowerShell-compatible ls usage); update the document to keep
  shared skill instructions shell-neutral or bash-first by removing
  PowerShell-specific examples and replacing them with neutral/baseline bash
  examples (use ls -la, grep, pipes/format strings) and add a note that
  PowerShell translation must be handled in the OpenCode adapter layer
  (.opencode/commands) while .claude/skills remain shell-neutral; ensure
  references to "PowerShell-compatible syntax" and the Select-String example are
  removed or replaced and explicitly call out .claude/skills as bash/shared and
  .opencode/commands as the place for PowerShell conversions.

In @scripts/check_bash_no_write.sh:

• Around line 13-18: The script currently treats jq parse failures as success
  (fail-open) because the error branch in "if ! COMMAND=$(jq -r
  '.tool_input.command // ""' 2>/dev/null); then exit 0 fi" exits 0; change this
  to fail-closed by detecting jq errors and exiting non-zero (e.g., exit 1) or
  printing an error before exit; ensure you still suppress jq stderr if desired
  but do not swallow the failure—update the conditional around the COMMAND
  assignment (the COMMAND variable and the jq invocation) so that a jq failure
  causes the hook to abort with a non-zero exit status rather than returning 0.

</details>

<details>
<summary>🪄 Autofix (Beta)</summary>

Fix all unresolved CodeRabbit comments on this PR:

- [ ] <!-- {"checkboxId": "4b0d0e0a-96d7-4f10-b296-3a18ea78f0b9"} --> Push a commit to this branch (recommended)
- [ ] <!-- {"checkboxId": "ff5b1114-7d8c-49e6-8ac1-43f82af23a33"} --> Create a new PR with the fixes

</details>

---

<details>
<summary>ℹ️ Review info</summary>

<details>
<summary>⚙️ Run configuration</summary>

**Configuration used**: Repository UI

**Review profile**: ASSERTIVE

**Plan**: Pro

**Run ID**: `1c5e4098-a7e1-45e7-b562-0c11b6279247`

</details>

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between c4cb4538139eafbb0cdc821b9685480bcebd6c33 and 0d94de6e0b7606cd3248d1190e999ce763ab6ca6.

</details>

<details>
<summary>📒 Files selected for processing (47)</summary>

* `.claude/agents/tool-parity-checker.md`
* `.claude/hookify.block-pr-create.md`
* `.claude/hookify.enforce-parallel-tests.md`
* `.claude/hookify.no-cd-prefix.md`
* `.claude/hookify.no-local-coverage.md`
* `.claude/skills/aurelio-review-pr/SKILL.md`
* `.claude/skills/pre-pr-review/SKILL.md`
* `.gitignore`
* `.opencode/agents/api-contract-drift.md`
* `.opencode/agents/async-concurrency-reviewer.md`
* `.opencode/agents/code-reviewer.md`
* `.opencode/agents/comment-analyzer.md`
* `.opencode/agents/conventions-enforcer.md`
* `.opencode/agents/design-token-audit.md`
* `.opencode/agents/docs-consistency.md`
* `.opencode/agents/frontend-reviewer.md`
* `.opencode/agents/go-conventions-enforcer.md`
* `.opencode/agents/go-reviewer.md`
* `.opencode/agents/go-security-reviewer.md`
* `.opencode/agents/infra-reviewer.md`
* `.opencode/agents/issue-resolution-verifier.md`
* `.opencode/agents/logging-audit.md`
* `.opencode/agents/persistence-reviewer.md`
* `.opencode/agents/pr-test-analyzer.md`
* `.opencode/agents/python-reviewer.md`
* `.opencode/agents/resilience-audit.md`
* `.opencode/agents/security-reviewer.md`
* `.opencode/agents/silent-failure-hunter.md`
* `.opencode/agents/test-quality-reviewer.md`
* `.opencode/agents/type-design-analyzer.md`
* `.opencode/commands/analyse-logs.md`
* `.opencode/commands/aurelio-review-pr.md`
* `.opencode/commands/codebase-audit.md`
* `.opencode/commands/post-merge-cleanup.md`
* `.opencode/commands/pre-pr-review.md`
* `.opencode/commands/research-link.md`
* `.opencode/commands/review-dep-pr.md`
* `.opencode/commands/worktree.md`
* `.opencode/plugins/memory.ts`
* `.opencode/plugins/synthorg-hooks.ts`
* `.pre-commit-config.yaml`
* `AGENTS.md`
* `CLAUDE.md`
* `opencode.json`
* `scripts/check_bash_no_write.sh`
* `scripts/check_git_c_cwd.sh`
* `scripts/check_push_rebased.sh`

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->