Bug: The CI script downloads a pinned gitleaks version using the /releases/latest/download/ URL, which will fail with a 404 error once a newer gitleaks version is released.
_{Severity: HIGH}

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/ci.yml#L43

Potential issue: The CI workflow uses `curl` to download a specific version of
`gitleaks` (`gitleaks_8.24.3_linux_amd64.tar.gz`) from the `/releases/latest/download/`
endpoint. This endpoint always points to the assets of the latest release. When a new
version of `gitleaks` is published, the "latest" tag will point to it. The `curl`
command will then try to download the `8.24.3` file from the new release's assets, which
won't exist, resulting in a 404 error. Since `curl` is run with the `-f` flag, this HTTP
error will cause the "Install gitleaks" step to fail, breaking the entire CI pipeline.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

Bug: The setup.sh script uses set -e and unguarded function calls, causing it to exit on the first missing tool instead of reporting all missing dependencies as intended.
_{Severity: MEDIUM}

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: claude-ops/scripts/setup.sh#L5

Potential issue: The `setup.sh` script uses `set -e`, which causes it to exit
immediately on any command that returns a non-zero exit code. The script calls the
`auto_install` function for several tools. This function returns `1` if a tool is
missing and cannot be installed (e.g., on a system without Homebrew). Because these
function calls are not guarded, the script will exit on the first missing tool. This
prevents the subsequent diagnostic loop from running, which is intended to collect and
report all missing tools, leaving the user without a complete list of required
dependencies.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

The download URL mixes releases/latest with a hard-coded asset name for v8.24.3. As soon as latest points to a newer tag, this will 404 and CI will fail. Pin the URL to the specific tag (e.g. releases/download/v8.24.3/...) or fetch the latest version dynamically and use a matching filename.

CI downloads and executes a prebuilt gitleaks binary without any integrity verification. To reduce supply-chain risk, add a checksum verification step (or use a package manager install with pinned version/signature) before executing the binary.

The header comment says this script is called by SessionStart and /ops:setup, but the repo only references it from the SessionStart hook (the setup wizard uses bin/ops-setup-*). Update the comment to match actual usage so future changes don’t assume it’s part of the interactive wizard flow.

npm install for telegram-server deps is fully silenced (--silent 2>/dev/null) and failures aren’t reported or added to MISSING, so SessionStart can silently leave the Telegram MCP server broken. Capture install failures and emit a clear ✗ ops: message (or add to MISSING) when dependency install fails.

Since both claude-ops/ and telegram-server/ have package-lock.json, using npm install here is non-deterministic and can update the lockfile or resolve different dependency trees across npm versions. Prefer npm ci when a lockfile exists (and fall back to npm install only when it doesn’t).

The GSD install instructions reference the auroracapital/get-shit-done marketplace and gsd@auroracapital-get-shit-done, but elsewhere in the repo GSD is referenced under Lifecycle-Innovations-Limited/get-shit-done. Align the marketplace slug/plugin ID so the wizard installs the same plugin that the docs reference.

This section mixes claude plugin ... CLI commands with the in-app /plugin ... slash commands used elsewhere in the setup flow. Since the wizard runs inside Claude Code, prefer one consistent command form (typically /plugin ...) to avoid confusing users about where to run the commands.

The PR template checklist references npm run type-check && npm run lint && npm run test, but this repo’s claude-ops/package.json does not define these scripts and CI currently runs npm ci, node --check, bash -n, and npx prettier --check. Update the checklist to match the actual project commands so contributors can follow it successfully.

CONTRIBUTING recommends npm run lint, npm run type-check, and npm run test, but this repository’s claude-ops/package.json doesn’t define those scripts and CI uses npm ci, syntax checks, and Prettier. Adjust the guidance to the real commands (or add the referenced scripts) so new contributors aren’t blocked by instructions that don’t work.

The README says “All credentials stored locally, never transmitted,” but later describes multiple integrations using OAuth via Claude.ai (which necessarily involves transmitting tokens/authorization flows). Reword this to distinguish local CLI tokens/secrets (stored locally) vs Claude.ai MCP OAuth connectors, to avoid misleading users about data handling.

Gitleaks CI URL will 404 due to version mismatch

High Severity

The gitleaks download URL uses /releases/latest/download/ which redirects to the latest release, but the filename is pinned to version 8.24.3. Since the latest gitleaks release is v8.30.1, the latest release doesn't contain an asset named gitleaks_8.24.3_linux_amd64.tar.gz, resulting in a 404. The correct URL for a pinned version is /releases/download/v8.24.3/gitleaks_8.24.3_linux_amd64.tar.gz.

 

^{Reviewed by Cursor Bugbot for commit 4e35e80. Configure here.}

Script exits on first missing tool due to set -e

High Severity

The auto_install function returns 1 when a tool is missing and Homebrew is unavailable. Combined with set -euo pipefail, the script aborts on the very first missing tool (e.g. auto_install jq jq) instead of collecting all missing tools into MISSING and reporting them at the end. The remaining tool checks, npm installs, and status reporting never execute.

 

^{Reviewed by Cursor Bugbot for commit 4e35e80. Configure here.}

GSD install commands reference old organization name

Medium Severity

The GSD auto-install commands use auroracapital/get-shit-done, but the GSD link in claude-ops/README.md was updated to Lifecycle-Innovations-Limited/get-shit-done as part of this PR's org migration. The install and fallback instructions will fail if the repository no longer exists under the old org.

 

^{Reviewed by Cursor Bugbot for commit 4e35e80. Configure here.}

Empty array expansion fails under set -u on macOS

Medium Severity

On macOS default bash 3.2, expanding an empty array with "${MISSING[@]}" while set -u (nounset) is active triggers an "unbound variable" error, even though the array is declared via MISSING=(). This affects the happy path where all tools are already installed — MISSING stays empty, and the for loop crashes the script before the registry check on line 58 ever runs. The SessionStart hook silently swallows this via 2>/dev/null, so users never see the missing-registry warning.

 

^{Reviewed by Cursor Bugbot for commit 4e35e80. Configure here.}

Prevent setup from exiting when a tool is missing

Because the script is running with set -e, returning non-zero here causes the whole setup script to abort on the first unavailable tool (for example gh on a fresh machine without Homebrew). That means later checks never run and the user gets no missing-tool guidance, which breaks the SessionStart diagnostic flow that expects this script to emit ✗ lines rather than terminate.

Useful? React with 👍 / 👎.

Use a stable gitleaks release URL

This URL combines the moving releases/latest alias with a hard-coded 8.24.3 asset name, so CI will fail with a download error as soon as latest points to any other version. Pinning both the tag and filename (or resolving the version dynamically) avoids a latent break in the leak-scan step.

Useful? React with 👍 / 👎.