Refresh agent and skill docs for the current plugin surfaces#184
Merged
Conversation
The security-audit agent predated the ?atproto preview endpoint, the REST controllers, the retry-ladder cron, and the mention-resolution egress surface. It gains an in-house findings history, a dedicated preview-endpoint audit section, mention-egress and publish/display parity checks, the wp_unschedule_hook() rule for arg-carrying events, new noted patterns, and preview curl probes; the stale model pin is replaced with the opus alias. Also fixes concrete staleness elsewhere: the dev skill documented a nonexistent 'npm run env' script (now npx wp-env run cli), code-review claimed WordPress 6.2+ where readme.txt requires 6.5, the test skill listed a 13-file test tree (now a directory map plus the identity / blob-stub / HTTP-tripwire fixtures), and spec-check knew only one of the four shipped content formats.
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the repository’s agent and skill documentation so audits/reviews/testing guidance matches the plugin’s current published surfaces (preview endpoint, REST controllers, cron retry ladder, content formats) and the current local-dev workflow.
Changes:
- Expand
security-auditguidance with 2026 pre-release regression classes, a dedicated?atprotopreview audit section, and new verification probes. - Update
spec-checkandcode-reviewchecklists to reflect current content formats and minimum supported WordPress version (6.5+). - Refresh
dev/testskills with workingwp-env/WP-CLI commands and a rot-resistant test directory + fixture map.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .claude/agents/spec-check.md | Adds coverage for additional document content $types and points at the parser registry/selection mechanism. |
| .claude/agents/security-audit.md | Major refresh: adds 2026 findings history, dedicated ?atproto audit section, new patterns and curl probes. |
| .claude/agents/code-review.md | Aligns compatibility checklist to WordPress 6.5+ and adds review lessons around capability scoping, read-only GET, egress caps, parity tokenization. |
| .agents/skills/test/SKILL.md | Replaces stale fixed test-tree listing with a directory map and documents common fixtures used by newer tests. |
| .agents/skills/dev/SKILL.md | Replaces nonexistent npm run env ... WP-CLI calls with verified npx wp-env run ... commands. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+107
to
+111
| $short_circuit = static function () use ( &$attempted ) { | ||
| $attempted = true; | ||
| return array( 'blob' => array( 'cid' => 'bafytest' ) ); | ||
| }; | ||
| \add_filter( 'atmosphere_pre_upload_blob', $short_circuit ); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes:
?atprotopreview endpoint, theincludes/rest/controllers, the retry-ladder cron, and the mention-resolution egress surface. It gains:REST_REQUESToutliving its branch, write-on-GET blob uploads, per-call egress caps misread as per-publish);?atprotopreview (object-level caps, strict read-only invariant,REST_REQUESTscoping, missingnocache_headers()as a known-open item, fall-through behavior, redaction, third-party transformer contract);wp_unschedule_hook()-for-arg-carrying-events rule in the cron section;curlprobes, and the staleclaude-opus-4-7[1m]model pin replaced with theopusalias.readme.txt), plus four checklist bullets from the same review lessons.npm run envscript — replaced with workingnpx wp-env run cli -- wp …forms (verified against the running environment).atmosphere_identityoption,atmosphere_pre_upload_blobstub,pre_http_requesttripwire).at.markpub.markdownof the four shipped content formats — now listsorg.wordpress.html(with the in-repo Lexicon doc as canonical),pub.leaflet.content, andblog.pckt.content, and points at theRegistryselection mechanism.Every symbol, hook, option, command, path, and port referenced by the updated docs was verified to exist on trunk; the corrected CLI commands were executed against a running wp-env.
Other information:
Testing instructions:
composer lintandnpm run env-testpass (docs-only diff — 854 tests green).grep -n "function current_user_can_preview" includes/transformer/class-preview.php,grep -n "OPTION_FORMAT" includes/content-parser/class-registry.php,python3 -c "import json; print(list(json.load(open('package.json'))['scripts']))"(noenvscript).npx wp-env run cli -- wp plugin listto confirm the corrected dev-skill command works.Changelog entry
Dev-tooling only (
.claude/,.agents/) — nothing end-user facing ships; "Skip Changelog" label applied.