fix(agents): port pr-review robustness learnings from facets (2026-06-22)

[0xbulma]

Motivation

This repo's .agents/ PR-review system is a markdown-only port of the 0xbulma/facets plugin's PR-review skills (dispatcher lib/pr-review-base.md + commands/pr-review-{ci,gh,local}.md + personas/). Eight PRs merged upstream on 2026-06-22 hardening that system. Most target upstream-only machinery absent here (TS scripts, findings-ledger), but four carry lessons that map onto this port — two are latent correctness bugs already present in our files, two are robustness tightenings. Parallel Conductor workspaces (shared host /tmp) make #57 materially relevant.

Solution

facets PR	Ported as	Detail
#57	per-run mktemp paths	Replace shared /tmp literals in pr-review-gh (Step 7 payload + watcher cycle file) and pr-review-ci (REVIEW_FILE) with mktemp "${TMPDIR:-/tmp}/…XXXXXX" (BSD+GNU portable). Also fixes a latent unassigned $REVIEW_FILE in pr-review-gh Step 7 (prose named a literal path; submit/cleanup referenced an unset var).
#52	persist repo-relative path	pr-review-base Step 6 already normalized finding.file for the scope compare but discarded it; callers passed the raw path into the GitHub review comments[].path, which the reviews API rejects (./, a/, b/, or absolute prefix) → atomic review collapses to a PR-level comment. Now the normalized path is written back into the kept finding; contract documented in the output section and both callers.
#53	watcher re-review on incomplete	--watch cache-hit on SHA equality treated a prior crashed-agent cycle (review may be incomplete, zero findings) as clean and never retried. Now detect the incomplete warning on the last review (CYCLE_LAST_REVIEW_INCOMPLETE) and re-review (WATCH_RETRY_INCOMPLETE) instead of cache-hitting. (--goal half of #53 is N/A — feature absent here.)
#54	single-message fan-out	pr-review-base Step 5 now mandates reading all persona files first, then issuing every Agent call in one message, with a caution that splitting serializes the panel.

Not ported (upstream-only machinery absent in this port)

• feat(position): add position functions #47, build(deps-dev): bump @nomicfoundation/hardhat-ethers from 3.0.6 to 3.0.7 #55 — operate on findings-ledger.ts / review-scope.ts; no TS scripts here.
• refacto: remove goerli #50 — no unquoted multi-token flag variable exists in .agents/ (all gh/git var usages are quoted single-token); feedback skill isn't ported.
• build(deps-dev): bump husky from 9.0.11 to 9.1.5 #51 — findings-ledger feature absent; the watcher concern it raises is addressed by the build(deps-dev): bump ts-jest from 29.2.4 to 29.2.5 #53 port.

Notes

• No changeset — .agents/** is repo tooling, not published package source (CLAUDE.md §7).
• No test harness for .agents/ in this repo (upstream's bats guard lives against the plugin layout). Verified via grep guards: zero fixed /tmp literals remain, three mktemp per-run paths, REVIEW_FILE/CYCLE_FILE assigned before use, normalized path written back. A small CI grep guard banning fixed /tmp/ review-state literals under .agents/ would be the spiritual port of upstream's bats test — left out of scope here.

🤖 Generated with Claude Code