Skip to content

Add agent stack sync helper - #91

Merged
justin808 merged 8 commits into
mainfrom
jg-codex/agent-stack-sync
Jul 8, 2026
Merged

Add agent stack sync helper#91
justin808 merged 8 commits into
mainfrom
jg-codex/agent-stack-sync

Conversation

@justin808

@justin808 justin808 commented Jul 8, 2026

Copy link
Copy Markdown
Member

Summary

  • add agent-stack sync as a hacker-friendly stack bootstrap/update helper
  • make ~/src the default source checkout root, ~/.agent-workflows the private runtime/config root, and ~/codex/agent-repos compatibility symlinks
  • install agent-stack alongside the existing workflow helper binaries
  • document the new local layout in the README and installation guide

Validation

  • bash -n bin/agent-stack bin/agent-stack-test.bash bin/install-agent-workflows bin/install-agent-workflows-test.bash
  • git diff --check
  • bash bin/agent-stack-test.bash
  • bash bin/install-agent-workflows-test.bash
  • bin/validate

Codex Decision Log

  • Non-blocking: where should editable source repos live?
    • Decision: default to ~/src and reserve ~/.agent-workflows for runtime/config/cache/log/state.
    • Why: this keeps the system hackable and mirrors the useful part of tools like gstack: normal source checkouts, dotdir runtime state.
    • Review later: if this becomes a packaged product, we can add a hidden ~/.agent-workflows/repos install mode without changing the contributor default.

Summary by CodeRabbit

  • New Features

    • Added a new local “agent stack” sync command for setting up and keeping multiple repos in sync.
    • Improved install guidance for choosing a host and using a shared agent home.
  • Documentation

    • Expanded setup docs with a full contributor workflow and clearer install paths.
    • Clarified that the full agent stack is separate from the generic workflow-pack install.
  • Tests

    • Added broader end-to-end coverage for sync behavior, safety checks, and install expectations.
    • Included the new sync test in validation runs.

@coderabbitai

coderabbitai Bot commented Jul 8, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@justin808, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 35 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 08ceea8d-3951-49c2-82e0-872782e48ea5

📥 Commits

Reviewing files that changed from the base of the PR and between 6d01cad and 0dc9580.

📒 Files selected for processing (2)
  • bin/agent-stack
  • bin/agent-stack-test.bash

Walkthrough

Adds a new bin/agent-stack Bash CLI implementing a sync subcommand that syncs three agent repos, manages runtime directories, and creates compatibility symlinks, with an install pathway for agent-coordination/workflows tools. Includes an extensive test suite, installer assertions, bin/validate wiring, and README/docs updates.

Changes

agent-stack sync feature

Layer / File(s) Summary
CLI entrypoint, config, and helpers
bin/agent-stack
Adds the sync subcommand dispatch, argument parsing for roots/host/mode/flags, validation of --host/--mode, timestamp helper, path normalization helpers, and git URL/origin-allowlist derivation.
Repo sync and compat linking
bin/agent-stack
Adds compat-root overlap checks, prepare_runtime_root for secure cache/logs/state/env layout, sync_repo for clone/branch/stash/fetch/fast-forward logic, and link_compat_path for creating or replacing compatibility symlinks.
Tool installation and execution flow
bin/agent-stack
Adds install_agent_stack, install_agent_coord, and install_workflows helpers, and wires the end-to-end flow: root normalization, overlap checks, runtime preparation, per-repo sync/link, conditional installs, and logging.
agent-stack sync test suite
bin/agent-stack-test.bash
Adds fixture/origin creation, assertion helpers, and tests covering successful sync/install/link, artifact preservation, binary refresh, dirty worktree and non-main refusal, origin/remote mismatch handling, worktree/symlink source handling, overlapping-root refusal, runtime env symlink refusal, --no-install, and --force-stash.
Installer, validation, and docs wiring
bin/install-agent-workflows-test.bash, bin/validate, README.md, docs/installation-and-upgrades.md
Adds installer test assertions that agent-stack is excluded from generic installs, runs the new test script from bin/validate, and updates README Quick Start and installation docs with a "Full Stack Contributor Setup" section.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

  • shakacode/agent-workflows#69: Modifies the same installer (bin/install-agent-workflows) and its test suite that this PR also adds assertions to.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title matches the main change: adding the new agent-stack sync helper and related setup.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch jg-codex/agent-stack-sync

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ef9e57a283

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread bin/agent-stack

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🧹 Nitpick comments (1)
bin/agent-stack-test.bash (1)

103-211: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Add a cleanup trap to remove temp directories.

Each test creates temp dirs via mktemp -d but never removes them, leaving artifacts behind on every run. Add a trap to clean up, or remove dirs at the end of each test function.

♻️ Suggested cleanup approach
 #!/usr/bin/env bash
 set -euo pipefail

 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

+TEST_TMPDIRS=()
+cleanup() {
+  for d in "${TEST_TMPDIRS[@]}"; do
+    rm -rf "$d"
+  done
+}
+trap cleanup EXIT
+

Then in each test, after tmp="$(mktemp -d)", add:

   tmp="$(mktemp -d)"
+  TEST_TMPDIRS+=("$tmp")
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bin/agent-stack-test.bash` around lines 103 - 211, The test helpers in
agent-stack-test.bash leave mktemp -d directories behind in each of the sync
test functions, so add cleanup using a trap or explicit removal for the temp
root created in each test. Update the affected functions such as
test_sync_clones_installs_and_links_the_stack,
test_sync_refuses_dirty_repo_without_force_stash,
test_sync_refuses_non_main_repo, and
test_sync_force_stash_allows_dirty_main_repo so tmp is always removed even on
failure, without changing the test assertions or flow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@bin/agent-stack-test.bash`:
- Line 200: The hardcoded redirect target in the agent-stack test script should
be replaced with a unique temporary file to avoid collisions and symlink risks.
Update the `--force-stash` output handling in `bin/agent-stack-test.bash` to
create a temp file with `mktemp`, redirect stdout there, and ensure the file is
removed during cleanup; use the surrounding script flow and the `--force-stash`
invocation to locate the change.
- Line 152: The failure test for the agent-stack sync command is missing the
runtime root setup, so it can still create ~/.agent-workflows before sync fails.
Update the failing invocations in the agent-stack test script around the sync
command to pass --runtime-root in both failure cases, and keep --target removed
since it is unused with --no-install. Use the agent-stack sync call and
prepare_runtime_root context to locate the affected test cases.

In `@docs/superpowers/plans/2026-07-08-agent-stack-sync.md`:
- Around line 16-18: The plan entries in the agent stack sync doc use hard-coded
`/Users/justin/...` paths, which makes the documentation non-portable and
exposes a personal workstation path. Update the listed items to use
repo-relative paths or a generic placeholder root instead, and make the same
replacement for the related entries noted elsewhere in the document so the paths
consistently reference the repo rather than a specific machine.

In `@README.md`:
- Around line 65-83: The bootstrap guidance in README is incomplete for
first-time users who do not already have agent-stack on PATH. Update the section
around the agent-stack sync helper to explicitly tell readers to run the helper
from the cloned checkout via bin/agent-stack sync, or to add that checkout’s
bin/ directory to PATH before invoking agent-stack. Keep the existing references
to the stack sync helper and the initial clone step, but make the startup
sequence unambiguous so users can reach the sync command from a fresh install.

---

Nitpick comments:
In `@bin/agent-stack-test.bash`:
- Around line 103-211: The test helpers in agent-stack-test.bash leave mktemp -d
directories behind in each of the sync test functions, so add cleanup using a
trap or explicit removal for the temp root created in each test. Update the
affected functions such as test_sync_clones_installs_and_links_the_stack,
test_sync_refuses_dirty_repo_without_force_stash,
test_sync_refuses_non_main_repo, and
test_sync_force_stash_allows_dirty_main_repo so tmp is always removed even on
failure, without changing the test assertions or flow.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c1839599-f986-401d-946c-3a06379e8901

📥 Commits

Reviewing files that changed from the base of the PR and between 69a8793 and ef9e57a.

📒 Files selected for processing (8)
  • README.md
  • bin/agent-stack
  • bin/agent-stack-test.bash
  • bin/install-agent-workflows
  • bin/install-agent-workflows-test.bash
  • bin/validate
  • docs/installation-and-upgrades.md
  • docs/superpowers/plans/2026-07-08-agent-stack-sync.md

Comment thread bin/agent-stack-test.bash Outdated
Comment thread bin/agent-stack-test.bash Outdated
Comment thread docs/superpowers/plans/2026-07-08-agent-stack-sync.md Outdated
Comment thread README.md Outdated
@claude

claude Bot commented Jul 8, 2026

Copy link
Copy Markdown

Review: Add agent stack sync helper

Overview: adds bin/agent-stack sync, a bash tool that clones/fast-forwards a trio of repos (agent-workflows, agent-coordination, agent-coordination-dashboard) into ~/src, symlinks compat paths under ~/codex/agent-repos, sets up a ~/.agent-workflows runtime dir, and chains into the existing installer/agent-coord bootstrap. Well-tested happy path and a few refusal cases (dirty tree, non-main branch).

Main concern: portability

agent-workflows describes itself as a generic, portable pack for many ShakaCode repos (see downstream.yml: react_on_rails_rsc, shakapacker, etc.), and AGENTS.md's Editing Rules say not to hardcode consumer-repo specifics into shared process. bin/agent-stack, however, is wired specifically to ShakaCode's own agent-coordination/agent-coordination-dashboard repos (hardcoded org/repo URLs in repo_url() and origin_allowed()), and it's added to the bin_helpers list in bin/install-agent-workflows — meaning it now gets installed into every consumer repo's agent home, including ones (react_on_rails_rsc, shakapacker, …) that have nothing to do with this specific 3-repo stack. The README/install docs additionally now lead with agent-stack sync as the primary Quick Start for all adopters. Left inline comments with specifics.

Other findings

  • origin_allowed() in bin/agent-stack has a logic gap: its hardcoded shakacode-URL fallback list bypasses the configured/overridden URL check unconditionally, so an env-var override (e.g., pointing at a fork) won't actually be enforced against a pre-existing checkout whose origin is still the canonical URL — see inline comment.
  • docs/superpowers/plans/2026-07-08-agent-stack-sync.md reads like an internal planning artifact (hardcoded /Users/justin/... paths, references to personal machines "M5"/"M1") that looks like it was committed by accident — there's no prior convention for a docs/superpowers/plans/ directory in this repo.
  • No CHANGELOG.md entry under [Unreleased], even though comparable helper additions (e.g. agent-workflows-trust-audit) are logged there per this repo's convention.
  • Test coverage gap: bin/agent-stack-test.bash doesn't exercise the origin_allowed mismatch-refusal path or the --replace-compat archive-of-existing-non-symlink path, despite both being safety-relevant branches.

Nits

  • install_agent_coord() unconditionally does rm -f "$agent_coord_install_dir/agent_coord" after bootstrap — fine as a "remove legacy alias" step, but it'll silently delete any unrelated file that happens to sit at that exact path.

Comment thread bin/install-agent-workflows Outdated
Comment thread README.md Outdated
Comment thread bin/agent-stack
Comment thread docs/superpowers/plans/2026-07-08-agent-stack-sync.md Outdated
@justin808

Copy link
Copy Markdown
Member Author

Address-review summary

Scan scope: full PR history.

Mattered

  • Fixed source-root/link safety: agent-stack now canonicalizes source, compatibility, and runtime roots before clone/link work, with regression coverage for symlinked source roots.
  • Fixed URL override safety: existing checkouts must match configured AGENT_STACK_*_URL overrides instead of silently accepting canonical ShakaCode origins.
  • Fixed generic installer scope: install-agent-workflows no longer installs stack-specific agent-stack; bin/agent-stack sync self-installs the short command for stack users.
  • Fixed README/install docs: default quick start is generic again, with full-stack sync documented as an optional ShakaCode contributor/operator workflow.
  • Removed the accidental internal planning artifact from public docs.

Optional

  • Added temp cleanup and mktemp use in the stack integration tests.
  • Isolated failure-path tests with explicit runtime roots.
  • Added coverage that --no-install does not create the default install directory.

Skipped

  • None.

Next default scan starts after this comment. Say check all reviews to rescan the full PR.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 862825123e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread bin/agent-stack Outdated
Comment thread bin/agent-stack Outdated
Comment thread bin/agent-stack Outdated
Comment thread bin/agent-stack Outdated
Comment thread bin/agent-stack
@claude

claude Bot commented Jul 8, 2026

Copy link
Copy Markdown

Review

Overview

Adds bin/agent-stack sync, a bootstrap/update helper that clones agent-workflows, agent-coordination, and agent-coordination-dashboard into ~/src, sets up a private, permission-locked runtime dir at ~/.agent-workflows, symlinks legacy ~/codex/agent-repos compatibility paths, and installs the shorter agent-stack command plus downstream tool installers (agent-coord, install-agent-workflows). Ships a thorough bash bin/agent-stack-test.bash suite wired into bin/validate, plus README/docs updates and regression assertions in install-agent-workflows-test.bash confirming the generic installer does not bundle this stack-specific helper.

Code quality

  • Script is disciplined for a bash tool: set -euo pipefail, consistent quoting, clear usage(), argument validation before any mutation, and defense-in-depth checks (git-origin allowlist, refuse-if-dirty, refuse-if-not-main, refuse-to-clobber-non-git-paths) before touching the filesystem.
  • prepare_runtime_root correctly uses install -m 0600 /dev/null … to avoid a permissions race when creating the env file, and chmods the runtime dir tree to 700.
  • Test coverage is good: clean sync, dirty-refusal, non-main-refusal, origin-mismatch-refusal, symlink-to-physical-root resolution, --no-install not creating default dirs, and --force-stash.

Issues found (posted inline)

  1. Correctness bugbin/agent-stack:238: fresh clones don't pin --branch main, but the next check (250-254) requires the checkout to already be on main. Any clone of a repo whose remote default branch isn't main (a realistic case given the supported AGENT_STACK_*_URL override mechanism) will fail immediately on first sync.
  2. Inconsistent safety gatebin/agent-stack:283-284: an existing symlink at a compat path is silently removed with no backup, while an existing regular file/dir at the same path is correctly gated behind --replace-compat and archived. Worth aligning the two paths.
  3. Minor/low-severitybin/agent-stack:158: the env file permission fixup follows symlinks (chmod behavior), inconsistent with the sibling -f check's "refuse non-file" intent. Narrow local-attacker scenario, low impact (chmod 600 isn't a dangerous target permission), but worth a passing thought.

Portability note (non-blocking)

Per AGENTS.md, the hard portability rule ("don't hardcode consumer repo commands/paths") is scoped to skills/ and workflows/, which this PR doesn't touch — bin/ is explicitly allowed to hold repo-wide, less-generic helpers. That said, bin/agent-stack hardcodes ShakaCode-specific repo names/URLs and legacy Codex compat paths into a repo whose stated purpose is a "portable" pack. The PR description's own Codex Decision Log already flags this trade-off as a conscious, non-blocking choice, so I'm not treating it as a defect — just flagging it in case the team wants this helper to live somewhere even more clearly "ShakaCode-internal" down the line.

Security

No injection or unsafe-eval concerns; all path/URL handling is properly quoted and argument-based (no eval, no unquoted expansions). The git-origin allowlist and dirty/branch refusals are a sensible safety net for a script that runs git pull --ff-only on user checkouts. The two low-severity symlink-following notes above are the only nits.

Nice addition overall — solid safety posture for a script that mutates a developer's local checkouts.

@justin808

Copy link
Copy Markdown
Member Author

Address-review summary

Scan scope: since previous summary at 2026-07-08T04:30:09Z.

Mattered

  • Fixed helper self-refresh: installed agent-stack sync now copies the helper from the synced agent-workflows checkout.
  • Fixed Git worktree support: existing source paths are validated with Git instead of requiring .git to be a directory.
  • Fixed fresh clone branch selection: clones pin main even when a remote override has a different default HEAD.
  • Fixed compatibility symlink safety: mismatched symlinks now require --replace-compat and are archived before replacement.
  • Fixed runtime env safety: symlinked ~/.agent-workflows/env files are refused before chmod handling.

Optional

  • Added regression tests for each edge case above.

Skipped

  • None.

Next default scan starts after this comment. Say check all reviews to rescan the full PR.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ac79520a07

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread bin/agent-stack
Comment thread bin/agent-stack Outdated
Comment thread bin/agent-stack
Comment thread bin/agent-stack
@claude

claude Bot commented Jul 8, 2026

Copy link
Copy Markdown

Review Summary

Reviewed the agent-stack sync helper (new bin/agent-stack, bin/agent-stack-test.bash) plus the small bin/install-agent-workflows-test.bash, bin/validate, README, and docs changes.

Overall: solid, defensively-written bash — good use of set -euo pipefail, explicit refusals on dirty worktrees / non-main branches / origin mismatches / symlinked env files, and thorough test coverage (11 scenario tests) including edge cases like worktree checkouts and physical-path resolution through a symlinked source root. The change correctly avoids leaking this ShakaCode-specific tool into the generic install-agent-workflows output (new assertions verify agent-stack is never installed/symlinked by the portable installer path).

Left 3 inline comments:

  1. bin/agent-stack:337rm -f "$agent_coord_install_dir/agent_coord" runs unconditionally after every bootstrap, on the assumption that agent-coordination's bootstrap script always creates that legacy alias. That assumption lives in a separate repo this codebase doesn't control; a pre-existing unrelated file with that exact name would be silently deleted.
  2. bin/agent-stack:311-327 — the documented update flow (agent-stack sync re-run from the installed copy) has install_agent_stack() overwrite the very script that's currently executing. Worth confirming install(1)'s replace semantics are safe across platforms (GNU vs BSD/macOS), since the existing same-path guard doesn't cover this case.
  3. bin/agent-stack:1-16 (non-blocking) — the script hardcodes ShakaCode's specific downstream repos/URLs in the repo-root bin/, which is otherwise meant to hold portable, org-agnostic helpers per AGENTS.md. It's correctly excluded from the generic installer output, so no functional portability issue, but a short callout that this is ShakaCode-internal tooling could avoid confusion for anyone using this repo as a generic template.

No issues found in skills/ or workflows/ — this PR doesn't touch either directory, so the portable-skill hardcoding rule in AGENTS.md doesn't directly apply here. No Ruby files changed in this PR.

@justin808

Copy link
Copy Markdown
Member Author

Address-review summary

Scan scope: since previous summary at 2026-07-08T04:41:12Z.

Mattered

  • Fixed source/compat overlap safety: agent-stack now refuses compatibility paths that overlap the source checkout before any archive/removal path can move a real checkout aside.

Optional

  • Added regression coverage for --compat-root == --source-root with --replace-compat.

Skipped

  • None.

Next default scan starts after this comment. Say check all reviews to rescan the full PR.

@justin808

Copy link
Copy Markdown
Member Author

Address-review summary

Scan scope: since previous summary at 2026-07-08T04:50:17Z.

Mattered

  • Fixed legacy-alias safety: agent-stack now preserves a pre-existing agent_coord file and only removes the compatibility alias when it appears after bootstrap and did not exist before.
  • Fixed self-update safety: installed agent-stack refreshes through a temp file plus rename instead of direct-installing over the running script.
  • Clarified scope: docs/help now call out agent-stack as ShakaCode-specific stack tooling, not part of the generic workflow-pack install path.

Optional

  • Added regression tests for pre-existing agent_coord preservation and installed-helper self-update.

Skipped

  • None.

Next default scan starts after this comment. Say check all reviews to rescan the full PR.

Comment thread bin/agent-stack Outdated
Comment thread bin/agent-stack
Comment thread docs/installation-and-upgrades.md
@claude

claude Bot commented Jul 8, 2026

Copy link
Copy Markdown

Review Summary

This PR adds bin/agent-stack sync, a bootstrap/update helper for the ShakaCode multi-repo dev stack (agent-workflows, agent-coordination, agent-coordination-dashboard), plus docs and 14 new test cases.

Overall: well-scoped and unusually well-tested for a bash script. No blocking issues found.

Code quality / correctness

  • bin/agent-stack is careful throughout: it refuses to touch dirty worktrees (unless --force-stash), refuses non-main branches, refuses origin-URL mismatches (origin_allowed), refuses symlink/non-regular-file tricks on the runtime env file, and refuses compat-symlink paths that overlap the source root. All of these guardrails have dedicated tests (bin/agent-stack-test.bash), including a nice one that verifies the running agent-stack binary can safely update itself via a mktemp + mv -f (atomic rename) rather than overwriting the file in place.
  • Argument parsing, quoting, and set -euo pipefail usage look correct; no unquoted expansions or eval that I could find.
  • One minor robustness gap left as an inline comment: sync_repo calls git remote get-url origin without guarding for a missing origin remote, which would abort with a raw git error instead of the script's usual Refusing ... messaging.

Security

  • prepare_runtime_root chmods the runtime dir/subdirs 700 and the env file 600, and explicitly refuses if env is a symlink or non-regular file — good defensive handling for a file meant to hold private config/secrets.
  • origin_allowed pins non-overridden repos to a hardcoded allowlist of known shakacode/* GitHub URLs (https/https.git/ssh), so an existing checkout can't be silently synced from a hostile remote. Env var overrides (AGENT_STACK_*_URL) bypass the allowlist by design, for testing/forking — reasonable tradeoff.
  • The tool does execute code from freshly-cloned agent-workflows/agent-coordination repos (install-agent-workflows, agent-coord bootstrap) — inherent to what a stack bootstrapper does, and mitigated by the origin pinning above.

Portability (skills/workflows genericism)

  • This PR doesn't touch skills/ or workflows/, so the AGENTS.md rule against hardcoding consumer-repo values in shared skills doesn't directly apply here.
  • Worth flagging anyway: bin/agent-stack hardcodes ShakaCode-specific repo names/org URLs in bin/, which AGENTS.md otherwise reserves for generic "repo-wide" helpers (like agent-workflow-seam-doctor). The PR is self-aware about this — it's explicitly documented as "ShakaCode-specific stack tooling, not part of the generic workflow-pack install path," and install-agent-workflows-test.bash gained assertions confirming the generic installer does not bundle agent-stack. This looks like a deliberate, already-discussed scope decision (per the PR's own "Codex Decision Log") rather than an oversight.

Docs

  • README.md and docs/installation-and-upgrades.md both gained near-identical "sync the stack" blurbs (left an inline note) — minor duplication/drift risk, not a blocker.

Tests

  • bin/agent-stack-test.bash covers clone/install/link happy path, preserving a pre-existing agent_coord alias, atomic self-update, dirty-repo refusal, non-main-branch refusal, git-worktree checkouts, remote HEAD-vs-main mismatch, URL-override mismatch, mismatched compat symlink refusal, overlapping source/compat roots, symlinked source root resolution, runtime env symlink refusal, --no-install not creating default dirs, and --force-stash. This is thorough coverage for a new bash tool.
  • bin/validate was updated to run the new test file, and install-agent-workflows-test.bash got assertions ensuring agent-stack isn't installed by the generic host installer.

No shell/Ruby helper safety issues found beyond the one minor note above.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ebcbaeabe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread bin/agent-stack

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6d01caddbf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread bin/agent-stack
Comment thread bin/agent-stack
Comment thread bin/agent-stack Outdated
Comment thread bin/agent-stack
@claude

claude Bot commented Jul 8, 2026

Copy link
Copy Markdown

Review: Add agent stack sync helper

Overview

Adds bin/agent-stack sync, a ShakaCode-specific bootstrap/update helper that clones/updates agent-workflows, agent-coordination, and agent-coordination-dashboard into ~/src, links ~/codex/agent-repos/* compatibility symlinks, sets up a private ~/.agent-workflows runtime root, and installs the workflow/coordination CLIs. Includes a thorough new test suite (bin/agent-stack-test.bash), wiring into bin/validate, README/doc updates, and assertions that the generic install-agent-workflows path does not install agent-stack for consumer repos.

Strengths

  • Careful guardrails in sync_repo: refuses dirty worktrees (unless --force-stash), refuses non-main branches, refuses missing/mismatched origin remotes (allow-listed URL forms plus explicit override checks), and clones --branch main explicitly regardless of the remote's default HEAD.
  • Symlink/overlap safety: rejects a compatibility root nested inside a source checkout (checked both before and after resolving symlinks), rejects a compatibility path that would overlap the source checkout, and refuses to blindly overwrite an existing/mismatched compatibility symlink without --replace-compat (archiving the old one instead of deleting it).
  • install_agent_stack self-updates atomically via mktemp + install + mv -f in the same directory, so it can safely overwrite the very binary that is currently executing (covered by test_sync_updates_running_installed_agent_stack_via_temp_file).
  • runtime_root/env is protected against being a symlink or non-regular file, and permissions are locked to 700/600.
  • Good test coverage for the guardrails above, plus --no-install not creating default install dirs, worktree checkouts, stashing, etc.
  • Consistent quoting throughout; no shell-injection or word-splitting issues found on manual review.

Portability (per AGENTS.md editing rules)

This PR does not touch skills/ or workflows/, so it does not violate the letter of "do not hardcode consumer repo commands/paths in shared skills." But bin/agent-stack does hardcode ShakaCode-org-specific GitHub URLs, repo names (agent-coordination, agent-coordination-dashboard), and default paths (~/codex/agent-repos) directly in this shared source pack's bin/ directory, which is the same class of thing that rule is meant to keep out of the portable pack. The PR is careful about the boundary (README/docs explicitly call it "ShakaCode-specific stack tooling, not part of the generic workflow-pack install path," and install-agent-workflows-test.bash now asserts agent-stack is never installed into a consumer target), so this looks like a deliberate, documented, and tested exception rather than an oversight. Flagging for maintainers to confirm this is the intended shape (vs., e.g., living in a separate private/internal repo) rather than as a defect.

Other notes (posted inline)

  • --force-stash stashes dirty changes but never restores them (bin/agent-stack:308-311) - worth documenting explicitly or restoring after a successful pull.
  • Minor permission-window nit in prepare_runtime_root (bin/agent-stack:194-195).
  • Minor docs gap: AGENT_STACK_SOURCE_ROOT/COMPAT_ROOT/RUNTIME_ROOT env overrides are not listed in usage() (bin/agent-stack:52-54).

No blocking correctness or security issues found otherwise.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 09ed4c8a6d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread bin/agent-stack Outdated
@claude

claude Bot commented Jul 8, 2026

Copy link
Copy Markdown

Review: Add agent stack sync helper

Overview: Adds bin/agent-stack sync, a ShakaCode-specific helper that clones/updates the agent-workflows / agent-coordination / agent-coordination-dashboard trio into ~/src, maintains ~/codex/agent-repos compatibility symlinks, sets up a locked-down ~/.agent-workflows runtime dir, and installs the helper binaries. Docs and README are updated, and a 634-line test suite (bin/agent-stack-test.bash) covers cloning, dirty-tree refusal, non-main refusal, origin mismatch refusal, worktree checkouts, compat-symlink safety, and self-update.

Portability (AGENTS.md "Editing Rules"): No violation found. The diff only touches README.md, bin/agent-stack, bin/agent-stack-test.bash, bin/install-agent-workflows-test.bash, bin/validate, and docs/installation-and-upgrades.md — it does not touch skills/ or workflows/. agent-stack is intentionally excluded from the generic installer's bin_helpers allowlist (bin/install-agent-workflows:33), and this exclusion is explicitly regression-tested in all three install modes (copy/symlink/Claude host) in bin/install-agent-workflows-test.bash. Good separation between the generic workflow-pack surface and ShakaCode-specific stack tooling.

Strengths:

  • Careful defense-in-depth: refuses to sync dirty worktrees, non-main branches, missing/mismatched origin remotes, symlinked or non-regular runtime env files, and overlapping source/compat roots — each with a dedicated regression test.
  • Self-update path (install_agent_stack) uses mktemp + install + mv -f into place rather than truncating in place, which is the right approach for a binary that may be overwriting its own running copy (test_sync_updates_running_installed_agent_stack_via_temp_file specifically guards against a regression here).
  • origin_allowed correctly refuses fallback to the public allow-list once a URL override env var is set, so a deliberate override can't silently be satisfied by an unrelated fork.

Possible issues (see inline comments):

  • Minor symlink-following inconsistency: the env file gets explicit -L symlink rejection before use, but the sibling cache/logs/state directories don't get the same treatment, so a pre-existing symlink there would cause chmod 700 to silently re-permission whatever it points at.
  • fetch --prune followed immediately by pull --ff-only performs two round trips to the remote where one would do.

Nothing else stood out as a correctness, security, or performance concern — this is a well-tested, conservatively-designed addition.

Comment thread bin/agent-stack
Comment thread bin/agent-stack Outdated
Comment thread bin/agent-stack
Comment thread bin/agent-stack
Comment thread bin/agent-stack
@claude

claude Bot commented Jul 8, 2026

Copy link
Copy Markdown

Review Summary

What this PR does: Adds bin/agent-stack sync, a ShakaCode-specific helper that clones/updates agent-workflows, agent-coordination, and agent-coordination-dashboard into ~/src, creates ~/codex/agent-repos compatibility symlinks, sets up a private ~/.agent-workflows runtime root, and installs the workflow-pack + agent-coord + agent-stack itself. Ships with an extensive 691-line test suite (bin/agent-stack-test.bash), a bin/validate hook, and doc updates.

Portability (AGENTS.md Editing Rules)

No changes touch skills/ or workflows/, so the "keep shared skills/workflows generic" rule doesn't directly apply here. bin/agent-stack does hardcode ShakaCode's own repo names/URLs and default paths, but that's explicit by design — the script, README, and docs all clearly label it "ShakaCode stack tooling, not the generic workflow-pack installer," and bin/install-agent-workflows-test.bash gained three new assertions confirming the generic installer never ships agent-stack into a consumer target. This looks correctly scoped.

Code quality / security (shell safety in bin/)

Overall the script is well-structured and unusually defensive for a bash tool: origin-URL allowlisting before syncing, repeated overlap checks between source_root/compat_root (re-validated after each symlink-resolution step), symlink/non-directory rejection for the runtime dir, umask 077 + explicit chmod 700/600 for runtime state, atomic temp-file-then-mv install of a binary that may be actively running, and a dedicated regression test for that last case. Syntax-checked clean (bash -n).

Left 3 inline suggestions, all low/defense-in-depth (none blocking):

  1. git clone --branch main "$url" "$path" (line 325) doesn't use -- before positional args, so an env-var-overridden URL starting with - could be parsed as a git option (classic clone argument-injection pattern). Low exploitability since the env var is set by the same local user, but worth hardening given how careful the rest of the script is.
  2. The "is this an existing checkout" check (line 326) uses --is-inside-work-tree, which passes for any directory nested inside a larger repo, not just a repo root — --show-toplevel would be a tighter check.
  3. runtime_root isn't cross-validated against source_root/compat_root the way those two are validated against each other, so --runtime-root ~/src would silently scatter chmod'd cache/logs/state/env into the source tree.

Other observations

  • No Ruby helpers touched in this diff.
  • Test coverage is thorough — dirty-worktree refusal, non-main-branch refusal, missing-origin refusal, worktree-checkout support, mismatched compat symlink refusal, root-overlap refusal (including a ..-normalization case), and the "update a running agent-stack binary" case are all covered.
  • Docs (README.md, docs/installation-and-upgrades.md) are consistent with each other and the anchor link (#full-stack-contributor-setup) matches the new heading.

@justin808

Copy link
Copy Markdown
Member Author

Address-review summary

Scan scope: review activity since previous summary at 2026-07-08T04:57:45Z.

Mattered

  • Addressed missing-origin handling: existing checkouts without an origin remote now fail with a friendly refusal and regression coverage.
  • Addressed nested compatibility-root safety: compatibility roots inside source checkouts, reverse source-under-alias layouts, and dot-dot path variants are rejected before creating managed checkout paths.
  • Addressed documentation duplication: README now links to the install guide as the canonical full-stack setup doc.
  • Addressed runtime hardening: private runtime dirs are created under restrictive permissions and runtime subdirectory symlinks are refused.

Optional

  • Fixed inline: clarified one-way --force-stash help text, documented path env overrides, and collapsed sync update to one git pull --ff-only --prune round trip.
  • Auto-deferred: final low/minor hardening nits around env URL delimiter, explicit repo-root assertion, and runtime/source/compat overlap were replied to with [auto-deferred] rationale and resolved to avoid restarting the review loop after all gates passed.

Skipped

  • None.

Validation: local bin/validate passed after each code batch; hosted validate, claude-review, and CodeRabbit pass on 0dc958075c7e7f61a28ac6ac14e232196d3cb860.

Next default scan starts after this comment. Say check all reviews to rescan the full PR.

@justin808
justin808 merged commit a4bd6fc into main Jul 8, 2026
21 checks passed
@justin808
justin808 deleted the jg-codex/agent-stack-sync branch July 8, 2026 05:41

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0dc958075c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread bin/agent-stack
compat_root="$(physical_dir "$compat_root")"
reject_compat_root_inside_source_checkout "$compat_root"
reject_source_root_inside_compat_alias "$source_root"
runtime_root="$(physical_dir "$runtime_root")"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject runtime roots inside managed checkouts

When --runtime-root is placed under a managed checkout, e.g. --source-root /tmp/src --runtime-root /tmp/src/agent-workflows/.agent-workflows, this pre-sync canonicalization calls mkdir -p and creates /tmp/src/agent-workflows before sync_repo runs, so the later clone is refused as a non-git path and the blocking directory is left behind. Normalize without creating and reject runtime roots inside managed checkout paths, or defer creating the runtime root until after checkout validation.

Useful? React with 👍 / 👎.

Comment thread bin/agent-stack
had_legacy_alias=true
fi

"$repo/bin/agent-coord" bootstrap --install-dir "$agent_coord_install_dir"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Protect existing agent_coord before bootstrap

When a user already has $agent_coord_install_dir/agent_coord, had_legacy_alias only prevents the post-bootstrap cleanup; it does not protect the file while agent-coord bootstrap runs. If bootstrap writes its legacy alias (the behavior expected by this cleanup and modeled in bin/agent-stack-test.bash), the custom command is overwritten and then kept, so the preexisting alias is not actually preserved. Move/restore the file around bootstrap or make bootstrap skip the alias when it already exists.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant