Conversation
…age skills into optional plugins - Add 4 new language skills (go, python, java, rust) in shared/skills/ with SKILL.md + references/ (violations, patterns, detection, language deep-dive) - Create 8 optional plugin directories (devflow-typescript, devflow-react, devflow-accessibility, devflow-frontend-design, devflow-go, devflow-python, devflow-java, devflow-rust) — each with plugin.json referencing its skill - Move typescript, react, accessibility, frontend-design out of core-skills, implement, and code-review plugins into their own optional plugins - Register all 8 optional plugins in plugins.ts with optional: true - Update reviewer agent: add go/java/python/rust to Focus Areas table and conditional activation entries - Update coder agent: add 4 new languages to frontmatter skills and DOMAIN hints - Update code-review commands (both variants): add go/python/java/rust to conditional activation table, add skill availability check instruction so orchestrator verifies skill exists before spawning language reviewers - Update ambient-router SKILL.md and skill-catalog.md with new languages - Update marketplace.json with 8 new plugin entries - Update skills-architecture.md with Tier 3 entries and glob patterns - Update tests: fix accessibility mapping assertion (now in devflow-accessibility) - Update CLAUDE.md (30 skills, 17 plugins) and README.md (language plugins section) Totals: 30 skills (was 26), 17 plugins (was 9), 9 optional (was 1) All 174 tests pass, build verified.
| @@ -2,7 +2,7 @@ | |||
| name: Coder | |||
| description: Autonomous task implementation on feature branch. Implements, tests, and commits. | |||
| model: inherit | |||
There was a problem hiding this comment.
BLOCKING: Coder agent frontmatter lists 8 optional skills as hard dependencies
The skills: frontmatter now declares go, python, java, rust (plus 4 pre-existing: typescript, react, accessibility, frontend-design) as required. These are now in optional plugins that may not be installed. While the agent body has conditional loading logic, the frontmatter contradicts this by unconditionally listing all 14 skills.
Impact: When users install devflow-implement without the language plugins, the agent will reference non-existent skill files.
Fix: Remove optional language skills from frontmatter. Let the body's domain-loading logic handle dynamic skill loading:
- skills: core-patterns, git-safety, implementation-patterns, git-workflow, typescript, react, test-patterns, input-validation, accessibility, frontend-design, go, python, java, rust
+ skills: core-patterns, git-safety, implementation-patterns, git-workflow, test-patterns, input-validationThe existing body text at line 41 ('For non-TypeScript backends: load the corresponding language skill') already handles this correctly.
|
|
||
| func (c *Client) connection() (*grpc.ClientConn, error) { | ||
| c.once.Do(func() { | ||
| c.conn, c.err = grpc.Dial("localhost:50051", grpc.WithInsecure()) |
There was a problem hiding this comment.
BLOCKING: Example uses deprecated grpc.WithInsecure() pattern
This example teaches an insecure pattern using deprecated APIs (deprecated since gRPC-Go v1.53+). Using grpc.WithInsecure() normalizes unencrypted transport in reference code that developers copy.
Fix: Use modern gRPC API with explicit comment about TLS:
func (c *Client) connection() (*grpc.ClientConn, error) {
c.once.Do(func() {
// For production: use credentials.NewTLS(&tls.Config{})
c.conn, c.err = grpc.NewClient("localhost:50051",
grpc.WithTransportCredentials(insecure.NewCredentials()), // local dev only
)
})
return c.conn, c.err
}
| ```python | ||
| from typing import AsyncGenerator | ||
|
|
||
| async def stream_results(query: str) -> AsyncGenerator[Record, None]: |
There was a problem hiding this comment.
BLOCKING: Example shows SQL injection pattern (raw string queries)
The stream_results function accepts raw SQL strings and passes them directly to conn.execute(query). While the usage example is hardcoded, the function signature invites SQL interpolation. The example should demonstrate parameterized queries.
Fix: Show parameterized query pattern:
async def stream_results(
query: str, params: tuple[Any, ...] = ()
) -> AsyncGenerator[Record, None]:
async with get_connection() as conn:
cursor = await conn.execute(query, params)
async for row in cursor:
yield Record.from_row(row)
# Usage
async for record in stream_results(
"SELECT * FROM events WHERE status = ?", ("active",)
):
await process(record)
PR #76 Review SummaryBlocking Issues (3 inline comments + 1 summary)
Additional Blocking Issues (Not Inline Commentable)
High-Priority Should-Fix Issues
Review Summary Statistics
Claude Code Review Attribution: Generated by multi-perspective code review system. |
- Remove Go test file exclusion from skill activation - Fix deprecated grpc.WithInsecure() → WithTransportCredentials - Fix deprecated datetime.utcnow → datetime.now(timezone.utc) - Fix SQL injection in Python async streaming example - Fix deprecated React Context.Provider → Context (React 19) - Fix deprecated useRef<T>() → useRef<T | undefined>(undefined) - Replace non-portable NodeJS.Timeout with ReturnType<typeof setTimeout> - Replace unsafe Function type with typed function signature - Coder agent: remove optional skills from frontmatter, add dynamic loading - Alphabetize language ordering (go, java, python, rust) across all files - Fix code-review count text to be dynamic - Add tests for optional: true flag on language plugins - Add CHANGELOG [Unreleased] section for polyglot-skills feature
1 participant
Summary
devflow initBefore → After
Key Design Decisions
devflow initmultiselect or--plugin=go,python~/.claude/skills/{focus}/SKILL.mdexists before spawning a conditional language reviewer; skips if not installedoptional: truehandling in init.ts already supports this; optional plugins appear unchecked by defaultTest plan
npm run buildpasses — 30 skills, 17 plugins distributed correctlynpm testpasses — 174/174 tests (updated accessibility mapping assertion)devflow initshows 8 language plugins as unchecked optional choicesdevflow init --plugin=goinstalls only go skill + core-skills/code-reviewon a Go project with devflow-go installed spawns Go reviewer