Install superpowers and use its review skill

.gitea/workflows/check.yml

@@ -14,8 +14,4 @@ jobs:
 
       - uses: denoland/setup-deno@v2
 
-      - run: >-
-          deno fmt --check . &&
-          deno lint . &&
-          deno check run.ts &&
-          deno test
+      - run: deno fmt --check . && deno lint . && deno check run.ts

action.yml

@@ -20,20 +20,10 @@ inputs:
   bot-token:
     description: API key or token for the selected bot
     required: false
-  model:
-    description: >-
-      Model for the selected bot. Defaults to `claude-sonnet-5` or
-      `gpt-5.6-terra`, the mid tiers, which cover reviews and fixes.
-    required: false
 
 runs:
   using: composite
   steps:
-    # The agent works on the event's commit with full history, as the author.
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-        token: ${{ inputs.author-token }}
     # This step assumes this is `node:24-bookworm` container.
     - name: Install dependencies
       shell: bash
@@ -45,7 +35,6 @@ runs:
         ACTION_PATH: ${{ gitea.action_path }}
         BOT_TYPE: ${{ inputs.bot-type }}
         BOT_TOKEN: ${{ inputs.bot-token }}
-        MODEL: ${{ inputs.model }}
         GITEA_API_URL: ${{ gitea.api_url }}
         GITEA_REPOSITORY: ${{ gitea.repository }}
         GITEA_TOKEN: ${{ inputs.author-token }}

auth.ts

@@ -1,12 +0,0 @@
-export async function retryInvalidToken<
-  T extends { status: { success: boolean }; error: string },
->(attempt: () => Promise<T>, relogin: () => Promise<void>): Promise<T> {
-  let result = await attempt();
-  if (
-    !result.status.success && result.error.includes("invalid_refresh_token")
-  ) {
-    await relogin();
-    result = await attempt();
-  }
-  return result;
-}

auth_test.ts

@@ -1,44 +0,0 @@
-import { assertEquals } from "jsr:@std/assert@1";
-import { retryInvalidToken } from "./auth.ts";
-
-Deno.test("retries once after an invalid refresh token", async () => {
-  let attempts = 0;
-  let relogins = 0;
-  const result = await retryInvalidToken(
-    () =>
-      Promise.resolve({
-        status: { success: false },
-        error: attempts++ === 0 ? "invalid_refresh_token" : "still failed",
-      }),
-    () => {
-      relogins++;
-      return Promise.resolve();
-    },
-  );
-
-  assertEquals({ attempts, relogins, error: result.error }, {
-    attempts: 2,
-    relogins: 1,
-    error: "still failed",
-  });
-});
-
-Deno.test("does not retry an unrelated failure", async () => {
-  let attempts = 0;
-  let relogins = 0;
-  await retryInvalidToken(
-    () => {
-      attempts++;
-      return Promise.resolve({
-        status: { success: false },
-        error: "rate limited",
-      });
-    },
-    () => {
-      relogins++;
-      return Promise.resolve();
-    },
-  );
-
-  assertEquals({ attempts, relogins }, { attempts: 1, relogins: 0 });
-});

prompt.md

@@ -13,56 +13,17 @@ response ends, so background monitors, scheduled wake-ups, and queued tasks
 never resume. Never promise future action and never claim to be waiting on a
 notification.
 
-The repository is checked out in the working directory at the event's commit,
-the head of the pull request when there is one, with full history and the
-author's push credentials. Read the code there, run its checks and tests when
-they bear on the task, and push from there.
-
-For a `pull_request` event, and for a comment on a pull request that asks you to
-review it, invoke the installed `superpowers:requesting-code-review` skill
-before inspecting the PR. You are the reviewer that has already been dispatched,
-so run the skill's code reviewer template yourself instead of dispatching
-another reviewer. Use the pull request and triggering instruction as its
-description and requirements, and review the exact base and head SHAs without
-changing code. Run the project's required checks on the head and treat a real
-failure as at least Important. The bot automation workflow itself is not a
-project check: ignore its skipped or canceled duplicate/automatic runs, and
-never reject a PR because the current review run is unfinished. Only a failed
-required check for the reviewed head blocks approval. Check the whole repository
-against the code rules at the end of this prompt, not only the diff; a violation
-is at least Important even when the diff did not cause it. Write the complete
-review, and nothing else, to the file `${REVIEW_PATH}`: it is posted verbatim as
-a pull request review from the bot account, and your final response is not
-posted at all. The file's first line must be exactly the verdict and nothing
-else: `Approved` when the head is ready to merge, `Changes requested` otherwise.
-The mark in front of it is added when posting, so write the words alone; any
-other first line is posted as a plain comment, which wastes the run. Minor
-issues alone never block, and neither does a finding the author has answered in
-the comment history below as intended or a false alarm, once the code or docs
-make that clear. When the verdict is `Changes requested`, the second line names
-what must change in one line, addressed to the author; the author's own agent
-picks the fixes up, so never ask `@bot` to make them. For UI changes, check that
-the result is aligned, clean, and pixel-perfect, and that included screenshots
-prove the intended result was achieved.
-
-Every finding that belongs to one line of the diff goes on that line instead of
-into the body. Write those to `${ANCHORS_PATH}` as a JSON array, each entry
-`{"path": "<path from the repository root>", "line": <number>, "side": "new" |
-"old", "body": "<the finding>"}`.
-`side` is `new` for a line in the head file and `old` for one only in the base
-file; `line` is that file's own line number, and it must be a line the diff
-touches, or Gitea refuses the anchor. Write the file only when there is
-something to anchor, and keep each body to the what, the why, and the how, with
-no `file:line` prefix; the line carries that.
-
-The review body must read at a glance: everything outside `<details>` blocks
-totals under 512 bytes. Only core information stays visible: the verdict, the
-summary line, and the section headings. Anything verbose goes into a `<details>`
-block whose `<summary>` is a few words, such as the title of an issue with the
-what, why, and how inside; the same for each strength, each recommendation, the
-reasoning, and any compliance notes. A finding you anchored belongs there only
-as its title, since its detail is on the line. Details blocks are top-level,
-never inside a list item, because Gitea breaks them there.
+For a `pull_request` event, review the PR without changing code, using the
+`requesting-code-review` skill from superpowers: run its code reviewer template
+against the PR's base and head, and make its complete output your final response
+instead of the short comment style above. Check the whole repository against the
+code rules at the end of this prompt, not only the diff; a violation is at least
+Important even when the diff did not cause it. Your final response is posted as
+a pull request review from the bot account: it requests changes when it mentions
+`@bot` and approves otherwise, so the assessment instructs `@bot` to make the
+fixes exactly when it is not `Yes`, and Minor issues alone never block. For UI
+changes, check that the result is aligned, clean, and pixel-perfect, and that
+included screenshots prove the intended result was achieved.
 
 For an `issue_comment` or `pull_request_review_comment` event, treat the `body`
 in the triggering comment payload below as the user's exact instruction.

run.ts

@@ -3,12 +3,6 @@
 // GITEA_TOKEN; everything this script posts goes through the reviewer token,
 // so it appears as the bot account.
 import { TextLineStream } from "jsr:@std/streams@1/text-line-stream";
-import { retryInvalidToken } from "./auth.ts";
-import {
-  type BotType,
-  parseBotType,
-  superpowersInstallCommands,
-} from "./superpowers.ts";
 
 type GiteaUser = { login: string; email: string };
 type GiteaComment = { user: GiteaUser; created_at: string; body: string };
@@ -23,17 +17,9 @@ const API = env("GITEA_API_URL");
 const REPO = env("GITEA_REPOSITORY");
 const INDEX = env("ISSUE_INDEX");
 const EVENT = env("EVENT_NAME");
-const BOT = parseBotType(env("BOT_TYPE"));
 const AUTHOR_TOKEN = env("GITEA_TOKEN");
 const REVIEWER_TOKEN = env("REVIEWER_TOKEN");
 const RULES_PATH = "repos/commons/code-rules/raw/README.md";
-// The mid tiers: a run follows a fixed template and the project's checks.
-const DEFAULT_MODELS: Record<string, string> = {
-  claude: "claude-sonnet-5",
-  codex: "gpt-5.6-terra",
-};
-const model = (bot: string): string =>
-  Deno.env.get("MODEL") || DEFAULT_MODELS[bot];
 
 // The reviewer token is withheld so the agent cannot approve as the bot.
 const { REVIEWER_TOKEN: _, ...agentEnv } = Deno.env.toObject();
@@ -66,84 +52,19 @@ async function postComment(body: string): Promise<void> {
   });
 }
 
-// A review is posted whenever the agent wrote one, whether a review request or
-// a comment asked for it. It comes through a file, because a final chat message
-// picks up narration while a file's first line is written on purpose. That line
-// is the verdict, matched whole; anything unexpected only comments, never
-// approves. The mark in front is added here, so it is never part of the match.
-const REVIEW_DIR = await Deno.makeTempDir();
-const REVIEW_PATH = `${REVIEW_DIR}/review.md`;
-const VERDICTS: Record<string, [event: string, mark: string]> = {
-  Approved: ["APPROVED", "✅"],
-  "Changes requested": ["REQUEST_CHANGES", "🛑"],
-};
-
-// A finding about one line is posted on that line of the diff rather than as
-// `file:line` prose in the body. Those anchors come as JSON, so the file and
-// line are structured instead of parsed back out of English; a malformed entry
-// fails the run, because a silently dropped finding is worse than a red run.
-const ANCHORS_PATH = `${REVIEW_DIR}/anchors.json`;
-type Anchor = { path: string; line: number; side: "new" | "old"; body: string };
-
-function parseAnchors(text: string): Anchor[] {
-  const entries: unknown = JSON.parse(text);
-  if (!Array.isArray(entries)) throw new Error(`${ANCHORS_PATH}: not an array`);
-  return entries.map((entry: unknown, index) => {
-    const at = `${ANCHORS_PATH}[${index}]`;
-    if (typeof entry !== "object" || entry === null) {
-      throw new Error(`${at}: not an object`);
-    }
-    const { path, line, side = "new", body } = entry as Record<string, unknown>;
-    if (typeof path !== "string" || path === "") {
-      throw new Error(`${at}.path: expected a repository path`);
-    }
-    if (typeof line !== "number" || !Number.isInteger(line) || line < 1) {
-      throw new Error(`${at}.line: expected a line number`);
-    }
-    if (side !== "new" && side !== "old") {
-      throw new Error(`${at}.side: expected "new" or "old"`);
-    }
-    if (typeof body !== "string" || body.trim() === "") {
-      throw new Error(`${at}.body: expected the finding`);
-    }
-    return { path, line, side, body };
-  });
-}
-
-async function readAnchors(): Promise<Anchor[]> {
-  const written = await Deno.readTextFile(ANCHORS_PATH).catch(() => null);
-  return written === null ? [] : parseAnchors(written);
-}
-
+// A pull request event is a review request, so the response becomes a review:
+// changes are requested when the agent asked @bot to fix something, a failed
+// run only comments, and anything else approves.
 async function postResult(body: string): Promise<void> {
-  const review = await Deno.readTextFile(REVIEW_PATH).catch(() => null);
-  if (review === null) {
-    if (EVENT === "pull_request") {
-      throw new Error(`no review was written to ${REVIEW_PATH}`);
-    }
-    return postComment(body);
-  }
-  const [verdict, ...rest] = review.split("\n");
-  const [event, mark] = VERDICTS[verdict.trim()] ?? ["COMMENT", "💬"];
-  const post = (anchors: Anchor[]) =>
-    gitea(REVIEWER_TOKEN, `repos/${REPO}/pulls/${INDEX}/reviews`, {
-      body: stripAnsi([`${mark} ${verdict.trim()}`, ...rest].join("\n")),
-      event,
-      comments: anchors.map(({ path, line, side, body }) => ({
-        path,
+  if (EVENT !== "pull_request") return postComment(body);
+  const event = body.includes("@bot")
+    ? "REQUEST_CHANGES"
+    : body.startsWith("Bot failed:")
+    ? "COMMENT"
+    : "APPROVED";
+  await gitea(REVIEWER_TOKEN, `repos/${REPO}/pulls/${INDEX}/reviews`, {
     body: stripAnsi(body),
-        new_position: side === "new" ? line : 0,
-        old_position: side === "old" ? line : 0,
-      })),
-    });
-  const anchors = await readAnchors();
-  // Gitea rejects the whole review when an anchor names a line outside the
-  // diff, and a verdict that never lands blocks the pull request, so the body
-  // goes up alone rather than not at all.
-  await post(anchors).catch(async (error: Error) => {
-    if (anchors.length === 0) throw error;
-    console.error(`inline comments rejected: ${error.message}`);
-    await post([]);
+    event,
   });
 }
 
@@ -152,14 +73,6 @@ async function run(command: string, args: string[]): Promise<void> {
   if (!success) throw new Error(`${command} ${args[0]} exited with ${code}`);
 }
 
-// The reviewer uses Superpowers' requesting-code-review template. Both plugin
-// installers are idempotent on the persisted bot home.
-async function installSuperpowers(bot: BotType): Promise<void> {
-  for (const { command, args } of superpowersInstallCommands(bot)) {
-    await run(command, args);
-  }
-}
-
 // Commits belong to the same account as the pull request they end up in.
 async function configureGitAuthor(): Promise<void> {
   const user: GiteaUser = await (await gitea(AUTHOR_TOKEN, "user")).json();
@@ -168,6 +81,19 @@ async function configureGitAuthor(): Promise<void> {
   }
 }
 
+// The superpowers plugin gives the agent its skills, including the code review
+// one that the prompt asks for. Both installs are idempotent on the persisted
+// home.
+async function installSuperpowers(bot: string): Promise<void> {
+  const commands = bot === "claude"
+    ? [
+      ["plugin", "marketplace", "add", "obra/superpowers-marketplace"],
+      ["plugin", "install", "-y", "superpowers@superpowers-marketplace"],
+    ]
+    : [["plugin", "add", "superpowers@openai-curated-remote"]];
+  for (const args of commands) await run(bot, args);
+}
+
 async function renderPrompt(): Promise<string> {
   const comments: GiteaComment[] = await (await gitea(
     REVIEWER_TOKEN,
@@ -183,8 +109,6 @@ async function renderPrompt(): Promise<string> {
     GITEA_API_URL: API,
     GITEA_REPOSITORY: REPO,
     ISSUE_INDEX: INDEX,
-    REVIEW_PATH,
-    ANCHORS_PATH,
   };
   const template = await Deno.readTextFile(
     new URL("prompt.md", import.meta.url),
@@ -198,9 +122,10 @@ async function renderPrompt(): Promise<string> {
 async function runClaude(prompt: string): Promise<string> {
   const token = Deno.env.get("BOT_TOKEN");
   if (!token) {
-    throw new Error(
+    await postComment(
       "Run `claude setup-token` locally and set the `bot-token` action input.",
     );
+    Deno.exit(1);
   }
   await installSuperpowers("claude");
   const claude = new Deno.Command("claude", {
@@ -208,7 +133,7 @@ async function runClaude(prompt: string): Promise<string> {
       "--print",
       "--dangerously-skip-permissions",
       "--model",
-      model("claude"),
+      "claude-fable-5",
       "--output-format",
       "stream-json",
       "--verbose",
@@ -219,7 +144,7 @@ async function runClaude(prompt: string): Promise<string> {
     clearEnv: true,
     stdout: "piped",
   }).spawn();
-  let result: { result?: string; subtype: string } | undefined;
+  let result = "Bot failed: no result";
   // Print events as they stream so the runner does not kill the job as a zombie.
   const lines = claude.stdout
     .pipeThrough(new TextDecoderStream())
@@ -231,13 +156,12 @@ async function runClaude(prompt: string): Promise<string> {
       const text = part.thinking ?? part.text ?? part.name;
       if (text) console.log(text);
     }
-    if (event.type === "result") result = event;
+    if (event.type === "result") {
+      result = event.result ?? `Bot failed: ${event.subtype}`;
+    }
   }
   await claude.status;
-  if (result?.result === undefined) {
-    throw new Error(`claude ended with ${result?.subtype ?? "no result"}`);
-  }
-  return result.result;
+  return result;
 }
 
 // Posts the device code so a human can finish the login on the persisted home.
@@ -253,17 +177,12 @@ async function codexDeviceLogin(): Promise<void> {
       new WritableStream({ write: (chunk) => void (shown += chunk) }),
     );
   const drained = Promise.all([collect(login.stdout), collect(login.stderr)]);
-  const status = login.status;
   await new Promise((resolve) => setTimeout(resolve, 3000));
-  while (shown.trim() === "") {
-    const exited = await Promise.race([
-      status.then(() => true),
-      new Promise<boolean>((resolve) => setTimeout(() => resolve(false), 100)),
-    ]);
-    if (exited) throw new Error("AI bot login produced no instructions");
-  }
   await postComment(shown);
-  await Promise.all([status, drained]);
+  await Promise.all([login.status, drained]);
+  const status = await new Deno.Command("codex", { args: ["login", "status"] })
+    .output();
+  await postComment(new TextDecoder().decode(status.stdout));
 }
 
 async function runCodex(prompt: string): Promise<string> {
@@ -274,12 +193,11 @@ async function runCodex(prompt: string): Promise<string> {
   if (!loggedIn.success) await codexDeviceLogin();
   await installSuperpowers("codex");
   const file = await Deno.makeTempFile();
-  const attempt = async () => {
-    const codex = new Deno.Command("codex", {
+  const status = await new Deno.Command("codex", {
     args: [
       "exec",
       "--model",
-        model("codex"),
+      "gpt-5.5",
       "--dangerously-bypass-approvals-and-sandbox",
       "--output-last-message",
       file,
@@ -288,33 +206,15 @@ async function runCodex(prompt: string): Promise<string> {
     env: agentEnv,
     clearEnv: true,
     stdout: "inherit",
-      stderr: "piped",
-    }).spawn();
-    const decoder = new TextDecoder();
-    let error = "";
-    for await (const chunk of codex.stderr) {
-      await Deno.stderr.write(chunk);
-      error += decoder.decode(chunk, { stream: true });
-    }
-    error += decoder.decode();
-    return { status: await codex.status, error };
-  };
-  const { status } = await retryInvalidToken(attempt, async () => {
-    await run("codex", ["logout"]);
-    await codexDeviceLogin();
-  });
+    stderr: "inherit",
+  }).spawn().status;
   if (!status.success) throw new Error(`codex exited with ${status.code}`);
   return await Deno.readTextFile(file);
 }
 
-try {
 await configureGitAuthor();
 const prompt = await renderPrompt();
-  const result = BOT === "claude"
+const result = env("BOT_TYPE") === "claude"
   ? await runClaude(prompt)
   : await runCodex(prompt);
 await postResult(result);
-} catch (error) {
-  await postComment(`Bot failed: ${error}`);
-  throw error;
-}

superpowers.ts

@@ -1,42 +0,0 @@
-export type BotType = "claude" | "codex";
-
-export type InstallCommand = {
-  command: string;
-  args: string[];
-};
-
-export function parseBotType(value: string): BotType {
-  if (value === "claude" || value === "codex") return value;
-  throw new Error(`unsupported bot type: ${value}`);
-}
-
-export function superpowersInstallCommands(
-  bot: BotType,
-): InstallCommand[] {
-  if (bot === "claude") {
-    return [
-      {
-        command: "claude",
-        args: [
-          "plugin",
-          "marketplace",
-          "add",
-          "obra/superpowers-marketplace",
-        ],
-      },
-      {
-        command: "claude",
-        args: [
-          "plugin",
-          "install",
-          "-y",
-          "superpowers@superpowers-marketplace",
-        ],
-      },
-    ];
-  }
-  return [{
-    command: "codex",
-    args: ["plugin", "add", "superpowers@openai-curated-remote"],
-  }];
-}

superpowers_test.ts

@@ -1,40 +0,0 @@
-import { assertEquals, assertThrows } from "jsr:@std/assert@1";
-import { parseBotType, superpowersInstallCommands } from "./superpowers.ts";
-
-Deno.test("installs Superpowers from the Codex marketplace", () => {
-  assertEquals(superpowersInstallCommands("codex"), [{
-    command: "codex",
-    args: ["plugin", "add", "superpowers@openai-curated-remote"],
-  }]);
-});
-
-Deno.test("installs Superpowers from the Claude marketplace", () => {
-  assertEquals(superpowersInstallCommands("claude"), [
-    {
-      command: "claude",
-      args: [
-        "plugin",
-        "marketplace",
-        "add",
-        "obra/superpowers-marketplace",
-      ],
-    },
-    {
-      command: "claude",
-      args: [
-        "plugin",
-        "install",
-        "-y",
-        "superpowers@superpowers-marketplace",
-      ],
-    },
-  ]);
-});
-
-Deno.test("rejects an unsupported bot type", () => {
-  assertThrows(
-    () => parseBotType("other"),
-    Error,
-    "unsupported bot type: other",
-  );
-});